Build with bazel on linux-x86_64 (#10)

2024-08-15 14:50:32 +03:00 · 2023-01-09 11:28:47 -05:00 · 2023-01-09 11:28:47 -05:00 · b339b5067a
commit b339b5067a
parent 09357fb872
512 changed files with 5000 additions and 104212 deletions
--- a/.bazelrc
+++ b/.bazelrc
@ -0,0 +1,13 @@
+# Disallow empty `glob()`s.
+build --incompatible_disallow_empty_glob
+
+# Don't auto-detect the C/C++ toolchain.
+build --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
+# Use platforms to select toolchains.
+# See https://bazel.build/concepts/platforms#cxx and
+# https://github.com/bazelbuild/bazel/issues/7260.
+build --incompatible_enable_cc_toolchain_resolution
+
+# Any personal configuration should go in .user.bazelrc.
+try-import %workspace%/.user.bazelrc
--- a/.gitignore
+++ b/.gitignore
@ -1,86 +1,262 @@
-# OSX
-.DS_Store
+# Bazel.
+/.user.bazelrc
+/bazel-*
+/urbit

-# Editors
-*~
-*#
-.#*
-\#*#
-.*.sw[a-z]
-*.un~
-*.org
-.projectile
-s/*
-cscope.*
-
-# Tags
-.tags
-.etags
-TAGS
-GPATH
-GRTAGS
-GTAGS
-
-# Nix
-result
-result-*
-
-# Common Piers
+# Fake ships.
 /zod
-/bus
 /nec
-/fakezod
-
-# NodeJS
-node_modules
-.eslintcache
-
-# Haskell
-.stack-work
-stack.yaml.lock
-dist-newstyle
-.ghc*
-
-# Profiling
-*.prof
-*.aux
-*.hp
-*.ps
-*.pdf
-
-# Build/Release Artifacts
-build/
-cross/
-release/
-dist/
-out/
-work/
-pkg/*/*.a
-*.o
-*.so
-*.dll
-*.dylib
-
-# Landscape Dev
-urbitrc
-*-min.js
-pkg/interface/link-webext/web-ext-artifacts
-
-# Certificates
-*.pem
-*.key
-*.secret
-*.sec
-*.asc
-
-# Archives
-*.zip
-*.gz
-*.tar
-*.bzip2
-*.xz
-
-# Logs
-*.log
-
-.vercel
+/bud
+/wes
+/sev
+/per
+/sut
+/let
+/ful
+/pen
+/syt
+/dur
+/wep
+/ser
+/wyl
+/sun
+/ryp
+/syx
+/dyr
+/nup
+/heb
+/peg
+/lup
+/dep
+/dys
+/put
+/lug
+/hec
+/ryt
+/tyv
+/syd
+/nex
+/lun
+/mep
+/lut
+/sep
+/pes
+/del
+/sul
+/ped
+/tem
+/led
+/tul
+/met
+/wen
+/byn
+/hex
+/feb
+/pyl
+/dul
+/het
+/mev
+/rut
+/tyl
+/wyd
+/tep
+/bes
+/dex
+/sef
+/wyc
+/bur
+/der
+/nep
+/pur
+/rys
+/reb
+/den
+/nut
+/sub
+/pet
+/rul
+/syn
+/reg
+/tyd
+/sup
+/sem
+/wyn
+/rec
+/meg
+/net
+/sec
+/mul
+/nym
+/tev
+/web
+/sum
+/mut
+/nyx
+/rex
+/teb
+/fus
+/hep
+/ben
+/mus
+/wyx
+/sym
+/sel
+/ruc
+/dec
+/wex
+/syr
+/wet
+/dyl
+/myn
+/mes
+/det
+/bet
+/bel
+/tux
+/tug
+/myr
+/pel
+/syp
+/ter
+/meb
+/set
+/dut
+/deg
+/tex
+/sur
+/fel
+/tud
+/nux
+/rux
+/ren
+/wyt
+/nub
+/med
+/lyt
+/dus
+/neb
+/rum
+/tyn
+/seg
+/lyx
+/pun
+/res
+/red
+/fun
+/rev
+/ref
+/mec
+/ted
+/rus
+/bex
+/leb
+/dux
+/ryn
+/num
+/pyx
+/ryg
+/ryx
+/fep
+/tyr
+/tus
+/tyc
+/leg
+/nem
+/fer
+/mer
+/ten
+/lus
+/nus
+/syl
+/tec
+/mex
+/pub
+/rym
+/tuc
+/fyl
+/lep
+/deb
+/ber
+/mug
+/hut
+/tun
+/byl
+/sud
+/pem
+/dev
+/lur
+/def
+/bus
+/bep
+/run
+/mel
+/pex
+/dyt
+/byt
+/typ
+/lev
+/myl
+/wed
+/duc
+/fur
+/fex
+/nul
+/luc
+/len
+/ner
+/lex
+/rup
+/ned
+/lec
+/ryd
+/lyd
+/fen
+/wel
+/nyd
+/hus
+/rel
+/rud
+/nes
+/hes
+/fet
+/des
+/ret
+/dun
+/ler
+/nyr
+/seb
+/hul
+/ryl
+/lud
+/rem
+/lys
+/fyn
+/wer
+/ryc
+/sug
+/nys
+/nyl
+/lyn
+/dyn
+/dem
+/lux
+/fed
+/sed
+/bec
+/mun
+/lyr
+/tes
+/mud
+/nyt
+/byr
+/sen
+/weg
+/fyr
+/mur
+/tel
+/rep
+/teg
+/pec
+/nel
+/nev
+/fes
--- a/.mailmap
+++ b/.mailmap
@ -1,26 +0,0 @@
-b <benjamin@tlon.io>
-b <benjamin@tlon.io> <42358674+benjamin-tlon@users.noreply.github.com>
-b <benjamin@tlon.io> <benjamin@bsummers.me>
-BernardoDeLaPlaz <BernardoDeLaPlaz@users.noreply.github.com> <40804016+BernardoDeLaPlaz@users.noreply.github.com>
-BernardoDeLaPlaz <BernardoDeLaPlaz@users.noreply.github.com> <tjic_BernardoDeLaPlaz_github@tjic.com>
-Elliot Glaysher <elliot@tlon.io> <glaysher@umich.edu>
-Fang <git@fang.io> <Fang-@users.noreply.github.com>
-Fang <git@fang.io> <fang@fang.io>
-Frank Ch. Eigler <fche@redhat.com> <fche@elastic.org>
-Isaac Visintainer <isaac.visintainer@gmail.com>
-Isaac Visintainer <isaac.visintainer@gmail.com> <isaacv@tlon.io>
-Jared Tobin <jared@jtobin.io> <jared@tlon.io>
-John Franklin <jfranklin9000@gmail.com>
-Joe Bryan <joemfb@gmail.com>
-Jose L. Bellod Cisneros <bellod.cisneros@gmail.com>
-Jōshin <git@wholezero.org>
-Jōshin <git@wholezero.org> <_@wholezero.org>
-Joshua Reagan <joshuareagan@gmail.com>
-Joshua Reagan <joshuareagan@gmail.com> <joshuareagan@users.noreply.github.com>
-Logan Allen <loganallc@gmail.com>
-Logan Allen <loganallc@gmail.com> <logan@tlon.io>
-Matilde Park <matilde@park.computer> <matilde@tlon.io>
-pilfer-pandex <pilfer-pandex@users.noreply.github.com> <47340789+pilfer-pandex@users.noreply.github.com>
-Robert <robert@tlon.io>
-Ted Blackman <ted@tlon.io> <ted@3scan.com>
-pkova <pyry.kovanen@gmail.com> <pkova@users.noreply.github.com>
--- a/BUILD.bazel
+++ b/BUILD.bazel
@ -0,0 +1,97 @@
+#
+# OS-CPU CONFIG SETTINGS
+#
+
+config_setting(
+    name = "linux-arm64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:arm64",
+    ],
+)
+
+config_setting(
+    name = "linux-x86_64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "macos-arm64",
+    constraint_values = [
+        "@platforms//os:macos",
+        "@platforms//cpu:arm64",
+    ],
+)
+
+config_setting(
+    name = "macos-x86_64",
+    constraint_values = [
+        "@platforms//os:macos",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "openbsd-x86_64",
+    constraint_values = [
+        "@platforms//os:openbsd",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "windows-x86_64",
+    constraint_values = [
+        "@platforms//os:windows",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+#
+# COMPILER CONSTRAINT SETTINGS
+#
+
+constraint_setting(name = "compiler")
+
+constraint_value(
+    name = "clang",
+    constraint_setting = ":compiler",
+    visibility = ["//visibility:public"],
+)
+
+constraint_value(
+    name = "gcc",
+    constraint_setting = ":compiler",
+    visibility = ["//visibility:public"],
+)
+
+#
+# PLATFORMS
+#
+
+platform(
+    name = "clang-linux-x86_64",
+    constraint_values = [
+        ":clang",
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+platform(
+    name = "gcc-linux-x86_64",
+    constraint_values = [
+        ":gcc",
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+alias(
+    name = "urbit",
+    actual = "//pkg/vere:urbit",
+)
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -1,303 +1,116 @@
-# Contributing to Urbit
+# Contributing

-Thank you for your interest in contributing to Urbit.
+## Workflow

-See [urbit.org/using/install][start] for basic orientation and usage
-instructions.  You may also want to subscribe to [urbit-dev][list], the Urbit
-development mailing list. For specific information on contributing to the Urbit
-interface, see its [contribution guidelines][interface].
+Before beginning any unit of work, you should have ensure you have an issue
+detailing the scope of the work. This could be an issue someone else filed and
+has been assigned to you (or you've assigned to yourself) or a new issue you
+filed specifically for this unit of work. As much as possible, discussion of the
+work should take place in the issue. When this is not possible, please update
+the issue with relevant details from any offline conversations. Each issue
+should provide a clear and thorough history of the work from inception to
+completion.

-For information on Arvo's maintainers, see [pkg/arvo][main].
+### Branch Names

-For more extensive information on Urbit development, such as how to set up an
-environment and how to submit a grant, see the [developer documentation][dev].
+Every branch that you intend to put up for review must adhere to the form
+`issue/N/<...>`, where `N` is the number of the issue that the branch corresponds
+to and `<...>` is an optional short description of the branch to aid in
+readability. If `<...>` is omitted, the `/` should be omitted as well, which
+makes `issue/N` a well-formed branch name.

-[start]: https://urbit.org/using/install
-[interface]: /pkg/interface/CONTRIBUTING.md
-[dev]: https://urbit.org/docs/development
+### Commits

-## Fake ships
-
-You may have an identity on the live network, but doing all your development on
-the live network would be cumbersome and unnecessary.  Standard practice in
-Urbit development is to work on a fake `~zod`.  Fake ships use deterministic
-keys (derived from the ship address) and don't talk to the live network. They
-can talk to each other over the local loopback.
-
-To start a fake ship, simply specify the name with `-F`:
+Commit messages should be written in an imperative style and include a mandatory
+short description and optional long description.

 ```
-$ urbit -F zod
+Require a short description
+
+Optionally add a long description.
 ```

-You can also pass a name for the *pier* (or ship directory):
+### Pull Requests and Merges
+
+When your work is ready for review, open up a pull request, making sure to link
+to the tracking issue in the description, which should be formatted as follows
+(where `N` is the number of this work's tracking issue):

 ```
-$ urbit -F zod -c my-fake-zod
+### Description
+
+Resolves #N.
+
+Thoroughly describe the changes made.
+
+### Related
+
+Reference any related issues, links, papers, etc. here.
 ```

-To resume a fake ship, just pass the name of the pier:
+Tests will run automatically via GitHub Actions when you open a pull request or
+push new commits to an existing pull request.

-```
-$ urbit my-fake-zod
+Once you've collected and addressed feedback and are ready to merge, squash and
+merge the pull request. Use the default squash commit message. Assuming that you
+properly included the "Resolves #N." directive in the pull request description,
+merging will automatically close the tracking issue associated with the pull
+request.
+
+
+## Development Environment
+
+Although you likely have an identity on the live network, developing on the live
+network is high-risk and largely unnecessary. Instead, standard practice is to
+work on a fake ship. Fake ships use deterministic keys derived from the ship's
+address; don't communicate on the live network; and can communicate with other
+fake ships over the local loopback.
+
+### Boot a New Fake Ship
+
+To boot a new fake ship, pass the `-F` flag and a valid Urbit ship name to
+`urbit`:
+
+```console
+$ bazel build :urbit
+$ ln -s bazel-bin/pkg/vere/urbit urbit
+$ ./urbit -F <ship>
 ```

-Fake ships by default use the same pre-compiled kernelspace ('pills') as livenet
-ships do: boot pills, which are not always current with `master`. If you wish to
-develop using code off the master branch, run the following from the repo
-directory:
+By default, booting a fake ship will use the same pre-compiled kernelspace--
+a "pill"--that livenet ships use, which leads to a non-trivial boot time on the
+order of tens of minutes. However, using a development specific pill--a "solid"
+pill--the time to boot a new fake ship can be reduced to a few minutes.

-```
-git lfs install
-git lfs pull
-urbit -F zod -B "bin/solid.pill" -A "pkg/arvo"
+The solid pill (and other pills) live in the [Urbit repo][urbit]. To boot using
+the solid pill, download the pill and then run:
+
+```console
+$ ./urbit -F <ship> -B solid.pill
 ```

-## Git practice
+Instead of downloading the pill, you can also generate one yourself using
+[`dojo`][dojo]:

-### Contributing
-
-The canonical source tree is the `master` branch of
-[https://github.com/urbit/urbit][repo].  You should typically branch off of
-`master` when commencing new work. Most pull requests should be merging into
-one of the `next/*` branches, depending on what part of the system the pull
-request is targeting.
-
-Since we use GitHub, we request you contribute via a GitHub pull request. Tag
-the [maintainer][main] for the component. If you have a question for the
-maintainer, you can direct message them from your Urbit ship using that
-information.
-
-When contributing changes, via whatever means, make sure you describe them
-appropriately.  You should attach a reasonably high-level summary of what the
-changes are and what they do; reference any useful background material that may
-exist, e.g. a GitHub issue, a mailing list discussion, a UP, etc.  [Here][jbpr]
-is a good example of a pull request with a useful, concise description.
-
-If your changes replace significant extant functionality, be sure to compare
-them with the thing you're replacing.  You may also want to cc reviewers,
-or other parties who might have a particular interest in what you're
-contributing.
-
-[jbpr]: https://github.com/urbit/urbit/pull/1782
-
-### Hygiene
-
-Commits should generally be relevant, atomic, and have descriptions formatted
-in the following manner:
-
->  component: short description
->
->  long description
-
-The 'component' is a short prefix of what area of the codebase the commit
-applies to.  If a commit patches `%gall`, for example, the description should
-be prefixed by 'gall'.  If it touches `:aqua`, it should be prefixed by 'aqua'.
-If it touches multiple components, then separate these by commas, e.g. "gall,
-aqua, ph" -- but note that this may be a warning that too many changes are
-being packed into a single commit.  The 'component' and 'short description'
-combined should be no more than 50 characters.
-
-A lengthier description is encouraged, where useful, but is not always strictly
-required.  You should use the longer description to give any useful background
-on or motivation for the commit, provide a summary of what it does, link to
-relevant issues, proposals, or other commits, and so on.
-
-Here is an example of our commit format, taken from a commit in the history:
-
->  zuse: remove superfluous 'scup' and 'culm' types.
->
->  %zuse includes definitions for 'scup' and 'culm', both of which are
->  superfluous.  'scup' is simply (pair ship desk) and is used only in
->  the definition of 'culm', a tagged union in which three of the four
->  branches are commented out (i.e. are unused).
->
->  This commit deletes 'scup' and 'culm' and refactors what little code
->  made use of them.
-
-Note that the short description is prefixed by `zuse:`, which is what the
-commit touches.  Otherwise it just includes a summary of the change.
-
-Here's another example:
-
->  build: give arvo a high priority
->
->  0bdced981e4 introduced the 'arvo-ropsten' derivation.  Attempting to
->  install both 'arvo' and 'arvo-ropsten' via nix-env will result in a
->  priority error; this assigns a higher priority to 'arvo' to resolve the
->  conflict.
->
->  Fixes #1912.
-
-Note that it cites a previous relevant commit, `0bdced981e4`, in its summary,
-and also points at the issue that it resolves.
-
-If you're in doubt about how to format your commit descriptions, take a look at
-the recent history and try to mimic the style that you can see others broadly
-follow there.
-
-When we say commits should be "atomic", we mean with respect to some distinct
-logical unit, e.g. a type definition used across many files, or a single file,
-or just a single function in a single file.  Commits should be atomic at the
-level of *code*, not of entire features.  You don't have to squash your commits
-into a single one that captures everything you're trying to do -- the history
-will never make for pleasant bedtime reading, so focus instead on making your
-commits useful for tools like `git-blame` and `git-bisect`.
-
-Your contribution must apply cleanly to `master` in order to be considered
-mergeable.  You may want to regularly [rebase your changes][reba] onto `master`
-in order to both clean up any intermediate "development" commits you make and
-to ensure that you're up to date.
-
-If you're making a GitHub pull request, it's good practice to make it from a
-topic branch, rather than `master`, on your fork.
-
-### Pills
-
-Any contribution that touches the kernel (i.e., anything in `pkg/arvo/sys`),
-should be accompanied by an updated [solid pill](#the-kernel-and-pills).  Pills
-are tracked in the repository via [git LFS][git-lfs].
-
-Whenever you make a contribution to the kernel, please create a new solid pill
-via:
-
-```
-sh/update-solid-pill
+```console
+dojo> .urbit/pill +solid
 ```

-and include it along with your contribution.
+This will write the pill to `<pier>/.urb/put/urbit.pill` (note that `<pier>` is
+the ship directory), which you can then use to boot a new ship:

-Historically, we've sometimes included these updated pills in separate,
-standalone commits (you will see plenty of "pills: update solid" and similar
-commits if you look through the history), but this practice is considered to be
-deprecated -- you should usually just include the updated pill in the same
-commit that updates the source.
-
-## Releases
-
-We typically create releases by tagging appropriate commits on `master`, so any
-given commit in `master` may not actually be present in the latest release.
-
-We perform updates by pushing releases over-the-air to `~zod` approximately
-once per week, so any contribution that can be deployed OTA will usually find
-its way onto the network pretty rapidly.
-
-If you want to propose a hotfix (i.e. a small, OTA-updateable change, usually a
-bugfix, to some currently-deployed release) then simply make it clear that your
-contribution -- whether it be a pull request, patch, or whatever -- is intended
-to be a hotfix.  A maintainer can then deploy it to the network outside of the
-normal release schedule.
-
-Less frequently we release new Vere versions, which requires users to download
-new binaries, and occasionally, while Urbit is still in early development, we
-breach network continuity in order to release large changes that are difficult
-to push out over-the-air.  Contributions to Vere, or non-OTA-able updates to
-Arvo, will find their way into releases before terribly long.
-
-## Code style
-
-The Urbit project uses two-space indentation and avoids tab characters.
-In C code, it should not be too difficult to mimic the style of the code
-around you, which is just fairly standard K&R with braces on every
-compound statement. One thing to watch out for is top-level sections in
-source files that are denoted by comments and are actually indented one
-level.
-
-Hoon will be a less familiar language to many contributors.  We've published
-some [style guidelines for Hoon][hoon], but above all you should try to mimic
-the style of the code around you.  With regards to the style used throughout
-the codebase: the more recently the code was written, the more standard and
-accepted its style is likely to be.
-
-## Kernel development
-
-Working on either C or non-kernel Hoon should not bring any surprises, but the
-Hoon kernel (anything under [`pkg/arvo/sys/`][sys]) is bootstrapped from a
-so-called *pill*, and must be recompiled if any changes are made. This should
-happen automatically when you make changes, but if it doesn't, the command to
-manually recompile and install the new kernel is `|reset` in `dojo`.  This
-rebuilds from the `sys` directory in the `base` desk in `%clay`.
-
-Currently, `|reset` does not reload apps like `dojo` itself, which will still
-reference the old kernel. To force them to reload, make a trivial edit to their
-main source file (under the `app` directory) in `%clay`.
-
-[arvo]: https://github.com/urbit/urbit/tree/master/pkg/arvo
-[sys]: https://github.com/urbit/urbit/tree/master/pkg/arvo/sys
-
-## The kernel and pills
-
-Urbit bootstraps itself using a binary blob called a pill (you can see it being
-fetched from `bootstrap.urbit.org` on boot).  This is the compiled version of
-the kernel (which you can find in the `sys` directory of [Arvo][arvo]), along
-with a complete copy of the Arvo source.
-
-The procedure for creating a pill is often called "soliding." It is somewhat
-similar to `|reset`, but instead of replacing your running kernel, it writes
-the compiled kernel to a file. The command to solid is:
-
-```
-> .urbit/pill +solid
+```console
+$ ./urbit -F <another-ship> -B <pier>/.urb/put/urbit.pill
 ```

-When the compilation finishes, your pill will be found in the
-`[pier]/.urb/put/` directory as `urbit.pill`.
+### Launch an Existing Fake Ship

-You can boot a new ship from your local pill with `-B`:
+To launch an existing fake ship, supply the pier (the ship directory), which is
+simply the name of the ship[^1], to `urbit`:

