projects/guix·blob java-team · refs

1383 lines · 54.8 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2012-2017, 2019-2025 Ludovic Courtès <[email protected]>
3;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2021 Mark H Weaver <[email protected]>
4;;; Copyright © 2014 Ian Denhardt <[email protected]>
5;;; Copyright © 2013, 2015, 2026 Andreas Enge <[email protected]>
6;;; Copyright © 2015 David Thompson <[email protected]>
7;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Leo Famulari <[email protected]>
8;;; Copyright © 2016, 2017, 2019, 2021-2024 Efraim Flashner <[email protected]>
9;;; Copyright © 2016, 2017, 2018 Nikita <[email protected]>
10;;; Copyright © 2016 Hartmut Goebel <[email protected]>
11;;; Copyright © 2017 Ricardo Wurmus <[email protected]>
12;;; Copyright © 2017-2022 Marius Bakke <[email protected]>
13;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <[email protected]>
14;;; Copyright © 2017 Rutger Helling <[email protected]>
15;;; Copyright © 2018 Clément Lassieur <[email protected]>
16;;; Copyright © 2019 Mathieu Othacehe <[email protected]>
17;;; Copyright © 2020, 2023, 2025 Janneke Nieuwenhuizen <[email protected]>
18;;; Copyright © 2020, 2021, 2023-2025 Maxim Cournoyer <[email protected]>
19;;; Copyright © 2021 Solene Rapenne <[email protected]>
20;;; Copyright © 2021 Brice Waegeneire <[email protected]>
21;;; Copyright © 2021 Maxime Devos <[email protected]>
22;;; Copyright © 2021 Matthew James Kraai <[email protected]>
23;;; Copyright © 2021 John Kehayias <[email protected]>
24;;; Copyright © 2022 Greg Hogan <[email protected]>
25;;; Copyright © 2024-2026 Ashish SHUKLA <[email protected]>
26;;; Copyright © 2026 Junker <[email protected]>
27;;;
28;;; This file is part of GNU Guix.
29;;;
30;;; GNU Guix is free software; you can redistribute it and/or modify it
31;;; under the terms of the GNU General Public License as published by
32;;; the Free Software Foundation; either version 3 of the License, or (at
33;;; your option) any later version.
34;;;
35;;; GNU Guix is distributed in the hope that it will be useful, but
36;;; WITHOUT ANY WARRANTY; without even the implied warranty of
37;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38;;; GNU General Public License for more details.
39;;;
40;;; You should have received a copy of the GNU General Public License
41;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
42
43(define-module (gnu packages tls)
44 #:use-module ((guix licenses) #:prefix license:)
45 #:use-module (guix deprecation)
46 #:use-module (guix packages)
47 #:use-module (guix download)
48 #:use-module (guix git-download)
49 #:use-module (guix utils)
50 #:use-module (guix gexp)
51 #:use-module (guix build-system gnu)
52 #:use-module (guix build-system go)
53 #:use-module (guix build-system perl)
54 #:use-module (guix build-system pyproject)
55 #:use-module (guix build-system cmake)
56 #:use-module (guix build-system trivial)
57 #:use-module (guix build-system meson)
58 #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR $SSL_CERT_FILE))
59 #:use-module (gnu packages compression)
60 #:use-module (gnu packages)
61 #:use-module (gnu packages autotools)
62 #:use-module (gnu packages base)
63 #:use-module (gnu packages bash)
64 #:use-module (gnu packages build-tools)
65 #:use-module (gnu packages check)
66 #:use-module (gnu packages certs)
67 #:use-module (gnu packages curl)
68 #:use-module (gnu packages dns)
69 #:use-module (gnu packages docbook)
70 #:use-module (gnu packages documentation)
71 #:use-module (gnu packages gawk)
72 #:use-module (gnu packages gettext)
73 #:use-module (gnu packages guile)
74 #:use-module (gnu packages libbsd)
75 #:use-module (gnu packages libffi)
76 #:use-module (gnu packages libidn)
77 #:use-module (gnu packages libunistring)
78 #:use-module (gnu packages linux)
79 #:use-module (gnu packages ncurses)
80 #:use-module (gnu packages nettle)
81 #:use-module (gnu packages networking)
82 #:use-module (gnu packages nss)
83 #:use-module (gnu packages perl)
84 #:use-module (gnu packages pkg-config)
85 #:use-module (gnu packages python)
86 #:use-module (gnu packages python-build)
87 #:use-module (gnu packages python-crypto)
88 #:use-module (gnu packages python-web)
89 #:use-module (gnu packages python-xyz)
90 #:use-module (gnu packages sphinx)
91 #:use-module (gnu packages texinfo)
92 #:use-module (gnu packages time)
93 #:use-module (gnu packages version-control)
94 #:use-module (gnu packages xml)
95 #:use-module (srfi srfi-1)
96 #:use-module (srfi srfi-34)
97 #:use-module (srfi srfi-35))
98
99(define-public libtasn1
100 (package
101 (name "libtasn1")
102 (version "4.21.0")
103 (source
104 (origin
105 (method url-fetch)
106 (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
107 version ".tar.gz"))
108 (sha256
109 (base32
110 "11ywcy8n115c8b3vmf7hmgkdhlfy4phlcwvp8114di9w495492hx"))))
111 (build-system gnu-build-system)
112 (arguments
113 `(#:configure-flags '("--disable-static")))
114 (native-inputs (list perl))
115 (home-page "https://www.gnu.org/software/libtasn1/")
116 (synopsis "ASN.1 library")
117 (description
118 "GNU libtasn1 is a library implementing the ASN.1 notation. It is used
119for transmitting machine-neutral encodings of data objects in computer
120networking, allowing for formal validation of data according to some
121specifications.")
122 (license license:lgpl2.0+)))
123
124(define-public asn1c
125 (package
126 (name "asn1c")
127 (version "0.9.28")
128 (source (origin
129 (method url-fetch)
130 (uri (string-append "https://lionet.info/soft/asn1c-"
131 version ".tar.gz"))
132 (sha256
133 (base32
134 "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
135 (build-system gnu-build-system)
136 (native-inputs
137 (list perl))
138 (home-page "https://lionet.info/asn1c")
139 (synopsis "ASN.1 to C compiler")
140 (description "The ASN.1 to C compiler takes ASN.1 module
141files and generates C++ compatible C source code. That code can be
142used to serialize the native C structures into compact and unambiguous
143BER/XER/PER-based data files, and deserialize the files back.
144
145Various ASN.1 based formats are widely used in the industry, such as to encode
146the X.509 certificates employed in the HTTPS handshake, to exchange control
147data between mobile phones and cellular networks, to car-to-car communication
148in intelligent transportation networks.")
