push sheeet

pkgs/development/compilers/graalvm/community-edition/buildGraalvm.nix

@@ -0,0 +1,275 @@
+{
+  lib,
+  stdenv,
+  alsa-lib,
+  autoPatchelfHook,
+  cairo,
+  cups,
+  fontconfig,
+  glib,
+  glibc,
+  gtk3,
+  makeWrapper,
+  musl,
+  runCommandCC,
+  setJavaClassPath,
+  unzip,
+  xorg,
+  zlib,
+  # extra params
+  extraCLibs ? [ ],
+  gtkSupport ? stdenv.hostPlatform.isLinux,
+  useMusl ? false,
+  ...
+}@args:
+
+let
+  extraArgs = removeAttrs args [
+    "lib"
+    "stdenv"
+    "alsa-lib"
+    "autoPatchelfHook"
+    "cairo"
+    "cups"
+    "darwin"
+    "darwinMinVersionHook"
+    "fontconfig"
+    "glib"
+    "glibc"
+    "gtk3"
+    "makeWrapper"
+    "musl"
+    "runCommandCC"
+    "setJavaClassPath"
+    "unzip"
+    "xorg"
+    "zlib"
+    "extraCLibs"
+    "gtkSupport"
+    "useMusl"
+    "passthru"
+    "meta"
+  ];
+
+  cLibs = lib.optionals stdenv.hostPlatform.isLinux (
+    [
+      glibc
+      zlib.static
+    ]
+    ++ lib.optionals (!useMusl) [ glibc.static ]
+    ++ lib.optionals useMusl [ musl ]
+    ++ extraCLibs
+  );
+
+  # GraalVM 21.3.0+ expects musl-gcc as <system>-musl-gcc
+  musl-gcc = (
+    runCommandCC "musl-gcc" { } ''
+      mkdir -p $out/bin
+      ln -s ${lib.getDev musl}/bin/musl-gcc $out/bin/${stdenv.hostPlatform.system}-musl-gcc
+    ''
+  );
+  binPath = lib.makeBinPath (lib.optionals useMusl [ musl-gcc ] ++ [ stdenv.cc ]);
+
+  runtimeLibraryPath = lib.makeLibraryPath (
+    [ cups ]
+    ++ lib.optionals gtkSupport [
+      cairo
+      glib
+      gtk3
+    ]
+  );
+
+  graalvm-ce = stdenv.mkDerivation (
+    {
+      pname = "graalvm-ce";
+
+      unpackPhase = ''
+        runHook preUnpack
+
+        mkdir -p "$out"
+
+        # The tarball on Linux has the following directory structure:
+        #
+        #   graalvm-ce-java11-20.3.0/*
+        #
+        # while on Darwin it looks like this:
+        #
+        #   graalvm-ce-java11-20.3.0/Contents/Home/*
+        #
+        # We therefor use --strip-components=1 vs 3 depending on the platform.
+        tar xf "$src" -C "$out" --strip-components=${if stdenv.hostPlatform.isLinux then "1" else "3"}
+
+        # Sanity check
+        if [ ! -d "$out/bin" ]; then
+          echo "The `bin` is directory missing after extracting the graalvm"
+          echo "tarball, please compare the directory structure of the"
+          echo "tarball with what happens in the unpackPhase (in particular"
+          echo "with regards to the `--strip-components` flag)."
+          exit 1
+        fi
+
+        runHook postUnpack
+      '';
+
+      dontStrip = true;
+
+      nativeBuildInputs = [
+        unzip
+        makeWrapper
+      ]
+      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+
+      propagatedBuildInputs = [
+        setJavaClassPath
+        zlib
+      ];
+
+      buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+        alsa-lib # libasound.so wanted by lib/libjsound.so
+        fontconfig
+        (lib.getLib stdenv.cc.cc) # libstdc++.so.6
+        xorg.libX11
+        xorg.libXext
+        xorg.libXi
+        xorg.libXrender
+        xorg.libXtst
+      ];
+
+      postInstall =
+        let
+          cLibsAsFlags = (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs);
+          preservedNixVariables = [
+            "-ENIX_BINTOOLS"
+            "-ENIX_BINTOOLS_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}"
+            "-ENIX_BUILD_CORES"
+            "-ENIX_BUILD_TOP"
+            "-ENIX_CC"
+            "-ENIX_CC_WRAPPER_TARGET_HOST_${stdenv.cc.suffixSalt}"
+            "-ENIX_CFLAGS_COMPILE"
+            "-ENIX_HARDENING_ENABLE"
+            "-ENIX_LDFLAGS"
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            "-ELOCALE_ARCHIVE"
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isDarwin [
+            "-EDEVELOPER_DIR"
+            "-EDEVELOPER_DIR_FOR_BUILD"
+            "-EDEVELOPER_DIR_FOR_TARGET"
+            "-EMACOSX_DEPLOYMENT_TARGET"
