From 1c575a9cd817ab74d2e448ba0a57049dd25810ef Mon Sep 17 00:00:00 2001
From: jacobi petrucciani <jacobi.petrucciani@medable.com>
Date: Wed, 21 Jan 2026 18:34:02 -0500
Subject: [PATCH] set rpath for mdctl native node extensions

---
 mods/pkgs/mdctl-alpha/default.nix | 24 ++++++++++++++++++++++++
 mods/pkgs/mdctl/default.nix       | 24 ++++++++++++++++++++++++
 2 files changed, 48 insertions(+)

diff --git a/mods/pkgs/mdctl-alpha/default.nix b/mods/pkgs/mdctl-alpha/default.nix
index 62ee9fd..4514a7f 100644
--- a/mods/pkgs/mdctl-alpha/default.nix
+++ b/mods/pkgs/mdctl-alpha/default.nix
@@ -6,6 +6,16 @@ let
   json = fromJSON (readFile ./package.json);
   pname = replaceStrings [ "@" "/" ] [ "" "-" ] (head (attrNames json.dependencies));
   version = head (attrValues json.dependencies);
+  keytarRuntimeLibs = lib.optionals stdenv.isLinux [
+    libsecret
+    glib
+    stdenv.cc.cc.lib
+    zlib
+    openssl
+    libffi
+    pcre2
+  ];
+  linuxRpath = lib.makeLibraryPath keytarRuntimeLibs;
   modules = (yarn2nix.mkYarnModules {
     inherit version;
     pname = "${pname}-modules";
@@ -19,6 +29,7 @@ let
         ] ++ lib.optionals stdenv.isLinux [
           libsecret
           glib
+          patchelf
         ] ++ osSpecific;
       };
       sqlite3.buildInputs = [ python3 pkg-config ];
@@ -30,6 +41,19 @@ let
     '';
   }).overrideAttrs (old: {
     NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    postFixup = (old.postFixup or "") + lib.optionalString pkgs.stdenv.isLinux ''
+      echo "Patching RPATH for native addons -> ${linuxRpath}"
+      while IFS= read -r -d "" f; do
+        if file "$f" | grep -q ELF; then
+          old_rpath="$(patchelf --print-rpath "$f" 2>/dev/null || true)"
+          if [ -n "$old_rpath" ]; then
+            patchelf --set-rpath "${linuxRpath}:$old_rpath" "$f" || true
+          else
+            patchelf --set-rpath "${linuxRpath}" "$f" || true
+          fi
+        fi
+      done < <(find "$out/node_modules" -type f -name '*.node' -print0)
+    '';
   });
 in
 stdenv.mkDerivation {
diff --git a/mods/pkgs/mdctl/default.nix b/mods/pkgs/mdctl/default.nix
index 62ee9fd..4514a7f 100644
--- a/mods/pkgs/mdctl/default.nix
+++ b/mods/pkgs/mdctl/default.nix
@@ -6,6 +6,16 @@ let
   json = fromJSON (readFile ./package.json);
   pname = replaceStrings [ "@" "/" ] [ "" "-" ] (head (attrNames json.dependencies));
   version = head (attrValues json.dependencies);
+  keytarRuntimeLibs = lib.optionals stdenv.isLinux [
+    libsecret
+    glib
+    stdenv.cc.cc.lib
+    zlib
+    openssl
+    libffi
+    pcre2
+  ];
+  linuxRpath = lib.makeLibraryPath keytarRuntimeLibs;
   modules = (yarn2nix.mkYarnModules {
     inherit version;
     pname = "${pname}-modules";
@@ -19,6 +29,7 @@ let
         ] ++ lib.optionals stdenv.isLinux [
           libsecret
           glib
+          patchelf
         ] ++ osSpecific;
       };
       sqlite3.buildInputs = [ python3 pkg-config ];
@@ -30,6 +41,19 @@ let
     '';
   }).overrideAttrs (old: {
     NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    postFixup = (old.postFixup or "") + lib.optionalString pkgs.stdenv.isLinux ''
+      echo "Patching RPATH for native addons -> ${linuxRpath}"
+      while IFS= read -r -d "" f; do
+        if file "$f" | grep -q ELF; then
+          old_rpath="$(patchelf --print-rpath "$f" 2>/dev/null || true)"
+          if [ -n "$old_rpath" ]; then
+            patchelf --set-rpath "${linuxRpath}:$old_rpath" "$f" || true
+          else
+            patchelf --set-rpath "${linuxRpath}" "$f" || true
+          fi
+        fi
+      done < <(find "$out/node_modules" -type f -name '*.node' -print0)
+    '';
   });
 in
 stdenv.mkDerivation {