gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016, 2017, 2018 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015, 2016, 2017, 2018 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   9 ;;; Copyright © 2016, 2017, 2018 Nils Gillmann <ng0@n0.is>
  10 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017, 2018 Marius Bakke <mbakke@fastmail.com>
  13 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
  14 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
  15 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages tls)
  33   #:use-module ((guix licenses) #:prefix license:)
  34   #:use-module (guix packages)
  35   #:use-module (guix download)
  36   #:use-module (guix utils)
  37   #:use-module (guix build-system gnu)
  38   #:use-module (guix build-system perl)
  39   #:use-module (guix build-system python)
  40   #:use-module (guix build-system cmake)
  41   #:use-module (guix build-system haskell)
  42   #:use-module (guix build-system trivial)
  43   #:use-module (gnu packages compression)
  44   #:use-module (gnu packages)
  45   #:use-module (gnu packages bash)
  46   #:use-module (gnu packages check)
  47   #:use-module (gnu packages curl)
  48   #:use-module (gnu packages dns)
  49   #:use-module (gnu packages gawk)
  50   #:use-module (gnu packages guile)
  51   #:use-module (gnu packages haskell)
  52   #:use-module (gnu packages haskell-check)
  53   #:use-module (gnu packages haskell-crypto)
  54   #:use-module (gnu packages libbsd)
  55   #:use-module (gnu packages libffi)
  56   #:use-module (gnu packages libidn)
  57   #:use-module (gnu packages linux)
  58   #:use-module (gnu packages ncurses)
  59   #:use-module (gnu packages nettle)
  60   #:use-module (gnu packages perl)
  61   #:use-module (gnu packages pkg-config)
  62   #:use-module (gnu packages python)
  63   #:use-module (gnu packages python-crypto)
  64   #:use-module (gnu packages python-web)
  65   #:use-module (gnu packages texinfo)
  66   #:use-module (gnu packages time)
  67   #:use-module (gnu packages base)
  68   #:use-module (srfi srfi-1))
  69
  70 (define-public libtasn1
  71   (package
  72     (name "libtasn1")
  73     (version "4.13")
  74     (source
  75      (origin
  76       (method url-fetch)
  77       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  78                           version ".tar.gz"))
  79       (sha256
  80        (base32
  81         "1jlc1iahj8k3haz28j55nzg7sgni5h41vqy461i1bpbx6668wlky"))))
  82     (build-system gnu-build-system)
  83     (native-inputs `(("perl" ,perl)))
  84     (home-page "https://www.gnu.org/software/libtasn1/")
  85     (synopsis "ASN.1 library")
  86     (description
  87      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  88 for transmitting machine-neutral encodings of data objects in computer
  89 networking, allowing for formal validation of data according to some
  90 specifications.")
  91     (license license:lgpl2.0+)))
  92
  93 (define-public asn1c
  94   (package
  95     (name "asn1c")
  96     (version "0.9.28")
  97     (source (origin
  98       (method url-fetch)
  99       (uri (string-append "https://lionet.info/soft/asn1c-"
 100                           version ".tar.gz"))
 101       (sha256
 102        (base32
 103         "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
 104     (build-system gnu-build-system)
 105     (native-inputs
 106      `(("perl" ,perl)))
 107     (home-page "https://lionet.info/asn1c")
 108     (synopsis "ASN.1 to C compiler")
 109     (description "The ASN.1 to C compiler takes ASN.1 module
 110 files and generates C++ compatible C source code.  That code can be
 111 used to serialize the native C structures into compact and unambiguous
 112 BER/XER/PER-based data files, and deserialize the files back.
 113
 114 Various ASN.1 based formats are widely used in the industry, such as to encode
 115 the X.509 certificates employed in the HTTPS handshake, to exchange control
 116 data between mobile phones and cellular networks, to car-to-car communication
 117 in intelligent transportation networks.")
 118     (license license:bsd-2)))
 119
 120 (define-public p11-kit
 121   (package
 122     (name "p11-kit")
 123     (version "0.23.12")
 124     (source
 125      (origin
 126       (method url-fetch)
 127       (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
 128                           "download/" version "/p11-kit-" version ".tar.gz"))
 129       (sha256
 130        (base32
 131         "00ylbx2gxrm9bv6w4y3qf8z30vpdkqaa8z1y22hy27fv34py5fjq"))))
 132     (build-system gnu-build-system)
 133     (native-inputs
 134      `(("pkg-config" ,pkg-config)))
 135     (inputs
 136      `(("libffi" ,libffi)
 137        ("libtasn1" ,libtasn1)))
 138     (arguments
 139      `(#:configure-flags '("--without-trust-paths")
 140        #:phases (modify-phases %standard-phases
 141                   (add-before 'check 'prepare-tests
 142                     (lambda _
 143                       ;; "test-runtime" expects XDG_RUNTIME_DIR to be set up
 144                       ;; and looks for .cache and other directories (only).
 145                       ;; For simplicity just drop it since it is irrelevant
 146                       ;; in the build container.
