What the developer wrote
Authored by Matt Gleason
SFT-6061: incomplete nix shell
What changed, and why it matters
This commit adds Nix build environment files (a reproducible developer shell setup) for the Passport firmware project. It does not change any firmware code, cryptographic logic, or device behavior. There is no indication this is a security fix or introduces a security vulnerability.
No security action required. Treat as normal build-system maintenance. Reviewers may optionally verify that the pinned Nixpkgs and Rust toolchain versions are acceptable for the project's supply-chain policies, but this is a routine configuration change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit introduces a Nix flake (flake.nix), a Rust toolchain definition (extmod/foundation-rust/rust-toolchain.toml), and two helper Nix expressions (nix/cosign.nix, nix/rust-toolchain.nix). These files define development and build shells, pin Rust 1.77.1 with rustfmt, clippy, rustc, and rust-src, and package the cosign helper tool. The diff is purely additive build-system/infrastructure configuration. No runtime or firmware code is modified.
Changed components
Nix development environment (flake.nix)Rust toolchain configuration (extmod/foundation-rust/rust-toolchain.toml)Nix helper expressions (nix/cosign.nix, nix/rust-toolchain.nix)Inspect captured patch +168 / −0
diff --git a/extmod/foundation-rust/rust-toolchain.toml b/extmod/foundation-rust/rust-toolchain.toml
new file mode 100644
index 0000000..e7fb095
--- /dev/null
+++ b/extmod/foundation-rust/rust-toolchain.toml
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+[toolchain]
+channel = "1.77.1"
+components = ["rustfmt", "clippy", "rustc", "rust-src"]
+targets = []
+profile = "minimal"
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..f091df4
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,106 @@
+# SPDX-FileCopyrightText: 2025 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+{
+ description = "Passport Core development environment";
+
+ inputs = {
+ nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+ fenix = {
+ url = "github:nix-community/fenix";
+ inputs.nixpkgs.follows = "nixpkgs";
+ };
+ };
+
+ outputs =
+ {
+ self,
+ nixpkgs,
+ fenix,
+ }:
+ let
+ inherit (nixpkgs) lib;
+
+ systems = [
+ "aarch64-darwin"
+ "x86_64-darwin"
+ "aarch64-linux"
+ "x86_64-linux"
+ ];
+
+ forAllSystems = f: lib.genAttrs systems f;
+ in
+ {
+ packages = forAllSystems (
+ system:
+ let
+ pkgs = import nixpkgs {
+ inherit system;
+ };
+ ci-pkgs = with pkgs; {
+ inherit just reuse python313Packages.pycodestyle;
+ };
+ in
+ ci-pkgs
+ // import ./nix/rust-toolchain.nix {
+ inherit
+ self
+ system
+ pkgs
+ fenix
+ ;
+ }
+ // import ./nix/cosign.nix { inherit self system pkgs; }
+ );
+
+ devShells = forAllSystems (
+ system:
+ let
+ pkgs = import nixpkgs {
+ inherit system;
+ config = {
+ allowUnfree = true;
+ };
+ };
+ customPackages = self.packages.${system};
+
+ buildPackages =
+ with pkgs;
+ [
+ # cmake
+ curl
+ gcc-arm-embedded
+ git
+ gnumake
+ just
+ openssl
+ pkg-config
+ reuse
+ autoconf
+ automake
+ pkg-config
+ cbindgen
+ # unixtools.xxd
+ ]
+ ++ (with customPackages; [
+ cosign
+ ]);
+
+ devPackages =
+ buildPackages
+ ++ (with pkgs; [
+ minicom
+ sdl2
+ openocd
+ ]);
+
+
+ in
+ {
+ # full development shell
+ default = mkShell devPackages;
+ # minimal build shell
+ build = mkShell buildPackages;
+ }
+ );
+ };
+}
diff --git a/nix/cosign.nix b/nix/cosign.nix
new file mode 100644
index 0000000..7c14f5b
--- /dev/null
+++ b/nix/cosign.nix
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2025 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+{
+ self,
+ system,
+ pkgs,
+}: let
+ src = pkgs.stdenv.mkDerivation {
+ name = "cosign-src";
+ src = self + "/ports/stm32/boards/Passport/tools/cosign";
+ # TODO: account for darwin and arm architectures
+
+ buildPhase = ''
+ make
+ '';
+
+ installPhase = ''
+ cp x86/release/cosign $out
+ '';
+ outputHash = "sha256-6GEfi9zx7+RLpIbxdT6K2uMRyJ1V78aVebM+vWZmwQY=";
+ outputHashMode = "recursive";
+ };
+in {
+ cosign = pkgs.stdenv.mkDerivation {
+ pname = "cosign";
+ inherit src;
+ };
+}
diff --git a/nix/rust-toolchain.nix b/nix/rust-toolchain.nix
new file mode 100644
index 0000000..1ee9611
--- /dev/null
+++ b/nix/rust-toolchain.nix
@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2025 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+{
+ self,
+ system,
+ pkgs,
+ fenix,
+}: let
+ toolchainSha256 = lib.fakeSha256;
+
+ baseToolchain = fenix.packages.${system}.fromToolchainFile {
+ file = self + "/extmod/foundation-rust/rust-toolchain.toml";
+ sha256 = toolchainSha256;
+ };
+
+ thumbv7emHf = fenix.packages.${system}.targets.thumbv7em-none-eabihf.fromToolchainFile {
+ file = self + "/extmod/foundation-rust/rust-toolchain.toml";
+ sha256 = toolchainSha256;
+ };
+in {
+ rust-core = fenix.packages.${system}.combine [
+ baseToolchain
+ thumbv7emHf
+ ];
+ rust-analyzer = fenix.packages.${system}.rust-analyzer;
+}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.