From 5c00e92a5965b40aecb2f65ea4a3bfb5e1cfbf54 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Wed, 24 Sep 2025 16:57:53 +0200
Subject: [PATCH 1/2] boringssl: unstable-2024-09-20 -> 0.20250818.0

---
 pkgs/by-name/bo/boringssl/package.nix         | 34 ++++++++++---------
 .../bo/boringssl/secp224r1-compat.patch       | 20 +++++++++++
 2 files changed, 38 insertions(+), 16 deletions(-)
 create mode 100644 pkgs/by-name/bo/boringssl/secp224r1-compat.patch

diff --git a/pkgs/by-name/bo/boringssl/package.nix b/pkgs/by-name/bo/boringssl/package.nix
index 628c374cd3a7..02b3217e5bcb 100644
--- a/pkgs/by-name/bo/boringssl/package.nix
+++ b/pkgs/by-name/bo/boringssl/package.nix
@@ -8,24 +8,29 @@
   buildGoModule,
 }:
 
-# reference: https://boringssl.googlesource.com/boringssl/+/2661/BUILDING.md
-buildGoModule {
+# reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
+buildGoModule (finalAttrs: {
   pname = "boringssl";
-  version = "unstable-2024-09-20";
+  version = "0.20250818.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
-    rev = "718900aeb84c601523e71abbd18fd70c9e2ad884";
-    hash = "sha256-TdSObRECiGRQcgz6N2LhKvSi9yRYOZYJdK6MyfJX2Bo=";
+    tag = finalAttrs.version;
+    hash = "sha256-lykIlC0tvjtjjS/rQTeX4vK9PgI+A8EnasEC+HYspvg=";
   };
 
+  patches = [
+    # Add SECP224R1 for backward compatibility
+    ./secp224r1-compat.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
     perl
   ];
 
-  vendorHash = "sha256-GlhLsPD+yp2LdqsIsfXNEaNKKlc76p0kBCyu4rlEmMg=";
+  vendorHash = "sha256-IXmnoCYLoiQ/XL2wjksRFv5Kwsje0VNkcupgGxG6rSY=";
   proxyVendor = true;
 
   # hack to get both go and cmake configure phase
@@ -59,13 +64,10 @@ buildGoModule {
 
     mkdir -p $bin/bin $dev $out/lib
 
-    mv tool/bssl $bin/bin
+    install -Dm755 bssl -t $bin/bin
+    install -Dm644 {libboringssl_gtest,libcrypto,libdecrepit,libpki,libssl,libtest_support_lib}.a -t $out/lib
 
-    mv ssl/libssl.a           $out/lib
-    mv crypto/libcrypto.a     $out/lib
-    mv decrepit/libdecrepit.a $out/lib
-
-    mv ../include $dev
+    cp -r ../include $dev
 
     runHook postInstall
   '';
@@ -76,16 +78,16 @@ buildGoModule {
     "dev"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Free TLS/SSL implementation";
     mainProgram = "bssl";
     homepage = "https://boringssl.googlesource.com";
-    maintainers = [ maintainers.thoughtpolice ];
-    license = with licenses; [
+    maintainers = [ lib.maintainers.thoughtpolice ];
+    license = with lib.licenses; [
       openssl
       isc
       mit
       bsd3
     ];
   };
-}
+})
diff --git a/pkgs/by-name/bo/boringssl/secp224r1-compat.patch b/pkgs/by-name/bo/boringssl/secp224r1-compat.patch
new file mode 100644
index 000000000000..b710a8dbec19
--- /dev/null
+++ b/pkgs/by-name/bo/boringssl/secp224r1-compat.patch
@@ -0,0 +1,20 @@
+diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
+index 51417d412..a961a1093 100644
+--- a/include/openssl/ssl.h
++++ b/include/openssl/ssl.h
+@@ -2522,6 +2522,7 @@ OPENSSL_EXPORT size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);
+ // |SSL_SIGN_*|.
+ 
+ // SSL_GROUP_* define TLS group IDs.
++#define SSL_GROUP_SECP224R1 22
+ #define SSL_GROUP_SECP256R1 23
+ #define SSL_GROUP_SECP384R1 24
+ #define SSL_GROUP_SECP521R1 25
+@@ -5836,6 +5837,7 @@ OPENSSL_EXPORT int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg);
+ #define SSL_R_TLSV1_CERTIFICATE_REQUIRED SSL_R_TLSV1_ALERT_CERTIFICATE_REQUIRED
+ 
+ // The following symbols are compatibility aliases for |SSL_GROUP_*|.
++#define SSL_CURVE_SECP224R1 SSL_GROUP_SECP224R1
+ #define SSL_CURVE_SECP256R1 SSL_GROUP_SECP256R1
+ #define SSL_CURVE_SECP384R1 SSL_GROUP_SECP384R1
+ #define SSL_CURVE_SECP521R1 SSL_GROUP_SECP521R1

From 09ee233a751b27b370771f67f2aab2dd771275b1 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Thu, 25 Sep 2025 15:03:10 +0200
Subject: [PATCH 2/2] python3Packages.primp: fix boringssl

---
 pkgs/development/python-modules/primp/default.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/development/python-modules/primp/default.nix b/pkgs/development/python-modules/primp/default.nix
index 4a38ff8c6951..0140719e10a3 100644
--- a/pkgs/development/python-modules/primp/default.nix
+++ b/pkgs/development/python-modules/primp/default.nix
@@ -55,6 +55,21 @@ let
       );
 
     vendorHash = "sha256-06MkjXl0DKFzIH/H+uT9kXsQdPq7qdZh2dlLW/YhJuk=";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $bin/bin $dev $out/lib
+
+      install -Dm755 tool/bssl -t $bin/bin
+      install -Dm644 ssl/libssl.a -t $out/lib
+      install -Dm644 crypto/libcrypto.a -t $out/lib
+      install -Dm644 decrepit/libdecrepit.a -t $out/lib
+
+      cp -r ../include $dev
+
+      runHook postInstall
+    '';
   });
   # boring-sys expects the static libraries in build/ instead of lib/
   boringssl-wrapper = runCommand "boringssl-wrapper" { } ''