Nix derivation for OpenAI's official Codex Linux app (.deb 26.810.41047)

codex-app.md

Official Codex app on NixOS

packages/codex-app.nix packages OpenAI's official x86_64 Linux .deb without running its Debian maintainer scripts. The source is the immutable, version-specific APT-pool object for 26.810.41047, pinned by SHA-256.

The upstream payload contains Electron, native Node modules, static helpers, glibc and musl fallbacks, optional Qt shims, and a bundled executable whose ELF section table cannot be rewritten by patchelf. The package therefore runs the unchanged payload inside a Nix-built FHS environment. The host's APT sources, keyring, AppArmor configuration, and /etc/default are never touched.

Build and verify

From this repository:

nix build .#packages.x86_64-linux.codex-app --no-link
nix build .#checks.x86_64-linux.codex-app --no-link

The check invokes the packaged launcher with an isolated home and requires its reported version to equal the derivation version. It does not open a window or modify the live Codex profile.

Run it without adding it to a system profile:

cd "$HOME"
nix run /etc/nixos#codex-app

The FHS wrapper exposes normal user and temporary paths. Starting it with a current directory under the host's /etc fails because that path is outside the bubblewrap namespace; launch it from $HOME, /tmp, or the desktop entry. The package is deliberately absent from environment.systemPackages until Peter chooses to activate it on a host.

Update

Read OpenAI's official APT index, select the new Filename and SHA256, and update version, url, and hash together:

https://persistent.oaistatic.com/codex-app-prod/linux/deb/dists/stable/main/binary-amd64/Packages

Never replace the versioned pool URL with the mutable /latest/ artifact. Only x86_64-linux is claimed by this derivation; an ARM64 package needs its own official artifact, hash, build, and launch smoke test.

codex-app.nix

{
  lib,
  stdenv,
  fetchurl,
  dpkg,
  buildFHSEnv,
}:

let
  version = "26.810.41047";

  payload = stdenv.mkDerivation {
    pname = "codex-app-payload";
    inherit version;

    src = fetchurl {
      url = "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.810.41047_amd64.deb";
      hash = "sha256-eHFfo80Tb/ZwcNqnaBmtrsxbQumYUVWWWWRdzh+/KvM=";
    };

    nativeBuildInputs = [ dpkg ];

    unpackPhase = ''
      runHook preUnpack
      dpkg-deb -x "$src" .
      runHook postUnpack
    '';

    installPhase = ''
      runHook preInstall
      mkdir -p "$out/lib" "$out/share"
      cp -a usr/lib/chatgpt "$out/lib/"
      cp -a usr/share/applications "$out/share/"
      cp -a usr/share/pixmaps "$out/share/"
      runHook postInstall
    '';
  };

  app = buildFHSEnv {
    name = "chatgpt";

    # The official payload includes Electron, native Node modules, helper
    # binaries, and architecture-specific fallbacks. Keeping those binaries
    # intact inside a Nix-built FHS runtime avoids selectively rewriting only
    # the files that autoPatchelf happens to recognize.
    targetPkgs = pkgs: with pkgs; [
      alsa-lib
      at-spi2-atk
      at-spi2-core
      atk
      cairo
      cups
      dbus
      expat
      fontconfig
      freetype
      gcc.cc.lib
      gdk-pixbuf
      glib
      graphite2
      gtk3
      harfbuzz
      icu
      libdrm
      libgbm
      libnotify
      libsecret
      libusb1
      libva
      libxkbcommon
      mesa
      nspr
      nss
      openssl
      pango
      systemd
      wayland
      xdg-utils
      libx11
      libxscrnsaver
      libxcomposite
      libxcursor
      libxdamage
      libxext
      libxfixes
      libxi
      libxrandr
      libxrender
      libxtst
      libxcb
      zlib
    ];

    runScript = "${payload}/lib/chatgpt/ChatGPT";

    extraInstallCommands = ''
      mkdir -p "$out/share/applications" "$out/share/pixmaps"
      cp -a ${payload}/share/applications/chatgpt.desktop \
        "$out/share/applications/chatgpt.desktop"
      cp -a ${payload}/share/pixmaps/chatgpt.png \
        "$out/share/pixmaps/chatgpt.png"
    '';
  };
in
app.overrideAttrs (old: {
  pname = "codex-app";
  inherit version;

  passthru = (old.passthru or { }) // {
    inherit payload;
  };

  meta = (old.meta or { }) // {
    description = "Official OpenAI Codex app for Linux";
    homepage = "https://developers.openai.com/codex/app";
    license = lib.licenses.unfree;
    mainProgram = "chatgpt";
    platforms = [ "x86_64-linux" ];
    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
})