logiguard fork: GPUI xdg-activation keyboard-focus serial fix

Single-commit orphan branch: full zed-industries/zed @ 8c74db0 source tree
with a 3-file patch applied (no upstream history).

Patch (crates/gpui_linux/src/linux/wayland/):
  - serial.rs: add SerialKind::KeyboardEnter
  - client.rs: store wl_keyboard.enter serial; add latest_serial_of()
  - window.rs: activate() uses keyboard-enter serial (Mutter focus gate)

Mutter honors window activation only when the token carries the keyboard-
focus serial from wl_keyboard.enter; GPUI used a stale mouse-press serial.
See docs/tray-window-focus-wayland.md in logiguard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

nix/build.nix

@@ -0,0 +1,383 @@
+{
+  pkgs,
+  system,
+  lib,
+  stdenv,
+
+  apple-sdk_15,
+  darwin,
+  darwinMinVersionHook,
+
+  cargo-about,
+  cargo-bundle,
+  crane,
+  rustPlatform,
+  rustToolchain,
+
+  copyDesktopItems,
+  envsubst,
+  fetchFromGitHub,
+  makeFontsConf,
+  makeWrapper,
+
+  alsa-lib,
+  cmake,
+  curl,
+  fontconfig,
+  freetype,
+  git,
+  glib,
+  libdrm,
+  libgbm,
+  libgit2,
+  libglvnd,
+  libva,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxkbcommon,
+  libxrandr,
+  libx11,
+  libxcb,
+  nodejs_22,
+  openssl,
+  perl,
+  pkg-config,
+  protobuf,
+  sqlite,
+  vulkan-loader,
+  wayland,
+  xorg,
+  zlib,
+  zstd,
+
+  withGLES ? false,
+  profile ? "release",
+  commitSha ? null,
+}:
+assert withGLES -> stdenv.hostPlatform.isLinux;
+let
+  mkIncludeFilter =
+    root': path: type:
+    let
+      # note: under lazy-trees this introduces an extra copy
+      root = toString root' + "/";
+      relPath = lib.removePrefix root path;
+      topLevelIncludes = [
+        "crates"
+        "assets"
+        "extensions"
+        "script"
+        "tooling"
+        "Cargo.toml"
+        ".config" # nextest?
+        ".cargo"
+      ];
+      firstComp = builtins.head (lib.path.subpath.components relPath);
+    in
+    builtins.elem firstComp topLevelIncludes;
+
+  craneLib = crane.overrideToolchain rustToolchain;
+  gpu-lib = if withGLES then libglvnd else vulkan-loader;
+  commonArgs =
+    let
+      zedCargoLock = builtins.fromTOML (builtins.readFile ../crates/zed/Cargo.toml);
+      stdenv' = stdenv;
+    in
+    rec {
+      pname = "zed-editor";
+      version =
+        zedCargoLock.package.version
+        + "-nightly"
+        + lib.optionalString (commitSha != null) "+${builtins.substring 0 7 commitSha}";
+      src = builtins.path {
+        path = ../.;
+        filter = mkIncludeFilter ../.;
+        name = "source";
+      };
+
+      cargoLock = ../Cargo.lock;
+
+      nativeBuildInputs = [
+        cmake
+        copyDesktopItems
+        curl
+        perl
+        pkg-config
+        protobuf
+        # Pin cargo-about to 0.8.2. Newer versions don't work with the current license identifiers
+        # See https://github.com/zed-industries/zed/pull/44012
+        (cargo-about.overrideAttrs (
+          new: old: rec {
+            version = "0.8.2";
+
+            src = fetchFromGitHub {
+              owner = "EmbarkStudios";
+              repo = "cargo-about";
+              tag = version;
+              sha256 = "sha256-cNKZpDlfqEXeOE5lmu79AcKOawkPpk4PQCsBzNtIEbs=";
+            };
+
+            cargoHash = "sha256-NnocSs6UkuF/mCM3lIdFk+r51Iz2bHuYzMT/gEbT/nk=";
+
+            # NOTE: can drop once upstream uses `finalAttrs` here:
+            # https://github.com/NixOS/nixpkgs/blob/10214747f5e6e7cb5b9bdf9e018a3c7b3032f5af/pkgs/build-support/rust/build-rust-package/default.nix#L104
+            #
+            # See (for context): https://github.com/NixOS/nixpkgs/pull/382550
+            cargoDeps = rustPlatform.fetchCargoVendor {
+              inherit (new) src;
+              hash = new.cargoHash;
+              patches = new.cargoPatches or [ ];
+              name = new.cargoDepsName or new.finalPackage.name;
+            };
+          }
+        ))
+        rustPlatform.bindgenHook
+      ]
+      ++ lib.optionals stdenv'.hostPlatform.isLinux [ makeWrapper ]
+      ++ lib.optionals stdenv'.hostPlatform.isDarwin [
+        (cargo-bundle.overrideAttrs (
+          new: old: {
+            version = "0.6.1-zed";
+            src = fetchFromGitHub {
+              owner = "zed-industries";
+              repo = "cargo-bundle";
+              rev = "2be2669972dff3ddd4daf89a2cb29d2d06cad7c7";
+              hash = "sha256-cSvW0ND148AGdIGWg/ku0yIacVgW+9f1Nsi+kAQxVrI=";
+            };
+            cargoHash = "sha256-urn+A3yuw2uAO4HGmvQnKvWtHqvG9KHxNCCWTiytE4k=";
+
+            # NOTE: can drop once upstream uses `finalAttrs` here:
+            # https://github.com/NixOS/nixpkgs/blob/10214747f5e6e7cb5b9bdf9e018a3c7b3032f5af/pkgs/build-support/rust/build-rust-package/default.nix#L104
+            #
+            # See (for context): https://github.com/NixOS/nixpkgs/pull/382550
+            cargoDeps = rustPlatform.fetchCargoVendor {
+              inherit (new) src;
+              hash = new.cargoHash;
+              patches = new.cargoPatches or [ ];
+              name = new.cargoDepsName or new.finalPackage.name;
+            };
+          }
+        ))
+      ];
+
+      buildInputs = [
+        curl
+        fontconfig
+        freetype
+        # TODO: need staticlib of this for linking the musl remote server.
+        # should make it a separate derivation/flake output
+        # see https://crane.dev/examples/cross-musl.html
+        libgit2
+        openssl
+        sqlite
+        zlib
+        zstd
+      ]
+      ++ lib.optionals stdenv'.hostPlatform.isLinux [
+        alsa-lib
+        glib
+        libva
+        libxkbcommon
+        wayland
+        gpu-lib
+        libglvnd
+        libx11
+        libxcb
+        libdrm
+        libgbm
+        libva
+        libxcomposite
+        libxdamage
+        libxext
+        libxfixes
+        libxrandr
+      ]
+      ++ lib.optionals stdenv'.hostPlatform.isDarwin [
+        apple-sdk_15
+        (darwinMinVersionHook "10.15")
+      ];
+
+      cargoExtraArgs = "-p zed -p cli --locked --features=gpui_platform/runtime_shaders";
+
+      stdenv =
+        pkgs:
+        let
+          base = pkgs.llvmPackages.stdenv;
+          addBinTools = old: {
+            cc = old.cc.override {
+              inherit (pkgs.llvmPackages) bintools;
+            };
+          };
+          custom = lib.pipe base [
+            (stdenv: stdenv.override addBinTools)
+            pkgs.stdenvAdapters.useMoldLinker
+          ];
+        in
+        if stdenv'.hostPlatform.isLinux then custom else base;
+
+      env = {
