From 309ec5a5926ae5152cd1981729882fd3fdbbc033 Mon Sep 17 00:00:00 2001
From: faukah <fau@faukah.com>
Date: Fri, 27 Feb 2026 19:08:31 +0100
Subject: [PATCH 1/3] nh-unwrapped: 4.2.0 -> 4.3.0

---
 pkgs/by-name/nh/nh-unwrapped/package.nix | 95 +++++++++++++++++-------
 1 file changed, 69 insertions(+), 26 deletions(-)

diff --git a/pkgs/by-name/nh/nh-unwrapped/package.nix b/pkgs/by-name/nh/nh-unwrapped/package.nix
index 282a0711f8d5..40f3ded9d81a 100644
--- a/pkgs/by-name/nh/nh-unwrapped/package.nix
+++ b/pkgs/by-name/nh/nh-unwrapped/package.nix
@@ -4,53 +4,96 @@
   rustPlatform,
   installShellFiles,
   fetchFromGitHub,
-  fetchpatch,
   nix-update-script,
   buildPackages,
+  sudo,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nh-unwrapped";
-  version = "4.2.0"; # Did you remove the patch below (and this comment)?
-
+  version = "4.3.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6n5SVO8zsdVTD691lri7ZcO4zpqYFU8GIvjI6dbxkA8=";
+    hash = "sha256-A3bEBKJlWYqsw41g4RaTwSLUWq8Mw/zz4FpMj4Lua+c=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/nix-community/nh/commit/8bf323483166797a204579a43ed8810113eb128c.patch";
-      hash = "sha256-hg0LgDPjiPWR+1DRzqORv6QPlrds7ys4PTDXFw6PUoI=";
-    })
-  ];
-
   strictDeps = true;
 
+  cargoBuildFlags = [
+    "-p"
+    "nh"
+    "-p"
+    "xtask"
+  ];
+
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
-    let
-      emulator = stdenv.hostPlatform.emulator buildPackages;
-    in
-    ''
-      mkdir completions
+  # pkgs.sudo is not available on the Darwin platform, and thus breaks build
+  # if added to nativeCheckInputs. We must manually disable the tests that
+  # *require* it, because they will fail when sudo is missing.
+  nativeCheckInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ sudo ];
+  checkFlags = [
+    # These do not work in Nix's sandbox
+    "--skip"
+    "test_get_build_image_variants_expression"
+    "--skip"
+    "test_get_build_image_variants_file"
+    "--skip"
+    "test_get_build_image_variants_flake"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Tests that require sudo in PATH (not available on Darwin)
+    "--skip"
+    "test_build_sudo_cmd_basic"
+    "--skip"
+    "test_build_sudo_cmd_with_preserve_vars"
+    "--skip"
+    "test_build_sudo_cmd_with_preserve_vars_disabled"
+    "--skip"
+    "test_build_sudo_cmd_with_set_vars"
+    "--skip"
+    "test_build_sudo_cmd_force_no_stdin"
+    "--skip"
+    "test_build_sudo_cmd_with_remove_vars"
+    "--skip"
+    "test_build_sudo_cmd_with_askpass"
+    "--skip"
+    "test_build_sudo_cmd_env_added_once"
+    "--skip"
+    "test_elevation_strategy_passwordless_resolves"
+    "--skip"
+    "test_build_sudo_cmd_with_nix_config_spaces"
+  ];
 
-      for shell in bash zsh fish; do
-        NH_NO_CHECKS=1 ${emulator} $out/bin/nh completions $shell > completions/nh.$shell
-      done
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
-      installShellCompletion completions/*
+  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
+    # Run both shell completion and manpage generation tasks. Unlike the
+    # fine-grained variants, the 'dist' command doesn't allow specifying the
+    # path but that's fine, because we can simply install them from the implicit
+    # output directories.
+    $out/bin/xtask dist
 
-      cargo xtask man --out-dir gen
-      installManPage gen/nh.1
-    ''
-  );
+    # The dist task above should've created
+    #  1. Shell completions in comp/
+    #  2. The NH manpage (nh.1) in man/
+    # Let's install those.
+    # The important thing to note here is that installShellCompletion cannot
+    # actually load *all* shell completions we generate with 'xtask dist'.
+    # Elvish, for example isn't supported. So we have to be very explicit
+    # about what we're installing, or this will fail.
+    installShellCompletion --cmd ${finalAttrs.meta.mainProgram} ./comp/*.{bash,fish,zsh,nu}
+    installManPage ./man/nh.1
 
-  cargoHash = "sha256-cxZsePgraYevuYQSi3hTU2EsiDyn1epSIcvGi183fIU=";
+    # Avoid populating PATH with an 'xtask' cmd
+    rm $out/bin/xtask
+  '';
+
+  cargoHash = "sha256-BLv69rL5L84wNTMiKHbSumFU4jVQqAiI1pS5oNLY9yE=";
 
   passthru.updateScript = nix-update-script { };
 

From 5c4ad89495209e8ffef459ce2fc23827bb3df412 Mon Sep 17 00:00:00 2001
From: faukah <fau@faukah.com>
Date: Fri, 27 Feb 2026 19:09:06 +0100
Subject: [PATCH 2/3] nh-unwrapped: add faukah to maintainers

---
 pkgs/by-name/nh/nh-unwrapped/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/nh/nh-unwrapped/package.nix b/pkgs/by-name/nh/nh-unwrapped/package.nix
index 40f3ded9d81a..4ad83883df25 100644
--- a/pkgs/by-name/nh/nh-unwrapped/package.nix
+++ b/pkgs/by-name/nh/nh-unwrapped/package.nix
@@ -110,6 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       mdaniels5757
       viperML
       midischwarz12
+      faukah
     ];
   };
 })

From d3ac52a8761bc0efa5dcef50697678bb634abbf2 Mon Sep 17 00:00:00 2001
From: faukah <fau@faukah.com>
Date: Fri, 27 Feb 2026 19:09:23 +0100
Subject: [PATCH 3/3] nh: add faukah to maintainers

---
 nixos/modules/programs/nh.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/programs/nh.nix b/nixos/modules/programs/nh.nix
index d40c445b2f6b..6ed9f1e919d2 100644
--- a/nixos/modules/programs/nh.nix
+++ b/nixos/modules/programs/nh.nix
@@ -12,6 +12,7 @@ in
     NotAShelf
     mdaniels5757
     viperML
+    faukah
   ];
 
   options.programs.nh = {