gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
   9 ;;;
  10 ;;; This file is part of GNU Guix.
  11 ;;;
  12 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  13 ;;; under the terms of the GNU General Public License as published by
  14 ;;; the Free Software Foundation; either version 3 of the License, or (at
  15 ;;; your option) any later version.
  16 ;;;
  17 ;;; GNU Guix is distributed in the hope that it will be useful, but
  18 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  19 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20 ;;; GNU General Public License for more details.
  21 ;;;
  22 ;;; You should have received a copy of the GNU General Public License
  23 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  24
  25 (define-module (gnu packages tls)
  26   #:use-module ((guix licenses) #:prefix license:)
  27   #:use-module (guix packages)
  28   #:use-module (guix download)
  29   #:use-module (guix utils)
  30   #:use-module (guix build-system gnu)
  31   #:use-module (guix build-system perl)
  32   #:use-module (guix build-system python)
  33   #:use-module (gnu packages compression)
  34   #:use-module (gnu packages)
  35   #:use-module (gnu packages guile)
  36   #:use-module (gnu packages libffi)
  37   #:use-module (gnu packages libidn)
  38   #:use-module (gnu packages ncurses)
  39   #:use-module (gnu packages nettle)
  40   #:use-module (gnu packages perl)
  41   #:use-module (gnu packages pkg-config)
  42   #:use-module (gnu packages python)
  43   #:use-module (gnu packages texinfo)
  44   #:use-module (gnu packages base))
  45
  46 (define-public libtasn1
  47   (package
  48     (name "libtasn1")
  49     (version "4.7")
  50     (source
  51      (origin
  52       (method url-fetch)
  53       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  54                           version ".tar.gz"))
  55       (sha256
  56        (base32
  57         "1j8iixynchziw1y39lnibyl5h81m4p78w3i4f28q2vgwjgf801x4"))))
  58     (build-system gnu-build-system)
  59     (native-inputs `(("perl" ,perl)))
  60     (home-page "http://www.gnu.org/software/libtasn1/")
  61     (synopsis "ASN.1 library")
  62     (description
  63      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  64 for transmitting machine-neutral encodings of data objects in computer
  65 networking, allowing for formal validation of data according to some
  66 specifications.")
  67     (license license:lgpl2.0+)))
  68
  69 (define-public p11-kit
  70   (package
  71     (name "p11-kit")
  72     (version "0.23.1")
  73     (source
  74      (origin
  75       (method url-fetch)
  76       (uri (string-append "https://p11-glue.freedesktop.org/releases/p11-kit-"
  77                           version ".tar.gz"))
  78       (sha256
  79        (base32
  80         "1i3a1wdpagm0p3y1bwaz5x5rjhcpqbcrnhkcp10p259vkxk72wz5"))
  81       (modules '((guix build utils))) ; for substitute*
  82       (snippet
  83         '(begin
  84            ;; Drop one test that fails, also when trying to compile manually.
  85            ;; Reported upstream at
  86            ;; https://bugs.freedesktop.org/show_bug.cgi?id=89027
  87            (substitute* "Makefile.in"
  88              (("test-module\\$\\(EXEEXT\\) ") ""))))))
  89     (build-system gnu-build-system)
  90     (native-inputs
  91      `(("pkg-config" ,pkg-config)))
  92     (inputs
  93      `(("libffi" ,libffi)
  94        ("libtasn1" ,libtasn1)))
  95     (arguments
  96      `(#:configure-flags '("--without-trust-paths")))
  97     (home-page "http://p11-glue.freedesktop.org/p11-kit.html")
  98     (synopsis "PKCS#11 library")
  99     (description
 100      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 101 provides a standard configuration setup for installing PKCS#11 modules
 102 in such a way that they are discoverable.  It also solves problems with
 103 coordinating the use of PKCS#11 by different components or libraries
 104 living in the same process.")
 105     (license license:bsd-3)))
 106
 107 (define-public gnutls
 108   (package
 109     (name "gnutls")
 110     (version "3.4.7")
 111     (source (origin
 112              (method url-fetch)
 113              (uri
 114               ;; Note: Releases are no longer on ftp.gnu.org since the
 115               ;; schism (after version 3.1.5).
