From aac46d7460e525938f99ecef888217f37ad2cda9 Mon Sep 17 00:00:00 2001
From: Raphael Robatsch <raphael-git@tapesoftware.net>
Date: Wed, 14 Dec 2022 22:10:21 +0000
Subject: [PATCH 1/2] mbedtls_2: 2.28.1 -> 2.28.2

Changelog: https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-2.28.2/ChangeLog
---
 pkgs/development/libraries/mbedtls/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
index ba1f520b08cf..e577b9183c27 100644
--- a/pkgs/development/libraries/mbedtls/2.nix
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -1,6 +1,6 @@
 { callPackage }:
 
 callPackage ./generic.nix {
-  version = "2.28.1";
-  hash = "sha256-brbZB3fINDeVWXf50ct4bxYkoBVyD6bBBijZyFQSnyw=";
+  version = "2.28.2";
+  hash = "sha256-rbWvPrFoY31QyW/TbMndPXTzAJS6qT/bo6J0IL6jRvQ=";
 }

From 110e3ce89a64aef456182ab4e2f60a75fd9c6390 Mon Sep 17 00:00:00 2001
From: Raphael Robatsch <raphael-git@tapesoftware.net>
Date: Wed, 14 Dec 2022 22:12:02 +0000
Subject: [PATCH 2/2] mbedtls: 3.2.1 -> 3.3.0

Changelog: https://github.com/Mbed-TLS/mbedtls/blob/mbedtls-3.3.0/ChangeLog

Removed NIX_CFLAGS_COMPILE which is not needed anymore, and disabled
generation of source code by using the generated code that is already
present in releases. This avoids new build-time dependencies for
mbedtls 3.
---
 pkgs/development/libraries/mbedtls/3.nix       |  4 ++--
 pkgs/development/libraries/mbedtls/generic.nix | 12 ++++++++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index d6f53feb086b..55293b6ecd49 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,6 +1,6 @@
 { callPackage }:
 
 callPackage ./generic.nix {
-  version = "3.2.1";
-  hash = "sha256-+M36NvFe4gw2PRbld/2JV3yBGrqK6soWcmrSEkUNcrc=";
+  version = "3.3.0";
+  hash = "sha256-yb5migP5Tcw99XHFzJkCct4f5R6ztxPR43VQcfTGRtE=";
 }
diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/development/libraries/mbedtls/generic.nix
index bb87c6dbc8ad..3383d3f8cc44 100644
--- a/pkgs/development/libraries/mbedtls/generic.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -32,10 +32,14 @@ stdenv.mkDerivation rec {
     perl scripts/config.pl set MBEDTLS_THREADING_PTHREAD    # POSIX thread wrapper layer for the threading layer.
   '';
 
-  cmakeFlags = [ "-DUSE_SHARED_MBEDTLS_LIBRARY=on" ];
-  NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
-    "-Wno-error=format"
-    "-Wno-error=format-truncation"
+  cmakeFlags = [
+    "-DUSE_SHARED_MBEDTLS_LIBRARY=on"
+
+    # Avoid a dependency on jsonschema and jinja2 by not generating source code
+    # using python. In releases, these generated files are already present in
+    # the repository and do not need to be regenerated. See:
+    # https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0 below "Requirement changes".
+    "-DGEN_FILES=off"
   ];
 
   meta = with lib; {