From 9a77eef2a9b9f77ab774c26218d25bb23e48c940 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Aug 2025 23:49:02 +0200
Subject: [PATCH 1/3] nss: implement automated updates using nix-update-script

---
 pkgs/development/libraries/nss/3_114.nix   |  2 ++
 pkgs/development/libraries/nss/esr.nix     |  2 ++
 pkgs/development/libraries/nss/generic.nix | 17 +++++++++++++++--
 pkgs/development/libraries/nss/latest.nix  |  2 ++
 pkgs/development/libraries/nss/update.sh   | 10 ----------
 5 files changed, 21 insertions(+), 12 deletions(-)
 delete mode 100755 pkgs/development/libraries/nss/update.sh

diff --git a/pkgs/development/libraries/nss/3_114.nix b/pkgs/development/libraries/nss/3_114.nix
index 3d17c3de971c..92b0671c8a79 100644
--- a/pkgs/development/libraries/nss/3_114.nix
+++ b/pkgs/development/libraries/nss/3_114.nix
@@ -1,4 +1,6 @@
 import ./generic.nix {
   version = "3.114";
   hash = "sha256-YVtXk1U9JtqfOH7+m/+bUI/yXJcydqjjGbCy/5xbMe8=";
+  filename = "3_114.nix";
+  versionRegex = "NSS_(3)_(114)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index f1b8c6df4acf..63b10c220152 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,6 @@
 import ./generic.nix {
   version = "3.101.2";
   hash = "sha256-i5K47pzQYOiD4vFHBN6VeqXEdPBOM7U1oSK0qSi2M2Y=";
+  filename = "esr.nix";
+  versionRegex = "NSS_(3)_(101)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 77d838a25ab0..6c274607e03c 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -1,4 +1,9 @@
-{ version, hash }:
+{
+  version,
+  hash,
+  filename,
+  versionRegex,
+}:
 {
   lib,
   stdenv,
@@ -19,6 +24,7 @@
   enableFIPS ? false,
   nixosTests,
   nss_latest,
+  nix-update-script,
 }:
 
 let
@@ -229,7 +235,14 @@ stdenv.mkDerivation rec {
       runHook postInstall
     '';
 
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--override-filename"
+      "pkgs/development/libraries/nss/${filename}"
+      "--version-regex"
+      versionRegex
+    ];
+  };
 
   passthru.tests =
     lib.optionalAttrs (lib.versionOlder version nss_latest.version) {
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 45cd7960539f..5711746540b7 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -7,4 +7,6 @@
 import ./generic.nix {
   version = "3.115";
   hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
+  filename = "latest.nix";
+  versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/nss/update.sh b/pkgs/development/libraries/nss/update.sh
deleted file mode 100755
index 600dbdff004c..000000000000
--- a/pkgs/development/libraries/nss/update.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnugrep gnused coreutils common-updater-scripts
-
-set -x
-
-base_url="https://ftp.mozilla.org/pub/security/nss/releases/"
-
-version="$(curl -sSL ${base_url}  | grep 'RTM' | grep -v WITH_CKBI | sed 's|.*>\(NSS_[0-9]*_[0-9]*_*[0-9]*_*[0-9]*_RTM\)/.*|\1|g' | sed 's|NSS_||g' | sed 's|_RTM||g' | sed 's|_|.|g' | sort -V | tail -1)"
-hash="$(nix-hash --type sha256 --base32 ${base_url}/NSS_${version/\./_}_RTM/src/nss-${version}.tar.gz)"
-update-source-version nss "${version}" "${hash}"

From a623867fd2aed070924d13505814eec634a9af3e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Aug 2025 23:56:41 +0200
Subject: [PATCH 2/3] nss_latest: 3.115 -> 3.115.1

https://github.com/nss-dev/nss/blob/master/doc/rst/releases/nss_3_115_1.rst
---
 pkgs/development/libraries/nss/latest.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 5711746540b7..85caeb11d41c 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.115";
-  hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
+  version = "3.115.1";
+  hash = "sha256-SuXNqRW0lBPioYxmoGa3ZbfxC7ud6TW3xVpakVwtm14=";
   filename = "latest.nix";
   versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }

From 324bee70162126c8c3ee60ce71fb74041f5ebc88 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 Aug 2025 23:56:59 +0200
Subject: [PATCH 3/3] nss_3_114: 3.114 -> 3.114.1

https://github.com/nss-dev/nss/blob/master/doc/rst/releases/nss_3_114_1.rst
---
 pkgs/development/libraries/nss/3_114.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/nss/3_114.nix b/pkgs/development/libraries/nss/3_114.nix
index 92b0671c8a79..af578ffeb2e4 100644
--- a/pkgs/development/libraries/nss/3_114.nix
+++ b/pkgs/development/libraries/nss/3_114.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "3.114";
-  hash = "sha256-YVtXk1U9JtqfOH7+m/+bUI/yXJcydqjjGbCy/5xbMe8=";
+  version = "3.114.1";
+  hash = "sha256-xs7G5MHOd6mPVpBfDd2fFG2qw+5KypBTPqErbl0zfrk=";
   filename = "3_114.nix";
   versionRegex = "NSS_(3)_(114)(?:_(\\d+))?_RTM";
 }