commits
- docs/darwin-builder.md: comprehensive setup guide covering NixOS module
quick start, manual setup, shared /nix/store, verification, custom build
hook, performance tuning, troubleshooting, and security considerations
- templates/darling-builder/: nix flake init template with ready-to-use
NixOS configuration and inline-documented options
- Wire templates.darling-builder into flake.nix
- Update PLAN.md, plan/09-phase7-remote-builder.md, plan/README.md to
mark task 7.7 as complete
- Phase 7.5: NixOS module (nix/darlingBuilderModule.nix) — services.darling-builder
with sshd inside Darling prefix, SSH key management, optional /nix/store sharing,
nix.buildMachines registration, and darling-builder-test diagnostic script
- Phase 7.4: Custom build hook (scripts/darling-build-hook) — offloads
x86_64-darwin builds to local Darling without SSH, supports Nix hook protocol
- Phase 6.5: Compatibility test matrix (tests/nix/compatibility-matrix.sh) —
4-tier package build tester with JSON reporting and cross-run comparison
- Phase 7 VM test (tests/darling-builder.nix) — 12-stage NixOS VM test covering
service startup, sshd, SSH auth, macOS identity, and restart resilience
- Wire darling-builder module and VM test into flake.nix
- Update PLAN.md, plan docs, and .gitignore
- Remove .github/workflows/nix.yml
- Add .tangled/workflows/ci.yml using nixery engine with Cachix caching
- Update PLAN.md and plan/08-phase6-ci.md references accordingly
Phase 5.1 — Directory Services stubs:
- dseditgroup: group create/edit/delete/checkmember/read (src/dirserv/)
- sysadminctl: addUser/deleteUser with UID/GID/home/shell (src/dirserv/)
- dscl: read/list/create/delete/append/search on /Users and /Groups (src/dirserv/)
- All operations are idempotent with input validation
- Wired into CMake build, installs to libexec/darling/usr/sbin/
- 78-test regression suite (tests/dirserv/test_dirserv.sh)
Phase 6.1 — NixOS VM integration test (tests/nix-in-darling.nix):
- 7 stages: Darling boot, sandbox-exec, dirserv stubs, Nix install,
core commands, currentSystem verification, trivial derivation builds
Phase 6.6 — Darling smoke test (tests/darling-smoke.nix):
- Lightweight NixOS VM test (no network), 8 stages covering shell,
macOS identity, filesystem, sandbox-exec, diskutil, dirserv stubs
Phase 6.2 — Wired tests into flake.nix:
- checks: darling-build, darling-smoke, nix-in-darling, dirserv-stubs
- dirserv-stubs runs as pure shell test (no Darling needed)
Also: updated run-tests.sh with dirserv suite (6 suites total),
updated PLAN.md and plan docs with task completions.
New scripts to bridge the gap between implementation and execution:
- scripts/run-tests.sh: Unified test runner that compiles and runs all
regression tests (syscall + sandbox) inside a Darling prefix. Supports
--suite filtering, --verbose, and --keep for debugging.
- scripts/verify-nix.sh: Standalone health-check for a Nix installation
inside Darling. Checks infrastructure, core commands, evaluator, store
integrity, syscall health, network (--online), and environment. Supports
--json for CI consumption.
- scripts/build-trivial.sh: Progressive derivation build tests for Phase
4.1 with 5 levels: echo to $out, multi-line builder, input transform,
derivation dependency, and binary substitution. Auto-skips later levels
on foundational failure; prints targeted debugging hints.
Updated PLAN.md and plan/README.md with new scripts, command examples in
the What's Next section, and a Script Quick Reference table.
Phase 1 syscall work:
- Add tests/syscall/test_utimensat.c: 16 regression tests for the
touch/utimensat segfault scenario (Task 1.4). Covers MODTIME, ACCTIME,
CRTIME, CHGTIME, combined attrs, FSOPT_NOFOLLOW on symlinks,
utimes/lutimes libc functions, NULL pointers, and kitchen-sink
multi-attribute scenarios.
- Verify Task 1.8 complete: SystemVersion.plist already reports 11.7.4
(Big Sur), CMAKE_OSX_DEPLOYMENT_TARGET=11.0. No changes needed.
