First release.

nimstatic app.nim — asks the Nim compiler what the program links against (including the libraries Nim would dlopen at runtime, which never reach a link line), fetches musl-built static archives for them from Alpine's mirrors, and builds against a sysroot it owns. No apk, no container, no root.

• Detection from a --compileOnly --genScript probe: the build json's link command plus the dynlib candidate strings in the generated C.
• Handles the two things that silently break static Nim with TLS: --dynlibOverride for dlopen'd libraries, and the OpenSSL 3 SSL_get_peer_certificate compat define.
• Cross-compiles with --arch; zig cc supplies the musl toolchain.
• 25 offline tests.

Binary

Releases here carry notes but no assets, so the build lives on the dist branch and is addressed by commit sha — an immutable URL.

https://rickub.com/nandi/nimstatic/raw/7e028dad26624a2648439fb91b76967f81666fc5/nimstatic-0.1.0-x86_64-linux.xz

sha256  8cd024a96a0d47d148576d730c11e2c81cdebde777389f08f8bd7faa59a9e185
size    1726368 bytes (xz), x86_64-linux, stripped, fully static

Stripped and static, built by nimstatic itself.

Pinning it with DotSlash

Drop this in tools/nimstatic, chmod +x, and run it like the binary — the first run fetches, verifies and caches:

#!/usr/bin/env dotslash

{
  "name": "nimstatic",
  "platforms": {
    "linux-x86_64": {
      "size": 1726368,
      "hash": "sha256",
      "digest": "8cd024a96a0d47d148576d730c11e2c81cdebde777389f08f8bd7faa59a9e185",
      "format": "xz",
      "path": "nimstatic-0.1.0-x86_64-linux",
      "providers": [
        { "url": "https://rickub.com/nandi/nimstatic/raw/7e028dad26624a2648439fb91b76967f81666fc5/nimstatic-0.1.0-x86_64-linux.xz" }
      ]
    }
  }
}

No signature verification of Alpine packages — treat a sysroot as build input, not a trust root.