kodiPackages.sendtokodi: fix PYTHON_PATH conflict with Kodi and yt-dlp

The "sendtokodi" addon bundles its own versions of "youtube-dl" and
"yt-dlp". This causes two issues:

  - The "youtube-dl" addon is unmaintained and suspect to known
    vulnerabilities.

  - Both of these dependencies also exist as packaged versions, so the
    vendoring causes duplications.

The first issue is being addressed by patching out support for
"youtube-dl", which in any case is only really needed for supporting
Python 2. The second issue is being addressed by removing the bundled
version of "yt-dlp" and instead injecting our packaged version of this
dependency via `PYTHON_PATH`.

Using `PYTHON_PATH` creates some new problems though, because Kodi
packages a bunch of Python libraries like "requests" as addons. The
consequence is that we may have a conflict in our PYTHON_PATH, where
dependencies may be provided both by such Kodi addons and by transitive
dependencies of "yt-dlp".

One obvious solution would be to stop replacing the bundled version of
"yt-dlp", but that would reintroduce the second issue explained further
up.

Instead, fix the issue by replacing the bundled version of "yt-dlp" with
the contents of the packaged version thereof. This allows us to drop the
PYTHON_PATH workaround and thus resolves the conflicts.

Reported-by: Aaron Andersen <aaron@fosslib.net>

pkgs/applications/video/kodi/addons/sendtokodi/default.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   kodi,
   inputstreamhelper,
+  requests,
 }:
 
 buildKodiAddon rec {
@@ -19,27 +20,25 @@ buildKodiAddon rec {
   };
 
   patches = [
-    # Unconditionally depend on packaged yt-dlp. This removes the ability to
-    # use youtube_dl, which is unmaintained and considered vulnerable (see
-    # CVE-2024-38519).
-    ./use-packaged-yt-dlp.patch
+    # Use yt-dlp, only. This removes the ability to use youtube_dl, which is
+    # unmaintained and considered vulnerable (see CVE-2024-38519).
+    ./use-yt-dlp-only.patch
   ];
 
   propagatedBuildInputs = [
     inputstreamhelper
+    requests
   ];
 
   postPatch = ''
-    # Remove vendored youtube-dl and yt-dlp libraries.
-    rm -r lib/
+    # Remove youtube-dl, which is unmaintained and vulnerable.
+    rm -r lib/youtube_dl lib/youtube_dl_version
+    # Replace yt-dlp with our own packaged version thereof.
+    rm -r lib/yt_dlp
+    echo "${lib.strings.getVersion kodi.pythonPackages.yt-dlp}" >lib/yt_dlp_version
+    ln -s ${kodi.pythonPackages.yt-dlp}/${kodi.pythonPackages.python.sitePackages}/yt_dlp lib/
   '';
 
-  passthru = {
-    # Instead of the vendored libraries, we propagate yt-dlp via the Python
-    # path.
-    pythonPath = with kodi.pythonPackages; makePythonPath [ yt-dlp ];
-  };
-
   meta = with lib; {
     homepage = "https://github.com/firsttris/plugin.video.sendtokodi";
     description = "Plays various stream sites on Kodi using yt-dlp";

pkgs/applications/video/kodi/addons/sendtokodi/use-yt-dlp-only.patch

@@ -1,18 +1,18 @@
 diff --git a/service.py b/service.py
-index 024ad9a..6ef71dd 100644
+index 5d588682..99123b4b 100644
 --- a/service.py
 +++ b/service.py
-@@ -243,11 +243,8 @@ def playlistIndex(url, playlist):
+@@ -323,12 +323,7 @@ if not sys.argv[2]:
+     xbmcaddon.Addon().openSettings()
+     exit()
  
- 
- # Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+)
+-# Use the chosen resolver while forcing to use youtube_dl on legacy python 2 systems (dlp is python 3.6+)
 -if xbmcplugin.getSetting(int(sys.argv[1]),"resolver") == "0" or sys.version_info[0] == 2:
--    from lib.youtube_dl import YoutubeDL
+-    from youtube_dl import YoutubeDL
 -else:
--    from lib.yt_dlp import YoutubeDL
--    
+-   # import lib.yt_dlp as yt_dlp
+-    from yt_dlp import YoutubeDL
 +from yt_dlp import YoutubeDL
-+
+ 
  # patch broken strptime (see above)
  patch_strptime()
-