Bug fix:
- Fix getattrlist_generic.c attribute buffer ordering: common attrs now
packed in Apple-defined bit-position order (OBJTAG 0x10 -> FNDRINFO
0x4000 -> FLAGS 0x40000) instead of incorrect FNDRINFO -> FLAGS ->
OBJTAG. Dir/file attrs also reordered correctly.
Triage automation (Task 1.7):
- Add scripts/triage-syscalls.sh: automated syscall discovery that runs
Nix operations inside Darling, captures unimplemented syscall messages,
maps syscall numbers to names, and produces a Markdown report.
Plan updates:
- Mark Phase 1 as 'core done, triage ongoing', Phase 2 as 'done'
- Add completed task summary table to PLAN.md
- Update What's Next: build+test -> live triage -> Phase 3 install
- Update syscall-triage.md with new entries and automation docs
Implement the core syscall fixes needed for Nix to run inside Darling:
renameatx_np (syscall 488) — Task 1.3:
New syscall translating macOS renameatx_np to Linux renameat2(2).
RENAME_SWAP → RENAME_EXCHANGE, RENAME_EXCL → RENAME_NOREPLACE.
Unblocks mv (coreutils) which was aborting on unimplemented syscall.
setattrlist ATTR_CMN_FLAGS — Task 1.1:
Extended setattrlist/fsetattrlist/setattrlistat to accept ATTR_CMN_FLAGS
(silently succeeds for any value). Also added ATTR_CMN_CRTIME and
ATTR_CMN_CHGTIME (silently ignored). Extended getattrlist/fgetattrlist/
getattrlistat to return flags=0 when ATTR_CMN_FLAGS is requested.
This is the #1 blocker: lchflags(path, 0) was returning EINVAL.
clonefile/fclonefileat — Task 1.5:
Changed stubs from ENOSYS to ENOTSUP so Nix gracefully falls back to
regular read/write copy.
Also fixes a pre-existing bug in getattrlist: ATTR_FILE_RSRCLENGTH was
using XATTR_FINDER_INFO instead of XATTR_RESOURCE_FORK.
Tests:
tests/syscall/test_renameatx_np.c — 5 test cases
tests/syscall/test_setattrlist_flags.c — 10 test cases
Phase 2 — Sandbox & Build Isolation:
- Fix sandbox API stubs: sandbox_init, sandbox_init_with_parameters,
sandbox_init_with_extensions, and sandbox_wakeup_daemon now set
*errorbuf = NULL on success instead of strdup("Not implemented"),
and guard against NULL errorbuf pointers.
- Create sandbox-exec stub (src/sandbox-exec/): small C program that
parses and ignores all sandbox flags (-f, -p, -n, -D) then exec's
the remaining command. Installs to libexec/darling/usr/bin/sandbox-exec.
This unblocks Nix builder invocations which wrap everything in
sandbox-exec.
Phase 3 — Nix Installation Support:
- Extend diskutil with info and list verb stubs so the Nix installer's
filesystem-type check (diskutil info /) succeeds.
- Create scripts/install-nix-in-darling.sh: automated installer that
downloads, patches, and runs the Nix Darwin installer inside a
Darling prefix in single-user mode.
- Create scripts/darling-nix: host-side wrapper for running Nix
commands inside Darling without manual darling shell bash -lc
boilerplate.
Phase 6 — CI:
- Create .github/workflows/nix.yml with flake-check, build, devshell,
and smoke-test jobs. Includes Cachix integration and path filtering.
Testing & Docs:
- Create tests/sandbox/ with C-level API tests and shell-level
sandbox-exec integration tests.
- Create plan/syscall-triage.md tracking table for unimplemented
syscalls.
- Update PLAN.md with progress summary and What's Next section.
- Update plan/README.md with new files and key scripts table.
- Fix .gitignore to allow tests/sandbox/ while ignoring other test dirs.
Implements Phase 0 (Nix Packaging + DevShell) from the plan:
- flake.nix: Uses flakelight with nixpkgs-unstable, x86_64-linux only.
Autoloads package, devShell, and nixosModule from nix/ directory.
Exposes darling-sdk as a separate package output.
- nix/package.nix: Full darling package adapted from nixie-dev/darling-nix.
Includes ccWrapperBypass for Darwin cross-compilation, SDK splitting
via postInstall, and nix-store leak checks in postFixup.