+        ZSTD_SYS_USE_PKG_CONFIG = true;
+        FONTCONFIG_FILE = makeFontsConf {
+          fontDirectories = [
+            ../assets/fonts/lilex
+            ../assets/fonts/ibm-plex-sans
+          ];
+        };
+        ZED_UPDATE_EXPLANATION = "Zed has been installed using Nix. Auto-updates have thus been disabled.";
+        RELEASE_VERSION = version;
+        ZED_COMMIT_SHA = lib.optionalString (commitSha != null) "${commitSha}";
+        LK_CUSTOM_WEBRTC = pkgs.callPackage ./livekit-libwebrtc/package.nix { };
+        PROTOC = "${protobuf}/bin/protoc";
+
+        CARGO_PROFILE = profile;
+        # need to handle some profiles specially https://github.com/rust-lang/cargo/issues/11053
+        TARGET_DIR = "target/" + (if profile == "dev" then "debug" else profile);
+
+        # for some reason these deps being in buildInputs isn't enough, the only thing
+        # about them that's special is that they're manually dlopened at runtime
+        NIX_LDFLAGS = lib.optionalString stdenv'.hostPlatform.isLinux "-rpath ${
+          lib.makeLibraryPath [
+            gpu-lib
+            wayland
+            libva
+          ]
+        }";
+
+        NIX_OUTPATH_USED_AS_RANDOM_SEED = "norebuilds";
+      };
+
+      # prevent nix from removing the "unused" wayland/gpu-lib rpaths
+      dontPatchELF = stdenv'.hostPlatform.isLinux;
+
+      # TODO: try craneLib.cargoNextest separate output
+      # for now we're not worried about running our test suite (or tests for deps) in the nix sandbox
+      doCheck = false;
+
+      cargoVendorDir = craneLib.vendorCargoDeps {
+        inherit src cargoLock;
+        overrideVendorGitCheckout =
+          let
+            hasWebRtcSys = builtins.any (crate: crate.name == "webrtc-sys");
+            # we can't set $RUSTFLAGS because that clobbers the cargo config
+            # see https://github.com/rust-lang/cargo/issues/5376#issuecomment-2163350032
+            glesConfig = builtins.toFile "config.toml" ''
+              [target.'cfg(all())']
+              rustflags = ["--cfg", "gles"]
+            '';
+
+            # `webrtc-sys` expects a staticlib; nixpkgs' `livekit-webrtc` has been patched to
+            # produce a `dylib`... patching `webrtc-sys`'s build script is the easier option
+            # TODO: send livekit sdk a PR to make this configurable
+            postPatch = ''
+              substituteInPlace webrtc-sys/build.rs --replace-fail \
+                "cargo:rustc-link-lib=static=webrtc" "cargo:rustc-link-lib=dylib=webrtc"
+
+              substituteInPlace webrtc-sys/build.rs --replace-fail \
+                'add_gio_headers(&mut builder);' \
+                'for lib_name in ["glib-2.0", "gio-2.0"] {
+                    if let Ok(lib) = pkg_config::Config::new().cargo_metadata(false).probe(lib_name) {
+                        for path in lib.include_paths {
+                            builder.include(&path);
+                        }
+                    }
+                }'
+            ''
+            + lib.optionalString withGLES ''
+              cat ${glesConfig} >> .cargo/config/config.toml
+            '';
+          in
+          crates: drv:
+          if hasWebRtcSys crates then
+            drv.overrideAttrs (o: {
+              postPatch = (o.postPatch or "") + postPatch;
+            })
+          else
+            drv;
+      };
+    };
+  cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+in
+craneLib.buildPackage (
+  lib.recursiveUpdate commonArgs {
+    inherit cargoArtifacts;
+
+    dontUseCmakeConfigure = true;
+
+    # without the env var generate-licenses fails due to crane's fetchCargoVendor, see:
+    # https://github.com/zed-industries/zed/issues/19971#issuecomment-2688455390
+    # TODO: put this in a separate derivation that depends on src to avoid running it on every build
+    preBuild = ''
+      ALLOW_MISSING_LICENSES=yes bash script/generate-licenses
+      echo nightly > crates/zed/RELEASE_CHANNEL
+    '';
+
+    installPhase =
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          runHook preInstall
+
+          pushd crates/zed
+          sed -i "s/package.metadata.bundle-nightly/package.metadata.bundle/" Cargo.toml
+          export CARGO_BUNDLE_SKIP_BUILD=true
+          app_path="$(cargo bundle --profile $CARGO_PROFILE | xargs)"
+          popd
+
+          mkdir -p $out/Applications $out/bin
+          # Zed expects git next to its own binary
+          ln -s ${git}/bin/git "$app_path/Contents/MacOS/git"
+          mv $TARGET_DIR/cli "$app_path/Contents/MacOS/cli"
+          mv "$app_path" $out/Applications/
+
+          # Physical location of the CLI must be inside the app bundle as this is used
+          # to determine which app to start
+          ln -s "$out/Applications/Zed Nightly.app/Contents/MacOS/cli" $out/bin/zed
+
+          runHook postInstall
+        ''
+      else
+        ''
+          runHook preInstall
+
+          mkdir -p $out/bin $out/libexec
+          cp $TARGET_DIR/zed $out/libexec/zed-editor
+          cp $TARGET_DIR/cli  $out/bin/zed
+          ln -s $out/bin/zed $out/bin/zeditor  # home-manager expects the CLI binary to be here
+
+
+          install -D "crates/zed/resources/app-icon-nightly@2x.png" \
+            "$out/share/icons/hicolor/1024x1024@2x/apps/zed.png"
+          install -D crates/zed/resources/app-icon-nightly.png \
+            $out/share/icons/hicolor/512x512/apps/zed.png
+
+          # TODO: icons should probably be named "zed-nightly"
+          (
+            export DO_STARTUP_NOTIFY="true"
+            export APP_CLI="zed"
+            export APP_ICON="zed"
+            export APP_NAME="Zed Nightly"
+            export APP_ARGS="%U"
+            mkdir -p "$out/share/applications"
+            ${lib.getExe envsubst} < "crates/zed/resources/zed.desktop.in" > "$out/share/applications/dev.zed.Zed-Nightly.desktop"
+            chmod +x "$out/share/applications/dev.zed.Zed-Nightly.desktop"
+          )
+
+          runHook postInstall
+        '';
+
+    # TODO: why isn't this also done on macOS?
+    postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+      wrapProgram $out/libexec/zed-editor --suffix PATH : ${lib.makeBinPath [ nodejs_22 ]}
+    '';
+
+    meta = {
+      description = "High-performance, multiplayer code editor from the creators of Atom and Tree-sitter";
+      homepage = "https://zed.dev";
+      changelog = "https://zed.dev/releases/preview";
+      license = lib.licenses.gpl3Only;
+      mainProgram = "zed";
+      platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    };
+  }
+)

