Merge remote-tracking branch 'origin/master' into relative-flakes

src/libflake/.version

@@ -0,0 +1 @@
+../../.version

src/libflake/build-utils-meson

@@ -0,0 +1 @@
+../../build-utils-meson

src/libflake/flake/config.cc

@@ -0,0 +1,81 @@
+#include "users.hh"
+#include "config-global.hh"
+#include "flake/settings.hh"
+#include "flake.hh"
+
+#include <nlohmann/json.hpp>
+
+namespace nix::flake {
+
+// setting name -> setting value -> allow or ignore.
+typedef std::map<std::string, std::map<std::string, bool>> TrustedList;
+
+Path trustedListPath()
+{
+    return getDataDir() + "/trusted-settings.json";
+}
+
+static TrustedList readTrustedList()
+{
+    auto path = trustedListPath();
+    if (!pathExists(path)) return {};
+    auto json = nlohmann::json::parse(readFile(path));
+    return json;
+}
+
+static void writeTrustedList(const TrustedList & trustedList)
+{
+    auto path = trustedListPath();
+    createDirs(dirOf(path));
+    writeFile(path, nlohmann::json(trustedList).dump());
+}
+
+void ConfigFile::apply(const Settings & flakeSettings)
+{
+    std::set<std::string> whitelist{"bash-prompt", "bash-prompt-prefix", "bash-prompt-suffix", "flake-registry", "commit-lock-file-summary", "commit-lockfile-summary"};
+
+    for (auto & [name, value] : settings) {
+
+        auto baseName = hasPrefix(name, "extra-") ? std::string(name, 6) : name;
+
+        // FIXME: Move into libutil/config.cc.
+        std::string valueS;
+        if (auto* s = std::get_if<std::string>(&value))
+            valueS = *s;
+        else if (auto* n = std::get_if<int64_t>(&value))
+            valueS = fmt("%d", *n);
+        else if (auto* b = std::get_if<Explicit<bool>>(&value))
+            valueS = b->t ? "true" : "false";
+        else if (auto ss = std::get_if<std::vector<std::string>>(&value))
+            valueS = dropEmptyInitThenConcatStringsSep(" ", *ss); // FIXME: evil
+        else
+            assert(false);
+
+        if (!whitelist.count(baseName) && !flakeSettings.acceptFlakeConfig) {
+            bool trusted = false;
+            auto trustedList = readTrustedList();
+            auto tlname = get(trustedList, name);
+            if (auto saved = tlname ? get(*tlname, valueS) : nullptr) {
+                trusted = *saved;
+                printInfo("Using saved setting for '%s = %s' from ~/.local/share/nix/trusted-settings.json.", name, valueS);
+            } else {
+                // FIXME: filter ANSI escapes, newlines, \r, etc.
+                if (std::tolower(logger->ask(fmt("do you want to allow configuration setting '%s' to be set to '" ANSI_RED "%s" ANSI_NORMAL "' (y/N)?", name, valueS)).value_or('n')) == 'y') {
+                    trusted = true;
+                }
+                if (std::tolower(logger->ask(fmt("do you want to permanently mark this value as %s (y/N)?",  trusted ? "trusted": "untrusted" )).value_or('n')) == 'y') {
+                    trustedList[name][valueS] = trusted;
+                    writeTrustedList(trustedList);
+                }
+            }
+            if (!trusted) {
+                warn("ignoring untrusted flake configuration setting '%s'.\nPass '%s' to trust it", name, "--accept-flake-config");
+                continue;
+            }
+        }
+
+        globalConfig.set(name, valueS);
+    }
+}
+
+}