 147                       (substitute* "Makefile"
 148                         (("test-runtime\\$\\(EXEEXT\\)") ""))
 149                       #t)))))
 150     (home-page "https://p11-glue.freedesktop.org/p11-kit.html")
 151     (synopsis "PKCS#11 library")
 152     (description
 153      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 154 provides a standard configuration setup for installing PKCS#11 modules
 155 in such a way that they are discoverable.  It also solves problems with
 156 coordinating the use of PKCS#11 by different components or libraries
 157 living in the same process.")
 158     (license license:bsd-3)))
 159
 160 (define-public gnutls
 161   (package
 162     (name "gnutls")
 163     (version "3.5.18")
 164     (source (origin
 165              (method url-fetch)
 166              (uri
 167               ;; Note: Releases are no longer on ftp.gnu.org since the
 168               ;; schism (after version 3.1.5).
 169               (string-append "mirror://gnupg/gnutls/v"
 170                              (version-major+minor version)
 171                              "/gnutls-" version ".tar.xz"))
 172              (patches
 173               (search-patches "gnutls-skip-trust-store-test.patch"
 174                               "gnutls-skip-pkgconfig-test.patch"))
 175              (sha256
 176               (base32
 177                "0d02x28fwkkx7xzn7807nww6idchizzq3plx8sfcyiw7wzclh8mf"))))
 178     (build-system gnu-build-system)
 179     (arguments
 180      `(; Ensure we don't keep a reference to this buggy software.
 181        #:disallowed-references (,net-tools)
 182        #:configure-flags
 183        (list
 184              ;; GnuTLS doesn't consult any environment variables to specify
 185              ;; the location of the system-wide trust store.  Instead it has a
 186              ;; configure-time option.  Unless specified, its configure script
 187              ;; attempts to auto-detect the location by looking for common
 188              ;; places in the file system, none of which are present in our
 189              ;; chroot build environment.  If not found, then no default trust
 190              ;; store is used, so each program has to provide its own
 191              ;; fallback, and users have to configure each program
 192              ;; independently.  This seems suboptimal.
 193              "--with-default-trust-store-dir=/etc/ssl/certs"
 194
 195              ;; FIXME: Temporarily disable p11-kit support since it is not
 196              ;; working on mips64el.
 197              "--without-p11-kit")
 198
 199        #:phases (modify-phases %standard-phases
 200                   (add-after
 201                    'install 'move-doc
 202                    (lambda* (#:key outputs #:allow-other-keys)
 203                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 204                      (let* ((out    (assoc-ref outputs "out"))
 205                             (doc    (assoc-ref outputs "doc"))
 206                             (mandir (string-append doc "/share/man/man3"))
 207                             (oldman (string-append out "/share/man/man3")))
 208                        (mkdir-p mandir)
 209                        (copy-recursively oldman mandir)
 210                        (delete-file-recursively oldman)
 211                        #t))))))
 212     (outputs '("out"                              ;4.4 MiB
 213                "debug"
 214                "doc"))                            ;4.1 MiB of man pages
 215     (native-inputs
 216      `(("net-tools" ,net-tools)
 217        ("pkg-config" ,pkg-config)
 218        ("which" ,which)))
 219     (inputs
 220      `(("guile" ,guile-2.2)))
 221     (propagated-inputs
 222      ;; These are all in the 'Requires.private' field of gnutls.pc.
 223      `(("libtasn1" ,libtasn1)
 224        ("libidn2" ,libidn2)
 225        ("nettle" ,nettle)
 226        ("zlib" ,zlib)))
 227     (home-page "https://www.gnu.org/software/gnutls/")
 228     (synopsis "Transport layer security library")
 229     (description
 230      "GnuTLS is a secure communications library implementing the SSL, TLS
 231 and DTLS protocols.  It is provided in the form of a C library to support the
 232 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 233 required structures.")
 234     (license license:lgpl2.1+)
 235     (properties '((ftp-server . "ftp.gnutls.org")
 236                   (ftp-directory . "/gcrypt/gnutls")))))
 237
 238 (define-public gnutls/guile-2.2
 239   (deprecated-package "guile2.2-gnutls" gnutls))
 240
 241 (define-public gnutls/guile-2.0
 242   ;; GnuTLS for Guile 2.0.
 243   (package
 244     (inherit gnutls)
 245     (name "guile2.0-gnutls")
 246     (inputs `(("guile" ,guile-2.0)
 247               ,@(alist-delete "guile" (package-inputs gnutls))))))
 248
 249 (define-public gnutls/dane
 250   ;; GnuTLS with build libgnutls-dane, implementing DNS-based
 251   ;; Authentication of Named Entities.  This is required for GNS functionality
 252   ;; by GNUnet and gnURL.  This is done in an extra package definition
 253   ;; to have the choice between GnuTLS with Dane and without Dane.
