boulder: 2025-04-17 -> v0.20251118.0, fix build

Boulder has mostly removed keys and certificates for testing in the
meantime. They have to be generated on-the-fly. The ipki keys just
require minica. The webpki keys would require softhsm and this somehow
fails. We currently get away without them, probably because we have
disabled all the tests that require them.

pkgs/by-name/bo/boulder/package.nix

@@ -4,17 +4,18 @@
   buildGoModule,
   testers,
   boulder,
+  minica,
   nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "boulder";
-  version = "2025-04-17";
+  version = "0.20251118.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
     repo = "boulder";
-    tag = "release-${version}";
+    tag = "v${version}";
     leaveDotGit = true;
     postFetch = ''
       pushd $out
@@ -22,11 +23,16 @@ buildGoModule rec {
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-FXk+JZJ1azpgN6IQ9aYmpUEO1CGs9/3sog1NjrfB4d8=";
+    hash = "sha256-JVkIu8Fh5F8WQXa45I0hnSedAaIQIOFidtWVpVHbAWA=";
   };
 
   vendorHash = null;
 
+  postPatch = ''
+    # We already built the application with custom settings. This fails, so we have to disable it.
+    substituteInPlace test/certs/generate.sh --replace-fail 'make build' ""
+  '';
+
   subPackages = [ "cmd/boulder" ];
 
   ldflags = [
@@ -40,9 +46,14 @@ buildGoModule rec {
     ldflags+=" -X \"github.com/letsencrypt/boulder/core.BuildTime=$(date -u -d @0)\""
   '';
 
+  nativeCheckInputs = [ minica ];
+
   preCheck = ''
     # Test all targets.
     unset subPackages
+    # Generate integration test certificates, but skip webpki certificates that are hard to make without errors and are currently unneeded.
+    mkdir test/certs/webpki
+    bash test/certs/generate.sh
   '';
 
   # Tests that fail or require additional services.
@@ -58,6 +69,7 @@ buildGoModule rec {
     "TestAddPrecertificateIncomplete"
     "TestAddPrecertificateKeyHash"
     "TestAddPrecertificateNoOCSP"
+    "TestAddRateLimitOverride"
     "TestAddRegistration"
     "TestAddReplacementOrder"
     "TestAddSerial"
@@ -110,6 +122,7 @@ buildGoModule rec {
     "TestEnforceJWSAuthType"
     "TestExactPublicSuffixCertLimit"
     "TestExtractJWK"
+    "TestExtractRequestTarget"
     "TestFQDNSetExists"
     "TestFQDNSetTimestampsForWindow"
     "TestFQDNSets"
@@ -249,6 +262,8 @@ buildGoModule rec {
     "TestRecheckCAAFail"
     "TestRecheckCAAInternalServerError"
     "TestRecheckCAASuccess"
+    "TestRecheckInvalidIdentifierType"
+    "TestRecheckSkipIPAddress"
     "TestRedisSource_BatchSetAndGet"
     "TestRedisSource_Ping"
     "TestRegistrationsPerIPOverrideUsage"