149 (license license:bsd-2)))
150
151(define-public p11-kit
152 (package
153 (name "p11-kit")
154 (version "0.26.2")
155 (source
156 (origin
157 (method url-fetch)
158 (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
159 "download/" version "/p11-kit-" version ".tar.xz"))
160 (sha256
161 (base32 "0a7qxkfaj7ayq5b3vw850h6ndr88f37ygmbk3qaa64s8v929zz89"))))
162 (build-system gnu-build-system)
163 (native-inputs
164 (list nss-certs ;default certificates
165 pkg-config
166 python-minimal)) ;to generate some headers
167 (inputs
168 (append (list libffi libtasn1)
169 (if (target-hurd?)
170 (list libbsd)
171 '())))
172 (arguments
173 (list
174 #:configure-flags
175 #~(list (string-append
176 "--with-trust-paths="
177 (string-join
178 '("/etc/ssl/certs/ca-certificates.crt" ;debian, gentoo, etc.
179 "/etc/pki/tls/certs/ca-bundle.crt" ;fedora, centos
180 "/var/lib/ca-certificates/ca-bundle.pem"
181 ;; It's not enough to point directly to the nss-certs'
182 ;; etc/ssl/certs directory; we must ensure the .pem
183 ;; certificates from a directory are found under the
184 ;; anchors/ subdirectory to be trusted (see:
185 ;; https://p11-glue.github.io/p11-glue/p11-kit/
186 ;; manual/trust-module.html#trust-files).
187 #$(file-union
188 "nss-certs"
189 `(("anchors"
190 ,(file-append (this-package-native-input "nss-certs")
191 "/etc/ssl/certs")))))
192 ":")))))
193 (native-search-paths
194 (list (search-path-specification
195 (variable "P11_MODULE_PATH")
196 (files (list "share/p11-kit/modules"))
197 ;; Helas, this only currently support a single PATH entry. It'll
198 ;; thus only work in profiles, not in the build environment.
199 (separator #f))))
200 (home-page "https://p11-glue.github.io/p11-glue/p11-kit.html")
201 (synopsis "PKCS#11 library")
202 (description
203 "p11-kit provides a way to load and enumerate PKCS#11 modules. It
204provides a standard configuration setup for installing PKCS#11 modules
205in such a way that they are discoverable. It also solves problems with
206coordinating the use of PKCS#11 by different components or libraries
207living in the same process.")
208 (license license:bsd-3)))
209
210(define-public gnutls
211 (package
212 (name "gnutls")
213 (version "3.8.13")
214 (source (origin
215 (method url-fetch)
216 ;; Note: Releases are no longer on ftp.gnu.org since the
217 ;; schism (after version 3.1.5).
218 (uri (string-append "mirror://gnupg/gnutls/v"
219 (version-major+minor version)
220 "/gnutls-" version ".tar.xz"))
221 (sha256
222 (base32
223 "0zn9m5nb3a4r9rh5ws3xaczbals7vrvy7ahl9xnl5hh9pz0qxvgz"))))
224 (build-system gnu-build-system)
225 (arguments
226 (list #:tests? (not (or (%current-target-system)
227 (target-hurd?)))
228 ;; Ensure we don't keep a reference to the tools used for testing.
229 #:disallowed-references
230 (if (target-hurd?)
231 '()
232 (list (this-package-native-input "net-tools")
233 (this-package-native-input "iproute2")
234 (this-package-native-input "socat")))
235
236 #:configure-flags
237 #~(list
238 ;; dlopen (the default otherwise) doesn't work reliably on Guix
239 ;; due to its non-FHS nature and the lack of a global
240 ;; ld.so.cache file.
241 "--with-zlib=link"
242 "--with-zstd=link"
243 ;; Configure GnuTLS to use the p11-kit trust module by default,
244 ;; which is more flexible and knows to look at locations we've
245 ;; configured it to, on top of allowing users to configure it
246 ;; further.
247 "--with-default-trust-store-pkcs11=pkcs11:")
248 #:phases
249 #~(modify-phases %standard-phases
250 #$@(if (target-ppc32?)
251 ;; https://gitlab.com/gnutls/gnutls/-/issues/1354
252 ;; Extend the test timeout from the default of 20 * 1000
253 #~((add-after 'unpack 'increase-test-timeout
254 (lambda _
255 (setenv "GNUTLS_TEST_TIMEOUT" "60000"))))
256 #~())
257 (add-after 'install 'move-doc
258 (lambda* (#:key outputs #:allow-other-keys)
259 ;; Copy the 4.1 MiB of section 3 man pages to "doc".
260 (let* ((out (assoc-ref outputs "out"))
261 (doc (assoc-ref outputs "doc"))
262 (mandir (string-append doc "/share/man/man3"))
263 (oldman (string-append out "/share/man/man3")))
264 (mkdir-p mandir)
265 (copy-recursively oldman mandir)
266 (delete-file-recursively oldman)))))))
267 (outputs '("out" ;4.4 MiB
268 "debug"
269 "doc")) ;4.1 MiB of man pages
270 (native-inputs
271 (append (list pkg-config
272 texinfo
273 util-linux) ;one test needs 'setsid'
274 (if (target-hurd?)
275 '()
276 (list net-tools
277 iproute ;for 'ss'
278 socat ;several tests rely on it
279 datefudge)))) ;tests rely on 'datefudge'
280 (inputs (list libunistring zlib))
281 (propagated-inputs
282 ;; These are all in the 'Requires.private' field of gnutls.pc.
283 (list libtasn1 libidn2 p11-kit nettle zlib `(,zstd "lib")))
284 (home-page "https://gnutls.org")
285 (synopsis "Transport layer security library")
286 (description
287 "GnuTLS is a secure communications library implementing the SSL, TLS
288and DTLS protocols. It is provided in the form of a C library to support the
289protocols, as well as to parse and write X.509, PKCS #12, OpenPGP and other
290required structures.")
291 (license license:lgpl2.1+)
292 (properties
293 ;; Since gnutls.org doesn't have a page with a direct link to the
294 ;; tarball, defer to fellow LFS hackers.
295 '((release-monitoring-url
296 . "https://www.linuxfromscratch.org/blfs/view/svn/postlfs/gnutls.html")
297 (upstream-name . "gnutls")))))
298
299(define-deprecated/public-alias gnutls-latest gnutls)
300
301(define-public gnutls/dane
302 ;; GnuTLS with build libgnutls-dane, implementing DNS-based
303 ;; Authentication of Named Entities. This is required for GNS functionality
304 ;; by GNUnet and gnURL. This is done in an extra package definition
305 ;; to have the choice between GnuTLS with Dane and without Dane.
306 (package/inherit gnutls
307 (name "gnutls-dane")
308 (inputs (modify-inputs inputs
309 (prepend unbound)))))
310
311(define-public guile-gnutls
312 (package
313 ;; This package supersedes the Guile bindings that came with GnuTLS until
314 ;; version 3.7.8 included.
