projects/guix·blob javascript-team · refs

434 lines · 19.1 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2013-2019, 2023, 2026 Ludovic Courtès <[email protected]>
3;;; Copyright © 2014-2021 Mark H Weaver <[email protected]>
4;;; Copyright © 2016-2019, 2021-2024 Efraim Flashner <[email protected]>
5;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <[email protected]>
6;;; Copyright © 2020, 2021 Marius Bakke <[email protected]>
7;;; Copyright © 2020 Jonathan Brielmaier <[email protected]>
8;;; Copyright © 2021-2025 Maxim Cournoyer <[email protected]>
9;;; Copyright © 2021 Maxime Devos <[email protected]>
10;;; Copyright © 2024 Zheng Junjie <[email protected]>
11;;;
12;;; This file is part of GNU Guix.
13;;;
14;;; GNU Guix is free software; you can redistribute it and/or modify it
15;;; under the terms of the GNU General Public License as published by
16;;; the Free Software Foundation; either version 3 of the License, or (at
17;;; your option) any later version.
18;;;
19;;; GNU Guix is distributed in the hope that it will be useful, but
20;;; WITHOUT ANY WARRANTY; without even the implied warranty of
21;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22;;; GNU General Public License for more details.
23;;;
24;;; You should have received a copy of the GNU General Public License
25;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
26
27(define-module (gnu packages nss)
28 #:use-module (guix packages)
29 #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR $SSL_CERT_FILE))
30 #:use-module (guix utils)
31 #:use-module (guix gexp)
32 #:use-module (guix download)
33 #:use-module (guix git-download)
34 #:use-module (guix build-system cargo)
35 #:use-module (guix build-system gnu)
36 #:use-module (guix build-system mozilla)
37 #:use-module (guix build-system trivial)
38 #:use-module ((guix licenses) #:prefix license:)
39 #:use-module (gnu packages)
40 #:use-module (gnu packages base)
41 #:use-module (gnu packages bash)
42 #:use-module (gnu packages certs)
43 #:use-module (gnu packages check)
44 #:use-module (gnu packages compression)
45 #:use-module (gnu packages perl)
46 #:use-module (gnu packages sqlite)
47 #:use-module (gnu packages time)
48 #:use-module (gnu packages tls)
49 #:use-module (srfi srfi-1)
50 #:use-module (srfi srfi-26))
51
52(define-public nspr
53 (package
54 (name "nspr")
55 (version "4.36")
56 (source (origin
57 (method url-fetch)
58 (uri (string-append
59 "https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v"
60 version "/src/nspr-" version ".tar.gz"))
61 (sha256
62 (base32
63 "15b83ipjxrmw0909l5qqz13pbarhp50d6i58vgjx4720y4bw7pjm"))))
64 (build-system gnu-build-system)
65 (inputs
66 (list perl ;for 'compile-et.pl'
67 bash-minimal)) ;for 'nspr-config'
68 (native-inputs
69 (list perl))
70 (arguments
71 (list
72 ;; Prevent the 'native' perl from sneaking into the closure.
73 ;; XXX it would be nice to do the same for 'bash-minimal',
74 ;; but using 'canonical-package' causes loops.
75 #:disallowed-references
76 (if (%current-target-system)
77 (list (gexp-input (this-package-native-input "perl") #:native? #t))
78 #f)
79 #:tests? #f ;no check target
80 #:configure-flags
81 #~(list "--disable-static"
82 "--enable-64bit"
83 (string-append "LDFLAGS=-Wl,-rpath="
84 (assoc-ref %outputs "out") "/lib")
85 #$@(if (%current-target-system)
86 #~("HOST_CC=gcc")
87 #~()))
88 ;; Use fixed timestamps for reproducibility.
89 #:make-flags #~'("SH_DATE='1970-01-01 00:00:01'"
90 ;; This is epoch 1 in microseconds.
91 "SH_NOW=100000")
92 #:phases #~(modify-phases %standard-phases
93 (add-before 'configure 'chdir
94 (lambda _ (chdir "nspr") #t)))))
95 (home-page
96 "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR")
97 (synopsis "Netscape API for system level and libc-like functions")
98 (description "Netscape Portable Runtime (@dfn{NSPR}) provides a
99platform-neutral API for system level and libc-like functions. It is used
100in the Mozilla clients.")
