clang

unvendor

06/using-nix/0-from-nixpkgs.nix

@@ -0,0 +1,77 @@
+# This is to support building protosrc/tinycc from nixpkgs, see comment in 0.nix
+
+let
+  nixpkgs = import (builtins.fetchTarball {
+    name = "pinned-nixpkgs";
+    url = "https://github.com/nixos/nixpkgs/archive/21f524672f25f8c3e7a0b5775e6505fee8fe43ce.tar.gz";
+    sha256 = "sha256:00pwazjld0bj2sp33gwiz1h8krkyf2nyid7injv5cqz5bz5jjw99";
+  }) { system = "x86_64-linux"; };
+
+  tinycc-unliberated = nixpkgs.pkgsStatic.tinycc;
+
+  tinycc-liberated = derivation {
+    name = "tinycc-liberated";
+    builder = "/bin/sh";
+    args = [ "-uexc" ''
+      ${nixpkgs.pkgs.gnused}/bin/sed \
+        's|/nix/store/.\{32\}-|!nix!store/................................-|g' \
+        < ${tinycc-unliberated}/bin/tcc \
+        > $out
+      ! ${nixpkgs.pkgs.gnugrep}/bin/grep -i /nix/store $out
+      ${nixpkgs.pkgs.coreutils}/bin/chmod +x $out
+    ''];
+    allowedReferences = [ ];
+    allowedRequisites = [ ];
+    system = "x86_64-linux";
+    __contentAddressed = true;
+    outputHashAlgo = "sha256"; outputHashMode = "recursive";
+    outputHash = "sha256-oqeOU6SFYDwpdIj8MjcQ+bMuU63CHyoV9NYdyPLFxEQ=";
+  };
+
+  source-tarball-musl = builtins.fetchurl {
+    url = "http://musl.libc.org/releases/musl-1.2.4.tar.gz";
+    sha256 = "7a35eae33d5372a7c0da1188de798726f68825513b7ae3ebe97aaaa52114f039";
+  };
+
+  source-tarball-busybox = builtins.fetchurl {
+    url = "https://busybox.net/downloads/busybox-1.36.1.tar.bz2";
+    sha256 = "b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314";
+  };
+
+  source-tarball-tinycc = builtins.fetchurl {
+    url = "https://github.com/TinyCC/tinycc/archive/af1abf1f45d45b34f0b02437f559f4dfdba7d23c.tar.gz";
+    sha256 = "sha256:0kkaax6iw28d9wl6sf14kn0gmwm0g5h9qmx9rm3awh23cq2iv9zm";
+  };
+
+  protosrc = derivation {
+    name = "protosrc";
+    builder = "/bin/sh";
+    args = [ "-uexc" ''
+      PATH=${nixpkgs.coreutils}/bin
+      PATH=$PATH:${nixpkgs.gnused}/bin
+      PATH=$PATH:${nixpkgs.gnutar}/bin
+      PATH=$PATH:${nixpkgs.gzip}/bin
+      PATH=$PATH:${nixpkgs.bzip2}/bin
+      export PATH
+      mkdir downloads/
+      cp ${source-tarball-musl} downloads/musl-1.2.4.tar.gz
+      cp ${source-tarball-busybox} downloads/busybox-1.36.1.tar.bz2
+      cp ${source-tarball-tinycc} downloads/tinycc-mob-af1abf1.tar.gz
+      mkdir -p recipes
+      cp -r ${../recipes/1-stage1} recipes/1-stage1
+      DESTDIR=$out ${nixpkgs.bash}/bin/bash \
+        ${../recipes/1-stage1/seed.host-executed.sh}
+      mv $out/protosrc/* $out/; rm -d $out/protosrc
+    ''];
+    allowedReferences = [ ];
+    allowedRequisites = [ ];
+    system = "x86_64-linux";
+    __contentAddressed = true;
+    outputHashAlgo = "sha256"; outputHashMode = "recursive";
+    outputHash = "sha256-upUZTTumJgBY16waF6L8ZeWbflSuQL9TMmwLw0YEDqM=";
+  };
+in
+  {
+    tinycc = tinycc-liberated;
+    inherit protosrc;
+  }

06/using-nix/0-prebuilt.nix

@@ -0,0 +1,28 @@
+# This is to prefetch protosrc/tinycc from github, see comment in 0.nix
+
+let
+  fetchTarball = { name, url, sha256 }: derivation {
+    inherit name url;
+    urls = [ url ];
+    unpack = true;
+
+    builder = "builtin:fetchurl";
+    system = "builtin";
+    outputHashMode = "recursive"; outputHashAlgo = "sha256";
+    preferLocalBuild = true;
+    outputHash = sha256;
+  };
+in
+  {
+    protosrc = fetchTarball {
+      name = "protosrc";
+      url = "https://github.com/ZilchOS/bootstrap-from-tcc/releases/download/seeding-files-r004/protosrc.nar";
+      sha256 = "sha256-upUZTTumJgBY16waF6L8ZeWbflSuQL9TMmwLw0YEDqM=";
+    };
+
+    tinycc = fetchTarball {
+      name = "tinycc-liberated";
+      url = "https://github.com/ZilchOS/bootstrap-from-tcc/releases/download/seeding-files-r004/tinycc-liberated.nar";
+      sha256 = "sha256-oqeOU6SFYDwpdIj8MjcQ+bMuU63CHyoV9NYdyPLFxEQ=";
+    };
+  }

06/using-nix/0.nix

@@ -0,0 +1,35 @@
+# Where do tcc-seed and protosrc come from if you build with Nix?
+
+# When building with `make` or `build.sh` you'll have tcc-seed and protosrc
+# long long before you have Nix,
+# so there's no question of where to take them from, you just inject'em.
+# In this case this file isn't used at all and a simpler 0.nix is generated,
+# see recipes/4-rebootstrap-using-nix.sh
+
+# But not everyone wants to go the full bootstrap route.
+# This file is for when you already have Nix and want to jump into the middle,
+# starting from the second, `using-nix` half of the bootstrap.
+# Cases like hydra or flake-building.
+
+# One option is to build them using nixpkgs (see 0-from-nixpkgs.nix),
+# but then you need nixpkgs, IFD and stuff.
+
+# Alternatively we could download them prebuilt from github:ZilchOS,
+# but then there's the question of falling back to another method
+# when recipes/1-stage1/seed.host-executed.sh or recipes/1-stage1/syscall.h
+# are updated.
+
+# Here's one weird combined approach:
+
+let
+  and = builtins.all (x: x);
+  syscall_h_ours = "${../recipes/1-stage1/syscall.h}";
+  syscall_h_reference = "/nix/store/678g5j997qzp0srprfg4gqqxcp8mr3g9-syscall.h";
+  syscall_h_is_unmodified = (syscall_h_ours == syscall_h_reference);
+  stage1_seeder_ours = "${../recipes/1-stage1/seed.host-executed.sh}";
+  stage1_seeder_reference = "/nix/store/qv4rmbdclws5nrx3m1vw1pb98qacw226-seed.host-executed.sh";
+  stage1_seeder_is_unmodified = (stage1_seeder_ours == stage1_seeder_reference);
+in
+  if (and [ syscall_h_is_unmodified stage1_seeder_is_unmodified ])
+  then import ./0-prebuilt.nix
+  else import ./0-from-nixpkgs.nix

