projects/guix·blob ruby-team · refs

1369 lines · 54.4 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2012-2017, 2019-2025 Ludovic Courtès <[email protected]>
3;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2021 Mark H Weaver <[email protected]>
4;;; Copyright © 2014 Ian Denhardt <[email protected]>
5;;; Copyright © 2013, 2015, 2026 Andreas Enge <[email protected]>
6;;; Copyright © 2015 David Thompson <[email protected]>
7;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Leo Famulari <[email protected]>
8;;; Copyright © 2016, 2017, 2019, 2021-2024 Efraim Flashner <[email protected]>
9;;; Copyright © 2016, 2017, 2018 Nikita <[email protected]>
10;;; Copyright © 2016 Hartmut Goebel <[email protected]>
11;;; Copyright © 2017 Ricardo Wurmus <[email protected]>
12;;; Copyright © 2017-2022 Marius Bakke <[email protected]>
13;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <[email protected]>
14;;; Copyright © 2017 Rutger Helling <[email protected]>
15;;; Copyright © 2018 Clément Lassieur <[email protected]>
16;;; Copyright © 2019 Mathieu Othacehe <[email protected]>
17;;; Copyright © 2020, 2023, 2025 Janneke Nieuwenhuizen <[email protected]>
18;;; Copyright © 2020, 2021, 2023-2025 Maxim Cournoyer <[email protected]>
19;;; Copyright © 2021 Solene Rapenne <[email protected]>
20;;; Copyright © 2021 Brice Waegeneire <[email protected]>
21;;; Copyright © 2021 Maxime Devos <[email protected]>
22;;; Copyright © 2021 Matthew James Kraai <[email protected]>
23;;; Copyright © 2021 John Kehayias <[email protected]>
24;;; Copyright © 2022 Greg Hogan <[email protected]>
25;;; Copyright © 2024-2026 Ashish SHUKLA <[email protected]>
26;;; Copyright © 2026 Junker <[email protected]>
27;;;
28;;; This file is part of GNU Guix.
29;;;
30;;; GNU Guix is free software; you can redistribute it and/or modify it
31;;; under the terms of the GNU General Public License as published by
32;;; the Free Software Foundation; either version 3 of the License, or (at
33;;; your option) any later version.
34;;;
35;;; GNU Guix is distributed in the hope that it will be useful, but
36;;; WITHOUT ANY WARRANTY; without even the implied warranty of
37;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38;;; GNU General Public License for more details.
39;;;
40;;; You should have received a copy of the GNU General Public License
41;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
42
43(define-module (gnu packages tls)
44 #:use-module ((guix licenses) #:prefix license:)
45 #:use-module (guix deprecation)
46 #:use-module (guix packages)
47 #:use-module (guix download)
48 #:use-module (guix git-download)
49 #:use-module (guix utils)
50 #:use-module (guix gexp)
51 #:use-module (guix build-system gnu)
52 #:use-module (guix build-system go)
53 #:use-module (guix build-system perl)
54 #:use-module (guix build-system pyproject)
55 #:use-module (guix build-system cmake)
56 #:use-module (guix build-system trivial)
57 #:use-module (guix build-system meson)
58 #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR $SSL_CERT_FILE))
59 #:use-module (gnu packages compression)
60 #:use-module (gnu packages)
61 #:use-module (gnu packages autotools)
62 #:use-module (gnu packages base)
63 #:use-module (gnu packages bash)
64 #:use-module (gnu packages build-tools)
65 #:use-module (gnu packages check)
66 #:use-module (gnu packages certs)
67 #:use-module (gnu packages curl)
68 #:use-module (gnu packages dns)
69 #:use-module (gnu packages docbook)
70 #:use-module (gnu packages documentation)
71 #:use-module (gnu packages gawk)
72 #:use-module (gnu packages gettext)
73 #:use-module (gnu packages guile)
74 #:use-module (gnu packages libbsd)
75 #:use-module (gnu packages libffi)
76 #:use-module (gnu packages libidn)
77 #:use-module (gnu packages libunistring)
78 #:use-module (gnu packages linux)
79 #:use-module (gnu packages ncurses)
80 #:use-module (gnu packages nettle)
81 #:use-module (gnu packages networking)
82 #:use-module (gnu packages nss)
83 #:use-module (gnu packages perl)
84 #:use-module (gnu packages pkg-config)
85 #:use-module (gnu packages python)
86 #:use-module (gnu packages python-build)
87 #:use-module (gnu packages python-crypto)
88 #:use-module (gnu packages python-web)
89 #:use-module (gnu packages python-xyz)
90 #:use-module (gnu packages sphinx)
91 #:use-module (gnu packages texinfo)
92 #:use-module (gnu packages time)
93 #:use-module (gnu packages version-control)
94 #:use-module (gnu packages xml)
95 #:use-module (srfi srfi-1)
96 #:use-module (srfi srfi-34)
97 #:use-module (srfi srfi-35))
98
99(define-public libtasn1
100 (package
101 (name "libtasn1")
102 (version "4.21.0")
103 (source
104 (origin
105 (method url-fetch)
106 (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
107 version ".tar.gz"))
108 (sha256
109 (base32
110 "11ywcy8n115c8b3vmf7hmgkdhlfy4phlcwvp8114di9w495492hx"))))
111 (build-system gnu-build-system)
112 (arguments
113 `(#:configure-flags '("--disable-static")))
114 (native-inputs (list perl))
115 (home-page "https://www.gnu.org/software/libtasn1/")
116 (synopsis "ASN.1 library")
117 (description
118 "GNU libtasn1 is a library implementing the ASN.1 notation. It is used
119for transmitting machine-neutral encodings of data objects in computer
120networking, allowing for formal validation of data according to some
121specifications.")
122 (license license:lgpl2.0+)))
123
124(define-public asn1c
125 (package
126 (name "asn1c")
127 (version "0.9.28")
128 (source (origin
129 (method url-fetch)
130 (uri (string-append "https://lionet.info/soft/asn1c-"
131 version ".tar.gz"))
132 (sha256
133 (base32
134 "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
135 (build-system gnu-build-system)
136 (native-inputs
137 (list perl))
138 (home-page "https://lionet.info/asn1c")
139 (synopsis "ASN.1 to C compiler")
140 (description "The ASN.1 to C compiler takes ASN.1 module
141files and generates C++ compatible C source code. That code can be
142used to serialize the native C structures into compact and unambiguous
143BER/XER/PER-based data files, and deserialize the files back.
144
145Various ASN.1 based formats are widely used in the industry, such as to encode
146the X.509 certificates employed in the HTTPS handshake, to exchange control
147data between mobile phones and cellular networks, to car-to-car communication
148in intelligent transportation networks.")
