From e50b405461b3e084c972d750c8d2f449934c9d73 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 21 Jan 2026 21:37:40 +0000
Subject: [PATCH] [staging-next] Reapply "onnxruntime,python3.pkgs.onnxruntime:
 fix runtime w/ glibc-2.42"

This reverts commit a2f23245d9a8c03cfcd0be1754fd94db922a3db0.
---
 pkgs/by-name/on/onnxruntime/package.nix       | 42 ++++++++++---------
 .../python-modules/onnxruntime/default.nix    |  4 ++
 2 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index 4b932dc5996b..8ea0c6837ee7 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -317,26 +317,28 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "onnxruntime_USE_COMPOSABLE_KERNEL_CK_TILE" false)
   ];
 
-  env =
-    lib.optionalAttrs rocmSupport {
-      MIOPEN_PATH = rocmPackages.miopen;
-      # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
-      # fatal error: 'rocrand/rocrand.h' file not found
-      HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
-        rocmPackages.hipblas
-        rocmPackages.hipcub
-        rocmPackages.hiprand
-        rocmPackages.hipsparse
-        rocmPackages.rocblas
-        rocmPackages.rocprim
-        rocmPackages.rocrand
-        rocmPackages.rocthrust
-      ];
-    }
-    // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
-      NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
-      GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
-    };
+  env = {
+    NIX_LDFLAGS = "-z,noexecstack";
+  }
+  // lib.optionalAttrs rocmSupport {
+    MIOPEN_PATH = rocmPackages.miopen;
+    # HIP steps fail to find ROCm libs when not in HIPFLAGS, causing
+    # fatal error: 'rocrand/rocrand.h' file not found
+    HIPFLAGS = lib.concatMapStringsSep " " (pkg: "-I${lib.getInclude pkg}/include") [
+      rocmPackages.hipblas
+      rocmPackages.hipcub
+      rocmPackages.hiprand
+      rocmPackages.hipsparse
+      rocmPackages.rocblas
+      rocmPackages.rocprim
+      rocmPackages.rocrand
+      rocmPackages.rocthrust
+    ];
+  }
+  // lib.optionalAttrs effectiveStdenv.hostPlatform.isMusl {
+    NIX_CFLAGS_COMPILE = "-DFLATBUFFERS_LOCALE_INDEPENDENT=0";
+    GTEST_FILTER = "*:-ContribOpTest.StringNormalizer*";
+  };
 
   doCheck =
     !(
diff --git a/pkgs/development/python-modules/onnxruntime/default.nix b/pkgs/development/python-modules/onnxruntime/default.nix
index 9685d85a72a3..ebd0e28cd243 100644
--- a/pkgs/development/python-modules/onnxruntime/default.nix
+++ b/pkgs/development/python-modules/onnxruntime/default.nix
@@ -38,6 +38,10 @@ buildPythonPackage {
     chmod +w dist
   '';
 
+  env = {
+    NIX_LDFLAGS = "-z,noexecstack";
+  };
+
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   # This project requires fairly large dependencies such as sympy which we really don't always need.