315 (name "guile-gnutls")
316 (version "5.0.2")
317 (home-page "https://codeberg.org/guile-gnutls/guile-gnutls")
318 (source (origin
319 ;; url-fetch is used here to avoid a circular dependency with
320 ;; git-download, see https://issues.guix.gnu.org/63331
321 (method url-fetch)
322 (uri (string-append "mirror://gnu/gnutls/guile-gnutls-v"
323 version "-src.tar.gz"))
324 (sha256
325 (base32
326 "1g1v2l9iczfc1h662szcgaxgri403kam5flyjq6rpja4jixxbxjg"))))
327 (build-system gnu-build-system)
328 (outputs '("out" "debug"))
329 (arguments
330 (list
331 #:configure-flags
332 ;; Tell the build system that we want Guile bindings installed to the
333 ;; output instead of Guiles own module directory.
334 #~(list "--disable-static"
335 (string-append "--with-guile-site-dir="
336 "$(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)")
337 (string-append "--with-guile-site-ccache-dir="
338 "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache")
339 (string-append "--with-guile-extension-dir="
340 "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/extensions"))))
341 (native-inputs
342 (list libtool
343 autoconf automake
344 pkg-config
345 texinfo
346 gnutls
347 guile-3.0)) ;XXX: 'guile-snarf' invokes the native 'cpp'
348 (inputs
349 (list gnutls
350 guile-3.0))
351 (properties '((ftp-directory . "gnutls")))
352 (synopsis "Guile bindings to GnuTLS")
353 (description
354 "This package provides Guile bindings to GnuTLS, a library implementation
355the @acronym{TLS, Transport-Layer Security} protocol. It supersedes the Guile
356bindings that were formerly provided as part of GnuTLS.")
357 (license license:lgpl2.1+)))
358
359(define-public guile2.2-gnutls
360 (package/inherit guile-gnutls
361 (name "guile2.2-gnutls")
362 (native-inputs
363 (modify-inputs native-inputs
364 (replace "guile" guile-2.2)))
365 (inputs
366 (modify-inputs inputs
367 (replace "guile" guile-2.2)))))
368
369(define (target->openssl-target pkg target)
370 "Return the value to set CONFIGURE_TARGET_ARCH to when cross-compiling
371OpenSSL for TARGET."
372 ;; Keep this code outside the build code,
373 ;; such that new targets can be added
374 ;; without causing rebuilds for other targets.
375 (if (target-mingw? target)
376 (string-append
377 "mingw"
378 (if (target-x86-64? target)
379 "64"
380 ""))
381 (let ((kernel
382 (cond ((target-hurd? target)
383 "hurd")
384 ((and (target-linux? target)
385 (or (target-riscv64? target)
386 (target-loongarch64? target)))
387 "linux64")
388 ((target-linux? target)
389 "linux")
390 (else
391 (raise (condition
392 (&package-unsupported-target-error
393 (package pkg)
394 (target target)))))))
395 (arch
396 (cond
397 ((target-x86-32? target)
398 "x86")
399 ((target-x32? target)
400 "x32")
401 ((target-x86-64? target)
402 "x86_64")
403 ((target-mips64el? target)
404 "mips64")
405 ((target-arm32? target)
406 "armv4")
407 ((target-aarch64? target)
408 "aarch64")
409 ((target-ppc64le? target)
410 "ppc64le")
411 ((target-ppc32? target)
412 "ppc")
413 ((and (target-powerpc? target)
414 (target-64bit? target))
415 "ppc64")
416 ((target-loongarch64? target)
417 "loongarch64")
418 ((target-riscv64? target)
419 "riscv64")
420 ((target-64bit? target)
421 "generic64")
422 (else
423 (raise (condition
424 (&package-unsupported-target-error
425 (package pkg)
426 (target target))))))))
427 (string-append kernel "-" arch))))
428
429(define-public openssl-1.1
430 (package
431 (name "openssl")
432 (version "1.1.1w")
433 (source (origin
434 (method url-fetch)
435 (uri (list (string-append "https://www.openssl.org/source/openssl-"
436 version ".tar.gz")
437 (string-append "ftp://ftp.openssl.org/source/"
438 "openssl-" version ".tar.gz")
439 (string-append "ftp://ftp.openssl.org/source/old/"
440 (string-trim-right version char-set:letter)
441 "/openssl-" version ".tar.gz")))
442 (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
443 (sha256
444 (base32
445 "1j3anw4554lk3m9cvjngvh1c2gbdkhgiz160jnnm7n5l1jarhc6g"))))
446 (build-system gnu-build-system)
447 (outputs '("out"
448 "doc" ;6.8 MiB of man3 pages and full HTML documentation
449 "static")) ;6.4 MiB of .a files
450 (native-inputs (list perl))
451 (arguments
452 (list
453 #:make-flags
454 (if (or (target-arm?) (target-riscv64?))
455 ;; 'test_afalg' seems to be dependent on kernel features:
456 ;; <https://github.com/openssl/openssl/issues/12242>.
457 #~(list "TESTS=-test_afalg")
458 #~(list))
459 #:test-target "test"
460 ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
461 ;; so we explicitly disallow it here.
462 #:disallowed-references (list (this-package-native-input "perl"))
463 #:phases
464 #~(modify-phases %standard-phases
465 #$@(if (%current-target-system)
466 #~((add-before 'configure 'set-cross-compile
467 (lambda* (#:key target #:allow-other-keys)
468 (setenv "CROSS_COMPILE" (string-append target "-"))
469 (setenv "CONFIGURE_TARGET_ARCH"
470 #$(target->openssl-target
471 this-package
472 (%current-target-system))))))
473 #~())
474 #$@(if (target-hurd?)
475 #~((add-after 'unpack 'patch-configure
476 (lambda _
477 (substitute* "config"
478 (("case \"\\$GUESSOS\" in.*" all)
479 (string-append all "hurd-x86*) OUT=hurd-x86;;\n"))))))
480 #~())
481 (replace 'configure
482 (lambda* (#:key configure-flags #:allow-other-keys)
483 ;; It's not a shebang so patch-source-shebangs misses it.
484 (substitute* "config"
485 (("/usr/bin/env")
486 (which "env")))
487 (apply
488 invoke #$@(if (%current-target-system)
489 #~("./Configure")
490 #~("./config"))
491 "shared" ;build shared libraries
492 "--libdir=lib"
493
494 ;; The default for this catch-all directory is PREFIX/ssl.
495 ;; Change that to something more conventional.