 116               (string-append "mirror://gnupg/gnutls/v"
 117                              (version-major+minor version)
 118                              "/gnutls-" version ".tar.xz"))
 119              (sha256
 120               (base32
 121                "0nifi3mr5jhz608pidkp8cjs4vwfj1m2qczsjrgpnp99615rxgn1"))))
 122     (build-system gnu-build-system)
 123     (arguments
 124      '(#:configure-flags
 125        (list (string-append "--with-guile-site-dir="
 126                             (assoc-ref %outputs "out")
 127                             "/share/guile/site/2.0")
 128              ;; GnuTLS doesn't consult any environment variables to specify
 129              ;; the location of the system-wide trust store.  Instead it has a
 130              ;; configure-time option.  Unless specified, its configure script
 131              ;; attempts to auto-detect the location by looking for common
 132              ;; places in the filesystem, none of which are present in our
 133              ;; chroot build environment.  If not found, then no default trust
 134              ;; store is used, so each program has to provide its own
 135              ;; fallback, and users have to configure each program
 136              ;; independently.  This seems suboptimal.
 137              "--with-default-trust-store-dir=/etc/ssl/certs"
 138
 139              ;; FIXME: Temporarily disable p11-kit support since it is not
 140              ;; working on mips64el.
 141              "--without-p11-kit")
 142
 143        #:phases (modify-phases %standard-phases
 144                   (add-after
 145                    'install 'move-doc
 146                    (lambda* (#:key outputs #:allow-other-keys)
 147                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 148                      (let* ((out    (assoc-ref outputs "out"))
 149                             (doc    (assoc-ref outputs "doc"))
 150                             (mandir (string-append doc "/share/man/man3"))
 151                             (oldman (string-append out "/share/man/man3")))
 152                        (mkdir-p mandir)
 153                        (copy-recursively oldman mandir)
 154                        (delete-file-recursively oldman)
 155                        #t))))))
 156     (outputs '("out"                              ;4.4 MiB
 157                "debug"
 158                "doc"))                            ;4.1 MiB of man pages
 159     (native-inputs
 160      `(("pkg-config" ,pkg-config)
 161        ("which" ,which)))
 162     (inputs
 163      `(("guile" ,guile-2.0)
 164        ("perl" ,perl)))
 165     (propagated-inputs
 166      ;; These are all in the 'Requires.private' field of gnutls.pc.
 167      `(("libtasn1" ,libtasn1)
 168        ("libidn" ,libidn)
 169        ("nettle" ,nettle)
 170        ("zlib" ,zlib)))
 171     (home-page "http://www.gnu.org/software/gnutls/")
 172     (synopsis "Transport layer security library")
 173     (description
 174      "GnuTLS is a secure communications library implementing the SSL, TLS
 175 and DTLS protocols.  It is provided in the form of a C library to support the
 176 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 177 required structures.")
 178     (license license:lgpl2.1+)))
 179
 180 (define-public openssl
 181   (package
 182    (replacement openssl-1.0.2g)
 183    (name "openssl")
 184    (version "1.0.2f")
 185    (source (origin
 186             (method url-fetch)
 187             (uri (list (string-append "ftp://ftp.openssl.org/source/"
 188                                       name "-" version ".tar.gz")
 189                        (string-append "ftp://ftp.openssl.org/source/old/"
 190                                       (string-trim-right version char-set:letter)
 191                                       "/" name "-" version ".tar.gz")))
 192             (sha256
 193              (base32
 194               "171fkdg9v6j29d962nh6kb79kfm8kkhy7n9makw39d7jvvj4wawk"))
 195             (patches (map search-patch
 196                           '("openssl-runpath.patch"
 197                             "openssl-c-rehash.patch")))))
 198    (build-system gnu-build-system)
 199    (native-inputs `(("perl" ,perl)))
 200    (arguments
 201     `(#:parallel-build? #f
 202       #:parallel-tests? #f
 203       #:test-target "test"
 204       #:phases
 205       (modify-phases %standard-phases
 206         (add-before
 207          'configure 'patch-Makefile.org
 208          (lambda* (#:key outputs #:allow-other-keys)
 209            ;; The default MANDIR is some unusual place.  Fix that.
 210            (let ((out (assoc-ref outputs "out")))
 211              (patch-makefile-SHELL "Makefile.org")
 212              (substitute* "Makefile.org"
 213                (("^MANDIR[[:blank:]]*=.*$")
 214                 (string-append "MANDIR = " out "/share/man\n")))
 215              #t)))
 216         (replace
 217          'configure
 218          (lambda* (#:key outputs #:allow-other-keys)
 219            (let ((out (assoc-ref outputs "out")))
 220              (zero?
 221               (system* "./config"
 222                        "shared"                   ;build shared libraries
 223                        "--libdir=lib"
 224
 225                        ;; The default for this catch-all directory is
 226                        ;; PREFIX/ssl.  Change that to something more
 227                        ;; conventional.