-```
-$ urbit -F zod -B path/to/urbit.pill my-fake-zod
+```console
+$ ./urbit <ship>
 ```

-Release pills, i.e. those corresponding to vere releases, are cached at
-`https://bootstrap.urbit.org` and are indexed by the vere version number, e.g.
-`urbit-0.8.2.pill`.

-Pills are also cached in version control via [git LFS][git-lfs].  You can find
-the latest solid pill, as well as the latest so-called *brass* and *ivory*
-pills, in the `bin/` directory at the repository root.  Note that you'll need
-to initialise git LFS in order to check these pills out:
-
-```
-$ git lfs init
-$ git lfs pull
-```
-
-[git-lfs]: https://git-lfs.github.com
-
-## Issues
-
-The [GitHub tracker][issu] is our canonical source of truth around issues,
-bugs, performance problems, feature requests, and so on.  If you encounter any
-issues when developing on Urbit, feel free to submit a report about it here.
-
-A good bug report, description of a crash, etc., should ideally be
-*reproducible*, with clear steps as to how another developer can replicate and
-examine your problem.  That said, this isn't always possible -- some bugs
-depend on having created a complicated or unusual state, or can otherwise
-simply be difficult to trigger again (say, you encountered it in the last
-continuity era).
-
-Your issue should thus at a minimum be *informative*.  The best advice here is
-probably "don't write bad issues," where "bad" is a matter of judgment and
-taste.  Issues that the maintainers don't judge to be sufficiently useful or
-informative may be closed.
-
-Feature requests are welcome, but they should include sufficient detail and
-explanation, as well as a discussion of perceived benefits one could expect
-from them.  "It would be cool if.." probably does not, in itself, constitute a
-good feature request; instead, try to be specific about what you're requesting,
-and what your desired feature would accomplish.
-
-## Staying in touch
-
-Questions or other communications about contributing to Urbit can go to
-[support@urbit.org][mail].
-
-[mail]: mailto:support@urbit.org
-[list]: https://groups.google.com/a/urbit.org/forum/#!forum/dev
-[repo]: https://github.com/urbit/urbit
-[reba]: https://git-rebase.io/
-[issu]: https://github.com/urbit/urbit/issues
-[hoon]: https://urbit.org/docs/hoon/reference/style
-[main]: https://github.com/urbit/urbit/tree/master/pkg/arvo#maintainers
+[^1]: Unless you specify the pier using the `-c` flag.
--- a/README.md
+++ b/README.md
@ -1,107 +1,102 @@
-# Urbit
+# Urbit Runtime

-[Urbit](https://urbit.org) is a personal server stack built from scratch. It
-has an identity layer (Azimuth), virtual machine (Vere), and operating system
-(Arvo).
+[Urbit][urbit] is a personal server stack built from scratch. This repository
+contains [Urbit's runtime environment][vere], the lowest layer of the Urbit
+stack, which includes the Nock virtual machine, I/O drivers, event log, and
+snapshotting system.

-A running Urbit "ship" is designed to operate with other ships peer-to-peer.
-Urbit is a general-purpose, peer-to-peer computer and network.

-This repository contains:
+## Getting Started

- The [Arvo OS][arvo]
- [herb][herb], a tool for Unix control of an Urbit ship
- Source code for [Landscape's web interface][land]
- Source code for the [vere][vere] virtual machine.
+For basic Urbit usage instructions, head over to [urbit.org][getting-started].
+For a high-level overview of the salient aspects of Urbit's architecture, visit
+[developers.urbit.org][technical-reference]. You might also be interested in
+joining the [urbit-dev][mailing-list] mailing list.

-For more on the identity layer, see [Azimuth][azim]. To manage your Urbit
-identity, use [Bridge][brid].

-[arvo]: https://github.com/urbit/urbit/tree/master/pkg/arvo
-[azim]: https://github.com/urbit/azimuth
-[brid]: https://github.com/urbit/bridge
-[herb]: https://github.com/urbit/urbit/tree/master/pkg/herb
-[land]: https://github.com/urbit/urbit/tree/master/pkg/interface
-[vere]: https://github.com/urbit/urbit/tree/master/pkg/urbit
+## Packages

-## Install
+Urbit's runtime is broken down into a few separate layers, each of which is
+defined in its own package:

-To install and run Urbit, please follow the instructions at
-[urbit.org/install][start].  You'll be on the live network in a
-few minutes.
+- [`pkg/c3`](pkg/c3): A set of basic utilities for writing Urbit's style of C.
+- [`pkg/ent`](pkg/ent): A cross-platform wrapper for `getentropy(2)`.
+- [`pkg/urcrypt`](pkg/urcrypt): A standardized interface for calling various
+  cryptographic functions used in the Urbit runtime.
+- [`pkg/ur`](pkg/ur): An implementation of [jam][jam] and [cue][cue], Urbit's
+  bitwise noun serialization and deserialization algorithms, respectively.
+- [`pkg/noun`](pkg/noun): The Nock virtual machine and snapshotting system.
+- [`pkg/vere`](pkg/vere): The I/O drivers, event log, and main event loop.

-If you're interested in Urbit development, keep reading.

-[start]: https://urbit.org/install/
+## Build

-## Development
+We use [`bazel`][bazel] to build Urbit's runtime. We support the following
+platforms:

-[![License][license-badge]][license]
-[![Build][build-badge]][build]
-[![Nix][nix-badge]][nix]
-[![Cachix][cachix-badge]][cachix]
+- `darwin-arm64` (macOS running Apple Silicon)
+- `darwin-x86_64` (macOS running Intel silicon)
+- `linux-arm64`
+- `linux-x86_64`
+- `openbsd-x86_64`
+- `mingw-x86_64`

-Urbit uses [Nix][nix] to manage builds.  On Linux and macOS you can install Nix
-via:
+To build the `urbit` binary, the primary artifact of this repository, ensure
+that you're on a supported platform and that you have an up-to-date version of
+[`bazel`][bazel], and then run:

-```
-curl -L https://nixos.org/nix/install | sh
+```console
+$ bazel build :urbit
 ```

-You can optionally setup Nix to pull build artefacts from the binary cache 
-that continuous integration uses. This will improve build times and avoid 
-unnecessary recompilations of common dependencies.  Once Nix has been installed 
-you can setup Cachix via:
+The build will take a while since `bazel` has to download and build from source
+all of `urbit`'s third-party dependencies.

-```
-nix-env -iA cachix -f https://cachix.org/api/v1/install
-cachix use ares
+To run the just-built `urbit` binary, run:
+
+```console
+$ bazel-bin/pkg/vere/urbit ...
 ```

-The Makefile in the project's root directory contains useful phony targets for
-building, installing, testing, and so on.  You can use it to avoid dealing with
-Nix explicitly.
+Or, to save yourself a few keystrokes, create a symlink to the `urbit` binary in
+the root of the repository:

-To build the Urbit virtual machine binary, for example, use:
-
-```
-make build
+```console
+$ ln -s bazel-bin/pkg/vere/urbit urbit
+$ ./urbit ...
 ```

-The test suite can similarly be run via a simple:
+To run all runtime tests, run:

-```
-make test
+```console
+$ bazel test //...
 ```

-Note that some of the Makefile targets need access to pills tracked via [git
-LFS][git-lfs], so you'll also need to have those available locally:
+or, to run a specific test, say
+[`pkg/noun/hashtable_tests.c`](pkg/noun/hashtable_tests.c), run:

-```
-git lfs install
-git lfs pull
+```console
+$ bazel test //pkg/noun:hashtable_tests
 ```

-[license]: https://raw.githubusercontent.com/urbit/urbit/master/LICENSE.txt
-[license-badge]: https://img.shields.io/badge/license-MIT-blue.svg
-[build]: https://github.com/urbit/urbit/actions
-[build-badge]: https://github.com/urbit/urbit/workflows/build/badge.svg
-[cachix]: https://ares.cachix.org
-[cachix-badge]: https://img.shields.io/badge/cachix-ares-purple.svg
-[nix]: https://nixos.org
-[nix-badge]: https://img.shields.io/badge/builtwith-nix-purple.svg
-[git-lfs]: https://git-lfs.github.com
+If you're interested in digging into the details of the build system, check out
+[`WORKSPACE.bazel`](WORKSPACE.bazel), [`BUILD.bazel`](BUILD.bazel),
+[`bazel/`](bazel), and the multiple `BUILD.bazel` files in [`pkg/`](pkg).
+

 ## Contributing

-Contributions of any form are more than welcome!  Please take a look at our
-[contributing guidelines][cont] for details on our git practices, coding
+Contributions of any form are more than welcome. Please take a look at our
+[contributing guidelines][contributing] for details on our git practices, coding
 styles, how we manage issues, and so on.

-For instructions on contributing to Landscape, see [its][lcont] guidelines.

