From c65d8817de170b4a977e411417e4dd3ecd7c95bd Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Wed, 3 Jun 2026 18:07:29 -0400
Subject: [PATCH] gp{auth,client}: 2.5.1 -> 2.5.4

gpclient now carries a custom vpnc-script so we have to include it and
patch for nixpkgs like we do for the upstream vpnc-script.

This change also fixes a broken gpauth path on darwin, allowing to use
the client on this platform too.

https://github.com/yuezk/GlobalProtect-openconnect/releases/tag/v2.5.2
https://github.com/yuezk/GlobalProtect-openconnect/releases/tag/v2.5.3
https://github.com/yuezk/GlobalProtect-openconnect/releases/tag/v2.5.4

Assisted-by: Codex, gpt-5.5 xhigh
---
 pkgs/by-name/gp/gpauth/package.nix   |  6 ++--
 pkgs/by-name/gp/gpclient/package.nix | 54 ++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index 0ebd8cb93433..08906b1fe59b 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -12,19 +12,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gpauth";
-  version = "2.5.1";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rux2rToqs5GZEDTryPAkm62yGdhWfEqapTMQOGyqCRI=";
+    hash = "sha256-RDfxhf0t70Ex6MfgHAX2AaWcPAwTCvjm1bQkek+92zc=";
     fetchSubmodules = true;
   };
 
   buildAndTestSubdir = "apps/gpauth";
 
-  cargoHash = "sha256-xza7AfuOcSUkDyliGHUx9bEd+M94d23xVrVVvZo2nas=";
+  cargoHash = "sha256-SY0PS5GxvVO1jaCNyLa3/l/v8/JT2R+4lM3W9kA7fVM=";
 
   nativeBuildInputs = [
     perl
diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index c29407821041..1aa7b97cda5a 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -6,21 +6,31 @@
   autoconf,
   automake,
   cairo,
+  coreutils,
+  gawk,
   glib,
   glib-networking,
+  gmp,
   gnutls,
+  gnugrep,
   gpauth,
   gtk3,
+  iproute2,
   libtool,
   libxml2,
   lz4,
   makeBinaryWrapper,
+  net-tools,
+  nettle,
+  openresolv,
   openssl,
   p11-kit,
   pango,
   perl,
   pkg-config,
-  vpnc-scripts,
+  systemd,
+  zlib,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
 }:
 
 rustPlatform.buildRustPackage {
@@ -51,14 +61,17 @@ rustPlatform.buildRustPackage {
   buildInputs = [
     glib
     glib-networking
+    gmp
+    gnutls
     gpauth
-    openssl
 
     # used for vendored openconnect
-    gnutls
     libxml2
     lz4
+    nettle
+    openssl
     p11-kit
+    zlib
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     atk
@@ -69,14 +82,17 @@ rustPlatform.buildRustPackage {
 
   postPatch = ''
     substituteInPlace crates/openconnect/src/vpn_utils.rs \
-      --replace-fail /etc/vpnc/vpnc-script ${vpnc-scripts}/bin/vpnc-script \
+      --replace-fail /usr/libexec/gpclient/vpnc-script $out/libexec/gpclient/vpnc-script \
       --replace-fail /usr/libexec/gpclient/hipreport.sh $out/libexec/gpclient/hipreport.sh
 
     substituteInPlace crates/common/src/constants.rs \
+      --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth \
+      --replace-fail /opt/homebrew/bin/gpauth ${gpauth}/bin/gpauth \
+      --replace-fail /usr/local/bin/gpauth ${gpauth}/bin/gpauth \
       --replace-fail /usr/bin/gpclient $out/bin/gpclient \
       --replace-fail /usr/bin/gpservice $out/bin/gpservice \
-      --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth \
-      --replace-fail /opt/homebrew/ $out/
+      --replace-fail /opt/homebrew/ $out/ \
+      --replace-fail /usr/local/ $out/
   '';
 
   postInstall = ''
@@ -85,6 +101,32 @@ rustPlatform.buildRustPackage {
     substituteInPlace $out/libexec/gpclient/hipreport.sh \
       --replace-fail /usr/bin/gpclient $out/bin/gpclient
   ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace $out/libexec/gpclient/vpnc-script \
+      --replace-fail /sbin/resolvconf ${openresolv}/bin/resolvconf
+  ''
+  + lib.optionalString withSystemd ''
+    substituteInPlace $out/libexec/gpclient/vpnc-script \
+      --replace-fail /usr/bin/resolvectl ${systemd}/bin/resolvectl \
+      --replace-fail /usr/bin/busctl ${systemd}/bin/busctl
+  ''
+  + ''
+    wrapProgram "$out/libexec/gpclient/vpnc-script" \
+      --prefix PATH : "${
+        lib.makeBinPath (
+          [
+            coreutils
+            gawk
+            gnugrep
+            net-tools
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isLinux [
+            iproute2
+            openresolv
+          ]
+        )
+      }"
+  ''
   + lib.optionalString stdenv.hostPlatform.isLinux ''
     cp -r packaging/files/usr/lib $out/lib
     substituteInPlace $out/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down \