 228                        (string-append "--openssldir=" out
 229                                       "/share/openssl-" ,version)
 230
 231                        (string-append "--prefix=" out)
 232
 233                        ;; XXX FIXME: Work around a code generation bug in GCC
 234                        ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
 235                        ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
 236                        ,@(if (and (not (%current-target-system))
 237                                   (string-prefix? "armhf" (%current-system)))
 238                              '("-mfpu=vfpv3")
 239                              '()))))))
 240         (add-after
 241          'install 'make-libraries-writable
 242          (lambda* (#:key outputs #:allow-other-keys)
 243            ;; Make libraries writable so that 'strip' does its job.
 244            (let ((out (assoc-ref outputs "out")))
 245              (for-each (lambda (file)
 246                          (chmod file #o644))
 247                        (find-files (string-append out "/lib")
 248                                    "\\.so"))
 249              #t)))
 250         (add-before
 251          'patch-source-shebangs 'patch-tests
 252          (lambda* (#:key inputs native-inputs #:allow-other-keys)
 253            (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 254              (substitute* (find-files "test" ".*")
 255                (("/bin/sh")
 256                 (string-append bash "/bin/bash"))
 257                (("/bin/rm")
 258                 "rm"))
 259              #t)))
 260         (add-after
 261          'install 'remove-miscellany
 262          (lambda* (#:key outputs #:allow-other-keys)
 263            ;; The 'misc' directory contains random undocumented shell and Perl
 264            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 265            (let ((out (assoc-ref outputs "out")))
 266              (delete-file-recursively (string-append out "/share/openssl-"
 267                                                      ,version "/misc"))
 268              #t))))))
 269    (native-search-paths
 270     ;; FIXME: These two variables must designate a single file or directory
 271     ;; and are not actually "search paths."  In practice it works OK in user
 272     ;; profiles because there's always just one item that matches the
 273     ;; specification.
 274     (list (search-path-specification
 275            (variable "SSL_CERT_DIR")
 276            (files '("etc/ssl/certs")))
 277           (search-path-specification
 278            (variable "SSL_CERT_FILE")
 279            (files '("etc/ssl/certs/ca-certificates.crt")))))
 280    (synopsis "SSL/TLS implementation")
 281    (description
 282     "OpenSSL is an implementation of SSL/TLS.")
 283    (license license:openssl)
 284    (home-page "http://www.openssl.org/")))
 285
 286 (define openssl-1.0.2g
 287   (package
 288     (inherit openssl)
 289     (replacement #f)
 290     (source
 291      (let ((name "openssl") (version "1.0.2g"))
 292        (origin
 293          (method url-fetch)
 294          (uri (list (string-append "ftp://ftp.openssl.org/source/"
 295                                    name "-" version ".tar.gz")
 296                     (string-append "ftp://ftp.openssl.org/source/old/"
 297                                    (string-trim-right version char-set:letter)
 298                                    "/" name "-" version ".tar.gz")))
 299          (sha256
 300           (base32
 301            "0cxajjayi859czi545ddafi24m9nwsnjsw4q82zrmqvwj2rv315p"))
 302          (patches (map search-patch
 303                        '("openssl-runpath.patch"
 304                          "openssl-c-rehash-in.patch"))))))
 305     (arguments
 306      (substitute-keyword-arguments (package-arguments openssl)
 307        ((#:phases phases)
 308         `(modify-phases ,phases
 309            (replace 'configure
 310              (lambda* (#:key outputs #:allow-other-keys)
 311                (let ((out (assoc-ref outputs "out")))
 312                  (zero?
 313                   (system*
 314                    "./config"
 315
 316                    ;; XXX TEMPORARY, FOR GRAFTING ONLY
 317                    ;;     Enable ssl2 code to preserve
 318                    ;;     ABI compatibility with 1.0.2f
 319                    "enable-ssl2"
 320
 321                    "shared"             ;build shared libraries
 322                    "--libdir=lib"
 323
 324                    ;; The default for this catch-all directory is
 325                    ;; PREFIX/ssl.  Change that to something more
 326                    ;; conventional.
 327                    (string-append "--openssldir=" out
 328                                   "/share/openssl-" ,(package-version openssl))
 329
 330                    (string-append "--prefix=" out)
 331
 332                    ;; XXX FIXME: Work around a code generation bug in GCC
 333                    ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
 334                    ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
 335                    ,@(if (and (not (%current-target-system))
 336                               (string-prefix? "armhf" (%current-system)))
 337                          '("-mfpu=vfpv3")
 338                          '()))))))))))))
 339
 340 (define-public libressl
 341   (package
 342     (name "libressl")
 343     (version "2.2.6")
 344     (source
 345      (origin
 346       (method url-fetch)
 347       (uri (string-append
 348              "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-"
 349              version ".tar.gz"))
 350       (sha256 (base32
 351                "0kynb15l5gq1qgp3p4ncn20sc65sbl8lk89vyr07s17xrya9kq8y"))))
 352     (build-system gnu-build-system)
 353     (native-search-paths
 354       ;; FIXME: These two variables must designate a single file or directory
 355       ;; and are not actually "search paths."  In practice it works OK in
 356       ;; user profiles because there's always just one item that matches the
 357       ;; specification.