-You might also be interested in joining the [urbit-dev][list] mailing list.
-
-[list]: https://groups.google.com/a/urbit.org/forum/#!forum/dev
-[cont]: https://github.com/urbit/urbit/blob/master/CONTRIBUTING.md
-[lcont]: https://github.com/urbit/urbit/blob/master/pkg/interface/CONTRIBUTING.md
+[bazel]: https://bazel.build
+[contributing]: https://github.com/urbit/urbit/blob/master/CONTRIBUTING.md
+[cue]: https://developers.urbit.org/reference/hoon/stdlib/2p#cue
+[getting-started]: https://urbit.org/getting-started
+[jam]: https://developers.urbit.org/reference/hoon/stdlib/2p#jam
+[mailing-list]: https://groups.google.com/a/urbit.org/forum/#!forum/dev
+[urbit]: https://urbit.org
+[vere]: https://developers.urbit.org/reference/glossary/vere
+[technical-reference]: https://developers.urbit.org/reference
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@ -0,0 +1,272 @@
+# BUMPING A DEPENDENCY VERSION
+#
+# The general process for bumping the version of a dependency is as follows:
+#
+# (1) Update the `version` attribute in the dependency's repository rule (likely
+#     `versioned_http_archive()` or `versioned_http_file()`.
+# (2) Download the source code of the new version of the dependency using
+#     the specified `url` attribute (substituting `{version}` with the actual
+#     version you're updating to in the URL).
+# (3) Compute the SHA-256 hash of the new version's tarball (or zip archive)
+#     using `openssl`:
+#     ```
+#     $ openssl dgst -sha256 <path_to_compressed_depedency>
+#     ```
+# (4) Update the `sha256` attribute in the dependency's repository rule with the
+#     SHA-256 hash from (3).
+# (5) Run `bazel clean` to ensure that Bazel removes the old version of the
+#     dependency.
+#
+# If a dependency has documention specific to that dependency that conflicts
+# with the process described above, adhere to the dependency-specific
+# documentation.
+#
+# UPDATING A DEPENDENCY'S BUILD FILE
+#
+# It's unlikely that you'll need to update a dependency's build file, but if you
+# do, you presumably know what you're doing. Nonetheless, here are a few useful
+# bits of non-obvious information:
+#
+# - Build logic for a dependency resides within its `<dependency>.BUILD` file.
+#   `BUILD.bazel` is also present in the dependency's directory in
+#   `third_party/` to mark the directory as a package. Ideally, the logic in
+#   `<dependency>.BUILD` would live in `BUILD.bazel`, but Bazel 5.3.1 cannot
+#   find the source files of the dependency when `BUILD.bazel` holds the build
+#   logic (at least on my machine - ThinkPad X1 Carbon Gen 9, Arch Linux).
+# - Whenever possible, avoid delegating to foreign build systems. Delegating is
+#   inevitable when a third party dependency has a particularly complicated
+#   build system that would be too difficult to replicate in Bazel (i.e.
+#   OpenSSL). However, delegate only as a last resort.
+
+load("//bazel:repo.bzl", "versioned_http_archive", "versioned_http_file")
+
+#
+# RULES REPOSITORIES
+#
+
+versioned_http_archive(
+    name = "bazel_skylib",
+    sha256 = "74d544d96f4a5bb630d465ca8bbcfe231e3594e5aae57e1edbf17a6eb3ca2506",
+    url = "https://github.com/bazelbuild/bazel-skylib/releases/download/{version}/bazel-skylib-{version}.tar.gz",
+    version = "1.3.0",
+)
+
+versioned_http_archive(
+    name = "rules_cc",
+    sha256 = "af6cc82d87db94585bceeda2561cb8a9d55ad435318ccb4ddfee18a43580fb5d",
+    strip_prefix = "rules_cc-{version}",
+    url = "https://github.com/bazelbuild/rules_cc/releases/download/{version}/rules_cc-{version}.tar.gz",
+    version = "0.0.4",
+)
+
+versioned_http_archive(
+    name = "rules_foreign_cc",
+    sha256 = "2a4d07cd64b0719b39a7c12218a3e507672b82a97b98c6a89d38565894cf7c51",
+    strip_prefix = "rules_foreign_cc-{version}",
+    url = "https://github.com/bazelbuild/rules_foreign_cc/archive/refs/tags/{version}.tar.gz",
+    version = "0.9.0",
+)
+
+#
+# TOOLCHAINS SETUP
+#
+
+# Use the toolchains we've configured.
+register_toolchains(
+    "//bazel/toolchain:clang-linux-x86_64-toolchain",
+    "//bazel/toolchain:gcc-linux-x86_64-toolchain",
+)
+
+load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
+
+rules_foreign_cc_dependencies()
+
+#
+# THIRD PARTY DEPENDENCIES
+#
+
+versioned_http_archive(
+    name = "aes_siv",
+    build_file = "//bazel/third_party/aes_siv:aes_siv.BUILD",
+    sha256 = "1916a428dff480e06b09dc0fb1c9d849c048f838dc9b8d141452233b508f6bb1",
+    strip_prefix = "libaes_siv-{version}",
+    url = "https://github.com/dfoxfranke/libaes_siv/archive/{version}.tar.gz",
+    version = "9681279cfaa6e6399bb7ca3afbbc27fc2e19df4b",
+)
+
+versioned_http_archive(
+    name = "argon2",
+    build_file = "//bazel/third_party/argon2:argon2.BUILD",
+    sha256 = "40850e6e6324be10f14228d17b617ad2074bb926eeddd6fe40ad5df833833949",
+    strip_prefix = "argon2-{version}",
+    url = "https://github.com/urbit/argon2/archive/{version}.tar.gz",
+    version = "a4c1e3f7138c2e577376beb99f964cf71e1c8b1b",
+)
+
+# See https://curl.se/docs/caextract.html.
+versioned_http_file(
+    name = "ca_bundle",
+    sha256 = "2cff03f9efdaf52626bd1b451d700605dc1ea000c5da56bd0fc59f8f43071040",
+    url = "https://curl.se/ca/cacert-{version}.pem",
+    version = "2022-10-11",
+)
+
+versioned_http_archive(
+    name = "curl",
+    build_file = "//bazel/third_party/curl:curl.BUILD",
+    sha256 = "78a06f918bd5fde3c4573ef4f9806f56372b32ec1829c9ec474799eeee641c27",
+    strip_prefix = "curl-{version}",
+    url = "https://curl.se/download/curl-{version}.tar.gz",
+    version = "7.85.0",
+)
+
+versioned_http_archive(
+    name = "ed25519",
+    build_file = "//bazel/third_party/ed25519:ed25519.BUILD",
+    sha256 = "373923c85f61276e3cad2c0ae7a5d5cd4809ffe46c5abc1dc8276683a55782a0",
+    strip_prefix = "ed25519-{version}",
+    url = "https://github.com/orlp/ed25519/archive/{version}.tar.gz",
+    version = "7fa6712ef5d581a6981ec2b08ee623314cd1d1c4",
+)
+
+versioned_http_archive(
+    name = "gmp",
+    build_file = "//bazel/third_party/gmp:gmp.BUILD",
+    sha256 = "fd4829912cddd12f84181c3451cc752be224643e87fac497b69edddadc49b4f2",
+    strip_prefix = "gmp-{version}",
+    url = "https://gmplib.org/download/gmp/gmp-{version}.tar.xz",
+    version = "6.2.1",
+)
+
+versioned_http_archive(
+    name = "h2o",
+    build_file = "//bazel/third_party/h2o:h2o.BUILD",
+    sha256 = "f8cbc1b530d85ff098f6efc2c3fdbc5e29baffb30614caac59d5c710f7bda201",
+    strip_prefix = "h2o-{version}",
+    url = "https://github.com/h2o/h2o/archive/refs/tags/v{version}.tar.gz",
+    # When bumping the version, compare `CMakeLists.txt` in the `h2o` repo to
+    # {build_file} and confirm that {build_file} remains an accurate description
+    # of the h2o build process.
+    version = "2.2.6",
+)
+
+versioned_http_file(
+    name = "ivory_pill",
+    sha256 = "5123a1ac30b83ec026587574df1ce13a73e72d06588ff68b5c41c09e1bebb5b7",
+    url = "https://github.com/urbit/urbit/raw/urbit-v{version}/bin/ivory.pill",
+    version = "1.10",
+)
+
+versioned_http_archive(
+    name = "keccak_tiny",
+    build_file = "//bazel/third_party/keccak_tiny:keccak_tiny.BUILD",
+    patch_args = ["-p1"],
+    patches = ["//bazel/third_party/keccak_tiny:{version}.patch"],
+    sha256 = "6d4717f96b84805886c74bad89e911076664d992f197634fd7cdfca2ac0f62ef",
+    strip_prefix = "keccak-tiny-{version}",
+    url = "https://github.com/coruus/keccak-tiny/archive/{version}.tar.gz",
+    version = "64b6647514212b76ae7bca0dea9b7b197d1d8186",
+)
+
+versioned_http_archive(
+    name = "lmdb",
+    build_file = "//bazel/third_party/lmdb:lmdb.BUILD",
+    sha256 = "22054926b426c66d8f2bc22071365df6e35f3aacf19ad943bc6167d4cae3bebb",
+    strip_prefix = "lmdb-LMDB_{version}/libraries/liblmdb",
+    url = "https://github.com/LMDB/lmdb/archive/refs/tags/LMDB_{version}.tar.gz",
+    # When bumping the version, compare `libraries/liblmdb/Makefile` in the
+    # `lmdb` repo to {build_file} and confirm that {build_file} remains an
+    # accurate description of the lmdb build process.
+    version = "0.9.29",
+)
+
+versioned_http_archive(
+    name = "murmur3",
+    build_file = "//bazel/third_party/murmur3:murmur3.BUILD",
+    sha256 = "d81836605204df2db9e0c095423b2856073d1b2ef900463151d0663b7ca3164f",
+    strip_prefix = "murmur3-{version}",
+    url = "https://github.com/PeterScott/murmur3/archive/{version}.tar.gz",
+    # When bumping the version, compare `makefile` in the `murmur3` repo to
+    # {build_file} and confirm that {build_file} remains an accurate description
+    # of the murmur3 build process.
+    version = "dae94be0c0f54a399d23ea6cbe54bca5a4e93ce4",
+)
+
+versioned_http_archive(
+    name = "openssl",
+    build_file = "//bazel/third_party/openssl:openssl.BUILD",
+    sha256 = "d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca",
+    strip_prefix = "openssl-{version}",
+    url = "https://www.openssl.org/source/openssl-{version}.tar.gz",
+    version = "1.1.1q",
+)
+
+versioned_http_archive(
+    name = "scrypt",
+    build_file = "//bazel/third_party/scrypt:scrypt.BUILD",
+    sha256 = "df681fb19b653b1a12970ebb6091bb2b58411b9e7baf01143870f6be3f099541",
+    strip_prefix = "libscrypt-{version}",
+    url = "https://github.com/technion/libscrypt/archive/{version}.tar.gz",
+    # When bumping the version, compare `Makefile` in the `scrypt` repo to
+    # {build_file} and confirm that {build_file} remains an accurate description
+    # of the scrypt build process.
+    version = "60e585cdd752262b22ed4113eca41c0461a61608",
+)
+
+versioned_http_archive(
+    name = "secp256k1",
+    build_file = "//bazel/third_party/secp256k1:secp256k1.BUILD",
+    sha256 = "5f6e4a66bf8f3c318d91eacbf3262d1cd81a3fda6bb9af267b54cf38ffd44b1c",
+    strip_prefix = "secp256k1-{version}",
+    url = "https://github.com/bitcoin-core/secp256k1/archive/{version}.tar.gz",
+    version = "694ce8fb2d1fd8a3d641d7c33705691d41a2a860",
+)
+
+versioned_http_archive(
+    name = "sigsegv",
+    build_file = "//bazel/third_party/sigsegv:sigsegv.BUILD",
+    sha256 = "cdac3941803364cf81a908499beb79c200ead60b6b5b40cad124fd1e06caa295",
+    strip_prefix = "libsigsegv-{version}",
+    url = "https://ftp.gnu.org/gnu/libsigsegv/libsigsegv-{version}.tar.gz",
+    version = "2.14",
+)
+
+versioned_http_archive(
+    name = "softfloat",
+    build_file = "//bazel/third_party/softfloat:softfloat.BUILD",
+    sha256 = "15ad5841e88fe09422a8e31a0ef3fe126ecf678f52c9a3882f3373d47752aebe",
+    strip_prefix = "berkeley-softfloat-3-{version}",
+    url = "https://github.com/ucb-bar/berkeley-softfloat-3/archive/{version}.tar.gz",
+    # When bumping the version, compare `build/<target>/Makefile` in the
+    # `softfloat` repo to {build_file} and compare that {build_file} remains an
+    # accurate description of the softfloat process for *all* supported
+    # `<target>`s.
+    version = "5c06db33fc1e2130f67c045327b0ec949032df1d",
+)
+
+versioned_http_archive(
+    name = "uv",
+    build_file = "//bazel/third_party/uv:uv.BUILD",
+    sha256 = "ccfcdc968c55673c6526d8270a9c8655a806ea92468afcbcabc2b16040f03cb4",
+    strip_prefix = "libuv-v{version}",
+    url = "https://dist.libuv.org/dist/v{version}/libuv-v{version}.tar.gz",
+    version = "1.44.2",
+)
+
+versioned_http_archive(
+    name = "whereami",
+    build_file = "//bazel/third_party/whereami:whereami.BUILD",
+    sha256 = "1d8744177f37e8386ec2f6c5992592399040cb93535ed4fd253e1976f889a744",
+    strip_prefix = "whereami-{version}",
+    url = "https://github.com/gpakosz/whereami/archive/{version}.tar.gz",
+    version = "ba364cd54fd431c76c045393b6522b4bff547f50",
+)
+
+versioned_http_archive(
+    name = "zlib",
+    build_file = "//bazel/third_party/zlib:zlib.BUILD",
+    sha256 = "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30",
+    strip_prefix = "zlib-{version}",
+    url = "https://www.zlib.net/zlib-{version}.tar.gz",
+    version = "1.2.13",
+)
--- a/pkg/urcrypt/build-aux/m4/.gitkeep
+++ b/pkg/urcrypt/build-aux/m4/.gitkeep
--- a/bazel/repo.bzl
+++ b/bazel/repo.bzl
@ -0,0 +1,34 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+
+# Adds a `version` attribute to `http_archive`.
+def versioned_http_archive(name, version, **kwargs):
+    if kwargs.get("url") != None:
+        kwargs["url"] = kwargs["url"].format(version = version)
+
+    if kwargs.get("urls") != None:
+        for index, url in enumerate(kwargs["urls"]):
+            kwargs["urls"][index] = url.format(version = version)
+
+    if kwargs.get("patches") != None:
+        for index, patch in enumerate(kwargs["patches"]):
+            kwargs["patches"][index] = patch.format(version = version)
+
+    if kwargs.get("strip_prefix") != None:
+        kwargs["strip_prefix"] = kwargs["strip_prefix"].format(version = version)
+
+    maybe(http_archive, name, **kwargs)
+
+# Adds a `version` attribute to `http_file`.
+def versioned_http_file(name, version, **kwargs):
+    if kwargs.get("url") != None:
+        kwargs["url"] = kwargs["url"].format(version = version)
+
+    if kwargs.get("urls") != None:
+        for index, url in enumerate(kwargs["urls"]):
+            kwargs["urls"][index] = url.format(version = version)
+
+    if kwargs.get("strip_prefix") != None:
+        kwargs["strip_prefix"] = kwargs["strip_prefix"].format(version = version)
+
+    maybe(http_file, name, **kwargs)
--- a/bazel/third_party/aes_siv/BUILD.bazel
+++ b/bazel/third_party/aes_siv/BUILD.bazel
--- a/bazel/third_party/aes_siv/aes_siv.BUILD
+++ b/bazel/third_party/aes_siv/aes_siv.BUILD
@ -0,0 +1,20 @@
+genrule(
+    name = "config",
+    srcs = ["config.h.in"],
+    outs = ["config.h"],
+    # The options in config.h.in only affect libaes_siv's testing behavior, so
+    # it's sufficient to generate an empty config.h.
+    cmd = "touch $@",
+)
+
+cc_library(
+    name = "aes_siv",
+    srcs = [
+        "aes_siv.c",
+        "config.h",
+    ],
+    hdrs = ["aes_siv.h"],
+    includes = ["."],
+    visibility = ["//visibility:public"],
+    deps = ["@openssl"],
+)
--- a/bazel/third_party/argon2/BUILD.bazel
+++ b/bazel/third_party/argon2/BUILD.bazel
--- a/bazel/third_party/argon2/argon2.BUILD
+++ b/bazel/third_party/argon2/argon2.BUILD
@ -0,0 +1,42 @@
+cc_library(
+    name = "argon2",
+    srcs = [
+        "src/argon2.c",
+        "src/blake2/blake2-impl.h",
+        "src/blake2/blake2b.c",
+        "src/core.c",
+        "src/core.h",
+        "src/encoding.c",
+        "src/encoding.h",
+        "src/thread.c",
+        "src/thread.h",
+    ] + select({
+        # `opt.c` requires SSE instructions. See `Makefile` in the `argon2` repo
+        # for the check used to determine whether to use `opt.c` or `ref.c`.
+        "@platforms//cpu:x86_64": [
+            "src/blake2/blamka-round-opt.h",
+            "src/opt.c",
+        ],
+        "//conditions:default": [
+            "src/blake2/blamka-round-ref.h",
+            "src/ref.c",
+        ],
+    }),
+    hdrs = [
+        "include/argon2.h",
+        "src/blake2/blake2.h",
+    ],
+    copts = [
+        "-std=c89",
+        "-O3",
+        "-Wall",
+        "-g",
+        "-Isrc",
+        "-DARGON2_NO_THREADS",
+    ],
+    includes = [
+        "include",
+        "src/blake2",
+    ],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/curl/BUILD.bazel
+++ b/bazel/third_party/curl/BUILD.bazel
--- a/bazel/third_party/curl/curl.BUILD
+++ b/bazel/third_party/curl/curl.BUILD
@ -0,0 +1,61 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+# TODO: check windows build.
+configure_make(
+    name = "curl",
+    args = ["--jobs=`nproc`"],
+    # We disable unneeded features.
+    # TODO: double check that all disabled features below are in fact unneeded.
+    configure_options = [
+        "--disable-alt-svc",
+        "--disable-ares",
+        "--disable-cookies",
+        "--disable-crypto-auth",
+        "--disable-dateparse",
+        "--disable-dnsshuffle",
+        "--disable-doh",
+        "--disable-get-easy-options",
+        "--disable-hsts",
+        "--disable-http-auth",
+        "--disable-ipv6",
+        "--disable-ldap",
+        "--disable-libcurl-option",
+        "--disable-manual",
+        "--disable-shared",
+        "--disable-netrc",
+        "--disable-ntlm-wb",
+        "--disable-progress-meter",
+        "--disable-proxy",
+        "--disable-pthreads",
+        "--disable-socketpair",
+        "--disable-threaded-resolver",
+        "--disable-tls-srp",
+        "--disable-unix-sockets",
+        "--disable-verbose",
+        "--disable-versioned-symbols",
+        "--enable-static",
+        # Use our openssl, not the system's openssl.
+        "--with-openssl=$(URBIT_RUNTIME_OPENSSL)",
+        "--without-brotli",
+        "--without-libidn2",
+        "--without-libpsl",
+        "--without-librtmp",
+        "--without-nghttp2",
+        "--without-ngtcp2",
+        "--without-ssl",
+        "--without-zlib",
+        "--without-zstd",
+    ],
+    env = {
+        "URBIT_RUNTIME_OPENSSL": "$(GENDIR)/external/openssl/openssl",
+    },
+    lib_source = ":all",
+    out_static_libs = ["libcurl.a"],
+    visibility = ["//visibility:public"],
+    deps = ["@openssl"],
+)
--- a/bazel/third_party/ed25519/BUILD.bazel
+++ b/bazel/third_party/ed25519/BUILD.bazel
--- a/bazel/third_party/ed25519/ed25519.BUILD
+++ b/bazel/third_party/ed25519/ed25519.BUILD
@ -0,0 +1,13 @@
+cc_library(
+    name = "ed25519",
+    srcs = glob(
+        [
+            "src/*.c",
+            "src/*.h",
+        ],
+        exclude = ["src/ed25519.h"],
+    ),
+    hdrs = ["src/ed25519.h"],
+    includes = ["src"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/gmp/BUILD.bazel
+++ b/bazel/third_party/gmp/BUILD.bazel
--- a/bazel/third_party/gmp/gmp.BUILD
+++ b/bazel/third_party/gmp/gmp.BUILD
@ -0,0 +1,16 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+# TODO: check windows build.
+configure_make(
+    name = "gmp",
+    args = ["--jobs=`nproc`"],
+    configure_options = ["--disable-shared"],
+    lib_source = ":all",
+    out_static_libs = ["libgmp.a"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/h2o/BUILD.bazel
+++ b/bazel/third_party/h2o/BUILD.bazel
--- a/bazel/third_party/h2o/h2o.BUILD
+++ b/bazel/third_party/h2o/h2o.BUILD
@ -0,0 +1,345 @@
+# This build file is derived from `CMakeLists.txt` in the `h2o` repo at
+# https://github.com/h2o/h2o.
+
+# See `CC_WARNING_FLAGS` in `CMakeLists.txt` in the `h2o` repo.
+CC_WARNING_FLAGS = [
+    "-Wall",
+    "-Wno-unused-value",
+    "-Wno-unused-function",
+    "-Wno-nullability-completeness",
+    "-Wno-expansion-to-defined",
+    "-Werror=implicit-function-declaration",
+    "-Werror=incompatible-pointer-types",
+]
+
+#
+# H2O DEPENDENCIES
+#
+
+# See `deps/cloxec` in the `h2o` repo.
+cc_library(
+    name = "cloexec",
+    srcs = ["deps/cloexec/cloexec.c"],
+    hdrs = ["deps/cloexec/cloexec.h"],
+    includes = ["deps/cloexec"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/golombset` in the `h2o` repo.
+cc_library(
+    name = "golombset",
+    hdrs = ["deps/golombset/golombset.h"],
+    includes = ["deps/golombset"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/klib` in the `h2o` repo.
+cc_library(
+    name = "klib",
+    srcs = glob(["deps/klib/*.c"]),
+    hdrs = glob(["deps/klib/*.h"]),
+    includes = ["deps/klib"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+    deps = ["@curl"],
+)
+
+# See `deps/libgkc` in the `h2o` repo.
+cc_library(
+    name = "libgkc",
+    srcs = ["deps/libgkc/gkc.c"],
+    hdrs = ["deps/libgkc/gkc.h"],
+    includes = ["deps/libgkc"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/libyrmcds` in the `h2o` repo.
+cc_library(
+    name = "libyrmcds",
+    srcs = glob(
+        ["deps/libyrmcds/*.c"],
+        exclude = [
+            "deps/libyrmcds/yc.c",
+            "deps/libyrmcds/yc-cnt.c",
+        ],
+    ) + [
+        "deps/libyrmcds/yrmcds_portability.h",
+        "deps/libyrmcds/yrmcds_text.h",
+    ],
+    hdrs = ["deps/libyrmcds/yrmcds.h"],
+    copts = [
+        "-Wall",
+        "-Wconversion",
+        "-gdwarf-3",
+        "-O2",
+    ],
+    includes = ["deps/libyrmcds"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/picohttpparser` in the `h2o` repo.
+cc_library(
+    name = "picohttpparser",
+    srcs = ["deps/picohttpparser/picohttpparser.c"],
+    hdrs = ["deps/picohttpparser/picohttpparser.h"],
+    includes = ["deps/picohttpparser"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/picotls` in the `h2o` repo.
+cc_library(
+    name = "picotls",
+    srcs = glob(
+        ["deps/picotls/lib/*.c"],
+    ),
+    hdrs = ["deps/picotls/include/picotls.h"] + glob(
+        ["deps/picotls/include/picotls/*.h"],
+    ),
+    copts = [
+        "-std=c99",
+        "-Wall",
+        "-O2",
+        "-g",
+    ],
+    includes = [
+        "deps/picotls/include",
+        "deps/picotls/include/picotls",
+    ],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+    deps = [
+        ":cifra",
+        ":micro_ecc",
+        "@openssl",
+    ],
+)
+
+# See `deps/ssl-conservatory` in the `h2o` repo.
+cc_library(
+    name = "ssl_conservatory",
+    hdrs = ["deps/ssl-conservatory/openssl/openssl_hostname_validation.h"],
+    includes = ["deps/ssl-conservatory/openssl"],
+    linkstatic = True,
+    textual_hdrs = ["deps/ssl-conservatory/openssl/openssl_hostname_validation.c"],
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/yoml` in the `h2o` repo.
+cc_library(
+    name = "yoml",
+    hdrs = glob(
+        ["deps/yoml/*.h"],
+    ),
+    includes = ["deps/yoml"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+)
+
+#
+# PICOTLS DEPENDENCIES
+#
+
+# See `deps/picotls/deps/cifra` in the `h2o` repo.
+cc_library(
+    name = "cifra",
+    srcs = [
+        "deps/picotls/deps/cifra/src/aes.c",
+        "deps/picotls/deps/cifra/src/sha256.c",
+        "deps/picotls/deps/cifra/src/sha512.c",
+        "deps/picotls/deps/cifra/src/chash.c",
+        "deps/picotls/deps/cifra/src/hmac.c",
+        "deps/picotls/deps/cifra/src/pbkdf2.c",
+        "deps/picotls/deps/cifra/src/modes.c",
+        "deps/picotls/deps/cifra/src/eax.c",
+        "deps/picotls/deps/cifra/src/gf128.c",
+        "deps/picotls/deps/cifra/src/blockwise.c",
+        "deps/picotls/deps/cifra/src/cmac.c",
+        "deps/picotls/deps/cifra/src/salsa20.c",
+        "deps/picotls/deps/cifra/src/chacha20.c",
+        "deps/picotls/deps/cifra/src/curve25519.c",
+        "deps/picotls/deps/cifra/src/gcm.c",
+        "deps/picotls/deps/cifra/src/cbcmac.c",
+        "deps/picotls/deps/cifra/src/ccm.c",
+        "deps/picotls/deps/cifra/src/sha3.c",
+        "deps/picotls/deps/cifra/src/sha1.c",
+        "deps/picotls/deps/cifra/src/poly1305.c",
+        "deps/picotls/deps/cifra/src/norx.c",
+        "deps/picotls/deps/cifra/src/chacha20poly1305.c",
+        "deps/picotls/deps/cifra/src/drbg.c",
+        "deps/picotls/deps/cifra/src/ocb.c",
+    ] + glob(
+        [
+            "deps/picotls/deps/cifra/src/*.h",
+            "deps/picotls/deps/cifra/src/ext/*.h",
+        ],
+        exclude = ["deps/picotls/deps/cifra/src/ext/handy.h"],
+    ),
+    hdrs = glob(
+        [
+            "deps/picotls/deps/cifra/src/*.h",
+            "deps/picotls/deps/cifra/src/ext/*.h",
+        ],
+    ),
+    includes = [
+        "deps/picotls/deps/cifra/src",
+        "deps/picotls/deps/cifra/src/ext",
+    ],
+    linkstatic = True,
+    textual_hdrs = ["deps/picotls/deps/cifra/src/curve25519.tweetnacl.c"],
+    visibility = ["//visibility:private"],
+)
+
+# See `deps/picotls/deps/micro-ecc` in the `h2o` repo.
+cc_library(
+    name = "micro_ecc",
+    srcs = [
+        "deps/picotls/deps/micro-ecc/types.h",
+        "deps/picotls/deps/micro-ecc/uECC.c",
+        "deps/picotls/deps/micro-ecc/uECC_vli.h",
+    ],
+    hdrs = ["deps/picotls/deps/micro-ecc/uECC.h"],
