From 26e668a09ab3bb0ca6d2a6e70afac733ccf49c20 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Sat, 23 May 2026 19:56:11 +0200
Subject: [PATCH 1/3] ivpn-service: support quantum resistance

---
 pkgs/by-name/iv/ivpn-service/package.nix | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index e62ed995af50..2a012785f548 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -13,13 +13,17 @@
   iptables,
   gawk,
   util-linux,
+  liboqs,
   nix-update-script,
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn-service";
   version = "3.15.6";
 
-  buildInputs = [ wirelesstools ];
+  buildInputs = [
+    wirelesstools
+    liboqs
+  ];
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
@@ -62,7 +66,9 @@ buildGoModule (finalAttrs: {
       --replace-fail 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
       'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"' \
       --replace-fail 'v2rayBinaryPath = path.Join(installDir, "v2ray/v2ray")' \
-      'v2rayBinaryPath = "${v2ray}/bin/v2ray"'
+      'v2rayBinaryPath = "${v2ray}/bin/v2ray"' \
+      --replace-fail 'kemHelperBinaryPath = path.Join(installDir, "kem/kem-helper")' \
+      'kemHelperBinaryPath = "${placeholder "out"}/bin/kem-helper"'
   '';
 
   ldflags = [
@@ -72,8 +78,17 @@ buildGoModule (finalAttrs: {
     "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
   ];
 
+  postBuild = ''
+    $CC -O2 -pthread \
+        References/common/kem-helper/main.c \
+        References/common/kem-helper/base64.c \
+        -loqs -Wl,-z,stack-size=5242880 \
+        -o kem-helper
+  '';
+
   postInstall = ''
     mv $out/bin/{daemon,ivpn-service}
+    install -Dm755 kem-helper $out/bin/kem-helper
   '';
 
   postFixup = ''

From d633cae73b72cf70737f5f78db3e755dbd83f884 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Sat, 23 May 2026 23:45:19 +0200
Subject: [PATCH 2/3] ivpn-service: drop redundant update script

---
 pkgs/by-name/iv/ivpn-service/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index 2a012785f548..5756d53a9da3 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -14,7 +14,6 @@
   gawk,
   util-linux,
   liboqs,
-  nix-update-script,
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn-service";
@@ -109,8 +108,6 @@ buildGoModule (finalAttrs: {
       }
   '';
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "Official IVPN Desktop app service daemon";
     homepage = "https://www.ivpn.net/apps";

From a557cbe75fd6b8ef6689c7ae51adaa53fed86fec Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Sat, 23 May 2026 23:44:56 +0200
Subject: [PATCH 3/3] ivpn-service: vendor liboqs 0.10.0

---
 pkgs/by-name/iv/ivpn-service/package.nix | 31 +++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index 5756d53a9da3..f318607f304c 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
 
   buildInputs = [
     wirelesstools
-    liboqs
+    (finalAttrs.passthru.liboqs)
   ];
   nativeBuildInputs = [ makeWrapper ];
 
@@ -108,6 +108,35 @@ buildGoModule (finalAttrs: {
       }
   '';
 
+  # IVPN pins this to an older incompatible version, so we vendor it at that
+  # Lives in passthru so end-users can override it
+  passthru.liboqs = liboqs.overrideAttrs (
+    final: prev: {
+      version = "0.10.0";
+      src = fetchFromGitHub {
+        owner = "open-quantum-safe";
+        repo = "liboqs";
+        tag = "${final.version}";
+        hash = "sha256-BFDa5NUr02lFPcT4Hnb2rjGAi+2cXvh1SHLfqX/zLlI=";
+      };
+      # the main derivations patches don't apply onto the older version
+      patches = [ ];
+      # manually do what the main derivations pkg-config patch does (unbreak invalid path)
+      postPatch = ''
+        substituteInPlace src/liboqs.pc.in \
+          --replace-fail 'libdir=''${prefix}/@CMAKE_INSTALL_LIBDIR@' \
+          'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+          --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' \
+          'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+      '';
+      # This matches IVPNs build script at $src/daemon/References/common/kem-helper/build.sh
+      cmakeFlags = (prev.cmakeFlags or [ ]) ++ [
+        "-DOQS_USE_OPENSSL=OFF"
+        "-DOQS_MINIMAL_BUILD=KEM_kyber_1024;KEM_classic_mceliece_348864"
+      ];
+    }
+  );
+
   meta = {
     description = "Official IVPN Desktop app service daemon";
     homepage = "https://www.ivpn.net/apps";