Add Nix flake and nixpkgs overlay for the CLI

.envrc

@@ -0,0 +1 @@
+use flake

.gitignore

@@ -6,6 +6,8 @@ target
 enclave.Dockerfile
 *.eif
 .metals/
+.direnv
+.env
 
 # Test Fixtures
 !/fixtures/*
@@ -78,3 +80,7 @@ Cargo.lock
 # Ignore all local history of files
 .history
 .ionide
+
+# Nix build output
+result
+result-*

README.md

@@ -10,6 +10,28 @@ Run the following command to install the Evervault CLI:
 curl https://cli.evervault.com/v4/install -sL | sh
 ```
 
+## Nix
+
+This repo is a flake, so you can run the CLI without installing it:
+```
+nix run github:evervault/evervault-cli -- --help
+```
+
+To make `nix-shell -p evervault-cli` work, add the overlay to your own Nix config
+(this is not in nixpkgs, so it has to be added per-machine):
+```
+mkdir -p ~/.config/nixpkgs/overlays
+cat > ~/.config/nixpkgs/overlays/evervault-cli.nix <<'EOF'
+final: prev: {
+  evervault-cli = final.callPackage "${builtins.fetchTarball
+    "https://github.com/evervault/evervault-cli/archive/refs/heads/main.tar.gz"}/nix/evervault-cli.nix" { };
+}
+EOF
+```
+
+Both build the CLI version pinned in [`nix/evervault-cli.nix`](nix/evervault-cli.nix);
+bump `version` and `srcHash` there when a new version is released.
+
 # [Documentation](https://docs.evervault.com/sdks/cli)
 For a full reference see the [Documentation Site](https://docs.evervault.com/sdks/cli). Try running `ev --help` to see the available commands.
 

flake.nix

@@ -0,0 +1,19 @@
+{
+  description = "Evervault CLI";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "aarch64-darwin" "x86_64-darwin" "aarch64-linux" "x86_64-linux" ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      overlays.default = import ./nix/overlay.nix;
+
+      packages = forAllSystems (pkgs: rec {
+        evervault-cli = pkgs.callPackage ./nix/evervault-cli.nix { };
+        default = evervault-cli;
+      });
+    };
+}

nix/evervault-cli.nix

@@ -0,0 +1,50 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+}:
+
+let
+  # Bump these together when a new CLI version is released.
+  version = "4.5.1";
+  srcHash = "sha256-I78wDnKxgj1rUPsBtl2tGKkLeSBTKgewhWAvFhivRDo=";
+
+  src = fetchFromGitHub {
+    owner = "evervault";
+    repo = "evervault-cli";
+    tag = "v${version}";
+    hash = srcHash;
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "evervault-cli";
+  inherit version src;
+
+  cargoLock.lockFile = "${src}/Cargo.lock";
+
+  # Mirrors crates/ev-cli/scripts/insert-cli-version.sh, which the release
+  # workflow runs so `ev --version` reports the released version.
+  postPatch = ''
+    substituteInPlace crates/ev-cli/Cargo.toml \
+      --replace-fail '1.0.0-dev' '${version}'
+  '';
+
+  cargoBuildFlags = [ "--package" "ev-cli" ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  # ev-cli enables openssl's `vendored` feature; build against nixpkgs' openssl instead.
+  env.OPENSSL_NO_VENDOR = "1";
+
+  # The test suite talks to the Evervault API.
+  doCheck = false;
+
+  meta = {
+    description = "Evervault CLI";
+    homepage = "https://github.com/evervault/evervault-cli";
+    license = lib.licenses.asl20;
+    mainProgram = "ev";
+  };
+}

nix/overlay.nix

@@ -0,0 +1,3 @@
+final: prev: {
+  evervault-cli = final.callPackage ./evervault-cli.nix { };
+}