From a4a1a0c1348c410c39542b7bd6b7e73793f42e80 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sun, 22 Jun 2025 19:24:08 +0200
Subject: [PATCH 1/2] gn_2233: init

Init as new variant of gn because the current version is too old for
signal-desktop's webrtc fork and we don't want to update gn on stable.

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/gn/gn/2233.nix     | 10 ++++++++++
 pkgs/by-name/gn/gn/generic.nix  |  5 ++++-
 pkgs/top-level/all-packages.nix |  2 ++
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/gn/gn/2233.nix

diff --git a/pkgs/by-name/gn/gn/2233.nix b/pkgs/by-name/gn/gn/2233.nix
new file mode 100644
index 0000000000000..330446152fb8e
--- /dev/null
+++ b/pkgs/by-name/gn/gn/2233.nix
@@ -0,0 +1,10 @@
+{ callPackage, ... }@args:
+
+# Do not update this pinned version!
+# Update ./package.nix instead or init an entirely new version based on this.
+callPackage ./generic.nix args {
+  rev = "85cc21e94af590a267c1c7a47020d9b420f8a033";
+  revNum = "2233";
+  version = "2025-04-28";
+  sha256 = "sha256-+nKP2hBUKIqdNfDz1vGggXSdCuttOt0GwyGUQ3Z1ZHI=";
+}
diff --git a/pkgs/by-name/gn/gn/generic.nix b/pkgs/by-name/gn/gn/generic.nix
index ca28240fa7053..2e89dbe95ed8e 100644
--- a/pkgs/by-name/gn/gn/generic.nix
+++ b/pkgs/by-name/gn/gn/generic.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation {
     inherit rev sha256;
   };
 
-  patches = [
+  patches = lib.optionals (lib.versionOlder revNum "2233") [
     (fetchpatch {
       name = "LFS64.patch";
       url = "https://gn.googlesource.com/gn/+/b5ff50936a726ff3c8d4dfe2a0ae120e6ce1350d%5E%21/?format=TEXT";
@@ -58,6 +58,9 @@ stdenv.mkDerivation {
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
+  # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
+  # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
+  ${if (lib.versionAtLeast revNum "2233") then "hardeningDisable" else null} = [ "format" ];
 
   buildPhase = ''
     python build/gen.py --no-last-commit-position
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0439f3ba3a75c..50cf1a6379a6e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7398,6 +7398,8 @@ with pkgs;
 
   m4 = gnum4;
 
+  gn_2233 = callPackage ../by-name/gn/gn/2233.nix { };
+
   gnumake = callPackage ../development/tools/build-managers/gnumake { };
   gradle-packages = import ../development/tools/build-managers/gradle {
     inherit

From 899cd214d943ee7fc18a0f4278da06307964bb81 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sun, 22 Jun 2025 19:24:08 +0200
Subject: [PATCH 2/2] signal-desktop.webrtc: use gn_2233 to unbreak

Default gn on stable is too old.

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/si/signal-desktop/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index d1f4b750ec257..1dd3a017068ca 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -4,6 +4,7 @@
   nodejs_22,
   pnpm_10,
   electron_36,
+  gn_2233,
   python3,
   makeWrapper,
   callPackage,
@@ -20,11 +21,12 @@ let
   nodejs = nodejs_22;
   pnpm = pnpm_10.override { inherit nodejs; };
   electron = electron_36;
+  gn = gn_2233;
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
   signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
 
-  webrtc = callPackage ./webrtc.nix { };
+  webrtc = callPackage ./webrtc.nix { inherit gn; };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
 
   # Noto Color Emoji PNG files for emoji replacement; see below.