gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
   9 ;;; Copyright © 2016 Nils Gillmann <niasterisk@grrlz.net>
  10 ;;;
  11 ;;; This file is part of GNU Guix.
  12 ;;;
  13 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  14 ;;; under the terms of the GNU General Public License as published by
  15 ;;; the Free Software Foundation; either version 3 of the License, or (at
  16 ;;; your option) any later version.
  17 ;;;
  18 ;;; GNU Guix is distributed in the hope that it will be useful, but
  19 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  20 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21 ;;; GNU General Public License for more details.
  22 ;;;
  23 ;;; You should have received a copy of the GNU General Public License
  24 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  25
  26 (define-module (gnu packages tls)
  27   #:use-module ((guix licenses) #:prefix license:)
  28   #:use-module (guix packages)
  29   #:use-module (guix download)
  30   #:use-module (guix utils)
  31   #:use-module (guix build-system gnu)
  32   #:use-module (guix build-system perl)
  33   #:use-module (guix build-system python)
  34   #:use-module (gnu packages compression)
  35   #:use-module (gnu packages)
  36   #:use-module (gnu packages guile)
  37   #:use-module (gnu packages libffi)
  38   #:use-module (gnu packages libidn)
  39   #:use-module (gnu packages linux)
  40   #:use-module (gnu packages ncurses)
  41   #:use-module (gnu packages nettle)
  42   #:use-module (gnu packages perl)
  43   #:use-module (gnu packages pkg-config)
  44   #:use-module (gnu packages python)
  45   #:use-module (gnu packages texinfo)
  46   #:use-module (gnu packages base))
  47
  48 (define-public libtasn1
  49   (package
  50     (name "libtasn1")
  51     (version "4.8")
  52     (source
  53      (origin
  54       (method url-fetch)
  55       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  56                           version ".tar.gz"))
  57       (sha256
  58        (base32
  59         "04y5m29pqmvkfdbppmsdifyx89v8xclxzklpfc7a1fkr9p4jz07s"))))
  60     (build-system gnu-build-system)
  61     (native-inputs `(("perl" ,perl)))
  62     (home-page "http://www.gnu.org/software/libtasn1/")
  63     (synopsis "ASN.1 library")
  64     (description
  65      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  66 for transmitting machine-neutral encodings of data objects in computer
  67 networking, allowing for formal validation of data according to some
  68 specifications.")
  69     (license license:lgpl2.0+)))
  70
  71 (define-public p11-kit
  72   (package
  73     (name "p11-kit")
  74     (version "0.23.1")
  75     (source
  76      (origin
  77       (method url-fetch)
  78       (uri (string-append "https://p11-glue.freedesktop.org/releases/p11-kit-"
  79                           version ".tar.gz"))
  80       (sha256
  81        (base32
  82         "1i3a1wdpagm0p3y1bwaz5x5rjhcpqbcrnhkcp10p259vkxk72wz5"))
  83       (modules '((guix build utils))) ; for substitute*
  84       (snippet
  85         '(begin
  86            ;; Drop one test that fails, also when trying to compile manually.
  87            ;; Reported upstream at
  88            ;; https://bugs.freedesktop.org/show_bug.cgi?id=89027
  89            (substitute* "Makefile.in"
  90              (("test-module\\$\\(EXEEXT\\) ") ""))))))
  91     (build-system gnu-build-system)
  92     (native-inputs
  93      `(("pkg-config" ,pkg-config)))
  94     (inputs
  95      `(("libffi" ,libffi)
  96        ("libtasn1" ,libtasn1)))
  97     (arguments
  98      `(#:configure-flags '("--without-trust-paths")))
  99     (home-page "http://p11-glue.freedesktop.org/p11-kit.html")
 100     (synopsis "PKCS#11 library")
 101     (description
 102      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 103 provides a standard configuration setup for installing PKCS#11 modules
 104 in such a way that they are discoverable.  It also solves problems with
 105 coordinating the use of PKCS#11 by different components or libraries
 106 living in the same process.")
 107     (license license:bsd-3)))
 108
 109 (define-public gnutls
 110   (package
 111     (name "gnutls")
 112     (version "3.5.2")
 113     (source (origin
 114              (method url-fetch)
 115              (uri
 116               ;; Note: Releases are no longer on ftp.gnu.org since the
 117               ;; schism (after version 3.1.5).