+            "-EMACOSX_DEPLOYMENT_TARGET_FOR_BUILD"
+            "-EMACOSX_DEPLOYMENT_TARGET_FOR_TARGET"
+            "-ENIX_APPLE_SDK_VERSION"
+          ];
+          preservedNixVariablesAsFlags = (map (f: "--add-flags '${f}'") preservedNixVariables);
+        in
+        ''
+          # jni.h expects jni_md.h to be in the header search path.
+          ln -sf $out/include/linux/*_md.h $out/include/
+
+          mkdir -p $out/share
+          # move files in $out like LICENSE.txt
+          find $out/ -maxdepth 1 -type f -exec mv {} $out/share \;
+          # symbolic link to $out/lib/svm/LICENSE_NATIVEIMAGE.txt
+          rm -f $out/LICENSE_NATIVEIMAGE.txt
+
+          # copy-paste openjdk's preFixup
+          # Set JAVA_HOME automatically.
+          mkdir -p $out/nix-support
+          cat > $out/nix-support/setup-hook << EOF
+          if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+          EOF
+
+          wrapProgram $out/bin/native-image \
+            --prefix PATH : ${binPath} \
+            ${toString (cLibsAsFlags ++ preservedNixVariablesAsFlags)}
+        '';
+
+      preFixup = lib.optionalString (stdenv.hostPlatform.isLinux) ''
+        for bin in $(find "$out/bin" -executable -type f); do
+          wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+        done
+      '';
+
+      doInstallCheck = true;
+      installCheckPhase = ''
+        runHook preInstallCheck
+
+        ${
+          # broken in darwin
+          lib.optionalString stdenv.hostPlatform.isLinux ''
+            echo "Testing Jshell"
+            echo '1 + 1' | $out/bin/jshell
+          ''
+        }
+
+        echo ${lib.escapeShellArg ''
+          public class HelloWorld {
+            public static void main(String[] args) {
+              System.out.println("Hello World");
+            }
+          }
+        ''} > HelloWorld.java
+        $out/bin/javac HelloWorld.java
+
+        # run on JVM with Graal Compiler
+        echo "Testing GraalVM"
+        $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
+
+        echo "Ahead-Of-Time compilation"
+        $out/bin/native-image -H:+UnlockExperimentalVMOptions -H:-CheckToolchain -H:+ReportExceptionStackTraces -march=compatibility HelloWorld
+        ./helloworld | fgrep 'Hello World'
+
+        ${
+          # -H:+StaticExecutableWithDynamicLibC is only available in Linux
+          lib.optionalString (stdenv.hostPlatform.isLinux && !useMusl) ''
+            echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
+            $out/bin/native-image -H:+UnlockExperimentalVMOptions -H:+StaticExecutableWithDynamicLibC -march=compatibility $extraNativeImageArgs HelloWorld
+            ./helloworld | fgrep 'Hello World'
+          ''
+        }
+
+        ${
+          # --static is only available in x86_64 Linux
+          lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 && useMusl) ''
+            echo "Ahead-Of-Time compilation with --static and --libc=musl"
+            $out/bin/native-image $extraNativeImageArgs -march=compatibility --libc=musl --static HelloWorld
+            ./helloworld | fgrep 'Hello World'
+          ''
+        }
+
+        runHook postInstallCheck
+      '';
+
+      passthru = {
+        home = graalvm-ce;
+        updateScript = [
+          ./update.sh
+          "graalvm-ce"
+        ];
+      }
+      // (args.passhtru or { });
+
+      meta =
+        with lib;
+        (
+          {
+            homepage = "https://www.graalvm.org/";
+            description = "High-Performance Polyglot VM";
+            license = with licenses; [
+              upl
+              gpl2
+              classpathException20
+              bsd3
+            ];
+            sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+            mainProgram = "java";
+            teams = [ teams.graalvm-ce ];
+          }
+          // (args.meta or { })
+        );
+    }
+    // extraArgs
+  );
+in
+graalvm-ce

pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix

@@ -0,0 +1,94 @@
+{
+  lib,
+  stdenv,
+  autoPatchelfHook,
+  graalvm-ce,
+  makeWrapper,
+  zlib,
+  libxcrypt-legacy,
+  # extra params
+  product,
+  extraBuildInputs ? [ ],
+  extraNativeBuildInputs ? [ ],
+  ...
+}@args:
+
+let
+  extraArgs = removeAttrs args [
+    "lib"
+    "stdenv"
+    "autoPatchelfHook"
+    "darwin"
+    "graalvm-ce"
+    "libxcrypt-legacy"
+    "makeWrapper"
+    "zlib"
+    "product"
+    "extraBuildInputs"
+    "extraNativeBuildInputs"
+    "meta"
+  ];
+in
+stdenv.mkDerivation (
+  {
+    pname = product;
+
+    nativeBuildInputs = [
+      makeWrapper
+    ]
+    ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook
+    ++ extraNativeBuildInputs;
+
+    buildInputs = [
+      (lib.getLib stdenv.cc.cc) # libstdc++.so.6
+      zlib
+      libxcrypt-legacy # libcrypt.so.1 (default is .2 now)
+    ]
+    ++ extraBuildInputs;
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      mkdir -p "$out"
+
+      tar xf "$src" -C "$out" --strip-components=1
+
+      # Sanity check
+      if [ ! -d "$out/bin" ]; then
+        echo "The `bin` is directory missing after extracting the graalvm"
+        echo "tarball, please compare the directory structure of the"
+        echo "tarball with what happens in the unpackPhase (in particular"
+        echo "with regards to the `--strip-components` flag)."
+        exit 1
+      fi
+
+      runHook postUnpack
+    '';
+
+    dontStrip = true;
+
+    passthru = {
+      updateScript = [
+        ./update.sh
+        product
+      ];
+    }
+    // (args.passhtru or { });
+
+    meta = (
+      {
+        inherit (graalvm-ce.meta)
+          homepage
+          license
+          sourceProvenance
+          teams
+          platforms
+          ;
+        description = "High-Performance Polyglot VM (Product: ${product})";
+        mainProgram = "js";
+      }
+      // (args.meta or { })
+    );
+  }
+  // extraArgs
+)

pkgs/development/compilers/graalvm/community-edition/graaljs/default.nix

@@ -0,0 +1,18 @@
+{
+  stdenv,
+  fetchurl,
+  graalvmPackages,
+}:
+
+graalvmPackages.buildGraalvmProduct {
+  src = fetchurl (import ./hashes.nix).hashes.${stdenv.system};
+  version = (import ./hashes.nix).version;
+
+  product = "graaljs";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    echo "Testing GraalJS"
+    echo '1 + 1' | $out/bin/js
+  '';
+}

pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix

@@ -0,0 +1,22 @@
+# Generated by update.sh script
+{
+  "version" = "24.2.2";
+  "hashes" = {
+    "aarch64-linux" = {
+      sha256 = "02i4fnxvxcq4pr4110inf0dzzjwzdpa4017iya8vpb95p9w9dwxr";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graaljs-community-24.2.2-linux-aarch64.tar.gz";
+    };
+    "x86_64-linux" = {
+      sha256 = "1128mdclnbwy0rxfy5ang6ql29q27zadkzp6la3sbj97nwjqa42m";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graaljs-community-24.2.2-linux-amd64.tar.gz";
+    };
+    "x86_64-darwin" = {
+      sha256 = "0r6lsdp4d3zb3rzykqq10gbmsppbyzm13bgynf3brmvrp7cgpb40";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graaljs-community-24.2.2-macos-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0l9cyw8z5xsl7islfhn62wd3405qwc7pjx67jy2wc1hsf5xwgx3l";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graaljs-community-24.2.2-macos-aarch64.tar.gz";
+    };
+  };
+}