149 (license license:bsd-2)))
150
151(define-public p11-kit
152 (package
153 (name "p11-kit")
154 (version "0.26.2")
155 (source
156 (origin
157 (method url-fetch)
158 (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
159 "download/" version "/p11-kit-" version ".tar.xz"))
160 (sha256
161 (base32 "0a7qxkfaj7ayq5b3vw850h6ndr88f37ygmbk3qaa64s8v929zz89"))))
162 (build-system gnu-build-system)
163 (native-inputs
164 (list nss-certs ;default certificates
165 pkg-config
166 python-minimal)) ;to generate some headers
167 (inputs
168 (append (list libffi libtasn1)
169 (if (target-hurd?)
170 (list libbsd)
171 '())))
172 (arguments
173 (list
174 #:configure-flags
175 #~(list (string-append
176 "--with-trust-paths="
177 (string-join
178 '("/etc/ssl/certs/ca-certificates.crt" ;debian, gentoo, etc.
179 "/etc/pki/tls/certs/ca-bundle.crt" ;fedora, centos
180 "/var/lib/ca-certificates/ca-bundle.pem"
181 ;; It's not enough to point directly to the nss-certs'
182 ;; etc/ssl/certs directory; we must ensure the .pem
183 ;; certificates from a directory are found under the
184 ;; anchors/ subdirectory to be trusted (see:
185 ;; https://p11-glue.github.io/p11-glue/p11-kit/
186 ;; manual/trust-module.html#trust-files).
187 #$(file-union
188 "nss-certs"
189 `(("anchors"
190 ,(file-append (this-package-native-input "nss-certs")
191 "/etc/ssl/certs")))))
192 ":")))))
193 (native-search-paths
194 (list (search-path-specification
195 (variable "P11_MODULE_PATH")
196 (files (list "share/p11-kit/modules"))
197 ;; Helas, this only currently support a single PATH entry. It'll
198 ;; thus only work in profiles, not in the build environment.
199 (separator #f))))
200 (home-page "https://p11-glue.github.io/p11-glue/p11-kit.html")
201 (synopsis "PKCS#11 library")
202 (description
203 "p11-kit provides a way to load and enumerate PKCS#11 modules. It
204provides a standard configuration setup for installing PKCS#11 modules
205in such a way that they are discoverable. It also solves problems with
206coordinating the use of PKCS#11 by different components or libraries
207living in the same process.")
208 (license license:bsd-3)))
209
210(define-public gnutls
211 (package
212 (name "gnutls")
213 (version "3.8.13")
214 (source (origin
215 (method url-fetch)
216 ;; Note: Releases are no longer on ftp.gnu.org since the
217 ;; schism (after version 3.1.5).
218 (uri (string-append "mirror://gnupg/gnutls/v"
219 (version-major+minor version)
220 "/gnutls-" version ".tar.xz"))
221 (sha256
222 (base32
223 "0zn9m5nb3a4r9rh5ws3xaczbals7vrvy7ahl9xnl5hh9pz0qxvgz"))))
224 (build-system gnu-build-system)
225 (arguments
226 (list #:tests? (not (or (%current-target-system)
227 (target-hurd?)))
228 ;; Ensure we don't keep a reference to the tools used for testing.
229 #:disallowed-references
230 (if (target-hurd?)
231 '()
232 (list (this-package-native-input "net-tools")
233 (this-package-native-input "iproute2")
234 (this-package-native-input "socat")))
235
236 #:configure-flags
237 #~(list
238 ;; dlopen (the default otherwise) doesn't work reliably on Guix
239 ;; due to its non-FHS nature and the lack of a global
240 ;; ld.so.cache file.
241 "--with-zlib=link"
242 "--with-zstd=link"
243 ;; Configure GnuTLS to use the p11-kit trust module by default,
244 ;; which is more flexible and knows to look at locations we've
245 ;; configured it to, on top of allowing users to configure it
246 ;; further.
247 "--with-default-trust-store-pkcs11=pkcs11:")
248 #:phases
249 #~(modify-phases %standard-phases
250 #$@(if (target-ppc32?)
251 ;; https://gitlab.com/gnutls/gnutls/-/issues/1354
252 ;; Extend the test timeout from the default of 20 * 1000
253 #~((add-after 'unpack 'increase-test-timeout
254 (lambda _
255 (setenv "GNUTLS_TEST_TIMEOUT" "60000"))))
256 #~())
257 (add-after 'install 'move-doc
258 (lambda* (#:key outputs #:allow-other-keys)
259 ;; Copy the 4.1 MiB of section 3 man pages to "doc".
260 (let* ((out (assoc-ref outputs "out"))
261 (doc (assoc-ref outputs "doc"))
262 (mandir (string-append doc "/share/man/man3"))
263 (oldman (string-append out "/share/man/man3")))
264 (mkdir-p mandir)
265 (copy-recursively oldman mandir)
266 (delete-file-recursively oldman)))))))
267 (outputs '("out" ;4.4 MiB
268 "debug"
269 "doc")) ;4.1 MiB of man pages
270 (native-inputs
271 (append (list pkg-config
272 texinfo
273 util-linux) ;one test needs 'setsid'
274 (if (target-hurd?)
275 '()
276 (list net-tools
277 iproute ;for 'ss'
278 socat ;several tests rely on it
279 datefudge)))) ;tests rely on 'datefudge'
280 (inputs (list libunistring zlib))
281 (propagated-inputs
282 ;; These are all in the 'Requires.private' field of gnutls.pc.
283 (list libtasn1 libidn2 p11-kit nettle zlib `(,zstd "lib")))
284 (home-page "https://gnutls.org")
285 (synopsis "Transport layer security library")
286 (description
287 "GnuTLS is a secure communications library implementing the SSL, TLS
288and DTLS protocols. It is provided in the form of a C library to support the
289protocols, as well as to parse and write X.509, PKCS #12, OpenPGP and other
290required structures.")
291 (license license:lgpl2.1+)
292 (properties
293 ;; Since gnutls.org doesn't have a page with a direct link to the
294 ;; tarball, defer to fellow LFS hackers.
295 '((release-monitoring-url
296 . "https://www.linuxfromscratch.org/blfs/view/svn/postlfs/gnutls.html")
297 (upstream-name . "gnutls")))))
298
299(define-deprecated/public-alias gnutls-latest gnutls)
300
301(define-public gnutls/dane
302 ;; GnuTLS with build libgnutls-dane, implementing DNS-based
303 ;; Authentication of Named Entities. This is required for GNS functionality
304 ;; by GNUnet and gnURL. This is done in an extra package definition
305 ;; to have the choice between GnuTLS with Dane and without Dane.