 254   (package
 255     (inherit gnutls)
 256     (name "gnutls-dane")
 257     (inputs `(("unbound" ,unbound)
 258               ,@(package-inputs gnutls)))))
 259
 260 (define-public openssl
 261   (package
 262    (name "openssl")
 263    (replacement openssl/fixed)
 264    (version "1.0.2o")
 265    (source (origin
 266              (method url-fetch)
 267              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 268                                        version ".tar.gz")
 269                         (string-append "ftp://ftp.openssl.org/source/"
 270                                        name "-" version ".tar.gz")
 271                         (string-append "ftp://ftp.openssl.org/source/old/"
 272                                        (string-trim-right version char-set:letter)
 273                                        "/" name "-" version ".tar.gz")))
 274              (sha256
 275               (base32
 276                "0kcy13l701054nhpbd901mz32v1kn4g311z0nifd83xs2jbmqgzc"))
 277              (patches (search-patches "openssl-runpath.patch"
 278                                       "openssl-c-rehash-in.patch"))))
 279    (build-system gnu-build-system)
 280    (outputs '("out"
 281               "doc"                               ;1.5MiB of man3 pages
 282               "static"))                          ;6MiB of .a files
 283    (native-inputs `(("perl" ,perl)))
 284    (arguments
 285     `(#:disallowed-references (,perl)
 286       #:parallel-build? #f
 287       #:parallel-tests? #f
 288       #:test-target "test"
 289
 290       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
 291       ;; so we explicitly disallow it here.
 292       #:disallowed-references ,(list (canonical-package perl))
 293       #:phases
 294       (modify-phases %standard-phases
 295         (add-before
 296          'configure 'patch-Makefile.org
 297          (lambda* (#:key outputs #:allow-other-keys)
 298            ;; The default MANDIR is some unusual place.  Fix that.
 299            (let ((out (assoc-ref outputs "out")))
 300              (patch-makefile-SHELL "Makefile.org")
 301              (substitute* "Makefile.org"
 302                (("^MANDIR[[:blank:]]*=.*$")
 303                 (string-append "MANDIR = " out "/share/man\n")))
 304              #t)))
 305         (replace
 306          'configure
 307          (lambda* (#:key outputs #:allow-other-keys)
 308            (let ((out (assoc-ref outputs "out")))
 309              (invoke "./config"
 310                      "shared"                 ;build shared libraries
 311                      "--libdir=lib"
 312
 313                      ;; The default for this catch-all directory is
 314                      ;; PREFIX/ssl.  Change that to something more
 315                      ;; conventional.
 316                      (string-append "--openssldir=" out
 317                                     "/share/openssl-" ,version)
 318
 319                      (string-append "--prefix=" out)
 320
 321                      ;; XXX FIXME: Work around a code generation bug in GCC
 322                      ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
 323                      ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
 324                      ,@(if (and (not (%current-target-system))
 325                                 (string-prefix? "armhf" (%current-system)))
 326                            '("-mfpu=vfpv3")
 327                            '())))))
 328         (add-after
 329          'install 'make-libraries-writable
 330          (lambda* (#:key outputs #:allow-other-keys)
 331            ;; Make libraries writable so that 'strip' does its job.
 332            (let ((out (assoc-ref outputs "out")))
 333              (for-each (lambda (file)
 334                          (chmod file #o644))
 335                        (find-files (string-append out "/lib")
 336                                    "\\.so"))
 337              #t)))
 338         (add-after 'install 'move-static-libraries
 339           (lambda* (#:key outputs #:allow-other-keys)
 340             ;; Move static libraries to the "static" output.
 341             (let* ((out    (assoc-ref outputs "out"))
 342                    (lib    (string-append out "/lib"))
 343                    (static (assoc-ref outputs "static"))
 344                    (slib   (string-append static "/lib")))
 345               (for-each (lambda (file)
 346                           (install-file file slib)
 347                           (delete-file file))
 348                         (find-files lib "\\.a$"))
 349               #t)))
 350         (add-after 'install 'move-man3-pages
 351           (lambda* (#:key outputs #:allow-other-keys)
 352             ;; Move section 3 man pages to "doc".
 353             (let* ((out    (assoc-ref outputs "out"))
 354                    (man3   (string-append out "/share/man/man3"))
 355                    (doc    (assoc-ref outputs "doc"))
 356                    (target (string-append doc "/share/man/man3")))
 357               (mkdir-p target)
 358               (for-each (lambda (file)
 359                           (rename-file file
 360                                        (string-append target "/"
 361                                                       (basename file))))
 362                         (find-files man3))
 363               (delete-file-recursively man3)
 364               #t)))
 365         (add-before
 366          'patch-source-shebangs 'patch-tests
 367          (lambda* (#:key inputs native-inputs #:allow-other-keys)
 368            (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 369              (substitute* (find-files "test" ".*")
 370                (("/bin/sh")
 371                 (string-append bash "/bin/sh"))
 372                (("/bin/rm")
 373                 "rm"))
 374              #t)))
 375         (add-after
 376          'install 'remove-miscellany
 377          (lambda* (#:key outputs #:allow-other-keys)
 378            ;; The 'misc' directory contains random undocumented shell and Perl
 379            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 380            (let ((out (assoc-ref outputs "out")))
 381              (delete-file-recursively (string-append out "/share/openssl-"
 382                                                      ,version "/misc"))
 383              #t))))))
 384    (native-search-paths
 385     (list (search-path-specification
 386            (variable "SSL_CERT_DIR")
 387            (separator #f)                        ;single entry
 388            (files '("etc/ssl/certs")))
 389           (search-path-specification
 390            (variable "SSL_CERT_FILE")
 391            (file-type 'regular)
 392            (separator #f)                        ;single entry
 393            (files '("etc/ssl/certs/ca-certificates.crt")))))
 394    (synopsis "SSL/TLS implementation")
 395    (description
 396     "OpenSSL is an implementation of SSL/TLS.")