pkgs/development/compilers/graalvm/community-edition/graalnodejs/default.nix

@@ -0,0 +1,18 @@
+{
+  stdenv,
+  fetchurl,
+  graalvmPackages,
+}:
+
+graalvmPackages.buildGraalvmProduct {
+  src = fetchurl (import ./hashes.nix).hashes.${stdenv.system};
+  version = (import ./hashes.nix).version;
+
+  product = "graalnodejs";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    echo "Testing NodeJS"
+    $out/bin/npx --help
+  '';
+}

pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix

@@ -0,0 +1,22 @@
+# Generated by update.sh script
+{
+  "version" = "24.2.2";
+  "hashes" = {
+    "aarch64-linux" = {
+      sha256 = "0l6airl9801ih9zki9h95dwd8dh9k86rk36bsc2rs00h92snicjz";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graalnodejs-community-24.2.2-linux-aarch64.tar.gz";
+    };
+    "x86_64-linux" = {
+      sha256 = "13lyy507cxmwfch3vdg4jsqg9mb2lm1qnw62v7pd05bv6czb7ga4";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graalnodejs-community-24.2.2-linux-amd64.tar.gz";
+    };
+    "x86_64-darwin" = {
+      sha256 = "0awrhdm6sjarqgpwwhj6yl3maf2gyqqfkiim4p0zxdsjjiaxvvh3";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graalnodejs-community-24.2.2-macos-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "08q5b9wl1d13sby029x4r5lgp405dajlz6rrzk663ybl87halk91";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-24.2.2/graalnodejs-community-24.2.2-macos-aarch64.tar.gz";
+    };
+  };
+}

pkgs/development/compilers/graalvm/community-edition/graalpy/default.nix

@@ -0,0 +1,19 @@
+{
+  stdenv,
+  fetchurl,
+  graalvmPackages,
+}:
+
+graalvmPackages.buildGraalvmProduct {
+  src = fetchurl (import ./hashes.nix).hashes.${stdenv.system};
+  version = (import ./hashes.nix).version;
+
+  product = "graalpy";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    echo "Testing GraalPy"
+    $out/bin/graalpy -c 'print(1 + 1)'
+    echo '1 + 1' | $out/bin/graalpy
+  '';
+}

pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix

@@ -0,0 +1,22 @@
+# Generated by update.sh script
+{
+  "version" = "25.0.0";
+  "hashes" = {
+    "aarch64-linux" = {
+      sha256 = "1fwvrzddwnj8y6b393qmlk2pkm6gbb9rqdwlb3dim8s8x8nljrbh";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.0/graalpy-community-25.0.0-linux-aarch64.tar.gz";
+    };
+    "x86_64-linux" = {
+      sha256 = "1mc8nxxrsccj9hdkyykjw07x6k9ri29idsmvjjk3qahbyhm5x3b2";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.0/graalpy-community-25.0.0-linux-amd64.tar.gz";
+    };
+    "x86_64-darwin" = {
+      sha256 = "1v01nylz20kdz2zfaksxflj61liw09j8wksxipfcy5h03xjnx1hv";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.0/graalpy-community-25.0.0-macos-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0n5va1kg2x595ggrm46vq64xb1llxan711hfhf0yi9awyxjfkhff";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.0/graalpy-community-25.0.0-macos-aarch64.tar.gz";
+    };
+  };
+}

pkgs/development/compilers/graalvm/community-edition/graalvm-ce/default.nix

@@ -0,0 +1,13 @@
+{
+  stdenv,
+  fetchurl,
+  graalvmPackages,
+  useMusl ? false,
+}:
+
+graalvmPackages.buildGraalvm {
+  inherit useMusl;
+  src = fetchurl (import ./hashes.nix).hashes.${stdenv.system};
+  version = (import ./hashes.nix).version;
+  meta.platforms = builtins.attrNames (import ./hashes.nix).hashes;
+}

pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix

@@ -0,0 +1,22 @@
+# Generated by update.sh script
+{
+  "version" = "25.0.0";
+  "hashes" = {
+    "aarch64-linux" = {
+      sha256 = "08c9x9pcnkq853p984nzlivswjzvribx7xww9lbmsv002xv8ng3c";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_linux-aarch64_bin.tar.gz";
+    };
+    "x86_64-linux" = {
+      sha256 = "1pfki55vjzfq22ycphsp4kyzldmg3fr2qlacmqy30yiqjz7g4qhq";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_linux-x64_bin.tar.gz";
+    };
+    "x86_64-darwin" = {
+      sha256 = "13bp0rwvb1sbs0sqmkmdfbmngsphjdvp5mqxqyfy4h6hczw8q9q4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_macos-x64_bin.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0n3isdwkkkr7kpqqkpq7l02j39zvx6cx4ja0q6j611m9xnmdain4";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.0/graalvm-community-jdk-25.0.0_macos-aarch64_bin.tar.gz";
+    };
+  };
+}

