Merge branch 'develop' into bthomee/node_depth

.github/workflows/check-tools.yml

@@ -0,0 +1,114 @@
+# Verifies the committed snapshots of `bin/check-tools.sh` output for each Nix
+# environment (see nix/check-tools/). If the environment changes — a new image
+# tag, an updated flake.lock, a different tool list — without the matching
+# snapshot being regenerated and committed, this workflow fails so the drift is
+# caught in review.
+#
+# To regenerate the snapshots, see nix/check-tools/README.md.
+name: Check tools
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  push:
+    branches:
+      - "develop"
+    paths:
+      - ".github/workflows/check-tools.yml"
+      - ".github/scripts/strategy-matrix/linux.json"
+      - "bin/check-tools.sh"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+      - "rust-toolchain.toml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The nix-nixos image tag is pinned alongside the build matrix in linux.json,
+  # so snapshots are checked against the exact image CI builds against.
+  linux-image-tag:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Read nix image tag
+        id: tag
+        run: echo "tag=$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)" >>"${GITHUB_OUTPUT}"
+
+  # One job for all environments; they differ only in whether the tools come
+  # from the nix-nixos container (Linux) or `nix develop` (macOS).
+  check-tools:
+    needs: linux-image-tag
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            snapshot: nix/check-tools/nix-ubuntu-amd64.txt
+            nix_develop: false
+          - runner: ubuntu-24.04-arm
+            snapshot: nix/check-tools/nix-ubuntu-arm64.txt
+            nix_develop: false
+          - runner: macos-26-apple-clang-21
+            snapshot: nix/check-tools/macos.txt
+            nix_develop: true
+    runs-on: ${{ matrix.runner }}
+    # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
+    # the flake's dev shell instead (see the run step below).
+    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-ubuntu:{0}', needs.linux-image-tag.outputs.tag) || null }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
+        with:
+          enable_ccache: false
+
+      - name: Regenerate snapshot
+        env:
+          CHECK_TOOLS_SKIP_CLONE: "1"
+          # check-tools.sh skips some macOS tools when CI is set; the snapshots
+          # capture the full `nix develop` environment, so unset it here.
+          CI: ""
+        run: |
+          if [ "${{ matrix.nix_develop }}" = "true" ]; then
+              # `nix develop` prints the dev-shell greeting first; keep only the
+              # check-tools.sh output (from the "Detected OS:" line onward).
+              nix --extra-experimental-features "nix-command flakes" develop \
+                  -c bash bin/check-tools.sh | sed -n '/^Detected OS:/,$p' >"${{ matrix.snapshot }}"
+          else
+              bash bin/check-tools.sh >"${{ matrix.snapshot }}"
+          fi
+
+      - name: Verify snapshot is up to date
+        run: |
+          if ! git diff --exit-code -- "${{ matrix.snapshot }}"; then
+              echo "::error::${{ matrix.snapshot }} is out of date. Regenerate it (see nix/check-tools/README.md) and commit the result."
+              exit 1
+          fi
+
+      - name: Upload regenerated snapshot
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: check-tools-${{ runner.os }}-${{ runner.arch }}
+          path: ${{ matrix.snapshot }}

bin/check-tools.sh

@@ -30,8 +30,10 @@ missing=()
 checked=0
 
 # check <name> [probe-command...]
-# Runs the probe (default: "<name> --version") quietly. Records <name> as
-# missing if the command is not found or exits non-zero.
+# Runs the probe (default: "<name> --version"), capturing both stdout and
+# stderr, and prints one aligned line: the status, the name, and the first
+# non-blank line of the probe output (its version). Records <name> as missing
+# if the command is not found or exits non-zero.
 check() {
     local name="$1"
     shift
@@ -40,10 +42,11 @@ check() {
         probe=("${name}" --version)
     fi
 
-    echo "Checking ${name}..."
     checked=$((checked + 1))
-    if "${probe[@]}" | head -n 1; then
-        printf '  [ ok ] %s\n' "${name}"
+    local output version
+    if output="$("${probe[@]}" 2>&1)"; then
+        version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
+        printf '  [ ok ] %-20s %s\n' "${name}" "${version}"
     else
         printf '  [MISS] %s\n' "${name}"
         missing+=("${name}")
@@ -85,12 +88,14 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check file
     check less
     check make
-    check netstat which netstat
+    # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
+    # version flag, so fall back to a presence marker there.
+    check netstat sh -c 'command -v netstat >/dev/null && { netstat --version 2>&1 | grep -m1 -oE "net-tools [0-9.]+" || echo present; }'
     check ninja
-    check perl
+    check perl perl -e 'print "$^V\n"'
     check pkg-config
     check vim
-    check zip
+    check zip bash -c 'zip --version 2>&1 | grep -m1 -oE "Zip [0-9.]+"'
 
     # These tools are present in our Linux CI images and in local development
     # setups, but not in the macOS CI environment. So check them everywhere

docs/build/nix.md

@@ -154,6 +154,14 @@ conan install .. --output-folder . --build '*' --settings build_type=Release
 
 To update `flake.lock` to the latest revision use `nix flake update` command.
 
