gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016, 2017, 2018 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015, 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016, 2017, 2019 Efraim Flashner <efraim@flashner.co.il>
   9 ;;; Copyright © 2016, 2017, 2018 ng0 <ng0@n0.is>
  10 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017, 2018, 2019, 2020 Marius Bakke <mbakke@fastmail.com>
  13 ;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
  14 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
  15 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
  16 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
  17 ;;;
  18 ;;; This file is part of GNU Guix.
  19 ;;;
  20 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  21 ;;; under the terms of the GNU General Public License as published by
  22 ;;; the Free Software Foundation; either version 3 of the License, or (at
  23 ;;; your option) any later version.
  24 ;;;
  25 ;;; GNU Guix is distributed in the hope that it will be useful, but
  26 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  27 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28 ;;; GNU General Public License for more details.
  29 ;;;
  30 ;;; You should have received a copy of the GNU General Public License
  31 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  32
  33 (define-module (gnu packages tls)
  34   #:use-module ((guix licenses) #:prefix license:)
  35   #:use-module (guix packages)
  36   #:use-module (guix download)
  37   #:use-module (guix git-download)
  38   #:use-module (guix utils)
  39   #:use-module (guix build-system gnu)
  40   #:use-module (guix build-system go)
  41   #:use-module (guix build-system perl)
  42   #:use-module (guix build-system python)
  43   #:use-module (guix build-system cmake)
  44   #:use-module (guix build-system trivial)
  45   #:use-module (gnu packages compression)
  46   #:use-module (gnu packages)
  47   #:use-module (gnu packages bash)
  48   #:use-module (gnu packages check)
  49   #:use-module (gnu packages curl)
  50   #:use-module (gnu packages dns)
  51   #:use-module (gnu packages gawk)
  52   #:use-module (gnu packages guile)
  53   #:use-module (gnu packages libbsd)
  54   #:use-module (gnu packages libffi)
  55   #:use-module (gnu packages libidn)
  56   #:use-module (gnu packages linux)
  57   #:use-module (gnu packages ncurses)
  58   #:use-module (gnu packages nettle)
  59   #:use-module (gnu packages perl)
  60   #:use-module (gnu packages pkg-config)
  61   #:use-module (gnu packages python)
  62   #:use-module (gnu packages python-crypto)
  63   #:use-module (gnu packages python-web)
  64   #:use-module (gnu packages python-xyz)
  65   #:use-module (gnu packages sphinx)
  66   #:use-module (gnu packages texinfo)
  67   #:use-module (gnu packages time)
  68   #:use-module (gnu packages base)
  69   #:use-module (srfi srfi-1))
  70
  71 (define-public libtasn1
  72   (package
  73     (name "libtasn1")
  74     (version "4.16.0")
  75     (source
  76      (origin
  77       (method url-fetch)
  78       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  79                           version ".tar.gz"))
  80       (sha256
  81        (base32
  82         "179jskl7dmfp1rd2khkzmlibzgki4wi6hvmmwfv7q49r728b03qf"))))
  83     (build-system gnu-build-system)
  84     (arguments
  85      `(#:configure-flags '("--disable-static")))
  86     (native-inputs `(("perl" ,perl)))
  87     (home-page "https://www.gnu.org/software/libtasn1/")
  88     (synopsis "ASN.1 library")
  89     (description
  90      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  91 for transmitting machine-neutral encodings of data objects in computer
  92 networking, allowing for formal validation of data according to some
  93 specifications.")
  94     (license license:lgpl2.0+)))
  95
  96 (define-public asn1c
  97   (package
  98     (name "asn1c")
  99     (version "0.9.28")
 100     (source (origin
 101       (method url-fetch)
 102       (uri (string-append "https://lionet.info/soft/asn1c-"
 103                           version ".tar.gz"))
 104       (sha256
 105        (base32
 106         "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
 107     (build-system gnu-build-system)
 108     (native-inputs
 109      `(("perl" ,perl)))
 110     (home-page "https://lionet.info/asn1c")
 111     (synopsis "ASN.1 to C compiler")
 112     (description "The ASN.1 to C compiler takes ASN.1 module
 113 files and generates C++ compatible C source code.  That code can be
 114 used to serialize the native C structures into compact and unambiguous
 115 BER/XER/PER-based data files, and deserialize the files back.
 116
 117 Various ASN.1 based formats are widely used in the industry, such as to encode
 118 the X.509 certificates employed in the HTTPS handshake, to exchange control
 119 data between mobile phones and cellular networks, to car-to-car communication
 120 in intelligent transportation networks.")
