From 7f556b60b632f19cf1d25158e6b8b506116a3d59 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Sat, 15 Nov 2025 13:00:45 +0100
Subject: [PATCH] openscap: discover built-in plugins (like SCE)

openscap calls dlopen() to discover plugins.
It prefixes the path that is dlopened with
OSCAP_CHECK_ENGINE_PLUGIN_DIR. By setting
that env-var we can make openscap discover
the built-in plugins that it ships with by
default. (Currently only SCE).
---
 pkgs/by-name/op/openscap/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/op/openscap/package.nix b/pkgs/by-name/op/openscap/package.nix
index 34776269a5ca..a2ccbd9235ea 100644
--- a/pkgs/by-name/op/openscap/package.nix
+++ b/pkgs/by-name/op/openscap/package.nix
@@ -26,6 +26,7 @@
   valgrind,
   asciidoc,
   installShellFiles,
+  makeWrapper,
   rpm,
   system-sendmail,
   gnome2,
@@ -55,6 +56,7 @@ stdenv.mkDerivation rec {
     cmake
     asciidoc
     doxygen
+    makeWrapper
     rpm
     swig
     util-linux
@@ -143,6 +145,13 @@ stdenv.mkDerivation rec {
     rm -rf $out/share/man8
   '';
 
+  postFixup = ''
+    # Set plugin directory to discover the SCE plugin.
+    # openscap calls dlopen with this as the directory prefix.
+    wrapProgram $out/bin/oscap \
+      --set OSCAP_CHECK_ENGINE_PLUGIN_DIR $out/lib
+  '';
+
   meta = {
     description = "NIST Certified SCAP 1.2 toolkit";
     homepage = "https://github.com/OpenSCAP/openscap";