src/libflake/flake/flake.hh

@@ -0,0 +1,237 @@
+#pragma once
+///@file
+
+#include "types.hh"
+#include "flakeref.hh"
+#include "lockfile.hh"
+#include "value.hh"
+
+namespace nix {
+
+class EvalState;
+
+namespace flake {
+
+struct Settings;
+
+/**
+ * Initialize `libnixflake`
+ *
+ * So far, this registers the `builtins.getFlake` primop, which depends
+ * on the choice of `flake:Settings`.
+ */
+void initLib(const Settings & settings);
+
+struct FlakeInput;
+
+typedef std::map<FlakeId, FlakeInput> FlakeInputs;
+
+/**
+ * FlakeInput is the 'Flake'-level parsed form of the "input" entries
+ * in the flake file.
+ *
+ * A FlakeInput is normally constructed by the 'parseFlakeInput'
+ * function which parses the input specification in the '.flake' file
+ * to create a 'FlakeRef' (a fetcher, the fetcher-specific
+ * representation of the input specification, and possibly the fetched
+ * local store path result) and then creating this FlakeInput to hold
+ * that FlakeRef, along with anything that might override that
+ * FlakeRef (like command-line overrides or "follows" specifications).
+ *
+ * A FlakeInput is also sometimes constructed directly from a FlakeRef
+ * instead of starting at the flake-file input specification
+ * (e.g. overrides, follows, and implicit inputs).
+ *
+ * A FlakeInput will usually have one of either "ref" or "follows"
+ * set.  If not otherwise specified, a "ref" will be generated to a
+ * 'type="indirect"' flake, which is treated as simply the name of a
+ * flake to be resolved in the registry.
+ */
+
+struct FlakeInput
+{
+    std::optional<FlakeRef> ref;
+    /**
+     * true = process flake to get outputs
+     *
+     * false = (fetched) static source path
+     */
+    bool isFlake = true;
+    std::optional<InputPath> follows;
+    FlakeInputs overrides;
+};
+
+struct ConfigFile
+{
+    using ConfigValue = std::variant<std::string, int64_t, Explicit<bool>, std::vector<std::string>>;
+
+    std::map<std::string, ConfigValue> settings;
+
+    void apply(const Settings & settings);
+};
+
+/**
+ * The contents of a flake.nix file.
+ */
+struct Flake
+{
+    /**
+     * The original flake specification (by the user)
+     */
+    FlakeRef originalRef;
+    /**
+     * registry references and caching resolved to the specific underlying flake
+     */
+    FlakeRef resolvedRef;
+    /**
+     * the specific local store result of invoking the fetcher
+     */
+    FlakeRef lockedRef;
+    /**
+     * The path of `flake.nix`.
+     */
+    SourcePath path;
+    /**
+     * pretend that 'lockedRef' is dirty
+     */
+    bool forceDirty = false;
+    std::optional<std::string> description;
+    FlakeInputs inputs;
+    /**
+     * 'nixConfig' attribute
+     */
+    ConfigFile config;
+
+    ~Flake();
+
+    SourcePath lockFilePath()
+    {
+        return path.parent() / "flake.lock";
+    }
+};
+
+Flake getFlake(EvalState & state, const FlakeRef & flakeRef, bool allowLookup);
+
+/**
+ * Fingerprint of a locked flake; used as a cache key.
+ */
+typedef Hash Fingerprint;
+
+struct LockedFlake
+{
+    Flake flake;
+    LockFile lockFile;
+
+    /**
+     * Source tree accessors for nodes that have been fetched in
+     * lockFlake(); in particular, the root node and the overriden
+     * inputs.
+     */
+    std::map<ref<Node>, SourcePath> nodePaths;
+
+    std::optional<Fingerprint> getFingerprint(ref<Store> store) const;
+};
+
+struct LockFlags
+{
+    /**
+     * Whether to ignore the existing lock file, creating a new one
+     * from scratch.
+     */
+    bool recreateLockFile = false;
+
+    /**
+     * Whether to update the lock file at all. If set to false, if any
+     * change to the lock file is needed (e.g. when an input has been
+     * added to flake.nix), you get a fatal error.
+     */
+    bool updateLockFile = true;
+
+    /**
+     * Whether to write the lock file to disk. If set to true, if the
+     * any changes to the lock file are needed and the flake is not
+     * writable (i.e. is not a local Git working tree or similar), you
+     * get a fatal error. If set to false, Nix will use the modified
+     * lock file in memory only, without writing it to disk.
+     */
+    bool writeLockFile = true;
+
+    /**
+     * Whether to use the registries to lookup indirect flake
+     * references like 'nixpkgs'.
+     */
+    std::optional<bool> useRegistries = std::nullopt;
+
+    /**
+     * Whether to apply flake's nixConfig attribute to the configuration
+     */
+
+    bool applyNixConfig = false;
+
+    /**
+     * Whether unlocked flake references (i.e. those without a Git
+     * revision or similar) without a corresponding lock are
+     * allowed. Unlocked flake references with a lock are always
+     * allowed.
+     */
+    bool allowUnlocked = true;
+
+    /**
+     * Whether to commit changes to flake.lock.
+     */
+    bool commitLockFile = false;
+
+    /**
+     * The path to a lock file to read instead of the `flake.lock` file in the top-level flake
+     */
+    std::optional<SourcePath> referenceLockFilePath;
+
+    /**
+     * The path to a lock file to write to instead of the `flake.lock` file in the top-level flake
+     */
+    std::optional<Path> outputLockFilePath;
+
+    /**
+     * Flake inputs to be overridden.
+     */
+    std::map<InputPath, FlakeRef> inputOverrides;
+
+    /**
+     * Flake inputs to be updated. This means that any existing lock
+     * for those inputs will be ignored.
+     */
+    std::set<InputPath> inputUpdates;
+};
+
+LockedFlake lockFlake(
+    const Settings & settings,
+    EvalState & state,
+    const FlakeRef & flakeRef,
+    const LockFlags & lockFlags);
+
+void callFlake(
+    EvalState & state,
+    const LockedFlake & lockedFlake,
+    Value & v);
+
+/**
+ * Map a `SourcePath` to the corresponding store path. This is a
+ * temporary hack to support chroot stores while we don't have full
+ * lazy trees. FIXME: Remove this once we can pass a sourcePath rather
+ * than a storePath to call-flake.nix.
+ */
+std::pair<StorePath, Path> sourcePathToStorePath(
+    ref<Store> store,
+    const SourcePath & path);
+
+}
+
+void emitTreeAttrs(
+    EvalState & state,
+    const StorePath & storePath,
+    const fetchers::Input & input,
+    Value & v,
+    bool emptyRevFallback = false,
+    bool forceDirty = false);
+
+}