pkgs/development/compilers/graalvm/community-edition/truffleruby/default.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  graalvmPackages,
+  libyaml,
+  openssl,
+}:
+
+graalvmPackages.buildGraalvmProduct {
+  src = fetchurl (import ./hashes.nix).hashes.${stdenv.system};
+  version = (import ./hashes.nix).version;
+
+  product = "truffleruby";
+
+  extraBuildInputs = [
+    libyaml
+    openssl
+  ];
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    patchelf $out/lib/mri/openssl.so \
+      --replace-needed libssl.so.10 libssl.so \
+      --replace-needed libcrypto.so.10 libcrypto.so
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    echo "Testing TruffleRuby"
+    # Fixup/silence warnings about wrong locale
+    export LANG=C
+    export LC_ALL=C
+    $out/bin/ruby -e 'puts(1 + 1)'
+    ${
+      # broken in darwin with sandbox enabled
+      lib.optionalString stdenv.hostPlatform.isLinux ''
+        echo '1 + 1' | $out/bin/irb
+      ''
+    }
+  '';
+}

pkgs/development/compilers/graalvm/community-edition/truffleruby/hashes.nix

@@ -0,0 +1,22 @@
+# Generated by update.sh script
+{
+  "version" = "25.0.0";
+  "hashes" = {
+    "aarch64-linux" = {
+      sha256 = "0fhx6ban2f489zsvn3kmf60sik9gs6xhd3j97kgd6cb9lkkg7x32";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-25.0.0/truffleruby-community-25.0.0-linux-aarch64.tar.gz";
+    };
+    "x86_64-linux" = {
+      sha256 = "1xamar6ff5r6cssa81bqnrv6qx269ng80yyhkp5ywl1n2q3d4jmb";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-25.0.0/truffleruby-community-25.0.0-linux-amd64.tar.gz";
+    };
+    "x86_64-darwin" = {
+      sha256 = "14pap9wm264a8m83ycyq86n4szs6vsy34czfr44kxahdjqf4hg24";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-25.0.0/truffleruby-community-25.0.0-macos-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0zkrqqjaq7ri4bllgnr0rmfx3j6hy6m9m58xcp5i8f5as7qy1kwh";
+      url = "https://github.com/oracle/truffleruby/releases/download/graal-25.0.0/truffleruby-community-25.0.0-macos-aarch64.tar.gz";
+    };
+  };
+}

