feat(build): add Nix-native Linux toolchains

flake.nix

@@ -4,6 +4,13 @@
 {
   description = "OpenShell development environment";
 
+  nixConfig = {
+    extra-substituters = [ "https://openshell.cachix.org" ];
+    extra-trusted-public-keys = [
+      "openshell.cachix.org-1:OAr5MunsfH5PZvUsfD08OtGx5RtcwdNZGJdU5FqLm5w="
+    ];
+  };
+
   inputs = {
     flake-utils.url = "github:numtide/flake-utils";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
@@ -33,34 +40,51 @@
           inherit system;
           overlays = [ (import rust-overlay) ];
         };
+        commonDevShellPackages = with pkgs; [
+          # Assemble Debian artifacts on macOS and Linux.
+          dpkg
+          # Required to find packages.
+          pkg-config
+          # Coverage.
+          lcov
+        ];
         treefmtEval = treefmt-nix.lib.evalModule pkgs {
           projectRootFile = "flake.nix";
           programs.nixfmt.enable = true;
         };
         rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+        z3-static = pkgs.callPackage ./nix/pkgs/z3-static.nix { };
+        aws-lc-static = pkgs.callPackage ./nix/pkgs/aws-lc-static.nix { };
         testGuest = import ./nix/test-guest { inherit pkgs; };
       in
       {
         apps.test-guest = testGuest.app;
         apps.test-guest-cache = testGuest.cacheApp;
 
-        devShells.default = pkgs.mkShell {
-          packages = with pkgs; [
-            rustToolchain
-            # Assemble Debian artifacts on macOS and Linux.
-            dpkg
-            # Required to find packages
-            pkg-config
-            # Required for bindgen generation.
-            llvmPackages.libclang
-            # system dependency for openshell-prover
-            z3
-            # Coverage
-            lcov
-          ];
-
-          env = {
-            LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
+        devShells = {
+          default =
+            (pkgs.mkShell.override {
+              stdenv =
+                if pkgs.stdenv.hostPlatform.isLinux then
+                  pkgs.stdenvAdapters.useMoldLinker pkgs.stdenv
+                else
+                  pkgs.stdenv;
+            })
+              {
+                packages = [
+                  rustToolchain
+                  z3-static
+                  aws-lc-static
+                ]
+                ++ commonDevShellPackages;
+              };
+        }
+        // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
+          glibc-2-28 = import ./nix/devShells/glibc-2-28.nix {
+            inherit pkgs rust-overlay commonDevShellPackages;
+          };
+          musl = import ./nix/devShells/musl.nix {
+            inherit pkgs rust-overlay commonDevShellPackages;
           };
         };
 

nix/devShells/glibc-2-28.nix

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{
+  pkgs,
+  rust-overlay,
+  commonDevShellPackages,
+}:
+
+let
+  toolchain = import ../toolchains/linux-gnu-2.28 { inherit pkgs; };
+  z3-static = pkgs.callPackage ../pkgs/z3-static.nix {
+    stdenv = toolchain.stdenv;
+  };
+  aws-lc-static = pkgs.callPackage ../pkgs/aws-lc-static.nix {
+    stdenv = toolchain.stdenv;
+  };
+  rustScope = {
+    stdenv = toolchain.stdenv;
+    gccForLibs.lib = toolchain.sharedRuntime;
+    pkgsTargetTarget = pkgs.pkgsTargetTarget // {
+      stdenv = toolchain.stdenv;
+    };
+  };
+  rust-bin = rust-overlay.lib.mkRustBin { } (
+    pkgs
+    // rustScope
+    // {
+      callPackage = pkgs.newScope rustScope;
+    }
+  );
+in
+(pkgs.mkShell.override { stdenv = toolchain.stdenv; }) {
+  packages = [
+    (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml)
+    z3-static
+    aws-lc-static
+  ]
+  ++ commonDevShellPackages;
+}

nix/devShells/musl.nix

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{
+  pkgs,
+  rust-overlay,
+  commonDevShellPackages,
+}:
+
+let
+  muslPkgs = pkgs.pkgsMusl;
+  stdenv = pkgs.stdenvAdapters.useMoldLinker muslPkgs.stdenv;
+  rust-bin = rust-overlay.lib.mkRustBin { } muslPkgs;
+  rustToolchain = (rust-bin.fromRustupToolchainFile ../../rust-toolchain.toml).override {
+    enableLibsecret = false;
+  };
+in
+(muslPkgs.mkShell.override { inherit stdenv; }) {
+  packages = [
+    rustToolchain
+    (muslPkgs.callPackage ../pkgs/z3-static.nix { })
+    (muslPkgs.callPackage ../pkgs/aws-lc-static.nix {
+      rust-bindgen = pkgs.rust-bindgen;
+    })
+  ]
+  ++ commonDevShellPackages;
+}

