curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
rustup install nightly-2026-01-16
rustup default nightly-2026-01-16
rustup target add x86_64-unknown-uefi --toolchain nightly-2026-01-16
rustup component add rust-src --toolchain nightly-2026-01-16

{
  "llvm-target": "x86_64-unknown-none-elf",
  "arch": "x86_64",
  "vendor": "nonos",
  "os": "none",
  "data-layout": "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128",
  "target-endian": "little",
  "target-pointer-width": 64,
  "target-c-int-width": 32,
  "max-atomic-width": 64,
  "executables": true,
  "panic-strategy": "abort",
  "disable-redzone": true,
  "frame-pointer": "always",
  "cpu": "x86-64",
  "features": "+sse,+sse2,-sse3,-ssse3,-sse4.1,-sse4.2,-avx,-avx2,-mmx",
  "linker-flavor": "ld.lld",
  "linker": "rust-lld",
  "pre-link-args": {
    "ld.lld": ["-nostdlib", "-pie", "--gc-sections", "-z", "max-page-size=0x1000"]
  },
  "relocation-model": "pic",
  "code-model": "small",
  "position-independent-executables": true,
  "static-position-independent-executables": true,
  "no-default-libraries": true,
  "stack-probes": { "kind": "inline" },
  "eh-frame-header": false
}

rustc +nightly-2026-01-16 -vV | grep LLVM

default = [
  "nonos-syscall-int80", "nonos-log-serial", "nonos-log-vga",
  "nonos-heap-guard", "nonos-wx-audit", "nonos-page-zero",
  "nonos-kaslr", "nonos-pcid", "nonos-nx-stack",
  "nonos-smap-smep", "nonos-consttime", "nonos-cet",
  "nonos-apic", "nonos-smp", "arch-x86_64",
  "crypto-core", "crypto-aead", "crypto-ed25519-int", "crypto-curve25519",
  "mlkem768", "mldsa3", "zk-groth16",
  "cli", "sched", "ui",
  "fs-ram", "fs-vfs", "fs-cryptofs",
  "net-core", "net-sockets", "net-ipv4", "net-ipv6",
]

default = ["logging", "zk-groth16", "zk-vk-provisioned", "zk-zeroize"]

pip3 install pynacl

cd nonos-kernel && cargo build --target x86_64-nonos.json \
  -Zbuild-std=core,alloc -Zbuild-std-features=compiler-builtins-mem

cd nonos-boot && cargo build --target x86_64-unknown-uefi

[profile.dev]
panic = "abort"
opt-level = 0
debug = true
codegen-units = 1
overflow-checks = true

make all

[profile.release]
panic = "abort"
opt-level = 3
lto = false
strip = "none"
codegen-units = 1
overflow-checks = false

make kernel

cd nonos-kernel && \
  SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk \
  AR=/Library/Developer/CommandLineTools/usr/bin/ar \
  CC=/Library/Developer/CommandLineTools/usr/bin/clang \
  NONOS_SIGNING_KEY=$(pwd)/../keys/signing_key_v1.bin \
  cargo build --release --target x86_64-nonos.json \
    -Zbuild-std=core,alloc -Zbuild-std-features=compiler-builtins-mem

make bootloader

cd nonos-boot && \
  NONOS_SIGNING_KEY=$(pwd)/../keys/signing_key_v1.bin \
  cargo build --target x86_64-unknown-uefi --release --features zk-groth16

make iso

xorriso -as mkisofs -o target/nonos.iso -R -J -V "NONOS" \
  -e EFI/Boot/BOOTX64.EFI -no-emul-boot \
  -append_partition 2 0xef target/iso/EFI/Boot/BOOTX64.EFI \
  target/iso

make usb

make clean      # Build artifacts
make distclean  # Including dependencies

#[unsafe(naked)]
#[no_mangle]
#[link_section = ".text._start"]
pub extern "C" fn _start() -> ! {
    naked_asm!(
        "push rdi",

