From e0ee4840b497da7bba4368786d536f76f6e060f3 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 11 Jul 2026 15:18:41 -0400
Subject: [PATCH 1/2] perlPackages.CryptOpenSSLRSA: 0.35 -> 0.41

Changelog: https://metacpan.org/dist/Crypt-OpenSSL-RSA/changes

Among other things, it restores PKCS#1 v1.5 padding for sign()/verify()
in 0.38 which broke proxmox api if deployed on NixOS [1].

[1] https://github.com/SaumonNet/proxmox-nixos/issues/217

(cherry picked from commit a112a05000a624b42bd31c55c827508acc50b24f)
---
 pkgs/top-level/perl-packages.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f0a2e666ff9d..bc6629e56ce9 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7702,17 +7702,21 @@ with self;
 
   CryptOpenSSLRSA = buildPerlPackage {
     pname = "Crypt-OpenSSL-RSA";
-    version = "0.35";
+    version = "0.41";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-0.35.tar.gz";
-      hash = "sha256-XuvVWsBxY0yGSo549c+vuq9Dz4TAQyOgm3Hddr8CXMI=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-OpenSSL-RSA-0.41.tar.gz";
+      hash = "sha256-gvqDmJe4jpwkW2Jl874m07yHnK5MeoFR+tSjB8M2aCI=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRandom ];
+    propagatedBuildInputs = [
+      CryptOpenSSLBignum
+      CryptOpenSSLRandom
+    ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     env.OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
+      homepage = "https://github.com/cpan-authors/Crypt-OpenSSL-RSA";
       description = "RSA encoding and decoding, using the openSSL libraries";
       license = with lib.licenses; [
         artistic1

From 41c647ad3b23f1e3820e06a3fe4b0ced3ef82c90 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Mon, 20 Jul 2026 22:56:31 -0400
Subject: [PATCH 2/2] perlPackages.MojoSAML: select padding to accommodate new
 CryptOpenSSLRSA

(cherry picked from commit f2e1035aa566b07cc831cf25352df918b2b894e3)
---
 .../MojoSAML-select-PKCS-1-padding.patch      | 44 +++++++++++++++++++
 pkgs/top-level/perl-packages.nix              |  3 ++
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch

diff --git a/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch b/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
new file mode 100644
index 000000000000..b894586077ee
--- /dev/null
+++ b/pkgs/development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
@@ -0,0 +1,44 @@
+From 7dcb837f5f953206eead3d28144c3d0e2af85c2c Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Mon, 20 Jul 2026 22:48:38 -0400
+Subject: [PATCH] Select PKCS#1 padding for XML signatures
+
+The rsa-sha* XML Signature algorithms require RSASSA-PKCS1-v1_5.
+Select that padding explicitly instead of relying on the RSA module's
+signing default, which is PSS in recent releases.
+
+Require Crypt::OpenSSL::RSA 0.38, the first release whose signing path
+honors the explicit padding choice.
+
+Assisted-by: Codex
+---
+ cpanfile           | 2 +-
+ lib/Mojo/XMLSig.pm | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/cpanfile b/cpanfile
+index 6c56caf..149f4a6 100644
+--- a/cpanfile
++++ b/cpanfile
+@@ -1,5 +1,5 @@
+ requires 'Mojolicious', '7.78'; # tag_to_html
+-requires 'Crypt::OpenSSL::RSA';
++requires 'Crypt::OpenSSL::RSA', '0.38';
+ requires 'Crypt::OpenSSL::X509';
+ requires 'Data::GUID';
+ requires 'Digest::SHA';
+diff --git a/lib/Mojo/XMLSig.pm b/lib/Mojo/XMLSig.pm
+index 3ee9db3..2498bbe 100644
+--- a/lib/Mojo/XMLSig.pm
++++ b/lib/Mojo/XMLSig.pm
+@@ -91,6 +91,7 @@ my $set_algo = sub {
+     unless $key->$isa('Crypt::OpenSSL::RSA');
+   Carp::croak 'Unsupported RSA algorithm'
+     unless my $method = $key->can("use_${algo}_hash");
++  $key->use_pkcs1_padding;
+   $key->$method;
+   return $key;
+ };
+-- 
+2.54.0
+
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index bc6629e56ce9..7b8da85adab3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22945,6 +22945,9 @@ with self;
       url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-SAML-0.07.tar.gz";
       hash = "sha256-csJMrNtvHXp14uqgBDfHFKv1eafSENSqTT8g8e/0cQ0=";
     };
+    patches = [
+      ../development/perl-modules/MojoSAML-select-PKCS-1-padding.patch
+    ];
     buildInputs = [ ModuleBuildTiny ];
     propagatedBuildInputs = [
       CryptOpenSSLRSA