101 (license license:mpl2.0)))
102
103(define-public nss
104 (package
105 (name "nss")
106 (version "3.112.5") ;update to latest ESR release
107 (source (origin
108 (method url-fetch)
109 (uri (let ((version-with-underscores
110 (string-join (string-split version #\.) "_")))
111 (string-append
112 "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
113 "releases/NSS_" version-with-underscores "_RTM/src/"
114 "nss-" version ".tar.gz")))
115 (sha256
116 (base32
117 "03chsv0bjd2fi8lab241grbyqd4blapll5lbrpraddpd5mc8rjx4"))
118 ;; Create nss.pc and nss-config.
119 (patches (search-patches "nss-3.56-pkgconfig.patch"
120 "nss-getcwd-nonnull.patch"
121 "nss-increase-test-timeout.patch"
122 "nss-3.115-disable-broken-tests.patch"
123 "nss-3.115-disable-pkix-ocsp-tests.patch"))
124 (modules '((guix build utils)))
125 (snippet
126 '(begin
127 ;; Delete the bundled copy of these libraries.
128 (delete-file-recursively "nss/lib/zlib")
129 (delete-file-recursively "nss/lib/sqlite")))))
130 (build-system gnu-build-system)
131 (outputs '("out" "bin" "static")) ;11 MiB of static archives
132 (arguments
133 (list
134 #:make-flags
135 #~(let ((rpath (string-append "-Wl,-rpath=" #$output "/lib/nss")))
136 (list "-C" "nss"
137 (string-append "PREFIX=" #$output)
138 "NSDISTMODE=copy"
139 "NSS_USE_SYSTEM_SQLITE=1"
140 ;; The gtests fail to compile on riscv64.
141 ;; Skipping them doesn't affect the test suite.
142 #$@(if (target-riscv64?)
143 #~("NSS_DISABLE_GTESTS=1")
144 #~())
145 ;; Ensure we are building for the (%current-target-system).
146 #$@(if (%current-target-system)
147 #~((string-append
148 "OS_TEST="
149 (string-take #$(%current-target-system)
150 (string-index #$(%current-target-system) #\-)))
151 (string-append
152 "KERNEL=" (cond (#$(target-hurd?) "gnu")
153 (#$(target-linux?) "linux")
154 (else ""))))
155 #~())
156 #$@(if (%current-target-system)
157 #~("CROSS_COMPILE=1")
158 #~())
159 (string-append "NSPR_INCLUDE_DIR="
160 (search-input-directory %build-inputs
161 "include/nspr"))
162 ;; Add $out/lib/nss to RPATH.
163 (string-append "RPATH=" rpath)
164 (string-append "LDFLAGS=" rpath)))
165 #:modules '((guix build gnu-build-system)
166 (guix build utils)
167 (ice-9 ftw)
168 (ice-9 match)
169 (srfi srfi-26))
170 #:tests? (not (or (%current-target-system)
171 ;; Tests take more than 30 hours on some architectures.
172 (target-riscv64?)
173 (target-ppc32?)))
174 #:phases
175 #~(modify-phases %standard-phases
176 ;; The "PayPalEE.cert" certificate expires every six months, leading
177 ;; to test failures:
178 ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To work
179 ;; around that, set the time to roughly the release date.
180 (add-after 'unpack 'set-release-date
181 (lambda _
182 (setenv "GUIX_NSS_RELEASE_DATE" "2025-02-05")))
183 (replace 'configure
184 (lambda _
185 (setenv "CC" #$(cc-for-target))
186 (setenv "CCC" #$(cxx-for-target))
187 (setenv "NATIVE_CC" "gcc")
188 ;; No VSX on powerpc-linux.
189 #$@(if (target-ppc32?)
190 #~((setenv "NSS_DISABLE_CRYPTO_VSX" "1"))
191 #~())
192 ;; Tells NSS to build for the 64-bit ABI if we are 64-bit system.
193 #$@(if (target-64bit?)
194 #~((setenv "USE_64" "1"))
195 #~())))
196 (replace 'check
197 (lambda* (#:key tests? #:allow-other-keys)
198 (if tests?
199 (begin
200 ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
201 ;; testing. The latter requires a working DNS or /etc/hosts.
202 (setenv "DOMSUF" "localdomain")
203 (setenv "USE_IP" "TRUE")
204 (setenv "IP_ADDRESS" "127.0.0.1")
205
206 ;; This specific test is looking at performance "now
207 ;; verify that we can quickly dump a database", and
208 ;; we're not testing performance here (especially
209 ;; since we're using faketime), so raise the
210 ;; threshold
211 (substitute* "nss/tests/dbtests/dbtests.sh"
212 ((" -lt 5") " -lt 50"))
213
214 #$@(if (target-64bit?)
