From 34762648c512d9c5bf80afc77dfc328a0ce5b75c Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 1 Apr 2026 13:07:19 -0700
Subject: [PATCH 1/2] libu2f-emu: init at 0-unstable-2020-09-04

Universal 2nd Factor (U2F) Emulation C Library, used by QEMU to
provide the u2f-emulated virtual device for testing.
---
 pkgs/by-name/li/libu2f-emu/package.nix | 61 ++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 pkgs/by-name/li/libu2f-emu/package.nix

diff --git a/pkgs/by-name/li/libu2f-emu/package.nix b/pkgs/by-name/li/libu2f-emu/package.nix
new file mode 100644
index 000000000000..640402e64d20
--- /dev/null
+++ b/pkgs/by-name/li/libu2f-emu/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  openssl,
+}:
+
+stdenv.mkDerivation {
+  pname = "libu2f-emu";
+  version = "0-unstable-2020-09-04";
+
+  src = fetchFromGitHub {
+    owner = "Agnoctopus";
+    repo = "libu2f-emu";
+    rev = "d1c4b9c2e1c42e8931033912c8b609521f2a7756";
+    hash = "sha256-kDAXA/v2nb/QAiJpGs0rTjm0t6CdbonTwHHoYhDQExE=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  postPatch = ''
+    # Upstream meson.build uses error() instead of warning() for missing
+    # doxygen/dot, which fails the configure.
+    substituteInPlace meson.build \
+      --replace-fail "error('Skip doc:" "warning('Skip doc:" \
+      --replace-fail "error('Skip dot in doc:" "warning('Skip dot in doc:"
+
+    # Fix header guard typo: TRANSaCTION_H -> TRANSACTION_H
+    substituteInPlace src/usb/transaction.h \
+      --replace-fail "define TRANSaCTION_H" "define TRANSACTION_H"
+
+    # Install headers into a u2f-emu/ subdirectory so consumers can
+    # use #include <u2f-emu/u2f-emu.h> (expected by QEMU).
+    substituteInPlace src/meson.build \
+      --replace-fail "install_headers(u2f_emu_headers)" \
+                     "install_headers(u2f_emu_headers, subdir: 'u2f-emu')"
+  '';
+
+  # Disable -Werror: upstream uses OpenSSL EC_KEY APIs deprecated since 3.0.
+  mesonFlags = [ "--warnlevel=2" ];
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  meta = {
+    description = "Universal 2nd Factor (U2F) Emulation C Library";
+    homepage = "https://github.com/Agnoctopus/libu2f-emu";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ philiptaron ];
+    platforms = lib.platforms.linux;
+  };
+}

From da5378d4bd123363a7d7c78304a1e5de5d9feb80 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 1 Apr 2026 13:07:26 -0700
Subject: [PATCH 2/2] qemu: add u2fEmuSupport option using libu2f-emu

Adds a u2fEmuSupport flag (default: false) to enable the u2f-emulated
virtual USB device in QEMU, backed by libu2f-emu. This allows NixOS VM
tests to use a software FIDO/U2F token without hardware.
---
 pkgs/by-name/qe/qemu/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 5dde5e581158..be472939ad21 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -92,6 +92,8 @@
   fuse3,
   canokeySupport ? false,
   canokey-qemu,
+  u2fEmuSupport ? false,
+  libu2f-emu,
   capstoneSupport ? !minimal,
   capstone,
   valgrindSupport ? false,
@@ -245,6 +247,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals uringSupport [ liburing ]
   ++ lib.optionals fuseSupport [ fuse3 ]
   ++ lib.optionals canokeySupport [ canokey-qemu ]
+  ++ lib.optionals u2fEmuSupport [ libu2f-emu ]
   ++ lib.optionals capstoneSupport [ capstone ]
   ++ lib.optionals valgrindSupport [ valgrind-light ];
 
@@ -329,6 +332,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional uringSupport "--enable-linux-io-uring"
   ++ lib.optional fuseSupport "--enable-fuse"
   ++ lib.optional canokeySupport "--enable-canokey"
+  ++ lib.optional u2fEmuSupport "--enable-u2f"
   ++ lib.optional capstoneSupport "--enable-capstone"
   ++ lib.optional (!pluginsSupport) "--disable-plugins"
   ++ lib.optional (!enableBlobs) "--disable-install-blobs"