+    includes = ["deps/picotls/deps/micro-ecc"],
+    textual_hdrs = [
+        "deps/picotls/deps/micro-ecc/asm_arm.inc",
+        "deps/picotls/deps/micro-ecc/asm_arm_mult_square.inc",
+        "deps/picotls/deps/micro-ecc/asm_arm_mult_square_umaal.inc",
+        "deps/picotls/deps/micro-ecc/asm_avr.inc",
+        "deps/picotls/deps/micro-ecc/asm_avr_mult_square.inc",
+        "deps/picotls/deps/micro-ecc/curve-specific.inc",
+        "deps/picotls/deps/micro-ecc/platform-specific.inc",
+    ],
+    visibility = ["//visibility:private"],
+)
+
+# TODO: check windows build.
+cc_library(
+    name = "h2o",
+    # The `*.c` files below correspond to the files in `lib/` in
+    # `LIB_SOURCE_FILES` in `CMakeLists.txt` in the `h2o` repo.
+    #
+    # Files in `deps/` in `LIB_SOURCE_FILES` are in their respective library
+    # targets above.
+    srcs = [
+        "lib/common/cache.c",
+        "lib/common/file.c",
+        "lib/common/filecache.c",
+        "lib/common/hostinfo.c",
+        "lib/common/http1client.c",
+        "lib/common/memcached.c",
+        "lib/common/memory.c",
+        "lib/common/multithread.c",
+        "lib/common/serverutil.c",
+        "lib/common/socket.c",
+        "lib/common/socketpool.c",
+        "lib/common/string.c",
+        "lib/common/time.c",
+        "lib/common/timeout.c",
+        "lib/common/url.c",
+        "lib/core/config.c",
+        "lib/core/configurator.c",
+        "lib/core/context.c",
+        "lib/core/headers.c",
+        "lib/core/logconf.c",
+        "lib/core/proxy.c",
+        "lib/core/request.c",
+        "lib/core/token.c",
+        "lib/core/util.c",
+        "lib/handler/access_log.c",
+        "lib/handler/chunked.c",
+        "lib/handler/compress.c",
+        "lib/handler/compress/gzip.c",
+        "lib/handler/configurator/access_log.c",
+        "lib/handler/configurator/compress.c",
+        "lib/handler/configurator/errordoc.c",
+        "lib/handler/configurator/expires.c",
+        "lib/handler/configurator/fastcgi.c",
+        "lib/handler/configurator/file.c",
+        "lib/handler/configurator/headers.c",
+        "lib/handler/configurator/headers_util.c",
+        "lib/handler/configurator/http2_debug_state.c",
+        "lib/handler/configurator/proxy.c",
+        "lib/handler/configurator/redirect.c",
+        "lib/handler/configurator/reproxy.c",
+        "lib/handler/configurator/status.c",
+        "lib/handler/configurator/throttle_resp.c",
+        "lib/handler/errordoc.c",
+        "lib/handler/expires.c",
+        "lib/handler/fastcgi.c",
+        "lib/handler/file.c",
+        "lib/handler/headers.c",
+        "lib/handler/headers_util.c",
+        "lib/handler/http2_debug_state.c",
+        "lib/handler/mimemap.c",
+        "lib/handler/proxy.c",
+        "lib/handler/redirect.c",
+        "lib/handler/reproxy.c",
+        "lib/handler/status.c",
+        "lib/handler/status/durations.c",
+        "lib/handler/status/events.c",
+        "lib/handler/status/requests.c",
+        "lib/handler/throttle_resp.c",
+        "lib/http1.c",
+        "lib/http2/cache_digests.c",
+        "lib/http2/casper.c",
+        "lib/http2/connection.c",
+        "lib/http2/frame.c",
+        "lib/http2/hpack.c",
+        "lib/http2/http2_debug_state.c",
+        "lib/http2/scheduler.c",
+        "lib/http2/stream.c",
+        "lib/tunnel.c",
+    ] + glob(
+        [
+            "lib/core/*.h",
+            "lib/handler/mimemap/*.h",
+            "lib/handler/file/*.h",
+            "lib/http2/*.h",
+            "lib/common/socket/*.h",
+        ],
+    ),
+    hdrs = ["include/h2o.h"] + glob(
+        [
+            "include/h2o/*.h",
+        ],
+    ) + glob(
+        ["include/h2o/socket/*.h"],
+    ),
+    copts = [
+        "-std=c99",
+        "-g3",
+        "-O2",
+        "-pthread",
+    ] + CC_WARNING_FLAGS,
+    includes = [
+        "include",
+        "include/h2o",
+        "include/h2o/socket",
+    ],
+    local_defines = [
+        "H2O_USE_LIBUV",
+        "H2O_USE_PICOTLS",
+    ] + select({
+        "@platforms//os:linux": ["_GNU_SOURCE"],
+        "//conditions:default": [],
+    }),
+    visibility = ["//visibility:public"],
+    deps = [
+        ":cloexec",
+        ":golombset",
+        ":klib",
+        ":libgkc",
+        ":libyrmcds",
+        ":picohttpparser",
+        ":picotls",
+        ":ssl_conservatory",
+        ":yoml",
+        "@openssl",
+        "@uv",
+        "@zlib",
+    ],
+)
--- a/bazel/third_party/keccak_tiny/64b6647514212b76ae7bca0dea9b7b197d1d8186.patch
+++ b/bazel/third_party/keccak_tiny/64b6647514212b76ae7bca0dea9b7b197d1d8186.patch
@ -0,0 +1,168 @@
+diff --git a/define-macros.h b/define-macros.h
+new file mode 100644
+index 0000000..79b534c
+--- /dev/null
+++ b/define-macros.h
+@@ -0,0 +1,44 @@
+#ifndef DEFINEMACROS_H
+#define DEFINEMACROS_H
+
+/*** Helper macros to define SHA3 and SHAKE instances. ***/
+#define defshake(bits)                                            \
+  int shake##bits(uint8_t* out, size_t outlen,                    \
+                  const uint8_t* in, size_t inlen) {              \
+    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x1f);  \
+  }
+#define defsha3(bits)                                             \
+  int sha3_##bits(uint8_t* out, size_t outlen,                    \
+                  const uint8_t* in, size_t inlen) {              \
+    if (outlen > (bits/8)) {                                      \
+      return -1;                                                  \
+    }                                                             \
+    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x06);  \
+  }
+
+#define defkeccak(bits)                                           \
+  int keccak_##bits(uint8_t* out, size_t outlen,                  \
+                  const uint8_t* in, size_t inlen) {              \
+    if (outlen > (bits/8)) {                                      \
+      return -1;                                                  \
+    }                                                             \
+    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x01);  \
+  }
+
+/*** FIPS202 SHAKE VOFs ***/
+defshake(128)
+defshake(256)
+
+/*** FIPS202 SHA3 FOFs ***/
+defsha3(224)
+defsha3(256)
+defsha3(384)
+defsha3(512)
+
+/*** Non FIP202 SHA3 (KECCAK) FOFs ***/
+defkeccak(224)
+defkeccak(256)
+defkeccak(384)
+defkeccak(512)
+
+#endif // DEFINEMACROS_H
+diff --git a/keccak-tiny-unrolled.c b/keccak-tiny-unrolled.c
+index c238af4..c1eb2a6 100644
+--- a/keccak-tiny-unrolled.c
+++ b/keccak-tiny-unrolled.c
+@@ -133,31 +133,11 @@ static inline int hash(uint8_t* out, size_t outlen,
+   // Squeeze output.
+   foldP(out, outlen, setout);
+   setout(a, out, outlen);
+-  memset_s(a, 200, 0, 200);
+  //TODO: c11 problem: replaced
+  //memset_s(a, 200, 0, 200);
+  //Reference: http://en.cppreference.com/w/c/string/byte/memset
+  memset(a, 0, 200);
+   return 0;
+ }
+
+-/*** Helper macros to define SHA3 and SHAKE instances. ***/
+-#define defshake(bits)                                            \
+-  int shake##bits(uint8_t* out, size_t outlen,                    \
+-                  const uint8_t* in, size_t inlen) {              \
+-    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x1f);  \
+-  }
+-#define defsha3(bits)                                             \
+-  int sha3_##bits(uint8_t* out, size_t outlen,                    \
+-                  const uint8_t* in, size_t inlen) {              \
+-    if (outlen > (bits/8)) {                                      \
+-      return -1;                                                  \
+-    }                                                             \
+-    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x06);  \
+-  }
+-
+-/*** FIPS202 SHAKE VOFs ***/
+-defshake(128)
+-defshake(256)
+-
+-/*** FIPS202 SHA3 FOFs ***/
+-defsha3(224)
+-defsha3(256)
+-defsha3(384)
+-defsha3(512)
+#include "define-macros.h"
+diff --git a/keccak-tiny.c b/keccak-tiny.c
+index 76d89fa..fcb3556 100644
+--- a/keccak-tiny.c
+++ b/keccak-tiny.c
+@@ -133,31 +133,11 @@ static inline int hash(uint8_t* out, size_t outlen,
+   // Squeeze output.
+   foldP(out, outlen, setout);
+   setout(a, out, outlen);
+-  memset_s(a, 200, 0, 200);
+  //TODO: c11 problem: replaced
+  //memset_s(a, 200, 0, 200);
+  //Reference: http://en.cppreference.com/w/c/string/byte/memset
+  memset(a, 0, 200);
+   return 0;
+ }
+
+-/*** Helper macros to define SHA3 and SHAKE instances. ***/
+-#define defshake(bits)                                            \
+-  int shake##bits(uint8_t* out, size_t outlen,                    \
+-                  const uint8_t* in, size_t inlen) {              \
+-    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x1f);  \
+-  }
+-#define defsha3(bits)                                             \
+-  int sha3_##bits(uint8_t* out, size_t outlen,                    \
+-                  const uint8_t* in, size_t inlen) {              \
+-    if (outlen > (bits/8)) {                                      \
+-      return -1;                                                  \
+-    }                                                             \
+-    return hash(out, outlen, in, inlen, 200 - (bits / 4), 0x06);  \
+-  }
+-
+-/*** FIPS202 SHAKE VOFs ***/
+-defshake(128)
+-defshake(256)
+-
+-/*** FIPS202 SHA3 FOFs ***/
+-defsha3(224)
+-defsha3(256)
+-defsha3(384)
+-defsha3(512)
+#include "define-macros.h"
+diff --git a/keccak-tiny.h b/keccak-tiny.h
+index c4c678e..5d643be 100644
+--- a/keccak-tiny.h
+++ b/keccak-tiny.h
+@@ -4,16 +4,31 @@
+ #include <stdint.h>
+ #include <stdlib.h>
+
+#define HASH224_SIZE 28
+#define HASH256_SIZE 32
+#define HASH384_SIZE 48
+#define HASH512_SIZE 64
+
+ #define decshake(bits) \
+   int shake##bits(uint8_t*, size_t, const uint8_t*, size_t);
+
+ #define decsha3(bits) \
+   int sha3_##bits(uint8_t*, size_t, const uint8_t*, size_t);
+
+#define deckeccak(bits) \
+  int keccak_##bits(uint8_t*, size_t, const uint8_t*, size_t);
+
+ decshake(128)
+ decshake(256)
+
+ decsha3(224)
+ decsha3(256)
+ decsha3(384)
+ decsha3(512)
+
+deckeccak(224)
+deckeccak(256)
+deckeccak(384)
+deckeccak(512)
+
+ #endif
--- a/bazel/third_party/keccak_tiny/BUILD.bazel
+++ b/bazel/third_party/keccak_tiny/BUILD.bazel
--- a/bazel/third_party/keccak_tiny/keccak_tiny.BUILD
+++ b/bazel/third_party/keccak_tiny/keccak_tiny.BUILD
@ -0,0 +1,15 @@
+cc_library(
+    name = "keccak_tiny",
+    srcs = [
+        "define-macros.h",
+        "keccak-tiny.c",
+    ],
+    hdrs = ["keccak-tiny.h"],
+    includes = ["."],
+    local_defines = select({
+        # TODO: confirm which platforms have memset_s().
+        "@platforms//os:linux": ["memset_s(W,WL,V,OL)=memset(W,V,OL)"],
+        "//conditions:default": [],
+    }),
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/lmdb/BUILD.bazel
+++ b/bazel/third_party/lmdb/BUILD.bazel
--- a/bazel/third_party/lmdb/lmdb.BUILD
+++ b/bazel/third_party/lmdb/lmdb.BUILD
@ -0,0 +1,25 @@
+# This build file is derived from `libraries/liblmdb/Makefile` in the `lmdb`
+# repo at https://github.com/LMDB/lmdb.
+
+cc_library(
+    name = "lmdb",
+    srcs = [
+        "mdb.c",
+        "midl.c",
+        "midl.h",
+    ],
+    hdrs = ["lmdb.h"],
+    copts = [
+        "-pthread",
+        "-O2",
+        "-g",
+        "-W",
+        "-Wall",
+        "-Wno-unused-parameter",
+        "-Wbad-function-cast",
+        "-Wuninitialized",
+    ],
+    include_prefix = "lmdb",
+    includes = ["."],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/murmur3/BUILD.bazel
+++ b/bazel/third_party/murmur3/BUILD.bazel
--- a/bazel/third_party/murmur3/murmur3.BUILD
+++ b/bazel/third_party/murmur3/murmur3.BUILD
@ -0,0 +1,14 @@
+# This build file is derived from `makefile` in the `murmur3` repo at
+# https://github.com/PeterScott/murmur3.
+
+cc_library(
+    name = "murmur3",
+    srcs = ["murmur3.c"],
+    hdrs = ["murmur3.h"],
+    copts = [
+        "-O3",
+        "-Wall",
+    ],
+    includes = ["."],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/openssl/BUILD.bazel
+++ b/bazel/third_party/openssl/BUILD.bazel
--- a/bazel/third_party/openssl/openssl.BUILD
+++ b/bazel/third_party/openssl/openssl.BUILD
@ -0,0 +1,36 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+# TODO: use configure_make_variant() to select nmake toolchain on windows?
+configure_make(
+    name = "openssl",
+    args = ["--jobs=`nproc`"],
+    configure_command = select({
+        "@platforms//os:windows": "Configure",
+        "//conditions:default": "config",
+    }),
+    configure_options = [
+        "no-shared",
+    ] + select({
+        "@platforms//os:windows": ["mingw64"],
+        "//conditions:default": [],
+    }),
+    configure_prefix = select({
+        "@platforms//os:windows": "perl",
+        "//conditions:default": "",
+    }),
+    lib_source = ":all",
+    out_static_libs = [
+        "libssl.a",
+        "libcrypto.a",
+    ],
+    targets = [
+        "build_libs",
+        "install_dev",
+    ],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/scrypt/BUILD.bazel
+++ b/bazel/third_party/scrypt/BUILD.bazel
--- a/bazel/third_party/scrypt/scrypt.BUILD
+++ b/bazel/third_party/scrypt/scrypt.BUILD
@ -0,0 +1,30 @@
+# This build file is derived from `Makefile` in the `scrypt` repo at
+# https://github.com/technion/libscrypt.
+
+cc_library(
+    name = "scrypt",
+    srcs = [
+        "b64.c",
+        "b64.h",
+        "crypto-mcf.c",
+        "crypto-scrypt-saltgen.c",
+        "crypto_scrypt-check.c",
+        "crypto_scrypt-hash.c",
+        "crypto_scrypt-nosse.c",
+        "sha256.c",
+        "sha256.h",
+        "slowequals.c",
+        "slowequals.h",
+        "sysendian.h",
+    ],
+    hdrs = ["libscrypt.h"],
+    copts = [
+        "-O2",
+        "-Wall",
+        "-g",
+        "-fstack-protector",
+    ],
+    includes = ["."],
+    local_defines = ["_FORTIFY_SOURCE=2"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/secp256k1/BUILD.bazel
+++ b/bazel/third_party/secp256k1/BUILD.bazel
--- a/bazel/third_party/secp256k1/secp256k1.BUILD
+++ b/bazel/third_party/secp256k1/secp256k1.BUILD
@ -0,0 +1,22 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "secp256k1",
+    args = ["--jobs=`nproc`"],
+    autogen = True,
+    configure_in_place = True,
+    configure_options = [
+        "--disable-shared",
+        "--enable-module-recovery",
+        "--enable-module-schnorrsig",
+        "--enable-static",
+    ],
+    lib_source = ":all",
+    out_static_libs = ["libsecp256k1.a"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/sigsegv/BUILD.bazel
+++ b/bazel/third_party/sigsegv/BUILD.bazel
--- a/bazel/third_party/sigsegv/sigsegv.BUILD
+++ b/bazel/third_party/sigsegv/sigsegv.BUILD
@ -0,0 +1,23 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "sigsegv",
+    args = ["--jobs=`nproc`"],
+    configure_options = [
+        "--disable-shared",
+        "--enable-static",
+    ] + select({
+        # Disable stack vma check, which reads from procfs, producing drastic
+        # slowdowns.
+        "@platforms//os:linux": ["--disable-stackvma"],
+        "//conditions:default": [],
+    }),
+    lib_source = ":all",
+    out_static_libs = ["libsigsegv.a"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/softfloat/BUILD.bazel
+++ b/bazel/third_party/softfloat/BUILD.bazel
--- a/bazel/third_party/softfloat/softfloat.BUILD
+++ b/bazel/third_party/softfloat/softfloat.BUILD
@ -0,0 +1,363 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "make")
+
+# This build file is derived from the makefiles in `build/` in the `softfloat`
+# repo at https://github.com/ucb-bar/berkeley-softfloat-3.
+#
+# The following link, which is referenced in `README.md` in the `softfloat`
+# repo, was useful in deriving this build file:
+#   http://www.jhauser.us/arithmetic/SoftFloat-3/doc/SoftFloat-source.html
+
+cc_library(
+    name = "softfloat_linux_x86_64",
+    srcs = [
+        # See `OBJS_PRIMITIVES` in `build/Linux-x86_64-GCC/Makefile` in the
+        # `softfloat` repo.
+        "source/s_eq128.c",
+        "source/s_le128.c",
+        "source/s_lt128.c",
+        "source/s_shortShiftLeft128.c",
+        "source/s_shortShiftRight128.c",
+        "source/s_shortShiftRightJam64.c",
+        "source/s_shortShiftRightJam64Extra.c",
+        "source/s_shortShiftRightJam128.c",
+        "source/s_shortShiftRightJam128Extra.c",
+        "source/s_shiftRightJam32.c",
+        "source/s_shiftRightJam64.c",
+        "source/s_shiftRightJam64Extra.c",
+        "source/s_shiftRightJam128.c",
+        "source/s_shiftRightJam128Extra.c",
+        "source/s_shiftRightJam256M.c",
+        "source/s_countLeadingZeros8.c",
+        "source/s_countLeadingZeros16.c",
+        "source/s_countLeadingZeros32.c",
+        "source/s_countLeadingZeros64.c",
+        "source/s_add128.c",
+        "source/s_add256M.c",
+        "source/s_sub128.c",
+        "source/s_sub256M.c",
+        "source/s_mul64ByShifted32To128.c",
+        "source/s_mul64To128.c",
+        "source/s_mul128By32.c",
+        "source/s_mul128To256M.c",
+        "source/s_approxRecip_1Ks.c",
+        "source/s_approxRecip32_1.c",
+        "source/s_approxRecipSqrt_1Ks.c",
+        "source/s_approxRecipSqrt32_1.c",
+        # See `OBJS_SPECIALIZE` in `build/Linux-x86_64-GCC/Makefile` in the
+        # `softfloat` repo.
+        "source/8086-SSE/softfloat_raiseFlags.c",
+        "source/8086-SSE/s_f16UIToCommonNaN.c",
+        "source/8086-SSE/s_commonNaNToF16UI.c",
+        "source/8086-SSE/s_propagateNaNF16UI.c",
+        "source/8086-SSE/s_f32UIToCommonNaN.c",
+        "source/8086-SSE/s_commonNaNToF32UI.c",
+        "source/8086-SSE/s_propagateNaNF32UI.c",
+        "source/8086-SSE/s_f64UIToCommonNaN.c",
+        "source/8086-SSE/s_commonNaNToF64UI.c",
+        "source/8086-SSE/s_propagateNaNF64UI.c",
+        "source/8086-SSE/extF80M_isSignalingNaN.c",
+        "source/8086-SSE/s_extF80UIToCommonNaN.c",
+        "source/8086-SSE/s_commonNaNToExtF80UI.c",
+        "source/8086-SSE/s_propagateNaNExtF80UI.c",
+        "source/8086-SSE/f128M_isSignalingNaN.c",
+        "source/8086-SSE/s_f128UIToCommonNaN.c",
+        "source/8086-SSE/s_commonNaNToF128UI.c",
+        "source/8086-SSE/s_propagateNaNF128UI.c",
+        # See `OBJS_OTHERS` in `build/Linux-x86_64-GCC/Makefile` in the
+        # `softfloat` repo.
+        "source/s_roundToUI32.c",
+        "source/s_roundToUI64.c",
+        "source/s_roundToI32.c",
+        "source/s_roundToI64.c",
+        "source/s_normSubnormalF16Sig.c",
+        "source/s_roundPackToF16.c",
+        "source/s_normRoundPackToF16.c",
+        "source/s_addMagsF16.c",
+        "source/s_subMagsF16.c",
+        "source/s_mulAddF16.c",
+        "source/s_normSubnormalF32Sig.c",
+        "source/s_roundPackToF32.c",
+        "source/s_normRoundPackToF32.c",
+        "source/s_addMagsF32.c",
+        "source/s_subMagsF32.c",
+        "source/s_mulAddF32.c",
+        "source/s_normSubnormalF64Sig.c",
+        "source/s_roundPackToF64.c",
+        "source/s_normRoundPackToF64.c",
+        "source/s_addMagsF64.c",
+        "source/s_subMagsF64.c",
+        "source/s_mulAddF64.c",
+        "source/s_normSubnormalExtF80Sig.c",
+        "source/s_roundPackToExtF80.c",
+        "source/s_normRoundPackToExtF80.c",
+        "source/s_addMagsExtF80.c",
+        "source/s_subMagsExtF80.c",
+        "source/s_normSubnormalF128Sig.c",
+        "source/s_roundPackToF128.c",
+        "source/s_normRoundPackToF128.c",
+        "source/s_addMagsF128.c",
+        "source/s_subMagsF128.c",
+        "source/s_mulAddF128.c",
+        "source/softfloat_state.c",
+        "source/ui32_to_f16.c",
+        "source/ui32_to_f32.c",
+        "source/ui32_to_f64.c",
+        "source/ui32_to_extF80.c",
+        "source/ui32_to_extF80M.c",
+        "source/ui32_to_f128.c",
+        "source/ui32_to_f128M.c",
+        "source/ui64_to_f16.c",
+        "source/ui64_to_f32.c",
+        "source/ui64_to_f64.c",
+        "source/ui64_to_extF80.c",
+        "source/ui64_to_extF80M.c",
+        "source/ui64_to_f128.c",
+        "source/ui64_to_f128M.c",
+        "source/i32_to_f16.c",
+        "source/i32_to_f32.c",
+        "source/i32_to_f64.c",
+        "source/i32_to_extF80.c",
+        "source/i32_to_extF80M.c",
+        "source/i32_to_f128.c",
+        "source/i32_to_f128M.c",
+        "source/i64_to_f16.c",
+        "source/i64_to_f32.c",
+        "source/i64_to_f64.c",
+        "source/i64_to_extF80.c",
+        "source/i64_to_extF80M.c",
+        "source/i64_to_f128.c",
+        "source/i64_to_f128M.c",
+        "source/f16_to_ui32.c",
+        "source/f16_to_ui64.c",
+        "source/f16_to_i32.c",
+        "source/f16_to_i64.c",
+        "source/f16_to_ui32_r_minMag.c",
+        "source/f16_to_ui64_r_minMag.c",
+        "source/f16_to_i32_r_minMag.c",
+        "source/f16_to_i64_r_minMag.c",
+        "source/f16_to_f32.c",
+        "source/f16_to_f64.c",
+        "source/f16_to_extF80.c",
+        "source/f16_to_extF80M.c",
+        "source/f16_to_f128.c",
+        "source/f16_to_f128M.c",
+        "source/f16_roundToInt.c",
+        "source/f16_add.c",
+        "source/f16_sub.c",
+        "source/f16_mul.c",
+        "source/f16_mulAdd.c",
+        "source/f16_div.c",
+        "source/f16_rem.c",
+        "source/f16_sqrt.c",
+        "source/f16_eq.c",
+        "source/f16_le.c",
+        "source/f16_lt.c",
+        "source/f16_eq_signaling.c",
+        "source/f16_le_quiet.c",
+        "source/f16_lt_quiet.c",
+        "source/f16_isSignalingNaN.c",
+        "source/f32_to_ui32.c",
+        "source/f32_to_ui64.c",
+        "source/f32_to_i32.c",
+        "source/f32_to_i64.c",
+        "source/f32_to_ui32_r_minMag.c",
+        "source/f32_to_ui64_r_minMag.c",
+        "source/f32_to_i32_r_minMag.c",
+        "source/f32_to_i64_r_minMag.c",
+        "source/f32_to_f16.c",
+        "source/f32_to_f64.c",
+        "source/f32_to_extF80.c",
+        "source/f32_to_extF80M.c",
+        "source/f32_to_f128.c",
+        "source/f32_to_f128M.c",
+        "source/f32_roundToInt.c",
+        "source/f32_add.c",
+        "source/f32_sub.c",
+        "source/f32_mul.c",
+        "source/f32_mulAdd.c",
+        "source/f32_div.c",
+        "source/f32_rem.c",
+        "source/f32_sqrt.c",
+        "source/f32_eq.c",
+        "source/f32_le.c",
+        "source/f32_lt.c",
+        "source/f32_eq_signaling.c",
+        "source/f32_le_quiet.c",
+        "source/f32_lt_quiet.c",
+        "source/f32_isSignalingNaN.c",
+        "source/f64_to_ui32.c",
+        "source/f64_to_ui64.c",
+        "source/f64_to_i32.c",
+        "source/f64_to_i64.c",
+        "source/f64_to_ui32_r_minMag.c",
+        "source/f64_to_ui64_r_minMag.c",
+        "source/f64_to_i32_r_minMag.c",
+        "source/f64_to_i64_r_minMag.c",
+        "source/f64_to_f16.c",
+        "source/f64_to_f32.c",
+        "source/f64_to_extF80.c",
+        "source/f64_to_extF80M.c",
+        "source/f64_to_f128.c",
+        "source/f64_to_f128M.c",
+        "source/f64_roundToInt.c",
+        "source/f64_add.c",
+        "source/f64_sub.c",
+        "source/f64_mul.c",
+        "source/f64_mulAdd.c",
+        "source/f64_div.c",
+        "source/f64_rem.c",
+        "source/f64_sqrt.c",
+        "source/f64_eq.c",
+        "source/f64_le.c",
+        "source/f64_lt.c",
+        "source/f64_eq_signaling.c",
+        "source/f64_le_quiet.c",
+        "source/f64_lt_quiet.c",
+        "source/f64_isSignalingNaN.c",
+        "source/extF80_to_ui32.c",
+        "source/extF80_to_ui64.c",
+        "source/extF80_to_i32.c",
+        "source/extF80_to_i64.c",
+        "source/extF80_to_ui32_r_minMag.c",
+        "source/extF80_to_ui64_r_minMag.c",
+        "source/extF80_to_i32_r_minMag.c",
