From 815d6316ce16f0bcc2b1a3cb09952f995b147611 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Tue, 11 Nov 2025 16:09:23 +0100
Subject: [PATCH 1/3] spire: build tpmdevid nodeattestor plugin

---
 pkgs/by-name/sp/spire/package.nix | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/sp/spire/package.nix b/pkgs/by-name/sp/spire/package.nix
index ac6d592ff42b..ef7020bf7c04 100644
--- a/pkgs/by-name/sp/spire/package.nix
+++ b/pkgs/by-name/sp/spire/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  openssl,
 }:
 
 buildGoModule (finalAttrs: {
@@ -21,7 +22,11 @@ buildGoModule (finalAttrs: {
     sha256 = "sha256-iZMeD5ZwWKjY9mfuXgEgh+QLotmv28T8xBgpKoQTgxw=";
   };
 
-  vendorHash = "sha256-tho3Qm9uHiiSNFmBZGZFgxhAKD4HKWsIUmiqkWlToQk=";
+  # Needed for github.co/google/go-tpm-tools/simulator  which contains non-go files that `go mod vendor` strips
+  proxyVendor = true;
+  vendorHash = "sha256-nslLp/NjzsN1hSMMga67T6tMGLiqBNYQMt4Kjtwyvoc=";
+
+  buildInputs = [ openssl ];
 
   ldflags = [
     "-s"
@@ -34,12 +39,6 @@ buildGoModule (finalAttrs: {
     "cmd/spire-server"
   ];
 
-  excludedPackages = [
-    # ensure these files aren't evaluated, see preCheck
-    "test/tmpsimulator"
-    "pkg/agent/plugin/nodeattestor/tpmdevid"
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   checkFlags =
@@ -53,10 +52,6 @@ buildGoModule (finalAttrs: {
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   preCheck = ''
-    # remove test files which reference github.com/google/go-tpm-tools/simulator
-    # since it requires cgo and some missing header files
-    rm -rf test/tpmsimulator pkg/server/plugin/nodeattestor/tpmdevid/devid_test.go
-
     # unset to run all tests
     unset subPackages
   '';

From 3c6428610284e9e44ab2d4a66290cdf4a4438125 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Tue, 11 Nov 2025 16:11:12 +0100
Subject: [PATCH 2/3] spire: add arianvp to maintainers

---
 pkgs/by-name/sp/spire/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/sp/spire/package.nix b/pkgs/by-name/sp/spire/package.nix
index ef7020bf7c04..2761bdad2a36 100644
--- a/pkgs/by-name/sp/spire/package.nix
+++ b/pkgs/by-name/sp/spire/package.nix
@@ -95,6 +95,7 @@ buildGoModule (finalAttrs: {
       fkautz
       jk
       mjm
+      arianvp
     ];
   };
 })

From 2824fa236006d42606c8a8534a72e515639bdf3f Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Tue, 11 Nov 2025 16:50:13 +0100
Subject: [PATCH 3/3] spire: build oidc-discovery-provider

---
 pkgs/by-name/sp/spire/package.nix | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/sp/spire/package.nix b/pkgs/by-name/sp/spire/package.nix
index 2761bdad2a36..503d20a86cf8 100644
--- a/pkgs/by-name/sp/spire/package.nix
+++ b/pkgs/by-name/sp/spire/package.nix
@@ -13,6 +13,7 @@ buildGoModule (finalAttrs: {
     "out"
     "agent"
     "server"
+    "oidc"
   ];
 
   src = fetchFromGitHub {
@@ -37,6 +38,7 @@ buildGoModule (finalAttrs: {
   subPackages = [
     "cmd/spire-agent"
     "cmd/spire-server"
+    "support/oidc-discovery-provider"
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -58,29 +60,27 @@ buildGoModule (finalAttrs: {
 
   # Usually either the agent or server is needed for a given use case, but not both
   postInstall = ''
-    mkdir -vp $agent/bin $server/bin
+    mkdir -vp $agent/bin $server/bin $oidc/bin
     mv -v $out/bin/spire-agent $agent/bin/
     mv -v $out/bin/spire-server $server/bin/
+    mv -v $out/bin/oidc-discovery-provider $oidc/bin/
 
     ln -vs $agent/bin/spire-agent $out/bin/spire-agent
     ln -vs $server/bin/spire-server $out/bin/spire-server
+    ln -vs $oidc/bin/oidc-discovery-provider $out/bin/oidc-discovery-provider
   '';
 
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
 
-    $out/bin/spire-agent -h
-    if [ "$($out/bin/spire-agent --version 2>&1)" != "${finalAttrs.version}" ]; then
-      echo "spire-agent version does not match"
-      exit 1
-    fi
-
-    $out/bin/spire-server -h
-    if [ "$($out/bin/spire-server --version 2>&1)" != "${finalAttrs.version}" ]; then
-      echo "spire-server version does not match"
-      exit 1
-    fi
+    for bin in $out/bin/*; do
+      $bin -h
+      if [ "$($bin --version 2>&1)" != "${finalAttrs.version}" ]; then
+        echo "$bin version does not match"
+        exit 1
+      fi
+    done
 
     runHook postInstallCheck
   '';