From 23d0e5f31d1cb3ab262659da5e838bf8ce91ec3f Mon Sep 17 00:00:00 2001
From: Siddharth <siddharth.060605@gmail.com>
Date: Sun, 2 Feb 2025 23:56:13 -0600
Subject: [PATCH 1/2] openssl: Add provider support

---
 .../development/libraries/openssl/default.nix | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index aee19324bcba..fa4a74a3c351 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -25,6 +25,8 @@
   conf ? null,
   removeReferencesTo,
   testers,
+  providers ? [ ],
+  autoloadProviders ? false,
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -307,6 +309,26 @@ let
         ''
         + lib.optionalString (conf != null) ''
           cat ${conf} > $etc/etc/ssl/openssl.cnf
+        ''
+
+        + lib.concatStringsSep "\n" (
+          map
+            (provider: ''
+              cp --no-preserve=mode ${provider.package}/lib/ossl-modules/* "$out/lib/ossl-modules"
+
+              ${lib.optionalString (autoloadProviders) ''
+                sed -i '/^[[:space:]]*#/!s/\[provider_sect\]/[provider_sect]\n${provider.name} = ${provider.name}_sect/g' $etc/etc/ssl/openssl.cnf
+                echo -e "\n[${provider.name}_sect]" >> $etc/etc/ssl/openssl.cnf
+                echo "activate = 1" >> $etc/etc/ssl/openssl.cnf
+              ''}
+            '')
+
+            providers
+        )
+
+        + lib.optionalString (autoloadProviders) ''
+          # The default provider needs loading when there are other providers loaded by default
+          sed -i '/^[[:space:]]*#/!s/\[default_sect\]/[default_sect]\nactivate = 1/g' $etc/etc/ssl/openssl.cnf
         '';
 
       allowedImpureDLLs = [ "CRYPT32.dll" ];

From cad7c1213ce1937e8abd703c2ee1ef7de8a4937a Mon Sep 17 00:00:00 2001
From: Siddharth <siddharth.060605@gmail.com>
Date: Tue, 11 Nov 2025 17:45:26 -0600
Subject: [PATCH 2/2] openssl_oqs: init

---
 .../development/libraries/openssl/default.nix | 39 ++++++++++++++-----
 pkgs/top-level/all-packages.nix               | 16 ++++++++
 2 files changed, 45 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index fa4a74a3c351..5b218ebb0b70 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -25,8 +25,9 @@
   conf ? null,
   removeReferencesTo,
   testers,
-  providers ? [ ],
+  providers ? [ ], # Each provider in the format { name = "provider-name"; package = <drv>; }
   autoloadProviders ? false,
+  extraINIConfig ? null, # Extra INI config in the format { section_name = { key = "value"}; }
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
@@ -311,24 +312,42 @@ let
           cat ${conf} > $etc/etc/ssl/openssl.cnf
         ''
 
+        # Replace the config's default provider section with the providers we wish
+        # to automatically load
+        + lib.optionalString autoloadProviders ''
+          sed -i '/^[[:space:]]*#/!s|\[provider_sect\]|${
+            let
+              config-provider-attrset = lib.foldl' (acc: elem: acc // elem) { } (
+                map (provider: { "${provider.name}" = "${provider.name}_sect"; }) providers
+              );
+            in
+            lib.escape [ "\n" ] (lib.generators.toINI { } { provider_sect = config-provider-attrset; })
+          }|' $etc/etc/ssl/openssl.cnf
+
+          # Activate the default provider
+          sed -i '/^[[:space:]]*#/!s/\[default_sect\]/[default_sect]\nactivate = 1/g' $etc/etc/ssl/openssl.cnf
+        ''
+
         + lib.concatStringsSep "\n" (
           map
             (provider: ''
-              cp --no-preserve=mode ${provider.package}/lib/ossl-modules/* "$out/lib/ossl-modules"
+              cp ${provider.package}/lib/ossl-modules/* "$out/lib/ossl-modules"
 
-              ${lib.optionalString (autoloadProviders) ''
-                sed -i '/^[[:space:]]*#/!s/\[provider_sect\]/[provider_sect]\n${provider.name} = ${provider.name}_sect/g' $etc/etc/ssl/openssl.cnf
-                echo -e "\n[${provider.name}_sect]" >> $etc/etc/ssl/openssl.cnf
-                echo "activate = 1" >> $etc/etc/ssl/openssl.cnf
+              ${lib.optionalString autoloadProviders ''
+                echo '${
+                  lib.generators.toINI { } {
+                    "${provider.name}_sect" = {
+                      activate = 1;
+                    };
+                  }
+                }' >> $etc/etc/ssl/openssl.cnf
               ''}
             '')
 
             providers
         )
-
-        + lib.optionalString (autoloadProviders) ''
-          # The default provider needs loading when there are other providers loaded by default
-          sed -i '/^[[:space:]]*#/!s/\[default_sect\]/[default_sect]\nactivate = 1/g' $etc/etc/ssl/openssl.cnf
+        + lib.optionalString (extraINIConfig != null) ''
+          echo '${lib.generators.toINI { } extraINIConfig}' >> $etc/etc/ssl/openssl.cnf
         '';
 
       allowedImpureDLLs = [ "CRYPT32.dll" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cc39c1553d5a..58229591098f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8182,6 +8182,22 @@ with pkgs;
 
   openssl = openssl_3_6;
 
+  openssl_oqs = openssl.override {
+    providers = [
+      {
+        name = "oqsprovider";
+        package = pkgs.oqs-provider;
+      }
+    ];
+    autoloadProviders = true;
+
+    extraINIConfig = {
+      tls_system_default = {
+        Groups = "X25519MLKEM768:X25519:P-256:X448:P-521:ffdhe2048:ffdhe3072";
+      };
+    };
+  };
+
   openssl_legacy = openssl.override {
     conf = ../development/libraries/openssl/3.0/legacy.cnf;
   };