fix(nix): drop tcl from sqlite on musl cross hosts to unblock fh-cache

[xmtp-coder-agent]

Resolves #3444

Summary

The Cache all Nix Outputs workflow has been failing repeatedly on the warp-macos-26-arm64-12x runner because tcl 8.6.16 (pinned via nixpkgs rev 09061f74…) does not cross-compile to {x86_64,aarch64}-unknown-linux-musl from a Darwin build host. There are two independent tcl bugs:

1. compat/mkstemp.c is missing <string.h> — strlen() is used without a declaration; gcc 15.2.0 promotes -Wimplicit-function-declaration to a hard error. Host-independent.
2. unix/configure defines TCL_WIDE_CLICKS + MAC_OSX_TCL from the build host's uname -s — specifically, configure.in:557 has an unguarded if test "`uname -s`" = "Darwin" branch that runs regardless of the --host triple. On a Darwin build host it unconditionally defines both macros, and tclUnixTime.c then pulls in <mach/mach_time.h> against a linux-musl sysroot. Darwin-build-host-only.

The cascade is tcl → sqlite → cargo-package-deps → bindings-node-js-napi / mls-validation-service → devour-output.

Why this only hits CI, not neekolas's laptop

cache.nixos.org hosts cross-compile outputs keyed by build-host. Hydra only builds the x86_64-linux → {x86_64,aarch64}-linux-musl cross chain, not aarch64-darwin → *-linux-musl. A developer on an Apple Silicon Mac who has ever had the target in their local store, uses a remote Linux builder, or populates /nix/store via just backend / dev/up can substitute the result and never touch the compile path. A cold macOS build is the only thing that reliably reproduces — which is exactly what #3408 made the fh-cache workflow do (active-build + invalidated WarpBuilds cache + new runner image + fresh flake.lock).

Previous attempt

Commit 4d17631 tried to patch tcl by exporting tcl_cv_sys_version=Linux in preConfigure, redirecting tcl's SC_CONFIG_SYSTEM autoconf macro. That was incomplete: the rogue uname -s check at configure.in:557 is a separate code path that the autoconf cache variable does not touch. A correct tcl patch would need to regenerate configure with autoreconf or patch both the generated script and the MAC_OSX_SRCS makefile variable — fragile across nixpkgs revisions.

Fix

Rather than fight tcl, sidestep it. sqlite only depends on tcl for its tclsqlite3 extension and its test harness. libxmtp consumes libsqlite3 directly via diesel/rusqlite, so --disable-tcl is safe. sqlite's autosetup uses the bundled autosetup/jimsh0.c for its own code generation when tcl is absent (documented at autosetup/sqlite-config.tcl:243).

The new overlay in nix/lib/default.nix:

(
  final: prev:
  prev.lib.optionalAttrs prev.stdenv.hostPlatform.isMusl {
    sqlite = prev.sqlite.overrideAttrs (old: {
      configureFlags =
        (prev.lib.filter (f: !(prev.lib.hasPrefix "--with-tcl=" f)) old.configureFlags)
        ++ [ "--disable-tcl" ];
      nativeBuildInputs = prev.lib.filter (p: !(prev.lib.hasPrefix "tcl" (p.pname or ""))) (
        old.nativeBuildInputs or [ ]
      );
      doCheck = false;
    });
  }
)

• Gated on stdenv.hostPlatform.isMusl — no-op for every other target.
• Strips --with-tcl=... from configureFlags and appends --disable-tcl (a first-party supported configuration in the nixpkgs sqlite derivation; it's already enabled on isStatic at sqlite/default.nix:85).
• Filters tcl* packages out of nativeBuildInputs.
• Disables doCheck — sqlite's test suite runs srctree-check.tcl via tclsh and would pull tcl back in otherwise.

Validation (all local)

• Musl x86_64 cross sqlite: builds cleanly; closure has zero tcl entries (verified via nix derivation show — inputs.drvs contains no tcl, env.configureFlags has only --disable-tcl, env.nativeBuildInputs has no tcl).

