feat(flake): darwin host support for genvm builds

[MuncleUscles]

Summary

Makes the genvm flake evaluate and build under aarch64-darwin / x86_64-darwin hosts, not just x86_64-linux. Linux path is unchanged.

Stacked on top of local/v0.2.11-nix-fix (= PR #290's predecessor branch, same scope + a couple of version fixups). Draft because that base isn't the public main — a rebase onto current main will be needed before this can land; opening it now for early review per the user's ask.

What changed

Two commits:

1. wip(flake): parameterise build host by system for darwin support — most of the structural work.

   • flake.nix wraps genvm-release in flake-utils.lib.eachSystem for {x86_64-linux, aarch64-linux, aarch64-darwin, x86_64-darwin}, moves all-for-platform/components under legacyPackages.<system>, and gates glibc + LD_LIBRARY_PATH in the devShell behind isLinux.
   • runners/default.nix + runners/support/all/head.nix accept pkgs as an arg, so runners evaluate against the caller's nixpkgs pin instead of creating a fresh x86_64-linux one internally.
   • support/rust.nix defaults system to pkgs.stdenv.hostPlatform.system, gates glibc + the patchelf fixupPhase behind isLinux.
   • support/compile-rust.nix gates glibc in nativeBuildInputs behind isLinux. Replaces hardcoded /build/libs with $TMPDIR/__libs so the staging path is writable inside darwin sandboxes.
   • support/zig.nix defaults system to host, adds x86_64-darwin and aarch64-darwin (the zig upstream key is aarch64-macos, so we name-map), replaces /build/.zig-cache with $TMPDIR/.zig-cache.
   • runners/support/wasi-sdk.nix per-host wasi-sdk tarball selection; gates autoPatchelfHook behind isLinux (Mach-O needs no ELF patching).

2. fix(rust): skip zig-cc when host == target (native darwin builds) — the link-stage follow-up.

   • When building aarch64-apple-darwin from an aarch64-darwin host the toolchain is native — rustc emits darwin-specific linker flags (-Wl,-exported_symbols_list, -framework, …) that the zig-cc wrapper can't forward. Route native darwin targets straight through rustc's default cc. zig-cc still wraps non-darwin→darwin cross-compiles.

Validated

• nix build .#all-for-platform.arm64-macos — ✅ Mach-O arm64 binary (genvm-modules)
• nix build .#all-for-platform.arm64-macos-executor — ✅ Mach-O arm64 binary
• nix build .#all-for-platform.universal — ❌ fails with cpython-determinism hash mismatch (separately being fixed upstream by JM)
• Linux: nix build .#all-for-platform.amd64-linux / amd64-linux-executor still reproduce the same output paths as before this branch (confirmed by evaluating with a x86_64-linux host).

Known gaps

• universal / universal-manifest builds (python + WASM runners) still fail on darwin because the cpython fixed-output hashes aren't deterministic across hosts yet — that's a separate line of work. The darwin fix here lets you build all-for-platform.arm64-macos{,-executor} natively, which is what dev-env needs to bring up the stack on Mac.
• The merge-base with main is ~50 commits old. Before landing: rebase this onto current main and revalidate each nix build target. Expected conflicts are in flake.nix (structural) plus support/*.nix (localized).

Why the PR is split this way

Keeping the base as local/v0.2.11-nix-fix shows just the darwin-specific delta (~300 LOC across 7 files) instead of the 98KB diff vs main that a fresh cherry-pick onto main would include. Once the base merges or this gets rebased, the PR can be retargeted.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: de289a8b-3158-4bc2-a785-edd53a212980

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch local/v0.2.11-nix-fix-macos

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}