projects/guix·blob python-team · refs

1402 lines · 55.6 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2012-2017, 2019-2025 Ludovic Courtès <[email protected]>
3;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2021 Mark H Weaver <[email protected]>
4;;; Copyright © 2014 Ian Denhardt <[email protected]>
5;;; Copyright © 2013, 2015, 2026 Andreas Enge <[email protected]>
6;;; Copyright © 2015 David Thompson <[email protected]>
7;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Leo Famulari <[email protected]>
8;;; Copyright © 2016, 2017, 2019, 2021-2024 Efraim Flashner <[email protected]>
9;;; Copyright © 2016, 2017, 2018 Nikita <[email protected]>
10;;; Copyright © 2016 Hartmut Goebel <[email protected]>
11;;; Copyright © 2017 Ricardo Wurmus <[email protected]>
12;;; Copyright © 2017-2022 Marius Bakke <[email protected]>
13;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <[email protected]>
14;;; Copyright © 2017 Rutger Helling <[email protected]>
15;;; Copyright © 2018 Clément Lassieur <[email protected]>
16;;; Copyright © 2019 Mathieu Othacehe <[email protected]>
17;;; Copyright © 2020, 2023, 2025 Janneke Nieuwenhuizen <[email protected]>
18;;; Copyright © 2020, 2021, 2023-2025 Maxim Cournoyer <[email protected]>
19;;; Copyright © 2021 Solene Rapenne <[email protected]>
20;;; Copyright © 2021 Brice Waegeneire <[email protected]>
21;;; Copyright © 2021 Maxime Devos <[email protected]>
22;;; Copyright © 2021 Matthew James Kraai <[email protected]>
23;;; Copyright © 2021 John Kehayias <[email protected]>
24;;; Copyright © 2022 Greg Hogan <[email protected]>
25;;; Copyright © 2024-2026 Ashish SHUKLA <[email protected]>
26;;; Copyright © 2026 Junker <[email protected]>
27;;;
28;;; This file is part of GNU Guix.
29;;;
30;;; GNU Guix is free software; you can redistribute it and/or modify it
31;;; under the terms of the GNU General Public License as published by
32;;; the Free Software Foundation; either version 3 of the License, or (at
33;;; your option) any later version.
34;;;
35;;; GNU Guix is distributed in the hope that it will be useful, but
36;;; WITHOUT ANY WARRANTY; without even the implied warranty of
37;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38;;; GNU General Public License for more details.
39;;;
40;;; You should have received a copy of the GNU General Public License
41;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
42
43(define-module (gnu packages tls)
44 #:use-module ((guix licenses) #:prefix license:)
45 #:use-module (guix deprecation)
46 #:use-module (guix packages)
47 #:use-module (guix download)
48 #:use-module (guix git-download)
49 #:use-module (guix utils)
50 #:use-module (guix gexp)
51 #:use-module (guix build-system gnu)
52 #:use-module (guix build-system go)
53 #:use-module (guix build-system perl)
54 #:use-module (guix build-system pyproject)
55 #:use-module (guix build-system cmake)
56 #:use-module (guix build-system trivial)
57 #:use-module (guix build-system meson)
58 #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR $SSL_CERT_FILE))
59 #:use-module (gnu packages compression)
60 #:use-module (gnu packages)
61 #:use-module (gnu packages autotools)
62 #:use-module (gnu packages base)
63 #:use-module (gnu packages bash)
64 #:use-module (gnu packages build-tools)
65 #:use-module (gnu packages check)
66 #:use-module (gnu packages certs)
67 #:use-module (gnu packages curl)
68 #:use-module (gnu packages dns)
69 #:use-module (gnu packages docbook)
70 #:use-module (gnu packages documentation)
71 #:use-module (gnu packages gawk)
72 #:use-module (gnu packages gettext)
73 #:use-module (gnu packages guile)
74 #:use-module (gnu packages libbsd)
75 #:use-module (gnu packages libffi)
76 #:use-module (gnu packages libidn)
77 #:use-module (gnu packages libunistring)
78 #:use-module (gnu packages linux)
79 #:use-module (gnu packages ncurses)
80 #:use-module (gnu packages nettle)
81 #:use-module (gnu packages networking)
82 #:use-module (gnu packages nss)
83 #:use-module (gnu packages perl)
84 #:use-module (gnu packages pkg-config)
85 #:use-module (gnu packages python)
86 #:use-module (gnu packages python-build)
87 #:use-module (gnu packages python-crypto)
88 #:use-module (gnu packages python-web)
89 #:use-module (gnu packages python-xyz)
90 #:use-module (gnu packages sphinx)
91 #:use-module (gnu packages texinfo)
92 #:use-module (gnu packages time)
93 #:use-module (gnu packages version-control)
94 #:use-module (gnu packages xml)
95 #:use-module (srfi srfi-1)
96 #:use-module (srfi srfi-34)
97 #:use-module (srfi srfi-35))
98
99(define-public libtasn1
100 (package
101 (name "libtasn1")
102 (version "4.21.0")
103 (source
104 (origin
105 (method url-fetch)
106 (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
107 version ".tar.gz"))
108 (sha256
109 (base32
110 "11ywcy8n115c8b3vmf7hmgkdhlfy4phlcwvp8114di9w495492hx"))))
111 (build-system gnu-build-system)
112 (arguments
113 `(#:configure-flags '("--disable-static")))
114 (native-inputs (list perl))
115 (home-page "https://www.gnu.org/software/libtasn1/")
116 (synopsis "ASN.1 library")
117 (description
118 "GNU libtasn1 is a library implementing the ASN.1 notation. It is used
119for transmitting machine-neutral encodings of data objects in computer
120networking, allowing for formal validation of data according to some
121specifications.")
122 (license license:lgpl2.0+)))
123
124(define-public asn1c
125 (package
126 (name "asn1c")
127 (version "0.9.28")
128 (source (origin
129 (method url-fetch)
130 (uri (string-append "https://lionet.info/soft/asn1c-"
131 version ".tar.gz"))
132 (sha256
133 (base32
134 "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
135 (build-system gnu-build-system)
136 (native-inputs
137 (list perl))
138 (home-page "https://lionet.info/asn1c")
139 (synopsis "ASN.1 to C compiler")
140 (description "The ASN.1 to C compiler takes ASN.1 module
141files and generates C++ compatible C source code. That code can be
142used to serialize the native C structures into compact and unambiguous
143BER/XER/PER-based data files, and deserialize the files back.
144
145Various ASN.1 based formats are widely used in the industry, such as to encode
146the X.509 certificates employed in the HTTPS handshake, to exchange control
147data between mobile phones and cellular networks, to car-to-car communication
148in intelligent transportation networks.")
