projects/guix·blob kernel-updates · refs

1893 lines · 75.4 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2014 David Thompson <[email protected]>
3;;; Copyright © 2015, 2017, 2018, 2019, 2022 Ricardo Wurmus <[email protected]>
4;;; Copyright © 2016, 2017, 2018, 2019, 2021 Leo Famulari <[email protected]>
5;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox>
6;;; Copyright © 2016–2022 Tobias Geerinckx-Rice <[email protected]>
7;;; Copyright © 2016, 2017 Nikita <[email protected]>
8;;; Copyright © 2016, 2017, 2019, 2020 Eric Bavier <[email protected]>
9;;; Copyright © 2017 Pierre Langlois <[email protected]>
10;;; Copyright © 2018, 2020, 2021, 2023, 2025 Efraim Flashner <[email protected]>
11;;; Copyright © 2018 Arun Isaac <[email protected]>
12;;; Copyright © 2018 Nicolas Goaziou <[email protected]>
13;;; Copyright © 2018, 2020 Nicolò Balzarotti <[email protected]>
14;;; Copyright © 2018 Tim Gesthuizen <[email protected]>
15;;; Copyright © 2019 Pierre Neidhardt <[email protected]>
16;;; Copyright © 2019 Tanguy Le Carrour <[email protected]>
17;;; Copyright © 2020, 2026 Marius Bakke <[email protected]>
18;;; Copyright © 2020 Jakub Kądziołka <[email protected]>
19;;; Copyright © 2020 Brice Waegeneire <[email protected]>
20;;; Copyright © 2020 Hendur Saga <[email protected]>
21;;; Copyright © 2020 pukkamustard <[email protected]>
22;;; Copyright © 2021 Ellis Kenyő <[email protected]>
23;;; Copyright © 2021 Maxime Devos <[email protected]>
24;;; Copyright © 2021, 2022, 2025 Brendan Tildesley <[email protected]>
25;;; Copyright © 2022 Allan Adair <[email protected]>
26;;; Copyright © 2022, 2024-2025 Maxim Cournoyer <[email protected]>
27;;; Copyright © 2022 Denis 'GNUtoo' Carikli <[email protected]>
28;;; Copyright © 2023 Ivan Vilata-i-Balaguer <[email protected]>
29;;; Copyright © 2023 Foundation Devices, Inc. <[email protected]>
30;;; Copyright © 2024, 2025 Janneke Nieuwenhuizen <[email protected]>
31;;; Copyright © 2025 Ashish SHUKLA <[email protected]>
32;;; Copyright © 2025 Robin Templeton <[email protected]>
33;;; Copyright © 2026 Hennadii Stepanov <[email protected]>
34;;; Copyright © 2026 Noé Lopez <[email protected]>
35;;; Copyright © 2026 bdunahu <[email protected]>
36;;;
37;;; This file is part of GNU Guix.
38;;;
39;;; GNU Guix is free software; you can redistribute it and/or modify it
40;;; under the terms of the GNU General Public License as published by
41;;; the Free Software Foundation; either version 3 of the License, or (at
42;;; your option) any later version.
43;;;
44;;; GNU Guix is distributed in the hope that it will be useful, but
45;;; WITHOUT ANY WARRANTY; without even the implied warranty of
46;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
47;;; GNU General Public License for more details.
48;;;
49;;; You should have received a copy of the GNU General Public License
50;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
51
52(define-module (gnu packages crypto)
53 #:use-module (gnu packages)
54 #:use-module (gnu packages admin)
55 #:use-module (gnu packages aidc)
56 #:use-module (gnu packages assembly)
57 #:use-module (gnu packages attr)
58 #:use-module (gnu packages autotools)
59 #:use-module (gnu packages base)
60 #:use-module (gnu packages bash)
61 #:use-module (gnu packages boost)
62 #:use-module (gnu packages check)
63 #:use-module (gnu packages compression)
64 #:use-module (gnu packages cpp)
65 #:use-module (gnu packages cryptsetup)
66 #:use-module (gnu packages curl)
67 #:use-module (gnu packages documentation)
68 #:use-module (gnu packages gettext)
69 #:use-module (gnu packages gnupg)
70 #:use-module (gnu packages graphviz)
71 #:use-module (gnu packages image)
72 #:use-module (gnu packages kerberos)
73 #:use-module (gnu packages libbsd)
74 #:use-module (gnu packages libffi)
75 #:use-module (gnu packages linux)
76 #:use-module (gnu packages logging)
77 #:use-module (gnu packages lsof)
78 #:use-module (gnu packages man)
79 #:use-module (gnu packages multiprecision)
80 #:use-module (gnu packages nettle)
81 #:use-module (gnu packages password-utils)
82 #:use-module (gnu packages perl)
83 #:use-module (gnu packages perl-check)
84 #:use-module (gnu packages pkg-config)
85 #:use-module (gnu packages python)
86 #:use-module (gnu packages python-build)
87 #:use-module (gnu packages python-xyz)
88 #:use-module (gnu packages python-check)
89 #:use-module (gnu packages python-crypto)
90 #:use-module (gnu packages readline)
91 #:use-module (gnu packages search)
92 #:use-module (gnu packages serialization)
93 #:use-module (gnu packages shells)
94 #:use-module (gnu packages sqlite)
95 #:use-module (gnu packages tcl)
96 #:use-module (gnu packages tls)
97 #:use-module (gnu packages version-control)
98 #:use-module (gnu packages xml)
99 #:use-module ((guix licenses) #:prefix license:)
100 #:use-module (guix packages)
101 #:use-module (guix download)
102 #:use-module (guix git-download)
103 #:use-module (guix gexp)
104 #:use-module (guix build-system cargo)
105 #:use-module (guix build-system cmake)
106 #:use-module (guix build-system copy)
107 #:use-module (guix build-system gnu)
108 #:use-module (guix build-system perl)
109 #:use-module (guix build-system pyproject)
110 #:use-module (guix utils)
111 #:use-module (srfi srfi-1)
112 #:use-module (srfi srfi-26))
113
114(define-public crc32c
115 (package
116 (name "crc32c")
117 (version "1.1.2")
118 (source (origin
119 (method git-fetch)
120 (uri (git-reference
121 (url "https://github.com/google/crc32c")
122 (commit version)))
123 (file-name (git-file-name name version))
124 (sha256
125 (base32
126 "0966lyy3w5cnrs0c0fkma4hga51k54hns72l4n76944awqssap7j"))
127 (patches (search-patches "crc32c-unbundle-googletest.patch"))))
128 (build-system cmake-build-system)
129 (arguments
130 (list
131 #:configure-flags
132 #~(list "-DBUILD_SHARED_LIBS=ON"
133 "-DCRC32C_BUILD_BENCHMARKS=OFF"
134 "-DCRC32C_USE_GLOG=OFF"
135 (string-append
136 "-DCRC32C_BUILD_TESTS="
137 ;; TODO: perhaps infer #:tests?
138 (if #$(%current-target-system)
139 "OFF" "ON")))))
140 (native-inputs (list googletest-1.12))
141 (home-page "https://github.com/google/crc32c")
142 (synopsis "Cyclic redundancy check")
143 (description
144 "This package provides architecture-specific implementations of the
145CRC32C algorithm, which is specified in RFC 3720, section 12.1.")
146 (license license:bsd-3)))
147
148(define-public crcpp
149 (package
150 (name "crcpp")
151 (version "1.2.1.0")
152 (source (origin
153 (method git-fetch)
154 (uri (git-reference
155 (url "https://github.com/d-bahr/CRCpp.git")
156 (commit (string-append "release-" version))))
157 (file-name (git-file-name name version))
158 (sha256
159 (base32
160 "005hc25srr4r80md57cg9fax98c8n57ljrhxyw0chjlyq3c0d07n"))))
161 (build-system cmake-build-system)
162 (arguments
163 (list
164 #:phases
165 #~(modify-phases %standard-phases
166 (add-after 'install 'install-pkgconfig-description
167 (lambda _
168 (let ((dir (string-append #$output "/lib/pkgconfig")))
169 (mkdir-p (string-append dir))
170 (with-output-to-file (string-append dir "/CRCpp.pc")
171 (lambda _
172 (simple-format #t "\
173prefix=~a
174includedir=${prefix}/include
175
176Name: ~a
177Description: CRC (cyclic redundancy check) library for C++
178Version: ~a
179Cflags: -I${includedir}"
180 #$output #$name #$version)))))))))
181 (home-page "https://github.com/d-bahr/CRCpp")
182 (synopsis "@acronym{CRC, cyclic redundancy check} library for C++")
183 (description "CRC++ is a C++ library for calculating cyclic redundancy
184checks. It supports bit-by-bit and byte-by-byte calculation of full and
185multipart CRCs. It aims to have highly optimized algorithms that can run
186branchless for projects with a need for efficiency. Many common CRCs are
187provided out-of-the-box, such as CRC-32 (used in PKZip and Ethernet),
188CRC-XMODEM, and CRC-CCITT.")
189 (license license:bsd-3)))
190
191(define-public libblake3
192 (package
193 (name "libblake3")
194 (version "1.8.2")
195 (source
196 (origin
197 (method git-fetch)
198 (uri (git-reference
199 (url "https://github.com/BLAKE3-team/BLAKE3")
200 (commit version)))
201 (file-name (git-file-name name version))
202 (sha256
203 (base32 "1pm7285insrmpfwwal8rnp3yhvc6s2ki8b6ccmbh2qfnnl95a010"))))
204 (build-system cmake-build-system)
205 (arguments
206 (list
207 #:configure-flags
208 #~(list "-DBUILD_SHARED_LIBS=ON")
209 #:tests? #f ; XXX: there are some rust tests in the root.