496 (string-append "--openssldir=" #$output
497 "/share/openssl")
498
499 (string-append "--prefix=" #$output)
500 (string-append "-Wl,-rpath," (string-append #$output "/lib"))
501 #$@(if (%current-target-system)
502 #~((getenv "CONFIGURE_TARGET_ARCH"))
503 #~())
504 configure-flags)
505 ;; Output the configure variables.
506 (invoke "perl" "configdata.pm" "--dump")))
507 (add-after 'install 'move-static-libraries
508 (lambda _
509 ;; Move static libraries to the "static" output.
510 (let* ((lib (string-append #$output "/lib"))
511 (slib (string-append #$output:static "/lib")))
512 (for-each (lambda (file)
513 (install-file file slib)
514 (delete-file file))
515 (find-files
516 lib
517 #$(if (target-mingw?)
518 '(lambda (filename _)
519 (and (string-suffix? ".a" filename)
520 (not (string-suffix? ".dll.a"
521 filename))))
522 "\\.a$"))))))
523 (add-after 'install 'move-extra-documentation
524 (lambda _
525 ;; Move man pages and full HTML documentation to "doc".
526 (let* ((man (string-append #$output "/share/man"))
527 (html (string-append #$output "/share/doc/openssl"))
528 (man-target (string-append #$output:doc "/share/man"))
529 (html-target (string-append
530 #$output:doc "/share/doc/openssl")))
531 (mkdir-p (dirname man-target))
532 (mkdir-p (dirname html-target))
533 (rename-file man man-target)
534 (rename-file html html-target))))
535 (add-after 'install 'remove-miscellany
536 (lambda _
537 ;; The 'misc' directory contains random undocumented shell and
538 ;; Perl scripts. Remove them to avoid retaining a reference on
539 ;; Perl.
540 (delete-file-recursively
541 (string-append #$output "/share/openssl/misc")))))))
542 (native-search-paths
543 (list $SSL_CERT_DIR $SSL_CERT_FILE))
544 (synopsis "SSL/TLS implementation")
545 (description "OpenSSL is an implementation of SSL/TLS.")
546 (license license:openssl)
547 (home-page "https://www.openssl.org/")))
548
549(define-public openssl-3.5
550 ;; LTS series with EOL 2030-04-08
551 (package
552 (name "openssl")
553 (version "3.5.7")
554 (source (origin
555 (method url-fetch)
556 (uri (list (string-append "https://www.openssl.org/source/openssl-"
557 version ".tar.gz")
558 (string-append "ftp://ftp.openssl.org/source/"
559 "openssl-" version ".tar.gz")
560 (string-append "ftp://ftp.openssl.org/source/old/"
561 (string-trim-right version char-set:letter)
562 "/openssl-" version ".tar.gz")))
563 (patches (search-patches "openssl-3.0-c-rehash-in.patch"))
564 (sha256
565 (base32
566 "1s4qmjp33ai43ahlm3iw59aq86fj5hp7kxbcygwq194waa5d5h58"))))
567 (build-system gnu-build-system)
568 (outputs '("out"
569 "doc"
570 "static"))
571 (arguments
572 (list
573 #:parallel-tests? #f
574 #:make-flags
575 (if (or (target-arm?) (target-riscv64?))
576 ;; 'test_afalg' seems to be dependent on kernel features:
577 ;; <https://github.com/openssl/openssl/issues/12242>.
578 #~(list "TESTS=-test_afalg")
579 #~(list))
580 #:test-target "test"
581 #:configure-flags
582 (if (system-hurd?)
583 (if (target-hurd64?)
584 #~(list "hurd-x86_64")
585 #~(list "hurd-x86"))
586 #~(list))
587 ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
588 ;; so we explicitly disallow it here.
589 #:disallowed-references (list (this-package-native-input "perl"))
590 #:phases
591 #~(modify-phases %standard-phases
592 (replace 'configure
593 (lambda* (#:key configure-flags native-inputs inputs target #:allow-other-keys)
594 ;; It's not a shebang so patch-source-shebangs misses it.
595 (substitute* "config"
596 (("/usr/bin/env")
597 (which "env")))
598 #$@(if (%current-target-system)
599 #~((setenv "CROSS_COMPILE" (string-append target "-"))
600 (setenv "CONFIGURE_TARGET_ARCH"
601 #$(target->openssl-target
602 this-package
603 (%current-target-system))))
604 #~())
605 ;; Configure PERL.
606 (setenv "HASHBANGPERL"
607 (search-input-file (or native-inputs inputs)
608 "/bin/perl"))
609 (apply
610 invoke #$@(if (%current-target-system)
611 #~("./Configure")
612 #~("./config"))
613 "shared" ;build shared libraries
614 "--libdir=lib"
615
616 ;; The default for this catch-all directory is
617 ;; PREFIX/ssl. Change that to something more
618 ;; conventional.
619 (string-append "--openssldir=" #$output
620 "/share/openssl-"
621 #$(package-version this-package))
622
623 (string-append "--prefix=" #$output)
624 (string-append "-Wl,-rpath," (string-append #$output "/lib"))
625 #$@(if (%current-target-system)
626 #~((getenv "CONFIGURE_TARGET_ARCH"))
627 #~())
628 configure-flags)
629 ;; Output the configure variables.
630 (invoke "perl" "configdata.pm" "--dump")))
631 (add-after 'install 'move-static-libraries
632 (lambda _
633 ;; Move static libraries to the "static" output.
634 (let* ((lib (string-append #$output "/lib"))
635 (slib (string-append #$output:static "/lib")))
636 (for-each (lambda (file)
637 (install-file file slib)
638 (delete-file file))
639 (find-files
640 lib
641 #$(if (target-mingw?)
642 '(lambda (filename _)
643 (and (string-suffix? ".a" filename)
644 (not (string-suffix? ".dll.a"
645 filename))))
646 "\\.a$"))))))
647 (add-after 'install 'move-extra-documentation
648 (lambda _
649 ;; Move man pages and full HTML documentation to "doc".
650 (let* ((man (string-append #$output "/share/man"))
651 (html (string-append #$output "/share/doc/openssl"))
652 (man-target (string-append #$output:doc "/share/man"))
653 (html-target (string-append
654 #$output:doc "/share/doc/openssl")))
655 (mkdir-p (dirname man-target))
656 (mkdir-p (dirname html-target))
657 (rename-file man man-target)
658 (rename-file html html-target))))
659 (add-after 'install 'remove-miscellany
660 (lambda _
661 ;; The 'misc' directory contains random undocumented shell and
662 ;; Perl scripts. Remove them to avoid retaining a reference on
663 ;; Perl.
664 (delete-file-recursively
665 (string-append #$output "/share/openssl-"
666 #$(package-version this-package) "/misc")))))))
667 (native-inputs (list perl))
668 (native-search-paths
669 (list $SSL_CERT_DIR $SSL_CERT_FILE))
670 (home-page "https://www.openssl.org/")
671 (synopsis "SSL/TLS implementation")
672 (description "OpenSSL is an implementation of SSL/TLS.")