 358      (list (search-path-specification
 359             (variable "SSL_CERT_DIR")
 360             (files '("etc/ssl/certs")))
 361            (search-path-specification
 362             (variable "SSL_CERT_FILE")
 363             (files '("etc/ssl/certs/ca-certificates.crt")))))
 364     (home-page "http://www.libressl.org/")
 365     (synopsis "SSL/TLS implementation")
 366     (description "LibreSSL is a version of the TLS/crypto stack forked
 367 from OpenSSL in 2014, with the goals of modernizing the codebase, improving
 368 security, and applying best practice development processes.")
 369     ;; Files taken from OpenSSL keep their license, others are under various
 370     ;; non-copyleft licenses.
 371     (license (list license:openssl
 372                    (license:non-copyleft
 373                      "file://COPYING"
 374                      "See COPYING in the distribution.")))))
 375
 376 (define-public python-acme
 377   (package
 378     (name "python-acme")
 379     (version "0.4.2")
 380     (source (origin
 381       (method url-fetch)
 382       (uri (pypi-uri "acme" version))
 383       (sha256
 384         (base32
 385          "1dh0qlsi309b37wa0nw0h2gvs94yk12lc4mhr3rb9c4h46m0hn8a"))))
 386     (build-system python-build-system)
 387     (arguments
 388      `(#:phases
 389        (modify-phases %standard-phases
 390          (add-before 'install 'disable-egg-compression
 391            (lambda _
 392              ;; Do not compress the egg.
 393              ;; See <http://bugs.gnu.org/20765>.
 394              (let ((port (open-file "setup.cfg" "a")))
 395                (display "\n[easy_install]\nzip_ok = 0\n"
 396                         port)
 397                (close-port port)
 398                #t)))
 399          (add-after 'install 'docs
 400            (lambda* (#:key outputs #:allow-other-keys)
 401              (let* ((out (assoc-ref outputs "out"))
 402                     (man (string-append out "/share/man/man1"))
 403                     (info (string-append out "/info")))
 404                (and (zero? (system* "make" "-C" "docs" "man" "info"))
 405                     (install-file "docs/_build/texinfo/acme-python.info" info)
 406                     (install-file "docs/_build/man/acme-python.1" man)
 407                     #t)))))))
 408     ;; TODO: Add optional inputs for testing.
 409     (native-inputs
 410      `(("python-mock" ,python-mock)
 411        ;; For documentation
 412        ("python-sphinx" ,python-sphinx)
 413        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 414        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 415        ("python-setuptools" ,python-setuptools)
 416        ("texinfo" ,texinfo)))
 417     (propagated-inputs
 418      `(("python-ndg-httpsclient" ,python-ndg-httpsclient)
 419        ("python-werkzeug" ,python-werkzeug)
 420        ("python-six" ,python-six)
 421        ("python-requests" ,python-requests)
 422        ("python-pytz" ,python-pytz)
 423        ("python-pyrfc3339" ,python-pyrfc3339)
 424        ("python-pyasn1" ,python-pyasn1)
 425        ("python-cryptography" ,python-cryptography)
 426        ("python-pyopenssl" ,python-pyopenssl)))
 427     (home-page "https://github.com/letsencrypt/letsencrypt")
 428     (synopsis "ACME protocol implementation in Python")
 429     (description "ACME protocol implementation in Python")
 430     (license license:asl2.0)))
 431
 432 (define-public python2-acme
 433   (package-with-python2 python-acme))
 434
 435 (define-public letsencrypt
 436   (package
 437     (name "letsencrypt")
 438     (version "0.4.2")
 439     (source (origin
 440               (method url-fetch)
 441               (uri (pypi-uri "letsencrypt" version))
 442               (sha256
 443                (base32
 444                 "1rjbblj60w7jwc5y04sy6fbxcynvakvazikg1pdmhyic5jmj9bg3"))))
 445     (build-system python-build-system)
 446     (arguments
 447      `(#:python ,python-2
 448        #:phases
 449        (modify-phases %standard-phases
 450          (add-after 'install 'docs
 451            (lambda* (#:key outputs #:allow-other-keys)
 452              (let* ((out (assoc-ref outputs "out"))
 453                     (man1 (string-append out "/share/man/man1"))
 454                     (man7 (string-append out "/share/man/man7"))
 455                     (info (string-append out "/info")))
 456                (substitute* "docs/man/letsencrypt.rst"
 457                  (("letsencrypt --help all")
 458                   (string-append out "/bin/letsencrypt" " --help all")))
 459                (and
 460                  (zero? (system* "make" "-C" "docs" "man" "info"))
 461                  (install-file "docs/_build/texinfo/LetsEncrypt.info" info)
 462                  (install-file "docs/_build/man/letsencrypt.1" man1)
 463                  (install-file "docs/_build/man/letsencrypt.7" man7)
 464                  #t)))))))
 465     ;; TODO: Add optional inputs for testing.
