stirling-pdf: 2.10.1 -> 2.14.2

Assisted-by: OpenCode, GPT-5.6 Sol

Co-authored-by: Toma <62384384+TomaSajt@users.noreply.github.com>

pkgs/by-name/st/stirling-pdf/fix-cargo-lock.patch

@@ -1,33 +0,0 @@
-diff --git a/frontend/src-tauri/Cargo.lock b/frontend/src-tauri/Cargo.lock
-index 87d5531..39b03ed 100644
---- a/frontend/src-tauri/Cargo.lock
-+++ b/frontend/src-tauri/Cargo.lock
-@@ -1966,7 +1966,7 @@ dependencies = [
-  "js-sys",
-  "log",
-  "wasm-bindgen",
-- "windows-core 0.61.2",
-+ "windows-core 0.62.2",
- ]
- 
- [[package]]
-@@ -6041,6 +6041,19 @@ dependencies = [
-  "windows-core 0.61.2",
- ]
- 
-+[[package]]
-+name = "windows-core"
-+version = "0.61.2"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
-+dependencies = [
-+ "windows-implement",
-+ "windows-interface",
-+ "windows-link 0.1.3",
-+ "windows-result 0.3.4",
-+ "windows-strings 0.4.2",
-+]
-+
- [[package]]
- name = "windows-core"
- version = "0.62.2"

pkgs/by-name/st/stirling-pdf/package.nix

@@ -12,8 +12,11 @@
   makeBinaryWrapper,
   nodejs,
   npmHooks,
+  pax-utils,
   pkg-config,
+  unzip,
   wrapGAppsHook3,
+  zip,
 
   glib-networking,
   jdk25,
@@ -25,7 +28,7 @@
   nixosTests,
 
   isDesktopVariant ? false,
-  withAdditionalFeatures ? true,
+  withAdditionalFeatures ? !isDesktopVariant,
   buildWithFrontend ? !isDesktopVariant,
 }:
 
@@ -35,36 +38,83 @@ assert isDesktopVariant -> !buildWithFrontend;
 let
   gradle = gradle_8;
   jre = jdk25;
+  # jpdfium 1.0.2's bundled x86_64 libicudata.so.74 has an erroneous executable
+  # PT_GNU_STACK; the arm64 archive was checked and already has a non-executable stack.
+  # Fixed upstream for the next natives release; remove when Stirling-PDF updates jpdfium.
+  # https://github.com/Stirling-Tools/Stirling-PDF/issues/6869
+  # https://github.com/Stirling-Tools/JPDFium/pull/19
+  patchJpdfium = lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) ''
+    nativeJars=(
+      "$GRADLE_USER_HOME"/caches/modules-2/files-2.1/com.stirling/jpdfium-natives-linux-x64/*/*/jpdfium-natives-linux-x64-*.jar
+    )
+    if (( ''${#nativeJars[@]} != 1 )); then
+      echo "expected exactly one jpdfium native JAR, found ''${#nativeJars[@]}" >&2
+      exit 1
+    fi
+    nativeJar="''${nativeJars[0]}"
+
+    patchDir="$(mktemp -d)"
+    unzip -q "$nativeJar" natives/linux-x64/libicudata.so.74 -d "$patchDir"
+    scanelf -X -e "$patchDir/natives/linux-x64/libicudata.so.74"
+    touch --date=@315532800 "$patchDir/natives/linux-x64/libicudata.so.74"
+
+    chmod u+w "$nativeJar"
+    (cd "$patchDir" && zip -q -X "$nativeJar" natives/linux-x64/libicudata.so.74)
+
+    bootJars=( ./app/core/build/libs/stirling-pdf-*.jar )
+    if (( ''${#bootJars[@]} != 1 )); then
+      echo "expected exactly one Stirling-PDF JAR, found ''${#bootJars[@]}" >&2
+      exit 1
+    fi
+    bootJar="$(realpath "''${bootJars[0]}")"
+    nestedJar="BOOT-INF/lib/$(basename "$nativeJar")"
+    mkdir -p "$patchDir/$(dirname "$nestedJar")"
+    cp "$nativeJar" "$patchDir/$nestedJar"
+    touch --date=@315532800 "$patchDir/$nestedJar"
+
+    chmod u+w "$bootJar"
+    (cd "$patchDir" && zip -q -X -0 "$bootJar" "$nestedJar")
+    rm -rf "$patchDir"
+  '';
 in
 stdenv.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
+
   pname = "stirling-pdf" + lib.optionalString isDesktopVariant "-desktop";
-  version = "2.10.1";
+  version = "2.14.2";
 
   src = fetchFromGitHub {
     owner = "Stirling-Tools";
     repo = "Stirling-PDF";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Qod8x8aB6qDxbRTE5rWUoqVka5kizfXJAWkKo5lhnFQ=";
+    hash = "sha256-2u4d9K4OEuOw9qE4YgpGXDvVLExVGUKAeXYNCySqy1c=";
   };
 
   patches = [
     # remove timestamp from the header of a generated .properties file
     ./remove-props-file-timestamp.patch
 