nix/pkgs/aws-lc-static.nix

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{
+  aws-lc,
+  rust-bindgen,
+  stdenv,
+}:
+
+aws-lc.override {
+  inherit stdenv rust-bindgen;
+  useSharedLibraries = false;
+  withRustBindings = true;
+}

nix/pkgs/z3-static.nix

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{ z3, stdenv }:
+
+(z3.override {
+  inherit stdenv;
+  pythonBindings = false;
+}).overrideAttrs
+  (old: {
+    cmakeFlags = old.cmakeFlags ++ [ "-DZ3_BUILD_LIBZ3_SHARED=OFF" ];
+  })

nix/toolchains/linux-gnu-2.28/default.nix

@@ -0,0 +1,103 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+{ pkgs }:
+
+let
+  glibc = pkgs.callPackage ./libc.nix { };
+  mkStdenv =
+    {
+      libraryPaths ? [ ],
+      ldflags ? null,
+    }:
+    let
+      runtime = pkgs.buildEnv {
+        name = "gcc-static-runtime";
+        paths = libraryPaths ++ map pkgs.lib.getDev libraryPaths;
+        pathsToLink = [
+          "/include"
+          "/include-cxx"
+          "/lib"
+        ];
+        postBuild = ''
+          mkdir -p $out/lib
+          find $out/lib -type l ! \( -name '*.a' -o -name 'crt*.o' \) -delete
+          printf 'GROUP ( libgcc.a libgcc_eh.a )\n' > $out/lib/libgcc_s.a
+        '';
+        passthru.isGNU = true;
+      };
+    in
+    pkgs.stdenvAdapters.useMoldLinker (
+      pkgs.overrideCC pkgs.stdenv (
+        pkgs.wrapCCWith {
+          cc = pkgs.gccNGPackages.gcc-unwrapped.overrideAttrs (old: {
+            configureFlags = old.configureFlags ++ [ "--disable-fixincludes" ];
+          });
+          bintools = pkgs.wrapBintoolsWith {
+            bintools = pkgs.binutils-unwrapped;
+            libc = glibc;
+          };
+          extraPackages = [ runtime ];
+          libcxx = runtime;
+          nixSupport = {
+            cc-cflags = [
+              "-isystem${pkgs.linuxHeaders}/include"
+              "-static-libgcc"
+              "-B${runtime}/lib"
+            ];
+          }
+          // pkgs.lib.optionalAttrs (ldflags != null) { cc-ldflags = ldflags; };
+        }
+      )
+    );
+  libgcc =
+    (pkgs.gccNGPackages.libgcc.override {
+      stdenv = mkStdenv { };
+    }).overrideAttrs
+      (old: {
+        makeFlags = old.makeFlags ++ [ "SHLIB_LC=-lc" ];
+      });
+  libssp =
+    (pkgs.gccNGPackages.libssp.override {
+      stdenv = mkStdenv { libraryPaths = [ libgcc ]; };
+    }).overrideAttrs
+      {
+        dontDisableStatic = true;
+      };
+  libstdcxxStdenv = mkStdenv {
+    libraryPaths = [
+      libgcc
+      libssp
+    ];
+  };
+  libstdcxx =
+    (pkgs.gccNGPackages.libstdcxx.override {
+      stdenv = libstdcxxStdenv;
+      inherit libgcc;
+      libbacktrace = pkgs.libbacktrace.override {
+        stdenv = libstdcxxStdenv;
+      };
+    }).overrideAttrs
+      {
+        dontDisableStatic = true;
+      };
+  sharedRuntime = pkgs.buildEnv {
+    name = "gcc-shared-runtime";
+    paths = [
+      libgcc
+      libstdcxx
+    ];
+    pathsToLink = [ "/lib" ];
+  };
+  stdenv = mkStdenv {
+    libraryPaths = [
+      libgcc
+      libssp
+      libstdcxx
+    ];
+    ldflags = [ "-lssp" ];
+  };
+in
+{
+  inherit sharedRuntime stdenv;
+}