src/libflake/flake/flakeref.cc

@@ -0,0 +1,321 @@
+#include "flakeref.hh"
+#include "store-api.hh"
+#include "url.hh"
+#include "url-parts.hh"
+#include "fetchers.hh"
+#include "registry.hh"
+
+namespace nix {
+
+#if 0
+// 'dir' path elements cannot start with a '.'. We also reject
+// potentially dangerous characters like ';'.
+const static std::string subDirElemRegex = "(?:[a-zA-Z0-9_-]+[a-zA-Z0-9._-]*)";
+const static std::string subDirRegex = subDirElemRegex + "(?:/" + subDirElemRegex + ")*";
+#endif
+
+std::string FlakeRef::to_string() const
+{
+    std::map<std::string, std::string> extraQuery;
+    if (subdir != "")
+        extraQuery.insert_or_assign("dir", subdir);
+    return input.toURLString(extraQuery);
+}
+
+fetchers::Attrs FlakeRef::toAttrs() const
+{
+    auto attrs = input.toAttrs();
+    if (subdir != "")
+        attrs.emplace("dir", subdir);
+    return attrs;
+}
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef)
+{
+    str << flakeRef.to_string();
+    return str;
+}
+
+FlakeRef FlakeRef::resolve(ref<Store> store) const
+{
+    auto [input2, extraAttrs] = lookupInRegistries(store, input);
+    return FlakeRef(std::move(input2), fetchers::maybeGetStrAttr(extraAttrs, "dir").value_or(subdir));
+}
+
+FlakeRef parseFlakeRef(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir,
+    bool allowMissing,
+    bool isFlake,
+    bool allowRelative)
+{
+    auto [flakeRef, fragment] = parseFlakeRefWithFragment(fetchSettings, url, baseDir, allowMissing, isFlake, allowRelative);
+    if (fragment != "")
+        throw Error("unexpected fragment '%s' in flake reference '%s'", fragment, url);
+    return flakeRef;
+}
+
+std::optional<FlakeRef> maybeParseFlakeRef(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir)
+{
+    try {
+        return parseFlakeRef(fetchSettings, url, baseDir);
+    } catch (Error &) {
+        return {};
+    }
+}
+
+static std::pair<FlakeRef, std::string> fromParsedURL(
+    const fetchers::Settings & fetchSettings,
+    ParsedURL && parsedURL,
+    bool isFlake)
+{
+    auto dir = getOr(parsedURL.query, "dir", "");
+    parsedURL.query.erase("dir");
+
+    std::string fragment;
+    std::swap(fragment, parsedURL.fragment);
+
+    return std::make_pair(FlakeRef(fetchers::Input::fromURL(fetchSettings, parsedURL, isFlake), dir), fragment);
+}
+
+std::pair<FlakeRef, std::string> parsePathFlakeRefWithFragment(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir,
+    bool allowMissing,
+    bool isFlake,
+    bool allowRelative)
+{
+    std::string path = url;
+    std::string fragment = "";
+    std::map<std::string, std::string> query;
+    auto pathEnd = url.find_first_of("#?");
+    auto fragmentStart = pathEnd;
+    if (pathEnd != std::string::npos && url[pathEnd] == '?') {
+        fragmentStart = url.find("#");
+    }
+    if (pathEnd != std::string::npos) {
+        path = url.substr(0, pathEnd);
+    }
+    if (fragmentStart != std::string::npos) {
+        fragment = percentDecode(url.substr(fragmentStart+1));
+    }
+    if (pathEnd != std::string::npos && fragmentStart != std::string::npos) {
+        query = decodeQuery(url.substr(pathEnd + 1, fragmentStart - pathEnd - 1));
+    }
+
+    if (baseDir) {
+        /* Check if 'url' is a path (either absolute or relative
+            to 'baseDir'). If so, search upward to the root of the
+            repo (i.e. the directory containing .git). */
+
+        path = absPath(path, baseDir);
+
+        if (isFlake) {
+
+            if (!S_ISDIR(lstat(path).st_mode)) {
+                if (baseNameOf(path) == "flake.nix") {
+                    // Be gentle with people who accidentally write `/foo/bar/flake.nix` instead of `/foo/bar`
+                    warn(
+                        "Path '%s' should point at the directory containing the 'flake.nix' file, not the file itself. "
+                        "Pretending that you meant '%s'"
+                        , path, dirOf(path));
+                    path = dirOf(path);
+                } else {
+                    throw BadURL("path '%s' is not a flake (because it's not a directory)", path);
+                }
+            }
+
+            if (!allowMissing && !pathExists(path + "/flake.nix")){
+                notice("path '%s' does not contain a 'flake.nix', searching up",path);
+
+                // Save device to detect filesystem boundary
+                dev_t device = lstat(path).st_dev;
+                bool found = false;
+                while (path != "/") {
+                    if (pathExists(path + "/flake.nix")) {
+                        found = true;
+                        break;
+                    } else if (pathExists(path + "/.git"))
+                        throw Error("path '%s' is not part of a flake (neither it nor its parent directories contain a 'flake.nix' file)", path);
+                    else {
+                        if (lstat(path).st_dev != device)
+                            throw Error("unable to find a flake before encountering filesystem boundary at '%s'", path);
+                    }
+                    path = dirOf(path);
+                }
+                if (!found)
+                    throw BadURL("could not find a flake.nix file");
+            }
+
+            if (!allowMissing && !pathExists(path + "/flake.nix"))
+                throw BadURL("path '%s' is not a flake (because it doesn't contain a 'flake.nix' file)", path);
+
+            auto flakeRoot = path;
+            std::string subdir;
+
+            while (flakeRoot != "/") {
+                if (pathExists(flakeRoot + "/.git")) {
+                    auto base = std::string("git+file://") + flakeRoot;
+
+                    auto parsedURL = ParsedURL{
+                        .url = base, // FIXME
+                        .base = base,
+                        .scheme = "git+file",
+                        .authority = "",
+                        .path = flakeRoot,
+                        .query = query,
+                        .fragment = fragment,
+                    };
+
+                    if (subdir != "") {
+                        if (parsedURL.query.count("dir"))
+                            throw Error("flake URL '%s' has an inconsistent 'dir' parameter", url);
+                        parsedURL.query.insert_or_assign("dir", subdir);
+                    }
+
+                    if (pathExists(flakeRoot + "/.git/shallow"))
+                        parsedURL.query.insert_or_assign("shallow", "1");
+
+                    return fromParsedURL(fetchSettings, std::move(parsedURL), isFlake);
+                }
+
+                subdir = std::string(baseNameOf(flakeRoot)) + (subdir.empty() ? "" : "/" + subdir);
+                flakeRoot = dirOf(flakeRoot);
+            }
+        }
+
+    } else {
+        if (!allowRelative && !hasPrefix(path, "/"))
+            throw BadURL("flake reference '%s' is not an absolute path", url);
+    }
+
+    fetchers::Attrs attrs;
+    attrs.insert_or_assign("type", "path");
+    attrs.insert_or_assign("path", path);
+
+    return fromParsedURL(fetchSettings, {
+        .url = path,
+        .base = path,
+        .scheme = "path",
+        .authority = "",
+        .path = path,
+        .query = query,
+        .fragment = fragment
+    }, isFlake);
+}
+
+/* Check if 'url' is a flake ID. This is an abbreviated syntax for
+    'flake:<flake-id>?ref=<ref>&rev=<rev>'. */
+static std::optional<std::pair<FlakeRef, std::string>> parseFlakeIdRef(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    bool isFlake)
+{
+    std::smatch match;
+
+    static std::regex flakeRegex(
+        "((" + flakeIdRegexS + ")(?:/(?:" + refAndOrRevRegex + "))?)"
+        + "(?:#(" + fragmentRegex + "))?",
+        std::regex::ECMAScript);
+
+    if (std::regex_match(url, match, flakeRegex)) {
+        auto parsedURL = ParsedURL{
+            .url = url,
+            .base = "flake:" + match.str(1),
+            .scheme = "flake",
+            .authority = "",
+            .path = match[1],
+        };
+
+        return std::make_pair(
+            FlakeRef(fetchers::Input::fromURL(fetchSettings, parsedURL, isFlake), ""),
+            percentDecode(match.str(6)));
+    }
+
+    return {};
+}
+
+std::optional<std::pair<FlakeRef, std::string>> parseURLFlakeRef(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir,
+    bool isFlake)
+{
+    try {
+        return fromParsedURL(fetchSettings, parseURL(url), isFlake);
+    } catch (BadURL &) {
+        return std::nullopt;
+    }
+}
+
+std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir,
+    bool allowMissing,
+    bool isFlake,
+    bool allowRelative)
+{
+    using namespace fetchers;
+
+    std::smatch match;
+
+    if (auto res = parseFlakeIdRef(fetchSettings, url, isFlake)) {
+        return *res;
+    } else if (auto res = parseURLFlakeRef(fetchSettings, url, baseDir, isFlake)) {
+        return *res;
+    } else {
+        return parsePathFlakeRefWithFragment(fetchSettings, url, baseDir, allowMissing, isFlake, allowRelative);
+    }
+}
+
+std::optional<std::pair<FlakeRef, std::string>> maybeParseFlakeRefWithFragment(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url, const std::optional<Path> & baseDir)
+{
+    try {
+        return parseFlakeRefWithFragment(fetchSettings, url, baseDir);
+    } catch (Error & e) {
+        return {};
+    }
+}
+
+FlakeRef FlakeRef::fromAttrs(
+    const fetchers::Settings & fetchSettings,
+    const fetchers::Attrs & attrs)
+{
+    auto attrs2(attrs);
+    attrs2.erase("dir");
+    return FlakeRef(
+        fetchers::Input::fromAttrs(fetchSettings, std::move(attrs2)),
+        fetchers::maybeGetStrAttr(attrs, "dir").value_or(""));
+}
+
+std::pair<StorePath, FlakeRef> FlakeRef::fetchTree(ref<Store> store) const
+{
+    auto [storePath, lockedInput] = input.fetchToStore(store);
+    return {std::move(storePath), FlakeRef(std::move(lockedInput), subdir)};
+}
+
+std::tuple<FlakeRef, std::string, ExtendedOutputsSpec> parseFlakeRefWithFragmentAndExtendedOutputsSpec(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir,
+    bool allowMissing,
+    bool isFlake)
+{
+    auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(url);
+    auto [flakeRef, fragment] = parseFlakeRefWithFragment(
+        fetchSettings,
+        std::string { prefix }, baseDir, allowMissing, isFlake);
+    return {std::move(flakeRef), fragment, std::move(extendedOutputsSpec)};
+}
+
+std::regex flakeIdRegex(flakeIdRegexS, std::regex::ECMAScript);
+
+}

