ports/overlay.nix
Overlay for Fil-C ported packages
Converts the port list from ../ports.nix into a nixpkgs overlay
Fil-C overrides for a Nix component scope, shared by upstream Nix and Determinate Nix. Boehm GC scans the native stack and data segments, which Fil-C objects do not live in; Fil-C collects garbage itself. seccomp filters and the static busybox sandbox shell are unavailable too.
Fil-C has no LTO; Nix enables it for its release builds.
Fil-C has no sigaltstack, and it catches stack overflow itself.
The suite runs whichever nix is on PATH. Nixpkgs asks for nix-cli.__spliced.hostHost, which this scope lacks, so it fell back to the build platform's (glibc) Nix: every functional test exercised native Nix, and the Fil-C test plugin could not load into it (undefined pizlonated_* symbols). Fil-C programs run on the build machine, so test the Fil-C Nix.
Fil-C's libc has no vfork.
Without seccomp, builds refuse to start unless filter-syscalls is off, so make that the default.
Fil-C's loader ignores RUNPATH when dlopening a bare soname, so name libc's nss_dns by path. NixOS's nix.conf check fails on the warning otherwise.
A program from the Fil-C sysroot's glibc.
Fil-C PHP 8.4 or 8.5 at a given release. Opt-in JIT builds use the in-process LLVM API on staging, or the early C-emitting backend on the released toolchain (docs/php.md and docs/php-port-notes.md).
| version | |
| hash | |
| jit | default false |
PHP 8.5 builds Lexbor and OPcache into PHP itself rather than as shared extensions, so their patches and flags move to the core.
PHP 8.5 matches with a PCRE2 whose interpreter avoids Fil-C's slow paths (see the patch); PHP 8.4 keeps Nixpkgs' choice.
Skips the tests that the libtool wrapper and the sandbox's locales break.
Fil-C cannot run the JIT's machine code; PHP is built without it.
PCRE2's own suite (RunTest, RunGrepTest), which the cross-style Fil-C build would otherwise skip.
Bundled extensions build from the unpatched PHP source.
Most PECL extensions build without their tests in Nixpkgs, and tests run with no other extension loaded (run-tests drops extension= lines from the ini), so tests that need session, json, ... skip. Load the default extensions and the extension's own dependencies ahead of it, and print the diff of each failure.
Drop tests that fail the same way without Fil-C or that need what the build sandbox lacks. Paths are relative to where postPatch runs: the PHP source for bundled extensions.
config.m4 looks up plain pkg-config, which a cross build only has under its target prefix.
Memcached servers on ports 11211 and 11212 for the tests.
The tests share the servers.
These new OOM tests spawn CGI with -n, which omits Nixpkgs' shared filter module. Keep testing the OOM, not an undefined filter_input() function.
Pins CPUs 0 and 1, but build sandboxes may exclude CPU 0.
The format probes run programs, so the cross build assumed libgd had none of them; it has all of them.
Nixpkgs pins ICU 73; use the ported default ICU.
The JIT compiles its code with Fil-C at run time.
The native JIT emits machine code, which Fil-C cannot run.
Bundled extensions outside the default set.
PECL extensions.
The version probe runs a program.
The tests share one GnuPG home directory.
The removed test predates PHP 8.2's dynamic property deprecation.
On PHP 8.5's tracked allocator memory_get_usage() ends 426 bytes lower after the dump, natively too.
Unix socket tests want /var/run/memcached; 056 wants a connection timeout where the sandbox has no route.
Fail the same way on x86-64 PHP without Fil-C.
Their SKIPIF includes a file the release lacks.
The stream round-trip holds two copies of PHP_BINARY; Fil-C executables exceed its default 128 MiB budget.
The inotify probe runs a program; the header is enough.
Tests written before PHP 8.4's deprecation notices.
Nixpkgs builds msgpack without session support.
Wants 400 unserializations a second, a native speed.
Judy keeps every node address in a Word_t (JudyMalloc returns one), so the pointers it hands back have no capability and the first allocation memprof records traps in JudyLIns. Porting needs Judy retyped throughout.
Busy-waits on the wall clock and expects that much CPU time; it passes alone but not beside other test jobs.
Fail the same way on x86-64 PHP without Fil-C.
Opens compress.zlib://ext/xsl/tests/..., relative to the PHP source root rather than the extension.
phpredis tests itself with a PHP script against servers on ports 6379 to 6382 rather than with run-tests.
The text tests need fonts and a fontconfig configuration, which the build sandbox lacks. The removed test fails the same way without Fil-C.
Xdebug has its own copy of run-tests. Its debugger tests start PHP themselves, so load the extensions from an ini directory that every PHP started here reads.
config.m4 never substitutes SPX_SHARED_LIBADD, so spx.so was not linked with zlib and only loaded after another module had brought it in. spx_custom_metadata fails the same way without Fil-C.
Tests written before PHP 8.5's warning for NAN coerced to a string and deprecation of null array offsets.
Default to the system allocator so Fil-C bounds each PHP value.
Extensions' libraries bound to PHP's own libraries' symbols.
Linear rather than quadratic string appends on the system allocator.
A computed-goto (HYBRID) VM without global registers, inlining only a small hot set of handlers; JIT builds keep the CALL VM. See docs/php.md.
Adds -Wa,--compress-debug-sections, which SaRCAsm rejects.
Fibers switch stacks with ucontext, like Boost.Context here, instead of the fcontext assembly.
Overflow-checked arithmetic in C instead of x86 asmgoto, whose callbr crashes FilPizlonatorPass.