 397    (license license:openssl)
 398    (home-page "https://www.openssl.org/")))
 399
 400 (define openssl/fixed
 401   (package
 402     (inherit openssl)
 403     (source (origin
 404               (inherit (package-source openssl))
 405               (patches (append (origin-patches (package-source openssl))
 406                                (search-patches "openssl-1.0.2-CVE-2018-0495.patch"
 407                                                "openssl-1.0.2-CVE-2018-0732.patch")))))))
 408
 409 (define-public openssl-next
 410   (package
 411     (inherit openssl)
 412     (name "openssl")
 413     (version "1.1.0h")
 414     (source (origin
 415              (method url-fetch)
 416              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 417                                        version ".tar.gz")
 418                         (string-append "ftp://ftp.openssl.org/source/"
 419                                        name "-" version ".tar.gz")
 420                         (string-append "ftp://ftp.openssl.org/source/old/"
 421                                        (string-trim-right version char-set:letter)
 422                                        "/" name "-" version ".tar.gz")))
 423               (patches (search-patches "openssl-1.1.0-c-rehash-in.patch"
 424                                        "openssl-1.1.0-CVE-2018-0495.patch"
 425                                        "openssl-1.1.0-CVE-2018-0732.patch"))
 426               (sha256
 427                (base32
 428                 "05x509lccqjscgyi935z809pwfm708islypwhmjnb6cyvrn64daq"))))
 429     (outputs '("out"
 430                "doc"        ;1.3MiB of man3 pages
 431                "static"))   ; 5.5MiB of .a files
 432     (arguments
 433      (substitute-keyword-arguments (package-arguments openssl)
 434        ((#:phases phases)
 435         `(modify-phases ,phases
 436            (delete 'patch-tests)          ; These two phases are not needed by
 437            (delete 'patch-Makefile.org)   ; OpenSSL 1.1.0.
 438
 439            ;; Override configure phase since -rpath is now a configure option.
 440            (replace 'configure
 441              (lambda* (#:key outputs #:allow-other-keys)
 442                (let* ((out (assoc-ref outputs "out"))
 443                       (lib (string-append out "/lib")))
 444                  (invoke "./config"
 445                          "shared"       ;build shared libraries
 446                          "--libdir=lib"
 447
 448                          ;; The default for this catch-all directory is
 449                          ;; PREFIX/ssl.  Change that to something more
 450                          ;; conventional.
 451                          (string-append "--openssldir=" out
 452                                         "/share/openssl-" ,version)
 453
 454                          (string-append "--prefix=" out)
 455                          (string-append "-Wl,-rpath," lib)
 456
 457                          ;; XXX FIXME: Work around a code generation bug in GCC
 458                          ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
 459                          ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
 460                          ,@(if (and (not (%current-target-system))
 461                                     (string-prefix? "armhf" (%current-system)))
 462                                '("-mfpu=vfpv3")
 463                                '())))))
 464
 465            ;; XXX: Duplicate this phase to make sure 'version' evaluates
 466            ;; in the current scope and not the inherited one.
 467            (replace 'remove-miscellany
 468              (lambda* (#:key outputs #:allow-other-keys)
 469                ;; The 'misc' directory contains random undocumented shell and Perl
 470                ;; scripts.  Remove them to avoid retaining a reference on Perl.
 471                (let ((out (assoc-ref outputs "out")))
 472                  (delete-file-recursively (string-append out "/share/openssl-"
 473                                                          ,version "/misc"))
 474                  #t)))))))))
 475
 476 (define-public libressl
 477   (package
 478     (name "libressl")
 479     (version "2.7.4")
 480     (source (origin
 481               (method url-fetch)
 482               (uri (string-append "mirror://openbsd/LibreSSL/"
 483                                   name "-" version ".tar.gz"))
 484               (sha256
 485                (base32
 486                 "19kxa5i97q7p6rrps9qm0nd8zqhdjvzx02j72400c73cl2nryfhy"))))
 487     (build-system gnu-build-system)
 488     (arguments
 489      ;; Do as if 'getentropy' was missing since older Linux kernels lack it
 490      ;; and libc would return ENOSYS, which is not properly handled.
