From fb74b741f82bb88b481262f7c849cadb117d505a Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 11 Nov 2025 00:52:11 -0800
Subject: [PATCH] pkcs11-provider: enable entire test suite

We can now test using both Kryoptic (a Rust PKCS#11 software token
implementation) and SoftHSM.
---
 pkgs/by-name/pk/pkcs11-provider/package.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pk/pkcs11-provider/package.nix b/pkgs/by-name/pk/pkcs11-provider/package.nix
index 975bb04bbf4d..a19126f0f492 100644
--- a/pkgs/by-name/pk/pkcs11-provider/package.nix
+++ b/pkgs/by-name/pk/pkcs11-provider/package.nix
@@ -6,6 +6,8 @@
   nss,
   p11-kit,
   opensc,
+  softhsm,
+  kryoptic,
   gnutls,
   expect,
   which,
@@ -44,10 +46,11 @@ stdenv.mkDerivation rec {
     which
   ];
 
-  # don't add SoftHSM to here: https://github.com/openssl/openssl/issues/22508
   nativeCheckInputs = [
     p11-kit.bin
     opensc
+    softhsm
+    kryoptic
     nss.tools
     gnutls
     openssl.bin
@@ -56,8 +59,16 @@ stdenv.mkDerivation rec {
     pkcs11ProviderPython3
   ];
 
+  env = {
+    KRYOPTIC = "${lib.getLib kryoptic}/lib";
+  };
+
+  # Fix a typo in the Kryoptic test (remove this in v1.2).
   postPatch = ''
     patchShebangs --build .
+    substituteInPlace tests/kryoptic-init.sh \
+      --replace-fail /usr/local/lib/kryoptic "\\''${KRYOPTIC}" \
+      --replace-fail "libkryoptic_pkcs11so" libkryoptic_pkcs11.so
   '';
 
   preInstall = ''