215 '()
216 ;; The script fails to determine the source
217 ;; directory when running under 'datefudge' (see
218 ;; <https://issues.guix.gnu.org/72239>). Help it.
219 #~((substitute* "nss/tests/gtests/gtests.sh"
220 (("SOURCE_DIR=.*")
221 (string-append "SOURCE_DIR=" (getcwd) "/nss\n")))))
222
223
224 (let ((release-date (getenv "GUIX_NSS_RELEASE_DATE")))
225 (when (string=? "" release-date)
226 (raise-exception "`GUIX_NSS_RELEASE_DATE' unset"))
227 (invoke #$(if (target-64bit?) "faketime" "datefudge")
228 release-date "./nss/tests/all.sh")))
229 (format #t "test suite not run~%"))))
230 (replace 'install
231 (lambda _
232 (let* ((inc (string-append #$output "/include/nss"))
233 (lib (string-append #$output "/lib/nss"))
234 (obj (match (scandir "dist" (cut string-suffix? "OBJ" <>))
235 ((obj) (string-append "dist/" obj)))))
236 ;; Install nss-config to $out/bin.
237 (install-file (string-append obj "/bin/nss-config")
238 (string-append #$output "/bin"))
239 (delete-file (string-append obj "/bin/nss-config"))
240 ;; Install nss.pc to $out/lib/pkgconfig.
241 (install-file (string-append obj "/lib/pkgconfig/nss.pc")
242 (string-append #$output "/lib/pkgconfig"))
243 (delete-file (string-append obj "/lib/pkgconfig/nss.pc"))
244 (rmdir (string-append obj "/lib/pkgconfig"))
245 ;; Install other files.
246 (copy-recursively "dist/public/nss" inc)
247 (copy-recursively (string-append obj "/bin") #$output:bin)
248 (copy-recursively (string-append obj "/lib") lib))))
249 (add-after 'install 'move-static-archives
250 (lambda _
251 (with-directory-excursion #$output
252 (for-each (lambda (f)
253 (install-file f
254 (string-append #$output:static
255 "/" (dirname f))))
256 (find-files "." "\\.a$"))))))))
257 (inputs (list sqlite zlib))
258 (propagated-inputs (list nspr)) ;required by nss.pc.
259 (native-inputs (list perl ;for tests
260 (if (target-64bit?) libfaketime datefudge)
261 which))
262
263 ;; The NSS test suite takes around 48 hours on Loongson 3A (MIPS) when
264 ;; another build is happening concurrently on the same machine.
265 (properties '((timeout . 216000))) ;60 hours
266
267 (home-page "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS")
268 (synopsis "Network Security Services (ESR)")
269 (description
270 "Network Security Services (@dfn{NSS}) is a set of libraries designed to
271support cross-platform development of security-enabled client and server
272applications. Applications built with NSS can support SSL v2 and v3, TLS,
273PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
274security standards.
275
276This package tracks the Extended Support Release (ESR) channel.")
277 (license license:mpl2.0)))
278
279;; nss-rapid tracks the rapid release channel. Unless your package requires a
280;; newer version, you should prefer the `nss' package, which tracks the ESR
281;; channel.
282;;
283;; See https://wiki.mozilla.org/NSS:Release_Versions
284;; and https://wiki.mozilla.org/Rapid_Release_Model
285
286(define-public nss-rapid
287 (package
288 (inherit nss)
289 (name "nss-rapid")
290 (version "3.129")
291 (source
292 (origin
293 (inherit (package-source nss))
294 (uri (let ((version-with-underscores
295 (string-join (string-split version #\.) "_")))
296 (string-append
297 "https://ftp.mozilla.org/pub/security/nss/"
298 "releases/NSS_" version-with-underscores "_RTM/src/"
299 "nss-" version ".tar.gz")))
300 (sha256
301 (base32 "11877m4y0k11kdx1xg8s2nh1jr69afbm8fs78d46fgwal6qa7fiq"))
302 (patches
303 (search-patches "nss-3.56-pkgconfig.patch"
304 "nss-getcwd-nonnull.patch"
305 "nss-increase-test-timeout.patch"
306 "nss-3.115-disable-pkix-ocsp-tests.patch"))))
307
308 (synopsis "Network Security Services (Rapid Release)")
309 (description
310 "Network Security Services (@dfn{NSS}) is a set of libraries designed to
311support cross-platform development of security-enabled client and server
312applications. Applications built with NSS can support SSL v2 and v3, TLS,
313PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
314security standards.
315
316This package tracks the Rapid Release channel, which updates frequently.")))