149 (license license:bsd-2)))
150
151(define-public p11-kit
152 (package
153 (name "p11-kit")
154 (version "0.26.2")
155 (source
156 (origin
157 (method url-fetch)
158 (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
159 "download/" version "/p11-kit-" version ".tar.xz"))
160 (sha256
161 (base32 "0a7qxkfaj7ayq5b3vw850h6ndr88f37ygmbk3qaa64s8v929zz89"))))
162 (build-system gnu-build-system)
163 (native-inputs
164 (list nss-certs ;default certificates
165 pkg-config
166 python-minimal)) ;to generate some headers
167 (inputs
168 (append (list libffi libtasn1)
169 (if (target-hurd?)
170 (list libbsd)
171 '())))
172 (arguments
173 (list
174 #:configure-flags
175 #~(list (string-append
176 "--with-trust-paths="
177 (string-join
178 '("/etc/ssl/certs/ca-certificates.crt" ;debian, gentoo, etc.
179 "/etc/pki/tls/certs/ca-bundle.crt" ;fedora, centos
180 "/var/lib/ca-certificates/ca-bundle.pem"
181 ;; It's not enough to point directly to the nss-certs'
182 ;; etc/ssl/certs directory; we must ensure the .pem
183 ;; certificates from a directory are found under the
184 ;; anchors/ subdirectory to be trusted (see:
185 ;; https://p11-glue.github.io/p11-glue/p11-kit/
186 ;; manual/trust-module.html#trust-files).
187 #$(file-union
188 "nss-certs"
189 `(("anchors"
190 ,(file-append (this-package-native-input "nss-certs")
191 "/etc/ssl/certs")))))
192 ":")))))
193 (native-search-paths
194 (list (search-path-specification
195 (variable "P11_MODULE_PATH")
196 (files (list "share/p11-kit/modules"))
197 ;; Helas, this only currently support a single PATH entry. It'll
198 ;; thus only work in profiles, not in the build environment.
199 (separator #f))))
200 (home-page "https://p11-glue.github.io/p11-glue/p11-kit.html")
201 (synopsis "PKCS#11 library")
202 (description
203 "p11-kit provides a way to load and enumerate PKCS#11 modules. It
204provides a standard configuration setup for installing PKCS#11 modules
205in such a way that they are discoverable. It also solves problems with
206coordinating the use of PKCS#11 by different components or libraries
207living in the same process.")
208 (license license:bsd-3)))
209
210(define-public gnutls
211 (package
212 (name "gnutls")
213 (version "3.8.13")
214 (source (origin
215 (method url-fetch)
216 ;; Note: Releases are no longer on ftp.gnu.org since the
217 ;; schism (after version 3.1.5).
218 (uri (string-append "mirror://gnupg/gnutls/v"
219 (version-major+minor version)
220 "/gnutls-" version ".tar.xz"))
221 (sha256
222 (base32
223 "0zn9m5nb3a4r9rh5ws3xaczbals7vrvy7ahl9xnl5hh9pz0qxvgz"))))
224 (build-system gnu-build-system)
225 (arguments
226 (list #:tests? (not (or (%current-target-system)
227 (target-hurd?)))
228 ;; Ensure we don't keep a reference to the tools used for testing.
229 #:disallowed-references
230 (if (target-hurd?)
231 '()
232 (list (this-package-native-input "net-tools")
233 (this-package-native-input "iproute2")
234 (this-package-native-input "socat")))
235
236 #:configure-flags
237 #~(list
238 ;; dlopen (the default otherwise) doesn't work reliably on Guix
239 ;; due to its non-FHS nature and the lack of a global
240 ;; ld.so.cache file.
241 "--with-zlib=link"
242 "--with-zstd=link"
243 ;; Configure GnuTLS to use the p11-kit trust module by default,
244 ;; which is more flexible and knows to look at locations we've
245 ;; configured it to, on top of allowing users to configure it
246 ;; further.
247 "--with-default-trust-store-pkcs11=pkcs11:")
248 #:phases
249 #~(modify-phases %standard-phases
250 #$@(if (target-ppc32?)
251 ;; https://gitlab.com/gnutls/gnutls/-/issues/1354
252 ;; Extend the test timeout from the default of 20 * 1000
253 #~((add-after 'unpack 'increase-test-timeout
254 (lambda _
255 (setenv "GNUTLS_TEST_TIMEOUT" "60000"))))
256 #~())
257 (add-after 'install 'move-doc
258 (lambda* (#:key outputs #:allow-other-keys)
259 ;; Copy the 4.1 MiB of section 3 man pages to "doc".
260 (let* ((out (assoc-ref outputs "out"))
261 (doc (assoc-ref outputs "doc"))
262 (mandir (string-append doc "/share/man/man3"))
263 (oldman (string-append out "/share/man/man3")))
264 (mkdir-p mandir)
265 (copy-recursively oldman mandir)
266 (delete-file-recursively oldman)))))))
267 (outputs '("out" ;4.4 MiB
268 "debug"
269 "doc")) ;4.1 MiB of man pages
270 (native-inputs
271 (append (list pkg-config
272 texinfo
273 util-linux) ;one test needs 'setsid'
274 (if (target-hurd?)
275 '()
276 (list net-tools
277 iproute ;for 'ss'
278 socat ;several tests rely on it
279 datefudge)))) ;tests rely on 'datefudge'
280 (inputs (list libunistring zlib))
281 (propagated-inputs
282 ;; These are all in the 'Requires.private' field of gnutls.pc.
283 (list libtasn1 libidn2 p11-kit nettle zlib `(,zstd "lib")))
284 (home-page "https://gnutls.org")
285 (synopsis "Transport layer security library")
286 (description
287 "GnuTLS is a secure communications library implementing the SSL, TLS
288and DTLS protocols. It is provided in the form of a C library to support the
289protocols, as well as to parse and write X.509, PKCS #12, OpenPGP and other
290required structures.")
291 (license license:lgpl2.1+)
292 (properties
293 ;; Since gnutls.org doesn't have a page with a direct link to the
294 ;; tarball, defer to fellow LFS hackers.
295 '((release-monitoring-url
296 . "https://www.linuxfromscratch.org/blfs/view/svn/postlfs/gnutls.html")
297 (upstream-name . "gnutls")))))
298
299(define-deprecated/public-alias gnutls-latest gnutls)
300
301(define-public gnutls/dane
302 ;; GnuTLS with build libgnutls-dane, implementing DNS-based
303 ;; Authentication of Named Entities. This is required for GNS functionality
304 ;; by GNUnet and gnURL. This is done in an extra package definition
305 ;; to have the choice between GnuTLS with Dane and without Dane.
306 (package/inherit gnutls
307 (name "gnutls-dane")
308 (inputs (modify-inputs inputs
309 (prepend unbound)))))
310
311(define-public guile-gnutls
312 (package
313 ;; This package supersedes the Guile bindings that came with GnuTLS until
314 ;; version 3.7.8 included.