nix/dev/flake.lock

@@ -0,0 +1,45 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1761236834,
+        "narHash": "sha256-+pthv6hrL5VLW2UqPdISGuLiUZ6SnAXdd2DdUE+fV2Q=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d5faa84122bc0a1fd5d378492efce4e289f8eac1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "treefmt-nix": "treefmt-nix"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1766000401,
+        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/dev/flake.nix

@@ -0,0 +1,10 @@
+{
+  description = "Private inputs for development purposes. These are used by the top level flake in the `dev` partition, but do not appear in consumers' lock files.";
+
+  inputs = {
+    treefmt-nix.url = "github:numtide/treefmt-nix";
+  };
+
+  # This flake is only used for its inputs.
+  outputs = { ... }: { };
+}

nix/livekit-libwebrtc/0001-shared-libraries.patch

@@ -0,0 +1,17 @@
+--- a/BUILD.gn
++++ b/BUILD.gn
+@@ -143,8 +143,12 @@
+ # target_defaults and direct_dependent_settings.
+ config("common_inherited_config") {
+   defines = [ "PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII=0" ]
+-  cflags = []
+-  ldflags = []
++  cflags = [ "-fvisibility=default" ]
++  ldflags = [ "-lavutil", "-lavformat", "-lavcodec" ]
++
++  if (is_linux) {
++    ldflags += [ "-Wl,--version-script=" + rebase_path("//libwebrtc.version", root_build_dir) ]
++  }
+
+   if (rtc_objc_prefix != "") {
+     defines += [ "RTC_OBJC_TYPE_PREFIX=${rtc_objc_prefix}" ]

nix/livekit-libwebrtc/README.md

@@ -0,0 +1,7 @@
+# Vendored livekit-libwebrtc build
+
+The contents of this directory is vendored from [this nixpkgs
+PR](https://github.com/NixOS/nixpkgs/pull/478907).
+
+It should be removed as soon as said PR is merged and the new version of libwebrtc hits
+nixpkgs-unstable.

nix/livekit-libwebrtc/chromium-129-rust.patch

@@ -0,0 +1,21 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index 45086d6838cac..81132ad8ecb31 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -1727,16 +1727,6 @@ config("runtime_library") {
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+ 
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
+-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
+-  # library. The Rust symbols are marked as weak, so that they can be replaced by
+-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
+-  # order to cause that replacement to occur by explicitly linking in clang's
+-  # compiler-rt library.
+-  if (is_clang && !is_nacl && !is_cronet_build) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {

nix/livekit-libwebrtc/libwebrtc.version

@@ -0,0 +1,22 @@
+/* Linker version script for libwebrtc.so (Linux only).
+ *
+ * When libwebrtc.so is built with rtc_use_pipewire=true and
+ * -fvisibility=default, PipeWire lazy-load trampoline stubs (pw_*, spa_*)
+ * are exported as weak symbols. If the PipeWire ALSA plugin
+ * (libasound_module_pcm_pipewire.so) is later dlopen'd by libasound,
+ * the dynamic linker may resolve the plugin's pw_* references through
+ * libwebrtc.so's broken trampolines instead of the real libpipewire.so,
+ * causing a SIGSEGV (NULL function pointer dereference).
+ *
+ * This script hides only those third-party symbol namespaces while
+ * keeping every WebRTC / BoringSSL / internal symbol exported (which
+ * the Rust webrtc-sys bindings require).
+ */
+{
+  global:
+    *;
+
+  local:
+    pw_*;
+    spa_*;
+};

