fix: propagate vendored OpenSSL to http-client crate for Android build (codex 0.149.0), remove DioNanos fork input - #168
Conversation
…d (codex 0.149.0), remove DioNanos fork input ## Changes 1. record-run-id job: restrict to openai/codex only (exclude DioNanos fork) 2. Validate source_ref step: remove DioNanos fork case, upstream only 3. Configure V8 artifacts: remove fork-helper branch, always use host-repo helper 4. Apply Android build patches: add http-client vendored OpenSSL patch (mirrors core crate) 5. Cargo.lock management: save pre-patch hash, generate-lockfile once, use --locked thereafter 6. Diagnose openssl-sys: verify all 3 binaries (codex-cli, codex-exec, codex-code-mode-host) have vendored feature 7. Build step: convert to loop, emit cargo:vendored=1 proof per package Fixes codex 0.149.0 Android build failure where openssl-sys linker paths were not propagated to http-client crate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8a3d73b0b4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ -f "$d/output" ] && grep -q "cargo:vendored=1" "$d/output"; then | ||
| echo "openssl-sys vendored build confirmed for ${pkg} (${d})" | ||
| else | ||
| echo "ERROR: openssl-sys build for ${pkg} did not use vendored path (${d})" >&2 |
There was a problem hiding this comment.
When the first package compiles openssl-sys, Cargo normally creates two target/.../build/openssl-sys-* directories: an invocation directory containing output and a build-script executable directory without it. Both appear in NEW_DIRS, so this condition treats the normal executable directory as a non-vendored build and exits with status 1, causing every fresh workflow build to fail even when vendoring succeeded. Restrict the check to the directory containing output.
Useful? React with 👍 / 👎.
| cd source-repo/codex-rs && cargo tree --target aarch64-linux-android -i openssl-sys 2>&1 | head -5 || echo "openssl-sys not found (expected)" | ||
| fi | ||
| cd source-repo/codex-rs | ||
| cargo generate-lockfile |
There was a problem hiding this comment.
Running this on every build discards the lockfile shipped with the selected Codex tag: the installed cargo-generate-lockfile(1) documentation states that an existing lockfile is rebuilt using the latest available version of every package. Consequently, the subsequent --locked builds merely lock an newly resolved, time-dependent dependency set and can compile unreviewed versions published after the upstream release—or fail due to one—rather than reproducibly building the selected tag.
Useful? React with 👍 / 👎.
1 participant
Summary
Fixes codex 0.149.0 Android cross-compile failure where openssl-sys linker configuration was not propagated to http-client dependency.
Test plan