673 (license license:asl2.0)))
674
675(define-public openssl-3.0
676 ;; LTS series with EOL 2026-09-07
677 (package
678 (inherit openssl-3.5)
679 (version "3.0.19")
680 (source (origin
681 (method url-fetch)
682 (uri (list (string-append "https://www.openssl.org/source/openssl-"
683 version ".tar.gz")
684 (string-append "ftp://ftp.openssl.org/source/"
685 "openssl-" version ".tar.gz")
686 (string-append "ftp://ftp.openssl.org/source/old/"
687 (string-trim-right version char-set:letter)
688 "/openssl-" version ".tar.gz")))
689 (patches (search-patches "openssl-3.0-c-rehash-in.patch"
690 "openssl-hurd64.patch"))
691 (sha256
692 (base32
693 "0wihnr5bjdc3v0r4viwb1d1lf1rfkbrcmwzj7vjqpqdap11l2nps"))))))
694
695(define-public openssl openssl-3.5)
696
697(define-public bearssl
698 (package
699 (name "bearssl")
700 (version "0.6")
701 (source (origin
702 (method url-fetch)
703 (uri (string-append "https://www.bearssl.org/"
704 "bearssl-" version ".tar.gz"))
705 (sha256
706 (base32
707 "057zhgy9w4y8z2996r0pq5k2k39lpvmmvz4df8db8qa9f6hvn1b7"))))
708 (build-system gnu-build-system)
709 (arguments
710 (list
711 #:make-flags
712 #~(list #$(string-append "CC=" (cc-for-target))
713 #$(string-append "LD=" (cc-for-target))
714 #$(string-append "LDDLL=" (cc-for-target)))
715 #:phases
716 #~(modify-phases %standard-phases
717 (delete 'configure) ;no configure script
718 (replace 'check
719 (lambda* (#:key tests? #:allow-other-keys)
720 (when tests?
721 (with-directory-excursion "build"
722 (invoke "./testcrypto" "all")
723 (invoke "./testx509")))))
724 (replace 'install ;no install rule
725 (lambda _
726 (let* ((out #$output)
727 (bin (string-append out "/bin"))
728 (doc (string-append out "/share/doc/" #$name "-" #$version))
729 (lib (string-append out "/lib"))
730 (include (string-append out "/include")))
731 (install-file "build/brssl" bin)
732 (for-each (lambda (f) (install-file f include))
733 (find-files "inc" "\\.h$"))
734 (install-file "LICENSE.txt" doc)
735 (install-file "build/libbearssl.so" lib)))))))
736 (home-page "https://bearssl.org/")
737 (synopsis "Small SSL/TLS library")
738 (description "BearSSL is an implementation of the SSL/TLS
739protocol (RFC 5246) written in C. It aims at being correct and
740secure. In particular, insecure protocol versions and choices of
741algorithms are not supported, by design; cryptographic algorithm
742implementations are constant-time by default. It should also be
743small, both in RAM and code footprint. For instance, a minimal server
744implementation may fit in about 20 kilobytes of compiled code and 25
745kilobytes of RAM.")
746 (license license:expat)))
747
748(define-public libressl
749 (package
750 (name "libressl")
751 (version "4.3.2")
752 (source (origin
753 (method url-fetch)
754 (uri (string-append "mirror://openbsd/LibreSSL/"
755 "libressl-" version ".tar.gz"))
756 (sha256
757 (base32
758 "1da712lxzqclwyavvfzkskwjys6spi29vjzgm7k6jpf64kp1mw7d"))))
759 (outputs (list "out" "debug"))
760 (build-system gnu-build-system)
761 (arguments
762 (list
763 #:configure-flags
764 #~(list
765 ;; Do as if 'getentropy' were missing: Linux kernels before 3.17 lack its
766 ;; underlying 'getrandom' system call and ENOSYS isn't properly handled.
767 ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
768 "ac_cv_func_getentropy=no"
769 ;; FIXME It's using it's own bundled certificate, instead it should
770 ;; behave like OpenSSL by using environment variables.
771 (string-append "--with-openssldir=" #$output
772 "/share/libressl-" #$(package-version this-package))
773 ;; Provide a TLS-enabled netcat.
774 "--enable-nc")))
775 (properties
776 `((release-monitoring-url . "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/")))
777 (home-page "https://www.libressl.org/")
778 (synopsis "SSL/TLS implementation")
779 (description "LibreSSL is a version of the TLS/crypto stack, forked from
780OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
781and applying best practice development processes. This package also includes a
782netcat implementation that supports TLS.")
783 ;; Files taken from OpenSSL keep their license, others are under various
784 ;; non-copyleft licenses.
785 (license (list license:openssl
786 (license:non-copyleft
787 "file://COPYING"
788 "See COPYING in the distribution.")))))
789
790(define-public python-acme
791 (package
792 (name "python-acme")
793 ;; Remember to update the hash of certbot when updating python-acme.
794 (version "4.2.0")
795 (source
796 (origin
797 (method url-fetch)
798 (uri (pypi-uri "acme" version))
799 (sha256
800 (base32 "0h8ckyal5j8lkm24fd52dajy38mxa76zh4q022i28f6b3878rxhd"))))
801 (build-system pyproject-build-system)
802 (arguments
803 (list
804 #:phases
805 #~(modify-phases %standard-phases
806 (add-after 'unpack 'relax-requirements
807 (lambda _
808 (substitute* "setup.py"
809 (("'PyOpenSSL.*',")
810 "'PyOpenSSL',"))))
811 (add-after 'build 'build-documentation
812 (lambda _
813 (invoke "make" "-C" "docs" "man" "info")))
814 (add-after 'install 'install-documentation
815 (lambda _
816 (let ((man (string-append #$output "/share/man/man1"))
817 (info (string-append #$output "/info")))
818 (install-file "docs/_build/texinfo/acme-python.info" info)
819 (install-file "docs/_build/man/acme-python.1" man)))))))
820 (native-inputs
821 (list python-pytest
822 python-pytest-xdist
823 python-setuptools
824 python-wheel
825 ;; For documentation
826 python-sphinx
827 python-sphinxcontrib-programoutput
828 python-sphinx-rtd-theme
829 texinfo))
830 (propagated-inputs
831 (list python-cryptography
832 python-josepy
833 python-pyopenssl
834 python-pyrfc3339
835 python-requests))
836 (home-page "https://github.com/certbot/certbot")
837 (synopsis "ACME protocol implementation in Python")
838 (description "ACME protocol implementation in Python")
839 (license license:asl2.0)))
840
841(define-public certbot
842 (package
843 (name "certbot")
844 ;; Certbot and python-acme are developed in the same repository, and their
845 ;; versions should remain synchronized.
