From 5e941fed6e25bf4f46b1eb9b9ecd6d5a125da12d Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Sun, 27 Jul 2025 09:35:49 -0700
Subject: [PATCH] bpfilter: 0.4.0 -> 0.5.2

---
 pkgs/by-name/bp/bpfilter/package.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/bp/bpfilter/package.nix b/pkgs/by-name/bp/bpfilter/package.nix
index f76bfcb465d3..158e8de49a67 100644
--- a/pkgs/by-name/bp/bpfilter/package.nix
+++ b/pkgs/by-name/bp/bpfilter/package.nix
@@ -1,5 +1,6 @@
 {
   bison,
+  clangStdenv,
   cmake,
   cmocka,
   doxygen,
@@ -14,19 +15,19 @@
   nix-update-script,
   pkg-config,
   sphinx,
-  stdenv,
+  tinyxxd,
   zlib,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "bpfilter";
-  version = "0.4.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "bpfilter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z0L4sY944cj/rqfOwwjNWOU0tZDAsZ1ocf4/djHad2Q=";
+    hash = "sha256-qL5wRm6QmfMa5L+oZc5E2kAVqvJfCt5fBxjmtWzb2kA=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     lcov
     pkg-config
     sphinx
+    tinyxxd
 
     # bpfilter's cmake files requires this, even if we specify the version
     # we're using without needing to detect the version during the build.
@@ -64,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  # invalid with -target bpf
+  hardeningDisable = [ "zerocallusedregs" ];
+
   preFixup = ''
     substituteInPlace $out/lib/systemd/system/bpfilter.service --replace-fail /usr/sbin/bpfilter $out/bin/bpfilter