From 4739a32ec87577968ed73d79d203d7c69a64bf55 Mon Sep 17 00:00:00 2001
From: Siddhartha Sahu <dev@sdht.in>
Date: Sat, 5 Apr 2025 13:05:57 -0400
Subject: [PATCH] checksec: 2.6.0 -> 3.0.2

---
 ...dprobe-config-before-checking-kernel.patch | 24 -----
 .../0002-don-t-sanatize-the-environment.patch | 25 ------
 pkgs/by-name/ch/checksec/package.nix          | 90 ++++---------------
 3 files changed, 15 insertions(+), 124 deletions(-)
 delete mode 100644 pkgs/by-name/ch/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch
 delete mode 100644 pkgs/by-name/ch/checksec/0002-don-t-sanatize-the-environment.patch

diff --git a/pkgs/by-name/ch/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch b/pkgs/by-name/ch/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch
deleted file mode 100644
index 2aabbc4d4c80..000000000000
--- a/pkgs/by-name/ch/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 5cfb08effd21d9278e3eb8901c85112a331c3181 Mon Sep 17 00:00:00 2001
-From: Austin Seipp <aseipp@pobox.com>
-Date: Tue, 26 Oct 2021 09:23:07 +0000
-Subject: [PATCH] attempt to 'modprobe config' before checking kernel
-
----
- checksec | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/checksec b/checksec
-index 5536250..895073b 100755
---- a/checksec
-+++ b/checksec
-@@ -1059,6 +1059,7 @@ kernelcheck() {
-   echo_message "  options that harden the kernel itself against attack.\n\n" '' '' ''
-   echo_message "  Kernel config:\n" '' '' '{ "kernel": '
-
-+  modprobe configs 2> /dev/null
-   if [[ ! "${1}" == "" ]]; then
-     kconfig="cat ${1}"
-     echo_message "  Warning: The config ${1} on disk may not represent running kernel config!\n\n" "${1}" "<kernel config=\"${1}\"" "{ \"KernelConfig\":\"${1}\""
--- 
-2.33.0
-
diff --git a/pkgs/by-name/ch/checksec/0002-don-t-sanatize-the-environment.patch b/pkgs/by-name/ch/checksec/0002-don-t-sanatize-the-environment.patch
deleted file mode 100644
index bd639574f63f..000000000000
--- a/pkgs/by-name/ch/checksec/0002-don-t-sanatize-the-environment.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 3b047ab4271919856ae0a3dee3a03a24045c0016 Mon Sep 17 00:00:00 2001
-From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
-Date: Mon, 13 Nov 2023 20:24:54 +0000
-Subject: [PATCH] don't sanatize the environment
-
----
- checksec | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/checksec b/checksec
-index 4fc3c31..135223a 100755
---- a/checksec
-+++ b/checksec
-@@ -2,9 +2,6 @@
- # Do not edit this file directly, this file is generated from the files
- # in the src directory. Any updates to this file will be overwritten when generated
-
--# sanitize the environment before run
--[[ "$(env | /bin/sed -r -e '/^(PWD|SHLVL|_)=/d')" ]] && exec -c "$0" "$@"
--
- # --- Modified Version ---
- # Name    : checksec.sh
- # Version : 1.7.0
---
-2.42.0
diff --git a/pkgs/by-name/ch/checksec/package.nix b/pkgs/by-name/ch/checksec/package.nix
index c479c7f14510..620b6beeaf81 100644
--- a/pkgs/by-name/ch/checksec/package.nix
+++ b/pkgs/by-name/ch/checksec/package.nix
@@ -1,110 +1,50 @@
 {
   lib,
-  stdenv,
-  fetchpatch,
   fetchFromGitHub,
-  makeWrapper,
-  testers,
-  runCommand,
 
-  # dependencies
-  binutils,
-  coreutils,
-  curl,
-  elfutils,
-  file,
-  findutils,
-  gawk,
-  glibc,
-  gnugrep,
-  gnused,
-  openssl,
-  procps,
-  sysctl,
-  wget,
-  which,
+  buildGoModule,
 
   # tests
+  testers,
   checksec,
 }:
 
-stdenv.mkDerivation rec {
+buildGoModule rec {
   pname = "checksec";
-  version = "2.6.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "slimm609";
-    repo = "checksec.sh";
-    rev = version;
-    hash = "sha256-BWtchWXukIDSLJkFX8M/NZBvfi7vUE2j4yFfS0KEZDo=";
+    repo = "checksec";
+    tag = version;
+    hash = "sha256-ZpDowTmnK23+ZocOY1pJMgMSn7FiQQGvMg/gSbiL1nw=";
   };
 
-  patches = [
-    ./0001-attempt-to-modprobe-config-before-checking-kernel.patch
-    # Tool would sanitize the environment, removing the PATH set by our wrapper.
-    ./0002-don-t-sanatize-the-environment.patch
-    # Fix the exit code of debug_report command. Check if PR 226 was merged when upgrading version.
-    (fetchpatch {
-      url = "https://github.com/slimm609/checksec.sh/commit/851ebff6972f122fde5507f1883e268bbff1f23d.patch";
-      hash = "sha256-DOcVF+oPGIR9VSbqE+EqWlcNANEvou1gV8qBvJLGLBE=";
-    })
-  ];
+  vendorHash = "sha256-7poHsEsRATljkqtfGxzqUbqhwSjVmiao2KoMVQ8LkD4=";
 
-  nativeBuildInputs = [
-    makeWrapper
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
   ];
 
-  installPhase =
-    let
-      path = lib.makeBinPath [
-        binutils
-        coreutils
-        curl
-        elfutils
-        file
-        findutils
-        gawk
-        gnugrep
-        gnused
-        openssl
-        procps
-        sysctl
-        wget
-        which
-      ];
-    in
-    ''
-      mkdir -p $out/bin
-      install checksec $out/bin
-      substituteInPlace $out/bin/checksec \
-        --replace "/bin/sed" "${gnused}/bin/sed" \
-        --replace "/usr/bin/id" "${coreutils}/bin/id" \
-        --replace "/lib/libc.so.6" "${glibc}/lib/libc.so.6"
-      wrapProgram $out/bin/checksec \
-        --prefix PATH : ${path}
-    '';
-
   passthru.tests = {
     version = testers.testVersion {
       package = checksec;
-      version = "v${version}";
+      inherit version;
     };
-    debug-report = runCommand "debug-report" { buildInputs = [ checksec ]; } ''
-      checksec --debug_report || exit 1
-      echo "OK"
-      touch $out
-    '';
   };
 
   meta = with lib; {
     description = "Tool for checking security bits on executables";
     mainProgram = "checksec";
-    homepage = "https://www.trapkit.de/tools/checksec/";
+    homepage = "https://slimm609.github.io/checksec/";
     license = licenses.bsd3;
     platforms = platforms.linux;
     maintainers = with maintainers; [
       thoughtpolice
       globin
+      sdht0
     ];
   };
 }