From 0ed8424ca33155a261aa2f462e82dd2a21aa49af Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 26 Apr 2026 19:15:38 +0100 Subject: [PATCH 01/11] lightway: 0-unstable-2026-04-10 -> 0-unstable-2026-04-24 Bumps the vendored wolfSSL to 5.9.1, thus fixing a bunch of CVEs. Diff: https://github.com/expressvpn/lightway/compare/72a924935df9db641e7f4fe28cbeafaead59014f...8e0940f047ee72db5daa1fb7c3bb82bc89e0f1d9 --- pkgs/by-name/li/lightway/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/li/lightway/package.nix b/pkgs/by-name/li/lightway/package.nix index 26d0ba9082dd..bd48ef60bcff 100644 --- a/pkgs/by-name/li/lightway/package.nix +++ b/pkgs/by-name/li/lightway/package.nix @@ -10,16 +10,16 @@ rustPlatform.buildRustPackage { pname = "lightway"; - version = "0-unstable-2026-04-10"; + version = "0-unstable-2026-04-24"; src = fetchFromGitHub { owner = "expressvpn"; repo = "lightway"; - rev = "72a924935df9db641e7f4fe28cbeafaead59014f"; - hash = "sha256-tygK2CQmbbynJiwGkMvYzt2dHoE17DCJeqD+jlai/m8="; + rev = "8e0940f047ee72db5daa1fb7c3bb82bc89e0f1d9"; + hash = "sha256-OFMAEw613aIGG7N5LBAGbVrpkqMUBi7lUy7jm5tZowc="; }; - cargoHash = "sha256-NdVOphyBW5sflv5jZPV/ShfAJXb3ZOyDRctmn/2JY38="; + cargoHash = "sha256-gY8KokOtdBT7Vq+lGn2sk4/o3A0TypEqv09TVJqaZjc="; cargoBuildFlags = lib.cli.toCommandLineGNU { } { package = [ From 255f7cd2d48d31b04df32494c4b27138be885595 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 19:14:12 +0000 Subject: [PATCH 02/11] uhttpd: use the default version of `libubox` --- pkgs/by-name/uh/uhttpd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/uh/uhttpd/package.nix b/pkgs/by-name/uh/uhttpd/package.nix index c5293b422df7..3c02e8ec259a 100644 --- a/pkgs/by-name/uh/uhttpd/package.nix +++ b/pkgs/by-name/uh/uhttpd/package.nix @@ -6,7 +6,7 @@ pkg-config, lua5_1, json_c, - libubox-wolfssl, + libubox, ubus, libxcrypt, unstableGitUpdater, @@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ lua5_1 json_c - libubox-wolfssl + libubox ubus libxcrypt ]; From 7c4031f35c9350468fddc6718f015de414752f01 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 26 Apr 2026 18:53:20 +0100 Subject: [PATCH 03/11] rpcs3: 0.0.39-unstable-2026-02-20 -> 0.0.40-unstable-2026-04-25 --- pkgs/by-name/rp/rpcs3/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix index 567ceffe0f1e..9d1d49ffa158 100644 --- a/pkgs/by-name/rp/rpcs3/package.nix +++ b/pkgs/by-name/rp/rpcs3/package.nix @@ -50,19 +50,19 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "rpcs3"; - version = "0.0.39-unstable-2026-02-20"; + version = "0.0.40-unstable-2026-04-25"; src = fetchFromGitHub { owner = "RPCS3"; repo = "rpcs3"; - rev = "6bfb33279f6989f3ff9ea2dc40ef45d6aeb57ef8"; + rev = "96f73f4497fd6fdafd40dc50f24c95c90cd4acc9"; postCheckout = '' cd $out/3rdparty git submodule update --init \ fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \ feralinteractive/feralinteractive ''; - hash = "sha256-Cu4Zaze0FZ00sRvPtUzUkOiX5ZAHWTtmWa536gNOTNY="; + hash = "sha256-IKRGKUN0SZIxZToP9kimIc+5wn9GS86tM+/oSv76d74="; }; passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; }; From ebb013106f3ce766e83bbdb925e5fb42c579d047 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 19:20:14 +0000 Subject: [PATCH 04/11] rpcs3: use vendored wolfSSL and update `meta.license` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Insofar as this works as an exception tightly scoped to RPCS3, the safest way to take advantage of it is to use the copy of wolfSSL directly included as part of RPCS3 and avoid dynamic linking. Insofar as it doesn’t work, `lib.licenses.unfree` keeps it away from the cache. Thankfully, they seem pretty good at keeping their vendored version up to date. --- pkgs/by-name/rp/rpcs3/package.nix | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix index 9d1d49ffa158..b5d5c085f865 100644 --- a/pkgs/by-name/rp/rpcs3/package.nix +++ b/pkgs/by-name/rp/rpcs3/package.nix @@ -18,7 +18,6 @@ libusb1, zlib, curl, - wolfssl, python3, pugixml, protobuf_33, @@ -60,9 +59,9 @@ stdenv.mkDerivation (finalAttrs: { cd $out/3rdparty git submodule update --init \ fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \ - feralinteractive/feralinteractive + feralinteractive/feralinteractive wolfssl/wolfssl ''; - hash = "sha256-IKRGKUN0SZIxZToP9kimIc+5wn9GS86tM+/oSv76d74="; + hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso="; }; passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; }; @@ -82,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: { (lib.cmakeBool "USE_SYSTEM_LIBPNG" true) (lib.cmakeBool "USE_SYSTEM_FFMPEG" true) (lib.cmakeBool "USE_SYSTEM_CURL" true) - (lib.cmakeBool "USE_SYSTEM_WOLFSSL" true) (lib.cmakeBool "USE_SYSTEM_FAUDIO" true) (lib.cmakeBool "USE_SYSTEM_OPENAL" true) (lib.cmakeBool "USE_SYSTEM_PUGIXML" true) @@ -127,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: { zlib libusb1 curl - wolfssl python3 pugixml sdl3 @@ -168,7 +165,25 @@ stdenv.mkDerivation (finalAttrs: { maintainers = with lib.maintainers; [ ilian ]; - license = lib.licenses.gpl2Only; + license = [ + lib.licenses.gpl2Only + # Vendors wolfSSL, which changed its licence from + # `GPL-2.0-or-later` to `GPL-3.0-or-later`, which is incompatible + # with RPCS3’s `GPL-2.0-only`. They have a “GPLv2 exception list” + # (), + # but this is dubious; either the exception likely negates the + # licence change by letting you take wolfSSL out of a + # `GPL-2.0-only` combination and redistribute it under those + # terms, negating the licence change entirely, or else it doesn’t + # allow distribution of the combination under the `GPL-2.0-only` + # at all and therefore would still constitute a licence + # violation to redistribute. + # + # We use `lib.licenses.unfree` to represent this awkward + # situation and keep Hydra from building the package. + lib.licenses.gpl3Plus + lib.licenses.unfree + ]; platforms = [ "x86_64-linux" "aarch64-linux" From ac722e11b8c5240a350ba5f85d846586d65f7910 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:23:43 +0100 Subject: [PATCH 05/11] libubox-wolfssl: drop --- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 3eb7c00c46e3..c981d9735f15 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1114,6 +1114,7 @@ mapAliases { libtorrent = throw "'libtorrent' has been renamed to 'libtorrent-rakshasa' for clearer distinction from 'libtorrent-rasterbar'"; # Added 2025-09-10 libtransmission = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26 libtransmission_3 = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26 + libubox-wolfssl = throw "'libubox-wolfssl' has been removed, use 'libubox' or 'libubox-mbedtls'"; # Added 2026-03-29 libuinputplus = throw "'libuinputplus' has been removed, as it was unmaintained upstream since 2021, no longer builds, and is no longer used by anything"; # Added 2025-11-02 libviper = throw "'libviper' was removed as it is broken and not maintained upstream"; # Added 2025-05-17 libWindowsWM = libwindowswm; # Added 2026-01-19 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1a32a61868b8..3f6e2ca21da8 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6752,11 +6752,6 @@ with pkgs; libubox = callPackage ../development/libraries/libubox { with_ustream_ssl = true; }; - libubox-wolfssl = callPackage ../development/libraries/libubox { - with_ustream_ssl = true; - ustream-ssl = ustream-ssl-wolfssl; - }; - libubox-mbedtls = callPackage ../development/libraries/libubox { with_ustream_ssl = true; ustream-ssl = ustream-ssl-mbedtls; From f322bbe86c9f842057905460e570668e08cd42f1 