06/using-nix/1-stage1.nix

@@ -0,0 +1,26 @@
+{ tcc-seed, protosrc, recipesStage1ExtrasPath, stage1cPath }:
+
+derivation {
+  name = "bootstrap-1-stage1";
+  builder = "/bin/sh";  # purely to pass $vars, which is silly
+  args = [ "-c" ''
+    ${tcc-seed} \
+      -nostdinc -nostdlib -Werror \
+      -I${recipesStage1ExtrasPath} \
+      -DINSIDE_NIX \
+      -DPROTOSRC='"'${protosrc}'"' \
+      -DTCC_SEED='"'${tcc-seed}'"' \
+      -DRECIPES_STAGE1='"'${recipesStage1ExtrasPath}'"' \
+      -DTMP_STAGE1='"'$TMPDIR/tmp'"' \
+      -DSTORE_PROTOBUSYBOX='"'$protobusybox/'"' \
+      -DSTORE_PROTOMUSL='"'$protomusl'"' \
+      -DSTORE_TINYCC='"'$tinycc'"' \
+      -run ${stage1cPath}
+  ''];
+  outputs = [ "protobusybox" "protomusl" "tinycc" ];
+  allowedReferences = [ "protobusybox" "protomusl" "tinycc" ];
+  allowedRequisites = [ "protobusybox" "protomusl" "tinycc" ];
+  system = "x86_64-linux";
+  __contentAddressed = true;
+  outputHashAlgo = "sha256"; outputHashMode = "recursive";
+}

06/using-nix/2a0-static-gnumake.nix

@@ -0,0 +1,70 @@
+{ fetchurl, mkDerivationStage2, stage1 }:
+
+let
+  source-tarball-gnumake = fetchurl {
+    # local = /downloads/make-4.4.1.tar.gz;
+    url = "http://ftp.gnu.org/gnu/make/make-4.4.1.tar.gz";
+    sha256 = "dd16fb1d67bfab79a72f5e8390735c49e3e8e70b4945a15ab1f81ddb78658fb3";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a0-static-gnumake";
+    buildInputPaths = [
+      "${stage1.tinycc}/wrappers"
+      "${stage1.protobusybox}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # unpack:
+        unpack ${source-tarball-gnumake}
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' \
+                src/job.c build-aux/install-sh po/Makefile.in.in
+        # this is part of stdlib, no idea how it's supposed to not clash
+        rm src/getopt.h
+        for f in src/getopt.c src/getopt1.c lib/fnmatch.c; do :> $f; done
+        for f in lib/glob.c lib/xmalloc.c lib/error.c; do :> $f; done
+      # embrace chaos
+        shuffle_comment='\/\* Handle shuffle mode argument.  \*\/'
+        shuffle_default='if (!shuffle_mode) shuffle_mode = xstrdup(\"random\");'
+        sed -i "s|$shuffle_comment|$shuffle_comment\n$shuffle_default|" \
+               src/main.c
+        grep 'if (!shuffle_mode) shuffle_mode = xstrdup("random");' src/main.c
+      # configure:
+        ash ./configure \
+                --build x86_64-linux \
+                --disable-dependency-tracking \
+                --prefix=$out \
+                CONFIG_SHELL='${stage1.protobusybox}/bin/ash' \
+                SHELL='${stage1.protobusybox}/bin/ash'
+      # bootstrap build:
+        ash ./build.sh
+      # test static GNU Make by remaking it with itself:
+        mv make make-intermediate
+        ./make-intermediate -j $NPROC clean
+        ./make-intermediate -j $NPROC
+      # reconfigure:
+        ash ./configure \
+                --build x86_64-linux \
+                --disable-dependency-tracking \
+                --prefix=$out \
+                CONFIG_SHELL='${stage1.protobusybox}/bin/ash' \
+                SHELL='${stage1.protobusybox}/bin/ash'
+      # rebuild:
+        ash ./build.sh
+      # test:
+        mv make make-intermediate
+        ./make-intermediate -j $NPROC clean
+        ./make-intermediate -j $NPROC CFLAGS=-O2
+      # install:
+        ./make -j $NPROC install
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+      # wrap:
+        # FIXME: patch make to use getenv?
+        mkdir -p $out/wrappers; cd $out/wrappers
+        echo "#!${stage1.protobusybox}/bin/ash" > make
+        echo "exec $out/bin/make SHELL=\$SHELL \"\$@\"" \ >> make
+        chmod +x make
+    '';
+  }

06/using-nix/2a1-static-binutils.nix

@@ -0,0 +1,56 @@
+{ fetchurl, mkDerivationStage2, stage1, static-gnumake }:
+
+let
+  source-tarball-binutils = fetchurl {
+    # local = /downloads/binutils-2.39.tar.xz;
+    url = "https://ftp.gnu.org/gnu/binutils/binutils-2.39.tar.xz";
+    sha256 = "645c25f563b8adc0a81dbd6a41cffbf4d37083a382e02d5d3df4f65c09516d00";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a1-static-binutils";
+    buildInputPaths = [
+      "${stage1.tinycc}/wrappers"
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # unpack:
+        unpack ${source-tarball-binutils}
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' \
+                missing install-sh mkinstalldirs
+        # see libtool's 74c8993c178a1386ea5e2363a01d919738402f30
+        sed -i 's/| \$NL2SP/| sort | $NL2SP/' ltmain.sh
+        sed -i 's|__FILE__|"__FILE__"|' \
+          ld/*.c ld/*.h bfd/*.* libctf/*.* opcodes/*.*
+        sed -i 's| -g | |' ld/Makefile*
+      # alias makeinfo to true
+        mkdir aliases
+        ln -s ${stage1.protobusybox}/bin/true aliases/makeinfo
+        PATH="$(pwd)/aliases/:$PATH"
+      # configure:
+        export lt_cv_sys_max_cmd_len=32768
+        export ac_cv_func_strncmp_works=no
+        ash ./configure \
+                CONFIG_SHELL='${stage1.protobusybox}/bin/ash' \
+                SHELL='${stage1.protobusybox}/bin/ash' \
+                CFLAGS='-O2 -D__LITTLE_ENDIAN__=1' \
+                CFLAGS_FOR_TARGET=-O2 \
+                --enable-deterministic-archives \
+                --disable-gprofng \
+                --host x86_64-linux --build x86_64-linux \
+                --prefix=$out
+      # build:
+        make -j $NPROC \
+                all-libiberty all-gas all-bfd all-libctf all-zlib all-gprof
+        make all-ld  # race condition on ld/.deps/ldwrite.Po, serialize
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+        rm $out/lib/*.la  # broken, reference builddir
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a2-static-gnugcc4-c.nix