nix/livekit-libwebrtc/mkSystemLibraries.nix

@@ -0,0 +1,64 @@
+{
+  brotli,
+  fontconfig,
+  freetype,
+  harfbuzz,
+  icu,
+  jsoncpp,
+  libpng,
+  libwebp,
+  libxml2,
+  libxslt,
+  minizip,
+  ffmpeg_6,
+}:
+{
+  "brotli" = {
+    package = brotli;
+    path = "third_party/brotli/BUILD.gn";
+  };
+  "fontconfig" = {
+    package = fontconfig;
+    path = "third_party/fontconfig/BUILD.gn";
+  };
+  "freetype" = {
+    package = freetype;
+    path = "build/config/freetype/freetype.gni";
+  };
+  "harfbuzz-ng" = {
+    package = harfbuzz;
+    path = "third_party/harfbuzz-ng/harfbuzz.gni";
+  };
+  "jsoncpp" = {
+    package = jsoncpp;
+    path = "third_party/jsoncpp/BUILD.gn";
+  };
+  "icu" = {
+    package = icu;
+    path = "third_party/icu/BUILD.gn";
+  };
+  "libpng" = {
+    package = libpng;
+    path = "third_party/libpng/BUILD.gn";
+  };
+  "libwebp" = {
+    package = libwebp;
+    path = "third_party/libwebp/BUILD.gn";
+  };
+  "libxml" = {
+    package = libxml2;
+    path = "third_party/libxml/BUILD.gn";
+  };
+  "libxslt" = {
+    package = libxslt;
+    path = "third_party/libxslt/BUILD.gn";
+  };
+  "zlib" = {
+    package = minizip;
+    path = "third_party/zlib/BUILD.gn";
+  };
+  "ffmpeg" = {
+    package = ffmpeg_6;
+    path = "third_party/ffmpeg/BUILD.gn";
+  };
+}

