From ea283e2fac23b9e613e56a58523f98e53547c761 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Sat, 30 May 2026 22:50:09 -0400
Subject: [PATCH] hqplayerd: mark broken due to libsoup 2.4 removal

HQPlayer 5.x has a dependency on gupnp, gssdp, and an old version of
Rygel, which all depend on the insecure libsoup 2.4. As we drop libsoup
2.4, we must thus mark this as broken.

It appears that upstream has published HQPlayer 6.x, which supposedly
comes with no dependency on Rygel and a new in-house UPnP
implementation. If that is the case, this package may be fixed by
bumping the version.
---
 pkgs/by-name/hq/hqplayerd/package.nix | 13 +++++++++----
 pkgs/by-name/hq/hqplayerd/rygel.nix   | 17 +++++++++++------
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/hq/hqplayerd/package.nix b/pkgs/by-name/hq/hqplayerd/package.nix
index 54f8c7d13a2e..ef52b3ad614b 100644
--- a/pkgs/by-name/hq/hqplayerd/package.nix
+++ b/pkgs/by-name/hq/hqplayerd/package.nix
@@ -8,8 +8,8 @@
   fetchurl,
   flac,
   gcc14,
-  gssdp,
-  gupnp,
+  # gssdp,
+  # gupnp,
   gupnp-av,
   lame,
   libgmpris,
@@ -49,8 +49,8 @@ stdenv.mkDerivation rec {
     flac
     gcc14.cc.lib
     rygel-hqplayerd
-    gssdp
-    gupnp
+    # gssdp
+    # gupnp
     gupnp-av
     lame
     libgmpris
@@ -111,6 +111,11 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
+    # libsoup 2.4 and its dependents (specifically gupnp and gssdp) were
+    # removed due to being insecure and having many known vulnerabilities. this
+    # thus no longer builds. this may be unbroken by updating to hqplayer 6.0,
+    # as it ostensibly removes the need for rygel and gupnp at all.
+    broken = true;
     homepage = "https://www.signalyst.com/custom.html";
     description = "High-end upsampling multichannel software embedded HD-audio player";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/hq/hqplayerd/rygel.nix b/pkgs/by-name/hq/hqplayerd/rygel.nix
index 14d7c082a830..b8fb0c496e6e 100644
--- a/pkgs/by-name/hq/hqplayerd/rygel.nix
+++ b/pkgs/by-name/hq/hqplayerd/rygel.nix
@@ -12,13 +12,13 @@
   wrapGAppsHook3,
   python3,
   glib,
-  gssdp,
-  gupnp,
+  # gssdp,
+  # gupnp,
   gupnp-av,
   gupnp-dlna,
   gst_all_1,
   libgee,
-  libsoup_2_4,
+  # libsoup_2_4,
   gtk3,
   libmediaart,
   sqlite,
@@ -61,12 +61,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
-    gssdp
-    gupnp
+    # gssdp
+    # gupnp
     gupnp-av
     gupnp-dlna
     libgee
-    libsoup_2_4
+    # libsoup_2_4
     gtk3
     libmediaart
     sqlite
@@ -105,6 +105,11 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
+    # libsoup 2.4 and its dependents (specifically gupnp and gssdp) were
+    # removed due to being insecure and having many known vulnerabilities. this
+    # thus no longer builds. this derivation might be obsoleted by updating to
+    # hqplayer 6.0, as it ostensibly removes the need for rygel.
+    broken = true;
     description = "Home media solution (UPnP AV MediaServer) that allows you to easily share audio, video and pictures to other devices";
     homepage = "https://gitlab.gnome.org/GNOME/rygel";
     license = lib.licenses.lgpl21Plus;