+## Tooling snapshots
+
+The tool versions in each Nix environment are recorded in
+[`nix/check-tools/`](../../nix/check-tools) and verified by CI. If you change the
+environment (bump the CI image tag, update `flake.lock`, or edit the tool list in
+`bin/check-tools.sh`), CI fails until you regenerate and commit the affected
+snapshot — see [`nix/check-tools/README.md`](../../nix/check-tools/README.md).
+
 ## Troubleshooting
 
 See [Troubleshooting Nix problems](./nix_troubleshooting.md) for common issues,

nix/check-tools/README.md

@@ -0,0 +1,49 @@
+# check-tools snapshots
+
+These files capture the output of [`bin/check-tools.sh`](../../bin/check-tools.sh)
+— the versions of the development tooling — in each Nix environment:
+
+| File                  | Environment                         |
+| --------------------- | ----------------------------------- |
+| `nix-nixos-amd64.txt` | `nix-nixos` CI image, `linux/amd64` |
+| `nix-nixos-arm64.txt` | `nix-nixos` CI image, `linux/arm64` |
+| `macos.txt`           | macOS, inside `nix develop`         |
+
+The [`check-tools`](../../.github/workflows/check-tools.yml) workflow regenerates
+each snapshot in its environment and fails if it differs from the committed file.
+So if you change the environment (bump the image tag in
+[`linux.json`](../../.github/scripts/strategy-matrix/linux.json), update
+`flake.lock`, change the tool list in `check-tools.sh`, …) you must regenerate
+and commit the affected snapshots.
+
+Each snapshot is `check-tools.sh` stdout with the git-clone connectivity check
+skipped (`CHECK_TOOLS_SKIP_CLONE=1`), so it contains only deterministic version
+data. On macOS the dev-shell greeting that `nix develop` prints first is dropped
+with `sed -n '/^Detected OS:/,$p'`.
+
+## Regenerating
+
+The two Linux snapshots come from the `nix-nixos` image (Docker or a compatible
+runtime such as Apple `container`). The image tag is pinned in `linux.json`:
+
+```bash
+img="ghcr.io/xrplf/xrpld/nix-nixos:$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)"
+
+for arch in amd64 arm64; do
+    container run --rm -i -e CHECK_TOOLS_SKIP_CLONE=1 -a "${arch}" --entrypoint bash "${img}" -s \
+        <bin/check-tools.sh >"nix/check-tools/nix-nixos-${arch}.txt"
+done
+```
+
+(With Docker, replace `container run … -a "${arch}"` with
+`docker run … --platform "linux/${arch}"`.)
+
+The macOS snapshot is generated locally. `CI=` is unset so `check-tools.sh`
+checks the full dev-shell tool set (it otherwise skips some tools when `CI` is
+set):
+
+```bash
+CI= nix develop -c bash -c 'CHECK_TOOLS_SKIP_CLONE=1 bash bin/check-tools.sh' |
+    sed -n '/^Detected OS:/,$p' \
+        >nix/check-tools/macos.txt
+```