 121     (license license:bsd-2)))
 122
 123 (define-public p11-kit
 124   (package
 125     (name "p11-kit")
 126     (version "0.23.20")
 127     (source
 128      (origin
 129       (method url-fetch)
 130       (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
 131                           "download/" version "/p11-kit-" version ".tar.xz"))
 132       (sha256
 133        (base32
 134         "0131maw666ha4d6iyj13fkz18c4pnb3lw2xwv5kvkmnzqcj61n0l"))))
 135     (build-system gnu-build-system)
 136     (native-inputs
 137      `(("pkg-config" ,pkg-config)))
 138     (inputs
 139      `(("libffi" ,libffi)
 140        ("libtasn1" ,libtasn1)))
 141     (arguments
 142      `(#:configure-flags '("--without-trust-paths")
 143        #:phases (modify-phases %standard-phases
 144                   (add-before 'check 'prepare-tests
 145                     (lambda _
 146                       ;; "test-runtime" expects XDG_RUNTIME_DIR to be set up
 147                       ;; and looks for .cache and other directories (only).
 148                       ;; For simplicity just drop it since it is irrelevant
 149                       ;; in the build container.
 150                       (substitute* "Makefile"
 151                         (("test-runtime\\$\\(EXEEXT\\)") ""))
 152                       #t)))))
 153     (home-page "https://p11-glue.freedesktop.org/p11-kit.html")
 154     (synopsis "PKCS#11 library")
 155     (description
 156      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 157 provides a standard configuration setup for installing PKCS#11 modules
 158 in such a way that they are discoverable.  It also solves problems with
 159 coordinating the use of PKCS#11 by different components or libraries
 160 living in the same process.")
 161     (license license:bsd-3)))
 162
 163 (define-public gnutls
 164   (package
 165     (name "gnutls")
 166     (version "3.6.12")
 167     (source (origin
 168              (method url-fetch)
 169              (uri
 170               ;; Note: Releases are no longer on ftp.gnu.org since the
 171               ;; schism (after version 3.1.5).
 172               (string-append "mirror://gnupg/gnutls/v"
 173                              (version-major+minor version)
 174                              "/gnutls-" version ".tar.xz"))
 175              (patches (search-patches "gnutls-skip-trust-store-test.patch"))
 176              (sha256
 177               (base32
 178                "0jvca1qahn9lrwv6f5kfs95icirc15b2a8x9fzczyj996ipg3b5z"))))
 179     (build-system gnu-build-system)
 180     (arguments
 181      `(; Ensure we don't keep a reference to this buggy software.
 182        #:disallowed-references (,net-tools)
 183        #:configure-flags
 184        (list
 185              ;; GnuTLS doesn't consult any environment variables to specify
 186              ;; the location of the system-wide trust store.  Instead it has a
 187              ;; configure-time option.  Unless specified, its configure script
 188              ;; attempts to auto-detect the location by looking for common
 189              ;; places in the file system, none of which are present in our
 190              ;; chroot build environment.  If not found, then no default trust
 191              ;; store is used, so each program has to provide its own
 192              ;; fallback, and users have to configure each program
 193              ;; independently.  This seems suboptimal.
 194              "--with-default-trust-store-dir=/etc/ssl/certs"
 195
 196              ;; Tell the build system that we want Guile bindings installed to
 197              ;; the output instead of Guiles own module directory.
 198              (string-append "--with-guile-site-dir="
 199                             "$(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)")
 200              (string-append "--with-guile-site-ccache-dir="
 201                             "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache")
 202              (string-append "--with-guile-extension-dir="
 203                             "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/extensions")
 204
 205              ;; FIXME: Temporarily disable p11-kit support since it is not
 206              ;; working on mips64el.
 207              "--without-p11-kit")
 208
 209        #:phases (modify-phases %standard-phases
 210                   (add-after
 211                    'install 'move-doc
 212                    (lambda* (#:key outputs #:allow-other-keys)
 213                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 214                      (let* ((out    (assoc-ref outputs "out"))
 215                             (doc    (assoc-ref outputs "doc"))
 216                             (mandir (string-append doc "/share/man/man3"))
 217                             (oldman (string-append out "/share/man/man3")))
 218                        (mkdir-p mandir)
 219                        (copy-recursively oldman mandir)
 220                        (delete-file-recursively oldman)
 221                        #t))))))
 222     (outputs '("out"                              ;4.4 MiB
 223                "debug"
 224                "doc"))                            ;4.1 MiB of man pages
 225     (native-inputs
 226      `(("net-tools" ,net-tools)
 227        ("pkg-config" ,pkg-config)
 228        ("which" ,which)
 229        ("datefudge" ,datefudge)                   ;tests rely on 'datefudge'
 230        ("util-linux" ,util-linux)))               ;one test needs 'setsid'
 231     (inputs
 232      `(("guile" ,guile-3.0)))
 233     (propagated-inputs
 234      ;; These are all in the 'Requires.private' field of gnutls.pc.
