From cb6b834a29ec1f197905999291eda250ba81fbee Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 12 Jan 2026 16:17:53 +0100
Subject: [PATCH 1/2] botan3: fetch sources directly

This avoids potential xz-style supply chain attacks.
---
 pkgs/by-name/bo/botan3/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/bo/botan3/package.nix b/pkgs/by-name/bo/botan3/package.nix
index c0483272cc8f..3afd3a2081da 100644
--- a/pkgs/by-name/bo/botan3/package.nix
+++ b/pkgs/by-name/bo/botan3/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   libcxxStdenv,
-  fetchurl,
+  fetchFromGitHub,
   pkgsStatic,
   runCommandLocal,
   binutils,
@@ -73,9 +73,11 @@ stdenv.mkDerivation (finalAttrs: {
     "selftests"
   ];
 
-  src = fetchurl {
-    url = "http://botan.randombit.net/releases/Botan-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/eGUI29tVDTxNuoKBif2zJ0mr4uW6fHhx9jILNkPTyQ=";
+  src = fetchFromGitHub {
+    owner = "randombit";
+    repo = "botan";
+    tag = finalAttrs.version;
+    hash = "sha256-E4kKk4ry3SMn2DbnUTVx22lcAWDxxbo8DLyixjr/S6A=";
   };
 
   nativeBuildInputs = [

From 117cfd7cb30598169d10c237efbcd4b8dd36a251 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 12 Jan 2026 16:20:35 +0100
Subject: [PATCH 2/2] botan3: remove superfluous version checks

These have become obsolete since we dropped other botan versions.
---
 pkgs/by-name/bo/botan3/package.nix | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/bo/botan3/package.nix b/pkgs/by-name/bo/botan3/package.nix
index 3afd3a2081da..c44b6e9eb5db 100644
--- a/pkgs/by-name/bo/botan3/package.nix
+++ b/pkgs/by-name/bo/botan3/package.nix
@@ -92,15 +92,12 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (stdenv.hostPlatform.isLinux && withTpm2) [
     tpm2-tss
   ]
-  ++ lib.optionals (lib.versionAtLeast finalAttrs.version "3.6.0" && !stdenv.hostPlatform.isMinGW) [
+  ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [
     jitterentropy
   ]
-  ++
-    lib.optionals
-      (lib.versionAtLeast finalAttrs.version "3.7.0" && withEsdm && !stdenv.hostPlatform.isMinGW)
-      [
-        esdm
-      ]
+  ++ lib.optionals (withEsdm && !stdenv.hostPlatform.isMinGW) [
+    esdm
+  ]
   ++ lib.optionals (stdenv.hostPlatform.isMinGW) [
     windows.pthreads
   ];
@@ -132,19 +129,16 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (stdenv.hostPlatform.isLinux && withTpm2) [
     "--with-tpm2"
   ]
-  ++ lib.optionals (lib.versionAtLeast finalAttrs.version "3.6.0" && !stdenv.hostPlatform.isMinGW) [
+  ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [
     "--enable-modules=jitter_rng"
   ]
-  ++
-    lib.optionals
-      (lib.versionAtLeast finalAttrs.version "3.7.0" && withEsdm && !stdenv.hostPlatform.isMinGW)
-      [
-        "--enable-modules=esdm_rng"
-      ]
-  ++ lib.optionals (lib.versionAtLeast finalAttrs.version "3.8.0" && policy != null) [
+  ++ lib.optionals (withEsdm && !stdenv.hostPlatform.isMinGW) [
+    "--enable-modules=esdm_rng"
+  ]
+  ++ lib.optionals (policy != null) [
     "--module-policy=${policy}"
   ]
-  ++ lib.optionals (lib.versionAtLeast finalAttrs.version "3.8.0" && policy == "bsi") [
+  ++ lib.optionals (policy == "bsi") [
     "--enable-module=ffi"
     "--enable-module=shake"
   ]