 491      ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
 492      '(#:configure-flags '("ac_cv_func_getentropy=no"
 493                            ;; Provide a TLS-enabled netcat.
 494                            "--enable-nc")))
 495     (native-search-paths
 496       ;; FIXME: These two variables must designate a single file or directory
 497       ;; and are not actually "search paths."  In practice it works OK in
 498       ;; user profiles because there's always just one item that matches the
 499       ;; specification.
 500      (list (search-path-specification
 501             (variable "SSL_CERT_DIR")
 502             (files '("etc/ssl/certs")))
 503            (search-path-specification
 504             (variable "SSL_CERT_FILE")
 505             (files '("etc/ssl/certs/ca-certificates.crt")))))
 506     (home-page "https://www.libressl.org/")
 507     (synopsis "SSL/TLS implementation")
 508     (description "LibreSSL is a version of the TLS/crypto stack, forked from
 509 OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
 510 and applying best practice development processes.  This package also includes a
 511 netcat implementation that supports TLS.")
 512     ;; Files taken from OpenSSL keep their license, others are under various
 513     ;; non-copyleft licenses.
 514     (license (list license:openssl
 515                    (license:non-copyleft
 516                      "file://COPYING"
 517                      "See COPYING in the distribution.")))))
 518
 519 (define-public python-acme
 520   (package
 521     (name "python-acme")
 522     ;; Remember to update the hash of certbot when updating python-acme.
 523     (version "0.25.1")
 524     (source (origin
 525               (method url-fetch)
 526               (uri (pypi-uri "acme" version))
 527               (sha256
 528                (base32
 529                 "0d177dhy8a7472pz9v4blrlk02d8fp6s52li7z8v3dv97pvz7da7"))))
 530     (build-system python-build-system)
 531     (arguments
 532      `(#:phases
 533        (modify-phases %standard-phases
 534          (add-after 'build 'build-documentation
 535            (lambda _
 536              (zero? (system* "make" "-C" "docs" "man" "info"))))
 537          (add-after 'install 'install-documentation
 538            (lambda* (#:key outputs #:allow-other-keys)
 539              (let* ((out (assoc-ref outputs "out"))
 540                     (man (string-append out "/share/man/man1"))
 541                     (info (string-append out "/info")))
 542                (install-file "docs/_build/texinfo/acme-python.info" info)
 543                (install-file "docs/_build/man/acme-python.1" man)
 544                #t))))))
 545     ;; TODO: Add optional inputs for testing.
 546     (native-inputs
 547      `(("python-mock" ,python-mock)
 548        ("python-pytest" ,python-pytest)
 549        ;; For documentation
 550        ("python-sphinx" ,python-sphinx)
 551        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 552        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 553        ("texinfo" ,texinfo)))
 554     (propagated-inputs
 555      `(("python-josepy" ,python-josepy)
 556        ("python-six" ,python-six)
 557        ("python-requests" ,python-requests)
 558        ("python-requests-toolbelt" ,python-requests-toolbelt)
 559        ("python-pytz" ,python-pytz)
 560        ("python-pyrfc3339" ,python-pyrfc3339)
 561        ("python-pyasn1" ,python-pyasn1)
 562        ("python-cryptography" ,python-cryptography)
 563        ("python-pyopenssl" ,python-pyopenssl)))
 564     (home-page "https://github.com/certbot/certbot")
 565     (synopsis "ACME protocol implementation in Python")
 566     (description "ACME protocol implementation in Python")
 567     (license license:asl2.0)))
 568
 569 (define-public certbot
 570   (package
 571     (name "certbot")
 572     ;; Certbot and python-acme are developed in the same repository, and their
 573     ;; versions should remain synchronized.
 574     (version (package-version python-acme))
 575     (source (origin
 576               (method url-fetch)
 577               (uri (pypi-uri name version))
 578               (sha256
 579                (base32
 580                 "0kp56gwn1bnlrag9qidhm1i5ifdp5z6y1ravh3yimfrkc4cfa8sw"))))
 581     (build-system python-build-system)
 582     (arguments
 583      `(,@(substitute-keyword-arguments (package-arguments python-acme)
 584            ((#:phases phases)
 585             `(modify-phases ,phases
 586               (replace 'install-documentation
 587                 (lambda* (#:key outputs #:allow-other-keys)
 588                   (let* ((out (assoc-ref outputs "out"))
 589                          (man1 (string-append out "/share/man/man1"))
 590                          (man7 (string-append out "/share/man/man7"))
 591                          (info (string-append out "/info")))
 592                     (install-file "docs/_build/texinfo/Certbot.info" info)
 593                     (install-file "docs/_build/man/certbot.1" man1)
 594                     (install-file "docs/_build/man/certbot.7" man7)
 595                     #t))))))))
 596     ;; TODO: Add optional inputs for testing.