src/libflake/flake/flakeref.hh

@@ -0,0 +1,122 @@
+#pragma once
+///@file
+
+#include <regex>
+
+#include "types.hh"
+#include "fetchers.hh"
+#include "outputs-spec.hh"
+
+namespace nix {
+
+class Store;
+
+typedef std::string FlakeId;
+
+/**
+ * A flake reference specifies how to fetch a flake or raw source
+ * (e.g. from a Git repository).  It is created from a URL-like syntax
+ * (e.g. 'github:NixOS/patchelf'), an attrset representation (e.g. '{
+ * type="github"; owner = "NixOS"; repo = "patchelf"; }'), or a local
+ * path.
+ *
+ * Each flake will have a number of FlakeRef objects: one for each
+ * input to the flake.
+ *
+ * The normal method of constructing a FlakeRef is by starting with an
+ * input description (usually the attrs or a url from the flake file),
+ * locating a fetcher for that input, and then capturing the Input
+ * object that fetcher generates (usually via
+ * FlakeRef::fromAttrs(attrs) or parseFlakeRef(url) calls).
+ *
+ * The actual fetch may not have been performed yet (i.e. a FlakeRef may
+ * be lazy), but the fetcher can be invoked at any time via the
+ * FlakeRef to ensure the store is populated with this input.
+ */
+struct FlakeRef
+{
+    /**
+     * Fetcher-specific representation of the input, sufficient to
+     * perform the fetch operation.
+     */
+    fetchers::Input input;
+
+    /**
+     * sub-path within the fetched input that represents this input
+     */
+    Path subdir;
+
+    bool operator ==(const FlakeRef & other) const = default;
+
+    FlakeRef(fetchers::Input && input, const Path & subdir)
+        : input(std::move(input)), subdir(subdir)
+    { }
+
+    // FIXME: change to operator <<.
+    std::string to_string() const;
+
+    fetchers::Attrs toAttrs() const;
+
+    FlakeRef resolve(ref<Store> store) const;
+
+    static FlakeRef fromAttrs(
+        const fetchers::Settings & fetchSettings,
+        const fetchers::Attrs & attrs);
+
+    std::pair<StorePath, FlakeRef> fetchTree(ref<Store> store) const;
+};
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);
+
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
+FlakeRef parseFlakeRef(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir = {},
+    bool allowMissing = false,
+    bool isFlake = true,
+    bool allowRelative = false);
+
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
+std::optional<FlakeRef> maybeParseFlake(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir = {});
+
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
+std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir = {},
+    bool allowMissing = false,
+    bool isFlake = true,
+    bool allowRelative = false);
+
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
+std::optional<std::pair<FlakeRef, std::string>> maybeParseFlakeRefWithFragment(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir = {});
+
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
+std::tuple<FlakeRef, std::string, ExtendedOutputsSpec> parseFlakeRefWithFragmentAndExtendedOutputsSpec(
+    const fetchers::Settings & fetchSettings,
+    const std::string & url,
+    const std::optional<Path> & baseDir = {},
+    bool allowMissing = false,
+    bool isFlake = true);
+
+const static std::string flakeIdRegexS = "[a-zA-Z][a-zA-Z0-9_-]*";
+extern std::regex flakeIdRegex;
+
+}

