feat: add Nix flake support for one-command installation #56931

Summary

This issue tracks adding Nix flake support so users can install and run Brave directly from GitHub without cloning or compiling manually.

What Nix provides

• Pure / Hermetic builds: every input — the prebuilt binary, glibc/libiconv, system libraries — is pinned in flake.lock. If it builds today, it builds in ten years.
• Reproducible: the exact same derivation always produces the exact same output bit-for-bit (modulo timestamps). No "works on my machine."
• Idempotent installs: running nix profile install twice is a no-op. The system reaches the declared state and stays there.
• Rollback-able: nix profile rollback restores the previous profile generation instantly. Broken update? One command back.
• Declarative: the entire build is a single expression (flake.nix). No imperative apt install, brew install dance.
• Cross-platform: same nix run github:brave/brave-browser works on macOS (Apple Silicon & Intel) and Linux. The flake handles platform-specific dependencies.
• Zero-install runs: nix run fetches from binary cache when available. No clone, no compile.
• No system pollution: nix profile install adds to a user-specific profile. Uninstall cleanly with nix profile remove. No orphaned global packages.
• Atomic upgrades / downgrades: profiles are switched atomically. No half-upgraded state.

Current gap

The project publishes prebuilt release artifacts (.deb for Linux, .zip for macOS) on the releases page, and nixpkgs already packages Brave via make-brave.nix. But there is no repo-owned flake, so users must rely on the nixpkgs channel's version (which lags behind upstream releases) or install manually.

Proposed change

• Add flake.nix that wraps the prebuilt release binary (reusing nixpkgs' brave packaging via overrideAttrs to swap in upstream version + per-platform SRI hashes). This avoids duplicating ~150 lines of patchelf/wrapGApps/desktop-fixup logic that nixpkgs already maintains.
• Add .github/workflows/nix-release.yml: a scheduled lag-check that auto-bumps version + per-platform sha256 hashes in flake.nix and opens a PR when the flake falls behind the latest stable release. Zero per-release manual maintenance.
• Add devbox.json for reproducible development environments.
• Update README.md with a Nix installation subsection.
• Update .gitignore with Nix build result symlinks.

Note: this is a Prebuilt Tarball Flake — it wraps the release binaries, it does not build from source (building Chromium/Brave from source is a different undertaking and lives in brave-core). Tag-pinning (github:brave/brave-browser/vX.Y.Z) does not work because the hash bump lands after the release tag is cut; use the default branch ref or a commit SHA for reproducibility.

Branch

feat-nix-package-manager-install on the fork.

Implementation

I have prepared the implementation in my fork at:
https://github.com/levonk/brave-browser/tree/feat-nix-package-manager-install

The changes include:

• flake.nix: Nix flake wrapping the prebuilt release binary as packages.<system>.default and apps.<system>.default, reusing nixpkgs brave packaging
• flake.lock: pinned nixpkgs-unstable input
• .github/workflows/nix-release.yml: scheduled lag-check automation that auto-bumps version + per-platform SRI hashes and opens a PR
• devbox.json: Devbox configuration for reproducible development environments
• .gitignore: added Nix build result symlinks
• README.md: added Nix installation subsection

Tested locally with nix flake check --no-build, nix build .#brave, and nix run .#brave -- --version (reports Brave Browser 150.1.92.134) on x86_64-darwin.