From 226a3b55fa27ed27982e4e9402506a3c97c0e071 Mon Sep 17 00:00:00 2001
From: Chuang Zhu <git@chuang.cz>
Date: Sun, 5 Apr 2026 20:40:13 +0800
Subject: [PATCH] picotool: add missing mbedtls

---
 pkgs/by-name/pi/picotool/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/pi/picotool/package.nix b/pkgs/by-name/pi/picotool/package.nix
index f5085d2aebb7..3d9d233bcca1 100644
--- a/pkgs/by-name/pi/picotool/package.nix
+++ b/pkgs/by-name/pi/picotool/package.nix
@@ -22,6 +22,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-kIB/ODAvwWWoAQDq2cMiFuNWjzzLgPuRQv0NluWYU+Y=";
   };
 
+  postPatch = ''
+    # necessary for signing/hashing support. our pico-sdk does not come with
+    # it by default, and it shouldn't due to submodule size. pico-sdk uses
+    # an upstream version of mbedtls 3.x so we patch ours in directly.
+    substituteInPlace lib/CMakeLists.txt \
+      --replace-fail "''$"'{PICO_SDK_PATH}/lib/mbedtls' '${mbedtls.src}'
+  '';
+
   buildInputs = [
     libusb1
     pico-sdk