210 #:phases
211 #~(modify-phases %standard-phases
212 (add-after 'unpack 'chdir
213 (lambda _
214 (chdir "c"))))))
215 (home-page "https://github.com/BLAKE3-team/BLAKE3")
216 (synopsis "Official C implementation of BLAKE3")
217 (description "This package provides a cryptographic hash function that is
218fast, secure, parallelizable, capable of incremental updates.")
219 (license (list license:asl2.0 license:cc0)))) ; dual licensed
220
221(define-public libdecaf
222 ;; The 1.0.2 release fails due to some compiler warning treated as an error
223 ;; (see: https://sourceforge.net/p/ed448goldilocks/tickets/16/). Use the
224 ;; latest commit available.
225 (let ((commit "e5cc6240690d3ffdfcbdb1e4e851954b789cd5d9")
226 (revision "0"))
227 (package
228 (name "libdecaf")
229 (version (git-version "1.0.2" revision commit))
230 (source (origin
231 (method git-fetch)
232 (uri (git-reference
233 (url "git://git.code.sf.net/p/ed448goldilocks/code")
234 (commit commit)))
235 (file-name
236 (git-file-name name version))
237 (sha256
238 (base32
239 "1gxf503cnmgsv7s0dm82rrizjhifdhdh42sfvbfsdj55syjnv1p2"))))
240 (build-system cmake-build-system)
241 (outputs '("out" "python" "doc"))
242 (arguments
243 (list #:imported-modules (append %cmake-build-system-modules
244 %pyproject-build-system-modules)
245 #:modules '((guix build cmake-build-system)
246 ((guix build pyproject-build-system) #:prefix python:)
247 (guix build utils))
248 #:configure-flags #~(list "-DENABLE_STATIC=OFF")
249 #:phases
250 #~(modify-phases %standard-phases
251 (add-after 'unpack 'patch-python-binding
252 (lambda _
253 (substitute* "python/setup.py"
254 (("gmake")
255 "make")
256 (("'\\.\\.', 'build', 'lib', 'libdecaf\\.so'")
257 "'..', '..', 'build', 'src', 'libdecaf.so'"))))
258 (add-after 'unpack 'ensure-no-mtimes-pre-1980
259 (assoc-ref python:%standard-phases 'ensure-no-mtimes-pre-1980))
260 (add-after 'install 'install-python-binding
261 (lambda* (#:key inputs outputs #:allow-other-keys)
262 (with-directory-excursion "../source/python"
263 (invoke "python" "setup.py" "install"
264 (string-append
265 "--prefix="
266 (python:site-packages inputs outputs)))))))))
267 (native-inputs (list python-minimal-wrapper python-setuptools))
268 (synopsis "Decaf Elliptic Curve Library")
269 (description "The libdecaf library is an implementation of elliptic curve
270cryptography using the Montgomery and Edwards curves Curve25519, Ed25519,
271Ed448-Goldilocks and Curve448, using the Decaf encoding.")
272 (home-page "https://ed448goldilocks.sourceforge.net/")
273 (license (list license:expat ;library
274 license:bsd-2))))) ;python bindings
275
276(define-public libsodium
277 (package
278 (name "libsodium")
279 (version "1.0.22")
280 (source
281 (origin
282 (method git-fetch)
283 (uri (git-reference
284 (url "https://github.com/jedisct1/libsodium")
285 (commit (string-append version "-RELEASE"))))
286 (file-name (git-file-name name version))
287 (sha256
288 (base32
289 "05lqdn6nzldsia5mv5a9xfvc5k0kybh9snwv7qsb135gva4bpjwk"))))
290 (build-system gnu-build-system)
291 (synopsis "Portable NaCl-based crypto library")
292 (description
293 "Sodium is a new easy-to-use high-speed software library for network
294communication, encryption, decryption, signatures, etc.")
295 (license license:isc)
296 (home-page "https://libsodium.org")))
297
298(define-public libmd
299 (package
300 (name "libmd")
301 (version "1.3.0")
302 (source (origin
303 (method git-fetch)
304 (uri (git-reference
305 (url "https://gitlab.freedesktop.org/libbsd/libmd")
306 (commit version)))
307 (file-name (git-file-name name version))
308 (sha256
309 (base32
310 "0p9fr67p9g1kvky90fp0rqd1mvfw54z2gax2m5ksd9jjpp1ibrws"))))
311 (build-system gnu-build-system)
312 (arguments
313 (list
314 #:configure-flags
315 #~(list "--disable-static")
316 #:phases
317 #~(modify-phases %standard-phases
318 (add-after 'unpack 'add-version-file
319 (lambda _
320 (call-with-output-file ".dist-version"
321 (lambda (port) (display #$version port)))))
322 (add-before 'bootstrap 'patch-bootstrap-shebang
323 (lambda _
324 (patch-shebang "get-version"))))))
325 (native-inputs
326 (list autoconf-2.72 automake libtool))
327 (synopsis "Message Digest functions from BSD systems")
328 (description
329 "The currently provided message digest algorithms are:
330@itemize
331@item MD2
332@item MD4
333@item MD5
334@item RIPEMD-160
335@item SHA-1
336@item SHA-2 (SHA-256, SHA-384 and SHA-512)
337@item SHA-3 (SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE-128, SHAKE-256)
338@end itemize")
339 (license (list license:bsd-3
340 license:bsd-2
341 license:isc
342 license:public-domain))
343 (home-page "https://www.hadrons.org/software/libmd/")))
344
345(define-public signify
346 (package
347 (name "signify")
348 (version "32")
349 (home-page "https://github.com/aperezdc/signify")
350 (source (origin
351 (method url-fetch)
352 (uri (string-append "https://github.com/aperezdc/signify/releases"
353 "/download/v" version "/signify-" version ".tar.xz"))
354 (sha256
355 (base32
356 "1maq4wv7934gql95rr55pj419gnbj8jkrgn1f25jcg97v5zvklbd"))
357 (modules '((guix build utils)))
358 (snippet '(delete-file-recursively "libbsd"))))
359 (build-system gnu-build-system)
360 ;; TODO Build with libwaive (described in README.md), to implement something
361 ;; like OpenBSD's pledge().
362 (arguments
363 (list
364 #:make-flags
365 #~(list (string-append "CC=" #$(cc-for-target))
366 (string-append "PREFIX=" #$output))
367 #:phases
368 #~(modify-phases %standard-phases
369 (delete 'configure))))
370 (native-inputs
371 (list pkg-config))
372 (inputs
373 (list libbsd))
374 (synopsis "Create and verify cryptographic signatures")
375 (description "The signify utility creates and verifies cryptographic
376signatures using the elliptic curve Ed25519. This is a Linux port of the
377OpenBSD tool of the same name.")
378 ;; This package includes third-party code that was originally released under
379 ;; various non-copyleft licenses. See the source files for clarification.
380 (license (list license:bsd-3 license:expat license:isc
381 license:public-domain (license:non-copyleft
382 "file://base64.c"
383 "See base64.c in the distribution for
384 the license from IBM.")))))
385
386(define-public rust-minisign
387 (package
388 (name "rust-minisign")
389 (version "0.7.9")
390 (source
391 (origin
392 (method url-fetch)
393 (uri (crate-uri "minisign" version))
394 (file-name (string-append name "-" version ".tar.gz"))
395 (sha256
396 (base32 "1rqdmnzzak7svsgcjnrb7rrbq4gv378alcnmynfq47js863i6m16"))))
397 (build-system cargo-build-system)
398 (arguments
399 `(#:install-source? #f))
400 (inputs (cargo-inputs 'rust-minisign))
401 (home-page "https://github.com/jedisct1/rust-minisign")
402 (synopsis "Crate to sign files and verify signatures")
403 (description
404 "This package provides a crate to sign files and verify signatures.")
405 (license license:expat)))
406
407(define-public keyutils
408 (package
409 (name "keyutils")
410 (version "1.6.3")
411 (source
412 (origin
413 (method git-fetch)
414 (uri (git-reference
415 (url (string-append "https://git.kernel.org/pub/scm/linux/kernel/"
416 "git/dhowells/keyutils.git"))
417 (commit (string-append "v" version))))
418 (file-name (git-file-name name version))
419 (sha256
420 (base32 "1095g1p5038m91wf2dxnagngpvww7ilcj8fhyviid3srvxr675i7"))
421 (modules '((guix build utils)))
422 ;; Create relative symbolic links instead of absolute ones to /lib/*.
423 (snippet '(begin
424 (substitute* "Makefile" (("\\$\\(LNS\\) \\$\\(LIBDIR\\)/")
425 "$(LNS) "))))))
426 (build-system gnu-build-system)
427 (arguments
428 (list #:make-flags
429 #~(list (string-append "CC=" #$(cc-for-target))
430 ;; "NO_ARLIB=1" would cleanly disable static libraries.
431 "RPATH=-Wl,-rpath,$(DESTDIR)$(LIBDIR)"
432 (string-append "DESTDIR=" #$output)
433 "INCLUDEDIR=/include"
434 "LIBDIR=/lib"
435 "MANDIR=/share/man"
436 "SHAREDIR=/share/keyutils")
437 #:phases
438 #~(modify-phases %standard-phases
439 (delete 'configure) ; no configure script
440 (add-after 'unpack 'avoid-embedding-timestamp
441 ;; Do not embed build timestamp
442 (lambda _
443 (substitute* "Makefile"
444 (("shell date") "shell true"))))
445 (add-after 'install 'install:static
446 (lambda _
447 (with-directory-excursion #$output
448 (for-each (lambda (file)
449 (let ((target (string-append #$output:static
450 "/" file)))
451 (format #t "~a -> ~a\n" file target)
452 (mkdir-p (dirname target))
453 (rename-file file target)))
454 (find-files "lib" "\\.a$"))))))
455 #:test-target "test"))
456 (inputs
457 (list mit-krb5))
458 (home-page "https://people.redhat.com/dhowells/keyutils/")
459 (synopsis "Linux key management utilities")
460 (description
461 "Keyutils is a set of utilities for managing the key retention facility in
462the Linux kernel, which can be used by file systems, block devices, and more to
463gain and retain the authorization and encryption keys required to perform
464secure operations.")