306 (package/inherit gnutls
307 (name "gnutls-dane")
308 (inputs (modify-inputs inputs
309 (prepend unbound)))))
310
311(define-public guile-gnutls
312 (package
313 ;; This package supersedes the Guile bindings that came with GnuTLS until
314 ;; version 3.7.8 included.
315 (name "guile-gnutls")
316 (version "5.0.2")
317 (home-page "https://codeberg.org/guile-gnutls/guile-gnutls")
318 (source (origin
319 ;; url-fetch is used here to avoid a circular dependency with
320 ;; git-download, see https://issues.guix.gnu.org/63331
321 (method url-fetch)
322 (uri (string-append "mirror://gnu/gnutls/guile-gnutls-v"
323 version "-src.tar.gz"))
324 (sha256
325 (base32
326 "1g1v2l9iczfc1h662szcgaxgri403kam5flyjq6rpja4jixxbxjg"))))
327 (build-system gnu-build-system)
328 (outputs '("out" "debug"))
329 (arguments
330 (list
331 #:configure-flags
332 ;; Tell the build system that we want Guile bindings installed to the
333 ;; output instead of Guiles own module directory.
334 #~(list "--disable-static"
335 (string-append "--with-guile-site-dir="
336 "$(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)")
337 (string-append "--with-guile-site-ccache-dir="
338 "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache")
339 (string-append "--with-guile-extension-dir="
340 "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/extensions"))))
341 (native-inputs
342 (list libtool
343 autoconf automake
344 pkg-config
345 texinfo
346 gnutls
347 guile-3.0)) ;XXX: 'guile-snarf' invokes the native 'cpp'
348 (inputs
349 (list gnutls
350 guile-3.0))
351 (properties '((ftp-directory . "gnutls")))
352 (synopsis "Guile bindings to GnuTLS")
353 (description
354 "This package provides Guile bindings to GnuTLS, a library implementation
355the @acronym{TLS, Transport-Layer Security} protocol. It supersedes the Guile
356bindings that were formerly provided as part of GnuTLS.")
357 (license license:lgpl2.1+)))
358
359(define-public guile2.2-gnutls
360 (package/inherit guile-gnutls
361 (name "guile2.2-gnutls")
362 (native-inputs
363 (modify-inputs native-inputs
364 (replace "guile" guile-2.2)))
365 (inputs
366 (modify-inputs inputs
367 (replace "guile" guile-2.2)))))
368
369(define (target->openssl-target pkg target)
370 "Return the value to set CONFIGURE_TARGET_ARCH to when cross-compiling
371OpenSSL for TARGET."
372 ;; Keep this code outside the build code,
373 ;; such that new targets can be added
374 ;; without causing rebuilds for other targets.
375 (if (target-mingw? target)
376 (string-append
377 "mingw"
378 (if (target-x86-64? target)
379 "64"
380 ""))
381 (let ((kernel
382 (cond ((target-hurd? target)
383 "hurd")
384 ((and (target-linux? target)
385 (or (target-riscv64? target)
386 (target-loongarch64? target)))
387 "linux64")
388 ((target-linux? target)
389 "linux")
390 (else
391 (raise (condition
392 (&package-unsupported-target-error
393 (package pkg)
394 (target target)))))))
395 (arch
396 (cond
397 ((target-x86-32? target)
398 "x86")
399 ((target-x32? target)
400 "x32")
401 ((target-x86-64? target)
402 "x86_64")
403 ((target-mips64el? target)
404 "mips64")
405 ((target-arm32? target)
406 "armv4")
407 ((target-aarch64? target)
408 "aarch64")
409 ((target-ppc64le? target)
410 "ppc64le")
411 ((target-ppc32? target)
412 "ppc")
413 ((and (target-powerpc? target)
414 (target-64bit? target))
415 "ppc64")
416 ((target-loongarch64? target)
417 "loongarch64")
418 ((target-riscv64? target)
419 "riscv64")
420 ((target-64bit? target)
421 "generic64")
422 (else
423 (raise (condition
424 (&package-unsupported-target-error
425 (package pkg)
426 (target target))))))))
427 (string-append kernel "-" arch))))
428
429(define-public openssl-1.1
430 (package
431 (name "openssl")
432 (version "1.1.1w")
433 (source (origin
434 (method url-fetch)
435 (uri (list (string-append "https://www.openssl.org/source/openssl-"
436 version ".tar.gz")
437 (string-append "ftp://ftp.openssl.org/source/"
438 "openssl-" version ".tar.gz")
439 (string-append "ftp://ftp.openssl.org/source/old/"
440 (string-trim-right version char-set:letter)
441 "/openssl-" version ".tar.gz")))
442 (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
443 (sha256
444 (base32
445 "1j3anw4554lk3m9cvjngvh1c2gbdkhgiz160jnnm7n5l1jarhc6g"))))
446 (build-system gnu-build-system)
447 (outputs '("out"
448 "doc" ;6.8 MiB of man3 pages and full HTML documentation
449 "static")) ;6.4 MiB of .a files
450 (native-inputs (list perl))
451 (arguments
452 (list
453 #:make-flags
454 (if (or (target-arm?) (target-riscv64?))
455 ;; 'test_afalg' seems to be dependent on kernel features:
456 ;; <https://github.com/openssl/openssl/issues/12242>.
457 #~(list "TESTS=-test_afalg")
458 #~(list))
459 #:test-target "test"
460 ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
461 ;; so we explicitly disallow it here.
462 #:disallowed-references (list (this-package-native-input "perl"))
463 #:phases
464 #~(modify-phases %standard-phases
465 #$@(if (%current-target-system)
466 #~((add-before 'configure 'set-cross-compile
467 (lambda* (#:key target #:allow-other-keys)
468 (setenv "CROSS_COMPILE" (string-append target "-"))
469 (setenv "CONFIGURE_TARGET_ARCH"
470 #$(target->openssl-target
471 this-package
472 (%current-target-system))))))
473 #~())
474 #$@(if (target-hurd?)
475 #~((add-after 'unpack 'patch-configure
476 (lambda _
477 (substitute* "config"
478 (("case \"\\$GUESSOS\" in.*" all)
479 (string-append all "hurd-x86*) OUT=hurd-x86;;\n"))))))
480 #~())
481 (replace 'configure
482 (lambda* (#:key configure-flags #:allow-other-keys)
483 ;; It's not a shebang so patch-source-shebangs misses it.
484 (substitute* "config"
485 (("/usr/bin/env")
486 (which "env")))
487 (apply
488 invoke #$@(if (%current-target-system)
489 #~("./Configure")
490 #~("./config"))
491 "shared" ;build shared libraries
492 "--libdir=lib"
493
494 ;; The default for this catch-all directory is PREFIX/ssl.
495 ;; Change that to something more conventional.
