From 7f556b60b632f19cf1d25158e6b8b506116a3d59 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Sat, 15 Nov 2025 13:00:45 +0100
Subject: [PATCH 1/2] openscap: discover built-in plugins (like SCE)

openscap calls dlopen() to discover plugins.
It prefixes the path that is dlopened with
OSCAP_CHECK_ENGINE_PLUGIN_DIR. By setting
that env-var we can make openscap discover
the built-in plugins that it ships with by
default. (Currently only SCE).
---
 pkgs/by-name/op/openscap/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/op/openscap/package.nix b/pkgs/by-name/op/openscap/package.nix
index 34776269a5ca..a2ccbd9235ea 100644
--- a/pkgs/by-name/op/openscap/package.nix
+++ b/pkgs/by-name/op/openscap/package.nix
@@ -26,6 +26,7 @@
   valgrind,
   asciidoc,
   installShellFiles,
+  makeWrapper,
   rpm,
   system-sendmail,
   gnome2,
@@ -55,6 +56,7 @@ stdenv.mkDerivation rec {
     cmake
     asciidoc
     doxygen
+    makeWrapper
     rpm
     swig
     util-linux
@@ -143,6 +145,13 @@ stdenv.mkDerivation rec {
     rm -rf $out/share/man8
   '';
 
+  postFixup = ''
+    # Set plugin directory to discover the SCE plugin.
+    # openscap calls dlopen with this as the directory prefix.
+    wrapProgram $out/bin/oscap \
+      --set OSCAP_CHECK_ENGINE_PLUGIN_DIR $out/lib
+  '';
+
   meta = {
     description = "NIST Certified SCAP 1.2 toolkit";
     homepage = "https://github.com/OpenSCAP/openscap";

From acdb865b93761d445a1c0872b302eeb7300524cd Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Sat, 15 Nov 2025 13:54:54 +0100
Subject: [PATCH 2/2] openscap: Don't hardcode PATH for SCE

Was introduced in https://github.com/OpenSCAP/openscap/commit/f4c30de885958a656625eca4ed460ee67d95d586

Not sure why. Let me remove the line so it picks up the transient
environment.

This makes SCE scripts work.
---
 pkgs/by-name/op/openscap/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/op/openscap/package.nix b/pkgs/by-name/op/openscap/package.nix
index a2ccbd9235ea..c7e090b03d47 100644
--- a/pkgs/by-name/op/openscap/package.nix
+++ b/pkgs/by-name/op/openscap/package.nix
@@ -106,6 +106,10 @@ stdenv.mkDerivation rec {
       --replace-fail "DESTINATION ''${PERL_VENDORARCH}" "DESTINATION ''${SWIG_PERL_DIR}"
     substituteInPlace src/common/oscap_pcre.c \
       --replace-fail "#include <pcre2.h>" "#include <${pcre2.dev}/include/pcre2.h>"
+
+    # Patch SCE engine to not hardcode FHS paths, allowing it to use the transient environment's PATH
+    substituteInPlace src/SCE/sce_engine.c \
+      --replace-fail 'env_values[0] = "PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin";' 'env_values[0] = "_PATCHED_OUT_DUMMY_VAR=patched-out";'
   '';
 
   cmakeFlags = [