src/libflake/flake/lockfile.cc

@@ -0,0 +1,381 @@
+#include <unordered_set>
+
+#include "lockfile.hh"
+#include "store-api.hh"
+
+#include <algorithm>
+#include <iomanip>
+
+#include <iterator>
+#include <nlohmann/json.hpp>
+
+#include "strings.hh"
+
+namespace nix::flake {
+
+static FlakeRef getFlakeRef(
+    const fetchers::Settings & fetchSettings,
+    const nlohmann::json & json,
+    const char * attr,
+    const char * info)
+{
+    auto i = json.find(attr);
+    if (i != json.end()) {
+        auto attrs = fetchers::jsonToAttrs(*i);
+        // FIXME: remove when we drop support for version 5.
+        if (info) {
+            auto j = json.find(info);
+            if (j != json.end()) {
+                for (auto k : fetchers::jsonToAttrs(*j))
+                    attrs.insert_or_assign(k.first, k.second);
+            }
+        }
+        return FlakeRef::fromAttrs(fetchSettings, attrs);
+    }
+
+    throw Error("attribute '%s' missing in lock file", attr);
+}
+
+LockedNode::LockedNode(
+    const fetchers::Settings & fetchSettings,
+    const nlohmann::json & json)
+    : lockedRef(getFlakeRef(fetchSettings, json, "locked", "info")) // FIXME: remove "info"
+    , originalRef(getFlakeRef(fetchSettings, json, "original", nullptr))
+    , isFlake(json.find("flake") != json.end() ? (bool) json["flake"] : true)
+    , parentPath(json.find("parent") != json.end() ? (std::optional<InputPath>) json["parent"] : std::nullopt)
+{
+    if (!lockedRef.input.isLocked() && !lockedRef.input.isRelative())
+        throw Error("lock file contains unlocked input '%s'",
+            fetchers::attrsToJSON(lockedRef.input.toAttrs()));
+}
+
+StorePath LockedNode::computeStorePath(Store & store) const
+{
+    return lockedRef.input.computeStorePath(store);
+}
+
+
+static std::shared_ptr<Node> doFind(const ref<Node> & root, const InputPath & path, std::vector<InputPath> & visited)
+{
+    auto pos = root;
+
+    auto found = std::find(visited.cbegin(), visited.cend(), path);
+
+    if (found != visited.end()) {
+        std::vector<std::string> cycle;
+        std::transform(found, visited.cend(), std::back_inserter(cycle), printInputPath);
+        cycle.push_back(printInputPath(path));
+        throw Error("follow cycle detected: [%s]", concatStringsSep(" -> ", cycle));
+    }
+    visited.push_back(path);
+
+    for (auto & elem : path) {
+        if (auto i = get(pos->inputs, elem)) {
+            if (auto node = std::get_if<0>(&*i))
+                pos = *node;
+            else if (auto follows = std::get_if<1>(&*i)) {
+                if (auto p = doFind(root, *follows, visited))
+                    pos = ref(p);
+                else
+                    return {};
+            }
+        } else
+            return {};
+    }
+
+    return pos;
+}
+
+std::shared_ptr<Node> LockFile::findInput(const InputPath & path)
+{
+    std::vector<InputPath> visited;
+    return doFind(root, path, visited);
+}
+
+LockFile::LockFile(
+    const fetchers::Settings & fetchSettings,
+    std::string_view contents, std::string_view path)
+{
+    auto json = nlohmann::json::parse(contents);
+
+    auto version = json.value("version", 0);
+    if (version < 5 || version > 7)
+        throw Error("lock file '%s' has unsupported version %d", path, version);
+
+    std::map<std::string, ref<Node>> nodeMap;
+
+    std::function<void(Node & node, const nlohmann::json & jsonNode)> getInputs;
+
+    getInputs = [&](Node & node, const nlohmann::json & jsonNode)
+    {
+        if (jsonNode.find("inputs") == jsonNode.end()) return;
+        for (auto & i : jsonNode["inputs"].items()) {
+            if (i.value().is_array()) { // FIXME: remove, obsolete
+                InputPath path;
+                for (auto & j : i.value())
+                    path.push_back(j);
+                node.inputs.insert_or_assign(i.key(), path);
+            } else {
+                std::string inputKey = i.value();
+                auto k = nodeMap.find(inputKey);
+                if (k == nodeMap.end()) {
+                    auto & nodes = json["nodes"];
+                    auto jsonNode2 = nodes.find(inputKey);
+                    if (jsonNode2 == nodes.end())
+                        throw Error("lock file references missing node '%s'", inputKey);
+                    auto input = make_ref<LockedNode>(fetchSettings, *jsonNode2);
+                    k = nodeMap.insert_or_assign(inputKey, input).first;
+                    getInputs(*input, *jsonNode2);
+                }
+                if (auto child = k->second.dynamic_pointer_cast<LockedNode>())
+                    node.inputs.insert_or_assign(i.key(), ref(child));
+                else
+                    // FIXME: replace by follows node
+                    throw Error("lock file contains cycle to root node");
+            }
+        }
+    };
+
+    std::string rootKey = json["root"];
+    nodeMap.insert_or_assign(rootKey, root);
+    getInputs(*root, json["nodes"][rootKey]);
+
+    // FIXME: check that there are no cycles in version >= 7. Cycles
+    // between inputs are only possible using 'follows' indirections.
+    // Once we drop support for version <= 6, we can simplify the code
+    // a bit since we don't need to worry about cycles.
+}
+
+std::pair<nlohmann::json, LockFile::KeyMap> LockFile::toJSON() const
+{
+    nlohmann::json nodes;
+    KeyMap nodeKeys;
+    std::unordered_set<std::string> keys;
+
+    std::function<std::string(const std::string & key, ref<const Node> node)> dumpNode;
+
+    dumpNode = [&](std::string key, ref<const Node> node) -> std::string
+    {
+        auto k = nodeKeys.find(node);
+        if (k != nodeKeys.end())
+            return k->second;
+
+        if (!keys.insert(key).second) {
+            for (int n = 2; ; ++n) {
+                auto k = fmt("%s_%d", key, n);
+                if (keys.insert(k).second) {
+                    key = k;
+                    break;
+                }
+            }
+        }
+
+        nodeKeys.insert_or_assign(node, key);
+
+        auto n = nlohmann::json::object();
+
+        if (!node->inputs.empty()) {
