From 61e7d035d398129a5cf6a942bf959637c7d7a889 Mon Sep 17 00:00:00 2001
From: Marc Brinkmann <git@marcbrinkmann.de>
Date: Thu, 29 Jan 2026 14:51:53 +0100
Subject: [PATCH] openssl_1_1: fix build after 3.0.19 patch update

The security update for OpenSSL 3.0.19 (d1cc6bdd) updated
use-etc-ssl-certs.patch to match the new formatting in 3.0.19,
which removed whitespace from preprocessor directives.

OpenSSL 1.1.1w still uses the old formatting, causing the shared
patch to fail.

This patch restores the old patch files into subfolder `1.1`, they
are byte-for-byte identical (same git blob hash).
---
 .../openssl/1.1/use-etc-ssl-certs-darwin.patch      | 13 +++++++++++++
 .../libraries/openssl/1.1/use-etc-ssl-certs.patch   | 13 +++++++++++++
 pkgs/development/libraries/openssl/default.nix      |  5 ++++-
 3 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs-darwin.patch
 create mode 100644 pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs.patch

diff --git a/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs-darwin.patch b/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs-darwin.patch
new file mode 100644
index 000000000000..2c98ccfa7ed0
--- /dev/null
+++ b/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs-darwin.patch
@@ -0,0 +1,13 @@
+diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h
+index 329ef62..9a8df64 100644
+--- a/include/internal/cryptlib.h
++++ b/include/internal/cryptlib.h
+@@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM);
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
++#  define X509_CERT_FILE          "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
+ # else
diff --git a/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs.patch b/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs.patch
new file mode 100644
index 000000000000..67d199681f96
--- /dev/null
+++ b/pkgs/development/libraries/openssl/1.1/use-etc-ssl-certs.patch
@@ -0,0 +1,13 @@
+diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h
+index 329ef62..9a8df64 100644
+--- a/include/internal/cryptlib.h
++++ b/include/internal/cryptlib.h
+@@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM);
+ # ifndef OPENSSL_SYS_VMS
+ #  define X509_CERT_AREA          OPENSSLDIR
+ #  define X509_CERT_DIR           OPENSSLDIR "/certs"
+-#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
++#  define X509_CERT_FILE          "/etc/ssl/certs/ca-certificates.crt"
+ #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
+ #  define CTLOG_FILE              OPENSSLDIR "/ct_log_list.cnf"
+ # else
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index b4aff30cb3c0..c89360283e10 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -417,7 +417,10 @@ in
       ./1.1/nix-ssl-cert-file.patch
 
       (
-        if stdenv.hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch
+        if stdenv.hostPlatform.isDarwin then
+          ./1.1/use-etc-ssl-certs-darwin.patch
+        else
+          ./1.1/use-etc-ssl-certs.patch
       )
     ];
     withDocs = true;