496 (string-append "--openssldir=" #$output
497 "/share/openssl")
498
499 (string-append "--prefix=" #$output)
500 (string-append "-Wl,-rpath," (string-append #$output "/lib"))
501 #$@(if (%current-target-system)
502 #~((getenv "CONFIGURE_TARGET_ARCH"))
503 #~())
504 configure-flags)
505 ;; Output the configure variables.
506 (invoke "perl" "configdata.pm" "--dump")))
507 (add-after 'install 'move-static-libraries
508 (lambda _
509 ;; Move static libraries to the "static" output.
510 (let* ((lib (string-append #$output "/lib"))
511 (slib (string-append #$output:static "/lib")))
512 (for-each (lambda (file)
513 (install-file file slib)
514 (delete-file file))
515 (find-files
516 lib
517 #$(if (target-mingw?)
518 '(lambda (filename _)
519 (and (string-suffix? ".a" filename)
520 (not (string-suffix? ".dll.a"
521 filename))))
522 "\\.a$"))))))
523 (add-after 'install 'move-extra-documentation
524 (lambda _
525 ;; Move man pages and full HTML documentation to "doc".
526 (let* ((man (string-append #$output "/share/man"))
527 (html (string-append #$output "/share/doc/openssl"))
528 (man-target (string-append #$output:doc "/share/man"))
529 (html-target (string-append
530 #$output:doc "/share/doc/openssl")))
531 (mkdir-p (dirname man-target))
532 (mkdir-p (dirname html-target))
533 (rename-file man man-target)
534 (rename-file html html-target))))
535 (add-after 'install 'remove-miscellany
536 (lambda _
537 ;; The 'misc' directory contains random undocumented shell and
538 ;; Perl scripts. Remove them to avoid retaining a reference on
539 ;; Perl.
540 (delete-file-recursively
541 (string-append #$output "/share/openssl/misc")))))))
542 (native-search-paths
543 (list $SSL_CERT_DIR $SSL_CERT_FILE))
544 (synopsis "SSL/TLS implementation")
545 (description "OpenSSL is an implementation of SSL/TLS.")
546 (license license:openssl)
547 (home-page "https://www.openssl.org/")))
548
549(define-public openssl-3.5
550 ;; LTS series with EOL 2030-04-08
551 (package
552 (name "openssl")
553 (version "3.5.7")
554 (source (origin
555 (method url-fetch)
556 (uri (list (string-append "https://www.openssl.org/source/openssl-"
557 version ".tar.gz")
558 (string-append "ftp://ftp.openssl.org/source/"
559 "openssl-" version ".tar.gz")
560 (string-append "ftp://ftp.openssl.org/source/old/"
561 (string-trim-right version char-set:letter)
562 "/openssl-" version ".tar.gz")))
563 (patches (search-patches "openssl-3.0-c-rehash-in.patch"))
564 (sha256
565 (base32
566 "1s4qmjp33ai43ahlm3iw59aq86fj5hp7kxbcygwq194waa5d5h58"))))
567 (build-system gnu-build-system)
568 (outputs '("out"
569 "doc"
570 "static"))
571 (arguments
572 (list
573 #:parallel-tests? #f
574 #:make-flags
575 (if (or (target-arm?) (target-riscv64?))
576 ;; 'test_afalg' seems to be dependent on kernel features:
577 ;; <https://github.com/openssl/openssl/issues/12242>.
578 #~(list "TESTS=-test_afalg")
579 #~(list))
580 #:test-target "test"
581 #:configure-flags
582 (if (system-hurd?)
583 (if (target-hurd64?)
584 #~(list "hurd-x86_64")
585 #~(list "hurd-x86"))
586 #~(list))
587 ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
588 ;; so we explicitly disallow it here.
589 #:disallowed-references (list (this-package-native-input "perl"))
590 #:phases
591 #~(modify-phases %standard-phases
592 (replace 'configure
593 (lambda* (#:key configure-flags native-inputs inputs target #:allow-other-keys)
594 ;; It's not a shebang so patch-source-shebangs misses it.
595 (substitute* "config"
596 (("/usr/bin/env")
597 (which "env")))
598 #$@(if (%current-target-system)
599 #~((setenv "CROSS_COMPILE" (string-append target "-"))
600 (setenv "CONFIGURE_TARGET_ARCH"
601 #$(target->openssl-target
602 this-package
603 (%current-target-system))))
604 #~())
605 ;; Configure PERL.
606 (setenv "HASHBANGPERL"
607 (search-input-file (or native-inputs inputs)
608 "/bin/perl"))
609 (apply
610 invoke #$@(if (%current-target-system)
611 #~("./Configure")
612 #~("./config"))
613 "shared" ;build shared libraries
614 "--libdir=lib"
615
616 ;; The default for this catch-all directory is
617 ;; PREFIX/ssl. Change that to something more
618 ;; conventional.
619 (string-append "--openssldir=" #$output
620 "/share/openssl-"
621 #$(package-version this-package))
622
623 (string-append "--prefix=" #$output)
624 (string-append "-Wl,-rpath," (string-append #$output "/lib"))
625 #$@(if (%current-target-system)
626 #~((getenv "CONFIGURE_TARGET_ARCH"))
627 #~())
628 configure-flags)
629 ;; Output the configure variables.
630 (invoke "perl" "configdata.pm" "--dump")))
631 (add-after 'install 'move-static-libraries
632 (lambda _
633 ;; Move static libraries to the "static" output.
634 (let* ((lib (string-append #$output "/lib"))
635 (slib (string-append #$output:static "/lib")))
636 (for-each (lambda (file)
637 (install-file file slib)
638 (delete-file file))
639 (find-files
640 lib
641 #$(if (target-mingw?)
642 '(lambda (filename _)
643 (and (string-suffix? ".a" filename)
644 (not (string-suffix? ".dll.a"
645 filename))))
646 "\\.a$"))))))
647 (add-after 'install 'move-extra-documentation
648 (lambda _
649 ;; Move man pages and full HTML documentation to "doc".
650 (let* ((man (string-append #$output "/share/man"))
651 (html (string-append #$output "/share/doc/openssl"))
652 (man-target (string-append #$output:doc "/share/man"))
653 (html-target (string-append
654 #$output:doc "/share/doc/openssl")))
655 (mkdir-p (dirname man-target))
656 (mkdir-p (dirname html-target))
657 (rename-file man man-target)
658 (rename-file html html-target))))
659 (add-after 'install 'remove-miscellany
660 (lambda _
661 ;; The 'misc' directory contains random undocumented shell and
662 ;; Perl scripts. Remove them to avoid retaining a reference on
663 ;; Perl.