- nix/devShell.nix: Comprehensive dev environment with clangStdenv,
all build deps + libraries, debug tools (gdb, strace, rizin),
code exploration (rg, fd, jq), Nix IDE (nil, nixfmt), and
C/C++ IDE (clangd). Sets CMAKE_EXPORT_COMPILE_COMMANDS=1.
- nix/nixosModule.nix: programs.darling.enable with unprivileged
user namespace config, FUSE setup, and optional persistent
prefix via systemd service.
- .envrc: 'use flake' for direnv/Zed integration.
- .gitignore: Add .direnv/, result, result-*.
Split into focused documents under plan/ to keep context manageable:
- 00-background: motivation, prior art, current state analysis
- 01-blockers: 7 identified blockers (lchflags, sandbox-exec, renameatx_np, etc.)
- 02-phase0: flake.nix, devShell with all tools for Zed, .envrc
- 03-phase1: core syscall fixes (setattrlist, renameatx_np, utimensat, etc.)
- 04-phase2: sandbox-exec stub, sandbox API fixes
- 05-phase3: automated Nix installation inside Darling
- 06-phase4: derivation building (trivial → stdenv → binary substitution)
- 07-phase5: nix-daemon, multi-user mode, Directory Services stubs
- 08-phase6: NixOS VM tests, syscall regression suite, GitHub Actions CI
- 09-phase7: Darling as a nix.buildMachines remote builder
- 10-phase8: stretch goals (aarch64-darwin, GUI testing, binary cache)
- 11-architecture: system diagram, key technical decisions, glossary
Inspired by nixie-dev/darling-nix and ersei's 'Nix All The Way Down' blog post.
Add symbols to CoreServices SearchKit for Xcode
Add Link To Open Collective
Improve source archive compression in GitHub Actions
- Switch compression format from gzip to xz
- Use xz maximum compression level (`-9e`) to minimize archive size
Update Submodules
darlinghq/darling-cocotron#56 | Add symbols for Forecast
darlinghq/darling-cocotron#57 | Add symbols for GOG Galaxy
darlinghq/darling-cocotron#62 | Return self in initWithCoder method of NSNibAXAttributeConnector
darlinghq/darling-libresolv#4 | Link against libplatform
darlinghq/darling-removefile#3 | Link against libplatform
darlinghq/darling-Libinfo | Add Note About "resolv-darwin" Dependency
added CMakeLists.txt defines up to Clang 23
Add AVFAudio framework
Add symbols for VSCode
Fix usage of DYLD_ROOT_PATH
darlinghq/darling-cocotron#53 | Add symbols for VSCode
darlinghq/darling-cocotron#54 | Add symbols for AudioFuse Control Center
darlinghq/darling-cocotron#55 | Add symbols for BibDesk
darlinghq/darling-cocotron#58 | Remove catalog verification from setFill, setStroke and CGColorRef
darlinghq/darling-cocotron#59 | Add QuartzCore symbols used by iTerm2
darlinghq/darling-foundation#24 | feat: add stringByRemovingPercentEncoding to NSString
darlinghq/darling-foundation#25 | add symbols for Keycastr
darlinghq/darling-foundation#26 | Add symbols for VSCode
darlinghq/darling-installer#8 | Decode space character from URL encoding to ASCII
darlinghq/darling-metal#2 | Add symbols for GOG Galaxy
Latest LLVM 22.x has removed __builtin_ia32_sqrtsd
https://github.com/llvm/llvm-project/pull/165682
Add implementation for LAContext
Add symbols for BibDesk
Add symbols for Forecast
Add `kTISNotifySelectedKeyboardInputSourceChanged` symbol
Update Submodules
darlinghq/darling-cocotron#49 | Add symbols for skyline
darlinghq/darling-dmg#107 | CMake fixes for gcc 15
darlinghq/darling-cocotron#50 | Add stub for existing symbol to improve skyline
darlinghq/darling-cocotron#51 | Add symbols for ShapeScript Viewer
darlinghq/darling-metal#1 | Add symbols for skyline and ShapeScript Viewer
darlinghq/darling-foundation#23 | Add symbols for ShapeScript Viewer
darlinghq/darling-cocotron#46 | Add symbols for MidiSuite application
CMake protect PATH in dSYM generation
Add symbols for skyline
Add private framework UIFoundation
Add framework AudioVideoBridging
Fix building against FFmpeg 8
darlinghq/darling-cocotron#47 | Add stubs for Xcode 3.0
darlinghq/darling-cocotron#48 | Add symbols for BibDesk
