gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016, 2017, 2018 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015, 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016, 2017, 2019 Efraim Flashner <efraim@flashner.co.il>
   9 ;;; Copyright © 2016, 2017, 2018 ng0 <ng0@n0.is>
  10 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017, 2018, 2019 Marius Bakke <mbakke@fastmail.com>
  13 ;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
  14 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
  15 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages tls)
  33   #:use-module ((guix licenses) #:prefix license:)
  34   #:use-module (guix packages)
  35   #:use-module (guix download)
  36   #:use-module (guix git-download)
  37   #:use-module (guix utils)
  38   #:use-module (guix build-system gnu)
  39   #:use-module (guix build-system go)
  40   #:use-module (guix build-system perl)
  41   #:use-module (guix build-system python)
  42   #:use-module (guix build-system cmake)
  43   #:use-module (guix build-system trivial)
  44   #:use-module (gnu packages compression)
  45   #:use-module (gnu packages)
  46   #:use-module (gnu packages bash)
  47   #:use-module (gnu packages check)
  48   #:use-module (gnu packages curl)
  49   #:use-module (gnu packages dns)
  50   #:use-module (gnu packages gawk)
  51   #:use-module (gnu packages guile)
  52   #:use-module (gnu packages libbsd)
  53   #:use-module (gnu packages libffi)
  54   #:use-module (gnu packages libidn)
  55   #:use-module (gnu packages linux)
  56   #:use-module (gnu packages ncurses)
  57   #:use-module (gnu packages nettle)
  58   #:use-module (gnu packages perl)
  59   #:use-module (gnu packages pkg-config)
  60   #:use-module (gnu packages python)
  61   #:use-module (gnu packages python-crypto)
  62   #:use-module (gnu packages python-web)
  63   #:use-module (gnu packages python-xyz)
  64   #:use-module (gnu packages sphinx)
  65   #:use-module (gnu packages texinfo)
  66   #:use-module (gnu packages time)
  67   #:use-module (gnu packages base)
  68   #:use-module (srfi srfi-1))
  69
  70 (define-public libtasn1
  71   (package
  72     (name "libtasn1")
  73     (version "4.14")
  74     (source
  75      (origin
  76       (method url-fetch)
  77       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  78                           version ".tar.gz"))
  79       (sha256
  80        (base32
  81         "025sqnlzji78ss2fi78dajc0v0h5fi02wp39hws41sn8qnjlnq4y"))))
  82     (build-system gnu-build-system)
  83     (arguments
  84      `(#:configure-flags '("--disable-static")))
  85     (native-inputs `(("perl" ,perl)))
  86     (home-page "https://www.gnu.org/software/libtasn1/")
  87     (synopsis "ASN.1 library")
  88     (description
  89      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  90 for transmitting machine-neutral encodings of data objects in computer
  91 networking, allowing for formal validation of data according to some
  92 specifications.")
  93     (license license:lgpl2.0+)))
  94
  95 (define-public asn1c
  96   (package
  97     (name "asn1c")
  98     (version "0.9.28")
  99     (source (origin
 100       (method url-fetch)
 101       (uri (string-append "https://lionet.info/soft/asn1c-"
 102                           version ".tar.gz"))
 103       (sha256
 104        (base32
 105         "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
 106     (build-system gnu-build-system)
 107     (native-inputs
 108      `(("perl" ,perl)))
 109     (home-page "https://lionet.info/asn1c")
 110     (synopsis "ASN.1 to C compiler")
 111     (description "The ASN.1 to C compiler takes ASN.1 module
 112 files and generates C++ compatible C source code.  That code can be
 113 used to serialize the native C structures into compact and unambiguous
 114 BER/XER/PER-based data files, and deserialize the files back.
 115
 116 Various ASN.1 based formats are widely used in the industry, such as to encode
 117 the X.509 certificates employed in the HTTPS handshake, to exchange control
 118 data between mobile phones and cellular networks, to car-to-car communication
 119 in intelligent transportation networks.")
 120     (license license:bsd-2)))
 121
 122 (define-public p11-kit
 123   (package
 124     (name "p11-kit")
 125     (version "0.23.18.1")
 126     (source
 127      (origin
 128       (method url-fetch)
 129       (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
 130                           "download/" version "/p11-kit-" version ".tar.gz"))
 131       (sha256
 132        (base32
 133         "0vrwab1082f7l5sbzpb28nrs3q4d2q7wzbi8c977rpah026bvhrl"))))
 134     (build-system gnu-build-system)
 135     (native-inputs
 136      `(("pkg-config" ,pkg-config)))
 137     (inputs
 138      `(("libffi" ,libffi)
 139        ("libtasn1" ,libtasn1)))
 140     (arguments
 141      `(#:configure-flags '("--without-trust-paths")
 142        #:phases (modify-phases %standard-phases
 143                   (add-before 'check 'prepare-tests
 144                     (lambda _
 145                       ;; "test-runtime" expects XDG_RUNTIME_DIR to be set up
 146                       ;; and looks for .cache and other directories (only).
 147                       ;; For simplicity just drop it since it is irrelevant
 148                       ;; in the build container.