nix/livekit-libwebrtc/package.nix

@@ -0,0 +1,353 @@
+{
+  stdenv,
+  clang,
+  gclient2nix,
+  lib,
+  gn,
+  fetchurl,
+  fetchpatch,
+  xcbuild,
+  python3,
+  ninja,
+  git,
+  cpio,
+  pkg-config,
+  glib,
+  alsa-lib,
+  pulseaudio,
+  nasm,
+  brotli,
+  fontconfig,
+  freetype,
+  harfbuzz,
+  icu,
+  jsoncpp,
+  libpng,
+  libwebp,
+  libxml2,
+  libxslt,
+  minizip,
+  ffmpeg_6,
+  libepoxy,
+  libgbm,
+  libGL,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrandr,
+  libxtst,
+  libx11,
+  libxi,
+  pipewire,
+  xorg,
+}:
+let
+  platformMap = {
+    "x86_64" = "x64";
+    "i686" = "x86";
+    "arm" = "arm";
+    "aarch64" = "arm64";
+  };
+  cpuName = stdenv.hostPlatform.parsed.cpu.name;
+  gnArch = platformMap."${cpuName}" or (throw "unsupported arch ${cpuName}");
+  gnOs =
+    if stdenv.hostPlatform.isLinux then
+      "linux"
+    else if stdenv.hostPlatform.isDarwin then
+      "mac"
+    else
+      throw "unknown platform ${stdenv.hostPlatform.config}";
+  boringSslSymbols = fetchurl {
+    url = "https://raw.githubusercontent.com/livekit/rust-sdks/refs/tags/webrtc-dac8015-6/webrtc-sys/libwebrtc/boringssl_prefix_symbols.txt";
+    hash = "sha256-dAweArv8zjsFPENEKi9mNBQkt4y+hh3rCqG6QZjRC20=";
+  };
+  gnSystemLibraries = import ./mkSystemLibraries.nix {
+    inherit
+      brotli
+      fontconfig
+      freetype
+      harfbuzz
+      icu
+      jsoncpp
+      libpng
+      libwebp
+      libxml2
+      libxslt
+      minizip
+      ffmpeg_6
+      ;
+  };
+in
+stdenv.mkDerivation {
+  pname = "livekit-libwebrtc";
+  version = "137-unstable-2025-11-24";
+
+  # libwebrtc loads libEGL/libGL at runtime via dlopen() in the Wayland
+  # screencast path, so they are not visible as ordinary DT_NEEDED edges.
+  # Keep an explicit rpath so the shared object can resolve them at runtime.
+  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux
+    "-rpath ${lib.makeLibraryPath [ libGL ]}";
+
+  # Prevent fixup from stripping the rpath above as "unused".
+  dontPatchELF = stdenv.hostPlatform.isLinux;
+
+  gclientDeps = gclient2nix.importGclientDeps ./sources.json;
+  sourceRoot = "src";
+
+  patches = [
+    # Adds missing dependencies to generated LICENSE
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_licenses.patch";
+      hash = "sha256-9A4KyRW1K3eoQxsTbPX0vOnj66TCs2Fxjpsu5wO8mGI=";
+    })
+    # Fixes the certificate chain, required for Let's Encrypt certs
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
+      hash = "sha256-RBvRcJzoKItpEbqpe07YZe1D1ZVGS12EnDSISldGy+0=";
+    })
+    # Adds dependencies and features required by livekit
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_deps.patch";
+      hash = "sha256-DwRtGdU5sppmiFsVuyhJoVCQrRl5JFmZJfxgUPhYXBg=";
+    })
+    # Fix gcc-related errors
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/force_gcc.patch";
+      hash = "sha256-1d73Pi1HkbunjYvp1NskUNE4xXbCmnh++rC6NrCJHbY=";
+      stripLen = 1;
+      extraPrefix = "build/";
+    })
+    # fix a gcc-related dav1d compile option
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/david_disable_gun_source_macro.patch";
+      hash = "sha256-RCZpeeSQHaxkL3dY2oFFXDjYeU0KHw7idQFONGge8+0=";
+      stripLen = 1;
+      extraPrefix = "third_party/";
+    })
+    # Required for dynamically linking to ffmpeg libraries, exposing symbols,
+    # and hiding PipeWire symbols via version script (Linux only) to prevent
+    # SIGSEGV when ALSA's PipeWire plugin is loaded.
+    ./0001-shared-libraries.patch
+    # Borrow a patch from chromium to prevent a build failure due to missing libclang libraries
+    ./chromium-129-rust.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace .gn \
+      --replace-fail "vpython3" "python3"
+
+    substituteInPlace tools/generate_shim_headers/generate_shim_headers.py \
+      --replace-fail "OFFICIAL_BUILD" "GOOGLE_CHROME_BUILD"
+
+    substituteInPlace BUILD.gn \
+      --replace-fail "rtc_static_library" "rtc_shared_library" \
+      --replace-fail "complete_static_lib = true" ""
+
+    substituteInPlace webrtc.gni \
+      --replace-fail "!build_with_chromium && is_component_build" "false"
+
+    substituteInPlace rtc_tools/BUILD.gn \
+      --replace-fail "\":frame_analyzer\"," ""
+
+    for lib in ${toString (builtins.attrNames gnSystemLibraries)}; do
+      if [ -d "third_party/$lib" ]; then
+        find "third_party/$lib" -type f \
+          \! -path "third_party/$lib/chromium/*" \
+          \! -path "third_party/$lib/google/*" \
+          \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
+          \! -regex '.*\.\(gn\|gni\|isolate\)' \
+          \! -name 'LICENSE*' \
+          \! -name 'COPYING*' \
+          -delete
+      fi
+    done
+
+    # Trick the update_rust.py script into thinking we have *this specific* rust available.
+    # It isn't actually needed for the libwebrtc build, but GN will fail if it isn't there.
+    mkdir -p third_party/rust-toolchain
+    (python3 tools/rust/update_rust.py --print-package-version || true) \
+      | head -n 1 \