darlinghq/darling-corecrypto#12 | Export _cccurve25519_make_key_pair symbol
darlinghq/darling-foundation#20 | Add macros for NS_TYPED_ENUM
darlinghq/darling-foundation#21 | Add symbols for BibDesk
darlinghq/darling-foundation#22 | Fix NSSocketPortNameServer header reference
- docs/darwin-builder.md: comprehensive setup guide covering NixOS module
quick start, manual setup, shared /nix/store, verification, custom build
hook, performance tuning, troubleshooting, and security considerations
- templates/darling-builder/: nix flake init template with ready-to-use
NixOS configuration and inline-documented options
- Wire templates.darling-builder into flake.nix
- Update PLAN.md, plan/09-phase7-remote-builder.md, plan/README.md to
mark task 7.7 as complete
- Phase 7.5: NixOS module (nix/darlingBuilderModule.nix) — services.darling-builder
with sshd inside Darling prefix, SSH key management, optional /nix/store sharing,
nix.buildMachines registration, and darling-builder-test diagnostic script
- Phase 7.4: Custom build hook (scripts/darling-build-hook) — offloads
x86_64-darwin builds to local Darling without SSH, supports Nix hook protocol
- Phase 6.5: Compatibility test matrix (tests/nix/compatibility-matrix.sh) —
4-tier package build tester with JSON reporting and cross-run comparison
- Phase 7 VM test (tests/darling-builder.nix) — 12-stage NixOS VM test covering
service startup, sshd, SSH auth, macOS identity, and restart resilience
- Wire darling-builder module and VM test into flake.nix
- Update PLAN.md, plan docs, and .gitignore
Phase 5.1 — Directory Services stubs:
- dseditgroup: group create/edit/delete/checkmember/read (src/dirserv/)
- sysadminctl: addUser/deleteUser with UID/GID/home/shell (src/dirserv/)
- dscl: read/list/create/delete/append/search on /Users and /Groups (src/dirserv/)
- All operations are idempotent with input validation
- Wired into CMake build, installs to libexec/darling/usr/sbin/
- 78-test regression suite (tests/dirserv/test_dirserv.sh)
Phase 6.1 — NixOS VM integration test (tests/nix-in-darling.nix):
- 7 stages: Darling boot, sandbox-exec, dirserv stubs, Nix install,
core commands, currentSystem verification, trivial derivation builds
Phase 6.6 — Darling smoke test (tests/darling-smoke.nix):
- Lightweight NixOS VM test (no network), 8 stages covering shell,
macOS identity, filesystem, sandbox-exec, diskutil, dirserv stubs
Phase 6.2 — Wired tests into flake.nix:
- checks: darling-build, darling-smoke, nix-in-darling, dirserv-stubs
- dirserv-stubs runs as pure shell test (no Darling needed)
Also: updated run-tests.sh with dirserv suite (6 suites total),
updated PLAN.md and plan docs with task completions.
New scripts to bridge the gap between implementation and execution:
- scripts/run-tests.sh: Unified test runner that compiles and runs all
regression tests (syscall + sandbox) inside a Darling prefix. Supports
--suite filtering, --verbose, and --keep for debugging.
- scripts/verify-nix.sh: Standalone health-check for a Nix installation
inside Darling. Checks infrastructure, core commands, evaluator, store
integrity, syscall health, network (--online), and environment. Supports
--json for CI consumption.
- scripts/build-trivial.sh: Progressive derivation build tests for Phase
4.1 with 5 levels: echo to $out, multi-line builder, input transform,
derivation dependency, and binary substitution. Auto-skips later levels
on foundational failure; prints targeted debugging hints.
Updated PLAN.md and plan/README.md with new scripts, command examples in
the What's Next section, and a Script Quick Reference table.
Phase 1 syscall work:
- Add tests/syscall/test_utimensat.c: 16 regression tests for the
touch/utimensat segfault scenario (Task 1.4). Covers MODTIME, ACCTIME,
CRTIME, CHGTIME, combined attrs, FSOPT_NOFOLLOW on symlinks,
utimes/lutimes libc functions, NULL pointers, and kitchen-sink
multi-attribute scenarios.
