To everyone, it's not correct to add openssl to buildInputs or propagatedBuildInputs. It's most probably a broken .la file in some package (like I fixed recently libarchive) that is propagating -lcrypto without a proper -L flag. So please, before adding build inputs like this and then you don't have any clue, at least ping someone for review. Thanks.