signal-desktop: preload sqlcipher library from nixpkgs

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -10,6 +10,7 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
+, sqlcipher
 }:
 
 let
@@ -21,6 +22,40 @@ let
     in lib.optionalString (spellcheckerLanguage != null) ''
       --set HUNSPELL_DICTIONARIES "${hunspellDicts.${hunspellDict}}/share/hunspell" \
       --set LC_MESSAGES "${spellcheckerLanguage}"'');
+
+  sqlcipher-signal = sqlcipher.overrideAttrs (_: {
+    # Using the same features as the upstream signal sqlcipher build
+    # https://github.com/signalapp/better-sqlite3/blob/2fa02d2484e9f9a10df5ac7ea4617fb2dff30006/deps/defines.gypi
+    CFLAGS = [
+      "-DSQLITE_LIKE_DOESNT_MATCH_BLOBS"
+      "-DSQLITE_THREADSAFE=2"
+      "-DSQLITE_USE_URI=0"
+      "-DSQLITE_DEFAULT_MEMSTATUS=0"
+      "-DSQLITE_OMIT_DEPRECATED"
+      "-DSQLITE_OMIT_GET_TABLE"
+      "-DSQLITE_OMIT_TCL_VARIABLE"
+      "-DSQLITE_OMIT_PROGRESS_CALLBACK"
+      "-DSQLITE_OMIT_SHARED_CACHE"
+      "-DSQLITE_TRACE_SIZE_LIMIT=32"
+      "-DSQLITE_DEFAULT_CACHE_SIZE=-16000"
+      "-DSQLITE_DEFAULT_FOREIGN_KEYS=1"
+      "-DSQLITE_DEFAULT_WAL_SYNCHRONOUS=1"
+      "-DSQLITE_ENABLE_COLUMN_METADATA"
+      "-DSQLITE_ENABLE_UPDATE_DELETE_LIMIT"
+      "-DSQLITE_ENABLE_STAT4"
+      "-DSQLITE_ENABLE_FTS5"
+      "-DSQLITE_ENABLE_JSON1"
+      "-DSQLITE_ENABLE_RTREE"
+      "-DSQLITE_INTROSPECTION_PRAGMAS"
+
+      # SQLCipher-specific options
+      "-DSQLITE_HAS_CODEC"
+      "-DSQLITE_TEMP_STORE=2"
+      "-DSQLITE_SECURE_DELETE"
+    ];
+
+    LDFLAGS = [ "-lm" ];
+  });
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
   version = "5.19.0"; # Please backport all updates to the stable channel.
@@ -115,15 +150,10 @@ in stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  # Required for $SQLCIPHER_LIB which contains "/build/" inside the path:
-  noAuditTmpdir = true;
-
   preFixup = ''
-    export SQLCIPHER_LIB="$out/lib/Signal/resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-    test -x "$SQLCIPHER_LIB" # To ensure the location hasn't changed
     gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
-      --prefix LD_PRELOAD : "$SQLCIPHER_LIB"
+      --prefix LD_PRELOAD : "${sqlcipher-signal}/lib/libsqlcipher.so"
       ${customLanguageWrapperArgs}
     )