Merge #147719: unbound-full: fix the build again

pkgs/tools/networking/unbound/default.nix

@@ -32,6 +32,9 @@
 , withDNSTAP ? false
 , withTFO ? false
 , withRedis ? false
+# Avoid .lib depending on openssl.out
+# The build gets a little hacky, so in some cases we disable this approach.
+, withSlimLib ? stdenv.isLinux && !stdenv.hostPlatform.isMusl && !withDNSTAP
 , libnghttp2
 }:
 
@@ -105,10 +108,9 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${lib.makeBinPath [ openssl ]}
   '';
 
-  preFixup = lib.optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) # XXX: revisit
+  preFixup = lib.optionalString withSlimLib
     # Build libunbound again, but only against nettle instead of openssl.
     # This avoids gnutls.out -> unbound.lib -> openssl.out.
-    # There was some problem with this on Darwin; let's not complicate non-Linux.
     ''
       configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
       configurePhase