+        "source/extF80_to_i64_r_minMag.c",
+        "source/extF80_to_f16.c",
+        "source/extF80_to_f32.c",
+        "source/extF80_to_f64.c",
+        "source/extF80_to_f128.c",
+        "source/extF80_roundToInt.c",
+        "source/extF80_add.c",
+        "source/extF80_sub.c",
+        "source/extF80_mul.c",
+        "source/extF80_div.c",
+        "source/extF80_rem.c",
+        "source/extF80_sqrt.c",
+        "source/extF80_eq.c",
+        "source/extF80_le.c",
+        "source/extF80_lt.c",
+        "source/extF80_eq_signaling.c",
+        "source/extF80_le_quiet.c",
+        "source/extF80_lt_quiet.c",
+        "source/extF80_isSignalingNaN.c",
+        "source/extF80M_to_ui32.c",
+        "source/extF80M_to_ui64.c",
+        "source/extF80M_to_i32.c",
+        "source/extF80M_to_i64.c",
+        "source/extF80M_to_ui32_r_minMag.c",
+        "source/extF80M_to_ui64_r_minMag.c",
+        "source/extF80M_to_i32_r_minMag.c",
+        "source/extF80M_to_i64_r_minMag.c",
+        "source/extF80M_to_f16.c",
+        "source/extF80M_to_f32.c",
+        "source/extF80M_to_f64.c",
+        "source/extF80M_to_f128M.c",
+        "source/extF80M_roundToInt.c",
+        "source/extF80M_add.c",
+        "source/extF80M_sub.c",
+        "source/extF80M_mul.c",
+        "source/extF80M_div.c",
+        "source/extF80M_rem.c",
+        "source/extF80M_sqrt.c",
+        "source/extF80M_eq.c",
+        "source/extF80M_le.c",
+        "source/extF80M_lt.c",
+        "source/extF80M_eq_signaling.c",
+        "source/extF80M_le_quiet.c",
+        "source/extF80M_lt_quiet.c",
+        "source/f128_to_ui32.c",
+        "source/f128_to_ui64.c",
+        "source/f128_to_i32.c",
+        "source/f128_to_i64.c",
+        "source/f128_to_ui32_r_minMag.c",
+        "source/f128_to_ui64_r_minMag.c",
+        "source/f128_to_i32_r_minMag.c",
+        "source/f128_to_i64_r_minMag.c",
+        "source/f128_to_f16.c",
+        "source/f128_to_f32.c",
+        "source/f128_to_extF80.c",
+        "source/f128_to_f64.c",
+        "source/f128_roundToInt.c",
+        "source/f128_add.c",
+        "source/f128_sub.c",
+        "source/f128_mul.c",
+        "source/f128_mulAdd.c",
+        "source/f128_div.c",
+        "source/f128_rem.c",
+        "source/f128_sqrt.c",
+        "source/f128_eq.c",
+        "source/f128_le.c",
+        "source/f128_lt.c",
+        "source/f128_eq_signaling.c",
+        "source/f128_le_quiet.c",
+        "source/f128_lt_quiet.c",
+        "source/f128_isSignalingNaN.c",
+        "source/f128M_to_ui32.c",
+        "source/f128M_to_ui64.c",
+        "source/f128M_to_i32.c",
+        "source/f128M_to_i64.c",
+        "source/f128M_to_ui32_r_minMag.c",
+        "source/f128M_to_ui64_r_minMag.c",
+        "source/f128M_to_i32_r_minMag.c",
+        "source/f128M_to_i64_r_minMag.c",
+        "source/f128M_to_f16.c",
+        "source/f128M_to_f32.c",
+        "source/f128M_to_extF80M.c",
+        "source/f128M_to_f64.c",
+        "source/f128M_roundToInt.c",
+        "source/f128M_add.c",
+        "source/f128M_sub.c",
+        "source/f128M_mul.c",
+        "source/f128M_mulAdd.c",
+        "source/f128M_div.c",
+        "source/f128M_rem.c",
+        "source/f128M_sqrt.c",
+        "source/f128M_eq.c",
+        "source/f128M_le.c",
+        "source/f128M_lt.c",
+        "source/f128M_eq_signaling.c",
+        "source/f128M_le_quiet.c",
+        "source/f128M_lt_quiet.c",
+        # See `$(OTHER_HEADERS)` in `build/Linux-x86_64-GCC/Makefile` in the
+        # `softfloat` repo.
+        "source/include/opts-GCC.h",
+        # See `$(OBJS_ALL)` target in `build/Linux-x86_64-GCC/Makefile` in the
+        # `softfloat` repo.
+        "build/Linux-x86_64-GCC/platform.h",
+        "source/include/primitiveTypes.h",
+        "source/include/primitives.h",
+        # See `$(OBJS_SPECIALIZE) $(OBJS_OTHERS)` target in
+        # `build/Linux-x86_64-GCC/Makefile` in the `softfloat` repo.
+        "source/include/softfloat_types.h",
+        "source/include/internals.h",
+        "source/8086-SSE/specialize.h",
+    ],
+    hdrs = [
+        "source/include/softfloat.h",
+    ],
+    copts = [
+        "-Iexternal/softfloat/build/Linux-x86_64-GCC",
+        "-Iexternal/softfloat/source/8086-SSE",
+        "-Werror-implicit-function-declaration",
+        "-O2",
+    ],
+    # `SOFTFLOAT_FAST_INT64` is used in `softfloat.h` and therefore needs to be
+    # passed to dependencies.
+    defines = ["SOFTFLOAT_FAST_INT64"],
+    includes = ["source/include"],
+    local_defines = [
+        "SOFTFLOAT_ROUND_ODD",
+        "INLINE_LEVEL=5",
+        "SOFTFLOAT_FAST_DIV32TO16",
+        "SOFTFLOAT_FAST_DIV64TO32",
+    ],
+    visibility = ["//visibility:private"],
+)
+
+cc_library(
+    name = "softfloat",
+    visibility = ["//visibility:public"],
+    deps = select({
+        "@//:linux-x86_64": [":softfloat_linux_x86_64"],
+    }),
+)
--- a/bazel/third_party/uv/BUILD.bazel
+++ b/bazel/third_party/uv/BUILD.bazel
--- a/bazel/third_party/uv/uv.BUILD
+++ b/bazel/third_party/uv/uv.BUILD
@ -0,0 +1,21 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+# TODO: check windows build.
+configure_make(
+    name = "uv",
+    args = ["--jobs=`nproc`"],
+    autogen = True,
+    configure_in_place = True,
+    configure_options = [
+        "--disable-shared",
+    ],
+    lib_source = ":all",
+    out_static_libs = ["libuv.a"],
+    targets = ["install"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/whereami/BUILD.bazel
+++ b/bazel/third_party/whereami/BUILD.bazel
--- a/bazel/third_party/whereami/whereami.BUILD
+++ b/bazel/third_party/whereami/whereami.BUILD
@ -0,0 +1,7 @@
+cc_library(
+    name = "whereami",
+    srcs = ["src/whereami.c"],
+    hdrs = ["src/whereami.h"],
+    includes = ["src"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/third_party/zlib/BUILD.bazel
+++ b/bazel/third_party/zlib/BUILD.bazel
--- a/bazel/third_party/zlib/zlib.BUILD
+++ b/bazel/third_party/zlib/zlib.BUILD
@ -0,0 +1,15 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "zlib",
+    args = ["--jobs=`nproc`"],
+    configure_options = ["--static"],
+    lib_source = ":all",
+    out_static_libs = ["libz.a"],
+    visibility = ["//visibility:public"],
+)
--- a/bazel/toolchain/BUILD.bazel
+++ b/bazel/toolchain/BUILD.bazel
@ -0,0 +1,111 @@
+# For more information on configuring toolchains, see
+# https://bazel.build/tutorials/ccp-toolchain-config
+# and https://bazel.build/extending/toolchains.
+
+load(":cfg.bzl", "cc_toolchain_config")
+
+filegroup(name = "empty")
+
+alias(
+    name = "toolchain_type",
+    actual = "@bazel_tools//tools/cpp:toolchain_type",
+)
+
+#
+# clang-linux-x86_64
+#
+
+# Toolchain identifier.
+_x86_64_clang = "toolchain-clang-linux-x86_64"
+
+cc_toolchain_config(
+    name = "clang-linux-x86_64-config",
+    ar = "/usr/bin/ar",
+    cc = "/usr/bin/clang",
+    compiler = "clang",
+    ld = "/usr/bin/ld",
+    sys_includes = [
+        "/usr/lib/clang/14.0.6",
+        "/usr/include",
+    ],
+    target_cpu = "x86_64",
+    toolchain_identifier = _x86_64_clang,
+)
+
+cc_toolchain(
+    name = "clang-linux-x86_64",
+    all_files = ":empty",
+    compiler_files = ":empty",
+    dwp_files = ":empty",
+    linker_files = ":empty",
+    objcopy_files = ":empty",
+    strip_files = ":empty",
+    supports_param_files = 0,
+    toolchain_config = ":clang-linux-x86_64-config",
+    toolchain_identifier = _x86_64_clang,
+)
+
+toolchain(
+    name = "clang-linux-x86_64-toolchain",
+    exec_compatible_with = [
+        "//:clang",
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    toolchain = ":clang-linux-x86_64",
+    toolchain_type = ":toolchain_type",
+)
+
+#
+# gcc-linux-x86_64
+#
+
+# Toolchain identifier.
+_x86_64_gcc = "toolchain-gcc-linux-x86_64"
+
+cc_toolchain_config(
+    name = "gcc-linux-x86_64-config",
+    ar = "/usr/bin/ar",
+    cc = "/usr/bin/gcc",
+    compiler = "gcc",
+    ld = "/usr/bin/ld",
+    sys_includes = [
+        # TODO: remove hard-coded version number.
+        "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include",
+        "/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.0/include-fixed",
+        "/usr/include",
+    ],
+    target_cpu = "x86_64",
+    toolchain_identifier = _x86_64_gcc,
+)
+
+cc_toolchain(
+    name = "gcc-linux-x86_64",
+    all_files = ":empty",
+    compiler_files = ":empty",
+    dwp_files = ":empty",
+    linker_files = ":empty",
+    objcopy_files = ":empty",
+    strip_files = ":empty",
+    supports_param_files = 0,
+    toolchain_config = ":gcc-linux-x86_64-config",
+    toolchain_identifier = _x86_64_gcc,
+)
+
+toolchain(
+    name = "gcc-linux-x86_64-toolchain",
+    exec_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    toolchain = ":gcc-linux-x86_64",
+    toolchain_type = ":toolchain_type",
+)
--- a/bazel/toolchain/cfg.bzl
+++ b/bazel/toolchain/cfg.bzl
@ -0,0 +1,77 @@
+load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "tool_path")
+
+def _cc_toolchain_config_impl(ctx):
+    # See
+    # https://bazel.build/rules/lib/cc_common#create_cc_toolchain_config_info.
+    return cc_common.create_cc_toolchain_config_info(
+        ctx = ctx,
+        # See https://bazel.build/docs/cc-toolchain-config-reference#features.
+        features = [],
+        cxx_builtin_include_directories = ctx.attr.sys_includes,
+        toolchain_identifier = ctx.attr.toolchain_identifier,
+        target_system_name = ctx.attr.target_system_name,
+        target_cpu = ctx.attr.target_cpu,
+        target_libc = ctx.attr.target_libc,
+        compiler = ctx.attr.compiler,
+        abi_version = ctx.attr.abi_version,
+        abi_libc_version = ctx.attr.abi_libc_version,
+        tool_paths = [
+            tool_path(
+                name = "gcc",
+                path = ctx.attr.cc,
+            ),
+            tool_path(
+                name = "ld",
+                path = ctx.attr.ld,
+            ),
+            tool_path(
+                name = "ar",
+                path = ctx.attr.ar,
+            ),
+            tool_path(
+                name = "cpp",
+                path = ctx.attr.cpp,
+            ),
+            tool_path(
+                name = "gcov",
+                path = ctx.attr.gcov,
+            ),
+            tool_path(
+                name = "nm",
+                path = ctx.attr.nm,
+            ),
+            tool_path(
+                name = "objdump",
+                path = ctx.attr.objdump,
+            ),
+            tool_path(
+                name = "strip",
+                path = ctx.attr.strip,
+            ),
+        ],
+    )
+
+cc_toolchain_config = rule(
+    implementation = _cc_toolchain_config_impl,
+    attrs = {
+        # Required.
+        "ar": attr.string(mandatory = True),
+        "cc": attr.string(mandatory = True),
+        "compiler": attr.string(mandatory = True),
+        "ld": attr.string(mandatory = True),
+        "target_cpu": attr.string(mandatory = True),
+        "toolchain_identifier": attr.string(mandatory = True),
+        # Optional.
+        "abi_libc_version": attr.string(default = "unknown"),
+        "abi_version": attr.string(default = "unknown"),
+        "cpp": attr.string(default = "/bin/false"),
+        "gcov": attr.string(default = "/bin/false"),
+        "nm": attr.string(default = "/bin/false"),
+        "objdump": attr.string(default = "/bin/false"),
+        "strip": attr.string(default = "/bin/false"),
+        "sys_includes": attr.string_list(default = []),
+        "target_libc": attr.string(default = "unknown"),
+        "target_system_name": attr.string(default = "unknown"),
+    },
+    provides = [CcToolchainConfigInfo],
+)
--- a/default.nix
+++ b/default.nix
@ -1,168 +0,0 @@
-
-/* Examples
-
-   Shared urbit and urbit-worker binaries:
-
-     $ nix-build -A urbit
-
-   Static urbit and urbit-worker binaries:
-
-     $ nix-build -A urbit --arg enableStatic true
-
-   Note that on linux the previous command is equivalent to:
-
-     $ nix-build -A urbit --argstr crossSystem x86_64-unknown-linux-musl \
-                          --arg enableStatic true
-
-   Static release tarball:
-
-     $ nix-build -A tarball --arg enableStatic true
-
-   Build a pill:
-
-     $ nix-build -A ivory.build
-     $ nix-build -A brass.build
-     $ nix-build -A solid.build
-
-*/
-
-# The build system where packages will be _built_.
-{ system ? builtins.currentSystem
-  # The host system where packages will _run_.
-, crossSystem ? null
-  # Additional sources.json overrides.
-, sources ? { }
-  # Additional nixpkgs.config overrides.
-, config ? { }
-  # Additional nixpkgs.overlays.
-, overlays ? [ ]
-  # Overlays to apply to the last package set in cross compilation.
-, crossOverlays ? [ ]
-  # Whether to use pkgs.pkgsStatic.* to obtain statically linked package
-  # dependencies - ie. when building fully-static libraries or executables.
-, enableStatic ? false
-  # release channel (when static)
-, verePace ? "" }:
-
-let
-
-  pkgsNative = import ./nix/default.nix { inherit system; };
-
-  pkgsCross = import ./nix/default.nix {
-    inherit system sources config overlays crossOverlays;
-
-    # If we're running on linux and crossSystem is unspecified but
-    # enableStatic = true - set the crossSystem to musl64.
-    crossSystem =
-      if system == "x86_64-linux" && crossSystem == null && enableStatic then
-        "x86_64-unknown-linux-musl"
-      else
-        if system == "aarch64-linux" && crossSystem == null && enableStatic then
-          "aarch64-unknown-linux-musl"
-        else
-          crossSystem;
-  };
-
-  # Use nixpkgs' top-level/static overlay if enableStatic = true.
-  pkgsStatic = if enableStatic then pkgsCross.pkgsStatic else pkgsCross;
-
-  # Enrich the global package set with our local functions and packages.
-  # Cross vs static build dependencies can be selectively overridden for
-  # inputs like python etc.
-  callPackage =
-    pkgsNative.lib.callPackageWith (pkgsStatic // libLocal // pkgsLocal);
-
-  # Local library import-from-derivation functions such as fetchGitHubLFS, etc.
-  libLocal = pkgsNative.callPackage ./nix/lib { };
-
-  # Local vendored packages defined in ./pkg.
-  # For non-vendored nixpkgs specific package overrides, see ./nix/overlays.
-  pkgsLocal = {
-    ca-bundle = callPackage ./nix/pkgs/ca-bundle { };
-
-    ent = callPackage ./nix/pkgs/ent { };
-
-    libaes_siv = callPackage ./nix/pkgs/libaes_siv { inherit (pkgsNative) cmake; };
-
-    murmur3 = callPackage ./nix/pkgs/murmur3 { };
-
-    softfloat3 = callPackage ./nix/pkgs/softfloat3 { };
-
-    herb = callPackage ./nix/pkgs/herb { inherit (pkgsCross) python; };
-
-    arvo = callPackage ./nix/pkgs/arvo { };
-
-    ivory = callPackage ./nix/pkgs/pill/ivory.nix { };
-
-    brass = callPackage ./nix/pkgs/pill/brass.nix { };
-
-    solid = callPackage ./nix/pkgs/pill/solid.nix { };
-
-    marsSources = callPackage ./nix/pkgs/marsSources { };
-
-    urbit = callPackage ./nix/pkgs/urbit { inherit enableStatic verePace; };
-
-    urcrypt = callPackage ./nix/pkgs/urcrypt { inherit enableStatic; };
-
-    docker-image = callPackage ./nix/pkgs/docker-image { };
-  };
-
-  # Additional top-level packages and attributes exposed for convenience.
-  pkgsExtra = with pkgsLocal; rec {
-    # Expose packages with local customisations (like patches) for dev access.
-    inherit (pkgsStatic) libsigsegv lmdb;
-
-    urbit-debug = urbit.override { enableDebug = true; };
-    urbit-tests = libLocal.testFakeShip {
-      inherit arvo;
-
-      urbit = urbit-debug;
-      pill = solid.lfs;
-    };
-
-    ivory-ropsten = ivory.override { arvo = arvo.ropsten; };
-    brass-ropsten = brass.override { arvo = arvo.ropsten; };
-
-    # Create a .tgz of the primary binaries.
-    tarball = let
-      name = "urbit-v${urbit.version}-${urbit.system}";
-    in libLocal.makeReleaseTarball {
-      inherit name;
-
-      contents = {
-        "${name}/urbit" = "${urbit}/bin/urbit";
-      };
-    };
-
-    inherit (pkgsNative) skopeo;
-
-    # A convenience function for constructing a shell.nix for any of the
-    # pkgsLocal derivations by automatically propagating any dependencies 
-    # to the nix-shell.
-    #
-    # Example:
-    #
-    #  let
-    #    pkgs = import ./default.nix { };
-    #  in pkgs.shellFor {
-    #    packages = ps: [
-    #      ps.urbit
-    #      ps.herb
-    #    ];
-    #  }
-    #
-    shellFor = { name, packages, ... }@attrs:
-      pkgsNative.mkShell ({
-        inputsFrom = packages pkgsLocal;
-      } // builtins.removeAttrs attrs [ "packages" ]);
-  };
-
-  # Ensure that in the case of cross-compilation we're not statically linking
-  # against glibc. This is typically a sign that crossSystem is misconfigured.
-  checkPlatform =
-    if enableStatic && pkgsCross.stdenv.hostPlatform.libc == "glibc" then
-      builtins.trace "warning: statically linking against glibc."
-    else
-      pkgsNative.lib.id;
-
-in checkPlatform (pkgsLocal // pkgsExtra)
--- a/nix/default.nix
+++ b/nix/default.nix
@ -1,34 +0,0 @@
-# The build system where packages will be _built_.
-{ system ? builtins.currentSystem
-  # The host system where packages will _run_.
-, crossSystem ? null
-  # Additional sources.json overrides.
-, sources ? { }
-  # Additional nixpkgs.config overrides.
-, config ? { }
-  # Additional nixpkgs.overlays.
-, overlays ? [ ]
-  # Overlays to apply to the last package set in cross compilation.
-, crossOverlays ? [ ] }:
-
-let
-
-  finalSources = import ./sources.nix { } // sources;
-
-  pkgs = import finalSources.nixpkgs {
-    inherit system config crossSystem crossOverlays;
-
-    overlays = [
-      # Make prev.sources available to subsequent overlays.
-      (_final: _prev: { sources = finalSources; })
-      # General unguarded (native) overrides for nixpkgs.
-      (import ./overlays/native.nix)
-      # Specific overrides guarded by the host platform.
-      (import ./overlays/musl.nix)
-      (import ./overlays/arm.nix)
-    ];
-  };
-
-in pkgs // {
-  pkgsStatic = pkgs.pkgsStatic.extend (import ./overlays/static.nix);
-}
--- a/nix/lib/boot-fake-ship.nix
+++ b/nix/lib/boot-fake-ship.nix
@ -1,72 +0,0 @@
-{ lib, stdenvNoCC, curl }:
-
-{ urbit, arvo ? null, pill, ship, arguments ? [ "-l" ] }:
-
-let
-
-  args = arguments ++ [ "-d" "-F" "${ship}" "-B" "${pill}" ]
-    ++ lib.optionals (arvo != null) [ "-A" "${arvo}" ];
-
-in stdenvNoCC.mkDerivation {
-  name = "fake-${ship}";
-
-  buildInputs = [ curl urbit ];
-
-  phases = [ "buildPhase" "installPhase " ];
-
-  buildPhase = ''
-    set -xeuo pipefail
-
-    urbit ${lib.concatStringsSep " " args} ./pier
-
-    cleanup () {
-      if [ -f ./pier/.vere.lock ]; then
-        kill $(< ./pier/.vere.lock) || true
-      fi
-
-      set +x
-    }
-
-    trap cleanup EXIT
-
-    port=$(cat ./pier/.http.ports | grep loopback | tr -s ' ' '\n' | head -n 1)
-
-    lensd() {
-      curl -f -s                                                           \
-        --data "{\"source\":{\"dojo\":\"$1\"},\"sink\":{\"stdout\":null}}" \
-        "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-    }
-
-    lensa() {
-      curl -f -s                                                           \
-        --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"app\":\"$1\"}}"  \
-        "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-    }
-
-    check () {
-      [ 3 -eq "$(lensd 3)" ]
-    }
-
-    if check && sleep 10 && check; then
-      header "boot success"
-      lensa hood '+hood/exit'
-      while [ -f ./pier/.vere.lock ]; do
-        echo "waiting for pier to shut down"
-        sleep 5
-      done
-    else
-      header "boot failure"
-      kill $(< ./pier/.vere.lock) || true
-      set +x
-      exit 1
-    fi
-
-    set +x
-  '';
-
-  installPhase = ''
-    ls
-    ls -a ./pier
-    mv ./pier $out
-  '';
-}
--- a/nix/lib/default.nix
+++ b/nix/lib/default.nix
@ -1,13 +0,0 @@
-# Functions that are expected run on the native (non-cross) system.
-
-{ callPackage }:
-
-rec {
-  bootFakeShip = callPackage ./boot-fake-ship.nix { };
-
-  testFakeShip = callPackage ./test-fake-ship.nix { inherit bootFakeShip; };
-
-  fetchGitHubLFS = callPackage ./fetch-github-lfs.nix { };
-
-  makeReleaseTarball = callPackage ./make-release-tarball.nix { };
-}
--- a/nix/lib/fetch-github-lfs.nix
+++ b/nix/lib/fetch-github-lfs.nix
@ -1,107 +0,0 @@
-{ lib, stdenvNoCC, runCommandLocal, cacert, curl, jq }:
-
-{ src
-# `name` shouldn't use `baseNameOf` otherwise we'll
-# get `is not allowed to refer to a store path` errors.
-, name ? baseNameOf src, owner ? "urbit", repo ? "urbit"
-, preferLocalBuild ? true }:
-
-assert builtins.isPath src;
-
-let
-
-  # Parse the first 7 characters of the supplied `src` path for the required
-  # `version` key as defined by the lfs specification:
-  # https://github.com/git-lfs/git-lfs/blob/master/docs/spec.md
-  #
-  # If `version` exists we assume we're dealing with a lfs pointer and parse
-  # the `oid` and `size` from the pointer and write these into a JSON object.
-  #
-  # If the first 7 characters are unrecognised we assume the path is a binary
-  # file and set both `oid` and `size` to `null`.
-  #
-  # The `oid` and `size` are then JSON decoded into an expression to use
-  # as the fixed-output derivation's `sha256 = oid`, and to form a download
-  # operation payload to request the actual lfs blob's real url.
-  pointer = builtins.fromJSON (builtins.readFile
-    (runCommandLocal "lfs-pointer-${name}" { } ''
-      oid="null"
-      size="null"
-
-      if [[ "$(head -c 7 "${src}")" != "version" ]]; then
-        header "lfs ${src} is a binary blob, skipping"
-      else
-        header "reading lfs pointer from ${src}"
-
-        contents=($(awk '{print $2}' "${src}"))
-        oid="''${contents[1]#sha256:}"
-        size="''${contents[2]}"
-      fi
-
-      cat <<EOF > "$out"
-      {"oid": "$oid", "size": $size}
-      EOF
-    ''));
-
-  downloadUrl =
-    "https://github.com/${owner}/${repo}.git/info/lfs/objects/batch";
-
-  # Encode `oid` and `size` into a download operation per:
-  # https://github.com/git-lfs/git-lfs/blob/master/docs/api/batch.md
-  #
-  # This is done using toJSON to avoid bash quotation issues.
-  downloadPayload = builtins.toJSON {
-    operation = "download";
-    objects = [ pointer ];
-  };
-
-  # Define a fixed-output derivation using the lfs pointer's `oid` as the
-  # expected sha256 output hash, if `oid` is not null.
-  #
-
-  # 1. Request the actual url of the binary file from the lfs batch api.
-  # 2. Download the binary file contents to `$out`.
-  download = stdenvNoCC.mkDerivation {
-    name = "lfs-blob-${name}";
-    nativeBuildInputs = [ curl jq ];
-    phases = [ "installPhase" ];
-    installPhase = ''
-      curl=(
-          curl
-          --location
-          --max-redirs 20
-          --retry 3
-          --disable-epsv
-          --cookie-jar cookies
-          $NIX_CURL_FLAGS
-        )
-
-      header "reading lfs metadata from ${downloadUrl}"
-
-      href=$("''${curl[@]}" \
-        -d '${downloadPayload}' \
-        -H 'Accept: application/vnd.git-lfs+json' \
-        '${downloadUrl}' \
-          | jq -r '.objects[0].actions.download.href')
-
-      header "download lfs data from remote"
-
-      # Pozor/Achtung: the href contains credential and signature information, 
-      # so we avoid echoing it to stdout/err.
-      "''${curl[@]}" -s --output "$out" "$href"
-    '';
-
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars;
-
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
-    outputHashAlgo = "sha256";
-    outputHashMode = "flat";
-    outputHash = pointer.oid;
-
-    inherit preferLocalBuild;
-  };
-
-  # If `pointer.oid` is null then supplied the `src` must be a binary
