From c0a53e695020cfcd935eabf446d2918187aa751b Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Tue, 12 May 2026 19:03:20 +0200
Subject: [PATCH] libressl_4_3: backport executable stack fix

And also add an additional check to preCheck that will enable us to
catch executable stack issues earlier next time.

(cherry picked from commit 5198c49a5a58932c1a782aee9ad2fd6509f935e1)
(cherry picked from commit 4248c5fd7a9c28e2fd27a865686fe864fcded34d)
---
 pkgs/by-name/li/libressl/default.nix | 29 ++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index a4ac4000d452..4ccc79407ba7 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -61,6 +61,22 @@ let
 
       doCheck = !(stdenv.hostPlatform.isPower64 || stdenv.hostPlatform.isRiscV);
       preCheck = ''
+        # Bail if any shared object has executable stack enabled. This can
+        # happen when an object produced from an assmbly file in libcrypto is
+        # missing a .note.GNU-stack section. An executable stack is dangerous
+        # and unintentional, but without this check the derivation will build
+        # and even run if W^X is not enforced; it would fail dangerously.
+        objdump -p **/*.so | awk '
+          BEGIN { res = 0 }
+          /file format/ { file = $1 }
+          /STACK/ { stack = 1; next }
+          stack {
+            if ($0 ~ /flags.*x/) { print file " has executable stack"; res = 1 }
+            stack = 0
+          }
+          END { exit res }
+        '
+
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       '';
@@ -139,5 +155,18 @@ in
   libressl_4_3 = generic {
     version = "4.3.1";
     hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+    patches = [
+      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
+      # 4.3 started requiring executable stack because some objects were missing
+      # a .note.GNU-stack section; will probably be included in the next release.
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
+        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
+        # This patch is written to be applied with -p0, with no leading path
+        # component, but Nix applies with -p1 by default, so we add it to not
+        # break compatibility with how other patches must be applied.
+        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
+      })
+    ];
   };
 }