 118               (string-append "mirror://gnupg/gnutls/v"
 119                              (version-major+minor version)
 120                              "/gnutls-" version ".tar.xz"))
 121              (sha256
 122               (base32
 123                "10l5pv7qc5c850aamih3pdkbqpc4v2a6g164dzd7c7fjpxffji9b"))))
 124     (build-system gnu-build-system)
 125     (arguments
 126      '(#:configure-flags
 127        (list (string-append "--with-guile-site-dir="
 128                             (assoc-ref %outputs "out")
 129                             "/share/guile/site/2.0")
 130              ;; GnuTLS doesn't consult any environment variables to specify
 131              ;; the location of the system-wide trust store.  Instead it has a
 132              ;; configure-time option.  Unless specified, its configure script
 133              ;; attempts to auto-detect the location by looking for common
 134              ;; places in the filesystem, none of which are present in our
 135              ;; chroot build environment.  If not found, then no default trust
 136              ;; store is used, so each program has to provide its own
 137              ;; fallback, and users have to configure each program
 138              ;; independently.  This seems suboptimal.
 139              "--with-default-trust-store-dir=/etc/ssl/certs"
 140
 141              ;; FIXME: Temporarily disable p11-kit support since it is not
 142              ;; working on mips64el.
 143              "--without-p11-kit")
 144
 145        #:phases (modify-phases %standard-phases
 146                   (add-after
 147                    'install 'move-doc
 148                    (lambda* (#:key outputs #:allow-other-keys)
 149                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 150                      (let* ((out    (assoc-ref outputs "out"))
 151                             (doc    (assoc-ref outputs "doc"))
 152                             (mandir (string-append doc "/share/man/man3"))
 153                             (oldman (string-append out "/share/man/man3")))
 154                        (mkdir-p mandir)
 155                        (copy-recursively oldman mandir)
 156                        (delete-file-recursively oldman)
 157                        #t))))))
 158     (outputs '("out"                              ;4.4 MiB
 159                "debug"
 160                "doc"))                            ;4.1 MiB of man pages
 161     (native-inputs
 162      `(("net-tools" ,net-tools)
 163        ("pkg-config" ,pkg-config)
 164        ("which" ,which)))
 165     (inputs
 166      `(("guile" ,guile-2.0)
 167        ("perl" ,perl)))
 168     (propagated-inputs
 169      ;; These are all in the 'Requires.private' field of gnutls.pc.
 170      `(("libtasn1" ,libtasn1)
 171        ("libidn" ,libidn)
 172        ("nettle" ,nettle)
 173        ("zlib" ,zlib)))
 174     (home-page "https://www.gnu.org/software/gnutls/")
 175     (synopsis "Transport layer security library")
 176     (description
 177      "GnuTLS is a secure communications library implementing the SSL, TLS
 178 and DTLS protocols.  It is provided in the form of a C library to support the
 179 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 180 required structures.")
 181     (license license:lgpl2.1+)
 182     (properties '((ftp-server . "ftp.gnutls.org")
 183                   (ftp-directory . "/gcrypt/gnutls")))))
 184
 185 (define-public openssl
 186   (package
 187    (name "openssl")
 188    (version "1.0.2h")
 189    (source (origin
 190              (method url-fetch)
 191              (uri (list (string-append "ftp://ftp.openssl.org/source/"
 192                                        name "-" version ".tar.gz")
 193                         (string-append "ftp://ftp.openssl.org/source/old/"
 194                                        (string-trim-right version char-set:letter)
 195                                        "/" name "-" version ".tar.gz")))
 196              (sha256
 197               (base32
 198                "06996ds1rk8xhnyb5y273a7xkcxhggp4bq1g02rab55d7bjhfh0x"))
 199              (patches (search-patches "openssl-runpath.patch"
 200                                       "openssl-c-rehash-in.patch"
 201                                       "openssl-CVE-2016-2177.patch"
 202                                       "openssl-CVE-2016-2178.patch"))))
 203    (build-system gnu-build-system)
 204    (outputs '("out"
 205               "doc"                               ;1.5MiB of man3 pages
 206               "static"))                          ;6MiB of .a files
 207    (native-inputs `(("perl" ,perl)))
 208    (arguments
 209     `(#:disallowed-references (,perl)
 210       #:parallel-build? #f
 211       #:parallel-tests? #f
 212       #:test-target "test"
 213
 214       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
 215       ;; so we explicitly disallow it here.
 216       #:disallowed-references ,(list (canonical-package perl))
 217       #:phases
 218       (modify-phases %standard-phases
 219         (add-before
 220          'configure 'patch-Makefile.org
 221          (lambda* (#:key outputs #:allow-other-keys)
 222            ;; The default MANDIR is some unusual place.  Fix that.