 235      `(("libtasn1" ,libtasn1)
 236        ("libidn2" ,libidn2)
 237        ("nettle" ,nettle)
 238        ("zlib" ,zlib)))
 239     (home-page "https://www.gnu.org/software/gnutls/")
 240     (synopsis "Transport layer security library")
 241     (description
 242      "GnuTLS is a secure communications library implementing the SSL, TLS
 243 and DTLS protocols.  It is provided in the form of a C library to support the
 244 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 245 required structures.")
 246     (license license:lgpl2.1+)
 247     (properties '((ftp-server . "ftp.gnutls.org")
 248                   (ftp-directory . "/gcrypt/gnutls")))))
 249
 250 (define-public gnutls/guile-2.0
 251   ;; GnuTLS for Guile 2.0.
 252   (package
 253     (inherit gnutls)
 254     (name "guile2.0-gnutls")
 255     (inputs `(("guile" ,guile-2.0)
 256               ,@(alist-delete "guile" (package-inputs gnutls))))))
 257
 258 (define-public gnutls/dane
 259   ;; GnuTLS with build libgnutls-dane, implementing DNS-based
 260   ;; Authentication of Named Entities.  This is required for GNS functionality
 261   ;; by GNUnet and gnURL.  This is done in an extra package definition
 262   ;; to have the choice between GnuTLS with Dane and without Dane.
 263   (package
 264     (inherit gnutls)
 265     (name "gnutls-dane")
 266     (inputs `(("unbound" ,unbound)
 267               ,@(package-inputs gnutls)))))
 268
 269 (define-public guile2.2-gnutls
 270   (package
 271     (inherit gnutls)
 272     (name "guile2.2-gnutls")
 273     (inputs `(("guile" ,guile-2.2)
 274               ,@(alist-delete "guile"
 275                               (package-inputs gnutls))))))
 276
 277 (define-public guile3.0-gnutls
 278   (deprecated-package "guile3.0-gnutls" gnutls))
 279
 280 (define-public openssl
 281   (package
 282    (name "openssl")
 283    (version "1.1.1d")
 284    (source (origin
 285              (method url-fetch)
 286              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 287                                        version ".tar.gz")
 288                         (string-append "ftp://ftp.openssl.org/source/"
 289                                        "openssl-" version ".tar.gz")
 290                         (string-append "ftp://ftp.openssl.org/source/old/"
 291                                        (string-trim-right version char-set:letter)
 292                                        "/openssl-" version ".tar.gz")))
 293              (sha256
 294               (base32
 295                "1whinyw402z3b9xlb3qaxv4b9sk4w1bgh9k0y8df1z4x3yy92fhy"))
 296              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))))
 297    (build-system gnu-build-system)
 298    (outputs '("out"
 299               "doc"         ;6.8 MiB of man3 pages and full HTML documentation
 300               "static"))    ;6.4 MiB of .a files
 301    (native-inputs `(("perl" ,perl)))
 302    (arguments
 303     `(#:parallel-tests? #f
 304       #:test-target "test"
 305
 306       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
 307       ;; so we explicitly disallow it here.
 308       #:disallowed-references ,(list (canonical-package perl))
 309       #:phases
 310       (modify-phases %standard-phases
 311         ,@(if (%current-target-system)
 312               '((add-before
 313                     'configure 'set-cross-compile
 314                   (lambda* (#:key target outputs #:allow-other-keys)
 315                     (setenv "CROSS_COMPILE" (string-append target "-"))
 316                     (setenv "CONFIGURE_TARGET_ARCH"
 317                             (cond
 318                              ((string-prefix? "i686" target)
 319                               "linux-x86")
 320                              ((string-prefix? "x86_64" target)
 321                               "linux-x86_64")
 322                              ((string-prefix? "arm" target)
 323                               "linux-armv4")
 324                              ((string-prefix? "aarch64" target)
 325                               "linux-aarch64")))
 326                     #t)))
 327               '())
 328         (replace 'configure
 329           (lambda* (#:key outputs #:allow-other-keys)
 330             (let* ((out (assoc-ref outputs "out"))
 331                    (lib (string-append out "/lib")))
 332               ;; It's not a shebang so patch-source-shebangs misses it.
