From 3d669a98fb8b35ae8ac4bcdd8c66c4ab0e9cd257 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 28 Mar 2026 18:20:55 +0000
Subject: [PATCH] vde2: switch to Mbed TLS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since wolfSSL ≥ 5.8.2 is `GPL-3.0-or-later` and VDEv2 is
`GPL-2.0-only`, it’s a licence violation to redistribute binaries
combining them.

Thankfully, upstream has added support for Mbed TLS, though not yet cut
a stable release with it. Backport the patch and switch to it. This
also avoids pulling wolfSSL unnecessarily into the QEMU closure,
which already contains Mbed TLS. It also conveniently fixes the build
on Darwin.
---
 pkgs/by-name/vd/vde2/package.nix | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vd/vde2/package.nix b/pkgs/by-name/vd/vde2/package.nix
index 707389c8b11f..9a205c2cefc9 100644
--- a/pkgs/by-name/vd/vde2/package.nix
+++ b/pkgs/by-name/vd/vde2/package.nix
@@ -5,7 +5,7 @@
   fetchpatch,
   autoreconfHook,
   libpcap,
-  wolfssl,
+  mbedtls,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -20,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    # See: <https://github.com/virtualsquare/vde-2/issues/69>
+    (fetchpatch {
+      name = "vde2-backport-mbedtls-support.patch";
+      url = "https://github.com/virtualsquare/vde-2/commit/e3f701978a0a20e56cd9829353d110d4ddcedd90.patch";
+      hash = "sha256-cq3yrA3w/K6J+RtwYX9AcG/nfctlAkc3aYJZpJxJXTQ=";
+    })
+
     (fetchpatch {
       url = "https://git.alpinelinux.org/aports/plain/main/vde2/musl-build-fix.patch?id=ddee2f86a48e087867d4a2c12849b2e3baccc238";
       sha256 = "0b5382v541bkxhqylilcy34bh83ag96g71f39m070jzvi84kx8af";
@@ -34,7 +41,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libpcap
-    wolfssl
+    mbedtls
+  ];
+
+  configureFlags = [
+    "--with-crypt=mbedtls"
   ];
 
   meta = {