 223            (let ((out (assoc-ref outputs "out")))
 224              (patch-makefile-SHELL "Makefile.org")
 225              (substitute* "Makefile.org"
 226                (("^MANDIR[[:blank:]]*=.*$")
 227                 (string-append "MANDIR = " out "/share/man\n")))
 228              #t)))
 229         (replace
 230          'configure
 231          (lambda* (#:key outputs #:allow-other-keys)
 232            (let ((out (assoc-ref outputs "out")))
 233              (zero?
 234               (system* "./config"
 235                        "shared"                   ;build shared libraries
 236                        "--libdir=lib"
 237
 238                        ;; The default for this catch-all directory is
 239                        ;; PREFIX/ssl.  Change that to something more
 240                        ;; conventional.
 241                        (string-append "--openssldir=" out
 242                                       "/share/openssl-" ,version)
 243
 244                        (string-append "--prefix=" out)
 245
 246                        ;; XXX FIXME: Work around a code generation bug in GCC
 247                        ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
 248                        ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
 249                        ,@(if (and (not (%current-target-system))
 250                                   (string-prefix? "armhf" (%current-system)))
 251                              '("-mfpu=vfpv3")
 252                              '()))))))
 253         (add-after
 254          'install 'make-libraries-writable
 255          (lambda* (#:key outputs #:allow-other-keys)
 256            ;; Make libraries writable so that 'strip' does its job.
 257            (let ((out (assoc-ref outputs "out")))
 258              (for-each (lambda (file)
 259                          (chmod file #o644))
 260                        (find-files (string-append out "/lib")
 261                                    "\\.so"))
 262              #t)))
 263         (add-after 'install 'move-static-libraries
 264           (lambda* (#:key outputs #:allow-other-keys)
 265             ;; Move static libraries to the "static" output.
 266             (let* ((out    (assoc-ref outputs "out"))
 267                    (lib    (string-append out "/lib"))
 268                    (static (assoc-ref outputs "static"))
 269                    (slib   (string-append static "/lib")))
 270               (mkdir-p slib)
 271               (for-each (lambda (file)
 272                           (install-file file slib)
 273                           (delete-file file))
 274                         (find-files lib "\\.a$"))
 275               #t)))
 276         (add-after 'install 'move-man3-pages
 277           (lambda* (#:key outputs #:allow-other-keys)
 278             ;; Move section 3 man pages to "doc".
 279             (let* ((out    (assoc-ref outputs "out"))
 280                    (man3   (string-append out "/share/man/man3"))
 281                    (doc    (assoc-ref outputs "doc"))
 282                    (target (string-append doc "/share/man/man3")))
 283               (mkdir-p target)
 284               (for-each (lambda (file)
 285                           (rename-file file
 286                                        (string-append target "/"
 287                                                       (basename file))))
 288                         (find-files man3))
 289               #t)))
 290         (add-before
 291          'patch-source-shebangs 'patch-tests
 292          (lambda* (#:key inputs native-inputs #:allow-other-keys)
 293            (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 294              (substitute* (find-files "test" ".*")
 295                (("/bin/sh")
 296                 (string-append bash "/bin/bash"))
 297                (("/bin/rm")
 298                 "rm"))
 299              #t)))
 300         (add-after
 301          'install 'remove-miscellany
 302          (lambda* (#:key outputs #:allow-other-keys)
 303            ;; The 'misc' directory contains random undocumented shell and Perl
 304            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 305            (let ((out (assoc-ref outputs "out")))
 306              (delete-file-recursively (string-append out "/share/openssl-"
 307                                                      ,version "/misc"))
 308              #t))))))
 309    (native-search-paths
 310     ;; FIXME: These two variables must designate a single file or directory
 311     ;; and are not actually "search paths."  In practice it works OK in user
 312     ;; profiles because there's always just one item that matches the
 313     ;; specification.
 314     (list (search-path-specification
 315            (variable "SSL_CERT_DIR")
 316            (files '("etc/ssl/certs")))
 317           (search-path-specification
 318            (variable "SSL_CERT_FILE")
 319            (files '("etc/ssl/certs/ca-certificates.crt")))))
 320    (synopsis "SSL/TLS implementation")
 321    (description
 322     "OpenSSL is an implementation of SSL/TLS.")
 323    (license license:openssl)
 324    (home-page "http://www.openssl.org/")))
 325
 326 (define-public libressl
 327   (package
 328     (name "libressl")
 329     (version "2.3.6")
 330     (source
 331      (origin
 332       (method url-fetch)
 333       (uri (string-append
 334              "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-"
 335              version ".tar.gz"))
 336       (sha256
 337        (base32
 338         "1yipsp1ici207nbminbf1knh252kzvqg036v0xpx0fw1wrwlg2im"))))
 339     (build-system gnu-build-system)
 340     (native-search-paths
 341       ;; FIXME: These two variables must designate a single file or directory
 342       ;; and are not actually "search paths."  In practice it works OK in
 343       ;; user profiles because there's always just one item that matches the
 344       ;; specification.
