Commit | Line | Data |
---|---|---|
cf053a4f AE |
1 | ;;; GNU Guix --- Functional package management for GNU |
2 | ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr> | |
41ce4601 | 3 | ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org> |
cf053a4f AE |
4 | ;;; |
5 | ;;; This file is part of GNU Guix. | |
6 | ;;; | |
7 | ;;; GNU Guix is free software; you can redistribute it and/or modify it | |
8 | ;;; under the terms of the GNU General Public License as published by | |
9 | ;;; the Free Software Foundation; either version 3 of the License, or (at | |
10 | ;;; your option) any later version. | |
11 | ;;; | |
12 | ;;; GNU Guix is distributed in the hope that it will be useful, but | |
13 | ;;; WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | ;;; GNU General Public License for more details. | |
16 | ;;; | |
17 | ;;; You should have received a copy of the GNU General Public License | |
18 | ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>. | |
19 | ||
20 | (define-module (gnu packages certs) | |
21 | #:use-module ((guix licenses) #:prefix license:) | |
22 | #:use-module (guix packages) | |
23 | #:use-module (guix download) | |
6e6e2414 | 24 | #:use-module (guix build-system gnu) |
cf053a4f AE |
25 | #:use-module (guix build-system trivial) |
26 | #:use-module (gnu packages) | |
6e6e2414 | 27 | #:use-module (gnu packages gnuzilla) |
cc2b77df | 28 | #:use-module (gnu packages python) |
784d6e91 | 29 | #:use-module (gnu packages perl) |
cc2b77df | 30 | #:use-module (gnu packages tls)) |
cf053a4f AE |
31 | |
32 | (define certdata2pem | |
33 | (package | |
34 | (name "certdata2pem") | |
35 | (version "2013") | |
36 | (source | |
81f36365 | 37 | (origin |
cf053a4f AE |
38 | (method url-fetch) |
39 | (uri | |
40 | "http://pkgs.fedoraproject.org/cgit/ca-certificates.git/plain/certdata2pem.py?id=053dde8a2f5901e97028a58bf54e7d0ef8095a54") | |
81f36365 | 41 | (file-name "certdata2pem.py") |
cf053a4f AE |
42 | (sha256 |
43 | (base32 | |
44 | "0zscrm41gnsf14zvlkxhy00h3dmgidyz645ldpda3y3vabnwv8dx")))) | |
45 | (build-system trivial-build-system) | |
46 | (inputs | |
47 | `(("python" ,python-2))) | |
48 | (arguments | |
49 | `(#:modules ((guix build utils)) | |
50 | #:builder | |
51 | (begin | |
52 | (use-modules (guix build utils)) | |
53 | (let ((bin (string-append %output "/bin"))) | |
54 | (copy-file (assoc-ref %build-inputs "source") "certdata2pem.py") | |
55 | (chmod "certdata2pem.py" #o555) | |
56 | (substitute* "certdata2pem.py" | |
57 | (("/usr/bin/python") | |
58 | (string-append (assoc-ref %build-inputs "python") | |
59 | "/bin/python")) | |
60 | ;; Use the file extension .pem instead of .crt. | |
61 | (("crt") "pem")) | |
62 | (mkdir-p bin) | |
63 | (copy-file "certdata2pem.py" | |
64 | (string-append bin "/certdata2pem.py")))))) | |
65 | (synopsis "Python script to extract .pem data from certificate collection") | |
66 | (description | |
67 | "certdata2pem.py is a Python script to transform X.509 certificate | |
68 | \"source code\" as contained, for example, in the Mozilla sources, into | |
69 | .pem formatted certificates.") | |
70 | (license license:gpl2+) | |
71 | (home-page "http://pkgs.fedoraproject.org/cgit/ca-certificates.git/"))) | |
6e6e2414 AE |
72 | |
73 | (define-public nss-certs | |
74 | (package (inherit nss) ; to reuse the source, version and some metadata | |
75 | (name "nss-certs") | |
76 | (build-system gnu-build-system) | |
77 | (outputs '("out")) | |
78 | (native-inputs | |
79 | `(("certdata2pem" ,certdata2pem) | |
784d6e91 LC |
80 | ("openssl" ,openssl) |
81 | ("perl" ,perl))) ;for OpenSSL's 'c_rehash' | |
6e6e2414 AE |
82 | (inputs '()) |
83 | (propagated-inputs '()) | |
84 | (arguments | |
85 | `(#:modules ((guix build gnu-build-system) | |
86 | (guix build utils) | |
41ce4601 MW |
87 | (rnrs io ports) |
88 | (srfi srfi-26) | |
89 | (ice-9 regex)) | |
6e6e2414 AE |
90 | #:phases |
91 | (alist-cons-after | |
92 | 'unpack 'install | |
93 | (lambda _ | |
41ce4601 MW |
94 | (let ((certsdir (string-append %output "/etc/ssl/certs/")) |
95 | (trusted-rx (make-regexp "^# openssl-trust=[a-zA-Z]" | |
96 | regexp/newline))) | |
97 | ||
98 | (define (maybe-install-cert file) | |
99 | (let ((cert (call-with-input-file file get-string-all))) | |
100 | (when (regexp-exec trusted-rx cert) | |
101 | (call-with-output-file | |
102 | (string-append certsdir file) | |
103 | (cut display cert <>))))) | |
104 | ||
6e6e2414 AE |
105 | (mkdir-p certsdir) |
106 | (with-directory-excursion "nss/lib/ckfw/builtins/" | |
107 | ;; extract single certificates from blob | |
108 | (system* "certdata2pem.py" "certdata.txt") | |
41ce4601 MW |
109 | ;; copy selected .pem files into the output |
110 | (for-each maybe-install-cert | |
41ce4601 MW |
111 | (find-files "." ".*\\.pem"))) |
112 | ||
113 | (with-directory-excursion certsdir | |
114 | ;; create symbolic links for and by openssl | |
115 | ;; Strangely, the call (system* "c_rehash" certsdir) | |
116 | ;; from inside the build dir fails with | |
117 | ;; "Usage error; try -help." | |
118 | ;; This looks like a bug in openssl-1.0.2, but we can also | |
119 | ;; switch into the target directory. | |
120 | (system* "c_rehash" ".")))) | |
121 | ||
6e6e2414 | 122 | (map (cut assq <> %standard-phases) |
81f36365 | 123 | '(set-paths install-locale unpack))))) |
6e6e2414 AE |
124 | (synopsis "CA certificates from Mozilla") |
125 | (description | |
126 | "This package provides certificates for Certification Authorities (CA) | |
127 | taken from the NSS package and thus ultimately from the Mozilla project."))) |