@@ -0,0 +1,85 @@
+{ fetchurl, mkDerivationStage2, stage1, static-gnumake, static-binutils }:
+
+let
+  source-tarball-gcc = fetchurl {
+    # local = /downloads/gcc-4.7.4.tar.bz2;
+    url = "https://ftp.gnu.org/gnu/gcc/gcc-4.7.4/gcc-4.7.4.tar.bz2";
+    sha256 = "92e61c6dc3a0a449e62d72a38185fda550168a86702dea07125ebd3ec3996282";
+  };
+  source-tarball-gmp = fetchurl {
+    # local = /downloads/gmp-4.3.2.tar.xz;
+    url = "https://gmplib.org/download/gmp/archive/gmp-4.3.2.tar.xz";
+    sha256 = "f69eff1bc3d15d4e59011d587c57462a8d3d32cf2378d32d30d008a42a863325";
+  };
+  source-tarball-mpfr = fetchurl {
+    # local = /downloads/mpfr-2.4.2.tar.xz;
+    url = "https://www.mpfr.org/mpfr-2.4.2/mpfr-2.4.2.tar.xz";
+    sha256 = "d7271bbfbc9ddf387d3919df8318cd7192c67b232919bfa1cb3202d07843da1b";
+  };
+  source-tarball-mpc = fetchurl {
+    # local = /downloads/mpc-0.8.1.tar.gz;
+    url = "http://www.multiprecision.org/downloads/mpc-0.8.1.tar.gz";
+    sha256 = "e664603757251fd8a352848276497a4c79b7f8b21fd8aedd5cc0598a38fee3e4";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a2-static-gnugcc4-c";
+    buildInputPaths = [
+      "${stage1.tinycc}/wrappers"
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # alias ash to sh:
+        mkdir aliases; ln -s ${stage1.protobusybox}/bin/ash aliases/sh
+        export PATH="$(pwd)/aliases:$PATH"
+      # unpack:
+        unpack ${source-tarball-gcc}
+        mkdir mpfr mpc gmp
+        unpack ${source-tarball-mpfr} -C mpfr
+        unpack ${source-tarball-mpc} -C mpc
+        unpack ${source-tarball-gmp} -C gmp
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' \
+          missing move-if-change mkdep mkinstalldirs symlink-tree \
+          gcc/genmultilib */*.sh gcc/exec-tool.in \
+          install-sh */install-sh
+        sed -i 's|^\(\s*\)sh |\1${stage1.protobusybox}/bin/ash |' \
+          Makefile* */Makefile*
+        sed -i 's|LIBGCC2_DEBUG_CFLAGS = -g|LIBGCC2_DEBUG_CFLAGS = |' \
+          libgcc/Makefile.in
+        # see libtool's 74c8993c178a1386ea5e2363a01d919738402f30
+        sed -i 's/| \$NL2SP/| sort | $NL2SP/' ltmain.sh */ltmain.sh
+        sed -i 's|#define HAVE_HOST_CORE2 1||' mpfr/configure
+      # configure:
+        export ac_cv_func_strncmp_works=no
+        export ac_cv_func_alloca_works=no
+        export ac_cv_prog_make_make_set=no
+        ash configure \
+          CONFIG_SHELL='${stage1.protobusybox}/bin/ash' \
+          SHELL='${stage1.protobusybox}/bin/ash' \
+          CFLAGS=-O2 CFLAGS_FOR_TARGET=-O2 \
+          --with-sysroot=${stage1.protomusl} \
+          --with-native-system-header-dir=/include \
+          --with-build-time-tools=${static-binutils}/bin \
+          --prefix=$out \
+          --enable-languages=c \
+          --disable-bootstrap \
+          --disable-libquadmath --disable-decimal-float --disable-fixed-point \
+          --disable-lto \
+          --disable-libgomp \
+          --disable-multilib \
+          --disable-multiarch \
+          --disable-libmudflap \
+          --disable-libssp \
+          --disable-nls \
+          --host x86_64-linux --build x86_64-linux
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a3-intermediate-musl.nix

@@ -0,0 +1,42 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, static-binutils, static-gnugcc4-c }:
+
+let
+  source-tarball-musl = fetchurl {
+    # local = /downloads/musl-1.2.4.tar.gz;
+    url = "http://musl.libc.org/releases/musl-1.2.4.tar.gz";
+    sha256 = "7a35eae33d5372a7c0da1188de798726f68825513b7ae3ebe97aaaa52114f039";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a3-intermediate-musl";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+      "${static-binutils}/bin"
+      "${static-gnugcc4-c}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # unpack:
+        unpack ${source-tarball-musl}
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' \
+                tools/*.sh \
+        # patch popen/system to search in PATH instead of hardcoding /bin/sh
+        sed -i 's|posix_spawn(&pid, "/bin/sh",|posix_spawnp(\&pid, "sh",|' \
+                src/stdio/popen.c src/process/system.c
+        sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
+                src/misc/wordexp.c
+        # eliminate a source path reference
+        sed -i 's/__FILE__/"__FILE__"/' include/assert.h
+      # configure:
+        ash ./configure --prefix=$out
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a4-gnugcc4-cpp.nix

@@ -0,0 +1,113 @@
+{ fetchurl, mkDerivationStage2
+, stage1
+, static-gnumake, static-binutils, static-gnugcc4-c, intermediate-musl }:
+
+let
+  source-tarball-gcc = fetchurl {
+    # local = /downloads/gcc-4.7.4.tar.bz2;
+    url = "https://ftp.gnu.org/gnu/gcc/gcc-4.7.4/gcc-4.7.4.tar.bz2";
+    sha256 = "92e61c6dc3a0a449e62d72a38185fda550168a86702dea07125ebd3ec3996282";
+  };
+  source-tarball-gmp = fetchurl {
+    # local = /downloads/gmp-4.3.2.tar.xz;
+    url = "https://gmplib.org/download/gmp/archive/gmp-4.3.2.tar.xz";
+    sha256 = "f69eff1bc3d15d4e59011d587c57462a8d3d32cf2378d32d30d008a42a863325";
+  };
+  source-tarball-mpfr = fetchurl {
+    # local = /downloads/mpfr-2.4.2.tar.xz;
+    url = "https://www.mpfr.org/mpfr-2.4.2/mpfr-2.4.2.tar.xz";
+    sha256 = "d7271bbfbc9ddf387d3919df8318cd7192c67b232919bfa1cb3202d07843da1b";
+  };
+  source-tarball-mpc = fetchurl {
+    # local = /downloads/mpc-0.8.1.tar.gz;
+    url = "http://www.multiprecision.org/downloads/mpc-0.8.1.tar.gz";
+    sha256 = "e664603757251fd8a352848276497a4c79b7f8b21fd8aedd5cc0598a38fee3e4";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a4-gnugcc4-cpp";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+      "${static-binutils}/bin"
+      "${static-gnugcc4-c}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # alias ash to sh:
+        mkdir aliases; ln -s ${stage1.protobusybox}/bin/ash aliases/sh
+        export PATH="$(pwd)/aliases:$PATH"
+      # create wrappers that make previous GNU GCC target new musl:
+        SYSROOT=${intermediate-musl}
+        export _SYSROOT="--sysroot $SYSROOT"
+        export _LDFLAG="--dynamic-linker=$SYSROOT/lib/libc.so"
+        export _NEWINC="-I$SYSROOT/include"
+        export _REALCC="-I$SYSROOT/include"
+        mkdir wrappers
+        echo '#!${stage1.protobusybox}/bin/ash' > wrappers/cc
+        echo '#!${stage1.protobusybox}/bin/ash' > wrappers/cpp
+        echo '#!${stage1.protobusybox}/bin/ash' > wrappers/ld
+        echo 'exec gcc $_SYSROOT -Wl,$_LDFLAG "$@"' >> wrappers/cc
+        echo 'exec ${static-gnugcc4-c}/bin/cpp $_NEWINC "$@"' \
+          >> wrappers/cpp
+        echo 'exec ${static-binutils}/bin/ld $_LDFLAG "$@"' \
+          >> wrappers/ld
+        chmod +x wrappers/cc wrappers/cpp wrappers/ld
+        export PATH="$(pwd)/wrappers:$PATH"
+      # unpack:
+        unpack ${source-tarball-gcc}
+        mkdir mpfr mpc gmp
+        unpack ${source-tarball-mpfr} -C mpfr
+        unpack ${source-tarball-mpc} -C mpc
+        unpack ${source-tarball-gmp} -C gmp
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' \
+          missing move-if-change mkdep mkinstalldirs symlink-tree \
+          gcc/genmultilib */*.sh gcc/exec-tool.in \
+          install-sh */install-sh
+        sed -i 's|^\(\s*\)sh |\1${stage1.protobusybox}/bin/ash |' \
+          Makefile* */Makefile*
+        sed -i "s|/lib64/ld-linux-x86-64.so.2|$SYSROOT/lib/libc.so|" \
+          gcc/config/i386/linux64.h
+        sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+        sed -i 's|LIBGCC2_DEBUG_CFLAGS = -g|LIBGCC2_DEBUG_CFLAGS = |' \
+          libgcc/Makefile.in
+        # see libtool's 74c8993c178a1386ea5e2363a01d919738402f30
+        sed -i 's/| \$NL2SP/| sort | $NL2SP/' ltmain.sh */ltmain.sh
+        sed -i 's|#define HAVE_HOST_CORE2 1||' mpfr/configure
+      # configure:
+        export ac_cv_func_strncmp_works=no
+        export ac_cv_func_alloca_works=no
+        export ac_cv_prog_make_make_set=no
+        export glibcxx_cv_random_tr1=no
+        ash configure \
+          cache_file=nonex \
+          CONFIG_SHELL='${stage1.protobusybox}/bin/ash' \
+          SHELL='${stage1.protobusybox}/bin/ash' \
+          CC=cc CPP=cpp LD=ld \
+          CFLAGS=-O2 CFLAGS_FOR_TARGET=-O2 \
+          --with-sysroot=$SYSROOT \
+          --with-native-system-header-dir=/include \
+          --with-build-time-tools=${static-binutils}/bin \
+          --prefix=$out \
+          --with-specs='%{!static:%x{-rpath=$out/lib64}}' \
+          --enable-languages=c,c++ \
+          --disable-bootstrap \
+          --disable-libquadmath --disable-decimal-float --disable-fixed-point \
+          --disable-lto \
+          --disable-libgomp \
+          --disable-multilib \
+          --disable-multiarch \
+          --disable-libmudflap \
+          --disable-libssp \
+          --disable-nls \
+          --disable-libitm \
+          --host x86_64-linux --build x86_64-linux
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a5-gnugcc10.nix