pkgs/development/compilers/graalvm/community-edition/update.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p coreutils curl.out nix jq gnused -i bash
+
+# Usage:
+# ./update.sh [PRODUCT]
+#
+# Examples:
+#   $ ./update.sh graalvm-ce # will generate ./graalvm-ce/hashes.nix
+#   $ ./update.sh # same as above
+#   $ ./update.sh graalpy # will generate ./graalpy/hashes.nix
+#
+# Environment variables:
+# FORCE=1        to force the update of a product (e.g.: skip up-to-date checks)
+# VERSION=xx.xx  will assume that xx.xx is the new version
+
+set -eou pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+tmpfile="$(mktemp --suffix=.nix)"
+readonly tmpfile
+
+trap 'rm -rf "$tmpfile"' EXIT
+
+info() { echo "[INFO] $*"; }
+
+echo_file() { echo "$@" >> "$tmpfile"; }
+
+verlte() {
+    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
+}
+
+readonly product="${1:-graalvm-ce}"
+readonly hashes_nix="$product/hashes.nix"
+readonly nixpkgs=../../../../..
+
+mkdir -p "$product"
+
+declare -r -A update_urls=(
+  [graalvm-ce]="https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest"
+  [graaljs]="https://api.github.com/repos/oracle/graaljs/releases/latest"
+  [graalnodejs]="https://api.github.com/repos/oracle/graaljs/releases/latest"
+  [graalpy]="https://api.github.com/repos/oracle/graalpython/releases/latest"
+  [truffleruby]="https://api.github.com/repos/oracle/truffleruby/releases/latest"
+)
+
+current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A "graalvmCEPackages.${product}.version" --json | jq -r)"
+readonly current_version
+
+if [[ -z "${VERSION:-}" ]]; then
+  gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s "${update_urls[$product]}" | \
+      jq --raw-output .tag_name)"
+  new_version="${gh_version//jdk-/}"
+  new_version="${new_version//graal-/}"
+else
+  new_version="$VERSION"
+fi
+readonly new_version
+
+info "Current version: $current_version"
+info "New version: $new_version"
+if verlte "$new_version" "$current_version"; then
+  info "$product $current_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
+else
+  info "$product $current_version is out-of-date. Updating..."
+fi
+
+# Make sure to get the `-community` versions!
+declare -r -A products_urls=(
+  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${new_version}/graalvm-community-jdk-${new_version}_@platform@_bin.tar.gz"
+  [graaljs]="https://github.com/oracle/graaljs/releases/download/graal-${new_version}/graaljs-community-${new_version}-@platform@.tar.gz"
+  [graalnodejs]="https://github.com/oracle/graaljs/releases/download/graal-${new_version}/graalnodejs-community-${new_version}-@platform@.tar.gz"
+  [graalpy]="https://github.com/oracle/graalpython/releases/download/graal-${new_version}/graalpy-community-${new_version}-@platform@.tar.gz"
+  [truffleruby]="https://github.com/oracle/truffleruby/releases/download/graal-${new_version}/truffleruby-community-${new_version}-@platform@.tar.gz"
+)
+
+# Argh, this is really inconsistent...
+if [[ "$product" == "graalvm-ce" ]]; then
+  declare -r -A platforms=(
+    [aarch64-linux]="linux-aarch64"
+    [x86_64-linux]="linux-x64"
+    [aarch64-darwin]="macos-aarch64"
+    [x86_64-darwin]="macos-x64"
+  )
+else
+  declare -r -A platforms=(
+    [aarch64-linux]="linux-aarch64"
+    [x86_64-linux]="linux-amd64"
+    [aarch64-darwin]="macos-aarch64"
+    [x86_64-darwin]="macos-amd64"
+  )
+fi
+
+info "Generating '$hashes_nix' file for '$product' $new_version. This will take a while..."
+
+# Indentation of `echo_file` function is on purpose to make it easier to visualize the output
+echo_file "# Generated by $(basename $0) script"
+echo_file "{"
+echo_file "  \"version\" = \"$new_version\";"
+url="${products_urls["${product}"]}"
+echo_file "  \"hashes\" = {"
+for nix_platform in "${!platforms[@]}"; do
+  product_platform="${platforms[$nix_platform]}"
+  args=("${url//@platform@/$product_platform}")
+  # Get current hashes to skip derivations already in /nix/store to reuse cache when the version is the same
+  # e.g.: when adding a new product and running this script with FORCE=1
+  if [[ "$current_version" == "$new_version" ]] && \
+      previous_hash="$(nix-instantiate --eval "$hashes_nix" -A "hashes.$nix_platform.sha256" --json | jq -r)"; then
+      args+=("$previous_hash" "--type" "sha256")
+  else
+      info "Hash in '$product' for '$nix_platform' not found. Re-downloading it..."
+  fi
+  if hash="$(nix-prefetch-url "${args[@]}")"; then
+echo_file "    \"$nix_platform\" = {"
+echo_file "      sha256 = \"$hash\";"
+echo_file "      url = \"${url//@platform@/${product_platform}}\";"
+echo_file "    };"
+  else
+      info "Error while downloading '$product' for '$nix_platform'. Skipping it..."
+  fi
+done
+echo_file "  };"
+echo_file "}"
+
+info "Moving the temporary file to '$hashes_nix'"
+mv "$tmpfile" "$hashes_nix"
+
+info "Done!"