+      | sed 's/.* expected Rust version is \([^ ]*\) .*/rustc 1.0 1234 (\1 chromium)/' \
+      > third_party/rust-toolchain/VERSION
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p buildtools/linux64
+    ln -sf ${lib.getExe gn} buildtools/linux64/gn
+    cp ${./libwebrtc.version} libwebrtc.version
+    substituteInPlace build/toolchain/linux/BUILD.gn \
+      --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p buildtools/mac
+    ln -sf ${lib.getExe gn} buildtools/mac/gn
+    chmod +x build/toolchain/apple/linker_driver.py
+    patchShebangs build/toolchain/apple/linker_driver.py
+    substituteInPlace build/toolchain/apple/toolchain.gni --replace-fail "/bin/cp -Rc" "cp -a"
+  '';
+
+  outputs = [
+    "dev"
+    "out"
+  ];
+
+  nativeBuildInputs =
+    (builtins.concatLists (
+      lib.mapAttrsToList (
+        _: library: if (library.package ? dev) then [ library.package.dev ] else [ ]
+      ) gnSystemLibraries
+    ))
+    ++ [
+      gclient2nix.gclientUnpackHook
+      gn
+      (python3.withPackages (ps: [ ps.setuptools ]))
+      ninja
+      git
+      cpio
+      pkg-config
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
+
+  buildInputs = [
+    nasm
+  ]
+  ++ (lib.mapAttrsToList (_: library: library.package) gnSystemLibraries)
+  ++ (lib.optionals stdenv.hostPlatform.isLinux [
+    glib
+    alsa-lib
+    pulseaudio
+    libepoxy
+    libgbm
+    libGL
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxrandr
+    libxtst
+    pipewire
+    libx11
+    libxi
+  ]);
+
+  preConfigure = ''
+    echo "generate_location_tags = true" >> build/config/gclient_args.gni
+    echo "0" > build/util/LASTCHANGE.committime
+
+    python build/linux/unbundle/replace_gn_files.py \
+        --system-libraries ${toString (builtins.attrNames gnSystemLibraries)}
+  '';
+
+  gnFlags = [
+    "is_debug=false"
+    "rtc_include_tests=false"
+    ''target_os="${gnOs}"''
+    ''target_cpu="${gnArch}"''
+    "treat_warnings_as_errors=false"
+    "rtc_enable_protobuf=false"
+    "rtc_include_tests=false"
+    "rtc_build_examples=false"
+    "rtc_build_tools=false"
+    "rtc_libvpx_build_vp9=true"
+    "enable_libaom=true"
+    "use_dummy_lastchange=true"
+    "is_component_build=true"
+    "enable_stripping=true"
+    "rtc_use_h264=true"
+    "rtc_use_h265=true"
+    "use_custom_libcxx=false"
+    "use_rtti=true"
+  ]
+  ++ (lib.optionals stdenv.hostPlatform.isLinux [
+    "rtc_use_pipewire=true"
+    "symbol_level=0"
+    "enable_iterator_debugging=false"
+    "rtc_use_x11=true"
+    "use_sysroot=false"
+    "use_custom_libcxx_for_host=false"
+    "use_libcxx_modules=false"
+    "use_llvm_libatomic=false"
+    "is_clang=false"
+  ])
+  ++ (lib.optionals stdenv.hostPlatform.isDarwin [
+    ''mac_deployment_target="${stdenv.hostPlatform.darwinMinVersion}"''
+    "rtc_enable_symbol_export=true"
+    "rtc_enable_objc_symbol_export=true"
+    "rtc_include_dav1d_in_internal_decoder_factory=true"
+    "clang_use_chrome_plugins=false"
+    "use_lld=false"
+    ''clang_base_path="${clang}"''
+  ]);
+
+  ninjaFlags = [
+    ":default"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "api/audio_codecs:builtin_audio_decoder_factory"
+    "api/task_queue:default_task_queue_factory"
+    "sdk:native_api"
+    "sdk:default_codec_factory_objc"
+    "pc:peer_connection"
+    "sdk:videocapture_objc"
+    "sdk:mac_framework_objc"
+    "desktop_capture_objc"
+  ];
+
+  postBuild =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      objcopy --redefine-syms="${boringSslSymbols}" "libwebrtc.so"
+    ''
+    + ''
+      # Generate licenses
+      python3 "../../tools_webrtc/libs/generate_licenses.py" \
+          --target ${if stdenv.hostPlatform.isDarwin then ":webrtc" else ":default"} $PWD $PWD
+    '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mkdir -p $dev/include
+
+    install -m0644 obj/webrtc.ninja obj/modules/desktop_capture/desktop_capture.ninja args.gn LICENSE.md $dev
+
+    pushd ../..
+    find . -name "*.h" -print | cpio -pd $dev/include
+    find . -name "*.inc" -print | cpio -pd $dev/include
+    popd
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -m0644 libwebrtc.so libthird_party_boringssl.so $out/lib
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install -m0644 WebRTC.framework/Versions/A/WebRTC $out/lib/libwebrtc.dylib
+    install -m0644 libthird_party_boringssl.dylib $out/lib
+  ''
+  + ''
+    ln -s $out/lib $dev/lib
+
+    runHook postInstall
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    boringssl="$out/lib/libthird_party_boringssl.dylib"
+    webrtc="$out/lib/libwebrtc.dylib"
+
+    install_name_tool -id "$boringssl" "$boringssl"
+    install_name_tool -id "$webrtc" "$webrtc"
+    install_name_tool -change @rpath/libthird_party_boringssl.dylib "$boringssl" "$webrtc"
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "WebRTC library used by livekit";
+    homepage = "https://github.com/livekit/rust-sdks/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      WeetHet
+      niklaskorz
+    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}

