koreader: use modern openssl

hosts/common/programs/koreader/default.nix

@@ -22,7 +22,6 @@
 { config, lib, pkgs, sane-lib, ... }:
 
 let
-  cfg = config.sane.programs.koreader;
   feeds = sane-lib.feeds;
   allFeeds = config.sane.feeds;
   wantedFeeds = feeds.filterByFormat [ "text" ] allFeeds;
@@ -82,10 +81,4 @@ in {
     # could be more explicit if i symlinked the history.lua file to somewhere it can persist better.
     persist.byStore.plaintext = [ ".config/koreader" ];
   };
-
-  nixpkgs.config.permittedInsecurePackages = lib.optionals cfg.enabled [
-    # koreader uses an ancient openssl.
-    # TODO: can i DI a newer version into it, anyway?
-    "openssl-1.1.1w"
-  ];
 }

pkgs/additional/koreader-from-src/default.nix

@@ -64,7 +64,7 @@
 , libpng
 , libunibreak
 , libwebp
-, openssl_1_1
+, openssl
 , openssh
 , sdcv
 , SDL2  # koreader doesn't actually vendor this, just expects it'll magically be available
@@ -172,7 +172,7 @@ let
 
   # these probably have more dirs than they really need.
   djvulibreAll = fhsLib djvulibre { lib=true; include=true; flatInclude=true; };
-  opensslAll = fhsLib openssl_1_1 { lib=false; include=true; flatLib=true; };
+  opensslAll = fhsLib openssl { lib=false; include=true; flatLib=true; };
   utf8procAll = fhsLib utf8proc { lib=true; include=false; flatInclude=true; };
   # KOreader uses ZLIB_DIR as:
   # - -L${ZLIB_DIR}
@@ -231,10 +231,10 @@ let
     LUAJIT_LIB="${lib.getLib luajit52}/lib/libluajit-5.1.so" \
     LUA_INCDIR="${lib.getDev luajit52}/include" \
     LUA_LIBDIR="${lib.getLib luajit52}/lib/libluajit-5.1.so" \
-    OPENSSL_LIB="${lib.getLib openssl_1_1}/lib/libssl.so" \
+    OPENSSL_LIB="${lib.getLib openssl}/lib/libssl.so" \
     OPENSSL_DIR="${opensslAll}" \
-    SSL_LIB="${lib.getLib openssl_1_1}/lib/libssl.so.1.1" \
-    CRYPTO_LIB="${lib.getLib openssl_1_1}/lib/libcrypto.so" \
+    SSL_LIB="${lib.getLib openssl}/lib/libssl.so.3" \
+    CRYPTO_LIB="${lib.getLib openssl}/lib/libcrypto.so" \
     PNG_LIB="${lib.getLib libpng}/lib/libpng.so" \
     PNG_DIR="${libAndDev libpng}" \
     SQLITE_LIB="${lib.getLib sqlite}/lib/libsqlite3.so" \
@@ -283,7 +283,7 @@ let
     libpng
     libunibreak'
     libwebp
-    openssl_1_1
+    openssl
     openssh
     sdcv
     SDL2
@@ -383,6 +383,10 @@ stdenv.mkDerivation rec {
       substituteInPlace ../fribidi/autogen.sh --replace 'which pkg-config' 'which $PKG_CONFIG'
     ''}
 
+    # patch for newer openssl
+    substituteInPlace --fail base/ffi/crypto.lua \
+      --replace 'ffi.load("libs/libcrypto.so.1.1")' 'ffi.load("libcrypto.so")'
+
     # dlopen libraries by name only, allowing them to be found via LD_LIBRARY_PATH
     # instead of just via $out/libs. this is required whenever we direct KOreader to use system libs instead of its vendored libs.
     for f in $(shopt -s globstar; ls **/*.lua) ; do