664 (delete-file-recursively
665 (string-append #$output "/share/openssl-"
666 #$(package-version this-package) "/misc")))))))
667 (native-inputs (list perl))
668 (native-search-paths
669 (list $SSL_CERT_DIR $SSL_CERT_FILE))
670 (home-page "https://www.openssl.org/")
671 (synopsis "SSL/TLS implementation")
672 (description "OpenSSL is an implementation of SSL/TLS.")
673 (license license:asl2.0)))
674
675(define-public openssl-3.0
676 ;; LTS series with EOL 2026-09-07
677 (package
678 (inherit openssl-3.5)
679 (version "3.0.19")
680 (source (origin
681 (method url-fetch)
682 (uri (list (string-append "https://www.openssl.org/source/openssl-"
683 version ".tar.gz")
684 (string-append "ftp://ftp.openssl.org/source/"
685 "openssl-" version ".tar.gz")
686 (string-append "ftp://ftp.openssl.org/source/old/"
687 (string-trim-right version char-set:letter)
688 "/openssl-" version ".tar.gz")))
689 (patches (search-patches "openssl-3.0-c-rehash-in.patch"
690 "openssl-hurd64.patch"))
691 (sha256
692 (base32
693 "0wihnr5bjdc3v0r4viwb1d1lf1rfkbrcmwzj7vjqpqdap11l2nps"))))))
694
695(define-public openssl openssl-3.5)
696
697(define-public bearssl
698 (package
699 (name "bearssl")
700 (version "0.6")
701 (source (origin
702 (method url-fetch)
703 (uri (string-append "https://www.bearssl.org/"
704 "bearssl-" version ".tar.gz"))
705 (sha256
706 (base32
707 "057zhgy9w4y8z2996r0pq5k2k39lpvmmvz4df8db8qa9f6hvn1b7"))))
708 (build-system gnu-build-system)
709 (arguments
710 (list
711 #:make-flags
712 #~(list #$(string-append "CC=" (cc-for-target))
713 #$(string-append "LD=" (cc-for-target))
714 #$(string-append "LDDLL=" (cc-for-target)))
715 #:phases
716 #~(modify-phases %standard-phases
717 (delete 'configure) ;no configure script
718 (replace 'check
719 (lambda* (#:key tests? #:allow-other-keys)
720 (when tests?
721 (with-directory-excursion "build"
722 (invoke "./testcrypto" "all")
723 (invoke "./testx509")))))
724 (replace 'install ;no install rule
725 (lambda _
726 (let* ((out #$output)
727 (bin (string-append out "/bin"))
728 (doc (string-append out "/share/doc/" #$name "-" #$version))
729 (lib (string-append out "/lib"))
730 (include (string-append out "/include")))
731 (install-file "build/brssl" bin)
732 (for-each (lambda (f) (install-file f include))
733 (find-files "inc" "\\.h$"))
734 (install-file "LICENSE.txt" doc)
735 (install-file "build/libbearssl.so" lib)))))))
736 (home-page "https://bearssl.org/")
737 (synopsis "Small SSL/TLS library")
738 (description "BearSSL is an implementation of the SSL/TLS
739protocol (RFC 5246) written in C. It aims at being correct and
740secure. In particular, insecure protocol versions and choices of
741algorithms are not supported, by design; cryptographic algorithm
742implementations are constant-time by default. It should also be
743small, both in RAM and code footprint. For instance, a minimal server
744implementation may fit in about 20 kilobytes of compiled code and 25
745kilobytes of RAM.")
746 (license license:expat)))
747
748(define-public libressl
749 (package
750 (name "libressl")
751 (version "4.3.2")
752 (source (origin
753 (method url-fetch)
754 (uri (string-append "mirror://openbsd/LibreSSL/"
755 "libressl-" version ".tar.gz"))
756 (sha256
757 (base32
758 "1da712lxzqclwyavvfzkskwjys6spi29vjzgm7k6jpf64kp1mw7d"))))
759 (outputs (list "out" "debug"))
760 (build-system gnu-build-system)
761 (arguments
762 (list
763 #:configure-flags
764 #~(list
765 ;; Do as if 'getentropy' were missing: Linux kernels before 3.17 lack its
766 ;; underlying 'getrandom' system call and ENOSYS isn't properly handled.
767 ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
768 "ac_cv_func_getentropy=no"
769 ;; FIXME It's using it's own bundled certificate, instead it should
770 ;; behave like OpenSSL by using environment variables.
771 (string-append "--with-openssldir=" #$output
772 "/share/libressl-" #$(package-version this-package))
773 ;; Provide a TLS-enabled netcat.
774 "--enable-nc")))
775 (properties
776 `((release-monitoring-url . "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/")))
777 (home-page "https://www.libressl.org/")
778 (synopsis "SSL/TLS implementation")
779 (description "LibreSSL is a version of the TLS/crypto stack, forked from
780OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
781and applying best practice development processes. This package also includes a
782netcat implementation that supports TLS.")
783 ;; Files taken from OpenSSL keep their license, others are under various
784 ;; non-copyleft licenses.
785 (license (list license:openssl
786 (license:non-copyleft
787 "file://COPYING"
788 "See COPYING in the distribution.")))))
789
790(define-public python-acme
791 (package
792 (name "python-acme")
793 ;; Remember to update the hash of certbot when updating python-acme.
794 (version "4.2.0")
795 (source
796 (origin
797 (method url-fetch)
798 (uri (pypi-uri "acme" version))
799 (sha256
800 (base32 "0h8ckyal5j8lkm24fd52dajy38mxa76zh4q022i28f6b3878rxhd"))))
801 (build-system pyproject-build-system)
802 (arguments
803 (list
804 #:phases
805 #~(modify-phases %standard-phases
806 (add-after 'unpack 'relax-requirements
807 (lambda _
808 (substitute* "setup.py"
809 (("'PyOpenSSL.*',")
810 "'PyOpenSSL',"))))
811 (add-after 'build 'build-documentation
812 (lambda _
813 (invoke "make" "-C" "docs" "man" "info")))
814 (add-after 'install 'install-documentation
815 (lambda _
816 (let ((man (string-append #$output "/share/man/man1"))
817 (info (string-append #$output "/info")))
818 (install-file "docs/_build/texinfo/acme-python.info" info)
819 (install-file "docs/_build/man/acme-python.1" man)))))))
820 (native-inputs
821 (list python-pytest
822 python-pytest-xdist
823 python-setuptools
824 python-wheel
825 ;; For documentation
826 python-sphinx
827 python-sphinxcontrib-programoutput
828 python-sphinx-rtd-theme
829 texinfo))
830 (propagated-inputs
831 (list python-cryptography
832 python-josepy
833 python-pyopenssl
834 python-pyrfc3339
835 python-requests))
836 (home-page "https://github.com/certbot/certbot")
837 (synopsis "ACME protocol implementation in Python")
838 (description "ACME protocol implementation in Python")
839 (license license:asl2.0)))
840
841(define-public certbot
842 (package
843 (name "certbot")
844 ;; Certbot and python-acme are developed in the same repository, and their
845 ;; versions should remain synchronized.
