feat: rewrite the package to fetch binary

package.nix

@@ -1,10 +1,8 @@
 { lib
-, rustPlatform
-, fetchFromGitHub
-, pkg-config
+, stdenv
+, fetchurl
+, autoPatchelfHook
 , makeWrapper
-, openssl
-, gtk3
 , wayland
 , libxkbcommon
 , libGL
@@ -16,6 +14,26 @@
 }:
 
 let
+  version = "0.14.0";
+
+  # Upstream publishes prebuilt release tarballs per platform. Each contains
+  # the `oryxis` binary, its .desktop file, and a 64px icon.
+  sources = {
+    x86_64-linux = {
+      url = "https://github.com/wilsonglasser/oryxis/releases/download/v${version}/oryxis-linux-x86_64.tar.gz";
+      hash = "sha256-U/8gEXcz3wJ0zk2GJqYnG0XdkU5+J53RloEyX4O2dcE=";
+    };
+    aarch64-linux = {
+      url = "https://github.com/wilsonglasser/oryxis/releases/download/v${version}/oryxis-linux-aarch64.tar.gz";
+      hash = "sha256-G3kTzci/GZVXVwF52eu/Yg7HERn7m/V3tJigkTA1SUM=";
+    };
+  };
+
+  source = sources.${stdenv.hostPlatform.system}
+    or (throw "oryxis: unsupported platform ${stdenv.hostPlatform.system}");
+
+  # Graphics/windowing libraries the binary dlopens at runtime (it only links
+  # libc/libm/libgcc directly), so they must be on LD_LIBRARY_PATH.
   runtimeLibs = [
     wayland
     libxkbcommon
@@ -27,47 +45,46 @@ let
     libxi
   ];
 in
-rustPlatform.buildRustPackage rec {
+stdenv.mkDerivation {
   pname = "oryxis";
-  version = "0.14.0";
+  inherit version;
 
-  src = fetchFromGitHub {
-    owner = "wilsonglasser";
-    repo = "oryxis";
-    rev = "v${version}";
-    hash = "sha256-2NJ2ELTZ3liuec4OiofMD6/KQLcBCgC+gttpebCeAM0=";
-  };
+  src = fetchurl source;
 
-  cargoHash = "sha256-Rg/FiKjG+44MTnJXNXeXs+pqHRmFq2WBos5uOXUoiJc=";
+  sourceRoot = ".";
 
   nativeBuildInputs = [
-    pkg-config
+    autoPatchelfHook  # fixes the ELF interpreter and rpath of the prebuilt binary
     makeWrapper
   ];
 
+  # Needed by autoPatchelfHook to resolve the binary's direct NEEDED entries
+  # (libgcc_s.so.1, libm, libc).
   buildInputs = [
-    openssl
-    gtk3
-    wayland
-    libxkbcommon
+    stdenv.cc.cc.lib
   ];
 
-  # Use the system openssl (from buildInputs) rather than vendoring it.
-  OPENSSL_NO_VENDOR = 1;
+  installPhase = ''
+    runHook preInstall
 
-  postInstall = ''
-    install -Dm644 resources/oryxis.desktop $out/share/applications/oryxis.desktop
-    install -Dm644 resources/logo.svg $out/share/icons/hicolor/scalable/apps/oryxis.svg
-    for size in 64 128 256; do
-      install -Dm644 resources/logo_$size.png \
-        $out/share/icons/hicolor/''${size}x''${size}/apps/oryxis.png
-    done
+    install -Dm755 oryxis $out/bin/oryxis
+    install -Dm644 oryxis.desktop $out/share/applications/oryxis.desktop
+    install -Dm644 logo_64.png $out/share/icons/hicolor/64x64/apps/oryxis.png
+
+    runHook postInstall
   '';
 
   postFixup = ''
-    for bin in $out/bin/*; do
-      wrapProgram "$bin" \
+    wrapProgram $out/bin/oryxis \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"
-    done
   '';
+
+  meta = {
+    description = "Modern SSH client built entirely in Rust. Fast, encrypted, native";
+    homepage = "https://github.com/wilsonglasser/oryxis";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "oryxis";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = builtins.attrNames sources;
+  };
 }