From 6e55c5c24159efe7a5e17887059d2050e0fb8fb4 Mon Sep 17 00:00:00 2001
From: Alejandro Cabeza Romero <alex93cabeza@gmail.com>
Date: Wed, 10 Jun 2026 12:28:53 +0200
Subject: [PATCH] Add flake.nix with pre-fetched rapidsnark derivations.

---
 .gitattributes  |  5 ++++
 flake.nix       | 63 +++++++++++++++++++++++++++++++++++++++++++++++++
 nix-hashes.json | 10 ++++++++
 3 files changed, 78 insertions(+)
 create mode 100644 .gitattributes
 create mode 100644 flake.nix
 create mode 100644 nix-hashes.json

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..40a2643
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,5 @@
+# Force LF for files that are read programmatically (Nix, shell scripts).
+# CRLF in RAPIDSNARK_VERSION causes a silent nix-hashes.json lookup failure.
+RAPIDSNARK_VERSION text eol=lf
+*.sh              text eol=lf
+*.nix             text eol=lf
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..2c3fb08
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,63 @@
+{
+  description = "Pre-built rapidsnark libraries (Nix)";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+
+  outputs =
+    { nixpkgs, ... }:
+    let
+      lib = nixpkgs.lib;
+
+      rapidsnarkVersion = builtins.head
+        (lib.splitString "\n" (builtins.readFile ./RAPIDSNARK_VERSION));
+
+      hashes = (builtins.fromJSON (builtins.readFile ./nix-hashes.json)).rapidsnark.${rapidsnarkVersion};
+
+      forkBase  = "https://github.com/logos-blockchain/logos-blockchain-rust-rapidsnark/releases/download/rapidsnark-pic-v${rapidsnarkVersion}";
+      iden3Base = "https://github.com/iden3/rapidsnark/releases/download/v${rapidsnarkVersion}";
+
+      # Linux PIC archives are built by us (see .github/workflows/build-pic-archives.yml);
+      # macOS archives are taken from the upstream iden3 release.
+      assetUrl = system: {
+        "x86_64-linux"   = "${forkBase}/rapidsnark-linux-x86_64-pic-v${rapidsnarkVersion}.zip";
+        "aarch64-linux"  = "${forkBase}/rapidsnark-linux-aarch64-pic-v${rapidsnarkVersion}.zip";
+        "aarch64-darwin" = "${iden3Base}/rapidsnark-macOS-arm64-v${rapidsnarkVersion}.zip";
+        "x86_64-darwin"  = "${iden3Base}/rapidsnark-macOS-x86_64-v${rapidsnarkVersion}.zip";
+      }.${system};
+
+      systems = builtins.attrNames hashes;
+      forAll  = lib.genAttrs systems;
+
+      mkRapidsnark = system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        pkgs.stdenv.mkDerivation {
+          pname   = "rapidsnark";
+          version = rapidsnarkVersion;
+          phases  = [ "installPhase" ];
+
+          # fetchzip extracts and strips the top-level directory; src points directly to the content.
+          src = pkgs.fetchzip {
+            url  = assetUrl system;
+            hash = hashes.${system};
+          };
+
+          # Exposed archives are static. Linux ones are built with -fPIC (see build-pic-archives.yml); remaining are upstream iden3.
+          installPhase = ''
+            mkdir -p $out
+            cp $src/lib/* $out/
+          '';
+
+          meta.platforms = builtins.attrNames hashes;
+
+          passthru.version = rapidsnarkVersion;
+        };
+    in
+    {
+      packages = forAll (system: {
+        rapidsnark = mkRapidsnark system;
+        default    = mkRapidsnark system;
+      });
+    };
+}
diff --git a/nix-hashes.json b/nix-hashes.json
new file mode 100644
index 0000000..a28c4c2
--- /dev/null
+++ b/nix-hashes.json
@@ -0,0 +1,10 @@
+{
+    "rapidsnark": {
+        "0.0.8": {
+            "x86_64-linux":   "sha256-88+TkECQYCKBN0WbYLRB+qi6TEhbjVfrpCqlSgm0DR8=",
+            "aarch64-linux":  "sha256-kcSITwWZjEv9gadzYL7LiG+DVtEEFbQJuhd/LTyOxJU=",
+            "aarch64-darwin": "sha256-DmhMmMq7/HKsx+Iz4rdsKYBDEwqwMZALo+ZJePJvAJg=",
+            "x86_64-darwin":  "sha256-/GCXzzT5mkBeXkVQAGEF9OmJXXcYz4KoXNzjFvhSgNU="
+        }
+    }
+}