Multiple Nix build failures

[Alb-O]

What version of Codex is running?

0.89.0

What subscription do you have?

Plus

Which model were you using?

No response

What platform is your computer?

Linux 6.6.87.2-microsoft-standard-WSL2 x86_64 unknown (NixOS)

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

Multiple Nix build failures; failed when trying to build codex-rs using the Rust toolchain from codex-rs/rust-toolchain.toml, plus missing fixed-output hashes.

1. Missing fixed-output hashes in cargoLock.outputHashes required for tokio-tungstenite-0.28.0 and tungstenite-0.28.0

2. Wrong rustc version from nixpkgs:

error: rustc 1.89.0 is not supported by the following packages:
  rama-core@0.3.0-alpha.4 requires rustc 1.91.0
  rama-dns@0.3.0-alpha.4 requires rustc 1.91.0

3. Missing rust overlay:

error: attribute 'rust-bin' missing
  at codex-rs/default.nix:9:15:
    toolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;

4. rama-boring-sys build script failed:

thread 'main' panicked at .../rama-boring-sys-0.5.9/build/main.rs:680:37:
called `Result::unwrap()` on an `Err` value: Os { code: 2, kind: NotFound, message: "No such file or directory" }

5. BoringSSL compile error:

error: 'void* __builtin_memcpy(...)' specified bound ... exceeds maximum object size ... [-Werror=stringop-overflow=]
cc1plus: all warnings being treated as errors

What steps can reproduce the bug?

from repo root run nix build .#codex-rs

What is the expected behavior?

Nix build should complete successfully

Additional information

The fix involves:

• Adding rust-overlay to flake.nix and using it to load rust-toolchain.toml.
• Adding missing cargoLock.outputHashes.
• Adding build inputs/env required by rama-boring-sys (git, cmake, python, perl, clang, libclang, LIBCLANG_PATH).
• Relaxing -Werror=stringop-overflow via NIX_CFLAGS_COMPILE to avoid glibc/boringssl warnings-as-errors.

Here's what I changed to get the build working, as a patch:

nix-fix.patch

[douglaz]

@etraut-openai yes, I believe #10302 fully fixes the issues here. The only difference in approach is using clang instead of gcc flags to fix the BoringSSL error. As far as I understand, clang is preferred for BoringSSL compilation.

[SyrupThinker]

Do the fixes for 4. and 5. in #10302 not only apply to the nix develop shell?

The actual package output built by nix build .#codex-rs (and nix run github:openai/codex) still seem affected, because they would have to be fixed in codex-rs/default.nix as well, as the suggested patch does.