Fil-C cannot run generated machine code; PCRE warned at the first preg_* call when mapping executable memory failed.
phpdbg's watchpoints would use userfaultfd, which Fil-C does not support; phpdbg died at startup.
The probe runs a program, so the cross build disabled the stack limit check; deep recursion then hit Fil-C's stack overflow trap instead of throwing "Maximum call stack size reached".
Toolchains with Fil-C's LLVM JIT (staging) get the in-process backend, which needs the program linked with -enable-filc-jit.
Regenerate the VM from the patched generator.
The built-in extensions' suites, which the shared ones run in their own builds: OPcache and URI (which parses with Lexbor).
The suites leave the JIT off; check that each backend compiles and runs code (LLVM only where the toolchain has it).
libunwind's unwinder is hand-written assembly without SaRCAsm annotations, and cannot follow Fil-C frames anyway. Packages that check availability (GStreamer, strace, ...) then build without it.
Boost 1.87 is the ported release (Context uses ucontext); Nixpkgs' default 1.89 builds its assembly fcontext and fails.
mount(8) stopped in libmount's NULL-argument probes. Only the full util-linux has mount(8); util-linuxMinimal (libuuid and libblkid for nearly everything) is made from this one, so leave its pname alone.
Nixpkgs' openssh is opensshPackages.openssh with /etc/ssh, and its tests build variants with opensshPackages.openssh.override. Port that one, so the variants keep the port, and derive openssh from it as Nixpkgs does (prev.openssh reads this set, and would be ported twice).
Default PHP; versioned packages remain available (docs/php.md).
Opt-in: use pkgsFilcStaging for the in-process LLVM JIT. The required API is not in the released Fil-C toolchain yet (docs/php.md).
Nixpkgs builds PHP with llvmPackages.stdenv whenever the compiler is Clang, which for Fil-C means a second compiler-rt and libc++ (and a cross GCC) built from source. The Fil-C stdenv is already Clang.
php84 follows PHP's releases; php84_25 keeps 8.4.25, which lacks the fixes for CVE-2026-109618 and CVE-2026-109619, for comparing exploits and fixes (docs/php.md). It is marked insecure so nothing uses it by accident.
Opt-in: opcache with the JIT, compiled through C (docs/php.md).
PHP 7.4, from fossar/nix-phps, which keeps Nixpkgs' PHP builder working for releases Nixpkgs has dropped. See docs/php.md.
Bundled extensions build from the unpatched PHP source.
The probes run programs, so the cross build assumed an iconv without errno that honours //IGNORE; glibc's sets errno and fails on //IGNORE.
The shared memory probes run programs, so the cross build found none and opcache could not start. Anonymous mmap works.
Replaces nix-phps' own overrides, so apply those first.
PHP's own backport for its end-of-life branch; see docs/php.md.
Default to the system allocator so Fil-C bounds each PHP value.
Adds -Wa,--compress-debug-sections, which SaRCAsm rejects.
Overflow-checked arithmetic in C instead of x86 asmgoto.
Fil-C cannot run generated machine code.
Probes that run programs, which the cross build cannot.
The ODBC driver builds its bundled Connector/C submodule, whose export map needs the same fix as mariadb-connector-c (see ports.nix).
Node.js (V8) is out of scope. Small pure-JS CLIs run on QuickJS through the qnode shim instead; see docs/quickjs-for-node.md.
YouTube needs a JavaScript runtime; yt-dlp's default, Deno, is V8. QuickJS is one of its supported runtimes. curl-cffi (curl-impersonate needs Go) and secretstorage (cryptography needs Rust) are optional. pycryptodomex is optional too (yt-dlp has a pure-Python AES), and the build's native Python would dlopen its Fil-C ctypes library and fail.
The top-level python3Packages argument splices to the build platform's default Python (3.13), whose hatchling the Fil-C Python 3.12 build cannot import. Use the ported set directly.
The pnpm dependency fetcher's output is platform-independent, but it overrides pnpm-fixup-state-db with pnpm's own Node.js, which loses splicing and pulls in the host (Fil-C) Node.js. Run it natively.
overrideScope, so that the plugins build against this GStreamer.
Only the optional PTP clock helper uses Rust. The multimedia core is C.
Native stack unwinding does not understand Fil-C frames.
GType is a pointer in Fil-C's GLib; upstream Fil-C's 1.24.7 patch, rebased onto 1.26.
Pointer GTypes: pointer once-inits, switches on uintptr_t, and signal parameters without G_SIGNAL_TYPE_STATIC_SCOPE bits.
Python generates sources at build time. As a build input it was the Fil-C Python, which CMake's FindPython3 does not accept as the build machine's interpreter.
See ports/qt5.nix.
Nix itself.
The 64-bit Value layout packs tag bits into pointers held as integers, which drops their capabilities; use the plain one.
nativeBuildInputs' perl splices to the build platform's perl, which cannot load the Fil-C DBI; Fil-C programs run on the build machine.
sv_setref_pv stores the wrapper through Fil-C's XS pointer table; the typemap read it back with a cast.
Determinate Systems' fork; see ports/determinate-nix.nix.
Boehm GC's API on Fil-C's own collector (docs/boehm-on-fugc.md).
unixtools takes glibc's getent and getconf only when libc is "glibc", and NetBSD's otherwise, which do not evaluate here. The Fil-C sysroot has glibc's.
The emacs30 port has no GUI; the -nox variants come from Nixpkgs' Emacs scope and would miss the port (and bring native compilation along).
jemalloc's API on Fil-C's own allocator (docs/jemalloc-on-fugc.md).