846 (version (package-version python-acme))
847 (source
848 (origin
849 (method url-fetch)
850 (uri (pypi-uri "certbot" version))
851 (sha256
852 (base32 "0yy287h1sjdkm5cj4wazq316igwwla856yqcmi4yqaq7ib55c7pv"))))
853 (build-system pyproject-build-system)
854 (arguments
855 (substitute-keyword-arguments (package-arguments python-acme)
856 ((#:test-flags flags '())
857 ;; XXX: No time zone found with key Asia/Sanghai, pytz version?
858 #~(list "-k" "not test_add_time_interval"))
859 ((#:phases phases)
860 #~(modify-phases #$phases
861 (replace 'install-documentation
862 (lambda* (#:key outputs #:allow-other-keys)
863 (let ((man1 (string-append #$output "/share/man/man1"))
864 (man7 (string-append #$output "/share/man/man7"))
865 (info (string-append #$output "/info")))
866 (install-file "docs/_build/texinfo/Certbot.info" info)
867 (install-file "docs/_build/man/certbot.1" man1)
868 (install-file "docs/_build/man/certbot.7" man7))))))))
869 (native-inputs
870 (list python-mock
871 python-pytest
872 python-setuptools
873 python-wheel
874 ;; For documentation
875 python-sphinx
876 python-sphinx-rtd-theme
877 python-sphinx-repoze-autointerface
878 python-sphinxcontrib-programoutput
879 texinfo))
880 (propagated-inputs
881 (list python-acme
882 python-cryptography
883 python-pyrfc3339
884 python-pyopenssl
885 python-configobj
886 python-configargparse
887 python-distro
888 python-parsedatetime
889 python-psutil
890 python-requests
891 python-pytz))
892 (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
893 (description
894 "Certbot automatically receives and installs X.509 certificates to enable
895Transport Layer Security (TLS) on servers. It interoperates with the
896Let’s Encrypt certificate authority (CA), which issues browser-trusted
897certificates for free.")
898 (home-page "https://certbot.eff.org/")
899 (license license:asl2.0)))
900
901(define-public uacme
902 (package
903 (name "uacme")
904 (version "1.8.1")
905 (source
906 (origin
907 (method git-fetch)
908 (uri (git-reference
909 (url "https://github.com/ndilieto/uacme/")
910 (commit (string-append "v" version))))
911 (file-name (git-file-name name version))
912 (sha256
913 (base32
914 "13s7rzcm0w1rxfr0yi7hyilj69pb0q7n56ag2id76c9vwras6a2f"))))
915 (build-system gnu-build-system)
916 (arguments
917 (list
918 #:phases
919 #~(modify-phases %standard-phases
920 (add-after 'unpack 'set-version
921 (lambda _
922 (substitute* "configure.ac"
923 (((string-append
924 "m4_esyscmd\\(\\[build-aux/git-version-gen "
925 "\\.tarball-version\\]\\)"))
926 #$version)))))))
927 (inputs
928 (list curl gnutls))
929 (native-inputs
930 (list asciidoc
931 autoconf
932 automake
933 pkg-config))
934 (home-page "https://github.com/ndilieto/uacme")
935 (synopsis "Minimal ACMEv2 client written in C")
936 (description "Uacme is a lightweight client for the RFC8555 ACMEv2
937protocol, written in plain C with minimal dependencies.")
938 (license license:gpl3+)))
939
940(define-public perl-net-ssleay
941 (package
942 (name "perl-net-ssleay")
943 (version "1.96")
944 (source (origin
945 (method url-fetch)
946 (uri (string-append "mirror://cpan/authors/id/C/CH/CHRISN/"
947 "Net-SSLeay-" version ".tar.gz"))
948 (sha256
949 (base32
950 "0lq7zjnr82q3qjvibbb32ninb0bg4vcwijv9qrvabcjzd28kc8db"))
951 (patches (search-patches "perl-net-ssleay-colon-parsing.patch"))))
952 (build-system perl-build-system)
953 (inputs (list openssl))
954 (arguments
955 (list
956 #:phases
957 #~(modify-phases %standard-phases
958 (add-before
959 'configure 'set-ssl-prefix
960 (lambda* (#:key inputs #:allow-other-keys)
961 (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl")))))))
962 (synopsis "Perl extension for using OpenSSL")
963 (description
964 "This module offers some high level convenience functions for accessing
965web pages on SSL servers (for symmetry, the same API is offered for accessing
966http servers, too), an sslcat() function for writing your own clients, and
967finally access to the SSL api of the SSLeay/OpenSSL package so you can write
968servers or clients for more complicated applications.")
969 (license license:perl-license)
970 (home-page "https://metacpan.org/release/Net-SSLeay")))
971
972(define-public perl-crypt-openssl-rsa
973 (package
974 (name "perl-crypt-openssl-rsa")
975 (version "0.33")
976 (source
977 (origin
978 (method url-fetch)
979 (uri (string-append
980 "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
981 version
982 ".tar.gz"))
983 (sha256
984 (base32
985 "0r6qxx2nyvdsv859zl8vz17ndj1a4xvrknbafhjh6m3gdl7n7gmx"))))
986 (build-system perl-build-system)
987 (native-inputs
988 (list perl-crypt-openssl-guess))
989 (inputs
990 (list perl-crypt-openssl-bignum perl-crypt-openssl-random openssl))
991 (arguments perl-crypt-arguments)
992 (home-page
993 "https://metacpan.org/release/Crypt-OpenSSL-RSA")
994 (synopsis
995 "RSA encoding and decoding, using the openSSL libraries")
996 (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
997OpenSSL libraries).")
998 (license license:perl-license)))
999
1000(define perl-crypt-arguments
1001 `(#:phases (modify-phases %standard-phases
1002 (add-before 'configure 'patch-Makefile.PL
1003 (lambda* (#:key inputs #:allow-other-keys)
1004 (substitute* "Makefile.PL"
1005 (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
1006 (assoc-ref inputs "openssl")
1007 "/lib -lcrypto'],")))
1008 #t)))))
1009
1010(define-public perl-crypt-openssl-bignum
1011 (package
1012 (name "perl-crypt-openssl-bignum")
1013 (version "0.09")
1014 (source
1015 (origin
1016 (method url-fetch)
1017 (uri (string-append
1018 "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
1019 version
1020 ".tar.gz"))
1021 (sha256
1022 (base32
1023 "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
1024 (build-system perl-build-system)
1025 (inputs (list openssl))
1026 (arguments perl-crypt-arguments)
1027 (home-page
1028 "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
1029 (synopsis
1030 "OpenSSL's multiprecision integer arithmetic in Perl")
1031 (description "Crypt::OpenSSL::Bignum provides multiprecision integer
1032arithmetic in Perl.")