@@ -0,0 +1,104 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, static-binutils, intermediate-musl, gnugcc4-cpp }:
+
+let
+  source-tarball-gcc = fetchurl {
+    # local = /downloads/gcc-10.5.0.tar.xz;
+    url = "https://ftp.gnu.org/gnu/gcc/gcc-10.5.0/gcc-10.5.0.tar.xz";
+    sha256 = "25109543fdf46f397c347b5d8b7a2c7e5694a5a51cce4b9c6e1ea8a71ca307c1";
+  };
+  source-tarball-gmp = fetchurl {
+    # local = /downloads/gmp-6.1.0.tar.xz;
+    url = "https://gmplib.org/download/gmp/gmp-6.1.0.tar.xz";
+    sha256 = "68dadacce515b0f8a54f510edf07c1b636492bcdb8e8d54c56eb216225d16989";
+  };
+  source-tarball-mpfr = fetchurl {
+    # local = /downloads/mpfr-3.1.4.tar.xz;
+    url = "https://www.mpfr.org/mpfr-3.1.4/mpfr-3.1.4.tar.xz";
+    sha256 = "761413b16d749c53e2bfd2b1dfaa3b027b0e793e404b90b5fbaeef60af6517f5";
+  };
+  source-tarball-mpc = fetchurl {
+    # local = /downloads/mpc-1.0.3.tar.gz;
+    url = "http://www.multiprecision.org/downloads/mpc-1.0.3.tar.gz";
+    sha256 = "617decc6ea09889fb08ede330917a00b16809b8db88c29c31bfbb49cbf88ecc3";
+  };
+  source-tarball-isl = fetchurl {
+    # local = /downloads/isl-0.18.tar.bz2;
+    url = "http://gcc.gnu.org/pub/gcc/infrastructure/isl-0.18.tar.bz2";
+    sha256 = "6b8b0fd7f81d0a957beb3679c81bbb34ccc7568d5682844d8924424a0dadcb1b";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a5-gnugcc10";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+      "${static-binutils}/bin"
+      "${gnugcc4-cpp}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # alias ash to sh:
+        mkdir aliases; ln -s ${stage1.protobusybox}/bin/ash aliases/sh
+        export PATH="$(pwd)/aliases:$PATH"
+      # unpack:
+        unpack ${source-tarball-gcc}
+        mkdir mpfr mpc gmp isl
+        unpack ${source-tarball-mpfr} -C mpfr
+        unpack ${source-tarball-mpc} -C mpc
+        unpack ${source-tarball-gmp} -C gmp
+        unpack ${source-tarball-isl} -C isl
+      # fixup:
+        SYSROOT=${intermediate-musl}
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' \
+          missing move-if-change mkdep mkinstalldirs symlink-tree install-sh \
+          gcc/exec-tool.in gcc/genmultilib libgcc/mkheader.sh
+        sed -i 's|^\(\s*\)sh |\1${stage1.protobusybox}/bin/ash |' \
+          libgcc/Makefile.in
+        sed -i "s|/lib/ld-musl-x86_64.so.1|$SYSROOT/lib/libc.so|" \
+          gcc/config/i386/linux64.h
+        sed -i 's|m64=../lib64|m64=../lib|' gcc/config/i386/t-linux64
+        sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+        sed -i 's|LIBGCC2_DEBUG_CFLAGS = -g|LIBGCC2_DEBUG_CFLAGS = |' \
+          libgcc/Makefile.in
+        # see libtool's 74c8993c178a1386ea5e2363a01d919738402f30
+        sed -i 's/| \$NL2SP/| sort | $NL2SP/' ltmain.sh */ltmain.sh
+      # configure:
+        export ac_cv_func_strncmp_works=no
+        export ac_cv_prog_make_make_set=no
+        export glibcxx_cv_dev_random=no
+        ash configure \
+          CONFIG_SHELL='${stage1.protobusybox}/bin/ash' \
+          SHELL='${stage1.protobusybox}/bin/ash' \
+          CFLAGS=-O2 CXXFLAGS=-O2 \
+          CFLAGS_FOR_TARGET=-O2 CXXFLAGS_FOR_TARGET=-O2 \
+          --with-sysroot=$SYSROOT \
+          --with-native-system-header-dir=/include \
+          --with-build-time-tools=${static-binutils}/bin \
+          --prefix=$out \
+          --with-specs='%{!static:%x{-rpath=$out/lib}}' \
+          --enable-languages=c,c++ \
+          --disable-bootstrap \
+          --disable-libquadmath --disable-decimal-float --disable-fixed-point \
+          --disable-lto \
+          --disable-libgomp \
+          --disable-multilib \
+          --disable-multiarch \
+          --disable-libmudflap \
+          --disable-libssp \
+          --disable-nls \
+          --disable-libitm \
+          --disable-libsanitizer \
+          --disable-cet \
+          --disable-gnu-unique-object \
+          --disable-gcov \
+          --disable-checking \
+          --host x86_64-linux-musl --build x86_64-linux-musl
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a6-linux-headers.nix

