Add flake.nix with pre-fetched rapidsnark derivations.

.gitattributes

@@ -0,0 +1,5 @@
+# Force LF for files that are read programmatically (Nix, shell scripts).
+# CRLF in RAPIDSNARK_VERSION causes a silent nix-hashes.json lookup failure.
+RAPIDSNARK_VERSION text eol=lf
+*.sh              text eol=lf
+*.nix             text eol=lf

flake.nix

@@ -0,0 +1,63 @@
+{
+  description = "Pre-built rapidsnark libraries (Nix)";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+
+  outputs =
+    { nixpkgs, ... }:
+    let
+      lib = nixpkgs.lib;
+
+      rapidsnarkVersion = builtins.head
+        (lib.splitString "\n" (builtins.readFile ./RAPIDSNARK_VERSION));
+
+      hashes = (builtins.fromJSON (builtins.readFile ./nix-hashes.json)).rapidsnark.${rapidsnarkVersion};
+
+      forkBase  = "https://github.com/logos-blockchain/logos-blockchain-rust-rapidsnark/releases/download/rapidsnark-pic-v${rapidsnarkVersion}";
+      iden3Base = "https://github.com/iden3/rapidsnark/releases/download/v${rapidsnarkVersion}";
+
+      # Linux PIC archives are built by us (see .github/workflows/build-pic-archives.yml);
+      # macOS archives are taken from the upstream iden3 release.
+      assetUrl = system: {
+        "x86_64-linux"   = "${forkBase}/rapidsnark-linux-x86_64-pic-v${rapidsnarkVersion}.zip";
+        "aarch64-linux"  = "${forkBase}/rapidsnark-linux-aarch64-pic-v${rapidsnarkVersion}.zip";
+        "aarch64-darwin" = "${iden3Base}/rapidsnark-macOS-arm64-v${rapidsnarkVersion}.zip";
+        "x86_64-darwin"  = "${iden3Base}/rapidsnark-macOS-x86_64-v${rapidsnarkVersion}.zip";
+      }.${system};
+
+      systems = builtins.attrNames hashes;
+      forAll  = lib.genAttrs systems;
+
+      mkRapidsnark = system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        pkgs.stdenv.mkDerivation {
+          pname   = "rapidsnark";
+          version = rapidsnarkVersion;
+          phases  = [ "installPhase" ];
+
+          # fetchzip extracts and strips the top-level directory; src points directly to the content.
+          src = pkgs.fetchzip {
+            url  = assetUrl system;
+            hash = hashes.${system};
+          };
+
+          # Exposed archives are static. Linux ones are built with -fPIC (see build-pic-archives.yml); remaining are upstream iden3.
+          installPhase = ''
+            mkdir -p $out
+            cp $src/lib/* $out/
+          '';
+
+          meta.platforms = builtins.attrNames hashes;
+
+          passthru.version = rapidsnarkVersion;
+        };
+    in
+    {
+      packages = forAll (system: {
+        rapidsnark = mkRapidsnark system;
+        default    = mkRapidsnark system;
+      });
+    };
+}

nix-hashes.json

@@ -0,0 +1,10 @@
+{
+    "rapidsnark": {
+        "0.0.8": {
+            "x86_64-linux":   "sha256-88+TkECQYCKBN0WbYLRB+qi6TEhbjVfrpCqlSgm0DR8=",
+            "aarch64-linux":  "sha256-kcSITwWZjEv9gadzYL7LiG+DVtEEFbQJuhd/LTyOxJU=",
+            "aarch64-darwin": "sha256-DmhMmMq7/HKsx+Iz4rdsKYBDEwqwMZALo+ZJePJvAJg=",
+            "x86_64-darwin":  "sha256-/GCXzzT5mkBeXkVQAGEF9OmJXXcYz4KoXNzjFvhSgNU="
+        }
+    }
+}