 466     (native-inputs
 467      `(("python2-nose" ,python2-nose)
 468        ("python2-mock" ,python2-mock)
 469        ;; For documentation
 470        ("python2-sphinx" ,python2-sphinx)
 471        ("python2-sphinx-rtd-theme" ,python2-sphinx-rtd-theme)
 472        ("python2-sphinx-repoze-autointerface" ,python2-sphinx-repoze-autointerface)
 473        ("python2-sphinxcontrib-programoutput" ,python2-sphinxcontrib-programoutput)
 474        ("texinfo" ,texinfo)))
 475     (propagated-inputs
 476      `(("python2-acme" ,python2-acme)
 477        ("python2-zope-interface" ,python2-zope-interface)
 478        ("python2-pythondialog" ,python2-pythondialog)
 479        ("python2-pyrfc3339" ,python2-pyrfc3339)
 480        ("python2-pyopenssl" ,python2-pyopenssl)
 481        ("python2-configobj" ,python2-configobj)
 482        ("python2-configargparse" ,python2-configargparse)
 483        ("python2-zope-component" ,python2-zope-component)
 484        ("python2-parsedatetime" ,python2-parsedatetime)
 485        ("python2-six" ,python2-six)
 486        ("python2-psutil" ,python2-psutil)
 487        ("python2-requests" ,python2-requests)
 488        ("python2-pytz" ,python2-pytz)))
 489     (synopsis "Let's Encrypt client")
 490     (description "Tool to automatically receive and install X.509 certificates
 491 to enable TLS on servers.  The client will interoperate with the Let’s Encrypt CA which
 492 will be issuing browser-trusted certificates for free.")
 493     (home-page "https://letsencrypt.org/")
 494     (license license:asl2.0)))
 495
 496 (define-public perl-net-ssleay
 497   (package
 498     (name "perl-net-ssleay")
 499     (version "1.68")
 500     (source (origin
 501               (method url-fetch)
 502               (uri (string-append "mirror://cpan/authors/id/M/MI/MIKEM/"
 503                                   "Net-SSLeay-" version ".tar.gz"))
 504               (sha256
 505                (base32
 506                 "1m2wwzhjwsg0drlhp9w12fl6bsgj69v8gdz72jqrqll3qr7f408p"))))
 507     (build-system perl-build-system)
 508     (native-inputs
 509      `(("patch" ,patch)
 510        ("patch/disable-ede-test"
 511         ,(search-patch "perl-net-ssleay-disable-ede-test.patch"))))
 512     (inputs `(("openssl" ,openssl)))
 513     (arguments
 514      `(#:phases
 515        (modify-phases %standard-phases
 516          (add-after
 517           'unpack 'apply-patch
 518           (lambda* (#:key inputs #:allow-other-keys)
 519             ;; XXX We apply this patch here instead of in the 'origin' because
 520             ;; this package's build system fails badly when the source file
 521             ;; times are zeroed.
 522             ;; XXX Try removing this patch for perl-net-ssleay > 1.68
 523             (zero? (system* "patch" "--force" "-p1" "-i"
 524                             (assoc-ref inputs "patch/disable-ede-test")))))
 525          (add-before
 526           'configure 'set-ssl-prefix
 527           (lambda* (#:key inputs #:allow-other-keys)
 528             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 529             #t)))))
 530     (synopsis "Perl extension for using OpenSSL")
 531     (description
 532      "This module offers some high level convenience functions for accessing
 533 web pages on SSL servers (for symmetry, the same API is offered for accessing
 534 http servers, too), an sslcat() function for writing your own clients, and
 535 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 536 servers or clients for more complicated applications.")
 537     (license (package-license perl))
 538     (home-page "http://search.cpan.org/~mikem/Net-SSLeay-1.66/")))