315 (name "guile-gnutls")
316 (version "5.0.2")
317 (home-page "https://codeberg.org/guile-gnutls/guile-gnutls")
318 (source (origin
319 ;; url-fetch is used here to avoid a circular dependency with
320 ;; git-download, see https://issues.guix.gnu.org/63331
321 (method url-fetch)
322 (uri (string-append "mirror://gnu/gnutls/guile-gnutls-v"
323 version "-src.tar.gz"))
324 (sha256
325 (base32
326 "1g1v2l9iczfc1h662szcgaxgri403kam5flyjq6rpja4jixxbxjg"))))
327 (build-system gnu-build-system)
328 (outputs '("out" "debug"))
329 (arguments
330 (list
331 #:configure-flags
332 ;; Tell the build system that we want Guile bindings installed to the
333 ;; output instead of Guiles own module directory.
334 #~(list "--disable-static"
335 (string-append "--with-guile-site-dir="
336 "$(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)")
337 (string-append "--with-guile-site-ccache-dir="
338 "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache")
339 (string-append "--with-guile-extension-dir="
340 "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/extensions"))))
341 (native-inputs
342 (list libtool
343 autoconf automake
344 pkg-config
345 texinfo
346 gnutls
347 guile-3.0)) ;XXX: 'guile-snarf' invokes the native 'cpp'
348 (inputs
349 (list gnutls
350 guile-3.0))
351 (properties '((ftp-directory . "gnutls")))
352 (synopsis "Guile bindings to GnuTLS")
353 (description
354 "This package provides Guile bindings to GnuTLS, a library implementation
355the @acronym{TLS, Transport-Layer Security} protocol. It supersedes the Guile
356bindings that were formerly provided as part of GnuTLS.")
357 (license license:lgpl2.1+)))
358
359(define-public guile2.2-gnutls
360 (package/inherit guile-gnutls
361 (name "guile2.2-gnutls")
362 (native-inputs
363 (modify-inputs native-inputs
364 (replace "guile" guile-2.2)))
365 (inputs
366 (modify-inputs inputs
367 (replace "guile" guile-2.2)))))
368
369(define (target->openssl-target pkg target)
370 "Return the value to set CONFIGURE_TARGET_ARCH to when cross-compiling
371OpenSSL for TARGET."
372 ;; Keep this code outside the build code,
373 ;; such that new targets can be added
374 ;; without causing rebuilds for other targets.
375 (if (target-mingw? target)
376 (string-append
377 "mingw"
378 (if (target-x86-64? target)
379 "64"
380 ""))
381 (let ((kernel
382 (cond ((target-hurd? target)
383 "hurd")
384 ((and (target-linux? target)
385 (or (target-riscv64? target)
386 (target-loongarch64? target)))
387 "linux64")
388 ((target-linux? target)
389 "linux")
390 (else
391 (raise (condition
392 (&package-unsupported-target-error
393 (package pkg)
394 (target target)))))))
395 (arch
396 (cond
397 ((target-x86-32? target)
398 "x86")
399 ((target-x32? target)
400 "x32")
401 ((target-x86-64? target)
402 "x86_64")
403 ((target-mips64el? target)
404 "mips64")
405 ((target-arm32? target)
406 "armv4")
407 ((target-aarch64? target)
408 "aarch64")
409 ((target-ppc64le? target)
410 "ppc64le")
411 ((target-ppc32? target)
412 "ppc")
413 ((and (target-powerpc? target)
414 (target-64bit? target))
415 "ppc64")
416 ((target-loongarch64? target)
417 "loongarch64")
418 ((target-riscv64? target)
419 "riscv64")
420 ((target-64bit? target)
421 "generic64")
422 (else
423 (raise (condition
424 (&package-unsupported-target-error
425 (package pkg)
426 (target target))))))))
427 (string-append kernel "-" arch))))
428
429(define-public openssl-1.1
430 (package
431 (name "openssl")
432 (version "1.1.1w")
433 (source (origin
434 (method url-fetch)
435 (uri (list (string-append "https://www.openssl.org/source/openssl-"
436 version ".tar.gz")
437 (string-append "ftp://ftp.openssl.org/source/"
438 "openssl-" version ".tar.gz")
439 (string-append "ftp://ftp.openssl.org/source/old/"
440 (string-trim-right version char-set:letter)
441 "/openssl-" version ".tar.gz")))
442 (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
443 (sha256
444 (base32
445 "1j3anw4554lk3m9cvjngvh1c2gbdkhgiz160jnnm7n5l1jarhc6g"))))
446 (build-system gnu-build-system)
447 (outputs '("out"
448 "doc" ;6.8 MiB of man3 pages and full HTML documentation
449 "static")) ;6.4 MiB of .a files
450 (native-inputs (list perl))
451 (arguments
452 (list
453 #:make-flags
454 (if (or (target-arm?) (target-riscv64?))
455 ;; 'test_afalg' seems to be dependent on kernel features:
456 ;; <https://github.com/openssl/openssl/issues/12242>.
457 #~(list "TESTS=-test_afalg")
458 #~(list))
459 #:test-target "test"
460 ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
461 ;; so we explicitly disallow it here.
462 #:disallowed-references (list (this-package-native-input "perl"))
463 #:phases
464 #~(modify-phases %standard-phases
465 #$@(if (%current-target-system)
466 #~((add-before 'configure 'set-cross-compile
467 (lambda* (#:key target #:allow-other-keys)
468 (setenv "CROSS_COMPILE" (string-append target "-"))
469 (setenv "CONFIGURE_TARGET_ARCH"
470 #$(target->openssl-target
471 this-package
472 (%current-target-system))))))
473 #~())
474 #$@(if (target-hurd?)
475 #~((add-after 'unpack 'patch-configure
476 (lambda _
477 (substitute* "config"
478 (("case \"\\$GUESSOS\" in.*" all)
479 (string-append all "hurd-x86*) OUT=hurd-x86;;\n"))))))
480 #~())
481 (replace 'configure
482 (lambda* (#:key configure-flags #:allow-other-keys)
483 ;; It's not a shebang so patch-source-shebangs misses it.
484 (substitute* "config"
485 (("/usr/bin/env")
486 (which "env")))
487 (apply
488 invoke #$@(if (%current-target-system)
489 #~("./Configure")
490 #~("./config"))
491 "shared" ;build shared libraries
492 "--libdir=lib"
493
494 ;; The default for this catch-all directory is PREFIX/ssl.
495 ;; Change that to something more conventional.
496 (string-append "--openssldir=" #$output
497 "/share/openssl")
498
499 (string-append "--prefix=" #$output)
500 (string-append "-Wl,-rpath," (string-append #$output "/lib"))
501 #$@(if (%current-target-system)
502 #~((getenv "CONFIGURE_TARGET_ARCH"))
503 #~())
504 configure-flags)
505 ;; Output the configure variables.