 597     (native-inputs
 598      `(("python-nose" ,python-nose)
 599        ("python-mock" ,python-mock)
 600        ;; For documentation
 601        ("python-sphinx" ,python-sphinx)
 602        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 603        ("python-sphinx-repoze-autointerface" ,python-sphinx-repoze-autointerface)
 604        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 605        ("texinfo" ,texinfo)))
 606     (propagated-inputs
 607      `(("python-acme" ,python-acme)
 608        ("python-zope-interface" ,python-zope-interface)
 609        ("python-pyrfc3339" ,python-pyrfc3339)
 610        ("python-pyopenssl" ,python-pyopenssl)
 611        ("python-configobj" ,python-configobj)
 612        ("python-configargparse" ,python-configargparse)
 613        ("python-zope-component" ,python-zope-component)
 614        ("python-parsedatetime" ,python-parsedatetime)
 615        ("python-six" ,python-six)
 616        ("python-psutil" ,python-psutil)
 617        ("python-requests" ,python-requests)
 618        ("python-pytz" ,python-pytz)))
 619     (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
 620     (description "Certbot automatically receives and installs X.509 certificates
 621 to enable Transport Layer Security (TLS) on servers.  It interoperates with the
 622 Let’s Encrypt certificate authority (CA), which issues browser-trusted
 623 certificates for free.")
 624     (home-page "https://certbot.eff.org/")
 625     (license license:asl2.0)))
 626
 627 (define-public letsencrypt
 628   (package (inherit certbot)
 629     (name "letsencrypt")
 630     (properties `((superseded . ,certbot)))))
 631
 632 (define-public perl-net-ssleay
 633   (package
 634     (name "perl-net-ssleay")
 635     (version "1.85")
 636     (source (origin
 637               (method url-fetch)
 638               (uri (string-append "mirror://cpan/authors/id/M/MI/MIKEM/"
 639                                   "Net-SSLeay-" version ".tar.gz"))
 640               (sha256
 641                (base32
 642                 "1j5h4ycm8538397l204d2d5fkm9595aj174pj7bkpbhwzfwqi0cx"))))
 643     (build-system perl-build-system)
 644     (inputs `(("openssl" ,openssl)))
 645     (arguments
 646      `(#:phases
 647        (modify-phases %standard-phases
 648          (add-before
 649           'configure 'set-ssl-prefix
 650           (lambda* (#:key inputs #:allow-other-keys)
 651             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 652             #t)))))
 653     (synopsis "Perl extension for using OpenSSL")
 654     (description
 655      "This module offers some high level convenience functions for accessing
 656 web pages on SSL servers (for symmetry, the same API is offered for accessing
 657 http servers, too), an sslcat() function for writing your own clients, and
 658 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 659 servers or clients for more complicated applications.")
 660     (license license:perl-license)
 661     (home-page "http://search.cpan.org/~mikem/Net-SSLeay-1.66/")))
 662
 663 (define-public perl-crypt-openssl-rsa
 664  (package
 665   (name "perl-crypt-openssl-rsa")
 666   (version "0.30")
 667   (source
 668     (origin
 669       (method url-fetch)
 670       (uri (string-append
 671              "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
 672              version
 673              ".tar.gz"))
 674       (sha256
 675         (base32
 676           "1b19kaaw4wda8dy6kjiwqa2prpbs2dqcyjyj9zdh5wbs74qkbq93"))))
 677   (build-system perl-build-system)
 678   (native-inputs
 679    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 680   (inputs
 681     `(("perl-crypt-openssl-bignum" ,perl-crypt-openssl-bignum)
 682       ("perl-crypt-openssl-random" ,perl-crypt-openssl-random)
 683       ("openssl" ,openssl)))
 684   (arguments perl-crypt-arguments)
 685   (home-page
 686     "http://search.cpan.org/dist/Crypt-OpenSSL-RSA")
 687   (synopsis
 688     "RSA encoding and decoding, using the openSSL libraries")
 689   (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
 690 OpenSSL libraries).")
 691   (license license:perl-license)))
 692
 693 (define perl-crypt-arguments
 694    `(#:phases (modify-phases %standard-phases
 695       (add-before 'configure 'patch-Makefile.PL
 696         (lambda* (#:key inputs #:allow-other-keys)
 697           (substitute* "Makefile.PL"
 698             (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
 699                                              (assoc-ref inputs "openssl")
 700                                              "/lib -lcrypto'],")))
 701           #t)))))
 702
 703 (define-public perl-crypt-openssl-bignum
 704  (package
 705   (name "perl-crypt-openssl-bignum")
 706   (version "0.09")
 707   (source
 708     (origin
 709       (method url-fetch)
 710       (uri (string-append
 711              "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
 712              version
 713              ".tar.gz"))
 714       (sha256
 715         (base32
 716           "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
 717   (build-system perl-build-system)
 718   (inputs `(("openssl" ,openssl)))
 719   (arguments perl-crypt-arguments)
 720   (home-page
 721     "http://search.cpan.org/dist/Crypt-OpenSSL-Bignum")
 722   (synopsis
 723     "OpenSSL's multiprecision integer arithmetic in Perl")
 724   (description "Crypt::OpenSSL::Bignum provides multiprecision integer
 725 arithmetic in Perl.")