        // Enable SSE
        "mov rax, cr0",
        "and ax, 0xFFFB",
        "or ax, 0x2",
        "mov cr0, rax",

        "mov rax, cr4",
        "or ax, 0x600",
        "mov cr4, rax",

        "pop rdi",
        "call {rust_main}",
        "hlt",
        rust_main = sym rust_main,
    );
}

let mut h = Sha512::new();
h.update(b"NONOS_CAPSULE_V1");
h.update(data);
let digest = h.finalize();
let sig = keypair.sign(&digest);

from nacl.signing import SigningKey
from nacl.encoding import RawEncoder

def sign_kernel(kernel_path, key_path, output_path):
    kernel_data = Path(kernel_path).read_bytes()
    key_seed = Path(key_path).read_bytes()  # 32 bytes

    signing_key = SigningKey(key_seed)
    signed = signing_key.sign(kernel_data, encoder=RawEncoder)
    signature = signed.signature  # 64 bytes

    output_data = kernel_data + signature
    Path(output_path).write_bytes(output_data)

python3 scripts/sign_kernel.py \
  target/x86_64-nonos/release/nonos-kernel \
  keys/signing_key_v1.bin \
  target/kernel_signed.bin

fn generate_keys() {
    let signing_key_path = env::var("NONOS_SIGNING_KEY")
        .unwrap_or_else(|_| "keys/signing_key_v1.bin".to_string());

    let key_data = fs::read(&signing_key_path)?;
    let seed: [u8; 32] = key_data[..32].try_into()?;
    let public_key = derive_ed25519_public_key(&seed);
    let key_id = compute_key_id(&public_key);
}

fn compute_key_id(public_key: &[u8; 32]) -> [u8; 32] {
    let mut hasher = blake3::Hasher::new_derive_key("NONOS:KEYID:ED25519:v1");
    hasher.update(public_key);
    *hasher.finalize().as_bytes()
}

pub const NONOS_PUBLIC_KEY: [u8; 32] = [...];
pub const NONOS_KEY_ID: [u8; 32] = [...];
pub const KEY_FINGERPRINT: &str = "a1b2c3d4e5f6a7b8";
pub const BUILD_TIMESTAMP: u64 = 1709500800;
pub const KEY_VERSION: u32 = 1;

if !Path::new(default).exists() {
    let mut key = [0u8; 32];
    fs::File::open("/dev/urandom")?.read_exact(&mut key)?;
    fs::write(default, &key)?;
}

cd nonos-boot/tools/keygen
cargo build --release

./target/release/nonos-keygen \
  --count 1 \
  --out-dir ../../keys \
  --allow-write-secrets \
  --operator "release@nonos.systems"

impl<F: PrimeField> ConstraintSynthesizer<F> for NonosAttestationCircuit<F> {
    fn generate_constraints(self, cs: ConstraintSystemRef<F>) -> Result<(), SynthesisError> {
        // Public inputs
        let capsule_var = UInt8::<F>::new_input_vec(cs.clone(), &capsule_commitment_bytes)?;
        let program_hash_var = UInt8::<F>::new_input_vec(cs.clone(), &program_hash_bytes)?;

        // Witnesses
        let pcr_var = UInt8::<F>::new_witness_vec(cs.clone(), &pcr_bytes)?;
        let hw_var = FpVar::<F>::new_witness(cs.clone(), || Ok(F::from(hw_level)))?;

        // program_hash == expected
        for (i, &expected) in expected_program_hash_bytes().iter().enumerate() {
            let expected_var = UInt8::<F>::new_constant(cs.clone(), expected)?;
            program_hash_var[i].enforce_equal(&expected_var)?;
        }

        // PCR entropy >= minimum
        pcr_nonzero_count.enforce_cmp(&min_entropy, Ordering::Greater, false)?;

        // hw_level >= minimum
        hw_var.enforce_cmp(&min_hw_var, Ordering::Greater, false)?;

        // capsule_commitment != 0
        cc_nonzero.enforce_equal(&Boolean::TRUE)?;

