zerotierone: fix on macOS

pkgs/flake-module.nix

@@ -32,7 +32,11 @@
         pending-reviews = pkgs.callPackage ./pending-reviews { };
         editor = pkgs.callPackage ./editor/clan-edit-codium.nix { };
         classgen = pkgs.callPackage ./classgen { };
-        zerotierone = pkgs.callPackage ./zerotierone { };
+        # When Nixpkgs gets bumped to include the newer version of ZeroTier
+        # we can remove our vendored version
+        zerotierone =
+          assert builtins.compareVersions pkgs.zerotierone.version "1.14.2" == -1;
+          pkgs.callPackage ./zerotierone { };
         webview-lib = pkgs.callPackage ./webview-lib { };
       };
     };

pkgs/zerotierone/0001-darwin-disable-link-time-optimization.patch

@@ -0,0 +1,32 @@
+From f71d88a15f537cbc5ea80ad2922c013553a5caab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Fri, 21 Jun 2024 14:43:03 +0200
+Subject: [PATCH 2/2] darwin: disable link-time optimization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's not yet clear to me, but in our build we somehow mix objects with
+and without flto.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ make-mac.mk | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/make-mac.mk b/make-mac.mk
+index 7af200ad..b388c05a 100644
+--- a/make-mac.mk
++++ b/make-mac.mk
+@@ -84,7 +84,7 @@ ifeq ($(ZT_DEBUG),1)
+ node/Salsa20.o node/SHA512.o node/C25519.o node/Poly1305.o: CFLAGS = -Wall -O2 -g $(INCLUDES) $(DEFS)
+ else
+ 	CFLAGS?=-Ofast -fstack-protector-strong
+-	CFLAGS+=$(ARCH_FLAGS) -Wall -flto -fPIE -mmacosx-version-min=$(MACOS_VERSION_MIN) -DNDEBUG -Wno-unused-private-field $(INCLUDES) $(DEFS)
++	CFLAGS+=$(ARCH_FLAGS) -Wall -fPIE -mmacosx-version-min=$(MACOS_VERSION_MIN) -DNDEBUG -Wno-unused-private-field $(INCLUDES) $(DEFS)
+ 	STRIP=strip
+ 	EXTRA_CARGO_FLAGS=--release
+ 	RUST_VARIANT=release
+-- 
+2.44.1
+

pkgs/zerotierone/0001-rustfsm-remove-unsupported-lints.workspace.patch

@@ -0,0 +1,24 @@
+From b83e6354de099860bcb1ca3876c222c57de89f0c Mon Sep 17 00:00:00 2001
+From: Michael Hoang <enzime@users.noreply.github.com>
+Date: Mon, 10 Feb 2025 18:03:12 +0700
+Subject: [PATCH] rustfsm: remove unsupported `lints.workspace`
+
+This patch will no longer be necessary when
+https://github.com/NixOS/nixpkgs/pull/300532 is merged
+---
+ fsm/Cargo.toml | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fsm/Cargo.toml b/fsm/Cargo.toml
+index 5e9e1c9..3fda704 100644
+--- a/fsm/Cargo.toml
++++ b/fsm/Cargo.toml
+@@ -17,5 +17,3 @@ rustfsm_trait = { version = "0.1", path = "rustfsm_trait" }
+ [package.metadata.workspaces]
+ independent = true
+ 
+-[lints]
+-workspace = true
+-- 
+2.46.0
+