 726   ;; At your option either gpl1+ or the Artistic License
 727   (license license:perl-license)))
 728
 729 (define-public perl-crypt-openssl-guess
 730   (package
 731     (name "perl-crypt-openssl-guess")
 732     (version "0.11")
 733     (source
 734      (origin
 735        (method url-fetch)
 736        (uri (string-append
 737              "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
 738              version ".tar.gz"))
 739        (sha256
 740         (base32
 741          "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
 742     (build-system perl-build-system)
 743     (home-page "http://search.cpan.org/dist/Crypt-OpenSSL-Guess/")
 744     (synopsis "Guess the OpenSSL include path")
 745     (description
 746      "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
 747 correct OpenSSL include path.  It is intended for use in your
 748 @file{Makefile.PL}.")
 749     (license license:perl-license)))
 750
 751 (define-public perl-crypt-openssl-random
 752  (package
 753   (name "perl-crypt-openssl-random")
 754   (version "0.13")
 755   (source
 756     (origin
 757       (method url-fetch)
 758       (uri (string-append
 759              "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
 760              version
 761              ".tar.gz"))
 762       (sha256
 763         (base32
 764           "0vmvrb3shrzjzri3qn524dzdasbq8zhhbpc1vmq8sx68n4jhizb0"))))
 765   (build-system perl-build-system)
 766   (native-inputs
 767    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 768   (inputs
 769    `(("openssl" ,openssl)))
 770   (arguments perl-crypt-arguments)
 771   (home-page
 772     "http://search.cpan.org/dist/Crypt-OpenSSL-Random")
 773   (synopsis
 774     "OpenSSL/LibreSSL pseudo-random number generator access")
 775   (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
 776 number generator")
 777   (license license:perl-license)))
 778
 779 (define-public acme-client
 780   (package
 781     (name "acme-client")
 782     (version "0.1.16")
 783     (source (origin
 784               (method url-fetch)
 785               (uri (string-append "https://kristaps.bsd.lv/" name "/"
 786                                   "snapshots/" name "-portable-"
 787                                   version ".tgz"))
 788               (sha256
 789                (base32
 790                 "00q05b3b1dfnfp7sr1nbd212n0mqrycl3cr9lbs51m7ncaihbrz9"))))
 791     (build-system gnu-build-system)
 792     (arguments
 793      '(#:tests? #f ; no test suite
 794        #:make-flags
 795        (list "CC=gcc"
 796              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 797        #:phases
 798        (modify-phases %standard-phases
 799          (add-after 'unpack 'patch-paths
 800            (lambda* (#:key inputs #:allow-other-keys)
 801              (let ((pem (string-append (assoc-ref inputs "libressl")
 802                                        "/etc/ssl/cert.pem")))
 803                (substitute* "http.c"
 804                  (("/etc/ssl/cert.pem") pem))
 805                #t)))
 806          (delete 'configure)))) ; no './configure' script
 807     (native-inputs
 808      `(("pkg-config" ,pkg-config)))
 809     (inputs
 810      `(("libbsd" ,libbsd)
 811        ("libressl" ,libressl)))
 812     (synopsis "Let's Encrypt client by the OpenBSD project")
 813     (description "acme-client is a Let's Encrypt client implemented in C.  It
 814 uses a modular design, and attempts to secure itself by dropping privileges and
 815 operating in a chroot where possible.  acme-client is developed on OpenBSD and
 816 then ported to the GNU / Linux environment.")
 817     (home-page "https://kristaps.bsd.lv/acme-client/")
 818     ;; acme-client is distributed under the ISC license, but the files 'jsmn.h'
 819     ;; and 'jsmn.c' are distributed under the Expat license.
 820     (license (list license:isc license:expat))))
 821
 822 ;; The "-apache" variant is the upstreamed prefered variant. A "-gpl"
 823 ;; variant exists in addition to the "-apache" one.
 824 (define-public mbedtls-apache
 825   (package
 826     (name "mbedtls-apache")
 827     (version "2.7.4")
 828     (source
 829      (origin
 830        (method url-fetch)
 831        ;; XXX: The download links on the website are script redirection links
 832        ;; which effectively lead to the format listed in the uri here.
 833        (uri (string-append "https://tls.mbed.org/download/mbedtls-"
 834                            version "-apache.tgz"))
 835        (sha256
 836         (base32
 837          "1x9qia3rd77brz6qiv46w3ham2q78shn2rsz1jbpgqq0jpa69q9l"))))
 838     (build-system cmake-build-system)
 839     (arguments
 840      `(#:configure-flags
 841        (list "-DUSE_SHARED_MBEDTLS_LIBRARY=ON")))
 842     (native-inputs
 843      `(("perl" ,perl)))
 844     (synopsis "Small TLS library")
 845     (description
 846      "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
 847 for developers to include cryptographic and SSL/TLS capabilities in their
 848 (embedded) products, facilitating this functionality with a minimal
 849 coding footprint.")