465 (license (list license:lgpl2.1+ ; the files keyutils.*
466 license:gpl2+)))) ; the rest
467
468(define-public ssss
469 (package
470 (name "ssss")
471 (version "0.5")
472 (source (origin
473 (method url-fetch)
474 (uri (string-append "http://point-at-infinity.org/ssss/ssss-"
475 version ".tar.gz"))
476 (sha256
477 (base32
478 "15grn2fp1x8p92kxkwbmsx8rz16g93y9grl3hfqbh1jn21ama5jx"))))
479 (build-system gnu-build-system)
480 (arguments
481 `(#:tests? #f ; No test suite
482 #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
483 ,(string-append "CC=" (cc-for-target)))
484 #:phases
485 (modify-phases %standard-phases
486 (delete 'configure) ; no configuration to be done
487 (replace 'install
488 (lambda* (#:key outputs #:allow-other-keys)
489 (let* ((outdir (assoc-ref outputs "out"))
490 (bindir (string-append outdir "/bin"))
491 (docdir (string-append outdir
492 "/share/doc/ssss-"
493 ,version)))
494 (install-file "ssss-combine" bindir)
495 (install-file "ssss-split" bindir)
496 (install-file "ssss.1" docdir)
497 (install-file "ssss.1.html" docdir)
498 #t))))))
499 (inputs
500 (list gmp))
501 (native-inputs
502 (list xmltoman))
503 (home-page "http://point-at-infinity.org/ssss/")
504 (synopsis "Shamir's secret sharing scheme implementation")
505 (description "@command{ssss-split} and @command{ssss-combine} are utilities that split
506and combine secrets securely using Shamir's secret sharing scheme. This implementation
507allows for a threshold scheme where the minimum number of shares can be less than the
508total number of shares generated.")
509 (license license:gpl2+)))
510
511(define-public tomb
512 (package
513 (name "tomb")
514 (version "2.13")
515 (source
516 (origin
517 (method url-fetch)
518 (uri (string-append "https://files.dyne.org/tomb/releases/"
519 "Tomb-" version ".tar.gz"))
520 (sha256
521 (base32 "1405kw0j8i1bqyqbim8530xf6hchpf57r9p1v92aknwyn5wgny0g"))))
522 (build-system gnu-build-system)
523 (arguments
524 (list
525 #:make-flags #~(list (string-append "PREFIX=" #$output))
526 ;; TODO: Build and install gtk and qt trays
527 #:phases
528 #~(modify-phases %standard-phases
529 (delete 'configure) ;no configuration to be done
530 (add-after 'install 'i18n
531 (lambda* (#:key make-flags #:allow-other-keys)
532 (apply invoke "make" "-C" "extras/translations"
533 "install" make-flags)))
534 (add-after 'install 'cloak
535 (lambda* (#:key make-flags #:allow-other-keys)
536 (apply invoke "make" "-C" "extras/cloak" "install" make-flags)
537 (copy-recursively
538 "extras/cloak/ciphers"
539 (string-append #$output "/share/tomb/extras/cloak/ciphers"))))
540 (add-after 'install 'gtomb
541 (lambda _
542 (install-file "extras/gtomb/gtomb"
543 (string-append #$output "/bin"))))
544 (add-after 'install 'wrap
545 (lambda* (#:key inputs #:allow-other-keys)
546 (wrap-program (string-append #$output "/bin/tomb")
547 `("PATH" ":" prefix
548 (,(string-append (assoc-ref inputs "mlocate") "/bin")
549 ,@(map (lambda (program)
550 (or (and=> (which program) dirname)
551 (error "program not found:" program)))
552 ;; The size of this package explodes with:
553 ;; "unoconv" "recoll"
554 '("argon2" "seq" "mkfs.ext4" "pinentry"
555 "gpg" "cryptsetup" "gettext" "lsof"
556 "qrencode" "steghide" "findmnt" "getent")))))))
557 (delete 'check)
558 (add-after 'wrap 'check
559 (lambda* (#:key tests? #:allow-other-keys)
560 (when tests?
561 ;; Running the full tests requires sudo/root access for
562 ;; cryptsetup, which is not available in the build
563 ;; environment. But we can run `tomb dig` without root, so
564 ;; make sure that works.
565 ;;
566 ;; TODO: It Would Be Nice to check the expected "index",
567 ;; "search", "bury", and "exhume" features are available by
568 ;; querying `tomb -h`.
569 (let ((tomb (string-append #$output "/bin/tomb")))
570 (invoke tomb "dig" "-s" "10" "secrets.tomb"))))))))
571 (native-inputs
572 (list which))
573 (inputs
574 (list argon2
575 bash-minimal
576 cryptsetup-minimal
577 e2fsprogs ; for mkfs.ext4
578 gettext-minimal ; used at runtime
579 gnupg
580 lsof
581 mlocate
582 pinentry
583 qrencode
584 ;; recoll ; size explodes
585 steghide
586 ;; unoconv ; size explodes
587 util-linux
588 zsh))
589 (home-page "https://dyne.org/tomb/")
590 (synopsis "File encryption for secret data")
591 (description
592 "Tomb is an application to manage the creation and access of encrypted
593storage files: it can be operated from commandline and it can integrate with a
594user's graphical desktop.")
595 (license license:gpl3+)))
596
597(define-public scrypt
598 (package
599 (name "scrypt")
600 (version "1.3.1")
601 (source
602 (origin
603 (method url-fetch)
604 (uri (string-append "https://www.tarsnap.com/scrypt/scrypt-"
605 version ".tgz"))
606 (sha256
607 (base32
608 "1hnl0r6pmyxiy4dmafmqk1db7wpc0x9rqpzqcwr9d2cmghcj6byz"))))
609 (build-system gnu-build-system)
610 (arguments
611 `(#:license-file-regexp "COPYRIGHT"
612 #:phases (modify-phases %standard-phases
613 (add-after 'unpack 'patch-$PATH-assumptions
614 (lambda _
615 (substitute* "configure"
616 (("\\{POSIX_PATH\\}")
617 "{PATH}"))
618 (substitute* "Makefile.in"
619 (("command -p") ""))
620 #t))
621 (add-after 'install 'install-docs
622 (lambda* (#:key outputs #:allow-other-keys)
623 (let* ((out (assoc-ref %outputs "out"))
624 (doc (string-append out "/share/doc/" ,name "-" ,version)))
625 (install-file "FORMAT" doc)
626 #t))))))
627 (inputs
628 (list openssl))
629 (home-page "https://www.tarsnap.com/scrypt.html")
630 (synopsis "Memory-hard encryption tool based on scrypt")
631 (description "This package provides a simple password-based encryption
632utility as a demonstration of the @code{scrypt} key derivation function.
633@code{Scrypt} is designed to be far more resistant against hardware brute-force
634attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
635 (license license:bsd-2)))
636
637(define-public libscrypt
638 (package
639 (name "libscrypt")
640 (version "1.22")
641 (source
642 (origin
643 (method git-fetch)
644 (uri (git-reference
645 (url "https://github.com/technion/libscrypt")
646 (commit (string-append "v" version))))
647 (file-name (git-file-name name version))
648 (sha256
649 (base32 "10dinz1zx8zfm81ra16s20izpm7f7j414n4i3fkdf40vbl5slra1"))))
650 (build-system gnu-build-system)
651 (outputs (list "out" "static"))
652 (arguments
653 (list #:make-flags
654 #~(list (string-append "PREFIX=" #$output)
655 (string-append "CC=" #$(cc-for-target)))
656 #:phases
657 #~(modify-phases %standard-phases
658 (delete 'configure) ; no configure script
659 (add-after 'install 'install:static
660 (lambda _
661 (install-file "libscrypt.a"
662 (string-append #$output:static "/lib")))))))
663 (home-page "https://lolware.net/libscrypt.html")
664 (synopsis "Password hashing library")
665 (description "@code{libscrypt} implements @code{scrypt} key derivation
666function. It is designed to be far more secure against hardware brute-force
667attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
668 (license license:bsd-3)))
669
670(define-public perl-math-random-isaac-xs
671 (package
672 (name "perl-math-random-isaac-xs")
673 (version "1.004")
674 (source
675 (origin
676 (method url-fetch)
677 (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
678 "Math-Random-ISAAC-XS-" version ".tar.gz"))
679 (sha256
680 (base32
681 "0yxqqcqvj51fn7b7j5xqhz65v74arzgainn66c6k7inijbmr1xws"))))
682 (build-system perl-build-system)
683 (native-inputs
684 (list perl-module-build perl-test-nowarnings))
685 (home-page "https://metacpan.org/release/Math-Random-ISAAC-XS")
686 (synopsis "C implementation of the ISAAC PRNG algorithm")
687 (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
688fast pseudo-random number generator. It is suitable for applications where a
689significant amount of random data needs to be produced quickly, such as
690solving using the Monte Carlo method or for games. The results are uniformly
691distributed, unbiased, and unpredictable unless you know the seed.
692
693This package implements the same interface as @code{Math::Random::ISAAC}.")
694 (license license:public-domain)))
695
696(define-public perl-math-random-isaac
697 (package
698 (name "perl-math-random-isaac")
699 (version "1.004")
700 (source
701 (origin
702 (method url-fetch)
703 (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
704 "Math-Random-ISAAC-" version ".tar.gz"))
705 (sha256
706 (base32
707 "0z1b3xbb3xz71h25fg6jgsccra7migq7s0vawx2rfzi0pwpz0wr7"))))
708 (build-system perl-build-system)
709 (native-inputs
710 (list perl-test-nowarnings))
711 (propagated-inputs
712 (list perl-math-random-isaac-xs))
713 (home-page "https://metacpan.org/release/Math-Random-ISAAC")
714 (synopsis "Perl interface to the ISAAC PRNG algorithm")
715 (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
716fast pseudo-random number generator. It is suitable for applications where a
717significant amount of random data needs to be produced quickly, such as
718solving using the Monte Carlo method or for games. The results are uniformly
719distributed, unbiased, and unpredictable unless you know the seed.