 149                       (substitute* "Makefile"
 150                         (("test-runtime\\$\\(EXEEXT\\)") ""))
 151                       #t)))))
 152     (home-page "https://p11-glue.freedesktop.org/p11-kit.html")
 153     (synopsis "PKCS#11 library")
 154     (description
 155      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 156 provides a standard configuration setup for installing PKCS#11 modules
 157 in such a way that they are discoverable.  It also solves problems with
 158 coordinating the use of PKCS#11 by different components or libraries
 159 living in the same process.")
 160     (license license:bsd-3)))
 161
 162 (define-public gnutls
 163   (package
 164     (name "gnutls")
 165     (version "3.6.9")
 166     (source (origin
 167              (method url-fetch)
 168              (uri
 169               ;; Note: Releases are no longer on ftp.gnu.org since the
 170               ;; schism (after version 3.1.5).
 171               (string-append "mirror://gnupg/gnutls/v"
 172                              (version-major+minor version)
 173                              "/gnutls-" version ".tar.xz"))
 174              (patches (search-patches "gnutls-skip-trust-store-test.patch"))
 175              (sha256
 176               (base32
 177                "1jqz5s3lv8sa53348cfi9nr5pw5l55n8m40b8msdvv0pb2jzqca3"))))
 178     (build-system gnu-build-system)
 179     (arguments
 180      `(; Ensure we don't keep a reference to this buggy software.
 181        #:disallowed-references (,net-tools)
 182        #:configure-flags
 183        (list
 184              ;; GnuTLS doesn't consult any environment variables to specify
 185              ;; the location of the system-wide trust store.  Instead it has a
 186              ;; configure-time option.  Unless specified, its configure script
 187              ;; attempts to auto-detect the location by looking for common
 188              ;; places in the file system, none of which are present in our
 189              ;; chroot build environment.  If not found, then no default trust
 190              ;; store is used, so each program has to provide its own
 191              ;; fallback, and users have to configure each program
 192              ;; independently.  This seems suboptimal.
 193              "--with-default-trust-store-dir=/etc/ssl/certs"
 194
 195              ;; Tell the build system that we want Guile bindings installed to
 196              ;; the output instead of Guiles own module directory.
 197              (string-append "--with-guile-site-dir="
 198                             "$(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)")
 199              (string-append "--with-guile-site-ccache-dir="
 200                             "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache")
 201              (string-append "--with-guile-extension-dir="
 202                             "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/extensions")
 203
 204              ;; FIXME: Temporarily disable p11-kit support since it is not
 205              ;; working on mips64el.
 206              "--without-p11-kit")
 207
 208        #:phases (modify-phases %standard-phases
 209                   (add-after
 210                    'install 'move-doc
 211                    (lambda* (#:key outputs #:allow-other-keys)
 212                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 213                      (let* ((out    (assoc-ref outputs "out"))
 214                             (doc    (assoc-ref outputs "doc"))
 215                             (mandir (string-append doc "/share/man/man3"))
 216                             (oldman (string-append out "/share/man/man3")))
 217                        (mkdir-p mandir)
 218                        (copy-recursively oldman mandir)
 219                        (delete-file-recursively oldman)
 220                        #t))))))
 221     (outputs '("out"                              ;4.4 MiB
 222                "debug"
 223                "doc"))                            ;4.1 MiB of man pages
 224     (native-inputs
 225      `(("net-tools" ,net-tools)
 226        ("pkg-config" ,pkg-config)
 227        ("which" ,which)))
 228     (inputs
 229      `(("guile" ,guile-2.2)))
 230     (propagated-inputs
 231      ;; These are all in the 'Requires.private' field of gnutls.pc.
 232      `(("libtasn1" ,libtasn1)
 233        ("libidn2" ,libidn2)
 234        ("nettle" ,nettle)
 235        ("zlib" ,zlib)))
 236     (home-page "https://www.gnu.org/software/gnutls/")
 237     (synopsis "Transport layer security library")
 238     (description
 239      "GnuTLS is a secure communications library implementing the SSL, TLS
 240 and DTLS protocols.  It is provided in the form of a C library to support the
 241 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 242 required structures.")
 243     (license license:lgpl2.1+)
 244     (properties '((ftp-server . "ftp.gnutls.org")
 245                   (ftp-directory . "/gcrypt/gnutls")))))
 246
 247 (define-public gnutls/guile-2.0
 248   ;; GnuTLS for Guile 2.0.
 249   (package
 250     (inherit gnutls)
 251     (name "guile2.0-gnutls")
 252     (inputs `(("guile" ,guile-2.0)
 253               ,@(alist-delete "guile" (package-inputs gnutls))))))
 254
 255 (define-public gnutls/dane
 256   ;; GnuTLS with build libgnutls-dane, implementing DNS-based
 257   ;; Authentication of Named Entities.  This is required for GNS functionality
 258   ;; by GNUnet and gnURL.  This is done in an extra package definition
 259   ;; to have the choice between GnuTLS with Dane and without Dane.
 260   (package
 261     (inherit gnutls)
 262     (name "gnutls-dane")
 263     (inputs `(("unbound" ,unbound)
 264               ,@(package-inputs gnutls)))))
 265
 266 (define gnutls-3.6.10
 267   ;; This is for 'guile3.0-gnutls', below.  Version 3.6.10 is the first to
 268   ;; introduce Guile 2.9/3.0 support.