317
318(define-public nss-certs
319 (package
320 (inherit nss)
321 (name "nss-certs")
322 (build-system gnu-build-system)
323 (outputs '("out"))
324 (native-inputs
325 (list certdata2pem openssl))
326 (inputs '())
327 (propagated-inputs '())
328 (arguments
329 (list #:modules '((guix build gnu-build-system)
330 (guix build utils)
331 (rnrs io ports)
332 (srfi srfi-26))
333 #:phases
334 #~(modify-phases
335 (map (cut assq <> %standard-phases)
336 '(set-paths install-locale unpack))
337 (add-after 'unpack 'install
338 (lambda _
339 (let ((certsdir (string-append #$output
340 "/etc/ssl/certs/")))
341 (with-directory-excursion "nss/lib/ckfw/builtins/"
342 (unless (file-exists? "blacklist.txt")
343 (call-with-output-file "blacklist.txt" (const #t)))
344 ;; Extract selected single certificates from blob.
345 (invoke "certdata2pem")
346 ;; Copy .pem files into the output.
347 (for-each (cut install-file <> certsdir)
348 (find-files "." ".*\\.pem$")))
349 (invoke "openssl" "rehash" certsdir)))))))
350 (synopsis "CA certificates from Mozilla")
351 (description
352 "This package provides certificates for Certification Authorities (CA)
353taken from the NSS package and thus ultimately from the Mozilla project.")
354 (home-page "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS")
355 (license license:mpl2.0)))
356
357(define-public nss-certs-for-test
358 (hidden-package
359 (package
360 (inherit nss-certs)
361 (name "nss-certs-for-test")
362 (source #f)
363 (build-system trivial-build-system)
364 (native-inputs (list nss-certs))
365 (inputs '())
366 (propagated-inputs '())
367 (arguments
368 (list
369 #:builder
370 (with-imported-modules '((guix build utils))
371 #~(begin
372 (use-modules (guix build utils)
373 (rnrs io ports)
374 (srfi srfi-26))
375 (define certs-dir (string-append #$output "/etc/ssl/certs/"))
376 (define ca-files
377 (find-files (string-append #+(this-package-native-input
378 "nss-certs")
379 "/etc/ssl/certs")
380 (lambda (file stat)
381 (string-suffix? ".pem" file))))
382 (define (concatenate-files files result)
383 "Make RESULT the concatenation of all of FILES."
384 (define (dump file port)
385 (display (call-with-input-file file get-string-all) port)
386 (newline port))
387 (call-with-output-file result
388 (lambda (port)
389 (for-each (cut dump <> port) files))))
390
391 (mkdir-p certs-dir)
392 (concatenate-files
393 ca-files (string-append certs-dir "/ca-certificates.crt"))
394 (for-each (cut install-file <> certs-dir) ca-files)))))
395 (native-search-paths
396 (list $SSL_CERT_DIR
397 $SSL_CERT_FILE)))))
398
399(define-public nsncd
400 (package
401 (name "nsncd")
402 (version "1.5.2")
403 (source
404 (origin
405 (method git-fetch)
406 (uri (git-reference
407 (url "https://github.com/twosigma/nsncd")
408 (commit (string-append "v" version))))
409 (file-name (git-file-name name version))
410 (sha256
411 (base32 "1kzwd5vlz5paal8k79dkamjqczz7k8azyc8zwjyhalcxzsjkdn0w"))))
412 (build-system cargo-build-system)
413 (arguments
414 `(#:cargo-test-flags
415 '("--"
416 ;; These tests fail with the current builder network setup
417 "--skip=ffi::test_gethostbyaddr_r"
418 "--skip=ffi::test_gethostbyname2_r"
419 "--skip=handlers::test::test_handle_getservbyname_name"
420 "--skip=handlers::test::test_handle_getservbyname_name_proto"
421 "--skip=handlers::test::test_handle_getservbyport_port"
422 "--skip=handlers::test::test_handle_getservbyport_port_proto"
423 "--skip=handlers::test::test_handle_getservbyport_port_proto_aliases")
424 #:install-source? #f))
425 (inputs (cargo-inputs 'nsncd))
426 (home-page "https://github.com/twosigma/nsncd")
427 (synopsis "The name service non-caching daemon")
428 (description
429 "This package provides @command{nscd}, a daemon compatible that proxies
430lookups, compatible with the GNU C Library's @command{nscd}, but without
431caching. It can be used in situations where you want to make an application
432use @acronym{NSS, Name Service Switch} plugins available to a different libc
433than the one the application will load.")
434 (license (list license:asl2.0))))