846 (version (package-version python-acme))
847 (source
848 (origin
849 (method url-fetch)
850 (uri (pypi-uri "certbot" version))
851 (sha256
852 (base32 "0yy287h1sjdkm5cj4wazq316igwwla856yqcmi4yqaq7ib55c7pv"))))
853 (build-system pyproject-build-system)
854 (arguments
855 (substitute-keyword-arguments (package-arguments python-acme)
856 ((#:test-flags flags '())
857 ;; XXX: No time zone found with key Asia/Sanghai, pytz version?
858 #~(list "-k" "not test_add_time_interval"))
859 ((#:phases phases)
860 #~(modify-phases #$phases
861 (replace 'install-documentation
862 (lambda* (#:key outputs #:allow-other-keys)
863 (let ((man1 (string-append #$output "/share/man/man1"))
864 (man7 (string-append #$output "/share/man/man7"))
865 (info (string-append #$output "/info")))
866 (install-file "docs/_build/texinfo/Certbot.info" info)
867 (install-file "docs/_build/man/certbot.1" man1)
868 (install-file "docs/_build/man/certbot.7" man7))))))))
869 (native-inputs
870 (list python-mock
871 python-pytest
872 python-setuptools
873 python-wheel
874 ;; For documentation
875 python-sphinx
876 python-sphinx-rtd-theme
877 python-sphinx-repoze-autointerface
878 python-sphinxcontrib-programoutput
879 texinfo))
880 (propagated-inputs
881 (list python-acme
882 python-cryptography
883 python-pyrfc3339
884 python-pyopenssl
885 python-configobj
886 python-configargparse
887 python-distro
888 python-parsedatetime
889 python-psutil
890 python-requests
891 python-pytz))
892 (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
893 (description
894 "Certbot automatically receives and installs X.509 certificates to enable
895Transport Layer Security (TLS) on servers. It interoperates with the
896Let’s Encrypt certificate authority (CA), which issues browser-trusted
897certificates for free.")
898 (home-page "https://certbot.eff.org/")
899 (license license:asl2.0)))
900
901(define-public uacme
902 (package
903 (name "uacme")
904 (version "1.8.1")
905 (source
906 (origin
907 (method git-fetch)
908 (uri (git-reference
909 (url "https://github.com/ndilieto/uacme/")
910 (commit (string-append "v" version))))
911 (file-name (git-file-name name version))
912 (sha256
913 (base32
914 "13s7rzcm0w1rxfr0yi7hyilj69pb0q7n56ag2id76c9vwras6a2f"))))
915 (build-system gnu-build-system)
916 (arguments
917 (list
918 #:phases
919 #~(modify-phases %standard-phases
920 (add-after 'unpack 'set-version
921 (lambda _
922 (substitute* "configure.ac"
923 (((string-append
924 "m4_esyscmd\\(\\[build-aux/git-version-gen "
925 "\\.tarball-version\\]\\)"))
926 #$version)))))))
927 (inputs
928 (list curl gnutls))
929 (native-inputs
930 (list asciidoc
931 autoconf
932 automake
933 pkg-config))
934 (home-page "https://github.com/ndilieto/uacme")
935 (synopsis "Minimal ACMEv2 client written in C")
936 (description "Uacme is a lightweight client for the RFC8555 ACMEv2
937protocol, written in plain C with minimal dependencies.")
938 (license license:gpl3+)))
939
940(define-public perl-net-ssleay
941 (package
942 (name "perl-net-ssleay")
943 (version "1.96")
944 (source (origin
945 (method url-fetch)
946 (uri (string-append "mirror://cpan/authors/id/C/CH/CHRISN/"
947 "Net-SSLeay-" version ".tar.gz"))
948 (sha256
949 (base32
950 "0lq7zjnr82q3qjvibbb32ninb0bg4vcwijv9qrvabcjzd28kc8db"))
951 (patches (search-patches "perl-net-ssleay-colon-parsing.patch"))))
952 (build-system perl-build-system)
953 (inputs (list openssl))
954 (arguments
955 (list
956 #:phases
957 #~(modify-phases %standard-phases
958 (add-before
959 'configure 'set-ssl-prefix
960 (lambda* (#:key inputs #:allow-other-keys)
961 (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl")))))))
962 (synopsis "Perl extension for using OpenSSL")
963 (description
964 "This module offers some high level convenience functions for accessing
965web pages on SSL servers (for symmetry, the same API is offered for accessing
966http servers, too), an sslcat() function for writing your own clients, and
967finally access to the SSL api of the SSLeay/OpenSSL package so you can write
968servers or clients for more complicated applications.")
969 (license license:perl-license)
970 (home-page "https://metacpan.org/release/Net-SSLeay")))
971
972(define-public perl-crypt-openssl-rsa
973 (package
974 (name "perl-crypt-openssl-rsa")
975 (version "0.33")
976 (source
977 (origin
978 (method url-fetch)
979 (uri (string-append
980 "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
981 version
982 ".tar.gz"))
983 (sha256
984 (base32
985 "0r6qxx2nyvdsv859zl8vz17ndj1a4xvrknbafhjh6m3gdl7n7gmx"))))
986 (build-system perl-build-system)
987 (native-inputs
988 (list perl-crypt-openssl-guess))
989 (inputs
990 (list perl-crypt-openssl-bignum perl-crypt-openssl-random openssl))
991 (arguments perl-crypt-arguments)
992 (home-page
993 "https://metacpan.org/release/Crypt-OpenSSL-RSA")
994 (synopsis
995 "RSA encoding and decoding, using the openSSL libraries")
996 (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
997OpenSSL libraries).")
998 (license license:perl-license)))
999
1000(define perl-crypt-arguments
1001 `(#:phases (modify-phases %standard-phases
1002 (add-before 'configure 'patch-Makefile.PL
1003 (lambda* (#:key inputs #:allow-other-keys)
1004 (substitute* "Makefile.PL"
1005 (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
1006 (assoc-ref inputs "openssl")
1007 "/lib -lcrypto'],")))
1008 #t)))))
1009
1010(define-public perl-crypt-openssl-bignum
1011 (package
1012 (name "perl-crypt-openssl-bignum")
1013 (version "0.09")
1014 (source
1015 (origin
1016 (method url-fetch)
1017 (uri (string-append
1018 "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
1019 version
1020 ".tar.gz"))
1021 (sha256
1022 (base32
1023 "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
1024 (build-system perl-build-system)
1025 (inputs (list openssl))
1026 (arguments perl-crypt-arguments)
1027 (home-page
1028 "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
1029 (synopsis
1030 "OpenSSL's multiprecision integer arithmetic in Perl")
1031 (description "Crypt::OpenSSL::Bignum provides multiprecision integer
1032arithmetic in Perl.")