506 (invoke "perl" "configdata.pm" "--dump")))
507 (add-after 'install 'move-static-libraries
508 (lambda _
509 ;; Move static libraries to the "static" output.
510 (let* ((lib (string-append #$output "/lib"))
511 (slib (string-append #$output:static "/lib")))
512 (for-each (lambda (file)
513 (install-file file slib)
514 (delete-file file))
515 (find-files
516 lib
517 #$(if (target-mingw?)
518 '(lambda (filename _)
519 (and (string-suffix? ".a" filename)
520 (not (string-suffix? ".dll.a"
521 filename))))
522 "\\.a$"))))))
523 (add-after 'install 'move-extra-documentation
524 (lambda _
525 ;; Move man pages and full HTML documentation to "doc".
526 (let* ((man (string-append #$output "/share/man"))
527 (html (string-append #$output "/share/doc/openssl"))
528 (man-target (string-append #$output:doc "/share/man"))
529 (html-target (string-append
530 #$output:doc "/share/doc/openssl")))
531 (mkdir-p (dirname man-target))
532 (mkdir-p (dirname html-target))
533 (rename-file man man-target)
534 (rename-file html html-target))))
535 (add-after 'install 'remove-miscellany
536 (lambda _
537 ;; The 'misc' directory contains random undocumented shell and
538 ;; Perl scripts. Remove them to avoid retaining a reference on
539 ;; Perl.
540 (delete-file-recursively
541 (string-append #$output "/share/openssl/misc")))))))
542 (native-search-paths
543 (list $SSL_CERT_DIR $SSL_CERT_FILE))
544 (synopsis "SSL/TLS implementation")
545 (description "OpenSSL is an implementation of SSL/TLS.")
546 (license license:openssl)
547 (home-page "https://www.openssl.org/")))
548
549(define-public openssl-3.5
550 ;; LTS series with EOL 2030-04-08
551 (package
552 (name "openssl")
553 (version "3.5.7")
554 (replacement openssl-3.5/fixed)
555 (source (origin
556 (method url-fetch)
557 (uri (list (string-append "https://www.openssl.org/source/openssl-"
558 version ".tar.gz")
559 (string-append "ftp://ftp.openssl.org/source/"
560 "openssl-" version ".tar.gz")
561 (string-append "ftp://ftp.openssl.org/source/old/"
562 (string-trim-right version char-set:letter)
563 "/openssl-" version ".tar.gz")))
564 (patches (search-patches "openssl-3.0-c-rehash-in.patch"))
565 (sha256
566 (base32
567 "1s4qmjp33ai43ahlm3iw59aq86fj5hp7kxbcygwq194waa5d5h58"))))
568 (build-system gnu-build-system)
569 (outputs '("out"
570 "doc"
571 "static"))
572 (arguments
573 (list
574 #:parallel-tests? #f
575 #:make-flags
576 (if (or (target-arm?) (target-riscv64?))
577 ;; 'test_afalg' seems to be dependent on kernel features:
578 ;; <https://github.com/openssl/openssl/issues/12242>.
579 #~(list "TESTS=-test_afalg")
580 #~(list))
581 #:test-target "test"
582 #:configure-flags
583 (if (system-hurd?)
584 (if (target-hurd64?)
585 #~(list "hurd-x86_64")
586 #~(list "hurd-x86"))
587 #~(list))
588 ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
589 ;; so we explicitly disallow it here.
590 #:disallowed-references (list (this-package-native-input "perl"))
591 #:phases
592 #~(modify-phases %standard-phases
593 (replace 'configure
594 (lambda* (#:key configure-flags native-inputs inputs target #:allow-other-keys)
595 ;; It's not a shebang so patch-source-shebangs misses it.
596 (substitute* "config"
597 (("/usr/bin/env")
598 (which "env")))
599 #$@(if (%current-target-system)
600 #~((setenv "CROSS_COMPILE" (string-append target "-"))
601 (setenv "CONFIGURE_TARGET_ARCH"
602 #$(target->openssl-target
603 this-package
604 (%current-target-system))))
605 #~())
606 ;; Configure PERL.
607 (setenv "HASHBANGPERL"
608 (search-input-file (or native-inputs inputs)
609 "/bin/perl"))
610 (apply
611 invoke #$@(if (%current-target-system)
612 #~("./Configure")
613 #~("./config"))
614 "shared" ;build shared libraries
615 "--libdir=lib"
616
617 ;; The default for this catch-all directory is
618 ;; PREFIX/ssl. Change that to something more
619 ;; conventional.
620 (string-append "--openssldir=" #$output
621 "/share/openssl-"
622 #$(package-version this-package))
623
624 (string-append "--prefix=" #$output)
625 (string-append "-Wl,-rpath," (string-append #$output "/lib"))
626 #$@(if (%current-target-system)
627 #~((getenv "CONFIGURE_TARGET_ARCH"))
628 #~())
629 configure-flags)
630 ;; Output the configure variables.
631 (invoke "perl" "configdata.pm" "--dump")))
632 (add-after 'install 'move-static-libraries
633 (lambda _
634 ;; Move static libraries to the "static" output.
635 (let* ((lib (string-append #$output "/lib"))
636 (slib (string-append #$output:static "/lib")))
637 (for-each (lambda (file)
638 (install-file file slib)
639 (delete-file file))
640 (find-files
641 lib
642 #$(if (target-mingw?)
643 '(lambda (filename _)
644 (and (string-suffix? ".a" filename)
645 (not (string-suffix? ".dll.a"
646 filename))))
647 "\\.a$"))))))
648 (add-after 'install 'move-extra-documentation
649 (lambda _
650 ;; Move man pages and full HTML documentation to "doc".
651 (let* ((man (string-append #$output "/share/man"))
652 (html (string-append #$output "/share/doc/openssl"))
653 (man-target (string-append #$output:doc "/share/man"))
654 (html-target (string-append
655 #$output:doc "/share/doc/openssl")))
656 (mkdir-p (dirname man-target))
657 (mkdir-p (dirname html-target))
658 (rename-file man man-target)
659 (rename-file html html-target))))
660 (add-after 'install 'remove-miscellany
661 (lambda _
662 ;; The 'misc' directory contains random undocumented shell and
663 ;; Perl scripts. Remove them to avoid retaining a reference on
664 ;; Perl.
665 (delete-file-recursively
666 (string-append #$output "/share/openssl-"
667 #$(package-version this-package) "/misc")))))))
668 (native-inputs (list perl))
669 (native-search-paths
670 (list $SSL_CERT_DIR $SSL_CERT_FILE))
671 (home-page "https://www.openssl.org/")
672 (synopsis "SSL/TLS implementation")
673 (description "OpenSSL is an implementation of SSL/TLS.")