720
721This package provides a Perl interface to the ISAAC pseudo random number
722generator.")
723 (license license:public-domain)))
724
725(define-public perl-crypt-random-source
726 (package
727 (name "perl-crypt-random-source")
728 (version "0.14")
729 (source
730 (origin
731 (method url-fetch)
732 (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/"
733 "Crypt-Random-Source-" version ".tar.gz"))
734 (sha256
735 (base32 "1rpdds3sy5l1fhngnkrsgwsmwd54wpicx3i9ds69blcskwkcwkpc"))))
736 (build-system perl-build-system)
737 (native-inputs
738 (list perl-module-build-tiny perl-test-fatal))
739 (propagated-inputs
740 (list perl-capture-tiny
741 perl-module-find
742 perl-module-runtime
743 perl-moo
744 perl-namespace-clean
745 perl-sub-exporter
746 perl-type-tiny))
747 (home-page "https://metacpan.org/release/Crypt-Random-Source")
748 (synopsis "Get weak or strong random data from pluggable sources")
749 (description "This module provides implementations for a number of
750byte-oriented sources of random data.")
751 (license license:perl-license)))
752
753(define-public perl-math-random-secure
754 (package
755 (name "perl-math-random-secure")
756 (version "0.080001")
757 (source
758 (origin
759 (method url-fetch)
760 (uri (string-append "mirror://cpan/authors/id/F/FR/FREW/"
761 "Math-Random-Secure-" version ".tar.gz"))
762 (sha256
763 (base32
764 "0dgbf4ncll4kmgkyb9fsaxn0vf2smc9dmwqzgh3259zc2zla995z"))))
765 (build-system perl-build-system)
766 (native-inputs
767 (list perl-list-moreutils perl-test-leaktrace perl-test-sharedfork
768 perl-test-warn))
769 (inputs
770 (list perl-crypt-random-source perl-math-random-isaac
771 perl-math-random-isaac-xs perl-moo))
772 (home-page "https://metacpan.org/release/Math-Random-Secure")
773 (synopsis "Cryptographically secure replacement for rand()")
774 (description "This module is intended to provide a
775cryptographically-secure replacement for Perl's built-in @code{rand} function.
776\"Cryptographically secure\", in this case, means:
777
778@enumerate
779@item No matter how many numbers you see generated by the random number
780generator, you cannot guess the future numbers, and you cannot guess the seed.
781@item There are so many possible seeds that it would take decades, centuries,
782or millennia for an attacker to try them all.
783@item The seed comes from a source that generates relatively strong random
784data on your platform, so the seed itself will be as random as possible.
785@end enumerate\n")
786 (license license:artistic2.0)))
787
788(define-public qatlib
789 (package
790 (name "qatlib")
791 (version "26.02.0")
792 (source (origin
793 (method git-fetch)
794 (uri (git-reference
795 (url "https://github.com/intel/qatlib/")
796 (commit version)))
797 (file-name (git-file-name name version))
798 (sha256
799 (base32
800 "1ly4wjw7mpvgn0270z3242bng7ailvx99mhisymf4qdhq0cvz8n2"))))
801 (build-system gnu-build-system)
802 (arguments
803 (list #:configure-flags #~(list "--disable-static"))) ;avoid large .a
804 (native-inputs (list autoconf autoconf-archive automake libtool nasm))
805 (inputs (list numactl openssl zlib))
806 (propagated-inputs (list openssl)) ;in 'Requires' of libqat.pc
807 (home-page "https://github.com/intel/qatlib")
808 (synopsis "Intel QuickAssist Technology Library (QATlib)")
809 (description "Intel QuickAssist Technology provides hardware acceleration for
810offloading security, authentication and compression services from the CPU,
811thus significantly increasing the performance and efficiency of standard
812platform solutions. Its services include symmetric encryption and
813authentication, asymmetric encryption, digital signatures, RSA, DH and ECC,
814and lossless data compression. This package provides user space libraries
815that allow access to Intel QuickAssist devices and expose the Intel
816QuickAssist APIs and sample codes.")
817 (license license:bsd-3)
818 ;; This package only supports hardware that exists on the x86_64 platform,
819 ;; and is not portable.
820 (supported-systems (list "x86_64-linux"))))
821
822(define-public crypto++
823 (package
824 (name "crypto++")
825 (version "8.9.0")
826 (source (origin
827 (method git-fetch)
828 (uri
829 (git-reference
830 (url "https://github.com/weidai11/cryptopp")
831 (commit
832 (string-append "CRYPTOPP_"
833 (string-replace-substring version "." "_")))))
834 (file-name (git-file-name name version))
835 (sha256
836 (base32
837 "153jl84s26nw85vw7hlc84plpja7adq6q2cdydr7g2b445yrlpqx"))))
838 (build-system gnu-build-system)
839 (arguments
840 (list #:make-flags
841 #~(list (string-append "PREFIX=" #$output)
842 (string-append "CC=" #$(cc-for-target))
843 (string-append "CXX=" #$(cxx-for-target))
844 (string-append "AR=" #$(ar-for-target))
845 ;; Override "/sbin/ldconfig" with simply "echo" since
846 ;; we don't need ldconfig(8).
847 "LDCONF=echo")
848 #:phases
849 #~(modify-phases %standard-phases
850 (delete 'configure)
851 (replace 'build
852 ;; By default, only the static library is built.
853 (lambda* (#:key make-flags parallel-build?
854 #:allow-other-keys)
855 (let* ((job-count (if parallel-build?
856 (number->string (parallel-job-count))
857 1))
858 (jobs (string-append "-j" job-count))
859 (target #$(if (target-mingw?)
860 "static"
861 "shared")))
862 (apply invoke "make" target jobs make-flags)
863 (apply invoke "make" "libcryptopp.pc" jobs
864 make-flags)))))))
865 (properties '((tunable? . #t)))
866 (native-inputs
867 (list unzip))
868 (home-page "https://cryptopp.com/")
869 (synopsis "C++ class library of cryptographic schemes")
870 (description "Crypto++ is a C++ class library of cryptographic schemes.")
871 ;; The compilation is distributed under the Boost license; the individual
872 ;; files in the compilation are in the public domain.
873 (license (list license:boost1.0 license:public-domain))))
874
875(define-public libb2
876 (package
877 (name "libb2")
878 (version "0.98.1")
879 (source (origin
880 (method url-fetch)
881 (uri (string-append
882 "https://github.com/BLAKE2/libb2/releases/download/v"
883 version "/libb2-" version ".tar.gz"))
884 (sha256
885 (base32
886 "0bn7yrzdixdvzm46shbhpkqbr6zyqyxiqn7a7x54ag3mrvfnyqjk"))))
887 (build-system gnu-build-system)
888 (arguments
889 `(#:configure-flags
890 (list
891 ,@(if (target-x86?)
892 ;; fat only checks for Intel optimisations
893 '("--enable-fat")
894 '())
895 "--disable-native"))) ;don't optimise at build time
896 (home-page "https://blake2.net/")
897 (synopsis "Library implementing the BLAKE2 family of hash functions")
898 (description
899 "libb2 is a portable implementation of the BLAKE2 family of cryptographic
900hash functions. It includes optimised implementations for IA-32 and AMD64
901processors, and an interface layer that automatically selects the best
902implementation for the processor it is run on.
903
904@dfn{BLAKE2} (RFC 7693) is a family of high-speed cryptographic hash functions
905that are faster than MD5, SHA-1, SHA-2, and SHA-3, yet are at least as secure
906as the latest standard, SHA-3. It is an improved version of the SHA-3 finalist
907BLAKE.")
908 (license license:public-domain)))
909
910(define-public b2sum
911 ;; Upstream doesn't seem to use a versioned release workflow, so build from
912 ;; a recent commit.
913 (let ((commit "54f4faa4c16ea34bcd59d16e8da46a64b259fc07")
914 (revision "0"))
915 (package
916 (name "b2sum")
917 (version (git-version "20190724" revision commit))
918 (source (origin
919 (method git-fetch)
920 (uri (git-reference
921 (url "https://github.com/BLAKE2/BLAKE2")
922 (commit commit)))
923 (file-name (git-file-name name version))
924 (sha256
925 (base32 "04z631v0vzl52g73v390ask5fnzi5wg83lcjkjhpmmymaz0jn152"))))
926 ;; "This code requires at least SSE2".
927 (supported-systems '("x86_64-linux"))
928 (build-system gnu-build-system)
929 (arguments
930 `(#:make-flags (list (string-append "CC=" ,(cc-for-target))
931 (string-append "PREFIX=" (assoc-ref %outputs "out")))
932 #:tests? #f ; No test suite
933 #:phases
934 (modify-phases %standard-phases
935 (add-before 'build 'change-directory
936 (lambda _
937 (chdir "b2sum")))
938 ;; Produce generic binaries
939 (add-after 'change-directory 'de-tune
940 (lambda _
941 (substitute* "makefile"
942 ((" -march=native") ""))))
943 (delete 'configure)))) ; No ./configure script
944 (home-page "https://www.blake2.net/")
945 (synopsis "BLAKE2 checksum tool")
946 (description "BLAKE2 is a cryptographic hash function faster than MD5,
947SHA-1, SHA-2, and SHA-3, yet is at least as secure as SHA-3.")
948 ;; You may also choose to redistribute this program as Apache 2.0 or the
949 ;; OpenSSL license. See 'b2sum/b2sum.c' in the source distribution.