1033 ;; At your option either gpl1+ or the Artistic License
1034 (license license:perl-license)))
1035
1036(define-public perl-crypt-openssl-guess
1037 (package
1038 (name "perl-crypt-openssl-guess")
1039 (version "0.11")
1040 (source
1041 (origin
1042 (method url-fetch)
1043 (uri (string-append
1044 "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
1045 version ".tar.gz"))
1046 (sha256
1047 (base32
1048 "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
1049 (build-system perl-build-system)
1050 (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
1051 (synopsis "Guess the OpenSSL include path")
1052 (description
1053 "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
1054correct OpenSSL include path. It is intended for use in your
1055@file{Makefile.PL}.")
1056 (license license:perl-license)))
1057
1058(define-public perl-crypt-openssl-random
1059 (package
1060 (name "perl-crypt-openssl-random")
1061 (version "0.15")
1062 (source
1063 (origin
1064 (method url-fetch)
1065 (uri (string-append
1066 "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
1067 version
1068 ".tar.gz"))
1069 (sha256
1070 (base32 "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh"))))
1071 (build-system perl-build-system)
1072 (native-inputs
1073 (list perl-crypt-openssl-guess))
1074 (inputs
1075 (list openssl))
1076 (arguments perl-crypt-arguments)
1077 (home-page
1078 "https://metacpan.org/release/Crypt-OpenSSL-Random")
1079 (synopsis
1080 "OpenSSL/LibreSSL pseudo-random number generator access")
1081 (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
1082number generator")
1083 (license license:perl-license)))
1084
1085(define-public mbedtls
1086 (package
1087 (name "mbedtls")
1088 (version "4.2.0")
1089 (source
1090 (origin
1091 (method url-fetch)
1092 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1093 "/download/mbedtls-" version
1094 "/mbedtls-" version ".tar.bz2"))
1095 (sha256
1096 (base32 "1spzwsylnlld4apdfh592bqwh2x3i8myg5xhadjzfs267dqrvv9b"))))
1097 (build-system cmake-build-system)
1098 (arguments
1099 (list #:parallel-tests? #f
1100 #:configure-flags
1101 #~(list "-DCMAKE_C_FLAGS=-Wno-error=calloc-transposed-args"
1102 "-DUSE_SHARED_MBEDTLS_LIBRARY=ON"
1103 "-DUSE_STATIC_MBEDTLS_LIBRARY=OFF")
1104 #:phases
1105 #~(modify-phases %standard-phases
1106 (add-after 'unpack 'make-source-writable
1107 (lambda _
1108 (for-each make-file-writable (find-files ".")))))))
1109 (native-inputs
1110 (list perl python))
1111 (synopsis "Small TLS library")
1112 (description
1113 "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
1114for developers to include cryptographic and SSL/TLS capabilities in their
1115(embedded) products, facilitating this functionality with a minimal
1116coding footprint.")
1117 (home-page "https://www.trustedfirmware.org/projects/mbed-tls/")
1118 (license (list license:asl2.0 license:gpl2+)))) ;dual licensed
1119
1120(define-public mbedtls-3
1121 (package
1122 (inherit mbedtls)
1123 (version "3.6.7")
1124 (source
1125 (origin
1126 (method url-fetch)
1127 (uri (string-append "https://github.com/Mbed-TLS/mbedtls/releases"
1128 "/download/mbedtls-" version
1129 "/mbedtls-" version ".tar.bz2"))
1130 (sha256
1131 (base32 "1xhi5lhn78vphv07kvwfyrigfdbbc9vmdwi4mys63xz6q2zbrs57"))))))
1132
1133;;; TODO: No longer maintained, migrate dependents to current mbedtls.
1134(define-public mbedtls-lts
1135 (package
1136 (inherit mbedtls)
1137 (name "mbedtls")
1138 (version "2.28.9")
1139 (source
1140 (origin
1141 (method git-fetch)
1142 (uri (git-reference
1143 (url "https://github.com/ARMmbed/mbedtls")
1144 (commit (string-append "mbedtls-" version))))
1145 (file-name (git-file-name name version))
1146 (sha256
1147 (base32 "0ldqhvmj9wl0yp3hz675zbnq69lw533s0ahy9bbdxxnj5gjb86gw"))))))
1148
1149;; The Hiawatha Web server requires some specific features to be enabled.
1150(define-public mbedtls-for-hiawatha
1151 (hidden-package
1152 (package/inherit mbedtls
1153 (arguments
1154 (substitute-keyword-arguments arguments
1155 ((#:phases phases)
1156 #~(modify-phases #$phases
1157 (add-before 'configure 'configure-extra-features
1158 (lambda _
1159 (for-each (lambda (feature)
1160 (invoke "scripts/config.pl" "set" feature))
1161 (list "MBEDTLS_THREADING_C"
1162 "MBEDTLS_THREADING_PTHREAD")))))))))))
1163
1164(define-public dehydrated
1165 (package
1166 (name "dehydrated")
1167 (version "0.7.1")
1168 (source
1169 (origin
1170 (method git-fetch)
1171 (uri (git-reference
1172 (url "https://github.com/dehydrated-io/dehydrated")
1173 (commit (string-append "v" version))))
1174 (file-name (git-file-name name version))
1175 (sha256
1176 (base32 "1mhf3v9ynwrxrkqawqpxnwfn5dmrlkqcvkxdrk59nkxjpdx1wkrb"))))
1177 (build-system trivial-build-system)
1178 (arguments
1179 (list
1180 #:modules '((guix build utils))
1181 #:builder
1182 #~(begin
1183 (use-modules (guix build utils)
1184 (srfi srfi-26))
1185 (let* ((source (assoc-ref %build-inputs "source"))
1186 (gzip (search-input-file %build-inputs "bin/gzip"))
1187 (bin (string-append #$output "/bin"))
1188 (doc (string-append #$output "/share/doc/"
1189 #$name "-" #$version))
1190 (man (string-append #$output "/share/man"))
1191 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
1192
1193 (chdir source)
1194
1195 (copy-recursively "docs" doc)
1196 (install-file "LICENSE" doc)
1197
1198 (mkdir-p man)
1199 (rename-file (string-append doc "/man")
1200 (string-append man "/man1"))
1201 (for-each (cut invoke gzip "-9n" <>)
1202 (find-files man ".*"))
1203
1204 (install-file "dehydrated" bin)
1205 (with-directory-excursion bin
1206 (patch-shebang "dehydrated" (list bash))
1207
1208 ;; Do not try to write to the store.