 269   (package
 270     (inherit gnutls)
 271     (version "3.6.10")
 272     (source (origin
 273               (inherit (package-source gnutls))
 274               (uri (string-append "mirror://gnupg/gnutls/v"
 275                                   (version-major+minor version)
 276                                   "/gnutls-" version ".tar.xz"))
 277               (sha256
 278                (base32
 279                 "14r2h73yfj66cm14k9mnb3kgzq5a7qjg5b31m53bf19vcxkwmwxi"))))))
 280
 281 (define-public guile3.0-gnutls
 282   (package
 283     (inherit gnutls-3.6.10)
 284     (name "guile3.0-gnutls")
 285     (arguments
 286      (substitute-keyword-arguments (package-arguments gnutls-3.6.10)
 287        ((#:phases phases '%standard-phases)
 288         `(modify-phases ,phases
 289            (add-before 'build 'leave-guile-stdout-open
 290              (lambda _
 291                ;; Work around <https://bugs.gnu.org/38348>.
 292                (substitute* "guile/Makefile"
 293                  (("out=-") "out=/dev/null"))
 294                #t))))))
 295     (inputs `(("guile" ,guile-next)
 296               ,@(alist-delete "guile"
 297                               (package-inputs gnutls-3.6.10))))))
 298
 299 (define-public openssl
 300   (package
 301    (name "openssl")
 302    (version "1.1.1c")
 303    (replacement openssl-1.1.1d)
 304    (source (origin
 305              (method url-fetch)
 306              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 307                                        version ".tar.gz")
 308                         (string-append "ftp://ftp.openssl.org/source/"
 309                                        "openssl-" version ".tar.gz")
 310                         (string-append "ftp://ftp.openssl.org/source/old/"
 311                                        (string-trim-right version char-set:letter)
 312                                        "/openssl-" version ".tar.gz")))
 313              (sha256
 314               (base32
 315                "142c7zdlz06hjrrvinb9f276czc78bnkyhd9xma621qmmmwk1yzn"))
 316              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))))
 317    (build-system gnu-build-system)
 318    (outputs '("out"
 319               "doc"         ;6.8 MiB of man3 pages and full HTML documentation
 320               "static"))    ;6.4 MiB of .a files
 321    (native-inputs `(("perl" ,perl)))
 322    (arguments
 323     `(#:disallowed-references (,perl)
 324       #:parallel-build? #f
 325       #:parallel-tests? #f
 326       #:test-target "test"
 327
 328       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
 329       ;; so we explicitly disallow it here.
 330       #:disallowed-references ,(list (canonical-package perl))
 331       #:phases
 332       (modify-phases %standard-phases
 333         (replace 'configure
 334           (lambda* (#:key outputs #:allow-other-keys)
 335             (let* ((out (assoc-ref outputs "out"))
 336                    (lib (string-append out "/lib")))
 337               ;; It's not a shebang so patch-source-shebangs misses it.
 338               (substitute* "config"
 339                 (("/usr/bin/env")
 340                  (string-append (assoc-ref %build-inputs "coreutils")
 341                                 "/bin/env")))
 342               (invoke "./config"
 343                       "shared"       ;build shared libraries
 344                       "--libdir=lib"
 345
 346                       ;; The default for this catch-all directory is
 347                       ;; PREFIX/ssl.  Change that to something more
 348                       ;; conventional.
 349                       (string-append "--openssldir=" out
 350                                      "/share/openssl-" ,version)
 351
 352                       (string-append "--prefix=" out)
 353                       (string-append "-Wl,-rpath," lib)))))
 354         (add-after 'install 'move-static-libraries
 355           (lambda* (#:key outputs #:allow-other-keys)
 356             ;; Move static libraries to the "static" output.
 357             (let* ((out    (assoc-ref outputs "out"))
 358                    (lib    (string-append out "/lib"))
 359                    (static (assoc-ref outputs "static"))
 360                    (slib   (string-append static "/lib")))
 361               (for-each (lambda (file)
 362                           (install-file file slib)
 363                           (delete-file file))
 364                         (find-files lib "\\.a$"))
 365               #t)))
 366         (add-after 'install 'move-extra-documentation
 367           (lambda* (#:key outputs #:allow-other-keys)
 368                ;; Move man3 pages and full HTML documentation to "doc".
