New build system using nix

[mvachhar]

This PR is a continuation of the work started by @daniel-noland to move to a proper nix based build system.

Most of this PR was built based on #1275 and the work of Claude Code using Opus 4.6. As such it should be reviewed carefully. I have tried to do the work in small chunks with the AI to get some review as we go along, but I am not a nix expert and had to rely a bit on the AI's judgement as to the best approach for certain things.

TODO:

• Make failing new sanitizer runs optional - the sanitizers found real bugs we need to fix in separate PRs
  • These got commented out, the github action-fu to make it work is too hard for this PR
• ~~ Create cachix "githedgehog" cache so that these runs come from the cache ~~ DONE
• Have @Fredi-raspall, @qmonnet, and @daniel-noland rebase on this branch to make sure their workflow still works
• Careful manual review of this PR before signing off
• Co-pilot review of this PR before signoff DONE
• Remove scripts/todo.sh. DONE
• Remove scripts/install-real-nix.sh. DONE
• Make sure the proper just targets for building and pushing containers is there (I believe we are good, but I want to confirm)

[Copilot]

Pull request overview

This PR continues the migration to a Nix-based build and CI workflow, replacing the prior compile-env/docker-based approach and wiring sysroot/toolchain configuration through Nix shells and Nix builds.

Changes:

• Replaces the legacy compile-env + fake-nix workflow with default.nix/overlays, nix-shell, and updated just recipes.
• Updates CI (dev.yml) to build/test via Nix targets and introduces new Nix packaging pieces (FRR packaging, platform/profile plumbing).
• Refactors sysroot usage in Rust build scripts and updates docs to match the new Nix-first workflow.

Reviewed changes

Copilot reviewed 55 out of 56 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
testing.md	Updates testing instructions to assume nix-shell tooling.
sysfs/build.rs	Removes sysroot build script logic.
sysfs/Cargo.toml	Drops dpdk-sysroot-helper build-dependency.
shell.nix	Switches shell entrypoint to default.nix devenv.
scripts/update-doc-headers.sh	Bumps KaTeX version used in docs.
scripts/todo.sh	Adds a Nix-based build/test “checklist” script.
scripts/test-runner.sh	Removes legacy docker-based test runner wrapper.
scripts/rust.env	Removes legacy RUSTFLAGS/profile env file.
scripts/k8s-crd.env	Updates gateway CRD ref env file (now likely legacy).
scripts/installl-real-nix.sh	Adds helper to replace “fake nix” with real Nix install.
scripts/dpdk-sys.env	Updates pinned dpdk-sys commit.
scripts/doc/custom-header.html	Updates KaTeX CDN links and integrity hashes.
rust-toolchain.toml	Removes rustup toolchain file in favor of Nix toolchain sourcing.
routing/Cargo.toml	Cleans tokio features and adds dev tokio “full”.
npins/sources.json	Updates Nix pins (crane, frr, gateway, nixpkgs, rust, rust-overlay).
nix/profiles.nix	Adjusts compile/link/security profile flags and profile mapping.
nix/platforms.nix	Adds platform name mapping for bluefield2 → bluefield.
nix/pkgs/frr/patches/yang-hack.patch	Adds FRR/libyang-related patch.
nix/pkgs/frr/patches/xrelifo.py.fix.patch	Adds FRR python/xrelfo patch.
nix/pkgs/frr/default.nix	Introduces FRR derivation with configurable protocol support.
nix/pkgs/frr/clippy-helper.nix	Adds split derivation for FRR “clippy” tool for cross builds.
nix/pkgs/dpdk/default.nix	Simplifies DPDK build params and uses platform-provided properties.
nix/overlays/llvm.nix	Reworks LLVM+Rust toolchain overlay to source versions from pins.
nix/overlays/frr.nix	Adds overlay customizing dependencies for FRR static/cross builds.
nix/overlays/default.nix	Registers new overlays (rust/llvm/dataplane/frr).
nix/overlays/dataplane.nix	Wires platform/profile into DPDK build and tweaks deps.
nix/overlays/dataplane-dev.nix	Uses llvmPackages’ stdenv and adds a static-leaning gdb override.
net/src/buffer/test_buffer.rs	Cleans doc-only import; adds explicit PacketBuffer doc link.
mgmt/tests/reconcile.rs	Adds VM-runner attribute to a test.
mgmt/src/tests/mgmt.rs	Removes unused imports and disables a VM test during refactor.
mgmt/Cargo.toml	Adds n-vm + tracing-subscriber for tests.
k8s-intf/build.rs	Refactors CRD generation to OUT_DIR and env-driven inputs.
k8s-intf/Cargo.toml	Swaps build deps to dpdk-sysroot-helper.
justfile	Replaces compile-env/sterile/docker flows with Nix build/test/container commands.
init/build.rs	Switches to dpdk_sysroot_helper::use_sysroot() behind feature gate.
init/Cargo.toml	Introduces sysroot feature and makes sysroot helper optional.
hardware/src/os/mod.rs	Fixes a typo in a clippy lint comment.
hardware/build.rs	Switches to centralized use_sysroot().
dpdk/src/lcore.rs	Updates lcore ID call to rte_lcore_id().
dpdk/build.rs	Switches to centralized use_sysroot().
dpdk-sysroot-helper/src/lib.rs	Changes sysroot discovery to DATAPLANE_SYSROOT and adds use_sysroot().
dpdk-sys/build.rs	Updates bindgen/sysroot handling and link libs list.
development/code/running-tests.md	Updates test-running docs to Nix-first commands.
default.nix	Major Nix build definition: dev shell env, profiles, test archives, container tars.
dataplane/src/drivers/dpdk.rs	Gates DPDK driver file behind dpdk feature.
dataplane/build.rs	Switches to centralized use_sysroot() behind dpdk feature.
dataplane/Cargo.toml	Makes dpdk deps optional behind a dpdk feature (default on).
cli/build.rs	Removes sysroot build script logic.
cli/Cargo.toml	Drops dpdk-sysroot-helper build-dependency.
README.md	Updates developer setup/docs to nix-shell workflow.
Cargo.toml	Updates workspace version and dependency versions.
Cargo.lock	Updates lockfile to match dependency/version changes.
.github/workflows/dev.yml.old	Keeps old workflow as .old (new file added).
.github/workflows/dev.yml	Reworks CI to use Nix builds and archives.
.envrc	Simplifies direnv env vars for the new devroot/sysroot layout.
.cargo/config.toml	Updates env vars and rustflags for sysroot/devroot-based builds.