674 (license license:asl2.0)))
675
676(define-public openssl-3.5/fixed
677 (hidden-package
678 (package
679 (inherit openssl-3.5)
680 (version "3.5.9")
681 (source (origin
682 (inherit (package-source openssl-3.5))
683 (uri (list (string-append "https://www.openssl.org/source/openssl-"
684 version ".tar.gz")
685 (string-append "ftp://ftp.openssl.org/source/"
686 "openssl-" version ".tar.gz")
687 (string-append "ftp://ftp.openssl.org/source/old/"
688 (string-trim-right version char-set:letter)
689 "/openssl-" version ".tar.gz")))
690 (sha256
691 (base32
692 "16l5xgqp1ii4vffbr8ap2wqbn8jqrm6x6aflzdvhvw7fw815cgv0")))))))
693
694(define-public openssl-3.0
695 ;; LTS series with EOL 2026-09-07
696 (package
697 (inherit openssl-3.5)
698 (version "3.0.19")
699 (source (origin
700 (method url-fetch)
701 (uri (list (string-append "https://www.openssl.org/source/openssl-"
702 version ".tar.gz")
703 (string-append "ftp://ftp.openssl.org/source/"
704 "openssl-" version ".tar.gz")
705 (string-append "ftp://ftp.openssl.org/source/old/"
706 (string-trim-right version char-set:letter)
707 "/openssl-" version ".tar.gz")))
708 (patches (search-patches "openssl-3.0-c-rehash-in.patch"
709 "openssl-hurd64.patch"))
710 (sha256
711 (base32
712 "0wihnr5bjdc3v0r4viwb1d1lf1rfkbrcmwzj7vjqpqdap11l2nps"))))))
713
714(define-public openssl openssl-3.5)
715
716(define-public bearssl
717 (package
718 (name "bearssl")
719 (version "0.6")
720 (source (origin
721 (method url-fetch)
722 (uri (string-append "https://www.bearssl.org/"
723 "bearssl-" version ".tar.gz"))
724 (sha256
725 (base32
726 "057zhgy9w4y8z2996r0pq5k2k39lpvmmvz4df8db8qa9f6hvn1b7"))))
727 (build-system gnu-build-system)
728 (arguments
729 (list
730 #:make-flags
731 #~(list #$(string-append "CC=" (cc-for-target))
732 #$(string-append "LD=" (cc-for-target))
733 #$(string-append "LDDLL=" (cc-for-target)))
734 #:phases
735 #~(modify-phases %standard-phases
736 (delete 'configure) ;no configure script
737 (replace 'check
738 (lambda* (#:key tests? #:allow-other-keys)
739 (when tests?
740 (with-directory-excursion "build"
741 (invoke "./testcrypto" "all")
742 (invoke "./testx509")))))
743 (replace 'install ;no install rule
744 (lambda _
745 (let* ((out #$output)
746 (bin (string-append out "/bin"))
747 (doc (string-append out "/share/doc/" #$name "-" #$version))
748 (lib (string-append out "/lib"))
749 (include (string-append out "/include")))
750 (install-file "build/brssl" bin)
751 (for-each (lambda (f) (install-file f include))
752 (find-files "inc" "\\.h$"))
753 (install-file "LICENSE.txt" doc)
754 (install-file "build/libbearssl.so" lib)))))))
755 (home-page "https://bearssl.org/")
756 (synopsis "Small SSL/TLS library")
757 (description "BearSSL is an implementation of the SSL/TLS
758protocol (RFC 5246) written in C. It aims at being correct and
759secure. In particular, insecure protocol versions and choices of
760algorithms are not supported, by design; cryptographic algorithm
761implementations are constant-time by default. It should also be
762small, both in RAM and code footprint. For instance, a minimal server
763implementation may fit in about 20 kilobytes of compiled code and 25
764kilobytes of RAM.")
765 (license license:expat)))
766
767(define-public libressl
768 (package
769 (name "libressl")
770 (version "4.3.2")
771 (source (origin
772 (method url-fetch)
773 (uri (string-append "mirror://openbsd/LibreSSL/"
774 "libressl-" version ".tar.gz"))
775 (sha256
776 (base32
777 "1da712lxzqclwyavvfzkskwjys6spi29vjzgm7k6jpf64kp1mw7d"))))
778 (outputs (list "out" "debug"))
779 (build-system gnu-build-system)
780 (arguments
781 (list
782 #:configure-flags
783 #~(list
784 ;; Do as if 'getentropy' were missing: Linux kernels before 3.17 lack its
785 ;; underlying 'getrandom' system call and ENOSYS isn't properly handled.
786 ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
787 "ac_cv_func_getentropy=no"
788 ;; FIXME It's using it's own bundled certificate, instead it should
789 ;; behave like OpenSSL by using environment variables.
790 (string-append "--with-openssldir=" #$output
791 "/share/libressl-" #$(package-version this-package))
792 ;; Provide a TLS-enabled netcat.
793 "--enable-nc")))
794 (properties
795 `((release-monitoring-url . "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/")))
796 (home-page "https://www.libressl.org/")
797 (synopsis "SSL/TLS implementation")
798 (description "LibreSSL is a version of the TLS/crypto stack, forked from
799OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
800and applying best practice development processes. This package also includes a
801netcat implementation that supports TLS.")
802 ;; Files taken from OpenSSL keep their license, others are under various
803 ;; non-copyleft licenses.
804 (license (list license:openssl
805 (license:non-copyleft
806 "file://COPYING"
807 "See COPYING in the distribution.")))))
808
809(define-public python-acme
810 (package
811 (name "python-acme")
812 ;; Remember to update the hash of certbot when updating python-acme.
813 (version "4.2.0")
814 (source
815 (origin
816 (method url-fetch)
817 (uri (pypi-uri "acme" version))
818 (sha256
819 (base32 "0h8ckyal5j8lkm24fd52dajy38mxa76zh4q022i28f6b3878rxhd"))))
820 (build-system pyproject-build-system)
821 (arguments
822 (list
823 #:phases
824 #~(modify-phases %standard-phases
825 (add-after 'unpack 'relax-requirements
826 (lambda _
827 (substitute* "setup.py"
828 (("'PyOpenSSL.*',")
829 "'PyOpenSSL',"))))
830 (add-after 'build 'build-documentation
831 (lambda _
832 (invoke "make" "-C" "docs" "man" "info")))
833 (add-after 'install 'install-documentation
834 (lambda _
835 (let ((man (string-append #$output "/share/man/man1"))
836 (info (string-append #$output "/info")))
837 (install-file "docs/_build/texinfo/acme-python.info" info)
838 (install-file "docs/_build/man/acme-python.1" man)))))))
839 (native-inputs
840 (list python-pytest
841 python-pytest-xdist
842 python-setuptools
843 python-wheel
844 ;; For documentation
845 python-sphinx
846 python-sphinxcontrib-programoutput
847 python-sphinx-rtd-theme
848 texinfo))
849 (propagated-inputs
850 (list python-cryptography
851 python-josepy
852 python-pyopenssl
853 python-pyrfc3339
854 python-requests))
855 (home-page "https://github.com/certbot/certbot")
856 (synopsis "ACME protocol implementation in Python")
857 (description "ACME protocol implementation in Python")
858 (license license:asl2.0)))
859
860(define-public certbot
861 (package
862 (name "certbot")
863 ;; Certbot and python-acme are developed in the same repository, and their
864 ;; versions should remain synchronized.
