From 3445bb69eb45b8fa3e0236812da10c9f20114b69 Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Fri, 14 Nov 2025 07:12:32 +1100
Subject: [PATCH 1/2] xen: switch to fetchFromGitHub

Xenbits is protected with Anubis, and while currently fetching works,
there is no reason to put the load on Xen's servers when a GitHub mirror
is available.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/xe/xen/package.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index e8645badd14d..4fbe5a050c04 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   testers,
-  fetchgit,
+  fetchFromGitHub,
   fetchpatch,
   replaceVars,
 
@@ -241,9 +241,10 @@ stdenv.mkDerivation (finalAttrs: {
     "boot"
   ];
 
-  src = fetchgit {
-    url = "https://xenbits.xenproject.org/git-http/xen.git";
-    rev = "08f043965a7b1047aabd6d81da6b031465f2d797";
+  src = fetchFromGitHub {
+    owner = "xen-project";
+    repo = "xen";
+    tag = "RELEASE-4.20.1";
     hash = "sha256-a4dIJBY5aeznXPoI8nSipMgimmww7ejoQ1GE28Gq13o=";
   };
 

From 69e3980672635456186f15403e407d81d39b0cce Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Fri, 14 Nov 2025 07:21:13 +1100
Subject: [PATCH 2/2] xen: 4.20.1 -> 4.20.2

XSAs 472-476 are already included in-tree.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/xe/xen/package.nix | 46 +++------------------------------
 1 file changed, 3 insertions(+), 43 deletions(-)

diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 4fbe5a050c04..147c0847caa3 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -173,7 +173,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xen";
-  version = "4.20.1";
+  version = "4.20.2";
 
   # This attribute can be overriden to correct the file paths in
   # `passthru` when building an unstable Xen.
@@ -191,46 +191,6 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";
       hash = "sha256-LH+68kxH/gxdyh45kYCPxKwk+9cztLrScpC2pCNQV2M=";
     })
-
-    # XSA 472
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa472-1.patch";
-      hash = "sha256-6k/X7KFno9uBG0mUtJxl7TMavaRs2Xlj9JlW9ai6p0k=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa472-2.patch";
-      hash = "sha256-BisdztU9Wa5nIGmHo4IikqYPHdEhBehHaNqj1IuBe6I=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa472-3.patch";
-      hash = "sha256-rikOofQeuLNMBkdQS3xzmwh7BlgMOTMSsQcAOEzNOso=";
-    })
-
-    # XSA 473
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa473-1.patch";
-      hash = "sha256-594tTalWcGJSLj3++4QB/ADkHH1qJNrdvg7FG6kOuB8=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa473-2.patch";
-      hash = "sha256-tGuIGxJFBXbckIruSUeTyrM6GabdIj6Pr3cVxeDvNNY=";
-    })
-
-    # XSA 475
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa475-1.patch";
-      hash = "sha256-Bzvtr12g+7+M9jY9Nt2jd41CwYTL+h2fuwzJFsxroio=";
-    })
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa475-2.patch";
-      hash = "sha256-7MKtDAJpihpfcBK+hyBFGCP6gHWs2cdgTks8B439b2s=";
-    })
-
-    # XSA 476
-    (fetchpatch {
-      url = "https://xenbits.xen.org/xsa/xsa476-4.20.patch";
-      hash = "sha256-nZUHcMr9RpQqrazG+RtTw+/s1gzqN1D565RuQjuALTQ=";
-    })
   ];
 
   outputs = [
@@ -244,8 +204,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "xen-project";
     repo = "xen";
-    tag = "RELEASE-4.20.1";
-    hash = "sha256-a4dIJBY5aeznXPoI8nSipMgimmww7ejoQ1GE28Gq13o=";
+    tag = "RELEASE-4.20.2";
+    hash = "sha256-ZDPjsEAEH5bW0156MVvOKUeqg+mwdce0GFdUTBH39Qc=";
   };
 
   strictDeps = true;