nix/livekit-libwebrtc/sources.json

@@ -0,0 +1,372 @@
+{
+    "src": {
+        "args": {
+            "hash": "sha256-+PgmOZD2Fi+SC66nguixhSwDsoXi4Sz693qOZZrLXm8=",
+            "owner": "webrtc-sdk",
+            "repo": "webrtc",
+            "rev": "624fa1dce239af785fc5fa9ca3b21b9250d3f835"
+        },
+        "fetcher": "fetchFromGitHub"
+    },
+    "src/base": {
+        "args": {
+            "hash": "sha256-MTG+pjMPY6/dqeEUy+xJVxPuICETtV98S+h/lFwGItg=",
+            "rev": "86c814633cf284bc8057a539bc722e2a672afe2f",
+            "url": "https://chromium.googlesource.com/chromium/src/base"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/build": {
+        "args": {
+            "hash": "sha256-qFZ12YFX4qxFEHU+VWOG+HDYYPXodgGz+iJ7WEc7cD8=",
+            "owner": "webrtc-sdk",
+            "repo": "build",
+            "rev": "01021e6c12636951a6b4e5342e16b2101b352367"
+        },
+        "fetcher": "fetchFromGitHub"
+    },
+    "src/buildtools": {
+        "args": {
+            "hash": "sha256-YWtmMKL1ydueNJ4XM/Pq+8OpqIFe5A6/vYyfZTv7/EI=",
+            "rev": "0f32cb9025766951122d4ed19aba87a94ded3f43",
+            "url": "https://chromium.googlesource.com/chromium/src/buildtools"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/testing": {
+        "args": {
+            "hash": "sha256-s65cABkyMo+FkAmilS67qM3VnrT7iYZg9scycrXzxyE=",
+            "rev": "a89c37d36bf80c05963727e28b9916835ae88d3a",
+            "url": "https://chromium.googlesource.com/chromium/src/testing"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party": {
+        "args": {
+            "hash": "sha256-q+xVOFlpC0vnLMSF9Z6ZRL7mb/cu8jBpsWjDNFFgiKM=",
+            "rev": "8062e0e102496ff14a8c58b586f014527424953d",
+            "url": "https://chromium.googlesource.com/chromium/src/third_party"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/boringssl/src": {
+        "args": {
+            "hash": "sha256-5Efqc8pLs4ZskXQGpFdTb5cw//v3+DR285m/DsrWSWA=",
+            "rev": "34492c89a8e381e0e856a686cc71b1eb5bd728db",
+            "url": "https://boringssl.googlesource.com/boringssl.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/breakpad/breakpad": {
+        "args": {
+            "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c=",
+            "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
+            "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/catapult": {
+        "args": {
+            "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw=",
+            "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
+            "url": "https://chromium.googlesource.com/catapult.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/ced/src": {
+        "args": {
+            "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY=",
+            "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
+            "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/clang-format/script": {
+        "args": {
+            "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
+            "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/colorama/src": {
+        "args": {
+            "hash": "sha256-6ZTdPYSHdQOLYMSnE+Tp7PgsVTs3U2awGu9Qb4Rg/tk=",
+            "rev": "3de9f013df4b470069d03d250224062e8cf15c49",
+            "url": "https://chromium.googlesource.com/external/colorama.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/compiler-rt/src": {
+        "args": {
+            "hash": "sha256-yo7BFGgwJNScsXwnCAu8gFBdZVS8/HJplzUk2e73mVg=",
+            "rev": "57213f125d03209892fed26189feb3b736e96735",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/crc32c/src": {
+        "args": {
+            "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
+            "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
+            "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/dav1d/libdav1d": {
+        "args": {
+            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
+            "rev": "8d956180934f16244bdb58b39175824775125e55",
+            "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/depot_tools": {
+        "args": {
+            "hash": "sha256-DWQyYtpAAGiryeGJzIWlUwY5yn4cNwXY957vlPDUNak=",
+            "rev": "fa8fc854e1766b86f10c9a15902cf3cc23adaac2",
+            "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/ffmpeg": {
+        "args": {
+            "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI=",
+            "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
+            "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/flatbuffers/src": {
+        "args": {
+            "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM=",
+            "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
+            "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/fontconfig/src": {
+        "args": {
+            "hash": "sha256-W5WIgC6A52kY4fNkbsDEa0o+dfd97Rl5NKfgnIRpI00=",
+            "rev": "14d466b30a8ab4a9d789977ed94f2c30e7209267",
+            "url": "https://chromium.googlesource.com/external/fontconfig.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/freetype/src": {
+        "args": {
+            "hash": "sha256-Vlin6Z+QisUyj6R+TclVOm8x6673YhUIWob9Ih6gzC8=",
+            "rev": "1da283b8ae6d6b94f34a5c4b8c1227adc9dbb1d8",
+            "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/fuzztest/src": {
+        "args": {
+            "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw=",
+            "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
+            "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/google_benchmark/src": {
+        "args": {
+            "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
+            "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
+            "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/googletest/src": {
+        "args": {
+            "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg=",
+            "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
+            "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/grpc/src": {
+        "args": {
+            "hash": "sha256-xivmP36VCSbiMAV3PDUjzCrF+AJzFXJdMe5e2q9yW/k=",
+            "rev": "957c9f95224b1e1318c0ecb98d0e7584ea5ccff2",
+            "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/gtest-parallel": {
+        "args": {
+            "hash": "sha256-VUuk5tBTh+aU2dxVWUF1FePWlKUJaWSiGSXk/J5zgHw=",
+            "rev": "96f4f904922f9bf66689e749c40f314845baaac8",
+            "url": "https://chromium.googlesource.com/external/github.com/google/gtest-parallel"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/harfbuzz-ng/src": {
+        "args": {
+            "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4=",
+            "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
+            "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/icu": {
+        "args": {
+            "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k=",
+            "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
+            "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/instrumented_libs": {
+        "args": {
+            "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
+            "rev": "69015643b3f68dbd438c010439c59adc52cac808",
+            "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/jsoncpp/source": {
+        "args": {
+            "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=",
+            "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
+            "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libFuzzer/src": {
+        "args": {
+            "hash": "sha256-Lb+HczYax0T7qvC0/Nwhc5l2szQTUYDouWRMD/Qz7sA=",
+            "rev": "e31b99917861f891308269c36a32363b120126bb",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libaom/source/libaom": {
+        "args": {
+            "hash": "sha256-ngVZ+xK0b+jKUmawteQ7VFAQzoebX4jqZ3hP9pW+Q0Q=",
+            "rev": "a23a4799ec2d7dd6e436c7b64a34553773014ed7",
+            "url": "https://aomedia.googlesource.com/aom.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libc++/src": {
+        "args": {
+            "hash": "sha256-lqeuVUgeAKm1pxo+w1vyUbBkBXBzLCQ+Lfu44neKLPo=",
+            "rev": "917609c669e43edc850eeb192a342434a54e1dfd",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libc++abi/src": {
+        "args": {
+            "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk=",
+            "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libjpeg_turbo": {
+        "args": {
+            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
+            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
+            "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libsrtp": {
+        "args": {
+            "hash": "sha256-bkG1+ss+1a2rCHGwZjhvf5UaNVbPPZJt9HZSIPBKGwM=",
+            "rev": "a52756acb1c5e133089c798736dd171567df11f5",
+            "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libunwind/src": {
+        "args": {
+            "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o=",
+            "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libvpx/source/libvpx": {
+        "args": {
+            "hash": "sha256-NIGpzP6elcPScHJlZmnPHJdmXsuHcbuELT0C4Ha5PcA=",
+            "rev": "ff1d193f4b9dfa9b2ced51efbb6ec7a69e58e88c",
+            "url": "https://chromium.googlesource.com/webm/libvpx.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/libyuv": {
+        "args": {
+            "hash": "sha256-b/EYCWBQvsNoGhea31DPBKpG8eouf0OBi5TgdHDHs9A=",
+            "rev": "1e40e34573c3861480d107cd4a4ce290df79951f",
+            "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/llvm-libc/src": {
+        "args": {
+            "hash": "sha256-yNNx3gOGafMNvZ+aebDKHVj6QM8g0zt0d69PWlWLkyk=",
+            "rev": "912274164f0877ca917c06e8484ad3be1784833a",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/lss": {
+        "args": {
+            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
+            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
+            "url": "https://chromium.googlesource.com/linux-syscall-support.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/nasm": {
+        "args": {
+            "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs=",
+            "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
+            "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/openh264/src": {
+        "args": {
+            "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
+            "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
+            "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/perfetto": {
+        "args": {
+            "hash": "sha256-I0qiAh3VliVop+3S2/tP6VwCAJOk0Vu7xy8vHJZ1w2A=",
+            "rev": "a54dd38d60593129ae56d400f1a72860670abea4",
+            "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/protobuf-javascript/src": {
+        "args": {
+            "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M=",
+            "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
+            "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/third_party/re2/src": {
+        "args": {
+            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
+            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
+            "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
+    "src/tools": {
+        "args": {
+            "hash": "sha256-kZFZl8SC9nZIIOVtNl/5H4huw6BCBsBkJVJ4gaUmly4=",
+            "rev": "ffcbc837bbb14d80d09147c2af5302ff6bd4bd69",
+            "url": "https://chromium.googlesource.com/chromium/src/tools"
+        },
+        "fetcher": "fetchFromGitiles"
+    }
+}