950 (license license:cc0)
951 ;; There is a significant speedup when the compiler generates
952 ;; instructions tuned to the CPU of the running machine:
953 ;; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=51198#22
954 (properties '((tunable? . #true))))))
955
956(define-public rhash
957 (package
958 (name "rhash")
959 (version "1.4.6")
960 (source
961 (origin
962 (method url-fetch)
963 (uri (string-append "mirror://sourceforge/rhash/rhash/" version
964 "/rhash-" version "-src.tar.gz"))
965 (file-name (string-append "rhash-" version ".tar.gz"))
966 (sha256
967 (base32
968 "0ylkxhkj4nzmb0iampn2lv7v4yw59x7dl8mdcxqcx2mfxv7ijq4z"))))
969 (build-system gnu-build-system)
970 (arguments
971 (list #:configure-flags
972 #~(list (string-append "--prefix=" #$output)
973 #$@(let ((target (%current-target-system)))
974 (if target
975 #~((string-append "--target=" #$target)
976 (string-append "--cc="
977 (assoc-ref %build-inputs "cross-gcc")
978 "/bin/" #$target "-gcc"))
979 #~())))
980 #:make-flags
981 ;; The binaries in /bin need some help finding librhash.so.0.
982 #~(list (string-append "LDFLAGS=-Wl,-rpath=" #$output "/lib"))
983 #:test-target "test" ; ‘make check’ just checks the sources
984 #:phases
985 #~(modify-phases %standard-phases
986 (delete 'configure)
987 (add-before 'build 'configure
988 ;; ./configure is not GNU autotools' and doesn't gracefully handle
989 ;; unrecognized options, so we must call it manually.
990 (lambda* (#:key configure-flags #:allow-other-keys)
991 (apply invoke "./configure" configure-flags)))
992 (add-before 'check 'patch-/bin/sh
993 (lambda _
994 (substitute* "Makefile"
995 (("/bin/sh") (which "sh")))))
996 (add-after 'install 'install-library-extras
997 (lambda* (#:key make-flags #:allow-other-keys)
998 (apply invoke
999 "make" "-C" "librhash"
1000 "install-lib-headers" "install-so-link"
1001 make-flags))))))
1002 (home-page "https://sourceforge.net/projects/rhash/")
1003 (synopsis "Utility for computing hash sums")
1004 (description "RHash is a console utility for calculation and verification
1005of magnet links and a wide range of hash sums like CRC32, MD4, MD5, SHA1,
1006SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R
100734.11-94, RIPEMD-160, HAS-160, EDON-R, Whirlpool and Snefru.")
1008 (license (license:non-copyleft "file://COPYING"))))
1009
1010(define-public botan
1011 (package
1012 (name "botan")
1013 (version "3.9.0")
1014 (source (origin
1015 (method git-fetch)
1016 (uri (git-reference
1017 (url "https://github.com/randombit/botan/")
1018 (commit version)))
1019 (file-name (git-file-name name version))
1020 (sha256
1021 (base32
1022 "1k5dyn39b77bfawly2yms0crbkn6g7msh16q7bxnh7dra4cnkmsn"))))
1023 (build-system gnu-build-system)
1024 (arguments
1025 (list
1026 #:phases
1027 #~(modify-phases %standard-phases
1028 (replace 'configure
1029 (lambda* (#:key inputs outputs #:allow-other-keys)
1030 ;; Upstream tests and benchmarks with -O3.
1031 (setenv "CXXFLAGS" "-O3")
1032 (invoke "python" "./configure.py"
1033 (string-append "--prefix=" #$output)
1034 "--disable-static"
1035
1036 ;; Otherwise, the `botan` executable cannot find
1037 ;; libbotan.
1038 (string-append "--ldflags=-Wl,-rpath=" #$output "/lib")
1039
1040 "--with-os-feature=getentropy"
1041 "--with-rst2man"
1042
1043 ;; Recommended by upstream
1044 "--with-zlib" "--with-bzip2" "--with-sqlite3")))
1045 (add-before 'check 'library-path-for-tests
1046 (lambda _ (setenv "LD_LIBRARY_PATH" (getcwd))))
1047 (replace 'check
1048 (lambda* (#:key tests? #:allow-other-keys)
1049 (when tests?
1050 (invoke "./botan-test")))))))
1051 (native-inputs (list python-wrapper python-docutils))
1052 (inputs (list sqlite bzip2 zlib))
1053 (synopsis "Cryptographic library in C++11")
1054 (description "Botan is a cryptography library, written in C++11, offering
1055the tools necessary to implement a range of practical systems, such as TLS/DTLS,
1056PKIX certificate handling, PKCS#11 and TPM hardware support, password hashing,
1057and post-quantum crypto schemes. In addition to the C++, botan has a C89 API
1058specifically designed to be easy to call from other languages. A Python binding
1059using ctypes is included, and several other language bindings are available.")
1060 (home-page "https://botan.randombit.net")
1061 (license license:bsd-2)))
1062
1063;; Needed explicitly by biboumi
1064(define-public botan-2
1065 (hidden-package
1066 (package
1067 (inherit botan)
1068 (name "botan")
1069 (version "2.19.3")
1070 (source
1071 (origin
1072 (method git-fetch)
1073 (uri (git-reference
1074 (url "https://github.com/randombit/botan/")
1075 (commit version)))
1076 (file-name (git-file-name name version))
1077 (sha256
1078 (base32
1079 "16dsrxb7z245hvbjzapq7qf65ip1fh2390qap30hpfd383dyvilw")))))))
1080
1081(define-public ccrypt
1082 (package
1083 (name "ccrypt")
1084 (version "1.11")
1085 (source (origin
1086 (method url-fetch)
1087 (uri (string-append "mirror://sourceforge/ccrypt/"
1088 version "/ccrypt-" version ".tar.gz"))
1089 (sha256
1090 (base32
1091 "0kx4a5mhmp73ljknl2lcccmw9z3f5y8lqw0ghaymzvln1984g75i"))))
1092 (build-system gnu-build-system)
1093 (home-page "https://ccrypt.sourceforge.net")
1094 (synopsis "Command-line utility for encrypting and decrypting files and streams")
1095 (description "@command{ccrypt} is a utility for encrypting and decrypting
1096files and streams. It was designed as a replacement for the standard unix
1097@command{crypt} utility, which is notorious for using a very weak encryption
1098algorithm. @command{ccrypt} is based on the Rijndael block cipher, a version of
1099which is also used in the Advanced Encryption Standard (AES, see
1100@url{http://www.nist.gov/aes}). This cipher is believed to provide very strong
1101security.")
1102 (license license:gpl2)))
1103
1104(define-public asignify
1105 (let ((commit "d6b3651fa96f05aeefc318f75503fc9ca77b1f58")
1106 (revision "2"))
1107 (package
1108 (name "asignify")
1109 (version (git-version "1.1" revision commit))
1110 (source (origin
1111 (method git-fetch)
1112 (uri (git-reference
1113 (url "https://github.com/vstakhov/asignify")
1114 (commit commit)))
1115 (file-name (git-file-name name version))
1116 (sha256
1117 (base32
1118 "0a6k21gb2n45bj1d2qy34lgi4qsd3ck59jxcycbxafs0wdglsyl9"))))
1119 (build-system gnu-build-system)
1120 (arguments
1121 (list
1122 #:configure-flags
1123 #~(list "--enable-openssl"
1124 (string-append "--with-openssl="
1125 #$(this-package-input "openssl")))))
1126 (native-inputs
1127 (list autoconf automake libtool))
1128 (inputs
1129 (list openssl))
1130 (home-page "https://github.com/vstakhov/asignify")
1131 (synopsis
1132 "Cryptographic authentication and encryption tool and library")
1133 (description "Asignify offers public cryptographic signatures and
1134encryption with a library or a command-line tool. The tool is heavily
1135inspired by signify as used in OpenBSD. The main goal of this project is to
1136define a high level API for signing files, validating signatures and
1137encrypting using public-key cryptography. Asignify is designed to be portable
1138and self-contained with zero external dependencies. Asignify can verify
1139OpenBSD signatures, but it cannot sign messages in OpenBSD format yet.")
1140 (license license:bsd-2))))
1141
1142(define-public embedded-json-signature
1143 ;; No releases, use latest commit.
1144 (let ((commit "2a571b0cbe8f8bdeacb02361fcf8be7c687f7778")
1145 (revision "0"))
1146 (package
1147 (name "embedded-json-signature")
1148 ;; For version, see top of EmbeddedJSONSignature.h.
1149 (version (git-version "1.0" revision commit))
1150 (source
1151 (origin
1152 (method git-fetch)
1153 (uri (git-reference
1154 (url "https://github.com/past-due/EmbeddedJSONSignature")
1155 (commit commit)))
1156 (file-name (git-file-name name version))
1157 (sha256
1158 (base32
1159 "1ixwymz6sngf378djh0yw5dg8v6iwcqyw68clnvnij8bl6a876f8"))))
1160 (build-system cmake-build-system)
1161 (arguments
1162 (list
1163 #:tests? #f ;no tests
1164 #:phases
1165 #~(modify-phases %standard-phases
1166 (add-after 'unpack 'do-shared
1167 (lambda _
1168 (substitute* "CMakeLists.txt" (("STATIC") "SHARED"))))
1169 (replace 'install ;no install phase
1170 (lambda _
1171 (let ((inc (in-vicinity #$output "include"))
1172 (lib (in-vicinity #$output "lib")))
1173 (install-file "../source/include/EmbeddedJSONSignature.h" inc)
1174 (install-file "libEmbeddedJSONSignature.so" lib)))))))
1175 (inputs (list libsodium))
1176 (home-page "https://github.com/past-due/EmbeddedJSONSignature")
1177 (synopsis "Simple embedded JSON signature algorithm for C++11 or later")
1178 (description "This package provides an @code{EmbeddedJSONSignature} C++
1179class for signing and verifying the integrity of JSON objects using
1180@code{libsodium}’s public-key signature system. Signatures are embedded into
1181the JSON object itself as a key/value pair, while verification methods allow
1182easy extraction of the unmodified object.")
