nandi/freeqsay-nim · 078b24d

⑂ 078b24d

just static: fully static builds through a pinned nimstatic

tools/nimstatic is a DotSlash file — first run fetches the published nimstatic
build, verifies its sha256 and caches it. The URL names a commit rather than a
branch, so the pin cannot move.

The result has no dynamic dependencies at all: musl libc and OpenSSL are linked
in rather than dlopen'd, which is what a static Nim binary with -d:ssl
otherwise gets wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nandi committed 2026-09-19T12:27:41-07:00 Browse files

078b24d parent: fa53aa2

modified .gitignore +4 -0 Viewed

@@ -1,5 +1,9 @@
1	1	/freeqsay
	2	+/freeqsay-static
2	3	/freeqsay.png
3	4	nimcache/
4	5	*.o
5	6	/tests/test_avatar
	7	+nimble.develop
	8	+nimble.paths
	9	+nimbledeps

  /freeqsay
++/freeqsay-static
  /freeqsay.png
  nimcache/
  *.o
  /tests/test_avatar
++nimble.develop
++nimble.paths
++nimbledeps

modified README.md +10 -0 Viewed

@@ -51,12 +51,22 @@ of them.
51	51
52	52	```bash
53	53	just build # optimized binary → ./freeqsay
	54	+just static # fully static binary → ./freeqsay-static
54	55	just test # test suite
55	56	just run <handle> <message> # run from source, no build
56	57	just shot <handle> <message> # gapless termshot png
57	58	just --list # everything else
58	59	```
59	60
	61	+`just static` produces a binary with no dynamic dependencies at all — musl
	62	+libc and OpenSSL linked in, nothing dlopen'd — so it runs on any Linux. It
	63	+builds through [nimstatic](https://rickub.com/nandi/nimstatic), pinned in
	64	+`tools/nimstatic` as a [DotSlash](https://dotslash-cli.com) file: the first run
	65	+fetches that exact build, checks its hash and caches it, and the URL names a
	66	+commit so it cannot move. A static binary carries no CA store, so set
	67	+`SSL_CERT_FILE` when resolving handles on a host without one at the default
	68	+path.
	69	+
60	70	`nimble build` and `nimble test` work too. `-d:ssl` is set in `config.nims`,
61	71	since handle resolution goes over HTTPS through the stdlib client.
62	72

  ```bash
  just build                    # optimized binary → ./freeqsay
++just static                   # fully static binary → ./freeqsay-static
  just test                     # test suite
  just run <handle> <message>   # run from source, no build
  just shot <handle> <message>  # gapless termshot png
  just --list                   # everything else
  ```
++`just static` produces a binary with no dynamic dependencies at all — musl
++libc and OpenSSL linked in, nothing dlopen'd — so it runs on any Linux. It
++builds through [nimstatic](https://rickub.com/nandi/nimstatic), pinned in
++`tools/nimstatic` as a [DotSlash](https://dotslash-cli.com) file: the first run
++fetches that exact build, checks its hash and caches it, and the URL names a
++commit so it cannot move. A static binary carries no CA store, so set
++`SSL_CERT_FILE` when resolving handles on a host without one at the default
++path.
++
  `nimble build` and `nimble test` work too. `-d:ssl` is set in `config.nims`,
  since handle resolution goes over HTTPS through the stdlib client.

modified justfile +6 -0 Viewed

@@ -8,6 +8,12 @@ default:
8	8	build:
9	9	nim c -d:release -d:ssl --hints:off -o:freeqsay src/freeqsay.nim
10	10
	11	+# Fully static binary → ./freeqsay-static. No glibc, no dlopen'd OpenSSL, so it
	12	+# runs on any Linux. tools/nimstatic is a DotSlash file: the first run fetches
	13	+# the pinned nimstatic build, verifies its hash and caches it.
	14	+static:
	15	+ ./tools/nimstatic src/freeqsay.nim -o freeqsay-static -- -d:ssl
	16	+
11	17	# Run the test suite.
12	18	test:
13	19	nim c -d:ssl --hints:off -r tests/test_avatar.nim

  build:
      nim c -d:release -d:ssl --hints:off -o:freeqsay src/freeqsay.nim
++# Fully static binary → ./freeqsay-static. No glibc, no dlopen'd OpenSSL, so it
++# runs on any Linux. tools/nimstatic is a DotSlash file: the first run fetches
++# the pinned nimstatic build, verifies its hash and caches it.
++static:
++    ./tools/nimstatic src/freeqsay.nim -o freeqsay-static -- -d:ssl
++
  # Run the test suite.
  test:
      nim c -d:ssl --hints:off -r tests/test_avatar.nim

added tools/nimstatic +22 -0 Viewed

new file mode 100755
@@ -0,0 +1,22 @@
	1	+#!/usr/bin/env dotslash
	2	+
	3	+// nimstatic, pinned. `just static` runs this; DotSlash fetches it on first use,
	4	+// verifies the hash and caches it. The URL names a commit rather than a branch,
	5	+// so it can never change under us.
	6	+{
	7	+ "name": "nimstatic",
	8	+ "platforms": {
	9	+ "linux-x86_64": {
	10	+ "size": 1726368,
	11	+ "hash": "sha256",
	12	+ "digest": "8cd024a96a0d47d148576d730c11e2c81cdebde777389f08f8bd7faa59a9e185",
	13	+ "format": "xz",
	14	+ "path": "nimstatic-0.1.0-x86_64-linux",
	15	+ "providers": [
	16	+ {
	17	+ "url": "https://rickub.com/nandi/nimstatic/raw/7e028dad26624a2648439fb91b76967f81666fc5/nimstatic-0.1.0-x86_64-linux.xz"
	18	+ }
	19	+ ]
	20	+ }
	21	+ }
	22	+}

++#!/usr/bin/env dotslash
++
++// nimstatic, pinned. `just static` runs this; DotSlash fetches it on first use,
++// verifies the hash and caches it. The URL names a commit rather than a branch,
++// so it can never change under us.
++{
++  "name": "nimstatic",
++  "platforms": {
++    "linux-x86_64": {
++      "size": 1726368,
++      "hash": "sha256",
++      "digest": "8cd024a96a0d47d148576d730c11e2c81cdebde777389f08f8bd7faa59a9e185",
++      "format": "xz",
++      "path": "nimstatic-0.1.0-x86_64-linux",
++      "providers": [
++        {
++          "url": "https://rickub.com/nandi/nimstatic/raw/7e028dad26624a2648439fb91b76967f81666fc5/nimstatic-0.1.0-x86_64-linux.xz"
++        }
++      ]
++    }
++  }
++}