rpcs3: use vendored wolfSSL and update meta.license

Insofar as this works as an exception tightly scoped to RPCS3,
the safest way to take advantage of it is to use the copy of wolfSSL
directly included as part of RPCS3 and avoid dynamic linking. Insofar as
it doesn’t work, `lib.licenses.unfree` keeps it away from the cache.

Thankfully, they seem pretty good at keeping their vendored version
up to date.

pkgs/by-name/rp/rpcs3/package.nix

@@ -18,7 +18,6 @@
   libusb1,
   zlib,
   curl,
-  wolfssl,
   python3,
   pugixml,
   protobuf_33,
@@ -60,9 +59,9 @@ stdenv.mkDerivation (finalAttrs: {
       cd $out/3rdparty
       git submodule update --init \
         fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \
-        feralinteractive/feralinteractive
+        feralinteractive/feralinteractive wolfssl/wolfssl
     '';
-    hash = "sha256-IKRGKUN0SZIxZToP9kimIc+5wn9GS86tM+/oSv76d74=";
+    hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
@@ -82,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "USE_SYSTEM_LIBPNG" true)
     (lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
     (lib.cmakeBool "USE_SYSTEM_CURL" true)
-    (lib.cmakeBool "USE_SYSTEM_WOLFSSL" true)
     (lib.cmakeBool "USE_SYSTEM_FAUDIO" true)
     (lib.cmakeBool "USE_SYSTEM_OPENAL" true)
     (lib.cmakeBool "USE_SYSTEM_PUGIXML" true)
@@ -127,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
     libusb1
     curl
-    wolfssl
     python3
     pugixml
     sdl3
@@ -168,7 +165,25 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       ilian
     ];
-    license = lib.licenses.gpl2Only;
+    license = [
+      lib.licenses.gpl2Only
+      # Vendors wolfSSL, which changed its licence from
+      # `GPL-2.0-or-later` to `GPL-3.0-or-later`, which is incompatible
+      # with RPCS3’s `GPL-2.0-only`. They have a “GPLv2 exception list”
+      # (<https://github.com/wolfSSL/wolfssl/blob/v5.9.1-stable/LICENSING>),
+      # but this is dubious; either the exception likely negates the
+      # licence change by letting you take wolfSSL out of a
+      # `GPL-2.0-only` combination and redistribute it under those
+      # terms, negating the licence change entirely, or else it doesn’t
+      # allow distribution of the combination under the `GPL-2.0-only`
+      # at all and therefore would still constitute a licence
+      # violation to redistribute.
+      #
+      # We use `lib.licenses.unfree` to represent this awkward
+      # situation and keep Hydra from building the package.
+      lib.licenses.gpl3Plus
+      lib.licenses.unfree
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"