From 5992b69d1fff686dd7165ba45d8c42af39191125 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 23 Jul 2026 20:54:58 +0200
Subject: [PATCH 1/3] hyperscan: mark static build broken, replace pcre with
 pcre2

> CMake Error at cmake/arch.cmake:108 (message):
>   A minimum of SSSE3 compiler support is required
> Call Stack (most recent call first):
>   CMakeLists.txt:340 (include)
---
 pkgs/by-name/hy/hyperscan/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hy/hyperscan/package.nix b/pkgs/by-name/hy/hyperscan/package.nix
index d32212804412..0a9312c052e9 100644
--- a/pkgs/by-name/hy/hyperscan/package.nix
+++ b/pkgs/by-name/hy/hyperscan/package.nix
@@ -8,7 +8,7 @@
   util-linux,
   pkg-config,
   boost,
-  pcre,
+  pcre2,
   withStatic ? false, # build only shared libs by default, build static+shared if true
 }:
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = lib.optionalString withStatic (
     ''
       mkdir -p pcre
-      tar xvf ${pcre.src} --strip-components 1 -C pcre
+      tar xvf ${pcre2.src} --strip-components 1 -C pcre
     ''
     # - CMake 4 dropped support of versions lower than 3.5, versions lower than 3.10 are deprecated.
     #   https://github.com/NixOS/nixpkgs/issues/445447
@@ -111,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    broken = stdenv.hostPlatform.isStatic; # A minimum of SSSE3 compiler support is required
     description = "High-performance multiple regex matching library";
     longDescription = ''
       Hyperscan is a high-performance multiple regex matching library.

From 3758224be38a7510566875fdf1749f76277570b5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 23 Jul 2026 21:02:41 +0200
Subject: [PATCH 2/3] rspamd: try migrating to pcre2 again

The crashes happened in 2022 and now we are yanking pcre1, so we need to
try.
---
 nixos/modules/services/mail/rspamd.nix | 1 +
 pkgs/by-name/rs/rspamd/package.nix     | 7 +++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix
index 189d2c078e0d..11867a6601ac 100644
--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@@ -506,6 +506,7 @@ in
         CapabilityBoundingSet = "";
         DevicePolicy = "closed";
         LockPersonality = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;
diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index 8c41fe9c2934..80bbd7e95e75 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -21,7 +21,7 @@
   lua,
   luajit,
   openssl,
-  pcre,
+  pcre2,
   ragel,
   sqlite,
   vectorscan,
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsodium
     (if withLuaJIT then luajit else lua)
     openssl
-    pcre
+    pcre2
     ragel
     sqlite
     vectorscan
@@ -92,8 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool' "ENABLE_HYPERSCAN" true)
     (cmakeBool' "ENABLE_JEMALLOC" true)
     (cmakeBool' "ENABLE_LUAJIT" withLuaJIT)
-    # pcre2 jit seems to cause crashes: https://github.com/NixOS/nixpkgs/pull/181908
-    (cmakeBool' "ENABLE_PCRE2" false)
+    (cmakeBool' "ENABLE_PCRE2" true)
     # doctest 2.5.0 compat problems https://github.com/rspamd/rspamd/issues/5994
     (cmakeBool' "SYSTEM_DOCTEST" false)
     (cmakeBool' "SYSTEM_XXHASH" true)

From 22fd0559fc39aa4d7d279cc1bac18ca998129aeb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 23 Jul 2026 21:05:37 +0200
Subject: [PATCH 3/3] rspamd: 4.1.0 -> 4.1.2

https://github.com/rspamd/rspamd/releases/tag/4.1.1
https://github.com/rspamd/rspamd/releases/tag/4.1.2
---
 pkgs/by-name/rs/rspamd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rs/rspamd/package.nix b/pkgs/by-name/rs/rspamd/package.nix
index 80bbd7e95e75..ac416fb819d7 100644
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -46,13 +46,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rspamd";
-  version = "4.1.0";
+  version = "4.1.2";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     tag = finalAttrs.version;
-    hash = "sha256-QAeh8SwUwGTGmbbFlJyrprXY0quk4grP/zA/KMQQBdo=";
+    hash = "sha256-LqFLzOcLyZeDT5kRlENmyTzUhyVC0HBhoSKInMFpqZA=";
   };
 
   nativeBuildInputs = [