linux-pam: 1.6.1 -> 1.7.1

PAM switched to meson build upstream, which requires some care:
- build with logind support
- reenable lastlog
- clean up autotools remnants
- disable debug as it slows down test making it fail

pkgs/by-name/li/linux-pam/package.nix

@@ -2,98 +2,100 @@
   lib,
   stdenv,
   buildPackages,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
   flex,
   db4,
   gettext,
+  ninja,
   audit,
   libxcrypt,
   nixosTests,
-  autoreconfHook269,
-  pkg-config-unwrapped,
+  meson,
+  pkg-config,
+  systemdLibs,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "linux-pam";
-  version = "1.6.1";
+  version = "1.7.1";
 
-  src = fetchurl {
-    url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
+  src = fetchFromGitHub {
+    owner = "linux-pam";
+    repo = "linux-pam";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
   };
 
-  patches = [
-    ./suid-wrapper-path.patch
-    # required for fixing CVE-2025-6020
-    (fetchpatch {
-      url = "https://github.com/linux-pam/linux-pam/commit/10b80543807e3fc5af5f8bcfd8bb6e219bb3cecc.patch";
-      hash = "sha256-VS3D3wUbDxDXRriIuEvvgeZixzDA58EfiLygfFeisGg=";
-    })
-    # Manually cherry-picked from 475bd60c552b98c7eddb3270b0b4196847c0072e
-    ./CVE-2025-6020.patch
-  ];
-
-  # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
-  postPatch =
-    lib.optionalString (stdenv.buildPlatform.isDarwin && stdenv.buildPlatform != stdenv.hostPlatform)
-      ''
-        rm CHANGELOG
-        touch ChangeLog
-      '';
+  # patching unix_chkpwd is required as the nix store entry does not have the necessary bits
+  postPatch = ''
+    substituteInPlace modules/module-meson.build \
+      --replace-fail "sbindir / 'unix_chkpwd'" "'/run/wrappers/bin/unix_chkpwd'"
+  '';
 
   outputs = [
     "out"
-    "doc"
-    "man" # "modules"
+    # "doc"
+    # "man"
+    # "modules"
   ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  # autoreconfHook269 is needed for `suid-wrapper-path.patch` above.
-  # pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS`
   nativeBuildInputs = [
     flex
-    autoreconfHook269
-    pkg-config-unwrapped
-  ]
-  ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
+    meson
+    ninja
+    pkg-config
+    gettext
+  ];
 
   buildInputs = [
     db4
     libxcrypt
   ]
-  ++ lib.optional stdenv.buildPlatform.isLinux audit;
+  ++ lib.optionals stdenv.buildPlatform.isLinux [
+    audit
+    systemdLibs
+  ];
 
   enableParallelBuilding = true;
 
-  configureFlags = [
-    "--includedir=${placeholder "out"}/include/security"
-    "--enable-sconfigdir=/etc/security"
-    # The module is deprecated. We re-enable it explicitly until NixOS
-    # module stops using it.
-    "--enable-lastlog"
-  ];
-
-  installFlags = [
-    "SCONFIGDIR=${placeholder "out"}/etc/security"
+  mesonFlags = [
+    (lib.mesonEnable "logind" stdenv.buildPlatform.isLinux)
+    (lib.mesonEnable "audit" stdenv.buildPlatform.isLinux)
+    (lib.mesonEnable "pam_lastlog" (!stdenv.hostPlatform.isMusl)) # TODO: switch to pam_lastlog2, pam_lastlog is deprecated and broken on musl
+    (lib.mesonEnable "pam_unix" true)
+    # (lib.mesonBool "pam-debug" true) # warning: slower execution due to debug makes VM tests fail!
+    (lib.mesonOption "sysconfdir" "etc") # relative to meson prefix, which is $out
+    (lib.mesonEnable "elogind" false)
+    (lib.mesonEnable "econf" false)
+    (lib.mesonEnable "selinux" false)
+    (lib.mesonEnable "nis" false)
+    (lib.mesonEnable "docs" false)
+    (lib.mesonBool "xtests" false)
+    (lib.mesonBool "examples" false)
   ];
 
   doCheck = false; # fails
 
-  passthru.tests = {
-    inherit (nixosTests)
-      pam-oath-login
-      pam-u2f
-      pam-lastlog
-      shadow
-      sssd-ldap
-      ;
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        pam-oath-login
+        pam-u2f
+        pam-lastlog
+        shadow
+        sssd-ldap
+        ;
+    };
+    updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/linux-pam/linux-pam/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/linux-pam/linux-pam";
     description = "Pluggable Authentication Modules, a flexible mechanism for authenticating user";
-    platforms = platforms.linux;
-    license = licenses.bsd3;
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd3;
   };
-}
+})

pkgs/by-name/li/linux-pam/suid-wrapper-path.patch

@@ -1,6 +0,0 @@
-It needs the SUID version during runtime, and that can't be in /nix/store/**
---- a/modules/pam_unix/Makefile.am
-+++ b/modules/pam_unix/Makefile.am
-@@ -21 +21 @@
--	-DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \
-+	-DCHKPWD_HELPER=\"/run/wrappers/bin/unix_chkpwd\" \