1209 (substitute* "dehydrated"
1210 (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
1211
1212 (setenv "PATH" bash)
1213 (wrap-program "dehydrated"
1214 `("PATH" ":" prefix
1215 ,(map (lambda (file)
1216 (dirname (search-input-file %build-inputs file)))
1217 (list
1218 ;; From check_dependencies() — keep them in sync.
1219 "bin/grep"
1220 "bin/diff"
1221 "bin/sed"
1222 "bin/awk"
1223 "bin/curl"
1224 "bin/cut" ; also mktemp, head, tail
1225 "bin/hexdump"
1226 ;; Additional requirements.
1227 "bin/openssl")))))))))
1228 (inputs
1229 (list bash
1230 coreutils
1231 curl
1232 diffutils
1233 gawk
1234 grep
1235 openssl
1236 sed
1237 util-linux+udev))
1238 (native-inputs
1239 (list gzip))
1240 ;; The following definition is copied from the cURL package to prevent a
1241 ;; cycle between the curl and tls modules.
1242 (native-search-paths
1243 (list (search-path-specification
1244 (variable "CURL_CA_BUNDLE")
1245 (file-type 'regular)
1246 (separator #f)
1247 (files '("etc/ssl/certs/ca-certificates.crt")))))
1248 (home-page "https://dehydrated.io/")
1249 (synopsis "ACME client implemented as a shell script")
1250 (description "Dehydrated is a client for obtaining certificates from an
1251ACME server (such as Let's Encrypt) implemented as a relatively simple Bash
1252script.")
1253 (license license:expat)))
1254
1255(define-public s2n
1256 (package
1257 (name "s2n")
1258 ;; Update only when updating aws-crt-cpp.
1259 (version "1.5.15")
1260 (source (origin
1261 (method git-fetch)
1262 (uri (git-reference
1263 (url "https://github.com/aws/s2n-tls")
1264 (commit (string-append "v" version))))
1265 (file-name (git-file-name name version))
1266 (sha256
1267 (base32
1268 "0b8ym4ns56fa5pkrvsm5kghh8mii0q0kc1mz2plg1ypm5zny02kw"))))
1269 (build-system cmake-build-system)
1270 (arguments
1271 '(#:configure-flags
1272 '("-DBUILD_SHARED_LIBS=ON")))
1273 (propagated-inputs (list aws-lc))
1274 (supported-systems %64bit-supported-systems)
1275 (synopsis "SSL/TLS implementation in C99")
1276 (description
1277 "This library provides a C99 implementation of SSL/TLS. It is designed to
1278be familiar to users of the widely-used POSIX I/O APIs. It supports blocking,
1279non-blocking, and full-duplex I/O. There are no locks or mutexes.
1280
1281As it can be difficult to keep track of which encryption algorithms and
1282protocols are best to use, s2n-tls features a simple API to use the latest
1283default set of preferences. Remaining on a specific version for backwards
1284compatibility is also supported.")
1285 (home-page "https://github.com/aws/s2n-tls")
1286 (license license:asl2.0)))
1287
1288(define-public wolfssl
1289 (package
1290 (name "wolfssl")
1291 (version "5.7.6")
1292 (source (origin
1293 (method git-fetch)
1294 (uri (git-reference
1295 (url "https://github.com/wolfSSL/wolfssl")
1296 (commit (string-append "v" version "-stable"))))
1297 (file-name (git-file-name name version))
1298 (sha256
1299 (base32
1300 "1q1sqwx6njsjbwmwr87ky0yrg2cin7ssa12gl14i8x1v35rpcxdb"))))
1301 (build-system gnu-build-system)
1302 (arguments
1303 (list #:configure-flags
1304 #~(list "--enable-distro"
1305 "--enable-pkcs11"
1306 "--disable-examples"
1307 "--enable-jobserver=no")))
1308 (native-inputs
1309 (list autoconf automake libtool))
1310 (synopsis "SSL/TLS implementation")
1311 (description "The wolfSSL embedded SSL library (formerly CyaSSL) is an
1312SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and
1313resource-constrained environments - primarily because of its small size, speed,
1314and feature set. wolfSSL supports industry standards up to the current TLS 1.3
1315and DTLS 1.2, is up to 20 times smaller than OpenSSL, and offers progressive
1316ciphers such as ChaCha20, Curve25519, NTRU, and Blake2b.")
1317 (home-page "https://www.wolfssl.com/")
1318 (license license:gpl2+))) ; Audit
1319
1320(define-public wolfssl-for-rpcs3
1321 (package/inherit wolfssl
1322 (name "wolfssl-for-rpcs3")
1323 (arguments
1324 (substitute-keyword-arguments arguments
1325 ((#:configure-flags flags ''())
1326 #~(cons* "--enable-des3"
1327 "--enable-pwdbased"
1328 "--enable-fastmath"
1329 "--enable-opensslextra"
1330 "--disable-harden"
1331 "--enable-altcertchains"
1332 "--enable-writedup"
1333 #$flags))))))
1334
1335(define-public aws-lc
1336 (package
1337 (name "aws-lc")
1338 ;; Update only when updating aws-crt-cpp.
1339 (version "1.48.5")
1340 (source (origin
1341 (method git-fetch)
1342 (uri (git-reference
1343 (url (string-append "https://github.com/awslabs/" name))
1344 (commit (string-append "v" version))))
1345 (file-name (git-file-name name version))
1346 (sha256
1347 (base32
1348 "1hgfsl3plpiljasvxxdhz37n5lc6j819djq3nlf59pw4fivfy6mv"))))
1349 (build-system cmake-build-system)
1350 (native-inputs (list perl))
1351 (arguments
1352 (list
1353 #:configure-flags
1354 #~(list "-DBUILD_SHARED_LIBS=ON" "-DDISABLE_GO=ON")
1355 #:modules '((guix build cmake-build-system)
1356 ((guix build gnu-build-system) #:prefix gnu:)
1357 (guix build utils))
1358 #:phases
1359 #~(modify-phases %standard-phases
1360 (replace 'check
1361 (lambda* (#:rest args)
1362 (apply (assoc-ref gnu:%standard-phases 'check)
1363 #:test-target "run_minimal_tests" args))))))
1364 (synopsis "General purpose cryptographic library")
1365 (description "AWS libcrypto (aws-lc) contains portable C implementations
1366of algorithms needed for TLS and common applications, and includes optimized
1367assembly versions for x86 and ARM.")
1368 (home-page "https://github.com/awslabs/aws-lc")
1369 (license license:asl2.0)))