From a30539e39669692aae886270f9e533b0735b0916 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Sat, 28 Mar 2026 21:28:59 -0700
Subject: [PATCH] wolfssl: add enableJni option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add an `enableJni` parameter that passes `--enable-jni` and patches out
failing ECH, CA_NAMES, and QUIC tests.  This replaces the raw
`overrideAttrs` in art-standalone with a clean `wolfssl.override`,
per the guidance in pkgs/README.md § "overrideAttrs and
overridePythonAttrs".
---
 pkgs/by-name/ar/art-standalone/package.nix | 14 +-------------
 pkgs/by-name/wo/wolfssl/package.nix        | 12 ++++++++++++
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ar/art-standalone/package.nix b/pkgs/by-name/ar/art-standalone/package.nix
index f6d383897132..6f0a62d6b9eb 100644
--- a/pkgs/by-name/ar/art-standalone/package.nix
+++ b/pkgs/by-name/ar/art-standalone/package.nix
@@ -65,19 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     lz4
     openssl
-    (wolfssl.overrideAttrs (oldAttrs: {
-      configureFlags = oldAttrs.configureFlags ++ [
-        "--enable-jni"
-      ];
-      # Disable failing tests when jni enabled
-      postPatch = oldAttrs.postPatch or "" + ''
-        sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d;
-                /TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d;
-                /TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c
-        sed -i '/quic/d' tests/include.am
-        sed -i '300,305d' tests/unit.c
-      '';
-    }))
+    (wolfssl.override { enableJni = true; })
     xz
     zlib
   ];
diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index e904c4dfefcc..d27efb056bc7 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -10,6 +10,7 @@
   # requiring to build a special variant for that software. Example: 'haproxy'
   variant ? "all",
   extraConfigureFlags ? [ ],
+  enableJni ? false,
   enableARMCryptoExtensions ?
     stdenv.hostPlatform.isAarch64
     && ((builtins.match "^.*\\+crypto.*$" stdenv.hostPlatform.gcc.arch) != null),
@@ -31,6 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     # ensure test detects musl-based systems too
     substituteInPlace scripts/ocsp-stapling2.test \
       --replace '"linux-gnu"' '"linux-"'
+  ''
+  + lib.optionalString enableJni ''
+    # Some tests fail when JNI is enabled
+    sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d;
+            /TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d;
+            /TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c
+    sed -i '/quic/d' tests/include.am
+    sed -i '/WOLFSSL_QUIC/,/#endif/d' tests/unit.c
   '';
 
   configureFlags = [
@@ -65,6 +74,9 @@ stdenv.mkDerivation (finalAttrs: {
     # No runtime detection under ARM and no platform function checks like for X86.
     (if enableARMCryptoExtensions then "--enable-armasm=inline" else "--disable-armasm")
   ]
+  ++ lib.optionals enableJni [
+    "--enable-jni"
+  ]
   ++ extraConfigureFlags;
 
   # Breaks tls13 tests on aarch64-darwin.