From 0298669377cdc25af94c77f170cab3eebe0584fa Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Mon, 21 Oct 2024 10:23:06 +0200
Subject: [PATCH 1/2] unbound: 1.21.1 -> 1.22.0

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/by-name/un/unbound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 6bb4dbe5f832..442ef2a8af27 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -50,11 +50,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.21.1";
+  version = "1.22.0";
 
   src = fetchurl {
     url = "https://nlnetlabs.nl/downloads/unbound/unbound-${finalAttrs.version}.tar.gz";
-    hash = "sha256-MDbSPCNiKzbTyH6UMRe97BrI+Bljbrl42AZBaw+p6kY=";
+    hash = "sha256-xd0b3vXVaFss7bdJFY3RUsUtRPZVKaNKwVzYjUsbPUM=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB

From c011c36c003c801a21d60d884128c87710a00c02 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Mon, 21 Oct 2024 10:28:25 +0200
Subject: [PATCH 2/2] unbound: fetch source from GitHub

To avoid a xz-style supply chain attack.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/by-name/un/unbound/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 442ef2a8af27..8b52ebd9dfc2 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -1,9 +1,10 @@
 { stdenv
 , lib
-, fetchurl
+, fetchFromGitHub
 , openssl
 , nettle
 , expat
+, flex
 , libevent
 , libsodium
 , protobufc
@@ -52,9 +53,11 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
   version = "1.22.0";
 
-  src = fetchurl {
-    url = "https://nlnetlabs.nl/downloads/unbound/unbound-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xd0b3vXVaFss7bdJFY3RUsUtRPZVKaNKwVzYjUsbPUM=";
+  src = fetchFromGitHub {
+    owner = "NLnetLabs";
+    repo = "unbound";
+    rev = "refs/tags/release-${finalAttrs.version}";
+    hash = "sha256-CFsd8tdFL+JbxmDZoWdStvWcs9azSaLtMG8Ih5oXE/A=";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
@@ -62,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs =
     lib.optionals withMakeWrapper [ makeWrapper ]
     ++ lib.optionals withDNSTAP [ protobufc ]
-    ++ [ pkg-config ]
+    ++ [ pkg-config flex ]
     ++ lib.optionals withPythonModule [ swig ];
 
   buildInputs = [ openssl nettle expat libevent ]