I haven't used Hydra much and have a question to see whether it might be a suitable tool for my usecase. I maintain a repository which defines some FPGA-targets for an embedded OS and I am providing pre-built FPGA bitstreams for these targets, so people don't have to install the heavyweight proprietary FPGA toolchains (>= 50GB binary blob) themselves.

I'm already building all of this with Nix, but using regular CI infrastructure like GitHub Actions or TravisCI to automate this is infeasible (can't redistribute the binary blob and it exceeds CI resource limitations).

If I were to build this with Hydra, can I

1. manually add the proprietary toolchain to the build system's nix-store as a garbage collector root and have Hydra use that for its builds, and
2. instruct Hydra to not offer / publish the proprietary toolchain itself? While it should be perfectly legal to compile a bitstream and redistribute that final artifact, I am not allowed to redistribute the toolchain itself. I do want to make the final artifacts available somewhere, although that doesn't have to be through Hydra directly.

1. required file
2. not easily

In reply to @andreas.schraegle:helsinki-systems.de
1. maybe/sort of yes. we build stuff like displaylink on our internal hydra, where you need to download the zip manually and agree to the license.
2. sure. hydra comes with a binary cache, but barely anyone uses it. you could just have a hook to only copy the bitstreams or use hydra-support stuff, to offer downloads.

In reply to @sandro:supersandro.de
well, I use the binary cache because plotting a nix-serve next to it is not really any different

In reply to @linus:schreibt.jetzt
What about adding the toolchain as an impure path? That way it never ends up in the store unless a derivation explicitly copies it in

Would you be suggesting that I install the toolchain elsewhere on that system and make it accessible to the build environment

Yes, exactly

One thing I'd like to retain is the ability for others to potentially use the built artifacts in a binary-cache style.

As long as the artifacts don't need the toolchain present to work, that should be fine