-    # upstream probably forgot to commit the lockfile after a bump
-    ./fix-cargo-lock.patch
+    # tests require network facilities intentionally unavailable in the Nix sandbox
+    ./skip-sandbox-incompatible-tests.patch
   ];
 
+  postPatch = lib.optionalString isDesktopVariant ''
+    # Nixpkgs does not produce artifacts for Stirling-PDF's upstream updater
+    # and does not have access to upstream's private signing key.
+    substituteInPlace frontend/editor/src-tauri/tauri.conf.json \
+      --replace-fail '"createUpdaterArtifacts": true' '"createUpdaterArtifacts": false'
+  '';
+
   npmRoot = "frontend";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
     postPatch = "cd ${finalAttrs.npmRoot}";
-    hash = "sha256-y+mviHatwhdIGCOKir1nnG/0Zm8oSoLKW345tU9upls=";
+    hash = "sha256-ujvSzang7n6DJZbNU/lDlG0x1265N5LJ6prkPbBYEic=";
   };
 
-  cargoRoot = "frontend/src-tauri";
+  cargoRoot = "frontend/editor/src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -75,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       cargoRoot
       ;
-    hash = "sha256-Tx6twcyFupNOzuXbW8uUulMJFObyPg/i2U0QnvyhIRQ=";
+    hash = "sha256-YhDFSmx6XK7x5wzQaPslyuaRbiX8W/X8y/Z0fxjbGwk=";
   };
 
   mitmCache = gradle.fetchDeps {
@@ -102,6 +152,9 @@ stdenv.mkDerivation (finalAttrs: {
     gradle
     jre # one of the tests also require that the `java` command is available on the command line
     makeBinaryWrapper
+    pax-utils
+    unzip
+    zip
   ]
   ++ lib.optionals (buildWithFrontend || isDesktopVariant) [
     nodejs
@@ -132,15 +185,18 @@ stdenv.mkDerivation (finalAttrs: {
 
     # this simulates what the desktop:jlink:jar would do
     gradle bootJar
-    install -Dm644 ./app/core/build/libs/stirling-pdf-*.jar -t ./frontend/src-tauri/libs
+    ${patchJpdfium}
+    install -Dm644 ./app/core/build/libs/stirling-pdf-*.jar -t ./frontend/editor/src-tauri/libs
 
     # creates as minimal jre via jlink
     task desktop:jlink:runtime
 
-    substituteInPlace frontend/src-tauri/stirling-pdf.desktop \
+    substituteInPlace frontend/editor/src-tauri/stirling-pdf.desktop \
       --replace-fail 'MimeType=application/pdf;' 'MimeType=application/pdf;x-scheme-handler/stirlingpdf;'
   '';
 
+  postBuild = lib.optionalString (!isDesktopVariant) patchJpdfium;
+
   # we use the installPhase from cargo-tauri-hook when we're building the desktop variant
   installPhase = lib.optionalString (!isDesktopVariant) ''
     runHook preInstall
@@ -177,6 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [
       fromSource
       binaryBytecode # java deps
+      binaryNativeCode # bundled jpdfium inside jar
     ];
   };
 })

pkgs/by-name/st/stirling-pdf/skip-sandbox-incompatible-tests.patch

@@ -0,0 +1,26 @@
+diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/misc/ConfigControllerTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/misc/ConfigControllerTest.java
+index 2ed6bb29f..8c48c1da2 100644
+--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/misc/ConfigControllerTest.java
++++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/misc/ConfigControllerTest.java
+@@ -230,4 +230,5 @@ class ConfigControllerTest {
+     @Test
++    @org.junit.jupiter.api.Disabled("requires a non-loopback network interface")
+     void resolveFrontendUrl_fallsThroughOnLoopbackHost() {
+         System sys = mock(System.class);
+         when(applicationProperties.getSystem()).thenReturn(sys);
+@@ -251,4 +252,5 @@ class ConfigControllerTest {
+     @Test
++    @org.junit.jupiter.api.Disabled("requires a non-loopback network interface")
+     void resolveFrontendUrl_usesActualPortWhenServerPortIsEphemeral() {
+         System sys = mock(System.class);
+         when(applicationProperties.getSystem()).thenReturn(sys);
+diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/cluster/s3/S3ClientsTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/cluster/s3/S3ClientsTest.java
+index 8f57e15bc..143155191 100644
+--- a/app/proprietary/src/test/java/stirling/software/proprietary/cluster/s3/S3ClientsTest.java
++++ b/app/proprietary/src/test/java/stirling/software/proprietary/cluster/s3/S3ClientsTest.java
+@@ -16,4 +16,5 @@ class S3ClientsTest {
+     @Test
++    @org.junit.jupiter.api.Disabled("requires DNS access")
+     void validateEndpointHost_publicAwsHost_passes() {
+         assertThatCode(
+                         () ->