-  # blob and can be returned directly.
-in if pointer.oid == null || pointer.size == null then src else download
--- a/nix/lib/make-release-tarball.nix
+++ b/nix/lib/make-release-tarball.nix
@ -1,30 +0,0 @@
-{ lib, stdenvNoCC, coreutils }:
-
-{ name, extension ? "tgz", contents # { target = source, ... }
-}:
-
-let
-
-  transforms = builtins.concatStringsSep " " (lib.mapAttrsToList
-    (target: source: ''--transform "s,${source},${target},"'') contents);
-
-  sources = builtins.concatStringsSep " "
-    (lib.mapAttrsToList (_target: source: "${source}") contents);
-
-in stdenvNoCC.mkDerivation {
-  name = "${name}.${extension}";
-  phases = [ "buildPhase" ];
-
-  nativeBuildInputs = [ coreutils ];
-
-  buildPhase = ''
-    tar -vczf $out \
-      --owner=0 --group=0 --mode=u+rw,uga+r \
-      --absolute-names \
-      --hard-dereference \
-      ${transforms} \
-      ${sources}
-  '';
-
-  preferLocalBuild = true;
-}
--- a/nix/lib/test-fake-ship.nix
+++ b/nix/lib/test-fake-ship.nix
@ -1,189 +0,0 @@
-{ lib, stdenvNoCC, curl, python3, bootFakeShip }:
-
-{ urbit, arvo ? null, pill, ship ? "bus", arguments ? urbit.meta.arguments
-, doCheck ? true }:
-
-stdenvNoCC.mkDerivation {
-  name = "test-${ship}";
-
-  src = bootFakeShip { inherit urbit arvo pill ship; };
-
-  phases = [ "unpackPhase" "buildPhase" "checkPhase" ];
-
-  buildInputs = [ curl python3 urbit ];
-
-  unpackPhase = ''
-    cp -R $src ./pier
-    chmod -R u+rw ./pier
-  '';
-
-  buildPhase = ''
-    set -x
-
-    urbit ${lib.concatStringsSep " " arguments} -d ./pier 2> urbit-output
-
-    # Sledge Hammer!
-    # See: https://github.com/travis-ci/travis-ci/issues/4704#issuecomment-348435959
-    python3 -c $'import os\n[os.set_blocking(i, True) for i in range(3)]\n'
-
-    port=$(cat ./pier/.http.ports | grep loopback | tr -s ' ' '\n' | head -n 1)
-
-    lensd() {
-      # -f elided, this can hit server-side timeouts
-      curl -s                                                              \
-        --data "{\"source\":{\"dojo\":\"$1\"},\"sink\":{\"stdout\":null}}" \
-        "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-    }
-
-    lensa() {
-      # -f elided, this can hit server-side timeouts
-      curl -s                                                              \
-        --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"app\":\"$1\"}}"  \
-        "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-    }
-
-    tail -F urbit-output >&2 &
-
-    tailproc=$!
-
-    cleanup () {
-      kill $(cat ./pier/.vere.lock) || true
-      kill "$tailproc" 2>/dev/null || true
-
-      set +x
-    }
-
-    trap cleanup EXIT
-
-    #  measure initial memory usage
-    #
-    lensd '~&  ~  ~&  %init-mass-start  ~'
-    lensa hood '+hood/mass'
-    lensd '~&  ~  ~&  %init-mass-end  ~'
-
-    #  run the unit tests
-    #
-    lensd '~&  ~  ~&  %test-unit-start  ~'
-    lensd '-test %/tests ~'
-    lensd '~&  ~  ~&  %test-unit-end  ~'
-
-    #  use the :test app to build all agents, generators, and marks
-    #
-    lensa hood '+hood/start %test'
-
-    lensd '~&  ~  ~&  %test-agents-start  ~'
-    lensa test '%agents'
-    lensd '~&  ~  ~&  %test-agents-end  ~'
-
-    lensd '~&  ~  ~&  %test-generators-start  ~'
-    lensa test '%generators'
-    lensd '~&  ~  ~&  %test-generators-end  ~'
-
-    lensd '~&  ~  ~&  %test-marks-start  ~'
-    lensa test '%marks'
-    lensd '~&  ~  ~&  %test-marks-end  ~'
-
-    #  measure memory usage post tests
-    #
-    lensd '~&  ~  ~&  %test-mass-start  ~'
-    lensa hood '+hood/mass'
-    lensd '~&  ~  ~&  %test-mass-end  ~'
-
-    #  defragment the loom
-    #
-    lensd '~&  ~  ~&  %pack-start  ~'
-    lensa hood '+hood/pack'
-    lensd '~&  ~  ~&  %pack-end  ~'
-
-    #  reclaim space within arvo
-    #
-    lensd '~&  ~  ~&  %trim-start  ~'
-    lensa hood '+hood/trim'
-    lensd '~&  ~  ~&  %trim-end  ~'
-
-    #  measure memory usage pre |meld
-    #
-    lensd '~&  ~  ~&  %trim-mass-start  ~'
-    lensa hood '+hood/mass'
-    lensd '~&  ~  ~&  %trim-mass-end  ~'
-
-    #  globally deduplicate
-    #
-    lensd '~&  ~  ~&  %meld-start  ~'
-    lensa hood '+hood/meld'
-    lensd '~&  ~  ~&  %meld-end  ~'
-
-    #  measure memory usage post |meld
-    #
-    lensd '~&  ~  ~&  %meld-mass-start  ~'
-    lensa hood '+hood/mass'
-    lensd '~&  ~  ~&  %meld-mass-end  ~'
-
-    lensa hood '+hood/exit'
-
-    cleanup
-
-    # Collect output
-    cp urbit-output test-output-unit
-    cp urbit-output test-output-agents
-    cp urbit-output test-output-generators
-    cp urbit-output test-output-marks
-
-    sed -i '0,/test-unit-start/d'        test-output-unit
-    sed -i '/test-unit-end/,$d'          test-output-unit
-
-    sed -i '0,/test-agents-start/d'      test-output-agents
-    sed -i '/test-agents-end/,$d'        test-output-agents
-
-    sed -i '0,/test-generators-start/d'  test-output-generators
-    sed -i '/test-generators-end/,$d'    test-output-generators
-
-    sed -i '0,/test-marks-start/d'       test-output-marks
-    sed -i '/test-marks-end/,$d'         test-output-marks
-
-    mkdir -p $out
-
-    cp test-output-* $out/
-
-    set +x
-  '';
-
-  checkPhase = ''
-    hdr () {
-      echo =====$(sed 's/./=/g' <<< "$1")=====
-      echo ==== $1 ====
-      echo =====$(sed 's/./=/g' <<< "$1")=====
-    }
-
-    for f in $(find "$out/" -type f); do
-      hdr "$(basename $f)"
-      cat "$f"
-    done
-
-    fail=0
-
-    for f in $(find "$out/" -type f); do
-      if egrep "((FAILED|CRASHED)|warn:) " $f >/dev/null; then
-        if [[ $fail -eq 0 ]]; then
-          hdr "Test Failures"
-        fi
-
-        echo "ERROR Test failure in $(basename $f)"
-
-        ((fail++))
-      fi
-    done
-
-    if [[ $fail -eq 0 ]]; then
-      hdr "Success"
-    fi
-
-    exit "$fail"
-  '';
-
-  inherit doCheck;
-
-  # Fix 'bind: operation not permitted' when nix.useSandbox = true on darwin.
-  # See https://github.com/NixOS/nix/blob/5f6840fbb49ae5b534423bd8a4360646ee93dbaf/src/libstore/build.cc#L2961
-  __darwinAllowLocalNetworking = true;
-}
--- a/nix/overlays/arm.nix
+++ b/nix/overlays/arm.nix
@ -1,14 +0,0 @@
-final: prev:
-
-let
-
-  isAarch64 = prev.stdenv.hostPlatform.isAarch64;
-  isDarwin  = prev.stdenv.isDarwin;
-
-in prev.lib.optionalAttrs (isAarch64 && !isDarwin) {
-  libsigsegv = prev.libsigsegv.overrideAttrs (attrs: {
-    preConfigure = (prev.preConfigure or "") + ''
-      sed -i 's/^CFG_FAULT=$/CFG_FAULT=fault-linux-arm.h/' configure
-    '';
-  });
-}
--- a/nix/overlays/musl.nix
+++ b/nix/overlays/musl.nix
@ -1,26 +0,0 @@
-final: prev:
-
-let
-
-  isMusl = prev.stdenv.hostPlatform.isMusl;
-
-  optionalList = xs: if xs == null then [ ] else xs;
-
-  overrideStdenv = pkg: pkg.override { stdenv = prev.gcc9Stdenv; };
-
-in prev.lib.optionalAttrs isMusl {
-  libsigsegv = prev.libsigsegv.overrideAttrs (attrs: {
-    preConfigure = (attrs.preConfigure or "") + ''
-      sed -i 's/^CFG_FAULT=$/CFG_FAULT=fault-linux-i386.h/' configure
-    '';
-  });
-
-  secp256k1 = prev.secp256k1.overrideAttrs (attrs: {
-    nativeBuildInputs = (attrs.nativeBuildInputs or [ ])
-      ++ [ prev.buildPackages.stdenv.cc ];
-  });
-
-  rhash = overrideStdenv prev.rhash;
-
-  numactl = overrideStdenv prev.numactl;
-}
--- a/nix/overlays/native.nix
+++ b/nix/overlays/native.nix
@ -1,40 +0,0 @@
-final: prev:
-
-let
-
-  optionalList = xs: if xs == null then [ ] else xs;
-
-in {
-  h2o = prev.h2o.overrideAttrs (_attrs: {
-    version = final.sources.h2o.rev;
-    src = final.sources.h2o;
-    outputs = [ "out" "dev" "lib" ];
-    meta.platforms = prev.lib.platforms.linux ++ prev.lib.platforms.darwin;
-  });
-
-  libsigsegv = prev.libsigsegv.overrideAttrs (attrs: {
-    patches = optionalList attrs.patches ++ [
-      ../pkgs/libsigsegv/disable-stackvma_fault-linux-arm.patch
-      ../pkgs/libsigsegv/disable-stackvma_fault-linux-i386.patch
-    ];
-  });
-
-  curlUrbit = prev.curlMinimal.override {
-    http2Support = false;
-    scpSupport = false;
-    gssSupport = false;
-    ldapSupport = false;
-    brotliSupport = false;
-  };
-
-  # lies, all lies
-  openssl-static-osx = prev.openssl;
-  zlib-static-osx = prev.zlib;
-
-  lmdb = prev.lmdb.overrideAttrs (attrs: {
-    patches =
-      optionalList attrs.patches ++ prev.lib.optional prev.stdenv.isDarwin [
-        ../pkgs/lmdb/darwin-fsync.patch
-      ];
-  });
-}
--- a/nix/overlays/static.nix
+++ b/nix/overlays/static.nix
@ -1,40 +0,0 @@
-final: prev:
-
-let
-
-  # https://github.com/NixOS/nixpkgs/pull/97047/files
-  # Will make pkgs.stdenv.isStatic available indepedent of the platform.
-  # isStatic = prev.stdenv.hostPlatform.isStatic;
-
-  configureFlags = attrs: {
-    configureFlags = (attrs.configureFlags or [ ])
-      ++ [ "--disable-shared" "--enable-static" ];
-  };
-
-  enableStatic = pkg: pkg.overrideAttrs configureFlags;
-
-in {
-  gmp = enableStatic prev.gmp;
-
-  curlUrbit = enableStatic (prev.curlUrbit.override { openssl = final.openssl-static-osx; zlib = final.zlib-static-osx; });
-
-  libuv = enableStatic prev.libuv;
-
-  libffi = enableStatic prev.libffi;
-
-  openssl-static-osx = prev.openssl.override {
-    static   = true;
-    withPerl = false;
-  };
-
-  zlib-static-osx = if final.stdenv.isDarwin then prev.zlib.static else prev.zlib;
-
-  secp256k1 = enableStatic prev.secp256k1;
-
-  lmdb = prev.lmdb.overrideAttrs (old:
-    configureFlags old // {
-      postPatch = ''
-        sed '/^ILIBS\t/s/liblmdb\$(SOEXT)//' -i Makefile
-      '';
-    });
-}
--- a/nix/pkgs/arvo/default.nix
+++ b/nix/pkgs/arvo/default.nix
@ -1,21 +0,0 @@
-{ lib, stdenvNoCC, marsSources }:
-
-stdenvNoCC.mkDerivation {
-  name = "arvo";
-
-  src = marsSources;
-
-  outputs = [ "out" "ropsten" ];
-
-  phases = [ "mainnetPhase" "ropstenPhase" ];
-
-  mainnetPhase = ''
-    ln -s ${marsSources.out}/arvo $out
-    '';
-
-  ropstenPhase = ''
-    ln -s ${marsSources.ropsten}/arvo $ropsten
-    '';
-
-  preferLocalBuild = true;
-}
--- a/nix/pkgs/ca-bundle/default.nix
+++ b/nix/pkgs/ca-bundle/default.nix
@ -1,29 +0,0 @@
-{ stdenvNoCC, xxd, cacert }:
-
-stdenvNoCC.mkDerivation {
-  name = "ca-bundle";
-
-  nativeBuildInputs = [ cacert xxd ];
-
-  phases = [ "installPhase" ];
-
-  installPhase = ''
-    set -euo pipefail
-
-    if ! [ -f "$SSL_CERT_FILE" ]; then
-      header "$SSL_CERT_FILE doesn't exist"
-      exit 1
-    fi
-
-    mkdir include
-
-    cat $SSL_CERT_FILE > include/ca-bundle.crt
-    xxd -i include/ca-bundle.crt > ca-bundle.h
-
-    mkdir -p $out/include
-
-    mv ca-bundle.h $out/include
-  '';
-
-  preferLocalBuild = true;
-}
--- a/nix/pkgs/docker-image/default.nix
+++ b/nix/pkgs/docker-image/default.nix
@ -1,112 +0,0 @@
-{ urbit, curl, libcap, coreutils, bashInteractive, dockerTools, writeScriptBin, amesPort ? 34343 }:
-let
-  startUrbit = writeScriptBin "start-urbit" ''
-    #!${bashInteractive}/bin/bash
-
-    set -eu
-
-    # set defaults
-    amesPort=${toString amesPort}
-
-    # check args
-    for i in "$@"
-    do
-    case $i in
-        -p=*|--port=*)
-            amesPort="''${i#*=}"
-            shift
-            ;;
-    esac
-    done
-
-    # If the container is not started with the `-i` flag
-    # then STDIN will be closed and we need to start
-    # Urbit/vere with the `-t` flag.
-    ttyflag=""
-    if [ ! -t 0 ]; then
-      echo "Running with no STDIN"
-      ttyflag="-t"
-    fi
-
-    # Check if there is a keyfile, if so boot a ship with its name, and then remove the key
-    if [ -e *.key ]; then
-      # Get the name of the key
-      keynames="*.key"
-      keys=( $keynames )
-      keyname=''${keys[0]}
-      mv $keyname /tmp
-
-      # Boot urbit with the key, exit when done booting
-      urbit $ttyflag -w $(basename $keyname .key) -k /tmp/$keyname -c $(basename $keyname .key) -p $amesPort -x
-
-      # Remove the keyfile for security
-      rm /tmp/$keyname
-      rm *.key || true
-    elif [ -e *.comet ]; then
-      cometnames="*.comet"
-      comets=( $cometnames )
-      cometname=''${comets[0]}
-      rm *.comet
-
-      urbit $ttyflag -c $(basename $cometname .comet) -p $amesPort -x
-    fi
-
-    # Find the first directory and start urbit with the ship therein
-    dirnames="*/"
-    dirs=( $dirnames )
-    dirname=''${dirnames[0]}
-
-    exec urbit $ttyflag -p $amesPort $dirname
-    '';
-
-  getUrbitCode = writeScriptBin "get-urbit-code" ''
-    #!${bashInteractive}/bin/bash
-
-    raw=$(curl -s -X POST -H "Content-Type: application/json" \
-      -d '{ "source": { "dojo": "+code" }, "sink": { "stdout": null } }' \
-      http://127.0.0.1:12321)
-
-    # trim \n" from the end
-    trim="''${raw%\\n\"}"
-
-    # trim " from the start
-    code="''${trim#\"}"
-
-    echo "$code"
-    '';
-
-  resetUrbitCode = writeScriptBin "reset-urbit-code" ''
-    #!${bashInteractive}/bin/bash
-
-    curl=$(curl -s -X POST -H "Content-Type: application/json" \
-      -d '{ "source": { "dojo": "+hood/code %reset" }, "sink": { "app": "hood" } }' \
-      http://127.0.0.1:12321)
-
-    if [[ $? -eq 0 ]]
-    then
-      echo "OK"
-    else
-      echo "Curl error: $?"
-    fi
-    '';
-    
-in dockerTools.buildImage {
-  name = "urbit";
-  tag = "v${urbit.version}";
-  contents = [ bashInteractive urbit curl startUrbit getUrbitCode resetUrbitCode coreutils ];
-  runAsRoot = ''
-    #!${bashInteractive}
-    mkdir -p /urbit
-    mkdir -p /tmp
-    ${libcap}/bin/setcap 'cap_net_bind_service=+ep' /bin/urbit
-    '';
-  config = {
-    Cmd = [ "/bin/start-urbit" ];
-    Env = [ "PATH=/bin" ];
-    WorkingDir = "/urbit";
-    Volumes = {
-      "/urbit" = {};
-    };
-    Expose = [ "80/tcp" "${toString amesPort}/udp" ];
-  };
-}
--- a/nix/pkgs/ent/default.nix
+++ b/nix/pkgs/ent/default.nix
@ -1,14 +0,0 @@
-{ lib, stdenv, enableParallelBuilding ? true }:
-
-stdenv.mkDerivation {
-  name = "ent";
-  src = lib.cleanSource ../../../pkg/ent;
-
-  postPatch = ''
-    patchShebangs ./configure
-  '';
-
-  installFlags = [ "PREFIX=$(out)" ];
-
-  inherit enableParallelBuilding;
-}
--- a/nix/pkgs/herb/default.nix
+++ b/nix/pkgs/herb/default.nix
@ -1,29 +0,0 @@
-{ lib, stdenvNoCC, python }:
-
-# Avoid using `python.withPackages` as it creates a wrapper script to set
-# PYTHONPATH, and the script is used verbatim as a python shebang.
-#
-# Unfortunately Darwin does not allow scripts as a shebang - so to get a
-# cross platform python interpreter with appropriate site-packages setup
-# we use `wrapPython/Packages` which handles these cases correctly.
-
-stdenvNoCC.mkDerivation {
-  name = "herb";
-  src = ../../../pkg/herb/herb;
-
-  nativeBuildInputs = [ python.pkgs.wrapPython ];
-  buildInputs = [ python python.pkgs.requests ];
-  pythonPath = [ python.pkgs.requests ];
-
-  phases = [ "installPhase" "fixupPhase" ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp $src $out/bin/herb
-    chmod +x $out/bin/herb
-  '';
-
-  postFixup = ''
-    wrapPythonPrograms
-  '';
-}
--- a/nix/pkgs/libaes_siv/cmakefiles_static.patch
+++ b/nix/pkgs/libaes_siv/cmakefiles_static.patch
@ -1,34 +0,0 @@
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -5,6 +5,8 @@ if("${CMAKE_BUILD_TYPE}" STREQUAL "")
- set(CMAKE_BUILD_TYPE Release)
- endif("${CMAKE_BUILD_TYPE}" STREQUAL "")
- 
-+option(BUILD_SHARED_LIBS "Build shared libraries" ON)
-+
- include(GNUInstallDirs)
- 
- # Warning: don't use the UB sanitizer in production builds. It can introduce timing side-channels
-@@ -31,10 +33,12 @@ endif(NOT DISABLE_DOCS)
- configure_file(config.h.in config.h)
- include_directories(${CMAKE_CURRENT_BINARY_DIR})
- 
-+if(BUILD_SHARED_LIBS)
- add_library(aes_siv SHARED aes_siv.c)
- target_include_directories(aes_siv PUBLIC ${OPENSSL_INCLUDE_DIR})
- target_link_libraries(aes_siv ${OPENSSL_CRYPTO_LIBRARY})
- set_target_properties(aes_siv PROPERTIES VERSION "1.0.1" SOVERSION 1)
-+endif()
- 
- add_library(aes_siv_static STATIC aes_siv.c)
- target_include_directories(aes_siv_static PUBLIC ${OPENSSL_INCLUDE_DIR})
-@@ -63,7 +67,9 @@ endif(ENABLE_SANITIZER)
- add_executable(bench EXCLUDE_FROM_ALL bench.c)
- target_link_libraries(bench aes_siv_static)
- 
-+if(BUILD_SHARED_LIBS)
- install(TARGETS aes_siv LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})
-+endif()
- install(TARGETS aes_siv_static ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR})
- install(FILES aes_siv.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
- 
--- a/nix/pkgs/libaes_siv/default.nix
+++ b/nix/pkgs/libaes_siv/default.nix
@ -1,17 +0,0 @@
-{ stdenv, sources, cmake, openssl, enableParallelBuilding ? true }:
-
-stdenv.mkDerivation {
-  name = "libaes_siv";
-  version = sources.libaes_siv.rev;
-  src = sources.libaes_siv;
-  patches = [ ./cmakefiles_static.patch ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ openssl ];
-
-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=OFF"
-  ];
-
-  inherit enableParallelBuilding;
-}
--- a/nix/pkgs/libsigsegv/disable-stackvma_fault-linux-arm.patch
+++ b/nix/pkgs/libsigsegv/disable-stackvma_fault-linux-arm.patch
@ -1,11 +0,0 @@
--- a/src/fault-linux-arm.h
-+++ b/src/fault-linux-arm.h
-@@ -17,6 +17,8 @@
- 
- #include "fault-posix-ucontext.h"
- 
-+#define HAVE_STACKVMA 0
-+
- #if defined(__aarch64__) || defined(__ARM_64BIT_STATE) || defined(__ARM_PCS_AAPCS64) /* 64-bit */
- 
- /* See glibc/sysdeps/unix/sysv/linux/aarch64/sys/ucontext.h.
--- a/nix/pkgs/libsigsegv/disable-stackvma_fault-linux-i386.patch
+++ b/nix/pkgs/libsigsegv/disable-stackvma_fault-linux-i386.patch
@ -1,11 +0,0 @@
--- a/src/fault-linux-i386.h
-+++ b/src/fault-linux-i386.h
-@@ -18,6 +18,8 @@
- 
- #include "fault-posix-ucontext.h"
- 
-+#define HAVE_STACKVMA 0
-+
- #if defined __x86_64__
- /* 64 bit registers */
- 
--- a/nix/pkgs/lmdb/darwin-fsync.patch
+++ b/nix/pkgs/lmdb/darwin-fsync.patch
@ -1,13 +0,0 @@
-diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
-index fe65e30..0070215 100644
--- a/libraries/liblmdb/mdb.c
-+++ b/libraries/liblmdb/mdb.c
-@@ -2526,7 +2526,7 @@ mdb_env_sync(MDB_env *env, int force)
- 					rc = ErrCode();
- 			} else
- #endif
-			if (MDB_FDATASYNC(env->me_fd))
-+			if (fcntl(env->me_fd, F_FULLFSYNC, 0))
- 				rc = ErrCode();
- 		}
- 	}
--- a/nix/pkgs/marsSources/default.nix
+++ b/nix/pkgs/marsSources/default.nix
@ -1,46 +0,0 @@
-{ lib, stdenvNoCC, bc }:
-
-stdenvNoCC.mkDerivation {
-  name = "sources";
-  src = lib.cleanSource ../../../pkg;
-
-  buildInputs = [ bc ];
-
-  outputs = [ "out" "ropsten" ];
-
-  phases = [ "mainnetPhase" "ropstenPhase" ];
-
-  mainnetPhase = ''
-    cp -r $src $out
-    chmod -R u+w $out
-  '';
-
-  ropstenPhase = ''
-    cp -r $src tmp
-    chmod -R u+w tmp
-
-    ZUSE=tmp/arvo/sys/zuse.hoon
-    AMES=tmp/arvo/sys/vane/ames.hoon
-    ACME=tmp/arvo/app/acme.hoon
-
-    # Replace the mainnet azimuth contract with the ropsten contract
-    sed --in-place \
-      's/\(\+\+  contracts  \)mainnet\-contracts/\1ropsten-contracts/' \
-      $ZUSE
-
-    # Increment the %ames protocol version
-    sed -r --in-place \
-      's_^(=/  protocol\-version=\?\(.*\)  %)([0-7])_echo "\1$(echo "(\2+1) % 8" | bc)"_e' \
-      $AMES
-
-    # Use the staging API in :acme
-    sed --in-place \
-      's_https://acme-v02.api.letsencrypt.org/directory_https://acme-staging-v02.api.letsencrypt.org/directory_' \
-      $ACME
-
-    cp -r tmp $ropsten
-    chmod -R u+w $ropsten
-  '';
-
-  preferLocalBuild = true;
-}
--- a/nix/pkgs/murmur3/default.nix
+++ b/nix/pkgs/murmur3/default.nix
@ -1,17 +0,0 @@
-{ stdenv, sources }:
-
-stdenv.mkDerivation {
-  pname = "murmur3";
-  version = sources.murmur3.rev;
-  src = sources.murmur3;
-
-  buildPhase = ''
-    $CC -fPIC -O3 -o murmur3.o -c $src/murmur3.c
-  '';
-
-  installPhase = ''
-    mkdir -p $out/{lib,include}
-    $AR rcs $out/lib/libmurmur3.a murmur3.o
-    cp $src/*.h $out/include/
-  '';
-}
--- a/nix/pkgs/pill/brass.nix
+++ b/nix/pkgs/pill/brass.nix
@ -1,22 +0,0 @@
-{ lib, stdenvNoCC, fetchGitHubLFS, bootFakeShip, solid, urbit, arvo, curl
-, withRopsten ? false }:
-
-let
-
-  lfs = fetchGitHubLFS { src = ../../../bin/brass.pill; };
-
-in {
-  build = import ./builder.nix {
-    inherit stdenvNoCC urbit curl;
-
-    name = "brass" + lib.optionalString withRopsten "-ropsten";
-    builder = ./brass.sh;
-    arvo = if withRopsten then arvo.ropsten else arvo;
-    pier = bootFakeShip {
-      inherit urbit;
-
-      pill = solid.lfs;
-      ship = "zod";
-    };
-  };
-} // lib.optionalAttrs (!withRopsten) { inherit lfs; }
--- a/nix/pkgs/pill/brass.sh
+++ b/nix/pkgs/pill/brass.sh
@ -1,40 +0,0 @@
-source $stdenv/setup
-
-set -euo pipefail
-
-cp -r $src ./pier
-chmod -R u+rw ./pier
-
-urbit -d ./pier
-
-cleanup () {
-  if [ -f ./pier/.vere.lock ]; then
-    kill $(< ./pier/.vere.lock) || true
-  fi
-}
-
-trap cleanup EXIT
-
-header "running +brass"
-
-port=$(cat ./pier/.http.ports | grep loopback | tr -s ' ' '\n' | head -n 1)
-
-lensa() {
-  # -f elided, this can hit server-side timeouts
-  curl -s                                                              \
-    --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"app\":\"$1\"}}"  \
-    "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-}
-
-lensf() {
-  # -f elided, this can hit server-side timeouts
-  d=$(echo $1 | sed 's/\./\//g')
-  curl -sJO                                                                   \
-    --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"output-pill\":\"$d\"}}" \
-    "http://localhost:$port"
-}
-
-lensf brass.pill '+brass'
-lensa hood '+hood/exit'
-
-stopNest
--- a/nix/pkgs/pill/builder.nix
+++ b/nix/pkgs/pill/builder.nix
@ -1,16 +0,0 @@
-{ stdenvNoCC, urbit, arvo, curl, name, builder, pier }:
-
-stdenvNoCC.mkDerivation {
-  name = "${name}.pill";
-  src = pier;
-  buildInputs = [ curl urbit ];
-  dontUnpack = true;
-
-  buildPhase = builtins.readFile builder;
-
-  installPhase = ''
-    mv ${name}.pill $out
-  '';
-
-  ARVO = arvo;
-}
--- a/nix/pkgs/pill/ivory.nix
+++ b/nix/pkgs/pill/ivory.nix
@ -1,42 +0,0 @@
-{ lib, stdenvNoCC, fetchGitHubLFS, bootFakeShip, solid, urbit, arvo, curl, xxd
-, withRopsten ? false }:
-
-let
-
-  lfs = fetchGitHubLFS { src = ../../../bin/ivory.pill; };
-
-in {
-  build = import ./builder.nix {
-    inherit stdenvNoCC urbit curl;
-
-    name = "ivory" + lib.optionalString withRopsten "-ropsten";
-    builder = ./ivory.sh;
-    arvo = if withRopsten then arvo.ropsten else arvo;
-    pier = bootFakeShip {
-      inherit urbit;
-
-      pill = solid.lfs;
-      ship = "zod";
-    };
-  };
-
-  # The hexdump of the `.lfs` pill contents as a C header.
-  header = stdenvNoCC.mkDerivation {
-    name = "ivory-header";
-    src = lfs;
-    nativeBuildInputs = [ xxd ];
-    phases = [ "installPhase" ];
-
-    installPhase = ''
-      file=u3_Ivory.pill
-
-      header "writing $file"
-
-      mkdir -p $out/include
-      cat $src > $file
-      xxd -i $file > $out/include/ivory_impl.h
-    '';
-
-    preferLocalBuild = true;
-  };
-} // lib.optionalAttrs (!withRopsten) { inherit lfs; }
--- a/nix/pkgs/pill/ivory.sh
+++ b/nix/pkgs/pill/ivory.sh
@ -1,40 +0,0 @@
-source $stdenv/setup
-
-set -euo pipefail
-
-cp -r $src ./pier
-chmod -R u+rw ./pier
-
-urbit -d ./pier
-
-cleanup () {
-  if [ -f ./pier/.vere.lock ]; then
-    kill $(< ./pier/.vere.lock) || true
-  fi
-}
-
-trap cleanup EXIT
-
-header "running +ivory"
-
-port=$(cat ./pier/.http.ports | grep loopback | tr -s ' ' '\n' | head -n 1)
-
-lensa() {
-  # -f elided, this can hit server-side timeouts
-  curl -s                                                              \
-    --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"app\":\"$1\"}}"  \
-    "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-}
-
-lensf() {
-  # -f elided, this can hit server-side timeouts
-  d=$(echo $1 | sed 's/\./\//g')
-  curl -sJO                                                                   \