 369                (let* ((out    (assoc-ref outputs "out"))
 370                       (man3   (string-append out "/share/man/man3"))
 371                       (html (string-append out "/share/doc/openssl"))
 372                       (doc    (assoc-ref outputs "doc"))
 373                       (man-target (string-append doc "/share/man/man3"))
 374                       (html-target (string-append doc "/share/doc/openssl")))
 375                  (copy-recursively man3 man-target)
 376                  (delete-file-recursively man3)
 377                  (copy-recursively html html-target)
 378                  (delete-file-recursively html)
 379                  #t)))
 380         (add-after
 381          'install 'remove-miscellany
 382          (lambda* (#:key outputs #:allow-other-keys)
 383            ;; The 'misc' directory contains random undocumented shell and Perl
 384            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 385            (let ((out (assoc-ref outputs "out")))
 386              (delete-file-recursively (string-append out "/share/openssl-"
 387                                                      ,version "/misc"))
 388              #t))))))
 389    (native-search-paths
 390     (list (search-path-specification
 391            (variable "SSL_CERT_DIR")
 392            (separator #f)                        ;single entry
 393            (files '("etc/ssl/certs")))
 394           (search-path-specification
 395            (variable "SSL_CERT_FILE")
 396            (file-type 'regular)
 397            (separator #f)                        ;single entry
 398            (files '("etc/ssl/certs/ca-certificates.crt")))))
 399    (synopsis "SSL/TLS implementation")
 400    (description
 401     "OpenSSL is an implementation of SSL/TLS.")
 402    (license license:openssl)
 403    (home-page "https://www.openssl.org/")))
 404
 405 (define openssl-1.1.1d
 406   (package/inherit
 407    openssl
 408    (version "1.1.1d")
 409    (source (origin
 410              (method url-fetch)
 411              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 412                                        version ".tar.gz")
 413                         (string-append "ftp://ftp.openssl.org/source/"
 414                                        "openssl-" version ".tar.gz")
 415                         (string-append "ftp://ftp.openssl.org/source/old/"
 416                                        (string-trim-right version char-set:letter)
 417                                        "/openssl-" version ".tar.gz")))
 418              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
 419              (sha256
 420               (base32
 421                "1whinyw402z3b9xlb3qaxv4b9sk4w1bgh9k0y8df1z4x3yy92fhy"))))))
 422
 423 (define-public openssl-1.0
 424   (package
 425     (inherit openssl)
 426     (name "openssl")
 427     (version "1.0.2t")
 428     (source (origin
 429               (method url-fetch)
 430               (uri (list (string-append "https://www.openssl.org/source/openssl-"
 431                                         version ".tar.gz")
 432                          (string-append "ftp://ftp.openssl.org/source/"
 433                                         "openssl-" version ".tar.gz")
 434                          (string-append "ftp://ftp.openssl.org/source/old/"
 435                                         (string-trim-right version char-set:letter)
 436                                         "/openssl-" version ".tar.gz")))
 437               (sha256
 438                (base32
 439                 "1g67ra0ph7gpz6fgvv1i96d792jmd6ymci5kk53vbikszr74djql"))
 440               (patches (search-patches "openssl-runpath.patch"
 441                                        "openssl-c-rehash-in.patch"))))
 442     (outputs '("out"
 443                "doc"                    ;1.5MiB of man3 pages
 444                "static"))               ;6MiB of .a files
 445     (arguments
 446      (substitute-keyword-arguments (package-arguments openssl)
 447        ;; Parallel build is not supported in 1.0.x.
 448        ((#:parallel-build? _ #f) #f)
 449        ((#:phases phases)
 450         `(modify-phases ,phases
 451            (add-before 'patch-source-shebangs 'patch-tests
 452              (lambda* (#:key inputs native-inputs #:allow-other-keys)
 453                (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 454                  (substitute* (find-files "test" ".*")
 455                    (("/bin/sh")
 456                     (string-append bash "/bin/sh"))
 457                    (("/bin/rm")
 458                     "rm"))
 459                  #t)))
 460            (add-before 'configure 'patch-Makefile.org
 461              (lambda* (#:key outputs #:allow-other-keys)
 462                ;; The default MANDIR is some unusual place.  Fix that.
 463                (let ((out (assoc-ref outputs "out")))
 464                  (patch-makefile-SHELL "Makefile.org")
 465                  (substitute* "Makefile.org"
 466                    (("^MANDIR[[:blank:]]*=.*$")
 467                     (string-append "MANDIR = " out "/share/man\n")))
 468                  #t)))
 469         (replace 'configure
 470           ;; Override this phase because OpenSSL 1.0 does not understand -rpath.
 471           (lambda* (#:key outputs #:allow-other-keys)
 472             (let ((out (assoc-ref outputs "out")))
 473               (invoke "./config"
 474                       "shared"                 ;build shared libraries
 475                       "--libdir=lib"
 476
 477                       ;; The default for this catch-all directory is
 478                       ;; PREFIX/ssl.  Change that to something more
 479                       ;; conventional.
 480                       (string-append "--openssldir=" out
 481                                      "/share/openssl-" ,version)
 482
 483                       (string-append "--prefix=" out)))))
 484         (delete 'move-extra-documentation)
 485         (add-after 'install 'move-man3-pages
 486           (lambda* (#:key outputs #:allow-other-keys)
 487             ;; Move section 3 man pages to "doc".
 488             (let* ((out    (assoc-ref outputs "out"))
 489                    (man3   (string-append out "/share/man/man3"))
 490                    (doc    (assoc-ref outputs "doc"))
 491                    (target (string-append doc "/share/man/man3")))
 492               (mkdir-p target)
 493               (for-each (lambda (file)
 494                           (rename-file file
 495                                        (string-append target "/"
 496                                                       (basename file))))
 497                         (find-files man3))
 498               (delete-file-recursively man3)
 499               #t)))
 500            ;; XXX: Duplicate this phase to make sure 'version' evaluates
 501            ;; in the current scope and not the inherited one.
