Flake build fails on NixOS due to missing build dependencies for rama-boring-sys

What version of Codex CLI is running?

0.98

What subscription do you have?

pro

Which model were you using?

_No response_

What platform is your computer?

_No response_

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

\\\\\\\\\\## Problem

The flake fails to build when used as a package dependency with the following error:

error: builder failed with exit code 101

--- stderr

thread 'main' (14988) panicked at /build/cargo-vendor-dir/rama-boring-sys-0.5.11/build/main.rs:680:37:
called `Result::unwrap()` on an `Err` value: Os { code: 2, kind: NotFound, message: "No such file or directory" }

Root Cause

The build dependencies required for rama-boring-sys (which compiles BoringSSL) are declared in devShells.default but are missing from the package build itself.

Looking at the flake.nix:

devShells.default = pkgs.mkShell {
  buildInputs = [
    rust
    pkgs.pkg-config
    pkgs.openssl
    pkgs.cmake                    # ← These are needed
    pkgs.llvmPackages.clang       # ← but only in devShell
    pkgs.llvmPackages.libclang.lib
  ];
  # ...
};

But the packages.default (built with crane) doesn't include these as nativeBuildInputs.

Reproduction

nix build github:openai/codex

Suggested Fix

Add the same build dependencies to the crane package build. The crane builder should include:

packages = forAllSystems (system:
  let
    # ... existing setup ...
    
    commonArgs = {
      # ... existing args ...
      nativeBuildInputs = [
        pkgs.cmake
        pkgs.pkg-config
        pkgs.llvmPackages.clang
      ];
      buildInputs = [
        pkgs.openssl
        pkgs.llvmPackages.libclang.lib
      ];
      PKG_CONFIG_PATH = "${pkgs.openssl.dev}/lib/pkgconfig";
      LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
      CC = "clang";
      CXX = "clang++";
    };
  in {
    default = craneLib.buildPackage (commonArgs // {
      inherit cargoArtifacts;
    });
  }
);

Essentially, the package build needs the same dependencies that devShells already has.

Environment

• NixOS unstable
• Nix flakes enabled
• System: x86_64-linux
• Commit: 9a10121fd6e46866c9eade1d1b876a270b1b6d72

Workaround

Override the package in your flake to add missing dependencies:

overlays = [
  (final: prev: {
    codex-fixed = codex.packages.${final.system}.default.overrideAttrs (old: {
      nativeBuildInputs = (old.nativeBuildInputs or []) ++ [
        final.cmake
        final.pkg-config
        final.llvmPackages.clang
      ];
      buildInputs = (old.buildInputs or []) ++ [
        final.openssl
        final.llvmPackages.libclang.lib
      ];
      PKG_CONFIG_PATH = "${final.openssl.dev}/lib/pkgconfig";
      LIBCLANG_PATH = "${final.llvmPackages.libclang.lib}/lib";
      CC = "clang";
      CXX = "clang++";
    });
  })
];

What is the expected behavior?

_No response_

Additional information

_No response_