865 (version (package-version python-acme))
866 (source
867 (origin
868 (method url-fetch)
869 (uri (pypi-uri "certbot" version))
870 (sha256
871 (base32 "0yy287h1sjdkm5cj4wazq316igwwla856yqcmi4yqaq7ib55c7pv"))))
872 (build-system pyproject-build-system)
873 (arguments
874 (substitute-keyword-arguments (package-arguments python-acme)
875 ((#:test-flags flags '())
876 ;; XXX: No time zone found with key Asia/Sanghai, pytz version?
877 #~(list "-k" "not test_add_time_interval"))
878 ((#:phases phases)
879 #~(modify-phases #$phases
880 (replace 'install-documentation
881 (lambda* (#:key outputs #:allow-other-keys)
882 (let ((man1 (string-append #$output "/share/man/man1"))
883 (man7 (string-append #$output "/share/man/man7"))
884 (info (string-append #$output "/info")))
885 (install-file "docs/_build/texinfo/Certbot.info" info)
886 (install-file "docs/_build/man/certbot.1" man1)
887 (install-file "docs/_build/man/certbot.7" man7))))))))
888 (native-inputs
889 (list python-mock
890 python-pytest
891 python-setuptools
892 python-wheel
893 ;; For documentation
894 python-sphinx
895 python-sphinx-rtd-theme
896 python-sphinx-repoze-autointerface
897 python-sphinxcontrib-programoutput
898 texinfo))
899 (propagated-inputs
900 (list python-acme
901 python-cryptography
902 python-pyrfc3339
903 python-pyopenssl
904 python-configobj
905 python-configargparse
906 python-distro
907 python-parsedatetime
908 python-psutil
909 python-requests
910 python-pytz))
911 (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
912 (description
913 "Certbot automatically receives and installs X.509 certificates to enable
914Transport Layer Security (TLS) on servers. It interoperates with the
915Let’s Encrypt certificate authority (CA), which issues browser-trusted
916certificates for free.")
917 (home-page "https://certbot.eff.org/")
918 (license license:asl2.0)))
919
920(define-public uacme
921 (package
922 (name "uacme")
923 (version "1.8.1")
924 (source
925 (origin
926 (method git-fetch)
927 (uri (git-reference
928 (url "https://github.com/ndilieto/uacme/")
929 (commit (string-append "v" version))))
930 (file-name (git-file-name name version))
931 (sha256
932 (base32
933 "13s7rzcm0w1rxfr0yi7hyilj69pb0q7n56ag2id76c9vwras6a2f"))))
934 (build-system gnu-build-system)
935 (arguments
936 (list
937 #:phases
938 #~(modify-phases %standard-phases
939 (add-after 'unpack 'set-version
940 (lambda _
941 (substitute* "configure.ac"
942 (((string-append
943 "m4_esyscmd\\(\\[build-aux/git-version-gen "
944 "\\.tarball-version\\]\\)"))
945 #$version)))))))
946 (inputs
947 (list curl gnutls))
948 (native-inputs
949 (list asciidoc
950 autoconf
951 automake
952 pkg-config))
953 (home-page "https://github.com/ndilieto/uacme")
954 (synopsis "Minimal ACMEv2 client written in C")
955 (description "Uacme is a lightweight client for the RFC8555 ACMEv2
956protocol, written in plain C with minimal dependencies.")
957 (license license:gpl3+)))
958
959(define-public perl-net-ssleay
960 (package
961 (name "perl-net-ssleay")
962 (version "1.96")
963 (source (origin
964 (method url-fetch)
965 (uri (string-append "mirror://cpan/authors/id/C/CH/CHRISN/"
966 "Net-SSLeay-" version ".tar.gz"))
967 (sha256
968 (base32
969 "0lq7zjnr82q3qjvibbb32ninb0bg4vcwijv9qrvabcjzd28kc8db"))
970 (patches (search-patches "perl-net-ssleay-colon-parsing.patch"))))
971 (build-system perl-build-system)
972 (inputs (list openssl))
973 (arguments
974 (list
975 #:phases
976 #~(modify-phases %standard-phases
977 (add-before
978 'configure 'set-ssl-prefix
979 (lambda* (#:key inputs #:allow-other-keys)
980 (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl")))))))
981 (synopsis "Perl extension for using OpenSSL")
982 (description
983 "This module offers some high level convenience functions for accessing
984web pages on SSL servers (for symmetry, the same API is offered for accessing
985http servers, too), an sslcat() function for writing your own clients, and
986finally access to the SSL api of the SSLeay/OpenSSL package so you can write
987servers or clients for more complicated applications.")
988 (license license:perl-license)
989 (home-page "https://metacpan.org/release/Net-SSLeay")))
990
991(define-public perl-crypt-openssl-rsa
992 (package
993 (name "perl-crypt-openssl-rsa")
994 (version "0.33")
995 (source
996 (origin
997 (method url-fetch)
998 (uri (string-append
999 "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
1000 version
1001 ".tar.gz"))
1002 (sha256
1003 (base32
1004 "0r6qxx2nyvdsv859zl8vz17ndj1a4xvrknbafhjh6m3gdl7n7gmx"))))
1005 (build-system perl-build-system)
1006 (native-inputs
1007 (list perl-crypt-openssl-guess))
1008 (inputs
1009 (list perl-crypt-openssl-bignum perl-crypt-openssl-random openssl))
1010 (arguments perl-crypt-arguments)
1011 (home-page
1012 "https://metacpan.org/release/Crypt-OpenSSL-RSA")
1013 (synopsis
1014 "RSA encoding and decoding, using the openSSL libraries")
1015 (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
1016OpenSSL libraries).")
1017 (license license:perl-license)))
1018
1019(define perl-crypt-arguments
1020 `(#:phases (modify-phases %standard-phases
1021 (add-before 'configure 'patch-Makefile.PL
1022 (lambda* (#:key inputs #:allow-other-keys)
1023 (substitute* "Makefile.PL"
1024 (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
1025 (assoc-ref inputs "openssl")
1026 "/lib -lcrypto'],")))
1027 #t)))))
1028
1029(define-public perl-crypt-openssl-bignum
1030 (package
1031 (name "perl-crypt-openssl-bignum")
1032 (version "0.09")
1033 (source
1034 (origin
1035 (method url-fetch)
1036 (uri (string-append
1037 "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
1038 version
1039 ".tar.gz"))
1040 (sha256
1041 (base32
1042 "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
1043 (build-system perl-build-system)
1044 (inputs (list openssl))
1045 (arguments perl-crypt-arguments)
1046 (home-page
1047 "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
1048 (synopsis
1049 "OpenSSL's multiprecision integer arithmetic in Perl")
1050 (description "Crypt::OpenSSL::Bignum provides multiprecision integer
1051arithmetic in Perl.")