nix/livekit-libwebrtc/update.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gitMinimal curl gojq gclient2nix
+
+set -eou pipefail
+package="livekit-libwebrtc"
+pkg_dir="$(dirname "$0")"
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+gh-curl () {
+  curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "$1"
+}
+
+# Get the current version part before the "-unstable-" for the branch name.
+# To manually update to a new major version, you can also invoke the script
+# with the new major version, e.g., UPDATE_MAJOR_VERSION=137.
+old_version="${UPDATE_NIX_OLD_VERSION:-$(nix-instantiate --eval -E "(import \"$nixpkgs\" { }).$package.version" | tr -d '"')}"
+major_version="${UPDATE_MAJOR_VERSION:-${old_version%%-unstable-*}}"
+branch="m${major_version}_release"
+
+# Fetch the current HEAD commit of the release branch
+head="$(gh-curl "https://api.github.com/repos/webrtc-sdk/webrtc/git/refs/heads/$branch" | gojq '.object.sha' --raw-output)"
+if gojq -e ".src.args.rev == \"$head\"" "$pkg_dir/sources.json"; then
+  echo "$package is already up-to-date: $head"
+  exit 0
+fi
+
+# Get the commit's date for the version field
+date="$(gh-curl "https://api.github.com/repos/webrtc-sdk/webrtc/git/commits/$head" | gojq '.committer.date| split("T") | .[0]' --raw-output)"
+
+echo "Updating sources.json to $head"
+gclient2nix generate --root src "https://github.com/webrtc-sdk/webrtc@$head" > "$pkg_dir/sources.json"
+
+sed -i "s|$old_version|$major_version-unstable-$date|g" "$pkg_dir/package.nix"

nix/modules/devshells.nix

@@ -0,0 +1,79 @@
+{ inputs, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    let
+      # NOTE: Duplicated because this is in a separate flake-parts partition
+      # than ./packages.nix
+      mkZed = import ../toolchain.nix { inherit inputs; };
+      zed-editor = mkZed pkgs;
+
+      rustBin = inputs.rust-overlay.lib.mkRustBin { } pkgs;
+      rustToolchain = rustBin.fromRustupToolchainFile ../../rust-toolchain.toml;
+
+      baseEnv =
+        (zed-editor.overrideAttrs (attrs: {
+          passthru.env = attrs.env;
+        })).env; # exfil `env`; it's not in drvAttrs
+
+      # Musl cross-compiler for building remote_server
+      muslCross = pkgs.pkgsCross.musl64;
+
+      # Cargo build timings wrapper script
+      wrappedCargo = pkgs.writeShellApplication {
+        name = "cargo";
+        runtimeInputs = [ pkgs.nodejs ];
+        text =
+          let
+            pathToCargoScript = ./. + "/../../script/cargo";
+          in
+          ''
+            NIX_WRAPPER=1 CARGO=${rustToolchain}/bin/cargo ${pathToCargoScript} "$@"
+          '';
+      };
+    in
+    {
+      devShells.default = (pkgs.mkShell.override { inherit (zed-editor) stdenv; }) {
+        name = "zed-editor-dev";
+        inputsFrom = [ zed-editor ];
+
+        packages = with pkgs; [
+          wrappedCargo # must be first, to shadow the `cargo` provided by `rustToolchain`
+          rustToolchain # cargo, rustc, and rust-toolchain.toml components included
+          cargo-nextest
+          cargo-hakari
+          cargo-machete
+          cargo-zigbuild
+          # TODO: package protobuf-language-server for editing zed.proto
+          # TODO: add other tools used in our scripts
+
+          # `build.nix` adds this to the `zed-editor` wrapper (see `postFixup`)
+          # we'll just put it on `$PATH`:
+          nodejs_22
+          zig
+        ];
+
+        env =
+          (removeAttrs baseEnv [
+            "LK_CUSTOM_WEBRTC" # download the staticlib during the build as usual
+            "ZED_UPDATE_EXPLANATION" # allow auto-updates
+            "CARGO_PROFILE" # let you specify the profile
+            "TARGET_DIR"
+          ])
+          // {
+            # note: different than `$FONTCONFIG_FILE` in `build.nix` – this refers to relative paths
+            # outside the nix store instead of to `$src`
+            FONTCONFIG_FILE = pkgs.makeFontsConf {
+              fontDirectories = [
+                "./assets/fonts/lilex"
+                "./assets/fonts/ibm-plex-sans"
+              ];
+            };
+            PROTOC = "${pkgs.protobuf}/bin/protoc";
+            ZED_ZSTD_MUSL_LIB = "${pkgs.pkgsCross.musl64.pkgsStatic.zstd.out}/lib";
+            # For aws-lc-sys musl cross-compilation
+            CC_x86_64_unknown_linux_musl = "${muslCross.stdenv.cc}/bin/x86_64-unknown-linux-musl-gcc";
+          };
+      };
+    };
+}

nix/modules/overlays.nix

@@ -0,0 +1,11 @@
+{ inputs, ... }:
+{
+  flake.overlays.default =
+    final: _:
+    let
+      mkZed = import ../toolchain.nix { inherit inputs; };
+    in
+    {
+      zed-editor = mkZed final;
+    };
+}

nix/modules/packages.nix

@@ -0,0 +1,15 @@
+{ inputs, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    let
+      mkZed = import ../toolchain.nix { inherit inputs; };
+      zed-editor = mkZed pkgs;
+    in
+    {
+      packages = {
+        default = zed-editor;
+        debug = zed-editor.override { profile = "dev"; };
+      };
+    };
+}

nix/modules/partitions.nix

@@ -0,0 +1,25 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.flake-parts.flakeModules.partitions
+  ];
+
+  partitionedAttrs = {
+    devShells = "dev";
+    formatter = "dev";
+    checks = "dev";
+  };
+
+  partitions.dev = {
+    extraInputsFlake = ../dev;
+    module =
+      { inputs, ... }:
+      {
+        imports = [
+          inputs.treefmt-nix.flakeModule
+          ./devshells.nix
+          ./treefmt.nix
+        ];
+      };
+  };
+}

nix/modules/treefmt.nix

@@ -0,0 +1,10 @@
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      treefmt = {
+        programs.nixfmt.enable = true;
+        programs.rustfmt.enable = true;
+      };
+    };
+}

nix/toolchain.nix

@@ -0,0 +1,10 @@
+{ inputs, ... }:
+pkgs:
+let
+  rustBin = inputs.rust-overlay.lib.mkRustBin { } pkgs;
+in
+pkgs.callPackage ./build.nix {
+  crane = inputs.crane.mkLib pkgs;
+  rustToolchain = rustBin.fromRustupToolchainFile ../rust-toolchain.toml;
+  commitSha = inputs.self.rev or null;
+}