freeipa: 4.12.1 -> 4.12.3

freeipa 4.12.1 was broken in unstable due to incompatibility with
cryptography 44.0.

- Version bump
- Add required patches (merged upstream, but not in a release yet) for
  cryptography and PyCA 44.0
- Add versionCheckHook so we catch similar breakage in the future

pkgs/os-specific/linux/freeipa/default.nix

@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchurl,
+  fetchpatch,
   pkg-config,
   autoconf,
   automake,
@@ -34,6 +35,7 @@
   lesscpy,
   jansson,
   runtimeShell,
+  versionCheckHook,
 }:
 
 let
@@ -66,13 +68,26 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freeipa";
-  version = "4.12.1";
+  version = "4.12.3";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
-    sha256 = "sha256-SPZ+QgssDKG1Hz1oqtVdg864qtcvncuOlzTWjN4+loM=";
+    sha256 = "sha256-bVttsyn99DX01CmthIxzxuJPGgqZB2+pgamviO4LBJI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "support-pyca-44.0";
+      url = "https://github.com/freeipa/freeipa/pull/7619/commits/2dc4133920fe58ce414c545102c74173d40d1997.patch";
+      hash = "sha256-PROnPc/1qS3hcO8s5sel55tsyZ1VPjEKLcua8Pd4DP0=";
+    })
+    (fetchpatch {
+      name = "fix-tripledes-cipher-warnings";
+      url = "https://github.com/freeipa/freeipa/pull/7619/commits/e2bf6e4091c7b5320ec6387dab2d5cabe4a9a42d.patch";
+      hash = "sha256-AyMK0hjXMrFK4/qIcjPMFH9DKvnvYOK2QS83Otcc+l4=";
+    })
+  ];
+
   nativeBuildInputs = [
     python3.pkgs.wrapPython
     jre
@@ -156,6 +171,13 @@ stdenv.mkDerivation rec {
     rm -rf $out/etc/ipa $out/var/lib/ipa-client/sysrestore
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   meta = with lib; {
     description = "Identity, Policy and Audit system";
     longDescription = ''