From 9191b948b02d09bdda437c9cee636445ee4f8472 Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Wed, 21 Oct 2026 23:44:02 +0900
Subject: [PATCH 1/2] dprint: remove obsolete test skips

---
 pkgs/by-name/dp/dprint/package.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index bc9fc8918574..6f0c0e5ecd2d 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -59,13 +59,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   checkFlags = [
-    # Require creating directory and network access
-    "--skip=plugins::cache_fs_locks::test"
-    "--skip=utils::lax_single_process_fs_flag::test"
     # Require cargo is running
     "--skip=utils::process::test"
-    # Requires deno for the testing, and making unstable results on darwin
-    "--skip=utils::url::test::unsafe_ignore_cert"
   ];
 
   postInstall =

From 3d587ef620d38732dd16715e539dea903b0bed16 Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Thu, 22 Oct 2026 00:21:46 +0900
Subject: [PATCH 2/2] dprint: use system CA by default

---
 pkgs/by-name/dp/dprint/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index 6f0c0e5ecd2d..ae1dcdda3a4b 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   rustPlatform,
   buildPackages,
+  makeBinaryWrapper,
   installShellFiles,
   pkg-config,
   zstd,
@@ -30,6 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-Dha+M4WbGPx3WXSD9LLIjgL6HAxRFklafSgb9m7Fbow=";
 
   nativeBuildInputs = [
+    makeBinaryWrapper
     installShellFiles
     pkg-config
   ];
@@ -71,8 +73,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
         else
           lib.getExe buildPackages.dprint;
     in
+    # dprint only supports a runtime switch (DPRINT_TLS_CA_STORE) to prefer system certs.
+    # Avoid the upstream default `mozilla,system` to reduce risks like https://github.com/NixOS/nixpkgs/issues/576485
     ''
       rm "$out/bin/test-process-plugin"
+      wrapProgram "$out/bin/dprint" \
+        --set-default DPRINT_TLS_CA_STORE system
       export DPRINT_CACHE_DIR="$(mktemp -d)"
       installShellCompletion --cmd dprint \
         --bash <(${dprint} completions bash) \