From e5cd30ecc2b96879e989e0593529e1e03304edf4 Mon Sep 17 00:00:00 2001
From: Benjamin Staffin <benley@gmail.com>
Date: Wed, 5 Feb 2025 18:04:48 -0500
Subject: [PATCH 1/2] freeipa: 4.12.1 -> 4.12.3

freeipa 4.12.1 was broken in unstable due to incompatibility with
cryptography 44.0.

- Version bump
- Add required patches (merged upstream, but not in a release yet) for
  cryptography and PyCA 44.0
- Add versionCheckHook so we catch similar breakage in the future
---
 pkgs/os-specific/linux/freeipa/default.nix | 26 ++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
index 5a60b256bde1..67d1cb5a9622 100644
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchurl,
+  fetchpatch,
   pkg-config,
   autoconf,
   automake,
@@ -34,6 +35,7 @@
   lesscpy,
   jansson,
   runtimeShell,
+  versionCheckHook,
 }:
 
 let
@@ -66,13 +68,26 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freeipa";
-  version = "4.12.1";
+  version = "4.12.3";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
-    sha256 = "sha256-SPZ+QgssDKG1Hz1oqtVdg864qtcvncuOlzTWjN4+loM=";
+    sha256 = "sha256-bVttsyn99DX01CmthIxzxuJPGgqZB2+pgamviO4LBJI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-pyca-44.0";
+      url = "https://github.com/freeipa/freeipa/pull/7619/commits/2dc4133920fe58ce414c545102c74173d40d1997.patch";
+      hash = "sha256-PROnPc/1qS3hcO8s5sel55tsyZ1VPjEKLcua8Pd4DP0=";
+    })
+    (fetchpatch {
+      name = "fix-tripledes-cipher-warnings";
+      url = "https://github.com/freeipa/freeipa/pull/7619/commits/e2bf6e4091c7b5320ec6387dab2d5cabe4a9a42d.patch";
+      hash = "sha256-AyMK0hjXMrFK4/qIcjPMFH9DKvnvYOK2QS83Otcc+l4=";
+    })
+  ];
+
   nativeBuildInputs = [
     python3.pkgs.wrapPython
     jre
@@ -156,6 +171,13 @@ stdenv.mkDerivation rec {
     rm -rf $out/etc/ipa $out/var/lib/ipa-client/sysrestore
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   meta = with lib; {
     description = "Identity, Policy and Audit system";
     longDescription = ''

From 4d7a31df8aa007dc0af76c02cc4873753ab144b5 Mon Sep 17 00:00:00 2001
From: Benjamin Staffin <benley@gmail.com>
Date: Wed, 5 Feb 2025 18:07:13 -0500
Subject: [PATCH 2/2] freeipa: add benley to maintainers

---
 pkgs/os-specific/linux/freeipa/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
index 67d1cb5a9622..212080d23365 100644
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -189,7 +189,10 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://www.freeipa.org/";
     license = licenses.gpl3Plus;
-    maintainers = [ maintainers.s1341 ];
+    maintainers = with maintainers; [
+      s1341
+      benley
+    ];
     platforms = platforms.linux;
     mainProgram = "ipa";
   };