 502            (replace 'remove-miscellany
 503              (lambda* (#:key outputs #:allow-other-keys)
 504                ;; The 'misc' directory contains random undocumented shell and Perl
 505                ;; scripts.  Remove them to avoid retaining a reference on Perl.
 506                (let ((out (assoc-ref outputs "out")))
 507                  (delete-file-recursively (string-append out "/share/openssl-"
 508                                                          ,version "/misc"))
 509                  #t)))))))))
 510
 511 (define-public libressl
 512   (package
 513     (name "libressl")
 514     (version "2.7.4")
 515     (source (origin
 516               (method url-fetch)
 517               (uri (string-append "mirror://openbsd/LibreSSL/"
 518                                   "libressl-" version ".tar.gz"))
 519               (sha256
 520                (base32
 521                 "19kxa5i97q7p6rrps9qm0nd8zqhdjvzx02j72400c73cl2nryfhy"))))
 522     (build-system gnu-build-system)
 523     (arguments
 524      ;; Do as if 'getentropy' was missing since older Linux kernels lack it
 525      ;; and libc would return ENOSYS, which is not properly handled.
 526      ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
 527      '(#:configure-flags '("ac_cv_func_getentropy=no"
 528                            ;; Provide a TLS-enabled netcat.
 529                            "--enable-nc")))
 530     (native-search-paths
 531      (list (search-path-specification
 532             (variable "SSL_CERT_DIR")
 533             (separator #f)              ;single entry
 534             (files '("etc/ssl/certs")))
 535            (search-path-specification
 536             (variable "SSL_CERT_FILE")
 537             (separator #f)              ;single entry
 538             (files '("etc/ssl/certs/ca-certificates.crt")))))
 539     (home-page "https://www.libressl.org/")
 540     (synopsis "SSL/TLS implementation")
 541     (description "LibreSSL is a version of the TLS/crypto stack, forked from
 542 OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
 543 and applying best practice development processes.  This package also includes a
 544 netcat implementation that supports TLS.")
 545     ;; Files taken from OpenSSL keep their license, others are under various
 546     ;; non-copyleft licenses.
 547     (license (list license:openssl
 548                    (license:non-copyleft
 549                      "file://COPYING"
 550                      "See COPYING in the distribution.")))))
 551
 552 (define-public python-acme
 553   (package
 554     (name "python-acme")
 555     ;; Remember to update the hash of certbot when updating python-acme.
 556     (version "1.0.0")
 557     (source (origin
 558               (method url-fetch)
 559               (uri (pypi-uri "acme" version))
 560               (sha256
 561                (base32
 562                 "1hl62dnh8zsipa5azzpy5kwgjgb5vflinhna1fsn7rcchhpz223a"))))
 563     (build-system python-build-system)
 564     (arguments
 565      `(#:phases
 566        (modify-phases %standard-phases
 567          (add-after 'build 'build-documentation
 568            (lambda _
 569              (invoke "make" "-C" "docs" "man" "info")))
 570          (add-after 'install 'install-documentation
 571            (lambda* (#:key outputs #:allow-other-keys)
 572              (let* ((out (assoc-ref outputs "out"))
 573                     (man (string-append out "/share/man/man1"))
 574                     (info (string-append out "/info")))
 575                (install-file "docs/_build/texinfo/acme-python.info" info)
 576                (install-file "docs/_build/man/acme-python.1" man)
 577                #t))))))
 578     ;; TODO: Add optional inputs for testing.
 579     (native-inputs
 580      `(("python-mock" ,python-mock)
 581        ("python-pytest" ,python-pytest)
 582        ;; For documentation
 583        ("python-sphinx" ,python-sphinx)
 584        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 585        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 586        ("texinfo" ,texinfo)))
 587     (propagated-inputs
 588      `(("python-josepy" ,python-josepy)
 589        ("python-six" ,python-six)
 590        ("python-requests" ,python-requests)
 591        ("python-requests-toolbelt" ,python-requests-toolbelt)
 592        ("python-pytz" ,python-pytz)
 593        ("python-pyrfc3339" ,python-pyrfc3339)
 594        ("python-pyasn1" ,python-pyasn1)
 595        ("python-cryptography" ,python-cryptography)
 596        ("python-pyopenssl" ,python-pyopenssl)))
 597     (home-page "https://github.com/certbot/certbot")
 598     (synopsis "ACME protocol implementation in Python")
 599     (description "ACME protocol implementation in Python")
 600     (license license:asl2.0)))
 601
 602 (define-public certbot
 603   (package
 604     (name "certbot")
 605     ;; Certbot and python-acme are developed in the same repository, and their
 606     ;; versions should remain synchronized.