nix/check-tools/macos.txt

@@ -0,0 +1,47 @@
+Detected OS: macos (Darwin arm64)
+
+Core build tools:
+  [ ok ] cmake                cmake version 4.1.2
+  [ ok ] conan                Conan version 2.28.1
+  [ ok ] git                  git version 2.54.0
+  [ ok ] python3              Python 3.13.13
+
+Development tooling:
+  [ ok ] ccache               ccache version 4.13.6
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
+  [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
+  [ ok ] curl                 curl 8.20.0 (aarch64-apple-darwin25.3.0) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+  [ ok ] file                 file-5.47
+  [ ok ] less                 less 692 (PCRE2 regular expressions)
+  [ ok ] make                 GNU Make 4.4.1
+  [ ok ] netstat              present
+  [ ok ] ninja                1.13.2
+  [ ok ] perl                 v5.42.0
+  [ ok ] pkg-config           0.29.2
+  [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
+  [ ok ] zip                  Zip 3.0
+  [ ok ] clang-format         clang-format version 22.1.7
+  [ ok ] dot                  dot - graphviz version 12.2.1 (0)
+  [ ok ] doxygen              1.16.1
+  [ ok ] gcovr                gcovr 8.4
+  [ ok ] gh                   gh version 2.94.0 (nixpkgs)
+  [ ok ] git-cliff            git-cliff 2.13.1
+  [ ok ] git-lfs              git-lfs/3.7.1 (3.7.1; darwin arm64; go 1.26.3)
+  [ ok ] gpg                  gpg (GnuPG) 2.4.9
+  [ ok ] pre-commit           pre-commit 4.5.1
+  [ ok ] run-clang-tidy       usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
+
+Rust toolchain:
+  [ ok ] cargo                cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+  [ ok ] cargo-audit          cargo-audit-audit 0.22.1
+  [ ok ] cargo-llvm-cov       cargo-llvm-cov 0.8.5
+  [ ok ] cargo-nextest        cargo-nextest 0.9.137
+  [ ok ] clippy               clippy 0.1.95 (59807616e1 2026-04-14)
+  [ ok ] rust-analyzer        rust-analyzer 1.95.0 (59807616 2026-04-14)
+  [ ok ] rustc                rustc 1.95.0 (59807616e 2026-04-14)
+  [ ok ] rustfmt              rustfmt 1.9.0-stable (59807616e1 2026-04-14)
+
+Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
+
+All 36 checked tools are present and runnable.

nix/check-tools/nix-ubuntu-amd64.txt

@@ -0,0 +1,55 @@
+Detected OS: linux (Linux x86_64)
+
+Core build tools:
+  [ ok ] cmake                cmake version 4.1.2
+  [ ok ] conan                Conan version 2.28.1
+  [ ok ] git                  git version 2.54.0
+  [ ok ] python3              Python 3.13.13
+
+Development tooling:
+  [ ok ] ccache               ccache version 4.13.6
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
+  [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
+  [ ok ] curl                 curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+  [ ok ] file                 file-5.47
+  [ ok ] less                 less 692 (PCRE2 regular expressions)
+  [ ok ] make                 GNU Make 4.4.1
+  [ ok ] netstat              net-tools 2.10
+  [ ok ] ninja                1.13.2
+  [ ok ] perl                 v5.42.0
+  [ ok ] pkg-config           0.29.2
+  [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
+  [ ok ] zip                  Zip 3.0
+  [ ok ] clang-format         clang-format version 22.1.7
+  [ ok ] dot                  dot - graphviz version 12.2.1 (0)
+  [ ok ] doxygen              1.16.1
+  [ ok ] gcovr                gcovr 8.4
+  [ ok ] gh                   gh version 2.94.0 (nixpkgs)
+  [ ok ] git-cliff            git-cliff 2.13.1
+  [ ok ] git-lfs              git-lfs/3.7.1 (3.7.1; linux amd64; go 1.26.3)
+  [ ok ] gpg                  gpg (GnuPG) 2.4.9
+  [ ok ] pre-commit           pre-commit 4.5.1
+  [ ok ] run-clang-tidy       usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
+
+Rust toolchain:
+  [ ok ] cargo                cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+  [ ok ] cargo-audit          cargo-audit-audit 0.22.1
+  [ ok ] cargo-llvm-cov       cargo-llvm-cov 0.8.5
+  [ ok ] cargo-nextest        cargo-nextest 0.9.137
+  [ ok ] clippy               clippy 0.1.95 (59807616e1 2026-04-14)
+  [ ok ] rust-analyzer        rust-analyzer 1.95.0 (5980761 2026-04-14)
+  [ ok ] rustc                rustc 1.95.0 (59807616e 2026-04-14)
+  [ ok ] rustfmt              rustfmt 1.9.0-stable (59807616e1 2026-04-14)
+
+GCC toolchain:
+  [ ok ] gcc                  gcc (GCC) 15.2.0
+  [ ok ] g++                  g++ (GCC) 15.2.0
+  [ ok ] gcov                 gcov (GCC) 15.2.0
+
+Mold:
+  [ ok ] mold                 mold 2.41.0 (compatible with GNU ld)
+
+Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
+
+All 40 checked tools are present and runnable.