@@ -0,0 +1,39 @@
+{ fetchurl, mkDerivationStage2, stage1, static-gnumake, static-binutils, gnugcc10 }:
+
+let
+  source-tarball-linux = fetchurl {
+    # local = /downloads/linux-6.4.12.tar.xz;
+    url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.4.12.tar.xz";
+    sha256 = "cca91be956fe081f8f6da72034cded96fe35a50be4bfb7e103e354aa2159a674";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a6-linux-headers";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+      "${static-binutils}/bin"
+      "${gnugcc10}/bin"
+    ];
+    script = ''
+      # unpack:
+        mkdir build-dir; cd build-dir
+        unpack ${source-tarball-linux} \
+          linux-6.4.12/Makefile \
+          linux-6.4.12/arch/x86 \
+          linux-6.4.12/include \
+          linux-6.4.12/scripts \
+          linux-6.4.12/tools
+      # build:
+        make -j $NPROC \
+                CONFIG_SHELL=${stage1.protobusybox}/bin/ash \
+                CC=gcc HOSTCC=gcc ARCH=x86_64 \
+                headers
+      # install:
+        find usr/include -name '.*' | xargs rm
+        mkdir -p $out
+        cp -rv usr/include $out/
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a7-cmake.nix

@@ -0,0 +1,51 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, static-binutils, gnugcc10, linux-headers }:
+
+let
+  source-tarball-cmake = fetchurl {
+    # local = /downloads/cmake-3.27.4.tar.gz;
+    url = "https://github.com/Kitware/CMake/releases/download/v3.27.4/cmake-3.27.4.tar.gz";
+    sha256 = "0a905ca8635ca81aa152e123bdde7e54cbe764fdd9a70d62af44cad8b92967af";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a7-cmake";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/wrappers"
+      "${static-binutils}/bin"
+      "${gnugcc10}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+        export SHELL=${stage1.protobusybox}/bin/ash
+      # unpack:
+        unpack ${source-tarball-cmake}
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' bootstrap
+        sed -i 's|__FILE__|"__FILE__"|' \
+          Source/CPack/IFW/cmCPackIFWCommon.h \
+          Source/CPack/cmCPack*.h \
+          Source/cmCTest.h
+      # bundle libraries:
+        # poor man's static linking, a way for cmake to be self-contained later
+        mkdir -p $out/bundled-runtime
+        cp -H ${gnugcc10}/lib/libstdc++.so.6 $out/bundled-runtime/
+        cp -H ${gnugcc10}/lib/libgcc_s.so.1 $out/bundled-runtime/
+      # configure:
+        ash configure \
+          CFLAGS="-DCPU_SETSIZE=128 -D_GNU_SOURCE" \
+          CXXFLAGS="-isystem ${linux-headers}/include" \
+          LDFLAGS="-Wl,-rpath $out/bundled-runtime" \
+          --prefix=$out \
+          --parallel=$NPROC \
+          -- \
+          -DCMAKE_USE_OPENSSL=OFF
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install/strip
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2a8-python.nix

@@ -0,0 +1,74 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, static-binutils, gnugcc10 }:
+
+let
+  source-tarball-python = fetchurl {
+    # local = /downloads/Python-3.12.0.tar.xz;
+    url = "https://www.python.org/ftp/python/3.12.0/Python-3.12.0.tar.xz";
+    sha256 = "795c34f44df45a0e9b9710c8c71c15c671871524cd412ca14def212e8ccb155d";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a8-python";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/wrappers"
+      "${static-binutils}/bin"
+      "${gnugcc10}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+        export SHELL=${stage1.protobusybox}/bin/ash
+      # alias ash to sh:
+        mkdir aliases; ln -s ${stage1.protobusybox}/bin/ash aliases/sh
+        export PATH="$(pwd)/aliases:$PATH"
+      # unpack:
+        unpack ${source-tarball-python}
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' configure install-sh
+        sed -i 's|ac_sys_system=`uname -s`|ac_sys_system=Linux|' configure
+        # the precompiled pyc files aren't reproducible,
+        # but it's not like I need to waste time on them anyway.
+        # break their generation
+        mv Lib/compileall.py Lib/compileall.py.bak
+        echo 'import sys; sys.exit(0)' > Lib/compileall.py
+        chmod +x Lib/compileall.py
+        sed -i 's|__FILE__|"__FILE__"|' \
+          Python/errors.c \
+          Include/pyerrors.h \
+          Include/cpython/object.h \
+          Modules/pyexpat.c
+        sed -i 's|TIME __TIME__|TIME "xx:xx:xx"|' Modules/getbuildinfo.c
+        sed -i 's|DATE __DATE__|DATE "xx/xx/xx"|' Modules/getbuildinfo.c
+        # different build path length leads to different wrapping. avoid
+        sed -i 's|vars, stream=f|vars, stream=f, width=2**24|' Lib/sysconfig.py
+      # configure:
+        mkdir -p $out/lib
+        ash configure \
+          ac_cv_broken_sem_getvalue=yes \
+          ac_cv_posix_semaphores_enabled=no \
+          OPT='-DNDEBUG -fwrapv -O3 -Wall' \
+          LDFLAGS="-Wl,-rpath $out/lib" \
+          --without-static-libpython \
+          --build x86_64-linux-musl \
+          --prefix=$out \
+          --enable-shared \
+          --with-ensurepip=no
+        # ensure reproducibility in case of no /dev/shm
+        grep 'define POSIX_SEMAPHORES_NOT_ENABLED 1' pyconfig.h
+        grep 'define HAVE_BROKEN_SEM_GETVALUE 1' pyconfig.h
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+      # strip builddir mentions:
+        sed -i "s|$(pwd)|...|g" \
+          $out/lib/python3.*/_sysconfigdata__*.py \
+          $out/lib/python3.*/config-3.*-x86_64-linux-musl/Makefile
+        # restore compileall just in case
+        cat Lib/compileall.py.bak > $out/lib/python3.12/compileall.py
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }
+

