build: add lib_secp256k1 dep

default.nix

@@ -1,11 +1,16 @@
 {
   lib,
   beam,
+  fetchFromGitHub,
+  runCommand,
+  autoconf,
+  automake,
+  libtool,
   pkg-config,
   vips,
 }: let
   pname = "parrhesia";
-  version = "0.1.0";
+  version = "0.2.0";
 
   beamPackages = beam.packages.erlang_28.extend (
     final: _prev: {
@@ -46,13 +51,66 @@
         hash = "sha256-1v2+Q1MHbu09r5OBaLehiR+JfMP0Q5OHaWuwrQDzZJU=";
       }
     else null;
+
+  # lib_secp256k1 is a :make dep and may not be present in fetchMixDeps output.
+  # Inject the Hex package explicitly, then vendor upstream bitcoin-core/secp256k1
+  # sources to avoid build-time network access.
+  libSecp256k1Hex = beamPackages.fetchHex {
+    pkg = "lib_secp256k1";
+    version = "0.7.1";
+    sha256 = "sha256-eL3TZhoXRIr/Wu7FynTI3bwJsB8Oz6O6Gro+iuR6srM=";
+  };
+
+  elixirMakeHex = beamPackages.fetchHex {
+    pkg = "elixir_make";
+    version = "0.9.0";
+    sha256 = "sha256-2yPU/Yt1dGKtAviqc0MaQm/mZxyAsgDZcQyvPR3Q/9s=";
+  };
+
+  secp256k1Src = fetchFromGitHub {
+    owner = "bitcoin-core";
+    repo = "secp256k1";
+    rev = "v0.7.1";
+    hash = "sha256-DnBgetf+98n7B1JGtyTdxyc+yQ51A3+ueTIPPSWCm4E=";
+  };
+
+  patchedMixFodDeps =
+    if mixFodDeps == null
+    then null
+    else
+      runCommand mixFodDeps.name {} ''
+        mkdir -p $out
+        cp -r --no-preserve=mode ${mixFodDeps}/. $out
+        chmod -R u+w $out
+
+        rm -rf $out/lib_secp256k1
+        cp -r ${libSecp256k1Hex} $out/lib_secp256k1
+        chmod -R u+w $out/lib_secp256k1
+
+        rm -rf $out/elixir_make
+        cp -r ${elixirMakeHex} $out/elixir_make
+
+        rm -rf $out/lib_secp256k1/c_src/secp256k1
+        mkdir -p $out/lib_secp256k1/c_src/secp256k1
+        cp -r ${secp256k1Src}/. $out/lib_secp256k1/c_src/secp256k1/
+        chmod -R u+w $out/lib_secp256k1/c_src/secp256k1
+
+        # mixRelease may copy deps without preserving +x bits, so avoid relying
+        # on executable mode for autogen.sh.
+        substituteInPlace $out/lib_secp256k1/Makefile \
+          --replace-fail "./autogen.sh" "sh ./autogen.sh"
+
+        touch $out/lib_secp256k1/c_src/secp256k1/.fetched
+      '';
 in
   beamPackages.mixRelease {
-    inherit pname version src mixFodDeps;
+    inherit pname version src;
+
+    mixFodDeps = patchedMixFodDeps;
 
     mixEnv = "prod";
     removeCookie = false;
-    nativeBuildInputs = [pkg-config];
+    nativeBuildInputs = [pkg-config autoconf automake libtool];
     buildInputs = [vips];
 
     preConfigure = ''