From 01bede8826fb0b35a0e432d788ce0a8fad2453f1 Mon Sep 17 00:00:00 2001
From: m3tam3re <p@m3ta.dev>
Date: Fri, 10 Jul 2026 13:22:27 +0200
Subject: [PATCH] fix: add n8n xlsx lockfile integrity workaround

---
 overlays/mods/n8n.nix      | 78 ++++++++++++++++++++++----------------
 tests/n8n-overlay-test.nix | 19 ++++++----
 2 files changed, 56 insertions(+), 41 deletions(-)

diff --git a/overlays/mods/n8n.nix b/overlays/mods/n8n.nix
index 3959587..19ec1b9 100644
--- a/overlays/mods/n8n.nix
+++ b/overlays/mods/n8n.nix
@@ -1,35 +1,47 @@
-{prev}:
-prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
-  version = "2.29.8";
+{prev}: let
+  xlsxTarball = "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz";
+  xlsxIntegrity = "sha512-+nKZ39+nvK7Qq6i0PvWWRA4j/EkfWOtkP/YhMtupm+lJIiHxUrgTr1CcKv1nBk1rHtkRRQ3O2+Ih/q/sA+FXZA==";
+  patchXlsxLockfile = ''
+    substituteInPlace pnpm-lock.yaml \
+      --replace-fail \
+        "resolution: {tarball: ${xlsxTarball}}" \
+        "resolution: {integrity: ${xlsxIntegrity}, tarball: ${xlsxTarball}}"
+  '';
+in
+  prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
+    version = "2.29.8";
 
-  src = prev.fetchFromGitHub {
-    owner = "n8n-io";
-    repo = "n8n";
-    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-+eiAdofrX1TRNFeD9MtTHt+XBH06c8NQHvTk6vrOU/k=";
-  };
-
-  pnpmDeps = prev.fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    pnpm = prev.pnpm_10;
-    fetcherVersion = 3;
-    hash = "sha256-j0IrYjVl83SzRo29rhEDCQLrt8kslWHdS7m4pG11DgA=";
-  };
-
-  preBuild =
-    (previousAttrs.preBuild or "")
-    + ''
-      if [ ! -e node_modules/sass-embedded ] && [ -e node_modules/.pnpm/node_modules/sass-embedded ]; then
-        ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded
-      fi
-      if [ ! -e node_modules/sqlite3 ] && [ -e node_modules/.pnpm/node_modules/sqlite3 ]; then
-        ln -s .pnpm/node_modules/sqlite3 node_modules/sqlite3
-      fi
-    '';
-
-  meta =
-    previousAttrs.meta
-    // {
-      changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
+    src = prev.fetchFromGitHub {
+      owner = "n8n-io";
+      repo = "n8n";
+      tag = "n8n@${finalAttrs.version}";
+      hash = "sha256-+eiAdofrX1TRNFeD9MtTHt+XBH06c8NQHvTk6vrOU/k=";
     };
-})
+
+    pnpmDeps = prev.fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = prev.pnpm_10;
+      fetcherVersion = 3;
+      prePnpmInstall = patchXlsxLockfile;
+      hash = "sha256-XMPvxTb7cKz3XmJFOAqN42B2VGyzyFPrF0eUU8g/KPU=";
+    };
+
+    prePnpmInstall = (previousAttrs.prePnpmInstall or "") + patchXlsxLockfile;
+
+    preBuild =
+      (previousAttrs.preBuild or "")
+      + ''
+        if [ ! -e node_modules/sass-embedded ] && [ -e node_modules/.pnpm/node_modules/sass-embedded ]; then
+          ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded
+        fi
+        if [ ! -e node_modules/sqlite3 ] && [ -e node_modules/.pnpm/node_modules/sqlite3 ]; then
+          ln -s .pnpm/node_modules/sqlite3 node_modules/sqlite3
+        fi
+      '';
+
+    meta =
+      previousAttrs.meta
+      // {
+        changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
+      };
+  })
diff --git a/tests/n8n-overlay-test.nix b/tests/n8n-overlay-test.nix
index ad49839..8ecb990 100644
--- a/tests/n8n-overlay-test.nix
+++ b/tests/n8n-overlay-test.nix
@@ -17,9 +17,10 @@
 
   expectedVersion = "2.29.8";
   expectedSrcHash = "sha256-+eiAdofrX1TRNFeD9MtTHt+XBH06c8NQHvTk6vrOU/k=";
-  expectedPnpmHash = "sha256-j0IrYjVl83SzRo29rhEDCQLrt8kslWHdS7m4pG11DgA=";
+  expectedPnpmHash = "sha256-XMPvxTb7cKz3XmJFOAqN42B2VGyzyFPrF0eUU8g/KPU=";
   expectedChangelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${expectedVersion}";
   expectedXlsxTarball = "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz";
+  expectedXlsxIntegrity = "sha512-+nKZ39+nvK7Qq6i0PvWWRA4j/EkfWOtkP/YhMtupm+lJIiHxUrgTr1CcKv1nBk1rHtkRRQ3O2+Ih/q/sA+FXZA==";
   expectedRootNodeModuleSymlinks = [
     "ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded"
     "ln -s .pnpm/node_modules/sqlite3 node_modules/sqlite3"
@@ -46,12 +47,14 @@
     then throw "${overlayName} n8n preBuild should create root node_modules symlinks required by the upstream buildPhase"
     else "ok";
 
-  checkXlsxTarballLock = overlayName: package:
-    pkgs.runCommand "${overlayName}-n8n-xlsx-tarball-lock-test" {
-      inherit expectedXlsxTarball;
+  checkXlsxIntegrityPatch = overlayName: package:
+    pkgs.runCommand "${overlayName}-n8n-xlsx-integrity-patch-test" {
+      inherit expectedXlsxTarball expectedXlsxIntegrity;
     } ''
-      grep -F "xlsx@$expectedXlsxTarball:" ${package.src}/pnpm-lock.yaml
-      grep -F "resolution: {tarball: $expectedXlsxTarball}" ${package.src}/pnpm-lock.yaml
+      cp ${package.src}/pnpm-lock.yaml pnpm-lock.yaml
+      ${package.prePnpmInstall or ""}
+      grep -F "xlsx@$expectedXlsxTarball:" pnpm-lock.yaml
+      grep -F "resolution: {integrity: $expectedXlsxIntegrity, tarball: $expectedXlsxTarball}" pnpm-lock.yaml
       touch $out
     '';
 in
@@ -70,8 +73,8 @@ in
     defaultOverlayBuildPhase = checkBuildPhaseInherited "overlays.default" defaultPkgs.n8n;
     modificationsOverlayRootNodeModuleSymlinks = checkRootNodeModuleSymlinks "overlays.modifications" modifiedPkgs.n8n;
     defaultOverlayRootNodeModuleSymlinks = checkRootNodeModuleSymlinks "overlays.default" defaultPkgs.n8n;
-    modificationsOverlayXlsxTarballLock = checkXlsxTarballLock "overlays.modifications" modifiedPkgs.n8n;
-    defaultOverlayXlsxTarballLock = checkXlsxTarballLock "overlays.default" defaultPkgs.n8n;
+    modificationsOverlayXlsxIntegrityPatch = checkXlsxIntegrityPatch "overlays.modifications" modifiedPkgs.n8n;
+    defaultOverlayXlsxIntegrityPatch = checkXlsxIntegrityPatch "overlays.default" defaultPkgs.n8n;
   } ''
     touch $out
   ''