-    --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"output-pill\":\"$d\"}}" \
-    "http://localhost:$port"
-}
-
-lensf ivory.pill '+ivory'
-lensa hood '+hood/exit'
-
-stopNest
--- a/nix/pkgs/pill/solid.nix
+++ b/nix/pkgs/pill/solid.nix
@ -1,23 +0,0 @@
-{ stdenvNoCC, fetchGitHubLFS, bootFakeShip, solid, urbit, arvo, curl }:
-
-let
-
-  lfs = fetchGitHubLFS { src = ../../../bin/solid.pill; };
-
-in {
-  inherit lfs;
-
-  build = import ./builder.nix {
-    inherit stdenvNoCC urbit arvo curl;
-
-    name = "solid";
-    builder = ./solid.sh;
-    pier = bootFakeShip {
-      inherit urbit;
-
-      arvo = null;
-      pill = solid.lfs;
-      ship = "zod";
-    };
-  };
-}
--- a/nix/pkgs/pill/solid.sh
+++ b/nix/pkgs/pill/solid.sh
@ -1,99 +0,0 @@
-source $stdenv/setup
-
-set -euo pipefail
-
-ARVO=${ARVO?:ARVO location is unset}
-
-cp -r $src ./pier
-chmod -R u+rw ./pier
-
-urbit -d ./pier
-
-cleanup () {
-  if [ -f ./pier/.vere.lock ]; then
-    kill $(< ./pier/.vere.lock) || true
-  fi
-}
-
-trap cleanup EXIT
-
-port=$(cat ./pier/.http.ports | grep loopback | tr -s ' ' '\n' | head -n 1)
-
-lensa() {
-  # -f elided, this can hit server-side timeouts
-  curl -s                                                              \
-    --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"app\":\"$1\"}}"  \
-    "http://localhost:$port" | xargs printf %s | sed 's/\\n/\n/g'
-}
-
-lensf() {
-  # -f elided, this can hit server-side timeouts
-  d=$(echo $1 | sed 's/\./\//g')
-  curl -sJO                                                                   \
-    --data "{\"source\":{\"dojo\":\"$2\"},\"sink\":{\"output-pill\":\"$d\"}}" \
-    "http://localhost:$port"
-}
-
-header "updating %base"
-
-# Update pill strategy to ensure correct staging
-lensa hood "+hood/mount /=base="
-
-until [ -d ./pier/base ]; do
-  sleep 1
-done
-
-# Update :lens, :dojo and dependencies
-# FIXME: reduce this list
-cp $ARVO/app/lens.hoon   ./pier/base/app/
-cp $ARVO/app/dojo.hoon   ./pier/base/app/
-cp $ARVO/lib/plume.hoon  ./pier/base/lib/
-cp $ARVO/lib/server.hoon ./pier/base/lib/
-cp $ARVO/lib/sole.hoon   ./pier/base/lib/
-cp $ARVO/lib/xray.hoon   ./pier/base/lib/
-cp $ARVO/lib/pprint.hoon ./pier/base/lib/
-
-mkdir -p ./pier/base/mar/lens/
-
-cp $ARVO/mar/lens/*      ./pier/base/mar/lens/
-
-cp $ARVO/sur/lens.hoon   ./pier/base/sur/
-cp $ARVO/sur/plum.hoon   ./pier/base/sur/
-cp $ARVO/sur/sole.hoon   ./pier/base/sur/
-cp $ARVO/sur/xray.hoon   ./pier/base/sur/
-
-# Update +solid and its dependencies
-cp $ARVO/lib/pill.hoon   ./pier/base/lib/
-cp $ARVO/gen/solid.hoon  ./pier/base/gen/
-
-chmod -R u+rw ./pier/base/
-
-lensa hood "+hood/commit %base"
-lensa hood "+hood/unmount %base"
-
-# FIXME: horrible hack to ensure the update is applied first
-sleep 10
-
-header "updating %stage"
-
-# Stage new desk for pill contents
-lensa hood '+hood/merge %stage our %base'
-lensa hood "+hood/mount /=stage="
-
-until [ -d ./pier/stage ]; do
-  sleep 1
-done
-
-rm -rf ./pier/stage
-cp -r $ARVO ./pier/stage
-chmod -R u+rw ./pier/stage
-
-lensa hood "+hood/commit %stage"
-lensa hood "+hood/unmount %stage"
-
-header "running +solid"
-
-lensf solid.pill '+solid /=stage=/sys, =dub &'
-lensa hood '+hood/exit'
-
-stopNest
--- a/nix/pkgs/softfloat3/default.nix
+++ b/nix/pkgs/softfloat3/default.nix
@ -1,28 +0,0 @@
-{ stdenv, sources, enableParallelBuilding ? true }:
-
-stdenv.mkDerivation {
-  pname = "softfloat3";
-  version = sources.softfloat3.rev;
-  src = sources.softfloat3;
-
-  postPatch = ''
-    for f in $(find build -type f -name 'Makefile'); do
-      substituteInPlace $f \
-        --replace 'gcc' '$(CC)' \
-        --replace 'ar crs' '$(AR) crs'
-    done
-  '';
-
-  preBuild = ''
-    cd build/Linux-x86_64-GCC 
-  '';
-
-  installPhase = ''
-    mkdir -p $out/{lib,include}
-    cp $src/source/include/*.h $out/include/
-    cp softfloat.a $out/lib/libsoftfloat3.a
-  '';
-
-  inherit enableParallelBuilding;
-}
-
--- a/nix/pkgs/urbit/default.nix
+++ b/nix/pkgs/urbit/default.nix
@ -1,85 +0,0 @@
-{ lib, stdenv, coreutils, pkgconfig                      # build/env
-, cacert, ca-bundle, ivory                               # codegen
-, curlUrbit, ent, gmp, h2o, libsigsegv, libuv, lmdb      # libs
-, murmur3, openssl, openssl-static-osx, softfloat3       #
-, urcrypt, zlib, zlib-static-osx                         #
-, enableStatic           ? stdenv.hostPlatform.isStatic  # opts
-, enableDebug            ? false
-, verePace               ? ""
-, doCheck                ? true
-, enableParallelBuilding ? true
-, dontStrip              ? true }:
-
-let
-
-  src = lib.cleanSource ../../../pkg/urbit;
-
-  version = builtins.readFile "${src}/version";
-
-  # See https://github.com/urbit/urbit/issues/5561
-  oFlags =
-    if stdenv.isDarwin
-    then (if enableDebug then [ "-O0" "-g" ] else [ "-O3" ])
-    else [ (if enableDebug then "-O0" else "-O3") "-g" ];
-
-in stdenv.mkDerivation {
-  inherit src version;
-
-  pname = "urbit" + lib.optionalString enableDebug "-debug"
-    + lib.optionalString enableStatic "-static";
-
-  nativeBuildInputs = [ pkgconfig ];
-
-  buildInputs = [
-    cacert
-    ca-bundle
-    curlUrbit
-    ent
-    gmp
-    h2o
-    ivory.header
-    libsigsegv
-    libuv
-    lmdb
-    murmur3
-    (if stdenv.isDarwin && enableStatic then openssl-static-osx else openssl)
-    softfloat3
-    urcrypt
-    (if stdenv.isDarwin && enableStatic then zlib-static-osx else zlib)
-  ];
-
-  # Ensure any `/usr/bin/env bash` shebang is patched.
-  postPatch = ''
-    patchShebangs ./configure
-  '';
-
-  checkTarget = "test";
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp ./build/urbit $out/bin/urbit
-  '';
-
-  dontDisableStatic = enableStatic;
-
-  configureFlags = if enableStatic
-    then [ "--disable-shared" "--enable-static" ]
-    else [];
-
-  CFLAGS = oFlags ++ lib.optionals (!enableDebug) [ "-Werror" ];
-
-  MEMORY_DEBUG = enableDebug;
-  CPU_DEBUG = enableDebug;
-  EVENT_TIME_DEBUG = false;
-  VERE_PACE = if enableStatic then verePace else "";
-
-  # See https://github.com/NixOS/nixpkgs/issues/18995
-  hardeningDisable = lib.optionals enableDebug [ "all" ];
-
-  inherit enableParallelBuilding doCheck dontStrip;
-
-  meta = {
-    debug = enableDebug;
-    arguments = lib.optionals enableDebug [ "-g" ];
-  };
-}
--- a/nix/pkgs/urcrypt/default.nix
+++ b/nix/pkgs/urcrypt/default.nix
@ -1,21 +0,0 @@
-{ stdenv, autoreconfHook, pkgconfig
-, libaes_siv, openssl, openssl-static-osx, secp256k1
-, enableStatic ? stdenv.hostPlatform.isStatic }:
-
-stdenv.mkDerivation rec {
-  name = "urcrypt";
-  src  = ../../../pkg/urcrypt;
-
-  # XX why are these required for darwin?
-  dontDisableStatic = enableStatic;
-
-  configureFlags = if enableStatic
-    then [ "--disable-shared" "--enable-static" ]
-    else [];
-
-  nativeBuildInputs =
-    [ autoreconfHook pkgconfig ];
-
-  propagatedBuildInputs =
-    [ openssl secp256k1 libaes_siv ];
-}
--- a/nix/sources-openssl.json
+++ b/nix/sources-openssl.json
@ -1,18 +0,0 @@
-{
-    "openssl": {
-        "branch": "1_1_1n",
-        "homepage": "https://www.openssl.org/",
-        "pmnsh": {
-            "include": "build/include",
-            "lib": "build",
-            "prepare": "./config --prefix=`mkdir -p build && readlink -f ./build` --libdir=. no-shared no-tests",
-            "make": "install_dev"
-        },
-        "owner": "openssl",
-        "repo": "openssl",
-        "rev": "OpenSSL_1_1_1n",
-        "type": "tarball",
-        "url": "https://github.com/openssl/openssl/archive/refs/tags/OpenSSL_1_1_1n.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/refs/tags/<rev>.tar.gz"
-    }
-}
--- a/nix/sources-pmnsh.json
+++ b/nix/sources-pmnsh.json
@ -1,95 +0,0 @@
-{
-    "curl": {
-        "branch": "master",
-        "description": "A command line tool and library for transferring data with URL syntax",
-        "homepage": "http://curl.se/",
-        "pmnsh": {
-            "compat": {
-                "openbsd": {
-                    "prepare": "autoreconf -vfi && ./configure --disable-shared --disable-ldap --disable-rtsp --without-brotli --without-libidn2 --without-libpsl --without-nghttp2 --with-openssl=`readlink -f ../openssl/build`"
-                }
-            },
-            "include": "include",
-            "lib": "lib/.libs",
-            "prepare": "autoreconf -vfi && ./configure --disable-shared --disable-ldap --disable-rtsp --without-brotli --without-libidn2 --without-libpsl --without-nghttp2 --with-openssl",
-            "make": "-C lib libcurl.la"
-        },
-        "owner": "curl",
-        "repo": "curl",
-        "rev": "curl-7_77_0",
-        "type": "tarball",
-        "url": "https://github.com/curl/curl/archive/curl-7_77_0.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "lmdb": {
-        "branch": "mdb.master",
-        "description": "LMDB library",
-        "homepage": "http://www.lmdb.tech/",
-        "pmnsh": {
-            "strip": 2,
-            "make": "liblmdb.a"
-        },
-        "owner": "LMDB",
-        "repo": "lmdb",
-        "rev": "48a7fed59a8aae623deff415dda27097198ca0c1",
-        "type": "tarball",
-        "url": "https://github.com/LMDB/lmdb/archive/48a7fed59a8aae623deff415dda27097198ca0c1.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "secp256k1": {
-        "branch": "master",
-        "description": "Optimized C library for ECDSA signatures and secret/public key operations on curve secp256k1.",
-        "homepage": null,
-        "owner": "bitcoin-core",
-        "pmnsh": {
-            "include": "include",
-            "lib": ".libs",
-            "make": "libsecp256k1.la",
-            "prepare": "./autogen.sh && ./configure --disable-shared --enable-benchmark=no --enable-exhaustive-tests=no --enable-experimental --enable-module-ecdh --enable-module-recovery --enable-module-schnorrsig --enable-tests=yes CFLAGS=-DSECP256K1_API="
-        },
-        "repo": "secp256k1",
-        "rev": "5dcc6f8dbdb1850570919fc9942d22f728dbc0af",
-        "sha256": "x9qG2S6tBSRseWaFIN9N2fRpY1vkv8idT3d3rfJnmaU",
-        "type": "tarball",
-        "url": "https://github.com/bitcoin-core/secp256k1/archive/5dcc6f8dbdb1850570919fc9942d22f728dbc0af.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "uv": {
-        "branch": "v1.x",
-        "description": "Cross-platform asynchronous I/O",
-        "homepage": "http://libuv.org/",
-        "pmnsh": {
-            "include": "include",
-            "lib": ".libs",
-            "prepare": "./autogen.sh && ./configure --disable-shared",
-            "make": "libuv.la",
-            "compat": {
-                "m1brew": false
-            }
-        },
-        "owner": "libuv",
-        "repo": "libuv",
-        "rev": "v1.40.0",
-        "type": "tarball",
-        "url": "https://github.com/libuv/libuv/archive/v1.40.0.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "ent": {
-        "pmnsh": {
-            "prepare": "./configure"
-        }
-    },
-    "urcrypt": {
-        "pmnsh": {
-            "compat": {
-                "openbsd": {
-                    "make": "install prefix=`readlink -f .` exec_prefix=`readlink -f .`",
-                    "include": "include",
-                    "lib": "lib"
-                }
-            },
-            "prepare": "./autogen.sh && ./configure --disable-shared PKG_CONFIG_PATH=../secp256k1 CFLAGS=\"-I../secp256k1/include -I../libaes_siv\" LDFLAGS=-L../libaes_siv",
-            "make": "install"
-        }
-    }
-}
--- a/nix/sources.json
+++ b/nix/sources.json
@ -1,123 +0,0 @@
-{
-    "h2o": {
-        "branch": "master",
-        "description": "H2O - the optimized HTTP/1, HTTP/2, HTTP/3 server",
-        "homepage": "https://h2o.examp1e.net",
-        "owner": "h2o",
-        "pmnsh": {
-            "compat": {
-                "mingw": {
-                    "prepare": "cmake -G\"MSYS Makefiles\" -DCMAKE_INSTALL_PREFIX=. ."
-                },
-                "openbsd": {
-                    "prepare": "cmake -DOPENSSL_ROOT_DIR=`readlink -f ../openssl/build` ."
-                }
-            },
-            "include": "include",
-            "make": "libh2o",
-            "prepare": "cmake ."
-        },
-        "repo": "h2o",
-        "rev": "v2.2.6",
-        "sha256": "0qni676wqvxx0sl0pw9j0ph7zf2krrzqc1zwj73mgpdnsr8rsib7",
-        "type": "tarball",
-        "url": "https://github.com/h2o/h2o/archive/v2.2.6.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "libaes_siv": {
-        "branch": "master",
-        "description": null,
-        "homepage": null,
-        "owner": "dfoxfranke",
-        "pmnsh": {
-            "compat": {
-                "m1brew": {
-                    "make": "install CFLAGS=$(pkg-config --cflags openssl)",
-                    "prepare": "cmake ."
-                },
-                "mingw": {
-                    "make": "aes_siv_static",
-                    "prepare": "cmake -G\"MSYS Makefiles\" -DDISABLE_DOCS:BOOL=ON ."
-                },
-                "openbsd": {
-                    "make": "aes_siv_static",
-                    "prepare": "cmake -DDISABLE_DOCS:BOOL=ON -DOPENSSL_ROOT_DIR=`readlink -f ../openssl/build` ."
-                }
-            }
-        },
-        "repo": "libaes_siv",
-        "rev": "9681279cfaa6e6399bb7ca3afbbc27fc2e19df4b",
-        "sha256": "1g4wy0m5wpqx7z6nillppkh5zki9fkx9rdw149qcxh7mc5vlszzi",
-        "type": "tarball",
-        "url": "https://github.com/dfoxfranke/libaes_siv/archive/9681279cfaa6e6399bb7ca3afbbc27fc2e19df4b.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "murmur3": {
-        "branch": "master",
-        "description": null,
-        "homepage": null,
-        "owner": "urbit",
-        "pmnsh": {
-            "make": "static"
-        },
-        "repo": "murmur3",
-        "rev": "71a75d57ca4e7ca0f7fc2fd84abd93595b0624ca",
-        "sha256": "0k7jq2nb4ad9ajkr6wc4w2yy2f2hkwm3nkbj2pklqgwsg6flxzwg",
-        "type": "tarball",
-        "url": "https://github.com/urbit/murmur3/archive/71a75d57ca4e7ca0f7fc2fd84abd93595b0624ca.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "niv": {
-        "branch": "master",
-        "description": "Easy dependency management for Nix projects",
-        "homepage": "https://github.com/nmattia/niv",
-        "owner": "nmattia",
-        "repo": "niv",
-        "rev": "9d35b9e4837ab88517210b1701127612c260eccf",
-        "sha256": "0q50xhnm8g2yfyakrh0nly4swyygxpi0a8cb9gp65wcakcgvzvdh",
-        "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/9d35b9e4837ab88517210b1701127612c260eccf.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixpkgs": {
-        "branch": "master",
-        "description": "Nix Packages collection",
-        "homepage": "",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "376d67e1cd05d5ac8a64a3f47f17b80fb6394792",
-        "sha256": "1l4ai1dppwdbkkjbvnavsivr5kx00b3q8640pilpnifskfmfc8mp",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/376d67e1cd05d5ac8a64a3f47f17b80fb6394792.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "softfloat3": {
-        "branch": "master",
-        "description": null,
-        "homepage": null,
-        "owner": "urbit",
-        "pmnsh": {
-            "compat": {
-                "m1brew": {
-                    "lib": "build/template-FAST_INT64",
-                    "make": "-C build/template-FAST_INT64 libsoftfloat3.a"
-                },
-                "mingw": {
-                    "lib": "build/Win64-MinGW-w64",
-                    "make": "-C build/Win64-MinGW-w64 libsoftfloat3.a"
-                },
-                "openbsd": {
-                    "lib": "build/template-FAST_INT64",
-                    "make": "-C build/template-FAST_INT64 libsoftfloat3.a"
-                }
-            },
-            "include": "source/include"
-        },
-        "repo": "berkeley-softfloat-3",
-        "rev": "ec4c7e31b32e07aad80e52f65ff46ac6d6aad986",
-        "sha256": "1lz4bazbf7lns1xh8aam19c814a4n4czq5xsq5rmi9sgqw910339",
-        "type": "tarball",
-        "url": "https://github.com/urbit/berkeley-softfloat-3/archive/ec4c7e31b32e07aad80e52f65ff46ac6d6aad986.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    }
-}
--- a/nix/sources.nix
+++ b/nix/sources.nix
@ -1,174 +0,0 @@
-# This file has been generated by Niv.
-
-let
-
-  #
-  # The fetchers. fetch_<type> fetches specs of type <type>.
-  #
-
-  fetch_file = pkgs: name: spec:
-    let
-      name' = sanitizeName name + "-src";
-    in
-      if spec.builtin or true then
-        builtins_fetchurl { inherit (spec) url sha256; name = name'; }
-      else
-        pkgs.fetchurl { inherit (spec) url sha256; name = name'; };
-
-  fetch_tarball = pkgs: name: spec:
-    let
-      name' = sanitizeName name + "-src";
-    in
-      if spec.builtin or true then
-        builtins_fetchTarball { name = name'; inherit (spec) url sha256; }
-      else
-        pkgs.fetchzip { name = name'; inherit (spec) url sha256; };
-
-  fetch_git = name: spec:
-    let
-      ref =
-        if spec ? ref then spec.ref else
-          if spec ? branch then "refs/heads/${spec.branch}" else
-            if spec ? tag then "refs/tags/${spec.tag}" else
-              abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!";
-    in
-      builtins.fetchGit { url = spec.repo; inherit (spec) rev; inherit ref; };
-
-  fetch_local = spec: spec.path;
-
-  fetch_builtin-tarball = name: throw
-    ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
-        $ niv modify ${name} -a type=tarball -a builtin=true'';
-
-  fetch_builtin-url = name: throw
-    ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
-        $ niv modify ${name} -a type=file -a builtin=true'';
-
-  #
-  # Various helpers
-  #
-
-  # https://github.com/NixOS/nixpkgs/pull/83241/files#diff-c6f540a4f3bfa4b0e8b6bafd4cd54e8bR695
-  sanitizeName = name:
-    (
-      concatMapStrings (s: if builtins.isList s then "-" else s)
-        (
-          builtins.split "[^[:alnum:]+._?=-]+"
-            ((x: builtins.elemAt (builtins.match "\\.*(.*)" x) 0) name)
-        )
-    );
-
-  # The set of packages used when specs are fetched using non-builtins.
-  mkPkgs = sources: system:
-    let
-      sourcesNixpkgs =
-        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) { inherit system; };
-      hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
-      hasThisAsNixpkgsPath = <nixpkgs> == ./.;
-    in
-      if builtins.hasAttr "nixpkgs" sources
-      then sourcesNixpkgs
-      else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then
-        import <nixpkgs> {}
-      else
-        abort
-          ''
-            Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
-            add a package called "nixpkgs" to your sources.json.
-          '';
-
-  # The actual fetching function.
-  fetch = pkgs: name: spec:
-
-    if ! builtins.hasAttr "type" spec then
-      abort "ERROR: niv spec ${name} does not have a 'type' attribute"
-    else if spec.type == "file" then fetch_file pkgs name spec
-    else if spec.type == "tarball" then fetch_tarball pkgs name spec
-    else if spec.type == "git" then fetch_git name spec
-    else if spec.type == "local" then fetch_local spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball name
-    else if spec.type == "builtin-url" then fetch_builtin-url name
-    else
-      abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
-
-  # If the environment variable NIV_OVERRIDE_${name} is set, then use
-  # the path directly as opposed to the fetched source.
-  replace = name: drv:
-    let
-      saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name;
-      ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
-    in
-      if ersatz == "" then drv else
-        # this turns the string into an actual Nix path (for both absolute and
-        # relative paths)
-        if builtins.substring 0 1 ersatz == "/" then /. + ersatz else /. + builtins.getEnv "PWD" + "/${ersatz}";
-
-  # Ports of functions for older nix versions
-
-  # a Nix version of mapAttrs if the built-in doesn't exist
-  mapAttrs = builtins.mapAttrs or (
-    f: set: with builtins;
-    listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
-  );
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
-  range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1);
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
-  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
-  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
-  concatMapStrings = f: list: concatStrings (map f list);
-  concatStrings = builtins.concatStringsSep "";
-
-  # https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331
-  optionalAttrs = cond: as: if cond then as else {};
-
-  # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, name ? null, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchTarball;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchTarball ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; }))
-      else
-        fetchTarball attrs;
-
-  # fetchurl version that is compatible between all the versions of Nix
-  builtins_fetchurl = { url, name ? null, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchurl;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchurl ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; }))
-      else
-        fetchurl attrs;
-
-  # Create the final "sources" from the config
-  mkSources = config:
-    mapAttrs (
-      name: spec:
-        if builtins.hasAttr "outPath" spec
-        then abort
-          "The values in sources.json should not have an 'outPath' attribute"
-        else
-          spec // { outPath = replace name (fetch config.pkgs name spec); }
-    ) config.sources;
-
-  # The "config" used by the fetchers
-  mkConfig =
-    { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
-    , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile)
-    , system ? builtins.currentSystem
-    , pkgs ? mkPkgs sources system
-    }: rec {
-      # The sources, i.e. the attribute set of spec name to spec
-      inherit sources;
-
-      # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
-      inherit pkgs;
-    };
-
-in
-mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }
--- a/pkg/c3/BUILD.bazel
+++ b/pkg/c3/BUILD.bazel
@ -0,0 +1,50 @@
+#
+# LIBRARIES
+#
+
+cc_library(
+    name = "c3",
+    srcs = glob(
+        ["*.h"],
+        exclude = [
+            "c3.h",
+            "*_tests.c",
+        ],
+    ),
+    hdrs = ["c3.h"],
+    # We define platform-specific macros here to avoid the need for a
+    # configuration header file.
+    defines = [
+        # We don't build on any big endian CPUs.
+        "U3_OS_ENDIAN_little=1",
+    ] + select({
+        "@platforms//cpu:aarch64": ["U3_CPU_aarch64=1"],
+        "//conditions:default": [],
+    }) + select({
+        "@platforms//os:freebsd": [
+            "U3_OS_bsd=1",
+        ],
+        "@platforms//os:linux": [
+            "U3_OS_linux=1",
+            "U3_OS_PROF=1",
+        ],
+        "@platforms//os:macos": [
+            "U3_OS_osx=1",
+            # TODO: check if this works on M1 Macs.
+            "U3_OS_PROF=1",
+        ],
+        "@platforms//os:openbsd": [
+            "U3_OS_bsd=1",
+            "U3_OS_no_ubc=1",
+        ],
+        "@platforms//os:windows": ["U3_OS_mingw=1"],
+    }),
+    include_prefix = "c3",
+    includes = ["."],
+    linkstatic = True,
+    visibility = ["//pkg:__subpackages__"],
+)
+
+#
+# TESTS
+#
--- a/pkg/c3/c3.h
+++ b/pkg/c3/c3.h
@ -0,0 +1,11 @@
+/// @file
+
+#ifndef C3_H
+#define C3_H
+
+#include "defs.h"
+#include "motes.h"
+#include "portable.h"
+#include "types.h"
+
+#endif /* ifndef C3_H */
--- a/pkg/c3/defs.h
+++ b/pkg/c3/defs.h
@ -1,6 +1,13 @@
+/// @file
+
 #ifndef C3_DEFS_H
 #define C3_DEFS_H

