From 41a37cc08306ebf7b9036d364f9e4266ec3600b3 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 4 Jun 2026 22:08:37 +0200
Subject: [PATCH] apparmor-parser: pick upstream patch for yacc format-security
 issues

---
 pkgs/by-name/ap/apparmor-parser/package.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 0191929c5efe..de39713f0c10 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -7,6 +7,7 @@
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
   zstd,
+  fetchpatch,
 
   # apparmor deps
   libapparmor,
@@ -34,15 +35,17 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-
-    # strict format check causes yacc auto-generated code to fail.
-    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
-    # removing the compile-time check here downgrades the issue and allows compilation to succeed
-    substituteInPlace parser.h \
-      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
-        'extern void yyerror(const char *msg, ...);'
   '';
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
+      # Patches generated yacc parser code to compile with format-security
+      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
+      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     flex