1183 (license license:expat))))
1184
1185(define-public enchive
1186 (package
1187 (name "enchive")
1188 (version "3.5")
1189 (source (origin
1190 (method git-fetch)
1191 (uri (git-reference
1192 (url "https://github.com/skeeto/enchive")
1193 (commit version)))
1194 (sha256
1195 (base32
1196 "0fdrfc5l42lj2bvmv9dmkmhmm7qiszwk7cmdvnqad3fs7652g0qa"))
1197 (file-name (git-file-name name version))))
1198 (build-system gnu-build-system)
1199 (arguments
1200 (list
1201 #:tests? #f ;no check target '
1202 #:make-flags
1203 #~(list (string-append "CC=" #$(cc-for-target))
1204 (string-append "PREFIX=" #$output))
1205 #:phases
1206 #~(modify-phases %standard-phases
1207 (delete 'configure)
1208 (add-after 'install 'post-install
1209 (lambda _
1210 (install-file
1211 "enchive-mode.el"
1212 (string-append #$output "/share/emacs/site-lisp")))))))
1213 (synopsis "Encrypted personal archives")
1214 (description
1215 "Enchive is a tool to encrypt files to yourself for long-term
1216archival. It's a focused, simple alternative to more complex solutions such as
1217GnuPG or encrypted filesystems. Enchive has no external dependencies and is
1218trivial to build for local use. Portability is emphasized over performance.")
1219 (home-page "https://github.com/skeeto/enchive")
1220 (license license:unlicense)))
1221
1222(define-public libsecp256k1
1223 (package
1224 (name "libsecp256k1")
1225 (version "0.8.0")
1226 (source (origin
1227 (method git-fetch)
1228 (uri (git-reference
1229 (url "https://github.com/bitcoin-core/secp256k1")
1230 (commit (string-append "v" version))))
1231 (file-name (git-file-name name version))
1232 (sha256
1233 (base32
1234 "0n3sflwzrb0yjf4fsip4qm3yq5pg2qj88hakam7vd98r1fqk13zg"))))
1235 (build-system gnu-build-system)
1236 (arguments
1237 (list #:configure-flags
1238 #~(list
1239 "--enable-module-recovery"
1240 "--enable-experimental"
1241 "--enable-shared"
1242 "--disable-static"
1243 "--disable-benchmark")
1244 #:phases
1245 (if (%current-target-system)
1246 #~%standard-phases
1247 #~(modify-phases %standard-phases
1248 ;; These files are pre-generated, the build system is able to
1249 ;; re-generate those if not cross-compiling,
1250 (add-after 'unpack 'delete-precomputed-files
1251 (lambda _
1252 (for-each delete-file '("src/precomputed_ecmult.c"
1253 "src/precomputed_ecmult_gen.c"))))))))
1254 (native-inputs
1255 (list autoconf automake libtool))
1256 (synopsis "C library for EC operations on curve secp256k1")
1257 (description
1258 "Optimized C library for EC operations on curve secp256k1.
1259
1260Features:
1261
1262@itemize
1263@item secp256k1 ECDSA signing/verification and key generation.
1264@item Additive and multiplicative tweaking of secret/public keys.
1265@item Serialization/parsing of private keys, public keys, signatures.
1266@item Constant time, constant memory access signing and public key generation.
1267@item Derandomized ECDSA (via RFC6979 or with a caller provided function.)
1268@item Very efficient implementation.
1269@item Suitable for embedded systems.
1270@item No runtime dependencies.
1271@item Optional module for public key recovery.
1272@item Optional module for ECDH key exchange.
1273@item Optional module for Schnorr signatures according to BIP-340.
1274@end itemize\n")
1275 (home-page "https://github.com/bitcoin-core/secp256k1")
1276 (license license:expat)))
1277
1278(define-public libsecp256k1-bitcoin-cash
1279 (package
1280 (name "libsecp256k1-bitcoin-cash")
1281 (version "0.27.1")
1282 (source
1283 (origin
1284 (method git-fetch)
1285 (uri (git-reference
1286 (url "https://github.com/Bitcoin-ABC/secp256k1")
1287 (commit (string-append "v" version))))
1288 (file-name (git-file-name name version))
1289 (sha256
1290 (base32 "00g7zdwdk6ij1wv2l3wf389njq3svg0zz09i1kq77sk7p9larnfs"))))
1291 (build-system gnu-build-system)
1292 (native-inputs
1293 (list autoconf automake libtool))
1294 (arguments
1295 '(#:configure-flags '("--enable-module-recovery"
1296 "--enable-experimental"
1297 "--enable-module-ecdh"
1298 "--disable-jni"
1299 "--with-bignum=no"
1300 "--enable-module-schnorr"
1301 "--disable-static"
1302 "--enable-shared")))
1303 (synopsis "Optimized C library for EC operations on curve secp256k1")
1304 (description
1305 "Optimized C library for cryptographic operations on curve secp256k1.
1306
1307This library is used for consensus critical cryptographic operations on the
1308Bitcoin Cash network.
1309
1310Features:
1311
1312@itemize
1313@item secp256k1 ECDSA signing/verification and key generation.
1314@item secp256k1 Schnorr signing/verification (Bitcoin Cash Schnorr variant).
1315@item Additive and multiplicative tweaking of secret/public keys.
1316@item Serialization/parsing of secret keys, public keys, signatures.
1317@item Constant time, constant memory access signing and pubkey generation.
1318@item Derandomized ECDSA (via RFC6979 or with a caller provided function).
1319@item Very efficient implementation.
1320@item Suitable for embedded systems.
1321@item Optional module for public key recovery.
1322@item Optional module for ECDH key exchange (experimental).
1323@item Optional module for multiset hash (experimental).
1324@end itemize\n")
1325 (home-page "https://github.com/Bitcoin-ABC/secp256k1")
1326 (license license:expat)))
1327
1328(define-public stoken
1329 (package
1330 (name "stoken")
1331 (version "0.92")
1332 (source (origin
1333 (method url-fetch)
1334 (uri (string-append "mirror://sourceforge/stoken/"
1335 "stoken-" version ".tar.gz"))
1336 (sha256
1337 (base32
1338 "0npgr6y85gzwksy8jkwa4yzvqwjprwnplx3yiw3ayk4f0ldlhaxa"))))
1339 (build-system gnu-build-system)
1340 (native-inputs
1341 (list pkg-config))
1342 (inputs
1343 (list nettle libxml2))
1344 (home-page "https://stoken.sf.net")
1345 (synopsis "Software Token for cryptographic authentication")
1346 (description
1347 "@code{stoken} is a token code generator compatible with RSA SecurID
1348128-bit (AES) tokens. This package contains a standalone command-line program
1349that allows for importing token seeds, generating token codes, and various
1350utility/testing functions.")
1351 (license license:lgpl2.1+)))
1352
1353(define-public hpenc
1354 (package
1355 (name "hpenc")
1356 (version "3.0")
1357 (source (origin
1358 (method git-fetch)
1359 (uri (git-reference
1360 (url "https://github.com/vstakhov/hpenc")
1361 (commit version)))
1362 (file-name (git-file-name name version))
1363 (sha256
1364 (base32
1365 "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1"))))
1366 (build-system gnu-build-system)
1367 (arguments
1368 (list
1369 #:tests? #f ; No test suite
1370 #:make-flags
1371 #~(list (string-append "PREFIX=" #$output)
1372 ;; Build the program and the docs.
1373 "SUBDIRS=src doc")
1374 #:phases
1375 #~(modify-phases %standard-phases
1376 (delete 'configure) ; No ./configure script
1377 (add-after 'unpack 'patch-path
1378 (lambda _
1379 (substitute* '("src/Makefile" "doc/Makefile")
1380 (("/usr/bin/install")
1381 "install"))))
1382 (add-before 'install 'make-output-directories
1383 (lambda _
1384 (mkdir-p (string-append #$output "/bin"))
1385 (mkdir-p (string-append #$output "/share/man/man1")))))))
1386 (inputs
1387 (list libsodium openssl))
1388 (synopsis "High-performance command-line tool for stream encryption")
1389 (description "Hpenc is a command-line tool for performing authenticated
1390encryption (AES-GCM and ChaCha20-Poly1305) of streaming data. It does not
1391perform an asymmetric key exchange, instead requiring the user to distribute
1392pre-shared keys out of band. It is designed to handle large amounts of data
1393quickly by using all your CPU cores and hardware acceleration.")
1394 (home-page "https://github.com/vstakhov/hpenc")
1395 (license license:bsd-3)))
1396
1397(define-public minisign
1398 (package
1399 (name "minisign")
1400 (version "0.12")
1401 (source
1402 (origin
1403 (method git-fetch)
1404 (uri (git-reference
1405 (url "https://github.com/jedisct1/minisign")
1406 (commit version)))
1407 (file-name (git-file-name name version))
1408 (sha256
1409 (base32 "1b7iagx8jdyhvni24qhq13qydsinbh42gvb9dgn8d9vx3f33645a"))))
1410 (build-system cmake-build-system)
1411 (arguments
1412 `(#:tests? #f)) ; no test suite
1413 (native-inputs
1414 (list pkg-config))
1415 (inputs
1416 (list libsodium))
1417 (home-page "https://jedisct1.github.io/minisign")
1418 (synopsis "Tool to sign files and verify signatures")
1419 (description
1420 "Minisign is a dead simple tool to sign files and verify signatures. It is
1421portable, lightweight, and uses the highly secure Ed25519 public-key signature
1422system. Signature written by minisign can be verified using OpenBSD's
1423signify tool: public key files and signature files are compatible. However,
1424minisign uses a slightly different format to store secret keys. Minisign
1425signatures include trusted comments in addition to untrusted comments.