• Musl aarch64 cross sqlite: builds cleanly.

• End-to-end: mls-validation-service-x86_64-unknown-linux-musl (the canonical downstream target in the failing workflow) builds successfully from a cold store. Output: /nix/store/fybjfq0yjd5dk6hmd9jr2n2ymky4s9v0-mls-validation-service-x86_64-unknown-linux-musl-1.10.0.

• Native sqlite invariance: native drv hashes identical with and without the overlay:

  • x86_64-linux: 53j5kr3aq86wnyczwlmlh0a0n48nhnk4-sqlite-3.51.2.drv (both)
  • aarch64-darwin: 9lkza91vfmh6h5f2r3vdg1w04m3ymn0f-sqlite-3.51.2.drv (both)

  ⇒ non-musl consumers continue to substitute from cache.nixos.org with no cache-miss regression.

• nixfmt-rfc-style clean on nix/lib/default.nix.

• CI (pending): the Cache all Nix Outputs workflow on warp-macos-26-arm64-12x is the only test that exercises the actual cold darwin-host cross path; this PR's CI run is the definitive end-to-end check.

Test plan

• nix build of musl cross sqlite for both x86_64 and aarch64 succeeds locally.
• nix derivation show confirms no tcl in the overridden sqlite's inputs.drvs, env.configureFlags, or env.nativeBuildInputs.
• mls-validation-service-x86_64-unknown-linux-musl builds end-to-end from a cold store.
• Native sqlite drv hashes unchanged on x86_64-linux and aarch64-darwin (no regression for non-musl consumers).
• nixfmt-rfc-style clean.
• CI Cache all Nix Outputs workflow passes on warp-macos-26-arm64-12x.

🤖 Generated with Claude Code

Note

Disable TCL in sqlite builds on musl cross hosts

Adds a Nix overlay in nix/lib/default.nix that overrides the sqlite derivation when the host platform is musl. The override strips any --with-tcl= configure flag, appends --disable-tcl, removes tcl-related entries from nativeBuildInputs, and sets doCheck = false.

^{Macroscope summarized 2d99c88.}

[insipx]

in reality we should probably replace all sqlite references with sqlcipher, since that's what we actually use, but this fix is ok for now

[xmtp-coder-agent]

Ack — and agreed that a sqlcipher migration would be a cleaner long-term story. For this PR I traced the actual closure to make sure the override lands in the right place:

$ nix-store --query --requisites \
    $(nix eval --raw .#packages.x86_64-linux.mls-validation-service-x86_64-unknown-linux-musl.drvPath) \
  | grep -E '(sqlite|sqlcipher|tcl)'

Findings:

• sqlite-x86_64-unknown-linux-musl-3.51.2.drv is in the closure (pulled via libsqlite3-sys → rusqlite) — this is the derivation the overlay targets, and nix derivation show on it confirms zero tcl in inputs.drvs, --disable-tcl in configureFlags, and no tcl in nativeBuildInputs.
• sqlcipher is not in the closure at all for the mls-validation-service nix package — it's only referenced in nix/shells/{local,rust}.nix (dev shell) and nix/package/xnet-gui.nix. The bindings-node-js-napi and mls-validation-service musl builds link against plain libsqlite3 via libsqlite3-sys, not sqlcipher.
• Native tcl-8.6.16.drv (the build-host tcl, not cross) remains in the closure — pulled by native sqlite as a build-time tool. That's fine because native tcl on darwin builds against darwin headers and the cross-compile bug is only tripped when --host=*-linux-musl meets tcl_cv_sys_version=Darwin.

So for the failing chain (tcl-*-unknown-linux-musl → sqlite-*-unknown-linux-musl → bindings-node-js-napi / mls-validation-service), dropping tcl from the musl cross sqlite is the minimum that breaks it. A full sqlcipher migration would be a bigger surface change and wouldn't move this issue forward — sqlcipher also has a tcl dep, it'd just be pulling native tcl (same as sqlite does today) rather than cross-tcl. Happy to open a follow-up issue for the sqlcipher unification if you'd like.