pkgs/development/compilers/graalvm/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  pkgs,
+  config,
+}:
+
+lib.makeScope pkgs.newScope (
+  self:
+  {
+    buildGraalvm = self.callPackage ./community-edition/buildGraalvm.nix;
+
+    buildGraalvmProduct = self.callPackage ./community-edition/buildGraalvmProduct.nix;
+
+    graalvm-ce = self.callPackage ./community-edition/graalvm-ce { };
+
+    graalvm-ce-musl = self.callPackage ./community-edition/graalvm-ce { useMusl = true; };
+
+    graaljs = self.callPackage ./community-edition/graaljs { };
+
+    graalnodejs = self.callPackage ./community-edition/graalnodejs { };
+
+    graalpy = self.callPackage ./community-edition/graalpy { };
+
+    truffleruby = self.callPackage ./community-edition/truffleruby { };
+
+    graalvm-oracle_25 = (self.callPackage ./graalvm-oracle { version = "25"; }).overrideAttrs (prev: {
+      autoPatchelfIgnoreMissingDeps = [ "libonnxruntime.so.1" ];
+    });
+    graalvm-oracle_17 = self.callPackage ./graalvm-oracle { version = "17"; };
+    graalvm-oracle = self.graalvm-oracle_25;
+  }
+  // lib.optionalAttrs config.allowAliases {
+    graalvm-oracle_22 = throw "GraalVM 22 is EOL, use a newer version instead";
+    graalvm-oracle_23 = throw "GraalVM 23 is EOL, use a newer version instead";
+    graalvm-oracle_24 = throw "GraalVM 24 is EOL, use a newer version instead";
+    graalvm-oracle_25-ea = throw "GraalVM 25-ea has been replaced by GraalVM 25";
+  }
+)

pkgs/development/compilers/graalvm/graalvm-oracle/default.nix

@@ -0,0 +1,16 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  graalvmPackages,
+  useMusl ? false,
+  version ? "25",
+}:
+
+graalvmPackages.buildGraalvm {
+  inherit useMusl version;
+  src = fetchurl (import ./hashes.nix).${version}.${stdenv.system};
+  meta.platforms = builtins.attrNames (import ./hashes.nix).${version};
+  meta.license = lib.licenses.unfree;
+  pname = "graalvm-oracle";
+}

pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix

@@ -0,0 +1,43 @@
+# To update, get the latest URLs from Archive Downloads, eg.
+# https://www.oracle.com/java/technologies/javase/graalvm-jdk23-archive-downloads.html
+# Then run this script:
+# $ rg -No "(https://.+)\"" -r '$1' pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix | \
+#   parallel -k 'echo {}; nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(curl -s {}.sha256)'
+{
+  "25" = {
+    "aarch64-linux" = {
+      hash = "sha256-pGirVIPXTz0p39qpybKbKSYaOp5JeG0hxKnACwbBVuo=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-aarch64_bin.tar.gz";
+    };
+    "x86_64-linux" = {
+      hash = "sha256-BNuoXdzg33UtbWngR2Z2/a0JmLfaXToPmq0f5uP/ocU=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-x64_bin.tar.gz";
+    };
+    "x86_64-darwin" = {
+      hash = "sha256-+Z4+6kgIoLc7VZ4oxGRs8JHfEtakwGX+80ZkqxcpkTc=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_macos-x64_bin.tar.gz";
+    };
+    "aarch64-darwin" = {
+      hash = "sha256-bnfxewEInf2wxUzOiqk2hH4qAZ4BEEGIE7SbO9l03JA=";
+      url = "https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_macos-aarch64_bin.tar.gz";
+    };
+  };
+  "17" = {
+    "aarch64-linux" = {
+      hash = "sha256-vZkdSGuS3rdDN7iB4PE6dkycHpD8NYgZCA9zIfpRdeg=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_linux-aarch64_bin.tar.gz";
+    };
+    "x86_64-linux" = {
+      hash = "sha256-tvPaziTPGWDseQIW9MhvANT0PfZOTotUj2OC8EiUcT8=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_linux-x64_bin.tar.gz";
+    };
+    "x86_64-darwin" = {
+      hash = "sha256-PsrBRx8/qVpWxbdcZdueYKxFUfVu2gnrnaleYEnqd9c=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_macos-x64_bin.tar.gz";
+    };
+    "aarch64-darwin" = {
+      hash = "sha256-TN/cbJOV9nc+/NGRtmBfG3yOG3irkAq1z/NHIKP+/8U=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_macos-aarch64_bin.tar.gz";
+    };
+  };
+}