From 06b17cff7d67f07779cc4b2adae419012c90f677 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 15:40:47 +0000
Subject: [PATCH 1/3] libapparmor: 4.1.7 -> 5.0.0

---
 pkgs/by-name/li/libapparmor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix
index 9290ebfa7044..7cfb71447ceb 100644
--- a/pkgs/by-name/li/libapparmor/package.nix
+++ b/pkgs/by-name/li/libapparmor/package.nix
@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "4.1.7";
+  version = "5.0.0";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yjqdUwHkQ1uiPKPZQVf/o8tGixQeIKNMOIYo4aVK7N0=";
+    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

From 33961684091fb623efc13c0fb1a889b8aeb79eac Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 23:41:50 +0200
Subject: [PATCH 2/3] apparmor-parser: fix for apparmor 5.0

---
 pkgs/by-name/ap/apparmor-parser/package.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 47927ab6477b..0191929c5efe 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -6,6 +6,7 @@
   bison,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
+  zstd,
 
   # apparmor deps
   libapparmor,
@@ -23,15 +24,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs .
+
+    substituteInPlace init/rc.apparmor.functions \
+      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \
+      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
+    sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
     cd parser
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
-    sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
+    # strict format check causes yacc auto-generated code to fail.
+    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
+    # removing the compile-time check here downgrades the issue and allows compilation to succeed
+    substituteInPlace parser.h \
+      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
+        'extern void yyerror(const char *msg, ...);'
   '';
 
   nativeBuildInputs = [
@@ -42,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libapparmor
+    zstd
     runtimeShellPackage
   ];
 

From a6b392bab03e99a052ff914e582163fdbeb85360 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 23:43:03 +0200
Subject: [PATCH 3/3] apparmor-profiles: fix test for apparmor 5.0

---
 pkgs/by-name/ap/apparmor-profiles/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ap/apparmor-profiles/package.nix b/pkgs/by-name/ap/apparmor-profiles/package.nix
index db3c21009b4c..7ecb3ba5cb3c 100644
--- a/pkgs/by-name/ap/apparmor-profiles/package.nix
+++ b/pkgs/by-name/ap/apparmor-profiles/package.nix
@@ -1,7 +1,9 @@
 {
+  lib,
   stdenv,
   which,
   callPackage,
+  python3,
 
   # apparmor deps
   libapparmor,
@@ -28,9 +30,16 @@ stdenv.mkDerivation {
     apparmor-utils
   ];
 
+  checkInputs = [
+    python3
+  ];
+
   preCheck = ''
     export USE_SYSTEM=1
     export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
+    patchShebangs ../parser/tst
+    substituteInPlace ../parser/tst/test_profile.py \
+      --replace-fail '../parser/apparmor_parser' '${lib.getExe apparmor-parser}'
   '';
 
   doCheck = true;