pkgs/zerotierone/default.nix

@@ -1,6 +1,171 @@
-{ zerotierone, lib }:
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  buildPackages,
+  cargo,
+  lzo,
+  openssl,
+  pkg-config,
+  ronn,
+  rustc,
+  zlib,
+  libiconv,
+  darwin,
+  fetchpatch,
+}:
+
+let
+  pname = "zerotierone";
+  version = "1.14.2";
+
+  src = fetchFromGitHub {
+    owner = "zerotier";
+    repo = "ZeroTierOne";
+    # https://github.com/zerotier/ZeroTierOne/archive/1.14.2.tar.gz returns
+    # the given path has multiple possibilities: #<Git::Ref:0x00007f07d119ed00>, #<Git::Ref:0x00007f07d1194800>
+    rev = "tags/${version}";
+    hash = "sha256-D+7/ja5uYzH1iNd+Ti3k+dWOf5GvN4U+GuVBA9gxtTc=";
+  };
+
+in
+
+(stdenv.mkDerivation {
+  inherit pname version src;
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    sourceRoot = "source/rustybits";
+    hash = "sha256-CSpm4zBWKhcrM/KXGU6/51NSQ6hzpT44D2J+QETBtpQ=";
+
+    # REMOVEME when https://github.com/NixOS/nixpkgs/pull/300532 is merged
+    postBuild = ''
+      pushd $out/git/730aadcc02767ae630e88f8f8c788a85d6bc81e6
+      patch --verbose -p1 <${./0001-rustfsm-remove-unsupported-lints.workspace.patch}
+      popd
+    '';
+  };
+
+  patches = [
+    ./0001-darwin-disable-link-time-optimization.patch
+    # https://github.com/zerotier/ZeroTierOne/pull/2435
+    (fetchpatch {
+      url = "https://github.com/zerotier/ZeroTierOne/commit/bfccc1a729479f6a8f867737db7d75cacee19766.patch";
+      hash = "sha256-91jyqyvQZ7ETMRbYGZV0UgdRRv/7d9GjOFwFkrssTgs=";
+    })
+  ];
+
+  postPatch = ''
+    cp rustybits/Cargo.lock Cargo.lock
+  '';
+
+  preConfigure = ''
+    patchShebangs ./doc/build.sh
+    substituteInPlace ./doc/build.sh \
+      --replace '/usr/bin/ronn' '${buildPackages.ronn}/bin/ronn' \
+
+    substituteInPlace ./make-linux.mk \
+      --replace '-march=armv6zk' "" \
+      --replace '-mcpu=arm1176jzf-s' ""
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    ronn
+    rustPlatform.cargoSetupHook
+    cargo
+    rustc
+  ];
+
+  buildInputs =
+    [
+      lzo
+      openssl
+      zlib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libiconv
+      darwin.apple_sdk.frameworks.SystemConfiguration
+      darwin.apple_sdk.frameworks.CoreServices
+    ];
+
+  enableParallelBuilding = true;
+
+  # Ensure Rust compiles for the right target
+  env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTarget;
+
+  preBuild =
+    if stdenv.hostPlatform.isDarwin then
+      ''
+        # building multiple architectures at the same time from nixpkgs is not supported
+        makeFlagsArray+=("ARCH=${stdenv.hostPlatform.darwinArch}")
+        if ! grep -q MACOS_VERSION_MIN=10.13 make-mac.mk; then
+          echo "You may need to update MACOSX_DEPLOYMENT_TARGET to match the value in make-mac.mk"
+          exit 1
+        fi
+      ''
+    else
+      ''
+        # Cargo won't compile to target/release but to target/<RUST_TARGET>/release when a target is
+        # explicitly defined. The build-system however expects target/release. Hence we just symlink from
+        # the latter to the former.
+        mkdir -p rustybits/target/release
+        ln -rs \
+          ./rustybits/target/${stdenv.hostPlatform.rust.rustcTarget}/release/libzeroidc.a \
+          ./rustybits/target/release/
+      '';
+
+  buildFlags = [
+    "all"
+    "selftest"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  checkPhase = ''
+    runHook preCheck
+    ./zerotier-selftest
+    runHook postCheck
+  '';
+
+  installFlags = [
+    # only linux has an install target, we borrow this for macOS as well
+    "-f"
+    "make-linux.mk"
+    "DESTDIR=$$out/upstream"
+  ];
+
+  postInstall = ''
+    mv $out/upstream/usr/sbin $out/bin
+
+    mkdir -p $man/share
+    mv $out/upstream/usr/share/man $man/share/man
+
+    rm -rf $out/upstream
+  '';
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  meta = with lib; {
+    description = "Create flat virtual Ethernet networks of almost unlimited size";
+    homepage = "https://www.zerotier.com";
+    license = licenses.bsl11;
+    maintainers = with maintainers; [
+      sjmackenzie
+      zimbatm
+      ehmry
+      obadz
+      danielfullmer
+      mic92 # also can test darwin
+    ];
+    platforms = platforms.unix;
+  };
+}).overrideAttrs
+  (_old: {
     # halalify zerotierone
-zerotierone.overrideAttrs (_old: {
     meta = _old.meta // {
       license = lib.licenses.apsl20;
     };