signal-desktop-source: build signal-sqlcipher from source (NixOS#397816)

Author: flokli

pkgs/by-name/si/signal-desktop-source/package.nix

@@ -18,7 +18,7 @@
 }:
 let
   nodejs = nodejs_22;
-  pnpm = pnpm_10;
+  pnpm = pnpm_10.override { inherit nodejs; };
   electron = electron_35;
 
   nodeOS =
@@ -39,6 +39,7 @@ let
       or (throw "unsupported platform ${stdenv.hostPlatform.parsed.cpu.name}");
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
+  signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
 
   webrtc = callPackage ./webrtc.nix { };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
@@ -85,7 +86,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      (pnpm.override { inherit nodejs; }).configHook
+      pnpm.configHook
     ];
 
     buildPhase = ''
@@ -107,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    (pnpm.override { inherit nodejs; }).configHook
+    pnpm.configHook
     makeWrapper
     copyDesktopItems
     python3
@@ -157,6 +158,11 @@ stdenv.mkDerivation (finalAttrs: {
       die "libsignal-client version mismatch"
     fi
 
+    if [ "`jq -r '.dependencies."@signalapp/sqlcipher"' < package.json`" != "${signal-sqlcipher.version}" ]
+    then
+      die "signal-sqlcipher version mismatch"
+    fi
+
     if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc.version}" ]
     then
       die "ringrtc version mismatch"
@@ -168,6 +174,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     rm -fr node_modules/@signalapp/libsignal-client/prebuilds
     cp -r ${libsignal-node}/lib node_modules/@signalapp/libsignal-client/prebuilds
+
+    rm -fr node_modules/@signalapp/sqlcipher
+    cp -r ${signal-sqlcipher} node_modules/@signalapp/sqlcipher
   '';
 
   buildPhase = ''
@@ -235,6 +244,7 @@ stdenv.mkDerivation (finalAttrs: {
       ringrtc
       webrtc
       sticker-creator
+      signal-sqlcipher
       ;
     tests.application-launch = nixosTests.signal-desktop;
     updateScript.command = [ ./update.sh ];
@@ -265,12 +275,5 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
     ];
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-
-      # @signalapp/sqlcipher
-      # ringrtc
-      binaryNativeCode
-    ];
   };
 })

pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix

@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  rustPlatform,
+  cargo,
+  dump_syms,
+  python3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "node-sqlcipher";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "signalapp";
+    repo = "node-sqlcipher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fuChNio2iWYuxIj40jW1lJCZItnQKrzX7m1gJeeajvs=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
+  };
+
+  cargoRoot = "deps/extension";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    name = "sqlcipher-signal-exentsion";
+    inherit (finalAttrs) src cargoRoot;
+    hash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    rustPlatform.cargoSetupHook
+    cargo
+    dump_syms
+    python3
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export npm_config_nodedir=${nodejs}
+    pnpm run prebuildify
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    cp -r prebuilds $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fast N-API-based Node.js addon wrapping sqlcipher and FTS5 segmenting APIs";
+    homepage = "https://github.com/signalapp/node-sqlcipher/tree/main";
+    license = with lib.licenses; [
+      agpl3Only
+
+      # deps/sqlcipher
+      bsd3
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/si/signal-desktop-source/sqlite3.gyp

@@ -22,6 +22,7 @@ latestVersion="`jq -r '.version' <<< $packageJson`"
 nodeVersion="`jq -r '.engines.node' <<< $packageJson | cut -d. -f1`"
 electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | cut -d. -f1`"
 libsignalClientVersion=`jq -r '.dependencies."@signalapp/libsignal-client"' <<< $packageJson`
+signalSqlcipherVersion=`jq -r '.dependencies."@signalapp/sqlcipher"' <<< $packageJson`
 ringrtcVersion=`jq -r '.dependencies."@signalapp/ringrtc"' <<< $packageJson`
 ringrtcVersionProperties="`curl_github "https://raw.githubusercontent.com/signalapp/ringrtc/refs/tags/v$ringrtcVersion/config/version.properties"`"
 webrtcVersion="`grep --only-matching "^webrtc.version=.*$" <<< $ringrtcVersionProperties | sed "s/webrtc.version=//g"`"
@@ -46,6 +47,15 @@ update-source-version signal-desktop-source.libsignal-node \
   --ignore-same-version \
   --source-key=npmDeps
 
+update-source-version signal-desktop-source.signal-sqlcipher \
+  "$signalSqlcipherVersion"
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=cargoDeps.vendorStaging
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=pnpmDeps
+
 update-source-version signal-desktop-source.ringrtc "$ringrtcVersion"
 update-source-version signal-desktop-source.ringrtc \
   --ignore-same-version \