From f9c51806df3cd96665240db3e257c26af7dc3cad Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 3 Jun 2026 12:13:12 -0400
Subject: [PATCH 1/2] arti: 2.3.0 -> 2.4.0

announcement: https://blog.torproject.org/arti_2_4_0_released/
changelog: https://gitlab.torproject.org/tpo/core/arti/-/blob/arti-v2.4.0/CHANGELOG.md
diff: https://gitlab.torproject.org/tpo/core/arti/-/compare/arti-v2.3.0...arti-v2.4.0
---
 pkgs/by-name/ar/arti/package.nix | 32 +++++++++++---------------------
 1 file changed, 11 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/ar/arti/package.nix b/pkgs/by-name/ar/arti/package.nix
index 71b8f3225149..f4d55df325cc 100644
--- a/pkgs/by-name/ar/arti/package.nix
+++ b/pkgs/by-name/ar/arti/package.nix
@@ -13,7 +13,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-OEGKjYJ3p4g0ZfeK6k8IJJPjgSBMrSlKlxsCw1OwyaI=";
+    hash = "sha256-YLOdrHstmN2pLl75uclkbpN5h3iBs3xpraZ8XN6R/+Q=";
   };
 
   # Working around a bug in cargo that appears with cargo-auditable, see
@@ -31,22 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"tor-rpcbase"' '"dep:tor-rpcbase"'
   '';
 
-  cargoHash = "sha256-OJgrIXL185W9rcQd7XZsgiqN4in74Oc2jDT1ZmcCC6E=";
+  buildAndTestSubdir = "crates/arti";
+  cargoHash = "sha256-7X3JJbt0/jxaMvBR3XQvguR7tqd96kiqX66G2byvPjM=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
   buildInputs = [ sqlite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
-
-  cargoBuildFlags = [
-    "--package"
-    "arti"
-  ];
-
-  cargoTestFlags = [
-    "--package"
-    "arti"
-  ];
-
   # `full` includes all stable and non-conflicting feature flags. the primary
   # downsides are increased binary size and memory usage for building, but
   # those are acceptable for nixpkgs
@@ -69,9 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # sandbox. this does NOT affect downstream users of Arti.
   env.ARTI_FS_DISABLE_PERMISSION_CHECKS = 1;
 
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
   passthru = {
@@ -84,10 +72,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "arti";
     homepage = "https://arti.torproject.org/";
     changelog = "https://gitlab.torproject.org/tpo/core/arti/-/blob/arti-v${finalAttrs.version}/CHANGELOG.md";
-    license = with lib.licenses; [
-      asl20
-      mit
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        asl20
+        mit
+      ];
     maintainers = with lib.maintainers; [
       rapiteanu
       whispersofthedawn

From d355b592b89e3d2fc4ba8b50e98322cc777395da Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 3 Jun 2026 14:47:45 -0400
Subject: [PATCH 2/2] arti: add patch for TROVE-2026-024

TROVE: https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

an invalid assumption of ASCII in port policies could allow a malicious
directory cache to crash arti clients. this issue was originally
publicly reported at
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4049
and the final fix was merged as
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4062. this
allows for DoSing clients, and has been allocated the the TROVE-2026-024
id with medium severity. we fetch the patch for it here, and may upgrade
to 2.4.1 or similar if upstream releases one.
---
 pkgs/by-name/ar/arti/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/ar/arti/package.nix b/pkgs/by-name/ar/arti/package.nix
index f4d55df325cc..e01cc45f7814 100644
--- a/pkgs/by-name/ar/arti/package.nix
+++ b/pkgs/by-name/ar/arti/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   rustPlatform,
   fetchFromGitLab,
+  fetchpatch,
   pkg-config,
   sqlite,
   openssl,
@@ -24,6 +25,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-YLOdrHstmN2pLl75uclkbpN5h3iBs3xpraZ8XN6R/+Q=";
   };
 
+  patches = [
+    # Fixes a panic that could allow malicious directory caches to crash
+    # clients.
+    # https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4062
+    (fetchpatch {
+      name = "TROVE-2026-024.patch";
+      url = "https://gitlab.torproject.org/tpo/core/arti/-/commit/f69be8c70561629e63004788f0aa4bf898025f93.patch";
+      hash = "sha256-P0sXTKOBW7ulqQZwmTVJfrpLksLyaonuDpxGF2keDqE=";
+    })
+  ];
+
   # Working around a bug in cargo that appears with cargo-auditable, see
   # https://github.com/rust-secure-code/cargo-auditable/issues/124.
   postPatch = ''