fortify-headers: switch source from alpine to github

the most recognized upstream for `fortify-headers` is
<git://git.2f30.org/fortify-headers> (see `meta.homepage`, e.g.),
but as per the previous source comment this upstream isn't accessible
over http.

<https://github.com/jvoisin/fortify-headers> is a reasonable
alternative: it's what [chimera linux][Chimera] sources, and
jvoisin is a regular committer to the `git.2f30.org` repo.
moreover, Alpine Linux is stuck at version 1.1, released in 2019.
moving away from Alpine (much as i appreciate their work),
allows us to take updates more timely.

cherry-pick Alpine's own patches, so that the `fortify-headers`
built before and after this patch is bit-for-bit identical.
Alpine's patches have been upstreamed, so they can go away with
a future package bump (see next patch).

Chimera: <https://github.com/chimera-linux/cports/blob/183ea38c47a0a74f78336164d975e652f622c6e5/main/fortify-headers/template.py#L11>

pkgs/by-name/fo/fortify-headers/package.nix

@@ -4,28 +4,44 @@
   fetchurl,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fortify-headers";
-  version = "1.1alpine3";
+  version = "1.1";
 
   # upstream only accessible via git - unusable during bootstrap, hence
-  # extract from the alpine package
+  # extract from GitHub release.
   src = fetchurl {
-    url = "https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/fortify-headers-1.1-r3.apk";
-    name = "fortify-headers.tar.gz"; # ensure it's extracted as a .tar.gz
-    hash = "sha256-8A8JcKHIBgXpUuIP4zs3Q1yBs5jCGd5F3H2E8UN/S2g=";
+    url = "https://github.com/jvoisin/fortify-headers/archive/refs/tags/${finalAttrs.version}.tar.gz";
+    hash = "sha256-3WJbFTjsIeL7fuFTTEoTaPAyz6PQ2sLBK29mQ8YG+1Y=";
   };
 
   patches = [
+    (fetchurl {
+      # Remove when updating to >= 3.0
+      url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/4adfa7e7291a716b871969b9d1146db037009b57/main/fortify-headers/0001-add-initial-clang-support.patch";
+      hash = "sha256-QbDnMTGVmvIokow6lkA+mDHFMDP8B0lLY8w9ciUhGKU=";
+    })
+    (fetchurl {
+      # Remove when updating to >= 3.0
+      url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/4adfa7e7291a716b871969b9d1146db037009b57/main/fortify-headers/0002-avoid-__extension__-with-clang.patch";
+      hash = "sha256-LooU8I5td7fsfXjBahawvZbhR7r9HTWlT7qGbPE88zY=";
+    })
+    (fetchurl {
+      # Remove when updating to >= 3.0
+      url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/4adfa7e7291a716b871969b9d1146db037009b57/main/fortify-headers/0003-Disable-wrapping-of-ppoll.patch";
+      hash = "sha256-NW46jwkKS/0hvC7WFaetbAyQxf/YLnyEV+Y8G9payCw=";
+    })
     ./wchar-imports-skip.patch
     ./restore-macros.patch
   ];
 
+  dontBuild = true;
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out
-    cp -r include/fortify $out/include
+    cp -r include $out/include
 
     runHook postInstall
   '';
@@ -37,4 +53,4 @@ stdenv.mkDerivation {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ ris ];
   };
-}
+})

pkgs/by-name/fo/fortify-headers/restore-macros.patch

@@ -5,8 +5,8 @@ some programs that define these miss them if removed
 push_macro and pop_macro pragmas allegedly well supported
 by gcc, clang and msvc
 
---- a/include/fortify/poll.h
-+++ b/include/fortify/poll.h
+--- a/include/poll.h
++++ b/include/poll.h
 @@ -29,6 +29,7 @@ __extension__
  extern "C" {
  #endif
@@ -24,8 +24,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/stdio.h
-+++ b/include/fortify/stdio.h
+--- a/include/stdio.h
++++ b/include/stdio.h
 @@ -29,12 +29,19 @@ __extension__
  extern "C" {
  #endif
@@ -61,8 +61,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/stdlib.h
-+++ b/include/fortify/stdlib.h
+--- a/include/stdlib.h
++++ b/include/stdlib.h
 @@ -38,7 +38,10 @@ extern "C" {
  
  /* FIXME clang */
@@ -84,8 +84,8 @@ by gcc, clang and msvc
  #endif
  
  #ifdef __cplusplus
---- a/include/fortify/string.h
-+++ b/include/fortify/string.h
+--- a/include/string.h
++++ b/include/string.h
 @@ -29,12 +29,19 @@ __extension__
  extern "C" {
  #endif
@@ -121,8 +121,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/strings.h
-+++ b/include/fortify/strings.h
+--- a/include/strings.h
++++ b/include/strings.h
 @@ -29,8 +29,12 @@ extern "C" {
  #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE) || defined(_POSIX_SOURCE) \
   || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE+0 < 200809L) \
@@ -146,8 +146,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/sys/socket.h
-+++ b/include/fortify/sys/socket.h
+--- a/include/sys/socket.h
++++ b/include/sys/socket.h
 @@ -29,9 +29,13 @@ __extension__
  extern "C" {
  #endif
@@ -174,8 +174,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/unistd.h
-+++ b/include/fortify/unistd.h
+--- a/include/unistd.h
++++ b/include/unistd.h
 @@ -29,16 +29,27 @@ __extension__
  extern "C" {
  #endif
@@ -223,8 +223,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/wchar.h
-+++ b/include/fortify/wchar.h
+--- a/include/wchar.h
++++ b/include/wchar.h
 @@ -43,19 +43,33 @@ __extension__
  extern "C" {
  #endif

pkgs/by-name/fo/fortify-headers/wchar-imports-skip.patch

@@ -8,8 +8,8 @@ supported/expected by some projects.
 having a way to almost entirely short-circuit these headers (by
 disabling _FORTIFY_SOURCE) is therefore important.
 
---- a/include/fortify/wchar.h
-+++ b/include/fortify/wchar.h
+--- a/include/wchar.h
++++ b/include/wchar.h
 @@ -20,21 +20,23 @@
  #if !defined(__cplusplus) && !defined(__clang__)
  __extension__