···135135 CacheDirectory = "knot-resolver";
136136 CacheDirectoryMode = "0770";
137137 };
138138+ # We don't mind running stop phase from wrong version. It seems less racy.
139139+ systemd.services."kresd@".stopIfChanged = false;
138140139141 # Try cleaning up the previously default location of cache file.
140142 # Note that /var/cache/* should always be safe to remove.
···11+#!/usr/bin/env bash
22+13declare -a autoPatchelfLibs
24declare -Ag autoPatchelfFailedDeps
35···1113 patchelf "$@" || (echo "Command failed: patchelf $*" && exit 1)
1214}
13151616+# shellcheck disable=SC2154
1717+# (targetOffset is referenced but not assigned.)
1418addEnvHooks "$targetOffset" gatherLibraries
15191620isExecutable() {
···116120 interpreter="$(< "$NIX_CC/nix-support/dynamic-linker")"
117121 if isExecutable "$toPatch"; then
118122 runPatchelf --set-interpreter "$interpreter" "$toPatch"
123123+ # shellcheck disable=SC2154
124124+ # (runtimeDependencies is referenced but not assigned.)
119125 if [ -n "$runtimeDependencies" ]; then
120126 for dep in $runtimeDependencies; do
121127 rpath="$rpath${rpath:+:}$dep/lib"
···129135 # clear the RPATH first.
130136 runPatchelf --remove-rpath "$toPatch"
131137138138+ # If the file is not a dynamic executable, ldd/sed will fail,
139139+ # in which case we return, since there is nothing left to do.
132140 local missing
133141 missing="$(
134142 ldd "$toPatch" 2> /dev/null | \
135143 sed -n -e 's/^[\t ]*\([^ ]\+\) => not found.*/\1/p'
136136- )"
144144+ )" || return 0
137145138146 # This ensures that we get the output of all missing dependencies instead
139147 # of failing at the first one, because it's more useful when working on a
···175183 esac
176184 done
177185178178- for file in \
179179- $(find "$@" "${findOpts[@]}" \! -type d \
180180- \( -name '*.so' -o -name '*.so.*' \))
181181- do addToDepCache "$file"; done
186186+ while IFS= read -r -d '' file; do
187187+ addToDepCache "$file"
188188+ done < <(find "$@" "${findOpts[@]}" \! -type d \
189189+ \( -name '*.so' -o -name '*.so.*' \) -print0)
182190}
183191184192autoPatchelf() {
···231239 echo "autoPatchelfHook could not satisfy dependency $failedDep wanted by ${autoPatchelfFailedDeps[$failedDep]}"
232240 depsMissing=1
233241 done
242242+ # shellcheck disable=SC2154
243243+ # (autoPatchelfIgnoreMissingDeps is referenced but not assigned.)
234244 if [[ $depsMissing == 1 && -z "$autoPatchelfIgnoreMissingDeps" ]]; then
235245 echo "Add the missing dependencies to the build inputs or set autoPatchelfIgnoreMissingDeps=true"
236246 exit 1
···2929 "-Wno-error=format-truncation"
3030 "-Wno-error=pointer-compare"
3131 "-Wno-error=stringop-truncation"
3232+ # The following flag allows libreswan v3.32 to work with NSS 3.22, see
3333+ # https://github.com/libreswan/libreswan/issues/334.
3434+ # This flag should not be needed for libreswan v3.33 (which is not yet released).
3535+ "-DNSS_PKCS11_2_0_COMPAT=1"
3236 ];
33373438 nativeBuildInputs = [ makeWrapper pkgconfig ];
···8286 meta = with stdenv.lib; {
8387 homepage = "https://libreswan.org";
8488 description = "A free software implementation of the VPN protocol based on IPSec and the Internet Key Exchange";
8585- platforms = platforms.linux ++ platforms.darwin ++ platforms.freebsd;
8989+ platforms = platforms.linux ++ platforms.freebsd;
8690 license = licenses.gpl2;
8791 maintainers = [ maintainers.afranchuk ];
8892 };