[Copilot]

Pull request overview

Copilot reviewed 64 out of 68 changed files in this pull request and generated 3 comments.

[Copilot]

confidence: 9
tags: [logic]

This workflow references the inputs context in the matrix definition, but inputs is only populated for workflow_dispatch/reusable workflows. Since this workflow also runs on pull_request, push, and merge_group, this can fail with an “Unrecognized named-value: 'inputs'” evaluation error. Use github.event.inputs.debug_justfile (and default it) or gate this expression on github.event_name == 'workflow_dispatch' so non-dispatch events don’t reference inputs at all.

Suggested change

	- "${{ inputs.debug_justfile || false }}"
	- "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.debug_justfile || false }}"

[Copilot]

confidence: 9
tags: [logic]

This run step also interpolates inputs.debug_justfile inside the nix-shell --run command. On non-workflow_dispatch events the inputs context may be undefined, which can break the job even if you don’t care about the flag. Prefer passing debug_justfile=${{ github.event.inputs.debug_justfile || false }} (or similar) instead of inputs.* here.

Suggested change

	debug_justfile=${{ inputs.debug_justfile || false }} \
	debug_justfile=${{ github.event.inputs.debug_justfile || false }} \

[Copilot]

confidence: 8
tags: [logic]

tar --mode='ugo-sw' only strips setuid/setgid/sticky bits but still leaves regular write permissions intact. That contradicts the preceding comment about “block all of that” (preventing edits) and weakens the hardening of the generated rootfs. Either tighten the mode to remove write bits (and possibly group/other permissions), or update the comment so it accurately reflects what’s enforced.

[daniel-noland]

Are you sure that is true? The -w part of ugo-sw should remove write no? I could accept that it should be a-sw but I think that amounts to the same thing no?