+            auto inputs = nlohmann::json::object();
+            for (auto & i : node->inputs) {
+                if (auto child = std::get_if<0>(&i.second)) {
+                    inputs[i.first] = dumpNode(i.first, *child);
+                } else if (auto follows = std::get_if<1>(&i.second)) {
+                    auto arr = nlohmann::json::array();
+                    for (auto & x : *follows)
+                        arr.push_back(x);
+                    inputs[i.first] = std::move(arr);
+                }
+            }
+            n["inputs"] = std::move(inputs);
+        }
+
+        if (auto lockedNode = node.dynamic_pointer_cast<const LockedNode>()) {
+            n["original"] = fetchers::attrsToJSON(lockedNode->originalRef.toAttrs());
+            n["locked"] = fetchers::attrsToJSON(lockedNode->lockedRef.toAttrs());
+            if (!lockedNode->isFlake)
+                n["flake"] = false;
+            if (lockedNode->parentPath)
+                n["parent"] = *lockedNode->parentPath;
+        }
+
+        nodes[key] = std::move(n);
+
+        return key;
+    };
+
+    nlohmann::json json;
+    json["version"] = 7;
+    json["root"] = dumpNode("root", root);
+    json["nodes"] = std::move(nodes);
+
+    return {json, std::move(nodeKeys)};
+}
+
+std::pair<std::string, LockFile::KeyMap> LockFile::to_string() const
+{
+    auto [json, nodeKeys] = toJSON();
+    return {json.dump(2), std::move(nodeKeys)};
+}
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile)
+{
+    stream << lockFile.toJSON().first.dump(2);
+    return stream;
+}
+
+std::optional<FlakeRef> LockFile::isUnlocked() const
+{
+    std::set<ref<const Node>> nodes;
+
+    std::function<void(ref<const Node> node)> visit;
+
+    visit = [&](ref<const Node> node)
+    {
+        if (!nodes.insert(node).second) return;
+        for (auto & i : node->inputs)
+            if (auto child = std::get_if<0>(&i.second))
+                visit(*child);
+    };
+
+    visit(root);
+
+    for (auto & i : nodes) {
+        if (i == ref<const Node>(root)) continue;
+        auto node = i.dynamic_pointer_cast<const LockedNode>();
+        if (node
+            && !node->lockedRef.input.isLocked()
+            && !node->lockedRef.input.isRelative())
+            return node->lockedRef;
+    }
+
+    return {};
+}
+
+bool LockFile::operator ==(const LockFile & other) const
+{
+    // FIXME: slow
+    return toJSON().first == other.toJSON().first;
+}
+
+InputPath parseInputPath(std::string_view s)
+{
+    InputPath path;
+
+    for (auto & elem : tokenizeString<std::vector<std::string>>(s, "/")) {
+        if (!std::regex_match(elem, flakeIdRegex))
+            throw UsageError("invalid flake input path element '%s'", elem);
+        path.push_back(elem);
+    }
+
+    return path;
+}
+
+std::map<InputPath, Node::Edge> LockFile::getAllInputs() const
+{
+    std::set<ref<Node>> done;
+    std::map<InputPath, Node::Edge> res;
+
+    std::function<void(const InputPath & prefix, ref<Node> node)> recurse;
+
+    recurse = [&](const InputPath & prefix, ref<Node> node)
+    {
+        if (!done.insert(node).second) return;
+
+        for (auto &[id, input] : node->inputs) {
+            auto inputPath(prefix);
+            inputPath.push_back(id);
+            res.emplace(inputPath, input);
+            if (auto child = std::get_if<0>(&input))
+                recurse(inputPath, *child);
+        }
+    };
+
+    recurse({}, root);
+
+    return res;
+}
+
+static std::string describe(const FlakeRef & flakeRef)
+{
+    auto s = fmt("'%s'", flakeRef.to_string());
+
+    if (auto lastModified = flakeRef.input.getLastModified())
+        s += fmt(" (%s)", std::put_time(std::gmtime(&*lastModified), "%Y-%m-%d"));
+
+    return s;
+}
+
+std::ostream & operator <<(std::ostream & stream, const Node::Edge & edge)
+{
+    if (auto node = std::get_if<0>(&edge))
+        stream << describe((*node)->lockedRef);
+    else if (auto follows = std::get_if<1>(&edge))
+        stream << fmt("follows '%s'", printInputPath(*follows));
+    return stream;
+}
+
+static bool equals(const Node::Edge & e1, const Node::Edge & e2)
+{
+    if (auto n1 = std::get_if<0>(&e1))
+        if (auto n2 = std::get_if<0>(&e2))
+            return (*n1)->lockedRef == (*n2)->lockedRef;
+    if (auto f1 = std::get_if<1>(&e1))
+        if (auto f2 = std::get_if<1>(&e2))
+            return *f1 == *f2;
+    return false;
+}
+
+std::string LockFile::diff(const LockFile & oldLocks, const LockFile & newLocks)
+{
+    auto oldFlat = oldLocks.getAllInputs();
+    auto newFlat = newLocks.getAllInputs();
+
+    auto i = oldFlat.begin();
+    auto j = newFlat.begin();
+    std::string res;
+
+    while (i != oldFlat.end() || j != newFlat.end()) {
+        if (j != newFlat.end() && (i == oldFlat.end() || i->first > j->first)) {
+            res += fmt("• " ANSI_GREEN "Added input '%s':" ANSI_NORMAL "\n    %s\n",
+                printInputPath(j->first), j->second);
+            ++j;
+        } else if (i != oldFlat.end() && (j == newFlat.end() || i->first < j->first)) {
+            res += fmt("• " ANSI_RED "Removed input '%s'" ANSI_NORMAL "\n", printInputPath(i->first));
+            ++i;
+        } else {
+            if (!equals(i->second, j->second)) {
+                res += fmt("• " ANSI_BOLD "Updated input '%s':" ANSI_NORMAL "\n    %s\n  → %s\n",
+                    printInputPath(i->first),
+                    i->second,
+                    j->second);
+            }
+            ++i;
+            ++j;
+        }
+    }
+
+    return res;
+}
+
+void LockFile::check()
+{
+    auto inputs = getAllInputs();
+
+    for (auto & [inputPath, input] : inputs) {
+        if (auto follows = std::get_if<1>(&input)) {
+            if (!follows->empty() && !findInput(*follows))
+                throw Error("input '%s' follows a non-existent input '%s'",
+                    printInputPath(inputPath),
+                    printInputPath(*follows));
+        }
+    }
+}
+
+void check();
+
+std::string printInputPath(const InputPath & path)
+{
+    return concatStringsSep("/", path);
+}
+
+}

