From ab7936238b252f30879be36d6fd6685124ea8308 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Fri, 13 Mar 2026 17:33:48 +0100
Subject: [PATCH 1/2] boringssl: build shared library on non-static stdenv

---
 pkgs/by-name/bo/boringssl/package.nix             | 11 ++++++++++-
 pkgs/by-name/li/libsignal-ffi/package.nix         |  6 ++++++
 pkgs/by-name/si/signal-desktop/libsignal-node.nix |  6 ++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/bo/boringssl/package.nix b/pkgs/by-name/bo/boringssl/package.nix
index 032d11dca1e2..8c6504e6ab07 100644
--- a/pkgs/by-name/bo/boringssl/package.nix
+++ b/pkgs/by-name/bo/boringssl/package.nix
@@ -6,6 +6,8 @@
   ninja,
   perl,
   gitUpdater,
+
+  withShared ? !stdenv.hostPlatform.isStatic,
 }:
 
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
@@ -30,6 +32,10 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" withShared)
+  ];
+
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.cc.isGNU [
       # Needed with GCC 12 but breaks on darwin (with clang)
@@ -47,7 +53,10 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    updateScript = gitUpdater { };
+    isShared = withShared;
+  };
 
   meta = {
     description = "Free TLS/SSL implementation";
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index f21357f2091e..39de36a8fb32 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -21,6 +21,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-xffBXvq1ikesIjw6cXfphnTIiyuMiUcY8h0pzSgfD8U=";
   };
 
+  postPatch = lib.optionalString boringssl.passthru.isShared ''
+    substituteInPlace $cargoDepsCopy/boring-sys-*/build/main.rs \
+      --replace-fail "cargo:rustc-link-lib=static=crypto" "cargo:rustc-link-lib=dylib=crypto" \
+      --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"
+  '';
+
   nativeBuildInputs = [
     protobuf
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/si/signal-desktop/libsignal-node.nix b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
index 1009f28ac4b3..95ef425ac970 100644
--- a/pkgs/by-name/si/signal-desktop/libsignal-node.nix
+++ b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   stdenv,
   rustPlatform,
   fetchNpmDeps,
@@ -60,6 +61,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "'prebuilds'" "'$out/lib'" \
       --replace-fail "objcopy = shutil.which('%s-linux-gnu-objcopy' % cargo_target.split('-')[0]) or 'objcopy'" \
                      "objcopy = os.getenv('OBJCOPY', 'objcopy')"
+  ''
+  + lib.optionalString boringssl.passthru.isShared ''
+    substituteInPlace $cargoDepsCopy/*/boring-sys-*/build/main.rs \
+      --replace-fail "cargo:rustc-link-lib=static=crypto" "cargo:rustc-link-lib=dylib=crypto" \
+      --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"
   '';
 
   buildPhase = ''

From 00ddb07a9d0a9376d92069a2f9f5b48801330a5c Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Fri, 17 Apr 2026 10:08:30 +0200
Subject: [PATCH 2/2] libsignal-ffi: build shared library on non-static stdenv

---
 pkgs/by-name/li/libsignal-ffi/package.nix | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index 39de36a8fb32..c3c1bf4dbf5e 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -6,6 +6,8 @@
   xcodebuild,
   protobuf,
   boringssl,
+
+  withShared ? !stdenv.hostPlatform.isStatic,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-ffi";
@@ -21,11 +23,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-xffBXvq1ikesIjw6cXfphnTIiyuMiUcY8h0pzSgfD8U=";
   };
 
-  postPatch = lib.optionalString boringssl.passthru.isShared ''
-    substituteInPlace $cargoDepsCopy/boring-sys-*/build/main.rs \
-      --replace-fail "cargo:rustc-link-lib=static=crypto" "cargo:rustc-link-lib=dylib=crypto" \
-      --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"
-  '';
+  postPatch =
+    lib.optionalString withShared ''
+      substituteInPlace rust/bridge/ffi/Cargo.toml \
+        --replace-fail 'crate-type = ["staticlib"]' 'crate-type = ["cdylib"]'
+    ''
+    + lib.optionalString boringssl.passthru.isShared ''
+      substituteInPlace $cargoDepsCopy/*/boring-sys-*/build/main.rs \
+        --replace-fail "cargo:rustc-link-lib=static=crypto" "cargo:rustc-link-lib=dylib=crypto" \
+        --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"
+    '';
 
   nativeBuildInputs = [
     protobuf
@@ -46,6 +53,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "libsignal-ffi"
   ];
 
+  postFixup = lib.optionalString (withShared && stdenv.hostPlatform.isDarwin) ''
+    dylib="$out/lib/libsignal_ffi.dylib"
+    install_name_tool -id "$dylib" "$dylib"
+  '';
+
   meta = {
     description = "C ABI library which exposes Signal protocol logic";
     homepage = "https://github.com/signalapp/libsignal";