From f9ded06725fe95a31637c3176fc2e1b620e244af Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Wed, 10 Jun 2026 13:27:30 +0200
Subject: [PATCH] cryfs: fix static build and tests

Co-authored-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/cr/cryfs/package.nix | 118 ++++++++++++++++++++----------
 1 file changed, 81 insertions(+), 37 deletions(-)

diff --git a/pkgs/by-name/cr/cryfs/package.nix b/pkgs/by-name/cr/cryfs/package.nix
index 1daefa523781..4505ab2bad8b 100644
--- a/pkgs/by-name/cr/cryfs/package.nix
+++ b/pkgs/by-name/cr/cryfs/package.nix
@@ -13,37 +13,33 @@
   range-v3,
   spdlog,
   llvmPackages,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cryfs";
   version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "cryfs";
     repo = "cryfs";
-    rev = version;
-    hash = "sha256-bBe//AjA9QmdSDlb0xiOboE5F4g6LJ03cHQZpfOk+Y4=";
+    tag = finalAttrs.version;
+    hash = "sha256-DbXZxPACisAcdaqaqRiBK2Su/Wp6E9Mh+w62EkJrpYA=";
   };
 
   postPatch = ''
-    patchShebangs src
-
-    # remove tests that require network access
-    substituteInPlace test/cpp-utils/CMakeLists.txt \
-      --replace "network/CurlHttpClientTest.cpp" "" \
-      --replace "network/FakeHttpClientTest.cpp" ""
-
-    # remove CLI test trying to access /dev/fuse
-    substituteInPlace test/cryfs-cli/CMakeLists.txt \
-      --replace "CliTest_IntegrityCheck.cpp" "" \
-      --replace "CliTest_Setup.cpp" "" \
-      --replace "CliTest_WrongEnvironment.cpp" "" \
-      --replace "CryfsUnmountTest.cpp" ""
-
-    # downsize large file test as 4.5G is too big for Hydra
+    patchShebangs src/
+  ''
+  # Set Boost_USE_STATIC_LIBS via CMake command line. (see cmakeFlags below)
+  + ''
+    substituteInPlace cmake-utils/Dependencies.cmake \
+      --replace-fail "set(Boost_USE_STATIC_LIBS OFF)" ""
+  ''
+  # Downsize large file test as 4.5G is too big for Hydra.
+  + ''
     substituteInPlace test/cpp-utils/data/DataTest.cpp \
-      --replace "(4.5L*1024*1024*1024)" "(0.5L*1024*1024*1024)"
+      --replace-fail "(4.5L*1024*1024*1024)" "(0.5L*1024*1024*1024)"
   '';
 
   nativeBuildInputs = [
@@ -66,38 +62,86 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
 
   cmakeFlags = [
-    "-DDEPENDENCY_CONFIG='../cmake-utils/DependenciesFromLocalSystem.cmake'"
-    "-DCRYFS_UPDATE_CHECKS:BOOL=FALSE"
-    "-DBoost_USE_STATIC_LIBS:BOOL=FALSE" # this option is case sensitive
-    "-DBUILD_TESTING:BOOL=${if doCheck then "TRUE" else "FALSE"}"
+    (lib.cmakeFeature "DEPENDENCY_CONFIG" "../cmake-utils/DependenciesFromLocalSystem.cmake")
+    (lib.cmakeBool "CRYFS_UPDATE_CHECKS" false)
+    (lib.cmakeBool "Boost_USE_STATIC_LIBS" stdenv.hostPlatform.isStatic) # This option is case sensitive.
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
   ];
 
-  # macFUSE needs to be installed for the test to succeed on Darwin
+  # macFUSE needs to be installed for the tests to succeed on Darwin.
   doCheck = !stdenv.hostPlatform.isDarwin;
 
-  checkPhase = ''
-    runHook preCheck
-    export HOME=$(mktemp -d)
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+  ];
 
-    # Skip CMakeFiles directory and tests depending on fuse (does not work well with sandboxing)
-    SKIP_IMPURE_TESTS="CMakeFiles|fspp|my-gtest-main"
+  checkPhase =
+    let
+      runTest =
+        {
+          path,
+          filter ? null,
+        }:
+        "command ./${path}${lib.optionalString (!isNull filter) " '--gtest_filter=${filter}'"}";
+    in
+    ''
+      runHook preCheck
 
-    for t in $(ls -d test/*/ | grep -E -v "$SKIP_IMPURE_TESTS") ; do
-      "./$t$(basename $t)-test"
-    done
+      pushd test/
+    ''
+    # See the test runner at https://github.com/cryfs/cryfs/blob/1.0.3/.github/workflows/actions/run_tests/action.yaml.
+    + (lib.concatLines [
+      (runTest {
+        path = "gitversion/gitversion-test";
+      })
+      (runTest {
+        path = "cpp-utils/cpp-utils-test";
+        filter =
+          if stdenv.hostPlatform.isStatic then "*-BacktraceTest.*:*.AssertMessageContainsBacktrace" else null;
+      })
+      (runTest {
+        path = "parallelaccessstore/parallelaccessstore-test";
+      })
+      (runTest {
+        path = "blockstore/blockstore-test";
+      })
+      (runTest {
+        path = "blobstore/blobstore-test";
+      })
+      (runTest {
+        path = "cryfs/cryfs-test";
+      })
+      # Skip tests trying to access /dev/fuse inside the build sandbox.
+      (runTest {
+        path = "fspp/fspp-test";
+        filter = ""; # Skip all tests.
+      })
+      (runTest {
+        path = "cryfs-cli/cryfs-cli-test";
+        filter = "*-CliTest.WorksWithCommasInBasedir:CliTest_IntegrityCheck.*:CliTest_Setup.*:CliTest_Unmount.*:RunningInForeground*";
+      })
+    ])
+    + ''
+      popd
 
-    runHook postCheck
-  '';
+      runHook postCheck
+    '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
 
   meta = {
     description = "Cryptographic filesystem for the cloud";
     homepage = "https://www.cryfs.org/";
-    changelog = "https://github.com/cryfs/cryfs/raw/${version}/ChangeLog.txt";
+    changelog = "https://github.com/cryfs/cryfs/raw/${finalAttrs.version}/ChangeLog.txt";
     license = lib.licenses.lgpl3Only;
     maintainers = with lib.maintainers; [
       peterhoeg
       sigmasquadron
     ];
-    platforms = lib.platforms.unix;
+    platforms = lib.systems.inspect.patterns.isUnix;
   };
-}
+})