- Verify Task 1.8 complete: SystemVersion.plist already reports 11.7.4
(Big Sur), CMAKE_OSX_DEPLOYMENT_TARGET=11.0. No changes needed.
Bug fix:
- Fix getattrlist_generic.c attribute buffer ordering: common attrs now
packed in Apple-defined bit-position order (OBJTAG 0x10 -> FNDRINFO
0x4000 -> FLAGS 0x40000) instead of incorrect FNDRINFO -> FLAGS ->
OBJTAG. Dir/file attrs also reordered correctly.
Triage automation (Task 1.7):
- Add scripts/triage-syscalls.sh: automated syscall discovery that runs
Nix operations inside Darling, captures unimplemented syscall messages,
maps syscall numbers to names, and produces a Markdown report.
Plan updates:
- Mark Phase 1 as 'core done, triage ongoing', Phase 2 as 'done'
- Add completed task summary table to PLAN.md
- Update What's Next: build+test -> live triage -> Phase 3 install
- Update syscall-triage.md with new entries and automation docs
Implement the core syscall fixes needed for Nix to run inside Darling:
renameatx_np (syscall 488) — Task 1.3:
New syscall translating macOS renameatx_np to Linux renameat2(2).
RENAME_SWAP → RENAME_EXCHANGE, RENAME_EXCL → RENAME_NOREPLACE.
Unblocks mv (coreutils) which was aborting on unimplemented syscall.
setattrlist ATTR_CMN_FLAGS — Task 1.1:
Extended setattrlist/fsetattrlist/setattrlistat to accept ATTR_CMN_FLAGS
(silently succeeds for any value). Also added ATTR_CMN_CRTIME and
ATTR_CMN_CHGTIME (silently ignored). Extended getattrlist/fgetattrlist/
getattrlistat to return flags=0 when ATTR_CMN_FLAGS is requested.
This is the #1 blocker: lchflags(path, 0) was returning EINVAL.
clonefile/fclonefileat — Task 1.5:
Changed stubs from ENOSYS to ENOTSUP so Nix gracefully falls back to
regular read/write copy.
Also fixes a pre-existing bug in getattrlist: ATTR_FILE_RSRCLENGTH was
using XATTR_FINDER_INFO instead of XATTR_RESOURCE_FORK.
Tests:
tests/syscall/test_renameatx_np.c — 5 test cases
tests/syscall/test_setattrlist_flags.c — 10 test cases
Phase 2 — Sandbox & Build Isolation:
- Fix sandbox API stubs: sandbox_init, sandbox_init_with_parameters,
sandbox_init_with_extensions, and sandbox_wakeup_daemon now set
*errorbuf = NULL on success instead of strdup("Not implemented"),
and guard against NULL errorbuf pointers.
- Create sandbox-exec stub (src/sandbox-exec/): small C program that
parses and ignores all sandbox flags (-f, -p, -n, -D) then exec's
the remaining command. Installs to libexec/darling/usr/bin/sandbox-exec.
This unblocks Nix builder invocations which wrap everything in
sandbox-exec.
Phase 3 — Nix Installation Support:
- Extend diskutil with info and list verb stubs so the Nix installer's
filesystem-type check (diskutil info /) succeeds.
- Create scripts/install-nix-in-darling.sh: automated installer that
downloads, patches, and runs the Nix Darwin installer inside a
Darling prefix in single-user mode.
- Create scripts/darling-nix: host-side wrapper for running Nix
commands inside Darling without manual darling shell bash -lc
boilerplate.
Phase 6 — CI:
- Create .github/workflows/nix.yml with flake-check, build, devshell,
and smoke-test jobs. Includes Cachix integration and path filtering.
Testing & Docs:
- Create tests/sandbox/ with C-level API tests and shell-level
sandbox-exec integration tests.
- Create plan/syscall-triage.md tracking table for unimplemented
syscalls.
- Update PLAN.md with progress summary and What's Next section.
- Update plan/README.md with new files and key scripts table.
- Fix .gitignore to allow tests/sandbox/ while ignoring other test dirs.
Implements Phase 0 (Nix Packaging + DevShell) from the plan:
- flake.nix: Uses flakelight with nixpkgs-unstable, x86_64-linux only.