 607     (version (package-version python-acme))
 608     (source (origin
 609               (method url-fetch)
 610               (uri (pypi-uri "certbot" version))
 611               (sha256
 612                (base32
 613                 "0aih7sir5byy8ah9lrgzwcaga7hjw98qj8bb1pxzzzqrvcqjvf46"))))
 614     (build-system python-build-system)
 615     (arguments
 616      `(,@(substitute-keyword-arguments (package-arguments python-acme)
 617            ((#:phases phases)
 618             `(modify-phases ,phases
 619               (replace 'install-documentation
 620                 (lambda* (#:key outputs #:allow-other-keys)
 621                   (let* ((out (assoc-ref outputs "out"))
 622                          (man1 (string-append out "/share/man/man1"))
 623                          (man7 (string-append out "/share/man/man7"))
 624                          (info (string-append out "/info")))
 625                     (install-file "docs/_build/texinfo/Certbot.info" info)
 626                     (install-file "docs/_build/man/certbot.1" man1)
 627                     (install-file "docs/_build/man/certbot.7" man7)
 628                     #t))))))))
 629     ;; TODO: Add optional inputs for testing.
 630     (native-inputs
 631      `(("python-mock" ,python-mock)
 632        ("python-pytest" ,python-pytest)
 633        ;; For documentation
 634        ("python-sphinx" ,python-sphinx)
 635        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 636        ("python-sphinx-repoze-autointerface" ,python-sphinx-repoze-autointerface)
 637        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 638        ("texinfo" ,texinfo)))
 639     (propagated-inputs
 640      `(("python-acme" ,python-acme)
 641        ("python-cryptography" ,python-cryptography)
 642        ("python-zope-interface" ,python-zope-interface)
 643        ("python-pyrfc3339" ,python-pyrfc3339)
 644        ("python-pyopenssl" ,python-pyopenssl)
 645        ("python-configobj" ,python-configobj)
 646        ("python-configargparse" ,python-configargparse)
 647        ("python-distro" ,python-distro)
 648        ("python-zope-component" ,python-zope-component)
 649        ("python-parsedatetime" ,python-parsedatetime)
 650        ("python-six" ,python-six)
 651        ("python-psutil" ,python-psutil)
 652        ("python-requests" ,python-requests)
 653        ("python-pytz" ,python-pytz)))
 654     (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
 655     (description "Certbot automatically receives and installs X.509 certificates
 656 to enable Transport Layer Security (TLS) on servers.  It interoperates with the
 657 Let’s Encrypt certificate authority (CA), which issues browser-trusted
 658 certificates for free.")
 659     (home-page "https://certbot.eff.org/")
 660     (license license:asl2.0)))
 661
 662 (define-public letsencrypt
 663   (package (inherit certbot)
 664     (name "letsencrypt")
 665     (properties `((superseded . ,certbot)))))
 666
 667 (define-public perl-net-ssleay
 668   (package
 669     (name "perl-net-ssleay")
 670     (version "1.88")
 671     (source (origin
 672               (method url-fetch)
 673               (uri (string-append "mirror://cpan/authors/id/C/CH/CHRISN/"
 674                                   "Net-SSLeay-" version ".tar.gz"))
 675               (sha256
 676                (base32
 677                 "1pfgh4h3szcpvqlcimc60pjbk9zwls99x5863sva0wc47i4dl010"))))
 678     (build-system perl-build-system)
 679     (inputs `(("openssl" ,openssl)))
 680     (arguments
 681      `(#:phases
 682        (modify-phases %standard-phases
 683          (add-before
 684           'configure 'set-ssl-prefix
 685           (lambda* (#:key inputs #:allow-other-keys)
 686             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 687             #t)))))
 688     (synopsis "Perl extension for using OpenSSL")
 689     (description
 690      "This module offers some high level convenience functions for accessing
 691 web pages on SSL servers (for symmetry, the same API is offered for accessing
 692 http servers, too), an sslcat() function for writing your own clients, and
 693 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 694 servers or clients for more complicated applications.")
 695     (license license:perl-license)
 696     (home-page "https://metacpan.org/release/Net-SSLeay")))
 697
 698 (define-public perl-crypt-openssl-rsa
 699  (package
 700   (name "perl-crypt-openssl-rsa")
 701   (version "0.31")
 702   (source
 703     (origin
 704       (method url-fetch)
 705       (uri (string-append
 706              "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
 707              version
 708              ".tar.gz"))
 709       (sha256
 710         (base32
 711           "0djl5i6kibl7862b6ih29q8dhg5zpwzq77q9j8hp6xngshx40ws1"))))
 712   (build-system perl-build-system)
 713   (native-inputs
 714    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 715   (inputs
 716     `(("perl-crypt-openssl-bignum" ,perl-crypt-openssl-bignum)
 717       ("perl-crypt-openssl-random" ,perl-crypt-openssl-random)
 718       ("openssl" ,openssl)))
 719   (arguments perl-crypt-arguments)
 720   (home-page
 721     "https://metacpan.org/release/Crypt-OpenSSL-RSA")
 722   (synopsis
 723     "RSA encoding and decoding, using the openSSL libraries")