1052 ;; At your option either gpl1+ or the Artistic License
1053 (license license:perl-license)))
1054
1055(define-public perl-crypt-openssl-guess
1056 (package
1057 (name "perl-crypt-openssl-guess")
1058 (version "0.11")
1059 (source
1060 (origin
1061 (method url-fetch)
1062 (uri (string-append
1063 "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
1064 version ".tar.gz"))
1065 (sha256
1066 (base32
1067 "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
1068 (build-system perl-build-system)
1069 (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
1070 (synopsis "Guess the OpenSSL include path")
1071 (description
1072 "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
1073correct OpenSSL include path. It is intended for use in your
1074@file{Makefile.PL}.")
1075 (license license:perl-license)))
1076
1077(define-public perl-crypt-openssl-random
1078 (package
1079 (name "perl-crypt-openssl-random")
1080 (version "0.15")
1081 (source
1082 (origin
1083 (method url-fetch)
1084 (uri (string-append
1085 "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
1086 version
1087 ".tar.gz"))
1088 (sha256
1089 (base32 "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh"))))
1090 (build-system perl-build-system)
1091 (native-inputs
1092 (list perl-crypt-openssl-guess))
1093 (inputs
1094 (list openssl))
1095 (arguments perl-crypt-arguments)
1096 (home-page
1097 "https://metacpan.org/release/Crypt-OpenSSL-Random")
1098 (synopsis
1099 "OpenSSL/LibreSSL pseudo-random number generator access")
1100 (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
1101number generator")
1102 (license license:perl-license)))
1103
1104(define-public mbedtls
1105 (package
1106 (name "mbedtls")
1107 (version "4.2.0")
1108 (source
1109 (origin
1110 (method url-fetch)
1111 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1112 "/download/mbedtls-" version
1113 "/mbedtls-" version ".tar.bz2"))
1114 (sha256
1115 (base32 "1spzwsylnlld4apdfh592bqwh2x3i8myg5xhadjzfs267dqrvv9b"))))
1116 (build-system cmake-build-system)
1117 (arguments
1118 (list #:parallel-tests? #f
1119 #:configure-flags
1120 #~(list "-DMBEDTLS_FATAL_WARNINGS=OFF"
1121 "-DUSE_SHARED_MBEDTLS_LIBRARY=ON"
1122 "-DUSE_STATIC_MBEDTLS_LIBRARY=OFF")
1123 #:phases
1124 #~(modify-phases %standard-phases
1125 (add-after 'unpack 'make-source-writable
1126 (lambda _
1127 (for-each make-file-writable (find-files ".")))))))
1128 (native-inputs
1129 (list perl python))
1130 (synopsis "Small TLS library")
1131 (description
1132 "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
1133for developers to include cryptographic and SSL/TLS capabilities in their
1134(embedded) products, facilitating this functionality with a minimal
1135coding footprint.")
1136 (home-page "https://www.trustedfirmware.org/projects/mbed-tls/")
1137 (license (list license:asl2.0 license:gpl2+)))) ;dual licensed
1138
1139(define-public mbedtls-4.0
1140 (hidden-package
1141 (package
1142 (inherit mbedtls)
1143 (version "4.0.0")
1144 (source
1145 (origin
1146 (method url-fetch)
1147 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1148 "/download/mbedtls-" version
1149 "/mbedtls-" version ".tar.bz2"))
1150 (sha256
1151 (base32 "09r8pzbflhvd3nhz74v0fzvjxkmpxkp6fj0f8ppxshd5ngvlffig")))))))
1152
1153(define-public mbedtls-3
1154 (package
1155 (inherit mbedtls)
1156 (version "3.6.7")
1157 (source
1158 (origin
1159 (method url-fetch)
1160 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1161 "/download/mbedtls-" version
1162 "/mbedtls-" version ".tar.bz2"))
1163 (sha256
1164 (base32 "1xhi5lhn78vphv07kvwfyrigfdbbc9vmdwi4mys63xz6q2zbrs57"))))))
1165
1166;;; TODO: No longer maintained, migrate dependents to current mbedtls.
1167(define-public mbedtls-lts
1168 (package
1169 (inherit mbedtls)
1170 (name "mbedtls")
1171 (version "2.28.9")
1172 (source
1173 (origin
1174 (method git-fetch)
1175 (uri (git-reference
1176 (url "https://github.com/ARMmbed/mbedtls")
1177 (commit (string-append "mbedtls-" version))))
1178 (file-name (git-file-name name version))
1179 (sha256
1180 (base32 "0ldqhvmj9wl0yp3hz675zbnq69lw533s0ahy9bbdxxnj5gjb86gw"))))))
1181
1182;; The Hiawatha Web server requires some specific features to be enabled.
1183(define-public mbedtls-for-hiawatha
1184 (hidden-package
1185 (package/inherit mbedtls
1186 (arguments
1187 (substitute-keyword-arguments arguments
1188 ((#:phases phases)
1189 #~(modify-phases #$phases
1190 (add-before 'configure 'configure-extra-features
1191 (lambda _
1192 (for-each (lambda (feature)
1193 (invoke "scripts/config.pl" "set" feature))
1194 (list "MBEDTLS_THREADING_C"
1195 "MBEDTLS_THREADING_PTHREAD")))))))))))
1196
1197(define-public dehydrated
1198 (package
1199 (name "dehydrated")
1200 (version "0.7.1")
1201 (source
1202 (origin
1203 (method git-fetch)
1204 (uri (git-reference
1205 (url "https://github.com/dehydrated-io/dehydrated")
1206 (commit (string-append "v" version))))
1207 (file-name (git-file-name name version))
1208 (sha256
1209 (base32 "1mhf3v9ynwrxrkqawqpxnwfn5dmrlkqcvkxdrk59nkxjpdx1wkrb"))))
1210 (build-system trivial-build-system)
1211 (arguments
1212 (list
1213 #:modules '((guix build utils))
1214 #:builder
1215 #~(begin
1216 (use-modules (guix build utils)
1217 (srfi srfi-26))
1218 (let* ((source (assoc-ref %build-inputs "source"))
1219 (gzip (search-input-file %build-inputs "bin/gzip"))
1220 (bin (string-append #$output "/bin"))
1221 (doc (string-append #$output "/share/doc/"
1222 #$name "-" #$version))
1223 (man (string-append #$output "/share/man"))
1224 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
1225
1226 (chdir source)
1227
1228 (copy-recursively "docs" doc)
1229 (install-file "LICENSE" doc)
1230
1231 (mkdir-p man)
1232 (rename-file (string-append doc "/man")
1233 (string-append man "/man1"))
1234 (for-each (cut invoke gzip "-9n" <>)
1235 (find-files man ".*"))
1236
1237 (install-file "dehydrated" bin)
1238 (with-directory-excursion bin
1239 (patch-shebang "dehydrated" (list bash))
1240
1241 ;; Do not try to write to the store.