1426Trusted comments are signed, thus verified, before being displayed.")
1427 (license license:isc)))
1428
1429(define-public monocypher
1430 (package
1431 (name "monocypher")
1432 (version "4.0.3")
1433 (source
1434 (origin
1435 (method git-fetch)
1436 (uri (git-reference
1437 (url "https://github.com/LoupVaillant/Monocypher")
1438 (commit version)))
1439 (file-name (git-file-name name version))
1440 (sha256
1441 (base32 "08wk5l2r5k7akxx2s525f72pwqkv0pcf69dd60zwyggylz34lw65"))))
1442 (build-system gnu-build-system)
1443 (arguments
1444 (list
1445 #:make-flags #~(list (string-append "CC=" #$(cc-for-target))
1446 (string-append "PREFIX=" #$output))
1447 #:phases
1448 #~(modify-phases %standard-phases
1449 (delete 'configure)
1450 (add-before 'check 'build-tests
1451 (lambda* (#:key tests? make-flags #:allow-other-keys)
1452 (when tests?
1453 (with-directory-excursion "tests/gen"
1454 (apply invoke "make" make-flags)))))
1455 (add-after 'install 'delete-static-archive
1456 ;; Don't want, but Makefile can't be told to only build shared.
1457 (lambda _
1458 (delete-file (in-vicinity #$output "lib/libmonocypher.a")))))))
1459 (native-inputs
1460 (list libsodium ;tests only
1461 mandoc
1462 pkg-config
1463 python-cryptography ;python is test only
1464 python-minimal))
1465 (home-page "https://monocypher.org/")
1466 (synopsis "Easy to use crypto library")
1467 (description "Monocypher is an easy to use, easy to deploy, auditable crypto
1468library for C. Features include:
1469@itemize
1470@item Authenticated encryption with XChaCha20 and Poly1305 (RFC 8439)
1471@item Hashing and key derivation with BLAKE2b (and SHA-512)
1472@item Password Hashing with Argon2
1473@item Public Key Cryptography with X25519 key exchanges
1474@item Public Key Signatures with EdDSA and Ed25519
1475@end itemize")
1476 (license (list license:bsd-2 license:cc0)))) ;dual licensed
1477
1478(define-public olm
1479 (package
1480 (name "olm")
1481 (version "3.2.16")
1482 (source (origin
1483 (method git-fetch)
1484 (uri (git-reference
1485 (url "https://gitlab.matrix.org/matrix-org/olm")
1486 (commit version)))
1487 (sha256
1488 (base32
1489 "19yibssxn12q6ddl15nvqzvcf1hwqial48ng6llfafwbkfdb8z95"))
1490 (file-name (git-file-name name version))
1491 ;; Delete the bundled blob. It's free, but unauditable,
1492 ;; and apparently only required for android.
1493 (snippet '(delete-file
1494 "android/gradle/wrapper/gradle-wrapper.jar"))))
1495 (build-system cmake-build-system)
1496 (arguments
1497 (list
1498 #:phases
1499 #~(modify-phases %standard-phases
1500 (replace 'check
1501 (lambda* (#:key tests? #:allow-other-keys)
1502 (when tests?
1503 (with-directory-excursion "tests"
1504 (invoke "ctest" "."))))))))
1505 (synopsis "Implementation of the Olm and Megolm cryptographic ratchets")
1506 (description "The Olm library implements the Double Ratchet
1507cryptographic ratchet. It is written in C and C++11, and exposed as a C
1508API.")
1509 (home-page "https://gitlab.matrix.org/matrix-org/olm/")
1510 (license license:asl2.0)))
1511
1512;; TODO: This is the only Python package here, consider to build from source
1513;; directly without inheritance and move to python-crypto module.
1514(define-public python-olm
1515 (package
1516 ;; python-olm is part of olm and must be updated at the same time.
1517 (inherit olm)
1518 (name "python-olm")
1519 (build-system pyproject-build-system)
1520 (arguments
1521 (list
1522 #:phases
1523 #~(modify-phases %standard-phases
1524 (add-after 'unpack 'chdir
1525 (lambda _
1526 (chdir "python")))
1527 (add-before 'build 'set-preprocessor
1528 (lambda _
1529 (setenv "CPP" "gcc -E"))))))
1530 (inputs (list olm))
1531 (propagated-inputs
1532 (list python-cffi python-future))
1533 (native-inputs
1534 (list python-aspectlib
1535 python-pytest
1536 python-pytest-benchmark
1537 python-setuptools))
1538 (synopsis "Python bindings for Olm")
1539 (description "The Olm library implements the Double Ratchet
1540cryptographic ratchet. This package contains its Python bindings.")))
1541
1542(define-public hash-extender
1543 (let ((commit "f00b1a02eca02b0907e26726f7efe437bc396aa4")
1544 (revision "0"))
1545 (package
1546 (name "hash-extender")
1547 (version (git-version "0.02" revision commit)) ;from hash_extender.c
1548 (source (origin
1549 (method git-fetch)
1550 (uri (git-reference
1551 (url "https://github.com/iagox86/hash_extender")
1552 (commit commit)))
1553 (sha256
1554 (base32
1555 "12hh2vs8ppavjj47rgyp60cdw70lm2zqdpdv1zdgb3jgdzkg7bf2"))
1556 (file-name (git-file-name name version))))
1557 (build-system gnu-build-system)
1558 (arguments
1559 (list
1560 #:phases
1561 #~(modify-phases %standard-phases
1562 (delete 'configure)
1563 ;; See: https://github.com/iagox86/hash_extender/issues/29
1564 (delete 'check)
1565 (replace 'install
1566 (lambda _
1567 (install-file "hash_extender" (string-append #$output "/bin"))
1568 (install-file
1569 "README.md"
1570 (string-append
1571 #$output "/share/doc/hash-extender-" #$version)))))))
1572 (inputs
1573 (list openssl))
1574 (synopsis "Tool for hash length extension attacks")
1575 (description "@command{hash_extender} is a utility for performing hash
1576length extension attacks supporting MD4, MD5, RIPEMD-160, SHA-0, SHA-1,
1577SHA-256, SHA-512, and WHIRLPOOL hashes.")
1578 (home-page "https://github.com/iagox86/hash_extender")
1579 (license license:bsd-3))))
1580
1581(define-public mkp224o
1582 (package
1583 (name "mkp224o")
1584 (version "1.7.0")
1585 (source (origin
1586 (method git-fetch)
1587 (uri (git-reference
1588 (url "https://github.com/cathugger/mkp224o")
1589 (commit (string-append "v" version))))
1590 (sha256
1591 (base32
1592 "1d0mrp936if1zi8ss0mmywglsmrl0jx42x2sgnm56js8ij3g3g9q"))
1593 (file-name (git-file-name name version))))
1594 (build-system gnu-build-system)
1595 (arguments
1596 (list
1597 #:tests? #f ; no test suite
1598 #:phases
1599 #~(modify-phases %standard-phases
1600 (add-before 'configure 'set-cflags
1601 (lambda _
1602 (setenv "CFLAGS" "-O3")))
1603 (replace 'install
1604 (lambda _
1605 (install-file "mkp224o" (string-append #$output "/bin")))))))
1606 (native-inputs
1607 (list autoconf))
1608 (inputs
1609 (list libsodium))
1610 (synopsis "Tor hidden service v3 name generator")
1611 (description "@code{mkp224o} generates valid ed25519 (hidden service
1612version 3) onion addresses. It allows one to produce customized vanity .onion
1613addresses using a brute-force method.")
1614 (home-page "https://github.com/cathugger/mkp224o")
1615 (license license:cc0)))
1616
1617(define-public transcrypt
1618 (package
1619 (name "transcrypt")
1620 (version "2.3.1")
1621 (source
1622 (origin
1623 (method git-fetch)
1624 (uri (git-reference
1625 (url "https://github.com/elasticdog/transcrypt")
1626 (commit (string-append "v" version))))
1627 (sha256
1628 (base32 "1yp1s69wphhsaks46rfj2ann8z397jgvbbq22ikdwxcw96f49pmk"))
1629 (file-name (git-file-name name version))))
1630 (inputs
1631 (list git openssl))
1632 (build-system copy-build-system)
1633 (arguments
1634 (list
1635 #:install-plan
1636 #~'(("transcrypt" "bin/transcrypt")
1637 ("man/transcrypt.1" "share/man/man1/transcrypt.1")
1638 ("contrib/bash/transcrypt"
1639 "share/bash-completion/completions/transcrypt")
1640 ("contrib/zsh/_transcrypt"
1641 "share/zsh/site-functions/_transcrypt"))))
1642 (home-page "https://github.com/elasticdog/transcrypt")
1643 (synopsis "Transparently encrypt files within a git repository")
1644 (description
1645 "Transcrypt is a script to configure transparent encryption of sensitive
1646files stored in a Git repository. Files that you choose will be automatically
1647encrypted when you commit them, and automatically decrypted when you check
1648them out. The process will degrade gracefully, so even people without your
1649encryption password can safely commit changes to the repository's
1650non-encrypted files.")
1651 (license license:expat)))
1652
1653(define-public cryfs
1654 (package
1655 (name "cryfs")
1656 (version "1.0.3")
1657 (source
1658 (origin
1659 (method url-fetch)
1660 (uri (string-append
1661 "https://github.com/cryfs/cryfs/releases/download/"
1662 version "/cryfs-" version ".tar.xz"))
1663 (sha256
1664 (base32 "1zlxbch22pdwvwpplcgzpx109a4plwc4a5qlpa8190awdr0cqc0z"))
1665 (patches (search-patches "cryfs-fuse3-up.patch"))))
1666 (build-system cmake-build-system)
1667 (arguments
1668 '(#:modules ((guix build cmake-build-system)
1669 (guix build utils)
1670 (srfi srfi-1))
1671 #:configure-flags
1672 ;; Note: This also disables checking for security issues.
