From ea62d92f6368e2da5ca695445b271ec7cb1522ef Mon Sep 17 00:00:00 2001
From: Klemens Nanni <klemens@posteo.de>
Date: Tue, 7 Jun 2022 12:10:35 +0200
Subject: [PATCH 1/2] libdigidocpp: Replace wrap with rpath addition

libdigidocpp.so itself contains the code to load the PKCS#11 module,
not digidoc-tool(1).

Wrapping `digitoc-tool`
- leaves the library broken
- is too broad (LD_LIBRARY_PATH is generic and inherited by children)
- needs an extra wrapper script (introducing subtle changes on its own)

Considering how dlopen(3) prefers the calling object's DT_RUNPATH,
simply amend that.
---
 .../development/libraries/libdigidocpp/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/libraries/libdigidocpp/default.nix b/pkgs/development/libraries/libdigidocpp/default.nix
index 1e1e892e532a..c99e96863d33 100644
--- a/pkgs/development/libraries/libdigidocpp/default.nix
+++ b/pkgs/development/libraries/libdigidocpp/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, cmake, makeWrapper, minizip, pcsclite, opensc, openssl
+{ lib, stdenv, fetchurl, fetchpatch, cmake, minizip, pcsclite, opensc, openssl
 , xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }:
 
 stdenv.mkDerivation rec {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ cmake makeWrapper pkg-config xxd ];
+  nativeBuildInputs = [ cmake pkg-config xxd ];
 
   buildInputs = [
     minizip pcsclite opensc openssl xercesc
@@ -31,11 +31,11 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" "bin" ];
 
-  # replace this hack with a proper cmake variable or environment variable
-  # once https://github.com/open-eid/cmake/pull/34 (or #35) gets merged.
-  postInstall = ''
-    wrapProgram $bin/bin/digidoc-tool \
-      --prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/
+  # libdigidocpp.so's `PKCS11Signer::PKCS11Signer()` dlopen()s "opensc-pkcs11.so"
+  # itself, so add OpenSC to its DT_RUNPATH after the fixupPhase shrinked it.
+  # https://github.com/open-eid/cmake/pull/35 might be an alternative.
+  postFixup = ''
+    patchelf --add-rpath ${opensc}/lib/pkcs11 $lib/lib/libdigidocpp.so
   '';
 
   meta = with lib; {

From 8daa103d1fecf9d95ecb89a837034cdc18daefe2 Mon Sep 17 00:00:00 2001
From: Klemens Nanni <klemens@posteo.de>
Date: Tue, 7 Jun 2022 12:21:39 +0200
Subject: [PATCH 2/2] qdigidoc: Explain why LD_LIBRARY_PATH is required

Contrary to libdigidocpp's libdigidocpp, qdigidoc uses Qt to load
modules and thus causes different search behaviour in dlopen(3).

This approach is not required on every platform;  on OpenBSD[0]
qdigidoc4(1) finds "opensc-pkcs11.so" due to /usr/local/lib/pkcs11/
in the main program's DT_RUNPATH.

0: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/libexec/ld.so/library_subr.c?annotate=1.51
   (line 297)
---
 pkgs/tools/security/qdigidoc/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix
index f76349c3dcf2..f7d40dc604cb 100644
--- a/pkgs/tools/security/qdigidoc/default.nix
+++ b/pkgs/tools/security/qdigidoc/default.nix
@@ -35,10 +35,14 @@ mkDerivation rec {
     qttranslations
   ];
 
-  # replace this hack with a proper cmake variable or environment variable
-  # once https://github.com/open-eid/cmake/pull/34 (or #35) gets merged.
+  # qdigidoc4's `QPKCS11::reload()` dlopen()s "opensc-pkcs11.so" in QLibrary,
+  # i.e. OpenSC's module is searched for in libQt5Core's DT_RUNPATH and fixing
+  # qdigidoc4's DT_RUNPATH has no effect on Linux (at least OpenBSD's ld.so(1)
+  # searches the program's runtime path as well).
+  # LD_LIBRARY_PATH takes precedence for all calling objects, see dlopen(3).
+  # https://github.com/open-eid/cmake/pull/35 might be an alternative.
   qtWrapperArgs = [
-      "--prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/"
+    "--prefix LD_LIBRARY_PATH : ${opensc}/lib/pkcs11/"
   ];
 
   meta = with lib; {