06/using-nix/2a9-intermediate-clang.nix

@@ -0,0 +1,145 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, static-binutils, intermediate-musl, gnugcc10
+, linux-headers, cmake, python}:
+
+let
+  source-tarball-llvm = fetchurl {
+    # local = /downloads/llvm-project-17.0.1.src.tar.xz;
+    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.1/llvm-project-17.0.1.src.tar.xz";
+    sha256 = "b0e42aafc01ece2ca2b42e3526f54bebc4b1f1dc8de6e34f46a0446a13e882b9";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2a9-intermediate-clang";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/wrappers"
+      "${static-binutils}/bin"
+      "${gnugcc10}/bin"
+      "${cmake}/bin"
+      "${python}/bin"
+    ];
+    script = ''
+        # Shared libs are not relinked on install. Instead, their rpath
+        # is erased with RPATH_SET: `Set runtime path of
+        # "/nix/store/.../lib/x86_64-unknown-linux-musl/libc++.so.1.0" to ""`
+        # One (hacky) workaround to that is using a constant-len build-dir.
+        build_dir=build-dir; expr "$(pwd)/$build_dir)" '<=' 128
+        while ! echo "$(pwd)/$build_dir" | wc -c | grep -Fqx 128; do
+          build_dir="$build_dir."
+        done; expr "$(echo $(pwd)/$build_dir | wc -c)" '==' 128
+        mkdir $build_dir; cd $build_dir
+        export SHELL=${stage1.protobusybox}/bin/ash
+        # llvm cmake configuration should pick up ccache automatically from PATH
+        export PATH="$PATH:/ccache/bin"
+        command -v ccache && USE_CCACHE=YES || USE_CCACHE=NO
+      # prepare future sysroot:
+        SYSROOT=$out/sysroot
+        mkdir -p $SYSROOT/lib $SYSROOT/include
+        ln -s ${intermediate-musl}/lib/* $SYSROOT/lib/
+        ln -s ${intermediate-musl}/include/* $SYSROOT/include/
+      # unpack:
+        unpack ${source-tarball-llvm}
+      # fixup:
+        sed -i "s|COMMAND sh|COMMAND ${stage1.protobusybox}/bin/ash|" \
+          llvm/cmake/modules/GetHostTriple.cmake clang/CMakeLists.txt
+        echo 'echo x86_64-unknown-linux-musl' > llvm/cmake/config.guess
+        LOADER=${intermediate-musl}/lib/libc.so
+        sed -i "s|/lib/ld-musl-\" + ArchName + \".so.1|$LOADER|" \
+          clang/lib/Driver/ToolChains/Linux.cpp
+        BEGINEND='const bool HasCRTBeginEndFiles'
+        sed -i "s|$BEGINEND =|$BEGINEND = false; ''${BEGINEND}_unused =|" \
+          clang/lib/Driver/ToolChains/Gnu.cpp
+        REL_ORIGIN='_install_rpath \"\$ORIGIN/../lib''${LLVM_LIBDIR_SUFFIX}\"'
+        sed -i "s|_install_rpath \"\\\\\$ORIGIN/..|_install_rpath \"$out|" \
+          llvm/cmake/modules/AddLLVM.cmake
+        sed -i 's|numShards = 32;|numShards = 1;|' lld/*/SyntheticSections.*
+        sed -i 's|numShards = 256;|numShards = 1;|' lld/*/ICF.cpp
+        sed -i 's|__FILE__|"__FILE__"|' \
+          libcxx/src/verbose_abort.cpp \
+          libcxxabi/src/abort_message.cpp \
+          compiler-rt/lib/builtins/int_util.h
+        sed -i 's|"@LLVM_SRC_ROOT@"|"REDACTED"|' \
+          llvm/tools/llvm-config/BuildVariables.inc.in
+        sed -i 's|"@LLVM_OBJ_ROOT@"|"REDACTED"|' \
+          llvm/tools/llvm-config/BuildVariables.inc.in
+      # figure out includes:
+        EXTRA_INCL="$(pwd)/extra_includes"
+        mkdir -p $EXTRA_INCL
+        cp clang/lib/Headers/*intrin*.h $EXTRA_INCL/
+        cp clang/lib/Headers/mm_malloc.h $EXTRA_INCL/
+        [ -e $EXTRA_INCL/immintrin.h ]
+      # configure:
+        export LD_LIBRARY_PATH=${gnugcc10}/lib
+        BOTH_STAGES_OPTS=""
+        add_opt() {
+          BOTH_STAGES_OPTS="$BOTH_STAGES_OPTS -D$1 -DBOOTSTRAP_$1"
+        }
+        add_opt CMAKE_BUILD_TYPE=MinSizeRel
+        add_opt LLVM_OPTIMIZED_TABLEGEN=YES
+        add_opt LLVM_CCACHE_BUILD=$USE_CCACHE
+        add_opt DEFAULT_SYSROOT=$SYSROOT
+        add_opt CMAKE_INSTALL_PREFIX=$out
+        add_opt LLVM_INSTALL_BINUTILS_SYMLINKS=YES
+        add_opt LLVM_INSTALL_CCTOOLS_SYMLINKS=YES
+        add_opt CMAKE_INSTALL_DO_STRIP=YES
+        add_opt LLVM_ENABLE_PER_TARGET_RUNTIME_DIR=YES
+        add_opt LLVM_TARGET_ARCH=X86
+        add_opt LLVM_TARGETS_TO_BUILD=Native
+        add_opt LLVM_BUILTIN_TARGETS=x86_64-unknown-linux-musl
+        add_opt LLVM_DEFAULT_TARGET_TRIPLE=x86_64-unknown-linux-musl
+        add_opt LLVM_HOST_TRIPLE=x86_64-unknown-linux-musl
+        add_opt COMPILER_RT_DEFAULT_TARGET_TRIPLE=x86_64-unknown-linux-musl
+        add_opt LLVM_APPEND_VC_REV=NO
+        add_opt LLVM_INCLUDE_TESTS=NO
+        add_opt LLVM_INCLUDE_EXAMPLES=NO
+        add_opt LLVM_INCLUDE_BENCHMARKS=NO
+        add_opt LLVM_ENABLE_BACKTRACES=NO
+        add_opt LLVM_ENABLE_EH=YES
+        add_opt LLVM_ENABLE_RTTI=YES
+        add_opt CLANG_ENABLE_ARCMT=NO
+        add_opt CLANG_ENABLE_STATIC_ANALYZER=NO
+        add_opt COMPILER_RT_BUILD_SANITIZERS=NO
+        add_opt COMPILER_RT_BUILD_XRAY=NO
+        add_opt COMPILER_RT_BUILD_LIBFUZZER=NO
+        add_opt COMPILER_RT_BUILD_PROFILE=NO
+        add_opt COMPILER_RT_BUILD_MEMPROF=NO
+        add_opt COMPILER_RT_BUILD_ORC=NO
+        add_opt COMPILER_RT_USE_BUILTINS_LIBRARY=YES
+        add_opt CLANG_DEFAULT_CXX_STDLIB=libc++
+        add_opt CLANG_DEFAULT_LINKER=lld
+        add_opt CLANG_DEFAULT_RTLIB=compiler-rt
+        add_opt LIBCXX_HAS_MUSL_LIBC=YES
+        add_opt LIBCXX_USE_COMPILER_RT=YES
+        add_opt LIBCXX_INCLUDE_BENCHMARKS=NO
+        add_opt LIBCXX_CXX_ABI=libcxxabi
+        add_opt LIBCXXABI_USE_COMPILER_RT=YES
+        add_opt LIBCXXABI_USE_LLVM_UNWINDER=YES
+        add_opt LIBCXX_ADDITIONAL_COMPILE_FLAGS=-I${linux-headers}/include
+        add_opt LLVM_INSTALL_TOOLCHAIN_ONLY=YES
+        add_opt LIBUNWIND_USE_COMPILER_RT=YES
+        add_opt LLVM_ENABLE_THREADS=NO
+        cmake -S llvm -B build -G 'Unix Makefiles' \
+          -DLLVM_ENABLE_PROJECTS='clang;lld' \
+          -DLLVM_ENABLE_RUNTIMES='compiler-rt;libcxx;libcxxabi;libunwind' \
+          -DGCC_INSTALL_PREFIX=${gnugcc10} \
+          "-DBOOTSTRAP_CMAKE_C_FLAGS=-isystem $EXTRA_INCL" \
+          "-DBOOTSTRAP_CMAKE_CXX_FLAGS=-isystem $EXTRA_INCL" \
+          -DCLANG_ENABLE_BOOTSTRAP=YES $BOTH_STAGES_OPTS
+      # build (stage1):
+        make -C build -j $NPROC clang lld runtimes
+      # build/install (stage2):
+        NEW_LIB_DIR="$(pwd)/build/lib/x86_64-unknown-linux-musl"
+        export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$NEW_LIB_DIR"
+        make -C build -j $NPROC stage2 stage2-install
+        ln -s $out/lib/x86_64-unknown-linux-musl/* $out/lib/
+        mkdir -p $out/bin/generic-names
+        ln -s $out/bin/clang $out/bin/generic-names/cc
+        ln -s $out/bin/clang++ $out/bin/generic-names/c++
+        ln -s $out/bin/clang-cpp $out/bin/generic-names/cpp
+      # mix new stuff into sysroot
+        ln -s $out/lib/* $out/sysroot/lib/
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+  }