Autoloads package, devShell, and nixosModule from nix/ directory.
Exposes darling-sdk as a separate package output.
- nix/package.nix: Full darling package adapted from nixie-dev/darling-nix.
Includes ccWrapperBypass for Darwin cross-compilation, SDK splitting
via postInstall, and nix-store leak checks in postFixup.
- nix/devShell.nix: Comprehensive dev environment with clangStdenv,
all build deps + libraries, debug tools (gdb, strace, rizin),
code exploration (rg, fd, jq), Nix IDE (nil, nixfmt), and
C/C++ IDE (clangd). Sets CMAKE_EXPORT_COMPILE_COMMANDS=1.
- nix/nixosModule.nix: programs.darling.enable with unprivileged
user namespace config, FUSE setup, and optional persistent
prefix via systemd service.
- .envrc: 'use flake' for direnv/Zed integration.
- .gitignore: Add .direnv/, result, result-*.
Split into focused documents under plan/ to keep context manageable:
- 00-background: motivation, prior art, current state analysis
- 01-blockers: 7 identified blockers (lchflags, sandbox-exec, renameatx_np, etc.)
- 02-phase0: flake.nix, devShell with all tools for Zed, .envrc
- 03-phase1: core syscall fixes (setattrlist, renameatx_np, utimensat, etc.)
- 04-phase2: sandbox-exec stub, sandbox API fixes
- 05-phase3: automated Nix installation inside Darling
- 06-phase4: derivation building (trivial → stdenv → binary substitution)
- 07-phase5: nix-daemon, multi-user mode, Directory Services stubs
- 08-phase6: NixOS VM tests, syscall regression suite, GitHub Actions CI
- 09-phase7: Darling as a nix.buildMachines remote builder
- 10-phase8: stretch goals (aarch64-darwin, GUI testing, binary cache)
- 11-architecture: system diagram, key technical decisions, glossary
Inspired by nixie-dev/darling-nix and ersei's 'Nix All The Way Down' blog post.
darlinghq/darling-cocotron#56 | Add symbols for Forecast
darlinghq/darling-cocotron#57 | Add symbols for GOG Galaxy
darlinghq/darling-cocotron#62 | Return self in initWithCoder method of NSNibAXAttributeConnector
darlinghq/darling-libresolv#4 | Link against libplatform
darlinghq/darling-removefile#3 | Link against libplatform
darlinghq/darling-Libinfo | Add Note About "resolv-darwin" Dependency
darlinghq/darling-cocotron#53 | Add symbols for VSCode
darlinghq/darling-cocotron#54 | Add symbols for AudioFuse Control Center
darlinghq/darling-cocotron#55 | Add symbols for BibDesk
darlinghq/darling-cocotron#58 | Remove catalog verification from setFill, setStroke and CGColorRef
darlinghq/darling-cocotron#59 | Add QuartzCore symbols used by iTerm2
darlinghq/darling-foundation#24 | feat: add stringByRemovingPercentEncoding to NSString
darlinghq/darling-foundation#25 | add symbols for Keycastr
darlinghq/darling-foundation#26 | Add symbols for VSCode
darlinghq/darling-installer#8 | Decode space character from URL encoding to ASCII
darlinghq/darling-metal#2 | Add symbols for GOG Galaxy
darlinghq/darling-cocotron#49 | Add symbols for skyline
darlinghq/darling-dmg#107 | CMake fixes for gcc 15
darlinghq/darling-cocotron#50 | Add stub for existing symbol to improve skyline
darlinghq/darling-cocotron#51 | Add symbols for ShapeScript Viewer
darlinghq/darling-metal#1 | Add symbols for skyline and ShapeScript Viewer
darlinghq/darling-foundation#23 | Add symbols for ShapeScript Viewer
darlinghq/darling-cocotron#46 | Add symbols for MidiSuite application
darlinghq/darling-cocotron#47 | Add stubs for Xcode 3.0
darlinghq/darling-cocotron#48 | Add symbols for BibDesk
darlinghq/darling-corecrypto#12 | Export _cccurve25519_make_key_pair symbol
darlinghq/darling-foundation#20 | Add macros for NS_TYPED_ENUM
darlinghq/darling-foundation#21 | Add symbols for BibDesk
darlinghq/darling-foundation#22 | Fix NSSocketPortNameServer header reference