From 2acaa8b7844c80fbeeb3858d5699c920878cfd24 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Tue, 7 Jul 2026 14:09:37 +0200
Subject: [PATCH 1/3] nsd: ensure patches can be overridden

Because the package replaced patchPhase entirely, using overrideAttrs to
add additional patches did not work. If we need to carry patches here in
the future, this will also get in the way. Fix this by moving the
current patch code to postPatch.

This removes the dead code with a todo on it; the package worked before
with that code being dead, so let's not change it right now.
---
 pkgs/by-name/ns/nsd/package.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ns/nsd/package.nix b/pkgs/by-name/ns/nsd/package.nix
index 7955413208a5..6efc6293ced5 100644
--- a/pkgs/by-name/ns/nsd/package.nix
+++ b/pkgs/by-name/ns/nsd/package.nix
@@ -57,12 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  # TODO: prePatch doesn't actually get executed because patchPhase is overridden
-  prePatch = ''
-    substituteInPlace nsd-control-setup.sh.in --replace openssl ${openssl}/bin/openssl
-  '';
-
-  patchPhase = ''
+  # Prevent the install script from copying nsd.conf.sample into /etc/nsd.
+  postPatch = ''
     sed 's@$(INSTALL_DATA) nsd.conf.sample $(DESTDIR)$(nsdconfigfile).sample@@g' -i Makefile.in
   '';
 

From 58fb9c25f948db0c774646fe434cde6178d735b9 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Tue, 7 Jul 2026 12:35:55 +0200
Subject: [PATCH 2/3] nsd: 4.14.3 -> 4.15.0

---
 pkgs/by-name/ns/nsd/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ns/nsd/package.nix b/pkgs/by-name/ns/nsd/package.nix
index 6efc6293ced5..002df58a2a85 100644
--- a/pkgs/by-name/ns/nsd/package.nix
+++ b/pkgs/by-name/ns/nsd/package.nix
@@ -32,13 +32,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nsd";
-  version = "4.14.3";
+  version = "4.15.0";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/nsd/nsd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-limtZNnBsBm74iKW1RSNeuZfWIziZaZCR1B0DwUrsSs=";
+    hash = "sha256-hPG+4ukqna20HZXsxkET5NPe+GIk3ndM2SADrdjE9XA=";
   };
 
+  patches = [
+    # https://github.com/NLnetLabs/nsd/pull/495 -- Without this patch, the build
+    # breaks with { openssl = libressl; bind8Stats = true; }. The patch will be
+    # included in 4.15.1, so we can drop it here on the next update.
+    (fetchurl {
+      url = "https://github.com/NLnetLabs/nsd/commit/15cf8736e3bfa0fd8f426b13637c44e638fa0d40.patch";
+      hash = "sha256-JVazJ83U80ASZypjic0epE92PZd3F1yi8UU6EapdW5U=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ]

From 2466716834b6f40cf88bc8795e5236a112836622 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Tue, 7 Jul 2026 12:50:47 +0200
Subject: [PATCH 3/3] nsd: remove references to -dev store paths

This drops 4 paths from the closure, which saves about 3.7 MiB in nsd's
closure size.
---
 pkgs/by-name/ns/nsd/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ns/nsd/package.nix b/pkgs/by-name/ns/nsd/package.nix
index 002df58a2a85..a49d4809dbfb 100644
--- a/pkgs/by-name/ns/nsd/package.nix
+++ b/pkgs/by-name/ns/nsd/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  removeReferencesTo,
   fstrm,
   libevent,
   openssl,
@@ -51,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    removeReferencesTo
   ]
   ++ lib.optionals withDnstap [ protobuf ];
 
@@ -96,6 +98,10 @@ stdenv.mkDerivation (finalAttrs: {
       "--with-configdir=etc/nsd"
     ];
 
+  postFixup = ''
+    find "$out" -type f -exec remove-references-to -t ${openssl.dev} -t ${libevent.dev} '{}' +
+  '';
+
   passthru.tests = {
     inherit (nixosTests) nsd;
   };