1033 ;; At your option either gpl1+ or the Artistic License
1034 (license license:perl-license)))
1035
1036(define-public perl-crypt-openssl-guess
1037 (package
1038 (name "perl-crypt-openssl-guess")
1039 (version "0.11")
1040 (source
1041 (origin
1042 (method url-fetch)
1043 (uri (string-append
1044 "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
1045 version ".tar.gz"))
1046 (sha256
1047 (base32
1048 "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
1049 (build-system perl-build-system)
1050 (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
1051 (synopsis "Guess the OpenSSL include path")
1052 (description
1053 "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
1054correct OpenSSL include path. It is intended for use in your
1055@file{Makefile.PL}.")
1056 (license license:perl-license)))
1057
1058(define-public perl-crypt-openssl-random
1059 (package
1060 (name "perl-crypt-openssl-random")
1061 (version "0.15")
1062 (source
1063 (origin
1064 (method url-fetch)
1065 (uri (string-append
1066 "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
1067 version
1068 ".tar.gz"))
1069 (sha256
1070 (base32 "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh"))))
1071 (build-system perl-build-system)
1072 (native-inputs
1073 (list perl-crypt-openssl-guess))
1074 (inputs
1075 (list openssl))
1076 (arguments perl-crypt-arguments)
1077 (home-page
1078 "https://metacpan.org/release/Crypt-OpenSSL-Random")
1079 (synopsis
1080 "OpenSSL/LibreSSL pseudo-random number generator access")
1081 (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
1082number generator")
1083 (license license:perl-license)))
1084
1085(define-public mbedtls
1086 (package
1087 (name "mbedtls")
1088 (version "4.2.0")
1089 (source
1090 (origin
1091 (method url-fetch)
1092 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1093 "/download/mbedtls-" version
1094 "/mbedtls-" version ".tar.bz2"))
1095 (sha256
1096 (base32 "1spzwsylnlld4apdfh592bqwh2x3i8myg5xhadjzfs267dqrvv9b"))))
1097 (build-system cmake-build-system)
1098 (arguments
1099 (list #:parallel-tests? #f
1100 #:configure-flags
1101 #~(list "-DMBEDTLS_FATAL_WARNINGS=OFF"
1102 "-DUSE_SHARED_MBEDTLS_LIBRARY=ON"
1103 "-DUSE_STATIC_MBEDTLS_LIBRARY=OFF")
1104 #:phases
1105 #~(modify-phases %standard-phases
1106 (add-after 'unpack 'make-source-writable
1107 (lambda _
1108 (for-each make-file-writable (find-files ".")))))))
1109 (native-inputs
1110 (list perl python))
1111 (synopsis "Small TLS library")
1112 (description
1113 "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
1114for developers to include cryptographic and SSL/TLS capabilities in their
1115(embedded) products, facilitating this functionality with a minimal
1116coding footprint.")
1117 (home-page "https://www.trustedfirmware.org/projects/mbed-tls/")
1118 (license (list license:asl2.0 license:gpl2+)))) ;dual licensed
1119
1120(define-public mbedtls-4.0
1121 (hidden-package
1122 (package
1123 (inherit mbedtls)
1124 (version "4.0.0")
1125 (source
1126 (origin
1127 (method url-fetch)
1128 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1129 "/download/mbedtls-" version
1130 "/mbedtls-" version ".tar.bz2"))
1131 (sha256
1132 (base32 "09r8pzbflhvd3nhz74v0fzvjxkmpxkp6fj0f8ppxshd5ngvlffig")))))))
1133
1134(define-public mbedtls-3
1135 (package
1136 (inherit mbedtls)
1137 (version "3.6.7")
1138 (source
1139 (origin
1140 (method url-fetch)
1141 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1142 "/download/mbedtls-" version
1143 "/mbedtls-" version ".tar.bz2"))
1144 (sha256
1145 (base32 "1xhi5lhn78vphv07kvwfyrigfdbbc9vmdwi4mys63xz6q2zbrs57"))))))
1146
1147;;; TODO: No longer maintained, migrate dependents to current mbedtls.
1148(define-public mbedtls-lts
1149 (package
1150 (inherit mbedtls)
1151 (name "mbedtls")
1152 (version "2.28.9")
1153 (source
1154 (origin
1155 (method git-fetch)
1156 (uri (git-reference
1157 (url "https://github.com/ARMmbed/mbedtls")
1158 (commit (string-append "mbedtls-" version))))
1159 (file-name (git-file-name name version))
1160 (sha256
1161 (base32 "0ldqhvmj9wl0yp3hz675zbnq69lw533s0ahy9bbdxxnj5gjb86gw"))))))
1162
1163;; The Hiawatha Web server requires some specific features to be enabled.
1164(define-public mbedtls-for-hiawatha
1165 (hidden-package
1166 (package/inherit mbedtls
1167 (arguments
1168 (substitute-keyword-arguments arguments
1169 ((#:phases phases)
1170 #~(modify-phases #$phases
1171 (add-before 'configure 'configure-extra-features
1172 (lambda _
1173 (for-each (lambda (feature)
1174 (invoke "scripts/config.pl" "set" feature))
1175 (list "MBEDTLS_THREADING_C"
1176 "MBEDTLS_THREADING_PTHREAD")))))))))))
1177
1178(define-public dehydrated
1179 (package
1180 (name "dehydrated")
1181 (version "0.7.1")
1182 (source
1183 (origin
1184 (method git-fetch)
1185 (uri (git-reference
1186 (url "https://github.com/dehydrated-io/dehydrated")
1187 (commit (string-append "v" version))))
1188 (file-name (git-file-name name version))
1189 (sha256
1190 (base32 "1mhf3v9ynwrxrkqawqpxnwfn5dmrlkqcvkxdrk59nkxjpdx1wkrb"))))
1191 (build-system trivial-build-system)
1192 (arguments
1193 (list
1194 #:modules '((guix build utils))
1195 #:builder
1196 #~(begin
1197 (use-modules (guix build utils)
1198 (srfi srfi-26))
1199 (let* ((source (assoc-ref %build-inputs "source"))
1200 (gzip (search-input-file %build-inputs "bin/gzip"))
1201 (bin (string-append #$output "/bin"))
1202 (doc (string-append #$output "/share/doc/"
1203 #$name "-" #$version))
1204 (man (string-append #$output "/share/man"))
1205 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
1206
1207 (chdir source)
1208
1209 (copy-recursively "docs" doc)
1210 (install-file "LICENSE" doc)
1211
1212 (mkdir-p man)
1213 (rename-file (string-append doc "/man")
1214 (string-append man "/man1"))
1215 (for-each (cut invoke gzip "-9n" <>)
1216 (find-files man ".*"))
1217
1218 (install-file "dehydrated" bin)
1219 (with-directory-excursion bin
1220 (patch-shebang "dehydrated" (list bash))
1221
1222 ;; Do not try to write to the store.
