From 0c00e5ee169e68d390d102ebb03fb87ecf25d95d Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Sat, 7 Feb 2026 12:52:31 -0600
Subject: [PATCH] fix: Add git and SSL certificates for git dependencies

Add git and cacert to nativeBuildInputs and set SSL certificate
environment variables. This fixes the SSL certificate verification
error when fetching heroicons from GitHub.
---
 nix/build.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nix/build.nix b/nix/build.nix
index 472d304a..911d7d25 100644
--- a/nix/build.nix
+++ b/nix/build.nix
@@ -4,6 +4,8 @@
   towerops-nif,
   net-snmp,
   writeShellScriptBin,
+  git,
+  cacert,
 }:
 
 beamPackages.mixRelease {
@@ -40,10 +42,20 @@ beamPackages.mixRelease {
   # Environment variables for build
   MIX_OS_DEPS_COMPILE_PARTITION_COUNT = "6";
 
+  # Need git and SSL certificates for fetching git dependencies
+  nativeBuildInputs = [
+    git
+    cacert
+  ];
+
   # Override Mix phases to handle vendored deps properly
   configurePhase = ''
     runHook preConfigure
 
+    # Set SSL certificate path for git operations
+    export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
+    export GIT_SSL_CAINFO="${cacert}/etc/ssl/certs/ca-bundle.crt"
+
     # Get all deps (including hex deps that vendored packages need)
     mix deps.get --only prod