src/libflake/flake/lockfile.hh

@@ -0,0 +1,104 @@
+#pragma once
+///@file
+
+#include "flakeref.hh"
+
+#include <nlohmann/json_fwd.hpp>
+
+namespace nix {
+class Store;
+class StorePath;
+}
+
+namespace nix::flake {
+
+typedef std::vector<FlakeId> InputPath;
+
+struct LockedNode;
+
+/**
+ * A node in the lock file. It has outgoing edges to other nodes (its
+ * inputs). Only the root node has this type; all other nodes have
+ * type LockedNode.
+ */
+struct Node : std::enable_shared_from_this<Node>
+{
+    typedef std::variant<ref<LockedNode>, InputPath> Edge;
+
+    std::map<FlakeId, Edge> inputs;
+
+    virtual ~Node() { }
+};
+
+/**
+ * A non-root node in the lock file.
+ */
+struct LockedNode : Node
+{
+    FlakeRef lockedRef, originalRef;
+    bool isFlake = true;
+
+    /* The node relative to which relative source paths
+       (e.g. 'path:../foo') are interpreted. */
+    std::optional<InputPath> parentPath;
+
+    LockedNode(
+        const FlakeRef & lockedRef,
+        const FlakeRef & originalRef,
+        bool isFlake = true,
+        std::optional<InputPath> parentPath = {})
+        : lockedRef(lockedRef)
+        , originalRef(originalRef)
+        , isFlake(isFlake)
+        , parentPath(parentPath)
+    { }
+
+    LockedNode(
+        const fetchers::Settings & fetchSettings,
+        const nlohmann::json & json);
+
+    StorePath computeStorePath(Store & store) const;
+};
+
+struct LockFile
+{
+    ref<Node> root = make_ref<Node>();
+
+    LockFile() {};
+    LockFile(
+        const fetchers::Settings & fetchSettings,
+        std::string_view contents, std::string_view path);
+
+    typedef std::map<ref<const Node>, std::string> KeyMap;
+
+    std::pair<nlohmann::json, KeyMap> toJSON() const;
+
+    std::pair<std::string, KeyMap> to_string() const;
+
+    /**
+     * Check whether this lock file has any unlocked inputs. If so,
+     * return one.
+     */
+    std::optional<FlakeRef> isUnlocked() const;
+
+    bool operator ==(const LockFile & other) const;
+
+    std::shared_ptr<Node> findInput(const InputPath & path);
+
+    std::map<InputPath, Node::Edge> getAllInputs() const;
+
+    static std::string diff(const LockFile & oldLocks, const LockFile & newLocks);
+
+    /**
+     * Check that every 'follows' input target exists.
+     */
+    void check();
+};
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile);
+
+InputPath parseInputPath(std::string_view s);
+
+std::string printInputPath(const InputPath & path);
+
+}

src/libflake/flake/nix-flake.pc.in

@@ -0,0 +1,10 @@
+prefix=@prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Nix
+Description: Nix Package Manager
+Version: @PACKAGE_VERSION@
+Requires: nix-util nix-store nix-expr
+Libs: -L${libdir} -lnixflake
+Cflags: -I${includedir}/nix -std=c++2a

src/libflake/flake/settings.cc

@@ -0,0 +1,7 @@
+#include "flake/settings.hh"
+
+namespace nix::flake {
+
+Settings::Settings() {}
+
+}

src/libflake/flake/settings.hh

@@ -0,0 +1,50 @@
+#pragma once
+///@file
+
+#include "types.hh"
+#include "config.hh"
+#include "util.hh"
+
+#include <map>
+#include <limits>
+
+#include <sys/types.h>
+
+namespace nix::flake {
+
+struct Settings : public Config
+{
+    Settings();
+
+    Setting<bool> useRegistries{
+        this,
+        true,
+        "use-registries",
+        "Whether to use flake registries to resolve flake references.",
+        {},
+        true,
+        Xp::Flakes};
+
+    Setting<bool> acceptFlakeConfig{
+        this,
+        false,
+        "accept-flake-config",
+        "Whether to accept nix configuration from a flake without prompting.",
+        {},
+        true,
+        Xp::Flakes};
+
+    Setting<std::string> commitLockFileSummary{
+        this,
+        "",
+        "commit-lock-file-summary",
+        R"(
+          The commit summary to use when committing changed flake lock files. If
+          empty, the summary is generated based on the action performed.
+        )",
+        {"commit-lockfile-summary"},
+        true,
+        Xp::Flakes};
+};
+
+}