 345      (list (search-path-specification
 346             (variable "SSL_CERT_DIR")
 347             (files '("etc/ssl/certs")))
 348            (search-path-specification
 349             (variable "SSL_CERT_FILE")
 350             (files '("etc/ssl/certs/ca-certificates.crt")))))
 351     (home-page "http://www.libressl.org/")
 352     (synopsis "SSL/TLS implementation")
 353     (description "LibreSSL is a version of the TLS/crypto stack forked
 354 from OpenSSL in 2014, with the goals of modernizing the codebase, improving
 355 security, and applying best practice development processes.")
 356     ;; Files taken from OpenSSL keep their license, others are under various
 357     ;; non-copyleft licenses.
 358     (license (list license:openssl
 359                    (license:non-copyleft
 360                      "file://COPYING"
 361                      "See COPYING in the distribution.")))))
 362
 363 (define-public python-acme
 364   (package
 365     (name "python-acme")
 366     (version "0.8.1")
 367     (source (origin
 368               (method url-fetch)
 369               (uri (string-append
 370                      "https://pypi.python.org/packages/"
 371                      "f5/7a/11a99b5d1d1c692f6eed27cfab69e6ba4d2f0c2a461d2607e6a930ff2c68/"
 372                      "acme-" version ".tar.gz"))
 373       (sha256
 374         (base32
 375          "17vx2miczpd8ww4xizmc0nca2c7jf04wnhfnswx2bxhb537lmsnk"))))
 376     (build-system python-build-system)
 377     (arguments
 378      `(#:phases
 379        (modify-phases %standard-phases
 380          (add-before 'install 'disable-egg-compression
 381            (lambda _
 382              ;; Do not compress the egg.
 383              ;; See <http://bugs.gnu.org/20765>.
 384              (let ((port (open-file "setup.cfg" "a")))
 385                (display "\n[easy_install]\nzip_ok = 0\n"
 386                         port)
 387                (close-port port)
 388                #t)))
 389          (add-after 'install 'docs
 390            (lambda* (#:key outputs #:allow-other-keys)
 391              (let* ((out (assoc-ref outputs "out"))
 392                     (man (string-append out "/share/man/man1"))
 393                     (info (string-append out "/info")))
 394                (and (zero? (system* "make" "-C" "docs" "man" "info"))
 395                     (install-file "docs/_build/texinfo/acme-python.info" info)
 396                     (install-file "docs/_build/man/acme-python.1" man)
 397                     #t)))))))
 398     ;; TODO: Add optional inputs for testing.
 399     (native-inputs
 400      `(("python-mock" ,python-mock)
 401        ;; For documentation
 402        ("python-sphinx" ,python-sphinx)
 403        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 404        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 405        ("python-setuptools" ,python-setuptools)
 406        ("texinfo" ,texinfo)))
 407     (propagated-inputs
 408      `(("python-ndg-httpsclient" ,python-ndg-httpsclient)
 409        ("python-werkzeug" ,python-werkzeug)
 410        ("python-six" ,python-six)
 411        ("python-requests" ,python-requests)
 412        ("python-pytz" ,python-pytz)
 413        ("python-pyrfc3339" ,python-pyrfc3339)
 414        ("python-pyasn1" ,python-pyasn1)
 415        ("python-cryptography" ,python-cryptography)
 416        ("python-pyopenssl" ,python-pyopenssl)))
 417     (home-page "https://github.com/letsencrypt/letsencrypt")
 418     (synopsis "ACME protocol implementation in Python")
 419     (description "ACME protocol implementation in Python")
 420     (license license:asl2.0)))
 421
 422 (define-public python2-acme
 423   (package-with-python2 python-acme))
 424
 425 (define-public certbot
 426   (package
 427     (name "certbot")
 428     (version "0.8.1")
 429     (source (origin
 430               (method url-fetch)
 431               (uri (string-append
 432                      "https://pypi.python.org/packages/"
 433                      "a2/3b/4756e6a0ceb14e084042a2a65c615d68d25621c6fd446d0fc10d14c4ce7d/"
 434                      name "-" version ".tar.gz"))
 435               (sha256
 436                (base32
 437                 "0w972cf2mk74aji5d8dylg3jw6wczg01gb4asf3ndv8c64yxza3c"))))
 438     (build-system python-build-system)
 439     (arguments
 440      `(#:python ,python-2
 441        #:phases
 442        (modify-phases %standard-phases
 443          (add-after 'build 'docs
 444            (lambda* (#:key outputs #:allow-other-keys)
 445              (let* ((out (assoc-ref outputs "out"))
 446                     (man1 (string-append out "/share/man/man1"))
 447                     (man7 (string-append out "/share/man/man7"))
 448                     (info (string-append out "/info")))
 449                (and
 450                  (zero? (system* "make" "-C" "docs" "man" "info"))
 451                  (install-file "docs/_build/texinfo/Certbot.info" info)
 452                  (install-file "docs/_build/man/certbot.1" man1)
 453                  (install-file "docs/_build/man/certbot.7" man7)
 454                  #t)))))))
 455     ;; TODO: Add optional inputs for testing.