1673 '("-DCRYFS_UPDATE_CHECKS=OFF"
1674 "-DBUILD_TESTING=ON")
1675 ;; crypto++ is still bundled: https://github.com/cryfs/cryfs/issues/369
1676 #:phases
1677 (modify-phases %standard-phases
1678 (add-before 'configure 'fix-up
1679 (lambda* (#:key tests? #:allow-other-keys)
1680 (chdir "..") ; We end up in .github somehow
1681 ;; Install documentation with Guix defaults.
1682 (substitute* "doc/CMakeLists.txt"
1683 (("CONFIGURATIONS Release")
1684 "CONFIGURATIONS Release RelWithDebInfo"))))
1685 (replace 'check
1686 (lambda* (#:key tests? #:allow-other-keys)
1687 (when tests?
1688 (setenv "HOME" "/tmp")))))))
1689 (native-inputs
1690 (list googletest pkg-config python-wrapper))
1691 (inputs
1692 (list boost curl fuse range-v3 spdlog))
1693 (home-page "https://www.cryfs.org/")
1694 (synopsis "Encrypted FUSE filesystem for the cloud")
1695 (description "CryFS encrypts your files, so you can safely store them anywhere.
1696It works well together with cloud services like Dropbox, iCloud, OneDrive and
1697others. CryFS creates an encrypted userspace filesystem that can be mounted
1698via FUSE without root permissions. It is similar to EncFS, but provides
1699additional security and privacy measures such as hiding file sizes and directory
1700structure. However CryFS is not considered stable yet by the developers.")
1701 (license license:lgpl3+)
1702 (properties `((tunable? . #t)))))
1703
1704(define-public b3sum
1705 (package
1706 (name "b3sum")
1707 (version "1.8.4")
1708 (source
1709 (origin
1710 (method url-fetch)
1711 (uri (crate-uri "b3sum" version))
1712 (file-name (string-append name "-" version ".tar.gz"))
1713 (sha256
1714 (base32 "0pkra5zh680cl9q92hpzmg9flz99b06bhpg7jyhymg1nkm0anw7a"))))
1715 (build-system cargo-build-system)
1716 (arguments
1717 (list
1718 #:install-source? #f
1719 #:phases
1720 #~(modify-phases %standard-phases
1721 (add-before 'check 'patch-tests
1722 (lambda _
1723 (substitute* "tests/cli_tests.rs"
1724 (("/bin/sh") (which "sh"))))))))
1725 (inputs (cargo-inputs 'b3sum))
1726 (home-page "https://github.com/BLAKE3-team/BLAKE3")
1727 (synopsis "Command line BLAKE3 checksum tool")
1728 (description "This package provides @code{b3sum}, a command line
1729checksum tool based on the BLAKE3 cryptographic hash function.")
1730 ;; Users may choose between these two licenses when redistributing the
1731 ;; program provided by this package.
1732 (license (list license:cc0 license:asl2.0))))
1733
1734(define-public libxcrypt
1735 (package
1736 (name "libxcrypt")
1737 (version "4.4.38")
1738 (source
1739 (origin
1740 (method url-fetch)
1741 (uri
1742 (string-append
1743 "https://github.com/besser82/libxcrypt/releases/download/v" version
1744 "/libxcrypt-" version ".tar.xz"))
1745 (sha256
1746 (base32 "1mkd42s12iagnpqk29hqi5vk2a6vkdaagn81gwr9k9vf62f4nc40"))))
1747 (build-system gnu-build-system)
1748 (native-inputs
1749 (list perl))
1750 (arguments
1751 (cond
1752 ((target-ppc32?)
1753 (list #:tests? #f)) ; TODO: Investigate test failures.
1754 ((target-mingw?)
1755 (list #:configure-flags
1756 #~(list #$(string-append "CFLAGS=-g -O2"
1757 " -Wno-error=pedantic"
1758 " -Wno-error=conversion")
1759 "ac_cv_ld_no_undefined=-no-undefined")))
1760 (else '())))
1761 (synopsis
1762 "Extended crypt library for descrypt, md5crypt, bcrypt, and others")
1763 (description
1764 "libxcrypt is a modern library for one-way hashing of passwords. It
1765supports a wide variety of both modern and historical hashing methods:
1766yescrypt, gost-yescrypt, scrypt, bcrypt, sha512crypt, sha256crypt, md5crypt,
1767SunMD5, sha1crypt, NT, bsdicrypt, bigcrypt, and descrypt.")
1768 (home-page "https://github.com/besser82/libxcrypt")
1769 (license license:lgpl2.1)))
1770
1771(define-public libxcrypt-without-failure-tokens
1772 ;; This version of libxcrypt is used for guile-2.2.4, which is used in Guix
1773 ;; v1.0.0 and thus needs to be supported for guix time-machine.
1774 ;;
1775 ;; Guile uses the 'crypt' hashing function that used to be provided by glibc,
1776 ;; but was moved to libxcrypt around glibc 2.39. However, the crypt function
1777 ;; in libxcrypt works differently for invalid salt values: libxcrypt returnns
1778 ;; the failure token "*0" for (crypt "pass" "$X$abc"), where glibc raised
1779 ;; "Invalid argument" (EINVAL). The --disable-failure-tokens flag lets
1780 ;; libxcrypt behave in the same way as glibc.
1781 ;;
1782 ;; Guile 2.2.4 explicitly checks for the glibc behavior of crypt, and thus
1783 ;; needs libxcrypt to be compiled with --disable-failure-tokens.
1784 (hidden-package
1785 (package/inherit libxcrypt
1786 (name "libxcrypt-without-failure-tokens")
1787 (arguments
1788 (substitute-keyword-arguments arguments
1789 ((#:configure-flags flags #~'())
1790 #~(cons* "--disable-failure-tokens" #$flags)))))))
1791
1792(define-public keychain
1793 (package
1794 (name "keychain")
1795 (version "2.9.8")
1796 (source (origin
1797 (method git-fetch)
1798 (uri (git-reference
1799 (url "https://github.com/danielrobbins/keychain")
1800 (commit version)))
1801 (file-name (git-file-name name version))
1802 (sha256
1803 (base32
1804 "1ps1hm6xf12agbrgw3jpja28q6b52cpa0fgsvkyhp4j1b2hfhkf6"))))
1805 (build-system gnu-build-system)
1806 (arguments
1807 (list
1808 #:tests? #f ; No test suite
1809 #:phases
1810 #~(modify-phases %standard-phases
1811 (delete 'configure)
1812 (replace 'install
1813 (lambda _
1814 (install-file "keychain" (string-append #$output "/bin/"))
1815 (install-file "keychain.1"
1816 (string-append #$output "/share/man/man1")))))))
1817 (propagated-inputs
1818 (list procps))
1819 (native-inputs
1820 (list perl))
1821 (synopsis
1822 "SSH or GPG agent frontend that can share a single agent on the same
1823system")
1824 (description
1825 "Keychain is usually run from shell profiles like ~/.bash_profile, but
1826it is also possible to use it with non-interactive shells. It works
1827with various operating systems (including GNU/Linux and HURD) and
1828shells (like bourne-compatible, csh-compatible and fish shells). By
1829default Keychain will only start ssh-agent, but it can also be
1830configured to start gpg-agent.")
1831 (home-page "https://github.com/danielrobbins/keychain")
1832 (license license:gpl2)))
1833
1834(define-public libdigidocpp
1835 (package
1836 (name "libdigidocpp")
1837 (version "4.3.0")
1838 (source
1839 (origin
1840 (method git-fetch)
1841 (uri (git-reference
1842 (url "https://github.com/open-eid/libdigidocpp")
1843 (commit (string-append "v" version))))
1844 (file-name (git-file-name name version))
1845 (sha256
1846 (base32 "1kv1cyc8ylsxcvhsx1lgbjaar7ilf14gmcnmzclql2wd5vf1973z"))
1847 (modules '((guix build utils)))
1848 (snippet '(delete-file-recursively "src/minizip"))))
1849 (build-system cmake-build-system)
1850 (arguments (list #:test-exclude "runtest"))
1851 (native-inputs (list boost pkg-config))
1852 (inputs
1853 (list libltdl
1854 libxml2
1855 libxslt
1856 minizip-ng-compat
1857 openssl
1858 xmlsec-openssl
1859 zlib))
1860 (home-page "https://github.com/open-eid/libdigidocpp")
1861 (synopsis "DigiDoc digital signature library")
1862 (description "DigiDoc is an XML file format for documents with digital
1863signatures used by the Estonian ID card infrastructure. This library allows
1864for creation and reading of DigiDoc files.")
1865 (license license:lgpl2.1+)))
1866
1867(define-public osslsigncode
1868 (package
1869 (name "osslsigncode")
1870 (version "2.14")
1871 (source
1872 (origin
1873 (method git-fetch)
1874 (uri (git-reference
1875 (url "https://github.com/mtrojnar/osslsigncode")
1876 (commit version)))
1877 (file-name (git-file-name name version))
1878 (sha256
1879 (base32 "06ybcp9r8w0algxvvv0mz4h1cjw764b33s9b26n1dhvpl1dqc24c"))))
1880 (build-system cmake-build-system)
1881 (arguments
1882 (list
1883 #:parallel-tests? #f))
1884 (inputs (list openssl zlib))
1885 (native-inputs (list python-cryptography python-minimal-wrapper))
1886 (home-page "https://github.com/mtrojnar/osslsigncode")
1887 (synopsis
1888 "Authenticode signing for PE, CAB, CAT, MSI, APPX and script files")
1889 (description
1890 "osslsigncode is a small tool that implements part of the
1891functionality of the Microsoft tool signtool.exe - more exactly the Authenticode
1892signing and timestamping. It is based on OpenSSL.")
1893 (license license:gpl3+)))