src/libflake/flake/url-name.cc

@@ -0,0 +1,46 @@
+#include "url-name.hh"
+#include <regex>
+#include <iostream>
+
+namespace nix {
+
+static const std::string attributeNamePattern("[a-zA-Z0-9_-]+");
+static const std::regex lastAttributeRegex("^((?:" + attributeNamePattern + "\\.)*)(" + attributeNamePattern +")(\\^.*)?$");
+static const std::string pathSegmentPattern("[a-zA-Z0-9_-]+");
+static const std::regex lastPathSegmentRegex(".*/(" + pathSegmentPattern +")");
+static const std::regex secondPathSegmentRegex("(?:" + pathSegmentPattern + ")/(" + pathSegmentPattern +")(?:/.*)?");
+static const std::regex gitProviderRegex("github|gitlab|sourcehut");
+static const std::regex gitSchemeRegex("git($|\\+.*)");
+
+std::optional<std::string> getNameFromURL(const ParsedURL & url)
+{
+    std::smatch match;
+
+    /* If there is a dir= argument, use its value */
+    if (url.query.count("dir") > 0)
+        return url.query.at("dir");
+
+    /* If the fragment isn't a "default" and contains two attribute elements, use the last one */
+    if (std::regex_match(url.fragment, match, lastAttributeRegex)
+        && match.str(1) != "defaultPackage."
+        && match.str(2) != "default") {
+        return match.str(2);
+    }
+
+    /* If this is a github/gitlab/sourcehut flake, use the repo name */
+    if (std::regex_match(url.scheme, gitProviderRegex) && std::regex_match(url.path, match, secondPathSegmentRegex))
+        return match.str(1);
+
+    /* If it is a regular git flake, use the directory name */
+    if (std::regex_match(url.scheme, gitSchemeRegex) && std::regex_match(url.path, match, lastPathSegmentRegex))
+        return match.str(1);
+
+    /* If there is no fragment, take the last element of the path */
+    if (std::regex_match(url.path, match, lastPathSegmentRegex))
+        return match.str(1);
+
+    /* If even that didn't work, the URL does not contain enough info to determine a useful name */
+    return {};
+}
+
+}

src/libflake/flake/url-name.hh

@@ -0,0 +1,20 @@
+#include "url.hh"
+#include "url-parts.hh"
+#include "util.hh"
+#include "split.hh"
+
+namespace nix {
+
+/**
+ * Try to extract a reasonably unique and meaningful, human-readable
+ * name of a flake output from a parsed URL.
+ * When nullopt is returned, the callsite should use information available
+ * to it outside of the URL to determine a useful name.
+ * This is a heuristic approach intended for user interfaces.
+ * @return nullopt if the extracted name is not useful to identify a
+ * flake output, for example because it is empty or "default".
+ * Otherwise returns the extracted name.
+ */
+std::optional<std::string> getNameFromURL(const ParsedURL & url);
+
+}

src/libflake/local.mk

@@ -0,0 +1,22 @@
+libraries += libflake
+
+libflake_NAME = libnixflake
+
+libflake_DIR := $(d)
+
+libflake_SOURCES := $(wildcard $(d)/*.cc $(d)/flake/*.cc)
+
+# Not just for this library itself, but also for downstream libraries using this library
+
+INCLUDE_libflake := -I $(d)
+
+libflake_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) $(INCLUDE_libflake)
+
+libflake_LDFLAGS += $(THREAD_LDFLAGS)
+
+libflake_LIBS = libutil libstore libfetchers libexpr
+
+$(eval $(call install-file-in, $(buildprefix)$(d)/flake/nix-flake.pc, $(libdir)/pkgconfig, 0644))
+
+$(foreach i, $(wildcard src/libflake/flake/*.hh), \
+  $(eval $(call install-file-in, $(i), $(includedir)/nix/flake, 0644)))

src/libflake/meson.build

@@ -0,0 +1,77 @@
+project('nix-flake', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+subdir('build-utils-meson/deps-lists')
+
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
+  dependency('nix-util'),
+  dependency('nix-store'),
+  dependency('nix-fetchers'),
+  dependency('nix-expr'),
+]
+subdir('build-utils-meson/subprojects')
+
+subdir('build-utils-meson/threads')
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  # '-include', 'config-fetchers.h',
+  '-include', 'config-expr.hh',
+  language : 'cpp',
+)
+
+subdir('build-utils-meson/diagnostics')
+
+sources = files(
+  'flake/config.cc',
+  'flake/flake.cc',
+  'flake/flakeref.cc',
+  'flake/lockfile.cc',
+  'flake/settings.cc',
+  'flake/url-name.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = files(
+  'flake/flake.hh',
+  'flake/flakeref.hh',
+  'flake/lockfile.hh',
+  'flake/settings.hh',
+  'flake/url-name.hh',
+)
+
+this_library = library(
+  'nixflake',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  prelink : true, # For C++ static initializers
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+libraries_private = []
+
+subdir('build-utils-meson/export')

src/libflake/package.nix

@@ -0,0 +1,78 @@
+{ lib
+, stdenv
+, mkMesonDerivation
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-store
+, nix-fetchers
+, nix-expr
+, nlohmann_json
+, libgit2
+, man
+
+# Configuration Options
+
+, version
+}:
+
+let
+  inherit (lib) fileset;
+in
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix-flake";
+  inherit version;
+
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-store
+    nix-util
+    nix-fetchers
+    nix-expr
+    nlohmann_json
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
+    ''
+      chmod u+w ./.version
+      echo ${version} > ../../.version
+    '';
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})