06/using-nix/2b0-musl.nix

@@ -0,0 +1,45 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, intermediate-clang }:
+
+let
+  source-tarball-musl = fetchurl {
+    # local = /downloads/musl-1.2.4.tar.gz;
+    url = "http://musl.libc.org/releases/musl-1.2.4.tar.gz";
+    sha256 = "7a35eae33d5372a7c0da1188de798726f68825513b7ae3ebe97aaaa52114f039";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2b0-musl";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+      "${intermediate-clang}/bin"
+      "${intermediate-clang}/bin/generic-names"
+    ];
+    script = ''
+      # unpack:
+        mkdir build-dir; cd build-dir
+        unpack ${source-tarball-musl}
+      # fixup:
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|' tools/*.sh \
+        # patch popen/system to search in PATH instead of hardcoding /bin/sh
+        sed -i 's|posix_spawn(&pid, "/bin/sh",|posix_spawnp(\&pid, "sh",|' \
+                src/stdio/popen.c src/process/system.c
+        sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
+                src/misc/wordexp.c
+        # avoid absolute path references
+        sed -i 's/__FILE__/__FILE_NAME__/' include/assert.h
+      # configure:
+        ash ./configure --prefix=$out CFLAGS=-O2
+      # build:
+        make -j $NPROC
+      # install:
+        make -j $NPROC install
+        mkdir $out/bin
+        ln -s $out/lib/libc.so $out/bin/ldd
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+    extra.allowedRequisites = [ "out" ];
+    extra.allowedReferences = [ "out" ];
+  }

06/using-nix/2b1-clang.nix

@@ -0,0 +1,157 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, musl, intermediate-clang
+, linux-headers, cmake, python}:
+
+let
+  source-tarball-llvm = fetchurl {
+    # local = /downloads/llvm-project-17.0.1.src.tar.xz;
+    url = "https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.1/llvm-project-17.0.1.src.tar.xz";
+    sha256 = "b0e42aafc01ece2ca2b42e3526f54bebc4b1f1dc8de6e34f46a0446a13e882b9";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2b1-clang";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/wrappers"
+      "${cmake}/bin"
+      "${python}/bin"
+      # 2a9-intermediate-clang intentionally not added to $PATH
+      # to prevent confusion
+    ];
+    script = ''
+        # Shared libs are not relinked on install. Instead, their rpath
+        # is erased with RPATH_SET: `Set runtime path of
+        # "/nix/store/.../lib/x86_64-unknown-linux-musl/libc++.so.1.0" to ""`
+        # One (hacky) workaround to that is using a constant-len build-dir.
+        build_dir=build-dir; expr "$(pwd)/$build_dir)" '<=' 128
+        while ! echo "$(pwd)/$build_dir" | wc -c | grep -Fqx 128; do
+          build_dir="$build_dir."
+        done; expr "$(echo $(pwd)/$build_dir | wc -c)" '==' 128
+        mkdir $build_dir; cd $build_dir
+        export SHELL=${stage1.protobusybox}/bin/ash
+        # llvm cmake configuration should pick up ccache automatically from PATH
+        export PATH="$PATH:/ccache/bin"
+        command -v ccache && USE_CCACHE=YES || USE_CCACHE=NO
+      # prepare future sysroot:
+        SYSROOT=$out/sysroot
+        mkdir -p $SYSROOT/lib $SYSROOT/include
+        ln -s ${musl}/lib/* $SYSROOT/lib/
+        ln -s ${musl}/include/* $SYSROOT/include/
+      # unpack:
+        unpack ${source-tarball-llvm}
+      # fixup:
+        sed -i "s|COMMAND sh|COMMAND ${stage1.protobusybox}/bin/ash|" \
+          llvm/cmake/modules/GetHostTriple.cmake clang/CMakeLists.txt
+        echo 'echo x86_64-unknown-linux-musl' > llvm/cmake/config.guess
+        LOADER=${musl}/lib/libc.so
+        sed -i "s|/lib/ld-musl-\" + ArchName + \".so.1|$LOADER|" \
+          clang/lib/Driver/ToolChains/Linux.cpp
+        BEGINEND='const bool HasCRTBeginEndFiles'
+        sed -i "s|$BEGINEND =|$BEGINEND = false; ''${BEGINEND}_unused =|" \
+          clang/lib/Driver/ToolChains/Gnu.cpp
+        REL_ORIGIN='_install_rpath \"\$ORIGIN/../lib''${LLVM_LIBDIR_SUFFIX}\"'
+        sed -i "s|_install_rpath \"\\\\\$ORIGIN/..|_install_rpath \"$out|" \
+          llvm/cmake/modules/AddLLVM.cmake
+        sed -i 's|numShards = 32;|numShards = 1;|' lld/*/SyntheticSections.*
+        sed -i 's|numShards = 256;|numShards = 1;|' lld/*/ICF.cpp
+        sed -i 's|__FILE__|"__FILE__"|' \
+          libcxx/src/verbose_abort.cpp \
+          libcxxabi/src/abort_message.cpp \
+          compiler-rt/lib/builtins/int_util.h
+        sed -i 's|"@LLVM_SRC_ROOT@"|"REDACTED"|' \
+          llvm/tools/llvm-config/BuildVariables.inc.in
+        sed -i 's|"@LLVM_OBJ_ROOT@"|"REDACTED"|' \
+          llvm/tools/llvm-config/BuildVariables.inc.in
+      # figure out includes:
+        EXTRA_INCL="$(pwd)/extra_includes"
+        mkdir -p $EXTRA_INCL
+        cp clang/lib/Headers/*intrin*.h $EXTRA_INCL/
+        cp clang/lib/Headers/mm_malloc.h $EXTRA_INCL/
+        [ -e $EXTRA_INCL/immintrin.h ]
+      # configure:
+        export LD_LIBRARY_PATH="${musl}/lib:${intermediate-clang}/lib"
+        export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$(pwd)/build/lib" # libLLVM
+        OPTS=""
+        add_opt() {
+            OPTS="$OPTS -D$1"
+        }
+        add_opt CMAKE_BUILD_TYPE=Release
+        add_opt LLVM_OPTIMIZED_TABLEGEN=YES
+        add_opt LLVM_CCACHE_BUILD=$USE_CCACHE
+        add_opt DEFAULT_SYSROOT=$SYSROOT
+        add_opt CMAKE_INSTALL_PREFIX=$out
+        add_opt LLVM_INSTALL_BINUTILS_SYMLINKS=YES
+        add_opt LLVM_INSTALL_CCTOOLS_SYMLINKS=YES
+        add_opt CMAKE_INSTALL_DO_STRIP=YES
+        add_opt LLVM_ENABLE_PER_TARGET_RUNTIME_DIR=YES
+        add_opt LLVM_TARGET_ARCH=X86
+        add_opt LLVM_TARGETS_TO_BUILD=Native
+        add_opt LLVM_BUILTIN_TARGETS=x86_64-unknown-linux-musl
+        add_opt LLVM_DEFAULT_TARGET_TRIPLE=x86_64-unknown-linux-musl
+        add_opt LLVM_HOST_TRIPLE=x86_64-unknown-linux-musl
+        add_opt COMPILER_RT_DEFAULT_TARGET_TRIPLE=x86_64-unknown-linux-musl
+        add_opt LLVM_APPEND_VC_REV=NO
+        add_opt LLVM_INCLUDE_TESTS=NO
+        add_opt LLVM_INCLUDE_EXAMPLES=NO
+        add_opt LLVM_INCLUDE_BENCHMARKS=NO
+        add_opt LLVM_ENABLE_BACKTRACES=NO
+        add_opt LLVM_ENABLE_EH=YES
+        add_opt LLVM_ENABLE_RTTI=YES
+        add_opt CLANG_ENABLE_ARCMT=NO
+        add_opt CLANG_ENABLE_STATIC_ANALYZER=NO
+        add_opt COMPILER_RT_BUILD_SANITIZERS=NO
+        add_opt COMPILER_RT_BUILD_XRAY=NO
+        add_opt COMPILER_RT_BUILD_LIBFUZZER=NO
+        add_opt COMPILER_RT_BUILD_PROFILE=NO
+        add_opt COMPILER_RT_BUILD_MEMPROF=NO
+        add_opt COMPILER_RT_BUILD_ORC=NO
+        add_opt COMPILER_RT_USE_BUILTINS_LIBRARY=YES
+        add_opt CLANG_DEFAULT_CXX_STDLIB=libc++
+        add_opt CLANG_DEFAULT_LINKER=lld
+        add_opt CLANG_DEFAULT_RTLIB=compiler-rt
+        add_opt LIBCXX_HAS_MUSL_LIBC=YES
+        add_opt LIBCXX_USE_COMPILER_RT=YES
+        add_opt LIBCXX_INCLUDE_BENCHMARKS=NO
+        add_opt LIBCXX_CXX_ABI=libcxxabi
+        add_opt LIBCXX_ADDITIONAL_COMPILE_FLAGS=-I${linux-headers}/include
+        add_opt LIBCXXABI_USE_COMPILER_RT=YES
+        add_opt LIBCXXABI_USE_LLVM_UNWINDER=YES
+        add_opt LLVM_INSTALL_TOOLCHAIN_ONLY=YES
+        add_opt LIBUNWIND_USE_COMPILER_RT=YES
+        add_opt LLVM_ENABLE_THREADS=NO
+        REWRITE="-ffile-prefix-map=$(pwd)=/builddir/"
+        CFLAGS="--sysroot=$SYSROOT -I$EXTRA_INCL $REWRITE"
+        LDFLAGS="-Wl,--dynamic-linker=$LOADER"
+        cmake -S llvm -B build -G 'Unix Makefiles' \
+          -DCMAKE_ASM_COMPILER=${intermediate-clang}/bin/clang \
+          -DCMAKE_C_COMPILER=${intermediate-clang}/bin/clang \
+          -DCMAKE_CXX_COMPILER=${intermediate-clang}/bin/clang++ \
+          -DLLVM_ENABLE_PROJECTS='clang;lld' \
+          -DLLVM_ENABLE_RUNTIMES='compiler-rt;libcxx;libcxxabi;libunwind' \
+          -DCMAKE_C_FLAGS="$CFLAGS" \
+          -DCMAKE_CXX_FLAGS="$CFLAGS" \
+          -DCMAKE_C_LINK_FLAGS="$LDFLAGS" \
+          -DCMAKE_CXX_LINK_FLAGS="$LDFLAGS" \
+          -DLLVM_BUILD_LLVM_DYLIB=YES \
+          -DLLVM_LINK_LLVM_DYLIB=YES \
+          -DCLANG_LINK_LLVM_DYLIB=YES \
+          $OPTS
+      # build:
+        make -C build -j $NPROC
+      # install:
+        make -C build install/strip
+        ln -s $out/lib/x86_64-unknown-linux-musl/* $out/lib/
+        mkdir -p $out/bin
+        ln -s $out/bin/clang $out/bin/cc
+        ln -s $out/bin/clang++ $out/bin/c++
+        ln -s $out/bin/clang-cpp $out/bin/cpp
+        ln -s $out/bin/lld $out/bin/ld
+      # mix new stuff into sysroot:
+        ln -s $out/lib/* $out/sysroot/lib/
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+    extra.allowedRequisites = [ "out" musl ];
+    extra.allowedReferences = [ "out" musl ];
+  }