1223 (substitute* "dehydrated"
1224 (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
1225
1226 (setenv "PATH" bash)
1227 (wrap-program "dehydrated"
1228 `("PATH" ":" prefix
1229 ,(map (lambda (file)
1230 (dirname (search-input-file %build-inputs file)))
1231 (list
1232 ;; From check_dependencies() — keep them in sync.
1233 "bin/grep"
1234 "bin/diff"
1235 "bin/sed"
1236 "bin/awk"
1237 "bin/curl"
1238 "bin/cut" ; also mktemp, head, tail
1239 "bin/hexdump"
1240 ;; Additional requirements.
1241 "bin/openssl")))))))))
1242 (inputs
1243 (list bash
1244 coreutils
1245 curl
1246 diffutils
1247 gawk
1248 grep
1249 openssl
1250 sed
1251 util-linux+udev))
1252 (native-inputs
1253 (list gzip))
1254 ;; The following definition is copied from the cURL package to prevent a
1255 ;; cycle between the curl and tls modules.
1256 (native-search-paths
1257 (list (search-path-specification
1258 (variable "CURL_CA_BUNDLE")
1259 (file-type 'regular)
1260 (separator #f)
1261 (files '("etc/ssl/certs/ca-certificates.crt")))))
1262 (home-page "https://dehydrated.io/")
1263 (synopsis "ACME client implemented as a shell script")
1264 (description "Dehydrated is a client for obtaining certificates from an
1265ACME server (such as Let's Encrypt) implemented as a relatively simple Bash
1266script.")
1267 (license license:expat)))
1268
1269(define-public s2n
1270 (package
1271 (name "s2n")
1272 ;; Update only when updating aws-crt-cpp.
1273 (version "1.5.15")
1274 (source (origin
1275 (method git-fetch)
1276 (uri (git-reference
1277 (url "https://github.com/aws/s2n-tls")
1278 (commit (string-append "v" version))))
1279 (file-name (git-file-name name version))
1280 (sha256
1281 (base32
1282 "0b8ym4ns56fa5pkrvsm5kghh8mii0q0kc1mz2plg1ypm5zny02kw"))))
1283 (build-system cmake-build-system)
1284 (arguments
1285 '(#:configure-flags
1286 '("-DBUILD_SHARED_LIBS=ON")))
1287 (propagated-inputs (list aws-lc))
1288 (supported-systems %64bit-supported-systems)
1289 (synopsis "SSL/TLS implementation in C99")
1290 (description
1291 "This library provides a C99 implementation of SSL/TLS. It is designed to
1292be familiar to users of the widely-used POSIX I/O APIs. It supports blocking,
1293non-blocking, and full-duplex I/O. There are no locks or mutexes.
1294
1295As it can be difficult to keep track of which encryption algorithms and
1296protocols are best to use, s2n-tls features a simple API to use the latest
1297default set of preferences. Remaining on a specific version for backwards
1298compatibility is also supported.")
1299 (home-page "https://github.com/aws/s2n-tls")
1300 (license license:asl2.0)))
1301
1302(define-public wolfssl
1303 (package
1304 (name "wolfssl")
1305 (version "5.7.6")
1306 (source (origin
1307 (method git-fetch)
1308 (uri (git-reference
1309 (url "https://github.com/wolfSSL/wolfssl")
1310 (commit (string-append "v" version "-stable"))))
1311 (file-name (git-file-name name version))
1312 (sha256
1313 (base32
1314 "1q1sqwx6njsjbwmwr87ky0yrg2cin7ssa12gl14i8x1v35rpcxdb"))))
1315 (build-system gnu-build-system)
1316 (arguments
1317 (list #:configure-flags
1318 #~(list "--enable-distro"
1319 "--enable-pkcs11"
1320 "--disable-examples"
1321 "--enable-jobserver=no")))
1322 (native-inputs
1323 (list autoconf automake libtool))
1324 (synopsis "SSL/TLS implementation")
1325 (description "The wolfSSL embedded SSL library (formerly CyaSSL) is an
1326SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and
1327resource-constrained environments - primarily because of its small size, speed,
1328and feature set. wolfSSL supports industry standards up to the current TLS 1.3
1329and DTLS 1.2, is up to 20 times smaller than OpenSSL, and offers progressive
1330ciphers such as ChaCha20, Curve25519, NTRU, and Blake2b.")
1331 (home-page "https://www.wolfssl.com/")
1332 (license license:gpl2+))) ; Audit
1333
1334(define-public wolfssl-for-rpcs3
1335 (package/inherit wolfssl
1336 (name "wolfssl-for-rpcs3")
1337 (arguments
1338 (substitute-keyword-arguments arguments
1339 ((#:configure-flags flags ''())
1340 #~(cons* "--enable-des3"
1341 "--enable-pwdbased"
1342 "--enable-fastmath"
1343 "--enable-opensslextra"
1344 "--disable-harden"
1345 "--enable-altcertchains"
1346 "--enable-writedup"
1347 #$flags))))))
1348
1349(define-public aws-lc
1350 (package
1351 (name "aws-lc")
1352 ;; Update only when updating aws-crt-cpp.
1353 (version "1.48.5")
1354 (source (origin
1355 (method git-fetch)
1356 (uri (git-reference
1357 (url (string-append "https://github.com/awslabs/" name))
1358 (commit (string-append "v" version))))
1359 (file-name (git-file-name name version))
1360 (sha256
1361 (base32
1362 "1hgfsl3plpiljasvxxdhz37n5lc6j819djq3nlf59pw4fivfy6mv"))))
1363 (build-system cmake-build-system)
1364 (native-inputs (list perl))
1365 (arguments
1366 (list
1367 #:configure-flags
1368 #~(list "-DBUILD_SHARED_LIBS=ON" "-DDISABLE_GO=ON")
1369 #:modules '((guix build cmake-build-system)
1370 ((guix build gnu-build-system) #:prefix gnu:)
1371 (guix build utils))
1372 #:phases
1373 #~(modify-phases %standard-phases
1374 (replace 'check
1375 (lambda* (#:rest args)
1376 (apply (assoc-ref gnu:%standard-phases 'check)
1377 #:test-target "run_minimal_tests" args))))))
1378 (synopsis "General purpose cryptographic library")
1379 (description "AWS libcrypto (aws-lc) contains portable C implementations
1380of algorithms needed for TLS and common applications, and includes optimized
1381assembly versions for x86 and ARM.")
1382 (home-page "https://github.com/awslabs/aws-lc")
1383 (license license:asl2.0)))