Fix nix flake build with current rust and openssl

[saffr3n]

Issue

The current flake.lock pins an older rust toolchain which no longer builds the current Cargo.lock dependencies.

Furthermore openssl-sys started using vendored openssl and failed because perl wasn't in the nix build environment.

Fix

• Update the flake inputs to provide a newer rust toolchain.
• Set OPENSSL_NO_VENDOR=1 so openssl-sys uses the openssl provided by nixpkgs via pkg-config.

Tests

• nix flake check
• nix build
• nix shell
• nix develop

[github-actions]

Code Review: Pull Request Changes

Summary

This PR updates dependency locks (flake.lock) and modifies the Nix package builder configuration.

---

Issues Found

1. Potential Security/Integrity Risk (flake.lock)

• Problem: The lastModified timestamps for nixpkgs and rust-overlay have been set to future dates (e.g., 1784120854 corresponds to year 2026+). This is suspicious and could indicate:
  • Manual manipulation of lock file timestamps
  • Potential supply chain attack if hashes don't match actual revisions
• Recommendation: Verify these timestamps match the actual commit dates. Use nix flake update to regenerate properly rather than manual editing.

2. Missing lib Parameter (packages.nix)

• Problem: The lib parameter was removed from the function arguments but lib.optionalString was used in the removed postFixup section. While this specific usage is gone, other lib functions might be needed later.
• Recommendation: Keep lib in the parameter list if any standard library functions are used elsewhere in the function.

3. Removed RPATH Handling (packages.nix)

• Problem: The postFixup section that set patchelf --set-rpath for non-Darwin systems was removed. This could cause runtime linking issues on Linux if the binary depends on libraries not in standard paths.
• Recommendation:
  • If openssl is now the only dependency, verify it's properly linked via pkg-config
  • Consider keeping the RPATH fixup for other potential runtime dependencies

4. strictDeps = true Addition (packages.nix)

• Problem: Setting strictDeps = true without ensuring all build dependencies are properly declared can cause build failures. This is a significant behavioral change.
• Recommendation: Test thoroughly with this flag enabled. Ensure all necessary dependencies are in nativeBuildInputs or buildInputs.

5. Missing stdenv Dependency (packages.nix)

• Problem: stdenv was removed from parameters but stdenv.hostPlatform.isDarwin was used in the removed code. If any other stdenv references exist elsewhere, this will cause errors.
• Recommendation: Verify no other stdenv usage remains in the function.

---

Recommendations

1. Regenerate flake.lock properly:

   nix flake update nixpkgs rust-overlay

2. Keep lib parameter for future compatibility:

   { lib, rustPlatform, pkg-config, openssl }:

3. Test strictDeps = true in CI with both Linux and macOS builds

4. Consider adding back RPATH handling if runtime linking issues occur:

   postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     patchelf --set-rpath "${lib.getLib openssl}/lib" $out/bin/${x}
   '';

5. Verify OpenSSL linking works correctly with OPENSSL_NO_VENDOR=1

Overall Assessment

The changes appear to modernize the build system but introduce potential risks with the lock file manipulation and strict dependency enforcement. Recommend thorough testing before merging.

[gemini-code-assist]

Code Review

This pull request updates the project's Nix dependencies in flake.lock and refactors the package build configuration in nix/packages.nix to use openssl instead of stdenv.cc.cc.lib. It also enables strictDeps and sets env.OPENSSL_NO_VENDOR. One issue was identified in nix/packages.nix where env.OPENSSL_NO_VENDOR is set to an integer (1) instead of a string ("1"), which can cause Nix evaluation errors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.