From d1d7a14e58080de93080642a86a8fa2f8f9e831d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 2 Jul 2026 12:14:42 +0300
Subject: [PATCH] vscode: fix vsce-sign integrity check

Extension updates fail with signature verification errors since
1.125, because auto-patchelf messes up the vsce-sign binary somehow.

Instead, just copy the original back into place after all the fixups,
and do the smallest amount of patchelfing possible.

(also it's dotnet, not node)
---
 pkgs/applications/editors/vscode/generic.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 752ff76bf682..652b2fab1896 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -308,11 +308,6 @@ stdenv.mkDerivation (
     dontConfigure = true;
     noDumpEnvVars = true;
 
-    stripExclude = lib.optional hasVsceSign [
-      # vsce-sign is a single executable application built with Node.js, and it becomes non-functional if stripped
-      "lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
-    ];
-
     installPhase = ''
       runHook preInstall
     ''
@@ -474,9 +469,11 @@ stdenv.mkDerivation (
           --add-needed ${libglvnd}/lib/libEGL.so.1 \
           $out/lib/${libraryName}/${executableName}
       ''
+      # restore original vsce-sign, which has integrity checks
       + (lib.optionalString hasVsceSign ''
+        cp -r ./resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign "$out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
         patchelf \
-          --add-needed ${lib.getLib openssl}/lib/libssl.so \
+          --add-needed ${lib.getLib openssl}/lib/libssl.so.3 \
           $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
       '')
     );