+#include "portable.h"
+#include "types.h"
+
+#include <errno.h>
+
  /** Loobeans - inverse booleans to match nock.
  **/
 #     define c3y      0
@ -21,7 +28,6 @@
 #       define c3_assert(x)                       \
          do {                                    \
            if (!(x)) {                           \
-              c3_cooked();                        \
              assert(x);                          \
            }                                     \
          } while(0)
@ -33,7 +39,6 @@
              fprintf(stderr, "\rAssertion '%s' " \
                      "failed in %s:%d\r\n",      \
                      #x, __FILE__, __LINE__);    \
-              c3_cooked();                        \
              assert(x);                          \
            }                                     \
          } while(0)
@ -70,11 +75,6 @@
    */
 #     define c3_rotw(r, x)  ( ((x) << (r)) | ((x) >> (32 - (r))) )

-    /* Emergency stdio fix.
-    */
-      int
-      c3_cooked();
-
    /* Fill 16 words (64 bytes) with high-quality entropy.
    */
      void
--- a/pkg/c3/motes.h
+++ b/pkg/c3/motes.h
@ -1,6 +1,10 @@
+/// @file
+
 #ifndef C3_MOTES_H
 #define C3_MOTES_H

+#include "defs.h"
+
  /** Definitions.
  **/

--- a/pkg/c3/portable.h
+++ b/pkg/c3/portable.h
@ -1,8 +1,8 @@
+/// @file
+
 #ifndef C3_PORTABLE_H
 #define C3_PORTABLE_H

-#include "config.h"
-
 #   ifndef __GNUC__
 #     error "port me"
 #   endif
@ -179,14 +179,6 @@
 #     error "port: LoomBase"
 #   endif

-  /** Global variable control.
-  ***
-  *** To instantiate globals, #define c3_global as extern.
-  **/
-#   ifndef c3_global
-#     define c3_global
-#   endif
-

  /** External, OS-independent library dependencies.
  **/
--- a/pkg/c3/types.h
+++ b/pkg/c3/types.h
@ -1,6 +1,10 @@
+/// @file
+
 #ifndef C3_TYPES_H
 #define C3_TYPES_H

+#include "portable.h"
+
  /** Integer typedefs.
  **/
    /* Canonical integers.
--- a/pkg/ent/BUILD.bazel
+++ b/pkg/ent/BUILD.bazel
@ -0,0 +1,44 @@
+#
+# LIBRARIES
+#
+
+cc_library(
+    name = "ent",
+    srcs = ["ent.c"],
+    hdrs = ["ent.h"],
+    copts = [
+        "-O3",
+        "-Wall",
+        "-Werror",
+        "-pedantic",
+        "-std=gnu99",
+    ],
+    include_prefix = "ent",
+    includes = ["."],
+    linkstatic = True,
+    local_defines = select({
+        "@platforms//os:windows": ["ENT_GETENTROPY_BCRYPTGENRANDOM"],
+        # TODO: support fallback to other options if `getrandom()` isn't
+        # available in `unistd.h`. Preferred order (from most preferred to least
+        # preferred) is:
+        # - ENT_GETENTROPY_UNISTD
+        # - ENT_GETENTROPY_SYSRANDOM
+        # - ENT_GETRANDOM_SYSCALL
+        # - ENT_DEV_URANDOM
+        "//conditions:default": ["ENT_GETENTROPY_UNISTD"],
+    }),
+    visibility = ["//:__subpackages__"],
+)
+
+#
+# TESTS
+#
+
+cc_test(
+    name = "tests",
+    timeout = "short",
+    srcs = ["tests.c"],
+    linkstatic = True,
+    visibility = ["//visibility:private"],
+    deps = [":ent"],
+)
--- a/pkg/ent/Makefile
+++ b/pkg/ent/Makefile
@ -1,29 +0,0 @@
-CC     ?= cc
-AR     ?= ar
-PREFIX ?= ./out
-
-ifndef IMPL
-$(error IMPL must be set)
-endif
-
-################################################################################
-
-.PHONY: all test install clean
-
-all: ent.c ent.h
-	$(CC) -D$(IMPL) -O3 -Wall -Werror -pedantic -std=gnu99 -c ent.c
-	$(AR) rcs libent.a ent.o
-
-test: all
-	$(CC) -D$(IMPL) -O3 -Wall -Werror -pedantic -std=gnu99 ent.c test.c -o test
-	./test
-
-install: all
-	@mkdir -p $(PREFIX)/lib/
-	@mkdir -p $(PREFIX)/include/
-	cp libent.a $(PREFIX)/lib/
-	cp ent.h $(PREFIX)/include/
-
-clean:
-	rm -f *.o *.a test
-	rm -rf ./out
--- a/pkg/ent/README.md
+++ b/pkg/ent/README.md
@ -9,10 +9,8 @@ kernel 3.17) on Linux, or `/dev/urandom` on other \*nix.
 ### Building and Testing

 ```bash
-./configure
-make
-make test
-PREFIX=/usr/local make install
+bazel build ...
+bazel test ...
 ```

 ### Why?
--- a/pkg/ent/configure
+++ b/pkg/ent/configure
@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-: "${MAKE:=make}"
-
-log () {
-  echo "$@" >&2;
-}
-
-for impl in ENT_GETENTROPY_UNISTD \
-            ENT_GETENTROPY_SYSRANDOM \
-            ENT_GETRANDOM_SYSCALL \
-            ENT_GETENTROPY_BCRYPTGENRANDOM \
-            ENT_DEV_URANDOM
-do
-    export IMPL=$impl
-
-    log "Trying IMPL=$IMPL"
-
-    if IMPL=$impl ${MAKE} >/dev/null 2>/dev/null
-    then sed -i 's|$(error IMPL must be set)|IMPL='"$impl"'|' Makefile
-         log "IMPL=$IMPL works"
-         exit 0
-    else log "IMPL=$IMPL failed"
-    fi
-done
-
-log "This shouldn't happen, something is broken."
-exit 1
--- a/pkg/ent/shell.nix
+++ b/pkg/ent/shell.nix
@ -1,8 +0,0 @@
-let
-
-  pkgs = import ../../default.nix { };
-
-in pkgs.shellFor {
-  name = "ent";
-  packages = ps: [ ps.ent ];
-}
--- a/pkg/ent/tests.c
+++ b/pkg/ent/tests.c
--- a/pkg/noun/BUILD.bazel
+++ b/pkg/noun/BUILD.bazel
@ -0,0 +1,88 @@
+#
+# LIBRARIES
+#
+
+cc_library(
+    name = "noun",
+    srcs = glob(
+        [
+            "*.c",
+            "*.h",
+            "jets/tree.c",
+            "jets/*.h",
+            "jets/**/*.c",
+        ],
+        exclude = [
+            "noun.h",
+            "*_tests.c",
+        ],
+    ),
+    hdrs = ["noun.h"],
+    includes = ["."],
+    linkstatic = True,
+    local_defines = ["U3_GUARD_PAGE"],
+    visibility = ["//pkg:__subpackages__"],
+    deps = [
+        "//pkg/c3",
+        "//pkg/ent",
+        "//pkg/ur",
+        "//pkg/urcrypt",
+        "@gmp",
+        "@murmur3",
+        "@openssl",
+        "@softfloat",
+    ] + select({
+        # We don't use `libsigsegv` on Windows because of performance reasons.
+        "@platforms//os:windows": [],
+        "//conditions:default": ["@sigsegv"],
+    }) + select({
+        "@platforms//os:macos": ["//pkg/noun/platform/darwin"],
+        "@platforms//os:linux": ["//pkg/noun/platform/linux"],
+        "@platforms//os:openbsd": ["//pkg/noun/platform/openbsd"],
+        "@platforms//os:windows": ["//pkg/noun/platform/mingw"],
+    }),
+)
+
+#
+# TESTS
+#
+
+cc_test(
+    name = "hashtable_tests",
+    timeout = "short",
+    srcs = ["hashtable_tests.c"],
+    visibility = ["//visibility:private"],
+    deps = [":noun"],
+)
+
+cc_test(
+    name = "jets_tests",
+    timeout = "short",
+    srcs = ["jets_tests.c"],
+    visibility = ["//visibility:private"],
+    deps = [":noun"],
+)
+
+cc_test(
+    name = "nock_tests",
+    timeout = "short",
+    srcs = ["nock_tests.c"],
+    visibility = ["//visibility:private"],
+    deps = [":noun"],
+)
+
+cc_test(
+    name = "retrieve_tests",
+    timeout = "short",
+    srcs = ["retrieve_tests.c"],
+    visibility = ["//visibility:private"],
+    deps = [":noun"],
+)
+
+cc_test(
+    name = "serial_tests",
+    timeout = "short",
+    srcs = ["serial_tests.c"],
+    visibility = ["//visibility:private"],
+    deps = [":noun"],
+)
--- a/pkg/noun/aliases.h
+++ b/pkg/noun/aliases.h
@ -1,115 +0,0 @@
-#ifndef U3_ALIASES_H
-#define U3_ALIASES_H
-
-  /**  Constants.
-  **/
-    /* u3_none - u3_noun which is not a noun.
-    */
-#     define u3_none  (u3_noun)0xffffffff
-
-    /* u3_nul: 0, hoon ~.
-    */
-#     define u3_nul   0
-
-    /* u3_blip: 0, hoon %$.
-    */
-#     define u3_blip  0
-
-
-  /**  Typedefs.
-  **/
-    /* u3_post: pointer offset into u3_Loom; _p suffix; declare as u3p().
-    */
-      typedef c3_w      u3_post;
-#     define u3p(type)  u3_post
-
-    /* u3_noun: tagged noun pointer.
-    **
-    **  If bit 31 is 0, a u3_noun is a direct 31-bit atom ("cat").
-    **  If bit 31 is 1 and bit 30 0, an indirect atom ("pug").
-    **  If bit 31 is 1 and bit 30 1, an indirect cell ("pom").
-    **
-    ** Bits 0-29 are a word offset against u3_Loom (u3_post).
-    */
-      typedef c3_w u3_noun;
-
-    /* u3_weak: u3_noun which may be u3_none (not a noun).
-    */
-      typedef u3_noun u3_weak;
-
-    /* u3_atom: u3_noun which must be an atom.
-    */
-      typedef u3_noun u3_atom;
-
-    /* u3_term: u3_noun which must be a term (@tas).
-    */
-      typedef u3_noun u3_term;
-
-    /* u3_cell, u3_trel, u3_qual, u3_quin: cell, triple, quadruple, quintuple.
-    */
-      typedef u3_noun u3_cell;
-      typedef u3_noun u3_trel;
-      typedef u3_noun u3_qual;
-      typedef u3_noun u3_quin;
-
-    /* u3_funk, u3_funq: unary and binary noun functions.
-    */
-      typedef u3_noun (*u3_funk)(u3_noun);
-      typedef u3_noun (*u3_funq)(u3_noun, u3_noun);
-
-
-  /**  Macros.
-  **/
-    /* u3_assure(): loobean assert, bailing with %fail.
-    */
-#     define u3_assure(x)  if ( !_(x) ) { u3m_bail(c3__fail); }
-
-    /* u3_assert(): loobean assert, bailing with %exit.
-    */
-#     define u3_assent(x)  if ( !_(x) ) { u3m_bail(c3__exit); }
-
-
-  /**  Aliases.
-  **/
-    /* u3h(), u3t(), u3at(): noun fragments.
-    */
-#     define u3h(som)          u3x_h(som)
-#     define u3t(som)          u3x_t(som)
-#     define u3at(axe, som)    u3x_at(axe, som)
-
-    /* u3nc(), u3nt(), u3nq(): tuple composition.
-    */
-#     define u3nc(a, b)        u3i_cell(a, b)
-#     define u3nt(a, b, c)     u3i_trel(a, b, c)
-#     define u3nq(a, b, c, d)  u3i_qual(a, b, c, d)
-
-
-    /* u3nl(), u3_none-terminated varargs list
-    */
-#     define u3nl              u3i_list
-
-    /* u3du(), u3ud(): noun/cell test.
-    */
-#     define u3du(som)         (u3r_du(som))
-#     define u3ud(som)         (u3r_ud(som))
-
-    /* u3k(), u3z(): reference counts.
-    */
-#     define u3k(som)          u3a_gain(som)
-#     define u3z(som)          u3a_lose(som)
-
-    /* u3do(), u3dc(), u3dt(), u3dq(): arvo calls.
-    */
-#     define  u3do(txt_c, arg)         u3v_do(txt_c, arg)
-#     define  u3dc(txt_c, a, b)        u3v_do(txt_c, u3nc(a, b))
-#     define  u3dt(txt_c, a, b, c)     u3v_do(txt_c, u3nt(a, b, c))
-#     define  u3dq(txt_c, a, b, c, d)  u3v_do(txt_c, u3nq(a, b, c, d))
-
-    /* u3to(), u3of(): offset/pointer conversion.
-    */
-#     define  u3to(type, x) ((type *) u3a_into(x))
-#     define  u3tn(type, x) (x == 0) ? (void *)0 :  ((type *) u3a_into(x))
-#     define  u3of(type, x) (u3a_outa((type *)x))
-
-
-#endif /* ifndef U3_ALIASES_H */
--- a/pkg/noun/allocate.c
+++ b/pkg/noun/allocate.c
@ -1,7 +1,16 @@
-/* g/a.c
-**
-*/
-#include "all.h"
+/// @file
+
+#include "allocate.h"
+
+#include "hashtable.h"
+#include "log.h"
+#include "manage.h"
+#include "options.h"
+#include "retrieve.h"
+#include "trace.h"
+#include "vortex.h"
+
+u3_road* u3a_Road;

 //  declarations of inline functions
 //
@ -2092,7 +2101,6 @@ _ca_print_leak(c3_c* cap_c, u3a_box* box_u, c3_ws use_ws)
 c3_w
 u3a_idle(u3a_road* rod_u)
 {
-  u3a_fbox* fox_u;
  c3_w i_w, fre_w = 0;

  for ( i_w = 0; i_w < u3a_fbox_no; i_w++ ) {
--- a/pkg/noun/allocate.h
+++ b/pkg/noun/allocate.h
@ -238,9 +238,12 @@
    */
 #     define u3a_is_atom(som)    c3o(u3a_is_cat(som), \
                                         u3a_is_pug(som))
+#     define u3ud(som)           u3a_is_atom(som)
+
    /* u3a_is_cell: yes if noun [som] is cell.
    */
 #     define u3a_is_cell(som)    u3a_is_pom(som)
+#     define u3du(som)           u3a_is_cell(som)

    /* u3a_h(): get head of cell [som]. Bail if [som] is not cell.
    */
@ -248,6 +251,7 @@
        ( _(u3a_is_cell(som)) \
           ? ( ((u3a_cell *)u3a_to_ptr(som))->hed )\
           : u3m_bail(c3__exit) )
+#     define u3h(som) u3a_h(som)

    /* u3a_t(): get tail of cell [som]. Bail if [som] is not cell.
    */
@ -255,14 +259,18 @@
        ( _(u3a_is_cell(som)) \
           ? ( ((u3a_cell *)u3a_to_ptr(som))->tel )\
           : u3m_bail(c3__exit) )
+#     define u3t(som) u3a_t(som)

    /* u3a_into(): convert loom offset [x] into generic pointer.
    */
 #     define  u3a_into(x) ((void *)(u3_Loom + (x)))
+#     define  u3to(type, x) ((type *)u3a_into(x))
+#     define  u3tn(type, x) (x) ? (type*)u3a_into(x) : (void*)NULL

    /* u3a_outa(): convert pointer [p] into word offset into loom.
    */
 #     define  u3a_outa(p) (((c3_w*)(void*)(p)) - u3_Loom)
+#     define  u3of(type, x) (u3a_outa((type*)x))

    /* u3a_is_north(): yes if road [r] is north road.
    */
@ -347,9 +355,8 @@

  /**  Globals.
  **/
-    /* u3_Road / u3R: current road (thread-local).
-    */
-      c3_global u3_road* u3a_Road;
+      /// Current road (thread-local).
+      extern u3_road* u3a_Road;
 #       define u3R  u3a_Road

    /* u3_Code: memory code.
@ -496,6 +503,7 @@
        */
          u3_weak
          u3a_gain(u3_weak som);
+#         define u3k(som) u3a_gain(som)

        /* u3a_take(): gain, copying juniors.
        */
@ -511,6 +519,7 @@
        */
          void
          u3a_lose(u3_weak som);
+#         define u3z(som) u3a_lose(som)

        /* u3a_wash(): wash all lazy mugs in subtree.  RETAIN.
        */
--- a/pkg/noun/boot_tests.c
+++ b/pkg/noun/boot_tests.c
@ -1,7 +1,9 @@
-#include "all.h"
+/// @file
+
+#include "ivory.h"
+#include "noun.h"
 #include "ur/ur.h"
-#include "vere/ivory.h"
-#include "vere/vere.h"
+#include "vere.h"

 /* _setup(): prepare for tests.
 */
--- a/Show More
+++ b/Show More