06/using-nix/2b2-busybox.nix

@@ -0,0 +1,52 @@
+{ fetchurl, mkDerivationStage2
+, stage1, static-gnumake, musl, clang, linux-headers }:
+
+let
+  source-tarball-busybox = fetchurl {
+    # local = /downloads/busybox-1.36.1.tar.bz2;
+    url = "https://busybox.net/downloads/busybox-1.36.1.tar.bz2";
+    sha256 = "b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314";
+  };
+in
+  mkDerivationStage2 {
+    name = "bootstrap-2b2-busybox";
+    buildInputPaths = [
+      "${stage1.protobusybox}/bin"
+      "${static-gnumake}/bin"
+      "${clang}/bin"
+    ];
+    script = ''
+        mkdir build-dir; cd build-dir
+      # alias ash to sh:
+        mkdir aliases; ln -s ${stage1.protobusybox}/bin/ash aliases/sh
+        export PATH="$(pwd)/aliases:$PATH"
+      # unpack:
+        unpack ${source-tarball-busybox}
+      # fixup:
+        echo -e '#!${stage1.protobusybox}/bin/ash\nprintf 9999' \
+          > scripts/gcc-version.sh
+        sed -i 's|/bin/sh|${stage1.protobusybox}/bin/ash|g' \
+          scripts/gen_build_files.sh \
+          scripts/mkconfigs scripts/embedded_scripts scripts/trylink \
+          scripts/generate_BUFSIZ.sh \
+          applets/usage_compressed applets/busybox.mkscripts applets/install.sh
+      # configure:
+        echo "### $0: configuring busybox..."
+        BUSYBOX_FLAGS='CONFIG_SHELL=${stage1.protobusybox}/bin/ash'
+        BUSYBOX_FLAGS="$BUSYBOX_FLAGS CC=cc HOSTCC=cc"
+        BUSYBOX_FLAGS="$BUSYBOX_FLAGS KCONFIG_NOTIMESTAMP=y"
+        BUSYBOX_CFLAGS="CFLAGS=-I${linux-headers}/include"
+        make -j $NPROC $BUSYBOX_FLAGS "$BUSYBOX_CFLAGS" defconfig
+        sed -i 's|CONFIG_INSTALL_NO_USR=y|CONFIG_INSTALL_NO_USR=n|' .config
+      # build:
+        make -j $NPROC $BUSYBOX_FLAGS "$BUSYBOX_CFLAGS" busybox busybox.links
+        sed -i 's|^/usr/s\?bin/|/bin/|' busybox.links
+      # install:
+        make -j $NPROC $BUSYBOX_FLAGS "$BUSYBOX_CFLAGS" \
+          install CONFIG_PREFIX=$out
+      # check for build path leaks:
+        ( ! grep -rF $(pwd) $out )
+    '';
+    extra.allowedRequisites = [ "out" musl clang ];
+    extra.allowedReferences = [ "out" musl clang ];
+  }