From 7569f2b4d99b66d2c176dc89d02a70ffb80883cd Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Wed, 3 Dec 2025 21:50:41 +0100
Subject: [PATCH 1/2] step-ca: 0.28.4 -> 0.29.0

---
 pkgs/by-name/st/step-ca/package.nix | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/st/step-ca/package.nix b/pkgs/by-name/st/step-ca/package.nix
index 7407358db680..28ce11bce858 100644
--- a/pkgs/by-name/st/step-ca/package.nix
+++ b/pkgs/by-name/st/step-ca/package.nix
@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "step-ca";
-  version = "0.28.4";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "smallstep";
@@ -24,20 +24,10 @@ buildGoModule rec {
     # Use forceFetchGit to fetch the source as git repo, as fetchGit isn't effected,
     # see https://github.com/NixOS/nixpkgs/issues/84312#issuecomment-2475948960.
     forceFetchGit = true;
-    hash = "sha256-ZIpsSNdQVkelo5b3H03N8qToHU7z+lalAE7Ur6m2YwY=";
+    hash = "sha256-TFpgVE394r6FkRWovlmDd3v/tGic2CekmO1Hp7S6KCE=";
   };
 
-  patches = [
-    # fix broken test TestHandler_RevokeCert
-    # https://github.com/smallstep/certificates/pull/2370
-    # TODO: remove at next release
-    (fetchpatch2 {
-      url = "https://github.com/smallstep/certificates/commit/b7e59c97f3b8a95a24153aeb85959118953f2bb4.patch?full_index=1";
-      hash = "sha256-GKGKUj4hpS4jo6sMvUhnD3BeE+f5vnxY5tK0a2pwpNM=";
-    })
-  ];
-
-  vendorHash = "sha256-gGPrrl5J8UrjUpof2DaSs1fAQsMSsyAMlC67h5V75+k=";
+  vendorHash = "sha256-9PlJaB3BCwoE+uFo5jUggANSH7ZWnintZYBgFL21LZ4=";
 
   ldflags = [
     "-w"

From 148c1597c6cac85d240cfa9fba94e2604c7f7dc2 Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Wed, 3 Dec 2025 21:51:03 +0100
Subject: [PATCH 2/2] nixos/step-ca: Set systemd Type=notify

step-ca supports sd_notify now: https://github.com/smallstep/certificates/pull/2463
---
 nixos/modules/services/security/step-ca.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index 3e57180a5b28..d92900b7220b 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -94,6 +94,7 @@ in
           ConditionFileNotEmpty = ""; # override upstream
         };
         serviceConfig = {
+          Type = "notify";
           User = "step-ca";
           Group = "step-ca";
           UMask = "0077";