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:23:43 +0100 Subject: [PATCH 06/11] ustream-ssl-wolfssl: drop --- pkgs/development/libraries/ustream-ssl/default.nix | 3 +-- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 5 ----- 3 files changed, 2 insertions(+), 7 deletions(-) diff --git a/pkgs/development/libraries/ustream-ssl/default.nix b/pkgs/development/libraries/ustream-ssl/default.nix index 3f24ddce7222..e787cdf8adc5 100644 --- a/pkgs/development/libraries/ustream-ssl/default.nix +++ b/pkgs/development/libraries/ustream-ssl/default.nix @@ -6,7 +6,6 @@ pkg-config, libubox-nossl, ssl_implementation, - additional_buildInputs ? [ ], }: stdenv.mkDerivation { @@ -35,7 +34,7 @@ stdenv.mkDerivation { cmake pkg-config ]; - buildInputs = [ ssl_implementation ] ++ additional_buildInputs; + buildInputs = [ ssl_implementation ]; passthru = { inherit ssl_implementation; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index c981d9735f15..421eee1720dc 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2051,6 +2051,7 @@ mapAliases { unixODBCDrivers = warnAlias "'unixODBCDrivers' has been renamed to 'unixodbcDrivers'" unixodbcDrivers; # Added 2026-02-12 unrar_6 = throw "'unrar_6' has been renamed to/replaced by 'unrar'"; # Added 2026-03-11 unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24 + ustream-ssl-wolfssl = throw "'ustream-ssl-wolfssl' has been removed, use 'ustream-ssl' or 'ustream-ssl-mbedtls'"; # Added 2026-03-29 usync = throw "'usync' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18 util-linuxCurses = throw "'util-linuxCurses' has been renamed to/replaced by 'util-linux'"; # Converted to throw 2025-10-27 utillinux = warnAlias "'utillinux' has been renamed to/replaced by 'util-linux'" util-linux; # Converted to warning 2025-10-28 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3f6e2ca21da8..90a2e1f5500d 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6134,11 +6134,6 @@ with pkgs; ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; }; - ustream-ssl-wolfssl = callPackage ../development/libraries/ustream-ssl { - ssl_implementation = wolfssl; - additional_buildInputs = [ openssl ]; - }; - ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl { ssl_implementation = mbedtls_2; }; From 89d326f7a52be496953980a2a45d032605f4a8f2 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:25:51 +0100 Subject: [PATCH 07/11] riemann_c_client: drop wolfSSL support --- pkgs/by-name/ri/riemann_c_client/package.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/by-name/ri/riemann_c_client/package.nix b/pkgs/by-name/ri/riemann_c_client/package.nix index ec82a124948f..abc0b7308119 100644 --- a/pkgs/by-name/ri/riemann_c_client/package.nix +++ b/pkgs/by-name/ri/riemann_c_client/package.nix @@ -7,8 +7,6 @@ pkg-config, file, protobufc, - withWolfSSL ? false, - wolfssl, withGnuTLS ? false, gnutls, withJSON ? true, @@ -45,12 +43,10 @@ stdenv.mkDerivation (finalAttrs: { file protobufc ] - ++ lib.optional withWolfSSL wolfssl ++ lib.optional withGnuTLS gnutls ++ lib.optional withJSON json_c; - configureFlags = - [ ] ++ lib.optional withWolfSSL "--with-tls=wolfssl" ++ lib.optional withGnuTLS "--with-tls=gnutls"; + configureFlags = [ ] ++ lib.optional withGnuTLS "--with-tls=gnutls"; doCheck = true; enableParallelBuilding = true; From e337b3ae4f603cf82aa4ab16eeaa3692f5cfcec1 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:26:23 +0100 Subject: [PATCH 08/11] curl: drop wolfSSL support --- pkgs/by-name/cu/curlMinimal/package.nix | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix index 1d1c9c0fe0c2..b3bd7cd1d94f 100644 --- a/pkgs/by-name/cu/curlMinimal/package.nix +++ b/pkgs/by-name/cu/curlMinimal/package.nix @@ -48,8 +48,6 @@ rtmpdump, scpSupport ? zlibSupport && !stdenv.hostPlatform.isSunOS && !stdenv.hostPlatform.isCygwin, libssh2, - wolfsslSupport ? false, - wolfssl, rustlsSupport ? false, rustls-ffi, zlibSupport ? true, @@ -80,7 +78,6 @@ assert (lib.count (x: x) [ gnutlsSupport opensslSupport - wolfsslSupport rustlsSupport ]) > 1 ); @@ -160,7 +157,6 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional pslSupport libpsl ++ lib.optional rtmpSupport rtmpdump ++ lib.optional scpSupport libssh2 - ++ lib.optional wolfsslSupport wolfssl ++ lib.optional rustlsSupport rustls-ffi ++ lib.optional zlibSupport zlib ++ lib.optional zstdSupport zstd; @@ -192,7 +188,8 @@ stdenv.mkDerivation (finalAttrs: { (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2)) (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl)) (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2)) - (lib.withFeatureAs wolfsslSupport "wolfssl" (lib.getDev wolfssl)) + # TODO: Clean up on `staging`. + "--without-wolfssl" ] ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}" # For the 'urandom', maybe it should be a cross-system option @@ -203,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: { "--without-ca-bundle" "--without-ca-path" ] - ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [ + ++ lib.optionals (!gnutlsSupport && !opensslSupport && !rustlsSupport) [ "--without-ssl" ] ++ lib.optionals (rustlsSupport && !stdenv.hostPlatform.isDarwin) [ From dadb9d4ebc8304ce511b22f2aa8fe33a39e2b3e7 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:27:00 +0100 Subject: [PATCH 09/11] haproxy: drop wolfSSL support --- pkgs/by-name/ha/haproxy/package.nix | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix index 806d008ac75b..cd0f97ea0835 100644 --- a/pkgs/by-name/ha/haproxy/package.nix +++ b/pkgs/by-name/ha/haproxy/package.nix @@ -12,7 +12,6 @@ aws-lc, libressl, openssl, - wolfssl, lua5_4, pcre2, }: @@ -21,7 +20,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [ "aws-lc" "libressl" "openssl" - "wolfssl" ]; let sslPkgs = { @@ -30,10 +28,6 @@ let libressl openssl ; - wolfssl = wolfssl.override { - variant = "haproxy"; - extraConfigureFlags = [ "--enable-quic" ]; - }; }; sslPkg = sslPkgs.${sslLibrary}; in @@ -85,9 +79,6 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optionals (sslLibrary == "openssl" && lib.versionOlder openssl.version "3.5.2") [ "USE_QUIC_OPENSSL_COMPAT=yes" ] - ++ lib.optionals (sslLibrary == "wolfssl") [ - "USE_OPENSSL_WOLFSSL=yes" - ] ++ lib.optionals usePcre [ "USE_PCRE2=yes" "USE_PCRE2_JIT=yes" From 82b9c8879be6a7c77cd51b23160e066c40d0b62f Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 3 Apr 2026 19:46:26 +0100 Subject: [PATCH 10/11] art-standalone: patch out wolfSSL dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The upstream Android runtime doesn’t use wolfSSL but instead Conscrypt, based on BoringSSL. This fork patches out Conscrypt in favour of using wolfSSL for a subset of the functionality. It seems like every demo app using TLS crashes under `android-translation-layer` already, so it’s hard to say if patching it out has a meaningful impact. It should presumably be possible to get another JSSE provider working, but given the lack of ability to meaningfully test it I decided not to sink too much time into it. The most compatible option would of course be to just get Conscrypt + BoringSSL working. --- pkgs/by-name/ar/art-standalone/package.nix | 3 +- .../ar/art-standalone/remove-wolfssljni.patch | 96 +++++++++++++++++++ 2 files changed, 97 insertions(+), 2 deletions(-) create mode 100644 pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch diff --git a/pkgs/by-name/ar/art-standalone/package.nix b/pkgs/by-name/ar/art-standalone/package.nix index 6f0a62d6b9eb..cb7c5904a462 100644 --- a/pkgs/by-name/ar/art-standalone/package.nix +++ b/pkgs/by-name/ar/art-standalone/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitLab, - wolfssl, bionic-translation, python3, which, @@ -35,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: { patches = [ # Do not hardocde addr2line binary path ./no-hardcode-path-addr2line.patch + ./remove-wolfssljni.patch ]; postPatch = '' @@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: { libpng lz4 openssl - (wolfssl.override { enableJni = true; }) xz zlib ]; diff --git a/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch b/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch new file mode 100644 index 000000000000..f3aac163d0a7 --- /dev/null +++ b/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch @@ -0,0 +1,96 @@ +diff --git a/Makefile b/Makefile +index 3383a64b36..b658f49c23 100644 +--- a/Makefile ++++ b/Makefile +@@ -53,7 +53,7 @@ + + default: ____art_all + +-____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex wolfssljni-hostdex okhttp-hostdex libandroidfw art-standalone.pc ++____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex okhttp-hostdex libandroidfw art-standalone.pc + + art-standalone.pc: art-standalone.pc.in + sed -e 's|@prefix@|$(____PREFIX)|g' \ +@@ -68,8 +68,7 @@ + install -Dt $(____INSTALL_LIBDIR)/java/dex/art/natives/ $(____TOPDIR)/out/host/linux-x86/lib64/libjavacore.so \ + $(____TOPDIR)/out/host/linux-x86/lib64/libnativehelper.so \ + $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdk.so \ +- $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so \ +- $(____TOPDIR)/out/host/linux-x86/lib64/libwolfssljni.so ++ $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so + # + # these are mostly internal libs which there's no point in versioning because they don't have any kind of stable ABI - so we just shove them in art/ namespace + # even the libunwind is actually a fork of libunwind 1.1 with added stuff that will likely never be upstreamed, especially since google stopped using libunwind +@@ -108,8 +107,7 @@ + $(____TOPDIR)/out/host/linux-x86/framework/core-oj-hostdex.jar \ + $(____TOPDIR)/out/host/linux-x86/framework/hamcrest-hostdex.jar \ + $(____TOPDIR)/out/host/linux-x86/framework/junit-runner-hostdex.jar \ +- $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar \ +- $(____TOPDIR)/out/host/linux-x86/framework/wolfssljni-hostdex.jar ++ $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar + # + # packaging note: this is needed as bootclasspath when compiling android_translation_layer. Can be in -dev package. + install -D $(____TOPDIR)/out/host/common/obj/JAVA_LIBRARIES/core-all-hostdex_intermediates/classes.jar $(____INSTALL_LIBDIR)/java/core-all_classes.jar +diff --git a/art/runtime/parsed_options.cc b/art/runtime/parsed_options.cc +index 1f8936114a..b8f7566401 100644 +--- a/art/runtime/parsed_options.cc ++++ b/art/runtime/parsed_options.cc +@@ -597,8 +597,7 @@ + bootclasspath_prefix + "/core-libart-hostdex.jar" + ':' + + bootclasspath_prefix + "/hamcrest-hostdex.jar" + ':' + + bootclasspath_prefix + "/junit-runner-hostdex.jar" + ':' + +- bootclasspath_prefix + "/okhttp-hostdex.jar" + ':' + +- bootclasspath_prefix + "/wolfssljni-hostdex.jar"; ++ bootclasspath_prefix + "/okhttp-hostdex.jar"; + free(bootclasspath_prefix); + + if(args.Exists(M::BootClassPath_a)) +diff --git a/libcore/luni/src/main/java/java/security/security.properties b/libcore/luni/src/main/java/java/security/security.properties +index ca55328279..b17437f81e 100644 +--- a/libcore/luni/src/main/java/java/security/security.properties ++++ b/libcore/luni/src/main/java/java/security/security.properties +@@ -18,15 +18,13 @@ + # Providers + # See also: J2SE doc. "How to Implement a Provider for the JavaTM