From e4b4dcfc0b7596b400480eebf64ce6cfd9c5fb7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Fri, 31 Jul 2026 05:46:35 +0300
Subject: [PATCH 1/2] fix(nix): bump supascan/gatekeeper Go pin from 1.24 to
 1.25

go_1_24 is missing in the upcoming nixpkgs 26.05pre bump used by #2328's
flake.lock update; go_1_25 is the newest Go version present in both the
current and the bumped nixpkgs, so pinning to it keeps these packages
building across the update.
---
 nix/packages/gatekeeper.nix | 6 +++---
 nix/packages/supascan.nix   | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/nix/packages/gatekeeper.nix b/nix/packages/gatekeeper.nix
index 5ec53c74e9..0288d32dc9 100644
--- a/nix/packages/gatekeeper.nix
+++ b/nix/packages/gatekeeper.nix
@@ -1,10 +1,10 @@
 { pkgs, ... }:
 let
 
-  go124 = pkgs.go_1_24;
-  buildGoModule124 = pkgs.buildGoModule.override { go = go124; };
+  go125 = pkgs.go_1_25;
+  buildGoModule125 = pkgs.buildGoModule.override { go = go125; };
 
-  upstream-gatekeeper = buildGoModule124 {
+  upstream-gatekeeper = buildGoModule125 {
     pname = "jit-db-gatekeeper";
     version = "1.0.5";
     src = pkgs.fetchFromGitHub {
diff --git a/nix/packages/supascan.nix b/nix/packages/supascan.nix
index daa51f19b8..c2debb84da 100644
--- a/nix/packages/supascan.nix
+++ b/nix/packages/supascan.nix
@@ -1,8 +1,8 @@
 { pkgs, lib, ... }:
 let
-  # Use Go 1.24 for the scanner which requires Go >= 1.23.2
-  go124 = pkgs.go_1_24;
-  buildGoModule124 = pkgs.buildGoModule.override { go = go124; };
+  # Use Go 1.25 for the scanner which requires Go >= 1.23.2
+  go125 = pkgs.go_1_25;
+  buildGoModule125 = pkgs.buildGoModule.override { go = go125; };
 
   # Package GOSS - server validation spec runner
   goss = pkgs.buildGoModule rec {
@@ -28,7 +28,7 @@ let
   };
 
   # Main supascan CLI - consolidated tool for baseline generation and validation
-  supascan = buildGoModule124 {
+  supascan = buildGoModule125 {
     pname = "supascan";
     version = "1.0.0";
 

From 1b841e8fb56806896ca50d2adafb903d4709f854 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rton=20Boros?= <martonboros@gmail.com>
Date: Fri, 31 Jul 2026 06:02:14 +0300
Subject: [PATCH 2/2] fix(nix): drop explicit Go version pin in
 supascan/gatekeeper

pkgs.go already resolves to 1.25.x on both the current and the bumped
nixpkgs (25.11pre -> 26.05pre), well above the >= 1.23.2 requirement,
so the explicit go_1_24/go_1_25 override was redundant and fragile
across nixpkgs bumps. Using plain pkgs.buildGoModule matches how the
other Go packages in this flake (goss, pg-startup-profiler, packer,
wal-g) are already built.
---
 nix/packages/gatekeeper.nix | 6 +-----
 nix/packages/supascan.nix   | 6 +-----
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/nix/packages/gatekeeper.nix b/nix/packages/gatekeeper.nix
index 0288d32dc9..d0a497669b 100644
--- a/nix/packages/gatekeeper.nix
+++ b/nix/packages/gatekeeper.nix
@@ -1,10 +1,6 @@
 { pkgs, ... }:
 let
-
-  go125 = pkgs.go_1_25;
-  buildGoModule125 = pkgs.buildGoModule.override { go = go125; };
-
-  upstream-gatekeeper = buildGoModule125 {
+  upstream-gatekeeper = pkgs.buildGoModule {
     pname = "jit-db-gatekeeper";
     version = "1.0.5";
     src = pkgs.fetchFromGitHub {
diff --git a/nix/packages/supascan.nix b/nix/packages/supascan.nix
index c2debb84da..020d5ce50d 100644
--- a/nix/packages/supascan.nix
+++ b/nix/packages/supascan.nix
@@ -1,9 +1,5 @@
 { pkgs, lib, ... }:
 let
-  # Use Go 1.25 for the scanner which requires Go >= 1.23.2
-  go125 = pkgs.go_1_25;
-  buildGoModule125 = pkgs.buildGoModule.override { go = go125; };
-
   # Package GOSS - server validation spec runner
   goss = pkgs.buildGoModule rec {
     pname = "goss";
@@ -28,7 +24,7 @@ let
   };
 
   # Main supascan CLI - consolidated tool for baseline generation and validation
-  supascan = buildGoModule125 {
+  supascan = pkgs.buildGoModule {
     pname = "supascan";
     version = "1.0.0";