From 383bd6b1c3f6c2ef0e1be3475906a06d0026e48e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sat, 30 May 2026 21:42:17 +0200
Subject: [PATCH 1/2] criu: enable strictDeps, use --replace-fail, use tag

---
 pkgs/by-name/cr/criu/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/cr/criu/package.nix b/pkgs/by-name/cr/criu/package.nix
index aeb6aed9b409..e07949b6b5a4 100644
--- a/pkgs/by-name/cr/criu/package.nix
+++ b/pkgs/by-name/cr/criu/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "checkpoint-restore";
     repo = "criu";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SfpJskXX7r3jbAwgZl2qpa7j1M4i8/sV6rlAWiUEoQs=";
   };
 
@@ -73,11 +73,14 @@ stdenv.mkDerivation (finalAttrs: {
     python3.pkgs.protobuf
   ]);
 
+  strictDeps = true;
+
   postPatch = ''
     substituteInPlace ./Documentation/Makefile \
-      --replace "2>/dev/null" "" \
-      --replace "-m custom.xsl" "-m custom.xsl --skip-validation -x ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
-    substituteInPlace ./Makefile --replace "head-name := \$(shell git tag -l v\$(CRIU_VERSION))" "head-name = ${finalAttrs.version}.0"
+      --replace-fail "2>/dev/null" "" \
+      --replace-fail "-m custom.xsl" "-m custom.xsl --skip-validation -x ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
+    substituteInPlace ./Makefile \
+      --replace-fail "head-name := \$(shell git tag -l v\$(CRIU_VERSION))" "head-name = ${finalAttrs.version}.0"
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
   '';
 

From bb538ea125c6a3a9d157daeae1671b821b9c3c8f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sat, 30 May 2026 22:16:51 +0200
Subject: [PATCH 2/2] criu: add patch to prevent build failures with newer
 glibc

In file included from criu/pie/parasite.c:10:
criu/include/linux/rseq.h:33:1: error: conflicting redefinition of enum 'enum rseq_flags'
   33 | };
      | ^
criu/include/linux/rseq.h:39:1: error: conflicting redefinition of enum 'enum rseq_cs_flags_bit'
   39 | };
      | ^
criu/include/linux/rseq.h:45:1: error: conflicting redefinition of enum 'enum rseq_cs_flags'
   45 | };
      | ^
cc1: note: unrecognized command-line option '-Wno-unknown-warning-option' may have been intended to silence earlier diagnostics
make[2]: *** [/build/criu-4.1.1-source/scripts/nmk/scripts/build.mk:119: criu/pie/parasite.o] Error 1
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [criu/Makefile:59: pie] Error 2
make: *** [Makefile:276: criu] Error 2

See https://github.com/checkpoint-restore/criu/pull/2920
---
 pkgs/by-name/cr/criu/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/cr/criu/package.nix b/pkgs/by-name/cr/criu/package.nix
index e07949b6b5a4..ddf9248caa43 100644
--- a/pkgs/by-name/cr/criu/package.nix
+++ b/pkgs/by-name/cr/criu/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   protobuf,
   protobufc,
   asciidoc,
@@ -38,6 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-SfpJskXX7r3jbAwgZl2qpa7j1M4i8/sV6rlAWiUEoQs=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "conflicting-redefinition-of-rseq-enums.patch";
+      url = "https://github.com/checkpoint-restore/criu/commit/3f3acc3200a23140abaa32a2017ae159d3c2d02c.patch?full_index=1";
+      hash = "sha256-J8n4TjqjzJLLULnpJdR/6YWa/8moFQMn+wNo4a0otgE=";
+    })
+  ];
+
   enableParallelBuilding = true;
   depsBuildBuild = [
     protobufc