Memory-safe Nix packages
Filnix builds Nixpkgs packages with Fil-C, the memory-safe implementation of C and C++. A memory error in a Fil-C program stops it with a panic instead of corrupting memory. This wiki collects how to use the results, how the toolchain is maintained, what individual ports needed, and how the port campaigns run.
Docs
Using filnix/opt/fil, a relocatable root, NixOS services, PHP
Compiler and toolchainDev shell, pins, findings to report upstream
Notes on portsBoehm GC and jemalloc on FUGC, Guile, GTK, Ruby
Thread cancellationWhat Fil-C's glibc needs to get right
Port campaignsRunner, caches, audits and repairs
Explainers
Fil-BIND: BIND 9 in memory-safe CBIND 9.20.30 on Fil-C, the year's CVEs, what it costs. Video, tarball and Docker image.
Misaligned pointers in global and thread-local initializersA clang assertion and silent shadow corruption in Fil-C 0.686, and a compile error instead. Video and reproducers.
Frame slot coloring at -O0: from cubic to near-linear48 s to 0.66 s for one function, with identical frames. Video and interactive model.