Cryptography Architecture" + # +-# Android's provider of OpenSSL backed implementations +-security.provider.1=com.wolfssl.provider.jsse.WolfSSLProvider + # Android's stripped down BouncyCastle provider +-security.provider.2=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider ++security.provider.1=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider + # provides implementations that would normally be provided by sun.security.provider.Sun + # (CertPathValidator, CertPathBuilder and (ATL added) JKS) +-security.provider.3=sun.security.provider.CertPathProvider ++security.provider.2=sun.security.provider.CertPathProvider + # Remaining Harmony providers +-security.provider.4=org.apache.harmony.security.provider.crypto.CryptoProvider ++security.provider.3=org.apache.harmony.security.provider.crypto.CryptoProvider + + + +@@ -39,13 +37,6 @@ + # javax/net/ssl/SSLSocketFactory.html#getDefault() + # javax/net/ssl/SSLServerSocketFactory.html#getDefault() + +-# For regular SSLSockets, we have two implementations: +-ssl.SocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLSocketFactory +-#ssl.SocketFactory.provider=com.android.org.conscrypt.SSLSocketFactoryImpl +- +-# For SSLServerSockets, there's only the new, OpenSSL-based implementation: +-ssl.ServerSocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLServerSocketFactory +- + # Default KeyStore type. + # See specification for java/security/KeyStore.html#getDefaultType() + keystore.type=BKS +diff --git a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java +index e60c3e3ba8..ec66dcb8f0 100644 +--- a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java ++++ b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java +@@ -103,7 +103,6 @@ + */ + "com.android.org.bouncycastle.jce.provider.BouncyCastleProvider", + "org.apache.harmony.security.provider.crypto.CryptoProvider", // we need SecureRandom +- "com.wolfssl.provider.jsse.WolfSSLProvider", + // END Android-changed: Use Conscrypt and BC, not the sun.security providers. + BACKUP_PROVIDER_CLASSNAME, + }; From 6fd28ab3b0ede0c39ee6b5592163662266128d30 Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 3 Apr 2026 19:54:31 +0100 Subject: [PATCH 11/11] wolfssl: drop --- pkgs/by-name/wo/wolfssl/package.nix | 135 ---------------------------- pkgs/top-level/aliases.nix | 1 + 2 files changed, 1 insertion(+), 135 deletions(-) delete mode 100644 pkgs/by-name/wo/wolfssl/package.nix diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix deleted file mode 100644 index 6cde924b81f7..000000000000 --- a/pkgs/by-name/wo/wolfssl/package.nix +++ /dev/null @@ -1,135 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - autoreconfHook, - util-linux, - openssl, - cacert, - # The primary --enable-XXX variant. 'all' enables most features, but causes build-errors for some software, - # requiring to build a special variant for that software. Example: 'haproxy' - variant ? "all", - extraConfigureFlags ? [ ], - enableJni ? false, - enableARMCryptoExtensions ? - stdenv.hostPlatform.isAarch64 - && ((builtins.match "^.*\\+crypto.*$" stdenv.hostPlatform.gcc.arch) != null), - enableLto ? !(stdenv.hostPlatform.isStatic || stdenv.cc.isClang), -}: -stdenv.mkDerivation (finalAttrs: { - pname = "wolfssl-${variant}"; - version = "5.9.1"; - - src = fetchFromGitHub { - owner = "wolfSSL"; - repo = "wolfssl"; - tag = "v${finalAttrs.version}-stable"; - hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE="; - }; - - postPatch = '' - patchShebangs ./scripts - # ensure test detects musl-based systems too - substituteInPlace scripts/ocsp-stapling2.test \ - --replace '"linux-gnu"' '"linux-"' - '' - + lib.optionalString enableJni '' - # Some tests fail when JNI is enabled - sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d; - /TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d; - /TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c - sed -i '/quic/d' tests/include.am - sed -i '/WOLFSSL_QUIC/,/#endif/d' tests/unit.c - ''; - - configureFlags = [ - "--enable-${variant}" - "--enable-reproducible-build" - ] - ++ lib.optionals (variant == "all") [ - # Extra feature flags to add while building the 'all' variant. - # Since they conflict while building other variants, only specify them for this one. - "--enable-pkcs11" - "--enable-writedup" - "--enable-base64encode" - ] - ++ [ - # We're not on tiny embedded machines. - # Increase TLS session cache from 33 sessions to 20k. - "--enable-bigcache" - - # Use WolfSSL's Single Precision Math with timing-resistant cryptography. - "--enable-sp=yes${ - lib.optionalString (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isAarch) ",asm" - }" - "--enable-sp-math-all" - "--enable-harden" - ] - ++ lib.optionals (stdenv.hostPlatform.isx86_64) [ - # Enable AVX/AVX2/AES-NI instructions, gated by runtime detection via CPUID. - "--enable-intelasm" - "--enable-aesni" - ] - ++ lib.optionals (stdenv.hostPlatform.isAarch64) [ - # No runtime detection under ARM and no platform function checks like for X86. - (if enableARMCryptoExtensions then "--enable-armasm=inline" else "--disable-armasm") - ] - ++ lib.optionals enableJni [ - "--enable-jni" - ] - ++ extraConfigureFlags; - - # Breaks tls13 tests on aarch64-darwin. - hardeningDisable = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ - "zerocallusedregs" - ]; - - # LTO should help with the C implementations. - env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto"; - env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto"; - - # Don't attempt connections to external services in the test suite. - env.WOLFSSL_EXTERNAL_TEST = "0"; - - outputs = [ - "dev" - "doc" - "lib" - "out" - ]; - - nativeBuildInputs = [ - autoreconfHook - util-linux - ]; - - # FAILURES: - # 497: test_wolfSSL_EVP_PBE_scrypt - doCheck = !stdenv.hostPlatform.isLoongArch64; - - nativeCheckInputs = [ - openssl - cacert - ]; - - postInstall = '' - # fix recursive cycle: - # wolfssl-config points to dev, dev propagates bin - moveToOutput bin/wolfssl-config "$dev" - # moveToOutput also removes "$out" so recreate it - mkdir -p "$out" - ''; - - meta = { - description = "Small, fast, portable implementation of TLS/SSL for embedded devices"; - mainProgram = "wolfssl-config"; - homepage = "https://www.wolfssl.com/"; - changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${finalAttrs.version}-stable"; - platforms = lib.platforms.all; - license = lib.licenses.gpl3Plus; - maintainers = with lib.maintainers; [ - fab - vifino - ]; - }; -}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 421eee1720dc..286b5bc3c201 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2132,6 +2132,7 @@ mapAliases { wlroots_0_17 = throw "'wlroots_0_17' has been removed in favor of newer versions"; # Added 2026-03-07 wlx-overlay-s = throw "'wlx-overlay-s' and 'wayvr-dashboard' have been merged into a single application. Please switch to 'wayvr'"; # Added 2026-01-09 wmii_hg = throw "'wmii_hg' has been renamed to/replaced by 'wmii'"; # Converted to throw 2025-10-27 + wolfssl = throw "'wolfssl' has been removed because it has an unclear licensing situation and no remaining users in Nixpkgs"; # Added 2026-04-03 woof = throw "'woof' has been removed as it is broken and unmaintained upstream"; # Added 2025-09-04 worldengine-cli = throw "'worldengine-cli' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04 wpa_supplicant_ro_ssids = throw "'wpa_supplicant_ro_ssids' has been renamed to/replaced by 'wpa_supplicant'"; # Converted to throw 2025-10-27