From bf5919b4d3044cabc70481b00de4a042152d1ce2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 16 Jul 2026 10:21:21 -0700
Subject: [PATCH] python3Packages.paho-mqtt: use upstream patch for generating
 SSL certs

(cherry picked from commit 72f5048d567d34839d7d7cfa5baf451e58895af9)
---
 .../python-modules/paho-mqtt/default.nix       | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/paho-mqtt/default.nix b/pkgs/development/python-modules/paho-mqtt/default.nix
index b0ea0015bb42..1d71451e962b 100644
--- a/pkgs/development/python-modules/paho-mqtt/default.nix
+++ b/pkgs/development/python-modules/paho-mqtt/default.nix
@@ -3,9 +3,11 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   hatchling,
   openssl,
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -28,10 +30,13 @@ buildPythonPackage rec {
     hash = "sha256-VMq+WTW+njK34QUUTE6fR2j2OmHxVzR0wrC92zYb1rY=";
   };
 
-  postPatch = ''
-    substituteInPlace tests/ssl/gen.sh \
-      --replace-fail "c_rehash certs" "#c_rehash certs"
-  '';
+  patches = [
+    (fetchpatch {
+      name = "generate-ssl-certs-in-a-test-fixture.patch";
+      url = "https://github.com/eclipse-paho/paho.mqtt.python/pull/931.diff";
+      hash = "sha256-A7rWwpR4PnCi77F1VqsQKHBxHNrdeHgmVM6BGMeUpjs=";
+    })
+  ];
 
   build-system = [
     hatchling
@@ -40,6 +45,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     openssl
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   __darwinAllowLocalNetworking = true;
@@ -51,10 +57,6 @@ buildPythonPackage rec {
 
     # paho.mqtt not in top-level dir to get caught by this
     export PYTHONPATH=".:$PYTHONPATH"
-
-    pushd tests/ssl
-    HOME="$(mktemp -d)" ./gen.sh
-    popd
   '';
 
   disabledTests = [