From 332a5130e4ca343fd7482c6f9c077e7859c4e082 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 23 Jun 2025 22:59:34 +0200
Subject: [PATCH 1/2] libressl: fix deprecated --replace, use
 TLS_DEFAULT_CA_FILE option again, misc cleanup

---
 pkgs/development/libraries/libressl/default.nix | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix
index 00bf49f5dc25..07e2c094f1e1 100644
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@@ -23,7 +23,7 @@ let
       inherit version;
 
       src = fetchurl {
-        url = "mirror://openbsd/LibreSSL/${pname}-${version}.tar.gz";
+        url = "mirror://openbsd/LibreSSL/libressl-${version}.tar.gz";
         inherit hash;
       };
 
@@ -38,6 +38,8 @@ let
         "-DCMAKE_C_FLAGS=-DHAVE_GNU_STACK"
         # libressl will append this to the regular prefix for libdir
         "-DCMAKE_INSTALL_LIBDIR=lib"
+
+        "-DTLS_DEFAULT_CA_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"
       ] ++ lib.optional buildShared "-DBUILD_SHARED_LIBS=ON";
 
       # The autoconf build is broken as of 2.9.1, resulting in the following error:
@@ -47,19 +49,14 @@ let
       preConfigure = ''
         rm configure
         substituteInPlace CMakeLists.txt \
-          --replace 'exec_prefix \''${prefix}' "exec_prefix ${placeholder "bin"}" \
-          --replace 'libdir      \''${exec_prefix}' 'libdir \''${prefix}'
+          --replace-fail 'exec_prefix \''${prefix}' "exec_prefix ${placeholder "bin"}" \
+          --replace-fail 'libdir      \''${exec_prefix}' 'libdir \''${prefix}'
       '';
 
       inherit patches;
 
-      # Since 2.9.x the default location can't be configured from the build using
-      # DEFAULT_CA_FILE anymore, instead we have to patch the default value.
       postPatch = ''
         patchShebangs tests/
-        ${lib.optionalString (lib.versionAtLeast version "2.9.2") ''
-          substituteInPlace ./tls/tls_config.c --replace '"/etc/ssl/cert.pem"' '"${cacert}/etc/ssl/certs/ca-bundle.crt"'
-        ''}
       '';
 
       doCheck = !(stdenv.hostPlatform.isPower64 || stdenv.hostPlatform.isRiscV);
@@ -116,7 +113,6 @@ let
         ];
       };
     };
-
 in
 {
   libressl_3_6 = generic {

From 45bbfd7c49617fa7d100b08d9e76b8000857f4b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 23 Jun 2025 23:14:18 +0200
Subject: [PATCH 2/2] libressl_3_{6,7,8}: drop

see https://www.libressl.org/releases.html#:~:text=w64%20and%20Cygwin-,Support%20Schedule,-LibreSSL%20transitions%20to
---
 .../libraries/libressl/default.nix            | 38 -------------------
 pkgs/top-level/all-packages.nix               |  3 --
 2 files changed, 41 deletions(-)

diff --git a/pkgs/development/libraries/libressl/default.nix b/pkgs/development/libraries/libressl/default.nix
index 07e2c094f1e1..06554b6f749e 100644
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@@ -115,44 +115,6 @@ let
     };
 in
 {
-  libressl_3_6 = generic {
-    version = "3.6.3";
-    hash = "sha256-h7G7426e7I0K5fBMg9NrLFsOWBeEx+sIFwJe0p6t6jc=";
-    patches = [
-      (fetchpatch {
-        url = "https://github.com/libressl/portable/commit/86e4965d7f20c3a6afc41d95590c9f6abb4fe788.patch";
-        includes = [ "tests/tlstest.sh" ];
-        hash = "sha256-XmmKTvP6+QaWxyGFCX6/gDfME9GqBWSx4X8RH8QbDXA=";
-      })
-    ];
-  };
-
-  libressl_3_7 = generic {
-    version = "3.7.3";
-    hash = "sha256-eUjIVqkMglvXJotvhWdKjc0lS65C4iF4GyTj+NwzXbM=";
-    patches = [
-      (fetchpatch {
-        url = "https://github.com/libressl/portable/commit/86e4965d7f20c3a6afc41d95590c9f6abb4fe788.patch";
-        includes = [ "tests/tlstest.sh" ];
-        hash = "sha256-XmmKTvP6+QaWxyGFCX6/gDfME9GqBWSx4X8RH8QbDXA=";
-      })
-    ];
-  };
-
-  libressl_3_8 = generic {
-    version = "3.8.4";
-    hash = "sha256-wM75z+F0rDZs5IL1Qv3bB3Ief6DK+s40tJqHIPo3/n0=";
-
-    patches = [
-      # Fixes build on ppc64
-      # https://github.com/libressl/portable/pull/1073
-      (fetchpatch {
-        url = "https://github.com/libressl/portable/commit/e6c7de3f03c51fbdcf5ad88bf12fe9e128521f0d.patch";
-        hash = "sha256-LJy3fjbnc9h5DG3/+8bLECwJeBpPxy3hU8sPuhovmcw=";
-      })
-    ];
-  };
-
   libressl_3_9 = generic {
     version = "3.9.2";
     hash = "sha256-ewMdrGSlnrbuMwT3/7ddrTOrjJ0nnIR/ksifuEYGj5c=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 254403a5c8f0..4f673f2105c1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9226,9 +9226,6 @@ with pkgs;
   openvdb = callPackage ../development/libraries/openvdb { };
 
   inherit (callPackages ../development/libraries/libressl { })
-    libressl_3_6
-    libressl_3_7
-    libressl_3_8
     libressl_3_9
     libressl_4_0
     ;