nix/check-tools/nix-ubuntu-arm64.txt

@@ -0,0 +1,55 @@
+Detected OS: linux (Linux aarch64)
+
+Core build tools:
+  [ ok ] cmake                cmake version 4.1.2
+  [ ok ] conan                Conan version 2.28.1
+  [ ok ] git                  git version 2.54.0
+  [ ok ] python3              Python 3.13.13
+
+Development tooling:
+  [ ok ] ccache               ccache version 4.13.6
+  [ ok ] clang                clang version 22.1.7
+  [ ok ] clang++              clang version 22.1.7
+  [ ok ] ClangBuildAnalyzer   ClangBuildAnalyzer 1.6.0
+  [ ok ] curl                 curl 8.20.0 (aarch64-unknown-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 libssh2/1.11.1 nghttp2/1.69.0 mit-krb5/1.22.1
+  [ ok ] file                 file-5.47
+  [ ok ] less                 less 692 (PCRE2 regular expressions)
+  [ ok ] make                 GNU Make 4.4.1
+  [ ok ] netstat              net-tools 2.10
+  [ ok ] ninja                1.13.2
+  [ ok ] perl                 v5.42.0
+  [ ok ] pkg-config           0.29.2
+  [ ok ] vim                  VIM - Vi IMproved 9.2 (2026 Feb 14, compiled Jan 01 1980 00:00:00)
+  [ ok ] zip                  Zip 3.0
+  [ ok ] clang-format         clang-format version 22.1.7
+  [ ok ] dot                  dot - graphviz version 12.2.1 (0)
+  [ ok ] doxygen              1.16.1
+  [ ok ] gcovr                gcovr 8.4
+  [ ok ] gh                   gh version 2.94.0 (nixpkgs)
+  [ ok ] git-cliff            git-cliff 2.13.1
+  [ ok ] git-lfs              git-lfs/3.7.1 (3.7.1; linux arm64; go 1.26.3)
+  [ ok ] gpg                  gpg (GnuPG) 2.4.9
+  [ ok ] pre-commit           pre-commit 4.5.1
+  [ ok ] run-clang-tidy       usage: run-clang-tidy [-h] [-allow-enabling-alpha-checkers]
+
+Rust toolchain:
+  [ ok ] cargo                cargo 1.95.0 (f2d3ce0bd 2026-03-21)
+  [ ok ] cargo-audit          cargo-audit-audit 0.22.1
+  [ ok ] cargo-llvm-cov       cargo-llvm-cov 0.8.5
+  [ ok ] cargo-nextest        cargo-nextest 0.9.137
+  [ ok ] clippy               clippy 0.1.95 (59807616e1 2026-04-14)
+  [ ok ] rust-analyzer        rust-analyzer 1.95.0 (5980761 2026-04-14)
+  [ ok ] rustc                rustc 1.95.0 (59807616e 2026-04-14)
+  [ ok ] rustfmt              rustfmt 1.9.0-stable (59807616e1 2026-04-14)
+
+GCC toolchain:
+  [ ok ] gcc                  gcc (GCC) 15.2.0
+  [ ok ] g++                  g++ (GCC) 15.2.0
+  [ ok ] gcov                 gcov (GCC) 15.2.0
+
+Mold:
+  [ ok ] mold                 mold 2.41.0 (compatible with GNU ld)
+
+Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
+
+All 40 checked tools are present and runnable.

nix/packages.nix

@@ -16,7 +16,23 @@ let
     exec ${pkgs.python3}/bin/python3 ${llvmPackages.clang-unwrapped}/bin/run-clang-tidy "$@"
   '';
 
-  rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
+  # rust-overlay's toolchain propagates the *default* stdenv.cc onto the PATH (so
+  # cargo has a linker). That default may be different from the clang we pin here,
+  # so it shadows our clang and the build can silently use a different compiler
+  # version. Drop that cc from every propagation channel instead of pinning a
+  # replacement: the toolchain then carries no compiler and cargo just uses the
+  # active shell's stdenv cc. Must cover all channels — rust-overlay uses both
+  # propagatedBuildInputs and depsHostHostPropagated.
+  rustToolchainBase = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
+  rustToolchain =
+    let
+      defaultCc = pkgs.stdenv.cc; # default compiler from nixpkgs stdenv
+      withoutDefaultCc = builtins.filter (dep: (dep.outPath or "") != defaultCc.outPath);
+    in
+    rustToolchainBase.overrideAttrs (old: {
+      propagatedBuildInputs = withoutDefaultCc (old.propagatedBuildInputs or [ ]);
+      depsHostHostPropagated = withoutDefaultCc (old.depsHostHostPropagated or [ ]);
+    });
 
   # Nix wraps its toolchain so that binaries are exposed only under unsuffixed
   # names (gcc, g++, clang-tidy, ...). Several tools probe for a