From 5c6ab576b399cfe5abfbd8a593a0dee55d8086bf Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 18:20:55 +0000 Subject: [PATCH 1/5] wolfSSL: correct `meta.license` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream switched from `GPL-2.0-or-later` to `GPL-3.0-or-later` in a CVE‐fixing patch release: * * I’ll omit my opinion on the wisdom of that decision. --- pkgs/by-name/wo/wolfssl/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix index 52c0d752dc0a..8418be4e39d4 100644 --- a/pkgs/by-name/wo/wolfssl/package.nix +++ b/pkgs/by-name/wo/wolfssl/package.nix @@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: { homepage = "https://www.wolfssl.com/"; changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${finalAttrs.version}-stable"; platforms = lib.platforms.all; - license = lib.licenses.gpl2Plus; + license = lib.licenses.gpl3Plus; maintainers = with lib.maintainers; [ fab vifino From 12a57e93e221311b572a4c54dc19db5a2166f411 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 18:20:55 +0000 Subject: [PATCH 2/5] vde2: correct `meta.license` --- pkgs/by-name/vd/vde2/package.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/vd/vde2/package.nix b/pkgs/by-name/vd/vde2/package.nix index 6bb1a895fccd..68121833bed8 100644 --- a/pkgs/by-name/vd/vde2/package.nix +++ b/pkgs/by-name/vd/vde2/package.nix @@ -45,6 +45,12 @@ stdenv.mkDerivation (finalAttrs: { homepage = "https://github.com/virtualsquare/vde-2"; description = "Virtual Distributed Ethernet, an Ethernet compliant virtual network"; platforms = lib.platforms.unix; - license = lib.licenses.gpl2Plus; + license = [ + # Effectively `lib.licenses.gpl2Only`, but file headers differ. + lib.licenses.gpl2Plus + lib.licenses.gpl2Only + # libvdeplug and code copied from glibc. + lib.licenses.lgpl21Plus + ]; }; }) From 217a550db5db52f46ca3ca4d664785430eb43b9e Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 18:37:30 +0000 Subject: [PATCH 3/5] vde2: make Musl patch unconditional --- pkgs/by-name/vd/vde2/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/vd/vde2/package.nix b/pkgs/by-name/vd/vde2/package.nix index 68121833bed8..89b52452767e 100644 --- a/pkgs/by-name/vd/vde2/package.nix +++ b/pkgs/by-name/vd/vde2/package.nix @@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: { sha256 = "sha256-Yf6QB7j5lYld2XtqhYspK4037lTtimoFc7nCavCP+mU="; }; - patches = lib.optionals stdenv.hostPlatform.isMusl [ + patches = [ (fetchpatch { url = "https://git.alpinelinux.org/aports/plain/main/vde2/musl-build-fix.patch?id=ddee2f86a48e087867d4a2c12849b2e3baccc238"; sha256 = "0b5382v541bkxhqylilcy34bh83ag96g71f39m070jzvi84kx8af"; From 42c772cf00d3b5064336427973a61f4cb68acde6 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 18:20:55 +0000 Subject: [PATCH 4/5] vde2: remove obsolete Darwin workaround --- pkgs/by-name/vd/vde2/package.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/pkgs/by-name/vd/vde2/package.nix b/pkgs/by-name/vd/vde2/package.nix index 89b52452767e..707389c8b11f 100644 --- a/pkgs/by-name/vd/vde2/package.nix +++ b/pkgs/by-name/vd/vde2/package.nix @@ -30,10 +30,6 @@ stdenv.mkDerivation (finalAttrs: { # https://github.com/virtualsquare/vde-2/commit/fedcb99c5f44c397f459ed0951a8fba4f4effb73 env.NIX_CFLAGS_COMPILE = "-std=gnu17"; - preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") '' - MACOSX_DEPLOYMENT_TARGET=10.16 - ''; - nativeBuildInputs = [ autoreconfHook ]; buildInputs = [ From 3d669a98fb8b35ae8ac4bcdd8c66c4ab0e9cd257 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 18:20:55 +0000 Subject: [PATCH 5/5] vde2: switch to Mbed TLS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since wolfSSL ≥ 5.8.2 is `GPL-3.0-or-later` and VDEv2 is `GPL-2.0-only`, it’s a licence violation to redistribute binaries combining them. Thankfully, upstream has added support for Mbed TLS, though not yet cut a stable release with it. Backport the patch and switch to it. This also avoids pulling wolfSSL unnecessarily into the QEMU closure, which already contains Mbed TLS. It also conveniently fixes the build on Darwin. --- pkgs/by-name/vd/vde2/package.nix | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/vd/vde2/package.nix b/pkgs/by-name/vd/vde2/package.nix index 707389c8b11f..9a205c2cefc9 100644 --- a/pkgs/by-name/vd/vde2/package.nix +++ b/pkgs/by-name/vd/vde2/package.nix @@ -5,7 +5,7 @@ fetchpatch, autoreconfHook, libpcap, - wolfssl, + mbedtls, }: stdenv.mkDerivation (finalAttrs: { @@ -20,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: { }; patches = [ + # See: + (fetchpatch { + name = "vde2-backport-mbedtls-support.patch"; + url = "https://github.com/virtualsquare/vde-2/commit/e3f701978a0a20e56cd9829353d110d4ddcedd90.patch"; + hash = "sha256-cq3yrA3w/K6J+RtwYX9AcG/nfctlAkc3aYJZpJxJXTQ="; + }) + (fetchpatch { url = "https://git.alpinelinux.org/aports/plain/main/vde2/musl-build-fix.patch?id=ddee2f86a48e087867d4a2c12849b2e3baccc238"; sha256 = "0b5382v541bkxhqylilcy34bh83ag96g71f39m070jzvi84kx8af"; @@ -34,7 +41,11 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ libpcap - wolfssl + mbedtls + ]; + + configureFlags = [ + "--with-crypt=mbedtls" ]; meta = {