 724   (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
 725 OpenSSL libraries).")
 726   (license license:perl-license)))
 727
 728 (define perl-crypt-arguments
 729    `(#:phases (modify-phases %standard-phases
 730       (add-before 'configure 'patch-Makefile.PL
 731         (lambda* (#:key inputs #:allow-other-keys)
 732           (substitute* "Makefile.PL"
 733             (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
 734                                              (assoc-ref inputs "openssl")
 735                                              "/lib -lcrypto'],")))
 736           #t)))))
 737
 738 (define-public perl-crypt-openssl-bignum
 739  (package
 740   (name "perl-crypt-openssl-bignum")
 741   (version "0.09")
 742   (source
 743     (origin
 744       (method url-fetch)
 745       (uri (string-append
 746              "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
 747              version
 748              ".tar.gz"))
 749       (sha256
 750         (base32
 751           "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
 752   (build-system perl-build-system)
 753   (inputs `(("openssl" ,openssl)))
 754   (arguments perl-crypt-arguments)
 755   (home-page
 756     "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
 757   (synopsis
 758     "OpenSSL's multiprecision integer arithmetic in Perl")
 759   (description "Crypt::OpenSSL::Bignum provides multiprecision integer
 760 arithmetic in Perl.")
 761   ;; At your option either gpl1+ or the Artistic License
 762   (license license:perl-license)))
 763
 764 (define-public perl-crypt-openssl-guess
 765   (package
 766     (name "perl-crypt-openssl-guess")
 767     (version "0.11")
 768     (source
 769      (origin
 770        (method url-fetch)
 771        (uri (string-append
 772              "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
 773              version ".tar.gz"))
 774        (sha256
 775         (base32
 776          "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
 777     (build-system perl-build-system)
 778     (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
 779     (synopsis "Guess the OpenSSL include path")
 780     (description
 781      "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
 782 correct OpenSSL include path.  It is intended for use in your
 783 @file{Makefile.PL}.")
 784     (license license:perl-license)))
 785
 786 (define-public perl-crypt-openssl-random
 787  (package
 788   (name "perl-crypt-openssl-random")
 789   (version "0.15")
 790   (source
 791     (origin
 792       (method url-fetch)
 793       (uri (string-append
 794              "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
 795              version
 796              ".tar.gz"))
 797       (sha256
 798         (base32 "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh"))))
 799   (build-system perl-build-system)
 800   (native-inputs
 801    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 802   (inputs
 803    `(("openssl" ,openssl)))
 804   (arguments perl-crypt-arguments)
 805   (home-page
 806     "https://metacpan.org/release/Crypt-OpenSSL-Random")
 807   (synopsis
 808     "OpenSSL/LibreSSL pseudo-random number generator access")
 809   (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
 810 number generator")
 811   (license license:perl-license)))
 812
 813 (define-public acme-client
 814   (package
 815     (name "acme-client")
 816     (version "0.1.16")
 817     (source (origin
 818               (method url-fetch)
 819               (uri (string-append "https://kristaps.bsd.lv/" name "/"
 820                                   "snapshots/" name "-portable-"
 821                                   version ".tgz"))
 822               (sha256
 823                (base32
 824                 "00q05b3b1dfnfp7sr1nbd212n0mqrycl3cr9lbs51m7ncaihbrz9"))))
 825     (build-system gnu-build-system)
 826     (arguments
 827      '(#:tests? #f ; no test suite
 828        #:make-flags
 829        (list "CC=gcc"
 830              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 831        #:phases
 832        (modify-phases %standard-phases
 833          (add-after 'unpack 'patch-paths
 834            (lambda* (#:key inputs #:allow-other-keys)
 835              (let ((pem (string-append (assoc-ref inputs "libressl")
 836                                        "/etc/ssl/cert.pem")))
 837                (substitute* "http.c"
 838                  (("/etc/ssl/cert.pem") pem))
 839                #t)))
 840          (delete 'configure)))) ; no './configure' script
 841     (native-inputs
 842      `(("pkg-config" ,pkg-config)))
 843     (inputs
 844      `(("libbsd" ,libbsd)
 845        ("libressl" ,libressl)))
 846     (synopsis "Let's Encrypt client by the OpenBSD project")
 847     (description "acme-client is a Let's Encrypt client implemented in C.  It
 848 uses a modular design, and attempts to secure itself by dropping privileges and
 849 operating in a chroot where possible.  acme-client is developed on OpenBSD and
 850 then ported to the GNU / Linux environment.")
 851     (home-page "https://kristaps.bsd.lv/acme-client/")
 852     ;; acme-client is distributed under the ISC license, but the files 'jsmn.h'
 853     ;; and 'jsmn.c' are distributed under the Expat license.
 854     (license (list license:isc license:expat))))
 855
 856 ;; The "-apache" variant is the upstreamed prefered variant. A "-gpl"
 857 ;; variant exists in addition to the "-apache" one.
 858 (define-public mbedtls-apache
 859   (package
 860     (name "mbedtls-apache")
 861     (version "2.16.3")
 862     (source
 863      (origin
 864        (method url-fetch)
 865        ;; XXX: The download links on the website are script redirection links
 866        ;; which effectively lead to the format listed in the uri here.
 867        (uri (string-append "https://tls.mbed.org/download/mbedtls-"
 868                            version "-apache.tgz"))
 869        (sha256
 870         (base32
 871          "0qd65lnr63vmx2gxla6lcmm5gawlnaj4wy4h4vmdc3h9h9nyw6zc"))))
 872     (build-system cmake-build-system)
 873     (arguments
 874      `(#:configure-flags
 875        (list "-DUSE_SHARED_MBEDTLS_LIBRARY=ON")))
 876     (native-inputs
 877      `(("perl" ,perl)
 878        ("python" ,python)))
 879     (synopsis "Small TLS library")
 880     (description
 881      "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
 882 for developers to include cryptographic and SSL/TLS capabilities in their
 883 (embedded) products, facilitating this functionality with a minimal
 884 coding footprint.")
