dnscrypt-wrapper: disable fortify3 hardening flag

This was enabled by default in db3e94c3 and breaks the key generation,
specifically `dnscrypt-wrapper --gen-crypt-keypair` fails with:

    Generate crypt key pair... ok.
    Secret key stored in 2.dnscrypt-cert.server.key
    *** buffer overflow detected ***: terminated

FAQ:

  1. Is the buffer overflow real? Probably.

  2. Is it maintained? Is upstream going to fix it? Not really.

  3. Are you willing to investigate and patch it yourself? Nope.

1 files changed, 3 insertions, 0 deletions

diff --git a/pkgs/tools/networking/dnscrypt-wrapper/default.nix b/pkgs/tools/networking/dnscrypt-wrapper/default.nix
index ddec798a8467a..1e414b0521cdb 100644
--- a/pkgs/tools/networking/dnscrypt-wrapper/default.nix
+++ b/pkgs/tools/networking/dnscrypt-wrapper/default.nix
@@ -13,6 +13,9 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # causes `dnscrypt-wrapper --gen-provider-keypair` to crash
+  hardeningDisable = [ "fortify3" ];
+
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [ libsodium libevent ];