1242 (substitute* "dehydrated"
1243 (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
1244
1245 (setenv "PATH" bash)
1246 (wrap-program "dehydrated"
1247 `("PATH" ":" prefix
1248 ,(map (lambda (file)
1249 (dirname (search-input-file %build-inputs file)))
1250 (list
1251 ;; From check_dependencies() — keep them in sync.
1252 "bin/grep"
1253 "bin/diff"
1254 "bin/sed"
1255 "bin/awk"
1256 "bin/curl"
1257 "bin/cut" ; also mktemp, head, tail
1258 "bin/hexdump"
1259 ;; Additional requirements.
1260 "bin/openssl")))))))))
1261 (inputs
1262 (list bash
1263 coreutils
1264 curl
1265 diffutils
1266 gawk
1267 grep
1268 openssl
1269 sed
1270 util-linux+udev))
1271 (native-inputs
1272 (list gzip))
1273 ;; The following definition is copied from the cURL package to prevent a
1274 ;; cycle between the curl and tls modules.
1275 (native-search-paths
1276 (list (search-path-specification
1277 (variable "CURL_CA_BUNDLE")
1278 (file-type 'regular)
1279 (separator #f)
1280 (files '("etc/ssl/certs/ca-certificates.crt")))))
1281 (home-page "https://dehydrated.io/")
1282 (synopsis "ACME client implemented as a shell script")
1283 (description "Dehydrated is a client for obtaining certificates from an
1284ACME server (such as Let's Encrypt) implemented as a relatively simple Bash
1285script.")
1286 (license license:expat)))
1287
1288(define-public s2n
1289 (package
1290 (name "s2n")
1291 ;; Update only when updating aws-crt-cpp.
1292 (version "1.5.15")
1293 (source (origin
1294 (method git-fetch)
1295 (uri (git-reference
1296 (url "https://github.com/aws/s2n-tls")
1297 (commit (string-append "v" version))))
1298 (file-name (git-file-name name version))
1299 (sha256
1300 (base32
1301 "0b8ym4ns56fa5pkrvsm5kghh8mii0q0kc1mz2plg1ypm5zny02kw"))))
1302 (build-system cmake-build-system)
1303 (arguments
1304 '(#:configure-flags
1305 '("-DBUILD_SHARED_LIBS=ON")))
1306 (propagated-inputs (list aws-lc))
1307 (supported-systems %64bit-supported-systems)
1308 (synopsis "SSL/TLS implementation in C99")
1309 (description
1310 "This library provides a C99 implementation of SSL/TLS. It is designed to
1311be familiar to users of the widely-used POSIX I/O APIs. It supports blocking,
1312non-blocking, and full-duplex I/O. There are no locks or mutexes.
1313
1314As it can be difficult to keep track of which encryption algorithms and
1315protocols are best to use, s2n-tls features a simple API to use the latest
1316default set of preferences. Remaining on a specific version for backwards
1317compatibility is also supported.")
1318 (home-page "https://github.com/aws/s2n-tls")
1319 (license license:asl2.0)))
1320
1321(define-public wolfssl
1322 (package
1323 (name "wolfssl")
1324 (version "5.7.6")
1325 (source (origin
1326 (method git-fetch)
1327 (uri (git-reference
1328 (url "https://github.com/wolfSSL/wolfssl")
1329 (commit (string-append "v" version "-stable"))))
1330 (file-name (git-file-name name version))
1331 (sha256
1332 (base32
1333 "1q1sqwx6njsjbwmwr87ky0yrg2cin7ssa12gl14i8x1v35rpcxdb"))))
1334 (build-system gnu-build-system)
1335 (arguments
1336 (list #:configure-flags
1337 #~(list "--enable-distro"
1338 "--enable-pkcs11"
1339 "--disable-examples"
1340 "--enable-jobserver=no")))
1341 (native-inputs
1342 (list autoconf automake libtool))
1343 (synopsis "SSL/TLS implementation")
1344 (description "The wolfSSL embedded SSL library (formerly CyaSSL) is an
1345SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and
1346resource-constrained environments - primarily because of its small size, speed,
1347and feature set. wolfSSL supports industry standards up to the current TLS 1.3
1348and DTLS 1.2, is up to 20 times smaller than OpenSSL, and offers progressive
1349ciphers such as ChaCha20, Curve25519, NTRU, and Blake2b.")
1350 (home-page "https://www.wolfssl.com/")
1351 (license license:gpl2+))) ; Audit
1352
1353(define-public wolfssl-for-rpcs3
1354 (package/inherit wolfssl
1355 (name "wolfssl-for-rpcs3")
1356 (arguments
1357 (substitute-keyword-arguments arguments
1358 ((#:configure-flags flags ''())
1359 #~(cons* "--enable-des3"
1360 "--enable-pwdbased"
1361 "--enable-fastmath"
1362 "--enable-opensslextra"
1363 "--disable-harden"
1364 "--enable-altcertchains"
1365 "--enable-writedup"
1366 #$flags))))))
1367
1368(define-public aws-lc
1369 (package
1370 (name "aws-lc")
1371 ;; Update only when updating aws-crt-cpp.
1372 (version "1.48.5")
1373 (source (origin
1374 (method git-fetch)
1375 (uri (git-reference
1376 (url (string-append "https://github.com/awslabs/" name))
1377 (commit (string-append "v" version))))
1378 (file-name (git-file-name name version))
1379 (sha256
1380 (base32
1381 "1hgfsl3plpiljasvxxdhz37n5lc6j819djq3nlf59pw4fivfy6mv"))))
1382 (build-system cmake-build-system)
1383 (native-inputs (list perl))
1384 (arguments
1385 (list
1386 #:configure-flags
1387 #~(list "-DBUILD_SHARED_LIBS=ON" "-DDISABLE_GO=ON")
1388 #:modules '((guix build cmake-build-system)
1389 ((guix build gnu-build-system) #:prefix gnu:)
1390 (guix build utils))
1391 #:phases
1392 #~(modify-phases %standard-phases
1393 (replace 'check
1394 (lambda* (#:rest args)
1395 (apply (assoc-ref gnu:%standard-phases 'check)
1396 #:test-target "run_minimal_tests" args))))))
1397 (synopsis "General purpose cryptographic library")
1398 (description "AWS libcrypto (aws-lc) contains portable C implementations
1399of algorithms needed for TLS and common applications, and includes optimized
1400assembly versions for x86 and ARM.")
1401 (home-page "https://github.com/awslabs/aws-lc")
1402 (license license:asl2.0)))