 885     (home-page "https://tls.mbed.org")
 886     (license license:asl2.0)))
 887
 888 ;; The Hiawatha Web server requires some specific features to be enabled.
 889 (define-public mbedtls-for-hiawatha
 890   (hidden-package
 891    (package
 892      (inherit mbedtls-apache)
 893      (arguments
 894       (substitute-keyword-arguments
 895           `(#:phases
 896             (modify-phases %standard-phases
 897               (add-after 'configure 'configure-extra-features
 898                 (lambda _
 899                   (for-each (lambda (feature)
 900                               (invoke "scripts/config.pl" "set" feature))
 901                             (list "MBEDTLS_THREADING_C"
 902                                   "MBEDTLS_THREADING_PTHREAD"))
 903                   #t)))
 904             ,@(package-arguments mbedtls-apache)))))))
 905
 906 (define-public dehydrated
 907   (package
 908     (name "dehydrated")
 909     (version "0.6.5")
 910     (source (origin
 911               (method url-fetch)
 912               (uri (string-append
 913                     "https://github.com/lukas2511/dehydrated/releases/download/"
 914                     "v" version "/dehydrated-" version ".tar.gz"))
 915               (sha256
 916                (base32
 917                 "0dgskgbdd95p13jx6s13p77y15wngb5cm6p4305cf2s54w0bvahh"))))
 918     (build-system trivial-build-system)
 919     (arguments
 920      `(#:modules ((guix build utils))
 921        #:builder
 922        (begin
 923          (use-modules (guix build utils))
 924          (let* ((source (assoc-ref %build-inputs "source"))
 925                 (tar (assoc-ref %build-inputs "tar"))
 926                 (gz  (assoc-ref %build-inputs "gzip"))
 927                 (out (assoc-ref %outputs "out"))
 928                 (bin (string-append out "/bin"))
 929                 (doc (string-append out "/share/doc/"))
 930                 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
 931
 932            (setenv "PATH" (string-append gz "/bin"))
 933            (invoke (string-append tar "/bin/tar") "xvf" source)
 934            (chdir (string-append ,name "-" ,version))
 935
 936            (install-file "dehydrated" bin)
 937            (install-file "LICENSE" (string-append doc ,name "-" ,version))
 938            (with-directory-excursion bin
 939              (patch-shebang "dehydrated" (list bash))
 940
 941              ;; Do not try to write in the store.
 942              (substitute* "dehydrated"
 943                (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
 944
 945              (setenv "PATH" bash)
 946              (wrap-program "dehydrated"
 947                `("PATH" ":" prefix
 948                  ,(map (lambda (dir)
 949                          (string-append dir "/bin"))
 950                        (map (lambda (input)
 951                               (assoc-ref %build-inputs input))
 952                             '("coreutils"
 953                               "curl"
 954                               "diffutils"
 955                               "gawk"
 956                               "grep"
 957                               "openssl"
 958                               "sed"))))))
 959            #t))))
 960     (inputs
 961      `(("bash" ,bash)
 962        ("coreutils" ,coreutils)
 963        ("curl" ,curl)
 964        ("diffutils" ,diffutils)
 965        ("gawk" ,gawk)
 966        ("grep" ,grep)
 967        ("openssl" ,openssl)
 968        ("sed" ,sed)))
 969     (native-inputs
 970      `(("gzip" ,gzip)
 971        ("tar" ,tar)))
 972     (home-page "https://dehydrated.io/")
 973     (synopsis "Let's Encrypt/ACME client implemented as a shell script")
 974     (description "Dehydrated is a client for signing certificates with an
 975 ACME-server (currently only provided by Let's Encrypt) implemented as a
 976 relatively simple Bash script.")
 977     (license license:expat)))
 978
 979 (define-public go-github-com-certifi-gocertifi
 980   (let ((commit "d2eda712971317d7dd278bc2a52acda7e945f97e")
 981         (revision "0"))
 982     (package
 983       (name "go-github-com-certifi-gocertifi")
 984       (version (git-version "2018.01.18" revision commit))
 985       (source (origin
 986                 (method git-fetch)
 987                 (uri (git-reference
 988                        (url "https://github.com/certifi/gocertifi")
 989                        (commit commit)))
 990                 (file-name (git-file-name name version))
 991                 (sha256
 992                  (base32
 993                   "0f3v26xps7gadw4qfmh1kxbpgp0cgqdd61a257xnnvnd7ll6k8dh"))))
 994       (build-system go-build-system)
 995       (arguments
 996        '(#:import-path "github.com/certifi/gocertifi"))
 997       (synopsis "X.509 TLS root certificate bundle for Go")
 998       (description "This package is a Go language X.509 TLS root certificate bundle,
 999 derived from Mozilla's collection.")
1000       (home-page "https://certifi.io")
1001       (license license:mpl2.0))))