From ebb013106f3ce766e83bbdb925e5fb42c579d047 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Sat, 28 Mar 2026 19:20:14 +0000
Subject: [PATCH] rpcs3: use vendored wolfSSL and update `meta.license`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Insofar as this works as an exception tightly scoped to RPCS3,
the safest way to take advantage of it is to use the copy of wolfSSL
directly included as part of RPCS3 and avoid dynamic linking. Insofar as
it doesn’t work, `lib.licenses.unfree` keeps it away from the cache.

Thankfully, they seem pretty good at keeping their vendored version
up to date.
---
 pkgs/by-name/rp/rpcs3/package.nix | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index 9d1d49ffa158..b5d5c085f865 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -18,7 +18,6 @@
   libusb1,
   zlib,
   curl,
-  wolfssl,
   python3,
   pugixml,
   protobuf_33,
@@ -60,9 +59,9 @@ stdenv.mkDerivation (finalAttrs: {
       cd $out/3rdparty
       git submodule update --init \
         fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \
-        feralinteractive/feralinteractive
+        feralinteractive/feralinteractive wolfssl/wolfssl
     '';
-    hash = "sha256-IKRGKUN0SZIxZToP9kimIc+5wn9GS86tM+/oSv76d74=";
+    hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
@@ -82,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "USE_SYSTEM_LIBPNG" true)
     (lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
     (lib.cmakeBool "USE_SYSTEM_CURL" true)
-    (lib.cmakeBool "USE_SYSTEM_WOLFSSL" true)
     (lib.cmakeBool "USE_SYSTEM_FAUDIO" true)
     (lib.cmakeBool "USE_SYSTEM_OPENAL" true)
     (lib.cmakeBool "USE_SYSTEM_PUGIXML" true)
@@ -127,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
     libusb1
     curl
-    wolfssl
     python3
     pugixml
     sdl3
@@ -168,7 +165,25 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       ilian
     ];
-    license = lib.licenses.gpl2Only;
+    license = [
+      lib.licenses.gpl2Only
+      # Vendors wolfSSL, which changed its licence from
+      # `GPL-2.0-or-later` to `GPL-3.0-or-later`, which is incompatible
+      # with RPCS3’s `GPL-2.0-only`. They have a “GPLv2 exception list”
+      # (<https://github.com/wolfSSL/wolfssl/blob/v5.9.1-stable/LICENSING>),
+      # but this is dubious; either the exception likely negates the
+      # licence change by letting you take wolfSSL out of a
+      # `GPL-2.0-only` combination and redistribute it under those
+      # terms, negating the licence change entirely, or else it doesn’t
+      # allow distribution of the combination under the `GPL-2.0-only`
+      # at all and therefore would still constitute a licence
+      # violation to redistribute.
+      #
+      # We use `lib.licenses.unfree` to represent this awkward
+      # situation and keep Hydra from building the package.
+      lib.licenses.gpl3Plus
+      lib.licenses.unfree
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"