 850     (home-page "https://tls.mbed.org")
 851     (license license:asl2.0)))
 852
 853 (define-public ghc-tls
 854   (package
 855     (name "ghc-tls")
 856     (version "1.3.8")
 857     (source (origin
 858               (method url-fetch)
 859               (uri (string-append "https://hackage.haskell.org/package/"
 860                                   "tls/tls-" version ".tar.gz"))
 861               (sha256
 862                (base32
 863                 "1rdidf18i781c0vdvy9yn79yh08hmcacf6fp3sgghyiy3h0wyh5l"))))
 864     (build-system haskell-build-system)
 865     (inputs
 866      `(("ghc-mtl" ,ghc-mtl)
 867        ("ghc-cereal" ,ghc-cereal)
 868        ("ghc-data-default-class" ,ghc-data-default-class)
 869        ("ghc-memory" ,ghc-memory)
 870        ("ghc-cryptonite" ,ghc-cryptonite)
 871        ("ghc-asn1-types" ,ghc-asn1-types)
 872        ("ghc-asn1-encoding" ,ghc-asn1-encoding)
 873        ("ghc-x509" ,ghc-x509)
 874        ("ghc-x509-store" ,ghc-x509-store)
 875        ("ghc-x509-validation" ,ghc-x509-validation)
 876        ("ghc-async" ,ghc-async)
 877        ("ghc-network" ,ghc-network)
 878        ("ghc-hourglass" ,ghc-hourglass)))
 879     (native-inputs
 880      `(("ghc-tasty" ,ghc-tasty)
 881        ("ghc-tasty-quickcheck" ,ghc-tasty-quickcheck)
 882        ("ghc-quickcheck" ,ghc-quickcheck)))
 883     (home-page "https://github.com/vincenthz/hs-tls")
 884     (synopsis
 885      "TLS/SSL protocol native implementation (Server and Client)")
 886     (description
 887      "Native Haskell TLS and SSL protocol implementation for server and client.
 888 This provides a high-level implementation of a sensitive security protocol,
 889 eliminating a common set of security issues through the use of the advanced
 890 type system, high level constructions and common Haskell features.  Currently
 891 implement the SSL3.0, TLS1.0, TLS1.1 and TLS1.2 protocol, and support RSA and
 892 Ephemeral (Elliptic curve and regular) Diffie Hellman key exchanges, and many
 893 extensions.")
 894     (license license:bsd-3)))
 895
 896 (define-public dehydrated
 897   (package
 898     (name "dehydrated")
 899     (version "0.6.2")
 900     (source (origin
 901               (method url-fetch/tarbomb)
 902               (uri (string-append
 903                     "https://github.com/lukas2511/dehydrated/archive/v"
 904                     version ".tar.gz"))
 905               (sha256
 906                (base32
 907                 "03p80yj6bnzjc6dkp5hb9wpplmlrla8n5src71cnzw4rj53q8cqn"))
 908               (file-name (string-append name "-" version ".tar.gz"))))
 909     (build-system trivial-build-system)
 910     (arguments
 911      `(#:modules ((guix build utils))
 912        #:builder
 913        (begin
 914          (use-modules (guix build utils))
 915          (let* ((source (assoc-ref %build-inputs "source"))
 916                 (out (assoc-ref %outputs "out"))
 917                 (bin (string-append out "/bin"))
 918                 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
 919            (mkdir-p bin)
 920            (with-directory-excursion bin
 921              (copy-file
 922               (in-vicinity source (string-append "/dehydrated-" ,version
 923                                                  "/dehydrated"))
 924               (in-vicinity bin "dehydrated"))
 925              (patch-shebang "dehydrated" (list bash))
 926
 927              ;; Do not try to write in the store.
 928              (substitute* "dehydrated"
 929                (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
 930
 931              (setenv "PATH" bash)
 932              (wrap-program "dehydrated"
 933                `("PATH" ":" prefix
 934                  ,(map (lambda (dir)
 935                          (string-append dir "/bin"))
 936                        (map (lambda (input)
 937                               (assoc-ref %build-inputs input))
 938                             '("coreutils"
 939                               "curl"
 940                               "diffutils"
 941                               "gawk"
 942                               "grep"
 943                               "openssl"
 944                               "sed"))))))
 945            #t))))
 946     (inputs
 947      `(("bash" ,bash)
 948        ("coreutils" ,coreutils)
 949        ("curl" ,curl)
 950        ("diffutils" ,diffutils)
 951        ("gawk" ,gawk)
 952        ("grep" ,grep)
 953        ("openssl" ,openssl)
 954        ("sed" ,sed)))
 955     (home-page "https://dehydrated.io/")
 956     (synopsis "Let's Encrypt/ACME client implemented as a shell script")
 957     (description "Dehydrated is a client for signing certificates with an
 958 ACME-server (currently only provided by Let's Encrypt) implemented as a
 959 relatively simple Bash script.")
 960     (license license:expat)))