Change:
<del> { lib, fetchurl, perlPackages, makeWrapper, gnupg, re2c, gcc, gnumake }: </del> <ins> { lib, fetchurl, perlPackages, makeBinaryWrapper, gnupg, re2c, gcc, gnumake, libxcrypt, openssl, coreutils, poppler_utils, tesseract, iana-etc }: </ins> perlPackages.buildPerlPackage rec { pname = "SpamAssassin"; <del> version = "3.4.6"; </del> <ins> version = "4.0.0"; </ins> src = fetchurl { url = "mirror://apache/spamassassin/source/Mail-${pname}-${version}.tar.bz2"; <del> sha256 = "044ng2aazqy8g0m17q0a4939ck1ca4x230q2q7q7jndvwkrpaj5w"; </del> <ins> hash = "sha256-5aoXBQowvHK6qGr9xgSMrepNHsLsxh14dxegWbgxnog="; </ins> }; <del> # ExtUtil::MakeMaker is bundled with Perl, but the bundled version # causes build errors for aarch64-darwin, so we override it with the # latest version.  We can drop the dependency to go back to the # bundled version when the version that comes with Perl is ≥7.57_02. # # Check the version bundled with Perl like this: #   perl -e 'use ExtUtils::MakeMaker qw($VERSION); print "$VERSIONn"' nativeBuildInputs = [ makeWrapper perlPackages.ExtUtilsMakeMaker ]; </del> <ins> patches = [ ./satest-no-clean-path.patch ./sa_compile-use-perl5lib.patch ]; nativeBuildInputs = [ makeBinaryWrapper ]; </ins> buildInputs = (with perlPackages; [ HTMLParser NetCIDRLite NetDNS NetAddrIP DBFile HTTPDate MailDKIM LWP LWPProtocolHttps IOSocketSSL DBI EncodeDetect IPCountry NetIdent Razor2ClientAgent MailSPF NetDNSResolverProgrammable Socket6 <del> ]); </del> <ins> ArchiveZip EmailAddressXS NetLibIDN2 MaxMindDBReader GeoIP MailDMARC MaxMindDBReaderXS ]) ++ [ openssl ]; </ins> <del> # Enabling 'taint' mode is desirable, but that flag disables support # for the PERL5LIB environment variable. Needs further investigation. makeFlags = [ "PERL_BIN=${perlPackages.perl}/bin/perl" "PERL_TAINT=no" ]; </del> <ins> makeFlags = [ "PERL_BIN=${perlPackages.perl}/bin/perl" "ENABLE_SSL=yes" ]; </ins> makeMakerFlags = [ "SYSCONFDIR=/etc LOCALSTATEDIR=/var/lib/spamassassin" ]; <del> doCheck = false; </del> <ins> checkInputs = (with perlPackages; [ TextDiff  # t/strip2.t ]) ++ [ coreutils  # date, t/basic_meta.t poppler_utils  # pdftotext, t/extracttext.t tesseract  # tesseract, t/extracttext.t iana-etc  # t/dnsbl_subtests.t (/etc/protocols used by Net::DNS::Nameserver) re2c gcc gnumake ]; preCheck = '' substituteInPlace t/spamc_x_e.t  --replace "/bin/echo" "${coreutils}/bin/echo" export C_INCLUDE_PATH='${lib.makeSearchPathOutput "include" "include" [ libxcrypt ]}' export HARNESS_OPTIONS="j''${NIX_BUILD_CORES}" export HOME=$NIX_BUILD_TOP/home mkdir -p $HOME mkdir t/log  # pre-create to avoid race conditions ''; </ins> postInstall = '' mkdir -p $out/share/spamassassin mv "rules/"* $out/share/spamassassin/ for n in "$out/bin/"*; do <del> wrapProgram "$n" --prefix PERL5LIB : "$PERL5LIB" --prefix PATH : ${lib.makeBinPath [ gnupg re2c gcc gnumake ]} </del> <ins> # Skip if this isn't a perl script if ! head -n1 "$n" | grep -q bin/perl; then continue fi echo "Wrapping $n for taint mode" orig="$out/bin/.$(basename "$n")-wrapped" mv "$n" "$orig" # We don't inherit argv0 so that $^X works properly in e.g. sa-compile makeWrapper "${perlPackages.perl}/bin/perl" "$n"  --add-flags "-T $perlFlags $orig"  --prefix PATH : ${lib.makeBinPath [ gnupg re2c gcc gnumake ]}  --prefix C_INCLUDE_PATH : ${lib.makeSearchPathOutput "include" "include" [ libxcrypt ]} </ins> done '';

Discussion:
SpamAssassin generates and compiles C code from anti-spam rules. This currently fails because the generated code makes use of the function, which is not available during the rule compilation process. Steps to reproduce the behavior: the SpamAssassin service that sa-update.service fails with the error message: that, consequently, spamd.service will not function. Alternatively, the error can also be observed by invoking directly. sa-update.service succeeds <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result.
A smoke-test that serves as a reproducer is available in .
In theory, this could be addressed by making libxcrypt available when compiling rules, but care must probably also be taken so that the dynamic linker can find it at rule run-time.
Rule compilation seems to complete without errors for the rule if we set . However, of course the resulting binary is not linked against libxcrypt then. I’m not sure when Spamassassin will generate code that actually calls functions from that library.