 456     (native-inputs
 457      `(("python2-nose" ,python2-nose)
 458        ("python2-mock" ,python2-mock)
 459        ;; For documentation
 460        ("python2-sphinx" ,python2-sphinx)
 461        ("python2-sphinx-rtd-theme" ,python2-sphinx-rtd-theme)
 462        ("python2-sphinx-repoze-autointerface" ,python2-sphinx-repoze-autointerface)
 463        ("python2-sphinxcontrib-programoutput" ,python2-sphinxcontrib-programoutput)
 464        ("texinfo" ,texinfo)))
 465     (propagated-inputs
 466      `(("python2-acme" ,python2-acme)
 467        ("python2-zope-interface" ,python2-zope-interface)
 468        ("python2-pythondialog" ,python2-pythondialog)
 469        ("python2-pyrfc3339" ,python2-pyrfc3339)
 470        ("python2-pyopenssl" ,python2-pyopenssl)
 471        ("python2-configobj" ,python2-configobj)
 472        ("python2-configargparse" ,python2-configargparse)
 473        ("python2-zope-component" ,python2-zope-component)
 474        ("python2-parsedatetime" ,python2-parsedatetime)
 475        ("python2-six" ,python2-six)
 476        ("python2-psutil" ,python2-psutil)
 477        ("python2-requests" ,python2-requests)
 478        ("python2-pytz" ,python2-pytz)))
 479     (synopsis "Let's Encrypt client")
 480     (description "Tool to automatically receive and install X.509 certificates
 481 to enable TLS on servers.  The client will interoperate with the Let’s Encrypt CA which
 482 will be issuing browser-trusted certificates for free.")
 483     (home-page "https://certbot.eff.org/")
 484     (license license:asl2.0)))
 485
 486 (define-public letsencrypt
 487   (package (inherit certbot)
 488     (name "letsencrypt")))
 489
 490 (define-public perl-net-ssleay
 491   (package
 492     (name "perl-net-ssleay")
 493     (version "1.68")
 494     (source (origin
 495               (method url-fetch)
 496               (uri (string-append "mirror://cpan/authors/id/M/MI/MIKEM/"
 497                                   "Net-SSLeay-" version ".tar.gz"))
 498               (sha256
 499                (base32
 500                 "1m2wwzhjwsg0drlhp9w12fl6bsgj69v8gdz72jqrqll3qr7f408p"))))
 501     (build-system perl-build-system)
 502     (native-inputs
 503      `(("patch" ,patch)
 504        ("patch/disable-ede-test"
 505         ,(search-patch "perl-net-ssleay-disable-ede-test.patch"))))
 506     (inputs `(("openssl" ,openssl)))
 507     (arguments
 508      `(#:phases
 509        (modify-phases %standard-phases
 510          (add-after
 511           'unpack 'apply-patch
 512           (lambda* (#:key inputs #:allow-other-keys)
 513             ;; XXX We apply this patch here instead of in the 'origin' because
 514             ;; this package's build system fails badly when the source file
 515             ;; times are zeroed.
 516             ;; XXX Try removing this patch for perl-net-ssleay > 1.68
 517             (zero? (system* "patch" "--force" "-p1" "-i"
 518                             (assoc-ref inputs "patch/disable-ede-test")))))
 519          (add-before
 520           'configure 'set-ssl-prefix
 521           (lambda* (#:key inputs #:allow-other-keys)
 522             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 523             #t)))))
 524     (synopsis "Perl extension for using OpenSSL")
 525     (description
 526      "This module offers some high level convenience functions for accessing
 527 web pages on SSL servers (for symmetry, the same API is offered for accessing
 528 http servers, too), an sslcat() function for writing your own clients, and
 529 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 530 servers or clients for more complicated applications.")
 531     (license (package-license perl))
 532     (home-page "http://search.cpan.org/~mikem/Net-SSLeay-1.66/")))