        Ok(())
    }
}

./embed-zk-proof \
  --input target/kernel_signed.bin \
  --output target/kernel_attested.bin \
  --proof target/attestation_proof.bin \
  --program-hash fa02d10e8804169a47233e34a6ff3566248958adff55e1248d50304aff4ab230 \
  --public-inputs target/public_inputs.bin

pub const PROGRAM_HASH_BOOT_AUTHORITY: [u8; 32] = [
    0xfa, 0x02, 0xd1, 0x0e, 0x88, 0x04, 0x16, 0x9a, ...
];

pub const VK_BOOT_AUTHORITY_BLS12_381_GROTH16: &[u8] = &[
    0x86, 0x2c, 0xf4, 0x4b, ...  // 576 bytes
];

make generate-zk-keys

./generate-keys generate \
  --output generated_keys/ \
  --seed "nonos-production-attestation-v1-2026" \
  --allow-unsigned \
  --print-program-hash

make show-vk
# Paste into nonos-boot/src/zk/registry/keys.rs

mformat -i esp.img -F -v EFI ::

make run

qemu-system-x86_64 \
  -m 1G -cpu Haswell -machine q35 \
  -drive "format=raw,file=fat:rw:target/esp" \
  -drive if=pflash,format=raw,unit=0,readonly=on,file="firmware/OVMF.fd" \
  -drive if=pflash,format=raw,unit=1,readonly=on,file="firmware/OVMF_VARS.fd" \
  -device e1000,netdev=net0 -netdev user,id=net0 \
  -serial mon:stdio -vga std -no-reboot

make run-serial

make debug

gdb -ex 'target remote :1234'

screen /dev/ttyUSB0 115200

#[panic_handler]
fn panic(info: &PanicInfo) -> ! {
    serial_println!("[PANIC] {}", info);
    vga_panic(info);
    loop { unsafe { asm!("hlt"); } }
}

[build]
rustflags = [
    "-C", "link-arg=-Bsymbolic",
    "-C", "link-arg=--build-id=none",
]

[env]
SOURCE_DATE_EPOCH = "0"

[profile.release]
codegen-units = 1
lto = false

let epoch = std::env::var("SOURCE_DATE_EPOCH")
    .ok()
    .and_then(|s| s.parse().ok())
    .unwrap_or_else(|| SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs());

SOURCE_DATE_EPOCH=$(git log -1 --format=%ct) make all

# Machine A
SOURCE_DATE_EPOCH=0 NONOS_SIGNING_KEY=keys/test.key make all
sha256sum target/kernel_signed.bin > checksums_a.txt

# Machine B
SOURCE_DATE_EPOCH=0 NONOS_SIGNING_KEY=keys/test.key make all
sha256sum target/kernel_signed.bin > checksums_b.txt

diff checksums_a.txt checksums_b.txt

sed -i 's/version = "0.7.0"/version = "0.8.0"/' nonos-kernel/Cargo.toml
git add -A
git commit -m "Release v0.8.0"
git tag -a v0.8.0 -m "NØNOS v0.8.0"
git push origin main
git push origin v0.8.0

NONOS_SIGNING_KEY=/secure/release.key make all
make iso
make usb

cd target
sha256sum nonos.iso nonos.img > SHA256SUMS
b3sum nonos.iso nonos.img > B3SUMS
gpg --detach-sign --armor SHA256SUMS
gpg --detach-sign --armor B3SUMS

gpg --detach-sign --armor nonos.iso
scp nonos.iso nonos.iso.asc SHA256SUMS SHA256SUMS.asc B3SUMS B3SUMS.asc \
  releases@nonos.software:/var/www/releases/0.8.0/

export SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk
export AR=/Library/Developer/CommandLineTools/usr/bin/ar
export CC=/Library/Developer/CommandLineTools/usr/bin/clang

rustup component add rust-src --toolchain nightly-2026-01-16

mkdir -p keys
dd if=/dev/urandom of=keys/signing_key_v1.bin bs=32 count=1

make generate-zk-keys
make generate-zk-proof
make embed-zk-proof