boringssl: build shared library on non-static stdenv (#499613)

pkgs/by-name/bo/boringssl/package.nix

@@ -6,6 +6,8 @@
   ninja,
   perl,
   gitUpdater,
+
+  withShared ? !stdenv.hostPlatform.isStatic,
 }:
 
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
@@ -30,6 +32,10 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" withShared)
+  ];
+
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.cc.isGNU [
       # Needed with GCC 12 but breaks on darwin (with clang)
@@ -47,7 +53,10 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    updateScript = gitUpdater { };
+    isShared = withShared;
+  };
 
   meta = {
     description = "Free TLS/SSL implementation";

pkgs/by-name/li/libsignal-ffi/package.nix

@@ -6,6 +6,8 @@
   xcodebuild,
   protobuf,
   boringssl,
+
+  withShared ? !stdenv.hostPlatform.isStatic,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-ffi";
@@ -21,6 +23,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-xffBXvq1ikesIjw6cXfphnTIiyuMiUcY8h0pzSgfD8U=";
   };
 
+  postPatch =
+    lib.optionalString withShared ''
+      substituteInPlace rust/bridge/ffi/Cargo.toml \
+        --replace-fail 'crate-type = ["staticlib"]' 'crate-type = ["cdylib"]'
+    ''
+    + lib.optionalString boringssl.passthru.isShared ''
+      substituteInPlace $cargoDepsCopy/*/boring-sys-*/build/main.rs \
+        --replace-fail "cargo:rustc-link-lib=static=crypto" "cargo:rustc-link-lib=dylib=crypto" \
+        --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"
+    '';
+
   nativeBuildInputs = [
     protobuf
     rustPlatform.bindgenHook
@@ -40,6 +53,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "libsignal-ffi"
   ];
 
+  postFixup = lib.optionalString (withShared && stdenv.hostPlatform.isDarwin) ''
+    dylib="$out/lib/libsignal_ffi.dylib"
+    install_name_tool -id "$dylib" "$dylib"
+  '';
+
   meta = {
     description = "C ABI library which exposes Signal protocol logic";
     homepage = "https://github.com/signalapp/libsignal";

pkgs/by-name/si/signal-desktop/libsignal-node.nix

@@ -1,4 +1,5 @@
 {
+  lib,
   stdenv,
   rustPlatform,
   fetchNpmDeps,
@@ -60,6 +61,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "'prebuilds'" "'$out/lib'" \
       --replace-fail "objcopy = shutil.which('%s-linux-gnu-objcopy' % cargo_target.split('-')[0]) or 'objcopy'" \
                      "objcopy = os.getenv('OBJCOPY', 'objcopy')"
+  ''
+  + lib.optionalString boringssl.passthru.isShared ''
+    substituteInPlace $cargoDepsCopy/*/boring-sys-*/build/main.rs \
+      --replace-fail "cargo:rustc-link-lib=static=crypto" "cargo:rustc-link-lib=dylib=crypto" \
+      --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"
   '';
 
   buildPhase = ''