From 4129d93f72dc1e62543f648b75a971779cc78180 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dani=C3=ABl=20de=20Kok?= <me@danieldk.eu>
Date: Thu, 24 Sep 2026 09:47:26 +0000
Subject: [PATCH 1/2] nix-builder: remove ~9s eval time by moving to
 precompiled pandoc

---
 nix-builder/overlay.nix                 |  5 ++
 nix-builder/pkgs/pandoc-bin/default.nix | 74 +++++++++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 nix-builder/pkgs/pandoc-bin/default.nix

diff --git a/nix-builder/overlay.nix b/nix-builder/overlay.nix
index bb0065ed..5ed08264 100644
--- a/nix-builder/overlay.nix
+++ b/nix-builder/overlay.nix
@@ -26,6 +26,11 @@ final: prev:
 
   nvtx = final.callPackage ./pkgs/nvtx { };
 
+  # pandoc is used by a lot of packages to convert docs. However, evaluating
+  # pandoc evaluates a lot of pacakges in the Haskell package set. Avoid this
+  # by grabbing a binary for pandoc instead.
+  pandoc = final.callPackage ./pkgs/pandoc-bin { };
+
   metal-cpp = final.callPackage ./pkgs/metal-cpp { };
 
   rewrite-nix-paths-macho = final.callPackage ./pkgs/rewrite-nix-paths-macho { };
diff --git a/nix-builder/pkgs/pandoc-bin/default.nix b/nix-builder/pkgs/pandoc-bin/default.nix
new file mode 100644
index 00000000..e5809b14
--- /dev/null
+++ b/nix-builder/pkgs/pandoc-bin/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  unzip,
+}:
+
+let
+  version = "3.11";
+
+  binaries = {
+    x86_64-linux = {
+      suffix = "linux-amd64.tar.gz";
+      hash = "sha256-N+2zu89yL5IaAJlBv1h04uDAkmMibJtKLZgHiMsGKrY=";
+    };
+    aarch64-linux = {
+      suffix = "linux-arm64.tar.gz";
+      hash = "sha256-Vu1VZuxB0i7J7gcE5qwLmLoQLpI4Tv1TBhc6ItMUx5o=";
+    };
+    aarch64-darwin = {
+      suffix = "arm64-macOS.zip";
+      hash = "sha256-FYBr7flRe/6tcuiP5qZpZjXDaR77tuFSFzRA6cW7ULQ=";
+    };
+    x86_64-darwin = {
+      suffix = "x86_64-macOS.zip";
+      hash = "sha256-OxwbV/FgESyCHQLyPZRu3ot/V6bM9GMqJaUS0zSpKR8=";
+    };
+  };
+
+  binary =
+    binaries.${stdenv.hostPlatform.system}
+      or (throw "pandoc-bin: unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
+  pname = "pandoc";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/jgm/pandoc/releases/download/${version}/pandoc-${version}-${binary.suffix}";
+    inherit (binary) hash;
+  };
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ unzip ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  dontStrip = true;
+
+  # musl binaries, so do not need to be patched.
+  dontPatchELF = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 bin/pandoc -t "$out/bin"
+    if [ -d share/man ]; then
+      mkdir -p "$out/share"
+      cp -r share/man "$out/share/"
+    fi
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Conversion between documentation formats";
+    homepage = "https://pandoc.org";
+    changelog = "https://github.com/jgm/pandoc/releases/tag/${version}";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "pandoc";
+    platforms = builtins.attrNames binaries;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+}

From 562426ceab10751be9c38cc41e6eee06fd7ffb88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dani=C3=ABl=20de=20Kok?= <me@danieldk.eu>
Date: Thu, 24 Sep 2026 09:49:49 +0000
Subject: [PATCH 2/2] nix-builder: cut eval time by 4.1s by sharing Cargo.lock
 eval

---
 nix-builder/overlay.nix                             | 9 +++++++++
 nix-builder/pkgs/kernel-builder/default.nix         | 8 ++------
 nix-builder/pkgs/python-modules/kernels/default.nix | 8 ++------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/nix-builder/overlay.nix b/nix-builder/overlay.nix
index 5ed08264..781b7a20 100644
--- a/nix-builder/overlay.nix
+++ b/nix-builder/overlay.nix
@@ -22,6 +22,15 @@ final: prev:
 
   kernel-layout-check = final.callPackage ./pkgs/kernel-layout-check { };
 
+  # The same Cargo.lock is used by kernel-builder and the kernels Python
+  # package. Evaluate Cargo.lock only once and use it in both packages.
+  kernelsCargoDeps = final.rustPlatform.importCargoLock {
+    lockFile = ../Cargo.lock;
+    outputHashes = {
+      "hf-hub-1.1.0" = "sha256-wClUTCmphrO4QM+IYwYrNxyvDp8qBGAPdP+Wca8TgRA=";
+    };
+  };
+
   lock-kernel-deps = final.callPackage ./pkgs/lock-kernel-deps { };
 
   nvtx = final.callPackage ./pkgs/nvtx { };
diff --git a/nix-builder/pkgs/kernel-builder/default.nix b/nix-builder/pkgs/kernel-builder/default.nix
index 7ce34beb..4d2be0ad 100644
--- a/nix-builder/pkgs/kernel-builder/default.nix
+++ b/nix-builder/pkgs/kernel-builder/default.nix
@@ -5,6 +5,7 @@
   pkg-config,
   libgit2,
   openssl,
+  kernelsCargoDeps,
 
   # Git provenance (`{ sha, dirty }`, or `null` for a non-git source) of the
   # `kernel-builder` flake. It is burned into the binary at build time and
@@ -67,12 +68,7 @@ rustPlatform.buildRustPackage (
         inherit lib sourceFiles;
       };
 
-    cargoLock = {
-      lockFile = ../../../Cargo.lock;
-      outputHashes = {
-        "hf-hub-1.1.0" = "sha256-wClUTCmphrO4QM+IYwYrNxyvDp8qBGAPdP+Wca8TgRA=";
-      };
-    };
+    cargoDeps = kernelsCargoDeps;
 
     cargoBuildFlags = cargoFlags;
     cargoTestFlags = cargoFlags;
diff --git a/nix-builder/pkgs/python-modules/kernels/default.nix b/nix-builder/pkgs/python-modules/kernels/default.nix
index f503d320..5363a0e9 100644
--- a/nix-builder/pkgs/python-modules/kernels/default.nix
+++ b/nix-builder/pkgs/python-modules/kernels/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   rustPlatform,
+  kernelsCargoDeps,
 
   huggingface-hub,
   pyyaml,
@@ -41,12 +42,7 @@ buildPythonPackage {
       inherit lib sourceFiles;
     };
 
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ../../../../Cargo.lock;
-    outputHashes = {
-      "hf-hub-1.1.0" = "sha256-wClUTCmphrO4QM+IYwYrNxyvDp8qBGAPdP+Wca8TgRA=";
-    };
-  };
+  cargoDeps = kernelsCargoDeps;
 
   maturinBuildFlags = cargoFlags;