System
Everything Nerv builds is compiled from source against musl with LLVM. The base has no GNU userland and no glibc in it. glibc exists on the machine as an optional layer for software the user installs.
libc and allocator
The base links musl patched with mimalloc. libc, the allocator, init, the shell, the system tools and the editors are all built this way. musl is small and consistent, and mimalloc brings guard pages, randomised allocation and encrypted free lists to every process on the system rather than to the ones that opted in.
A second, glibc userland sits alongside it for packages that require one: CUDA, Fedora RPMs, pip wheels, vendor binaries. The two coexist because every ELF names its own interpreter, so a musl binary and a glibc binary never collide at runtime. The rule is enforced in one direction: nothing Nerv ships may link glibc, and the glibc layer is never a dependency of a Nerv package.
Packaging
rpm, libsolv, librepo and dnf5 are built against musl and run with no
glibc in their dependency trees. No other musl distribution ships rpm and
dnf5. It means two things: the system can rebuild itself, and
dnf install still reaches the Fedora package ecosystem when
you need something Nerv does not build.
| Component | Version | Notes |
|---|---|---|
rpm | 6.0.2 | musl; PGP via librpm, which drops the whole gpgme chain |
libsolv | 0.7.39 | built via librpm with comps enabled |
librepo | 1.20.0 | USE_GPGME=OFF |
dnf5 | 5.4.2.1 | links libdnf5, librpm, libc++, libunwind, musl — no glibc |
Toolchain
The base is built with LLVM and clang, linked with lld, using ThinLTO and per-target CPU tuning. One compiler across every package is what makes hardening a property of the system rather than of whichever packages enabled it: control-flow integrity, a subset of UBSan kept on at runtime, stack protection and position-independent executables apply everywhere.
Builds run in a pure-musl chroot composed from the local repository, not in a Fedora buildroot. Building a musl target inside a glibc buildroot bakes glibc-shaped answers into musl binaries, which is a class of bug that is very hard to find later.
Init and updates
systemd is PID 1, built against musl. dash is
/bin/sh for scripts and zsh is the interactive shell; bash is
a build-time dependency only and is not on a runtime slot.
The disk carries two btrfs subvolumes. An update composes into the slot you are not running and the bootloader default moves only after the new slot has booted. A failed update costs a reboot. The mechanism is cage.