 333               (substitute* "config"
 334                 (("/usr/bin/env")
 335                  (string-append (assoc-ref %build-inputs "coreutils")
 336                                 "/bin/env")))
 337               (invoke ,@(if (%current-target-system)
 338                             '("./Configure")
 339                             '("./config"))
 340                       "shared"       ;build shared libraries
 341                       "--libdir=lib"
 342
 343                       ;; The default for this catch-all directory is
 344                       ;; PREFIX/ssl.  Change that to something more
 345                       ;; conventional.
 346                       (string-append "--openssldir=" out
 347                                      "/share/openssl-" ,version)
 348
 349                       (string-append "--prefix=" out)
 350                       (string-append "-Wl,-rpath," lib)
 351                       ,@(if (%current-target-system)
 352                             '((getenv "CONFIGURE_TARGET_ARCH"))
 353                             '())))))
 354         (add-after 'install 'move-static-libraries
 355           (lambda* (#:key outputs #:allow-other-keys)
 356             ;; Move static libraries to the "static" output.
 357             (let* ((out    (assoc-ref outputs "out"))
 358                    (lib    (string-append out "/lib"))
 359                    (static (assoc-ref outputs "static"))
 360                    (slib   (string-append static "/lib")))
 361               (for-each (lambda (file)
 362                           (install-file file slib)
 363                           (delete-file file))
 364                         (find-files lib "\\.a$"))
 365               #t)))
 366         (add-after 'install 'move-extra-documentation
 367           (lambda* (#:key outputs #:allow-other-keys)
 368                ;; Move man3 pages and full HTML documentation to "doc".
 369                (let* ((out    (assoc-ref outputs "out"))
 370                       (man3   (string-append out "/share/man/man3"))
 371                       (html (string-append out "/share/doc/openssl"))
 372                       (doc    (assoc-ref outputs "doc"))
 373                       (man-target (string-append doc "/share/man/man3"))
 374                       (html-target (string-append doc "/share/doc/openssl")))
 375                  (copy-recursively man3 man-target)
 376                  (delete-file-recursively man3)
 377                  (copy-recursively html html-target)
 378                  (delete-file-recursively html)
 379                  #t)))
 380         (add-after
 381          'install 'remove-miscellany
 382          (lambda* (#:key outputs #:allow-other-keys)
 383            ;; The 'misc' directory contains random undocumented shell and Perl
 384            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 385            (let ((out (assoc-ref outputs "out")))
 386              (delete-file-recursively (string-append out "/share/openssl-"
 387                                                      ,version "/misc"))
 388              #t))))))
 389    (native-search-paths
 390     (list (search-path-specification
 391            (variable "SSL_CERT_DIR")
 392            (separator #f)                        ;single entry
 393            (files '("etc/ssl/certs")))
 394           (search-path-specification
 395            (variable "SSL_CERT_FILE")
 396            (file-type 'regular)
 397            (separator #f)                        ;single entry
 398            (files '("etc/ssl/certs/ca-certificates.crt")))))
 399    (synopsis "SSL/TLS implementation")
 400    (description
 401     "OpenSSL is an implementation of SSL/TLS.")
 402    (license license:openssl)
 403    (home-page "https://www.openssl.org/")))
 404
 405 (define-public openssl-1.0
 406   (package
 407     (inherit openssl)
 408     (name "openssl")
 409     (version "1.0.2u")
 410     (source (origin
 411               (method url-fetch)
 412               (uri (list (string-append "https://www.openssl.org/source/openssl-"
 413                                         version ".tar.gz")
 414                          (string-append "ftp://ftp.openssl.org/source/"
 415                                         "openssl-" version ".tar.gz")
 416                          (string-append "ftp://ftp.openssl.org/source/old/"
 417                                         (string-trim-right version char-set:letter)
 418                                         "/openssl-" version ".tar.gz")))
 419               (sha256
 420                (base32
 421                 "05lxcs4hzyfqd5jn0d9p0fvqna62v2s4pc9qgmq0dpcknkzwdl7c"))
 422               (patches (search-patches "openssl-runpath.patch"
 423                                        "openssl-c-rehash-in.patch"))))
 424     (outputs '("out"
 425                "doc"                    ;1.5MiB of man3 pages
 426                "static"))               ;6MiB of .a files
 427     (arguments
 428      (substitute-keyword-arguments (package-arguments openssl)
 429        ;; Parallel build is not supported in 1.0.x.
 430        ((#:parallel-build? _ #f) #f)
 431        ((#:phases phases)
 432         `(modify-phases ,phases
 433            (add-before 'patch-source-shebangs 'patch-tests
 434              (lambda* (#:key inputs native-inputs #:allow-other-keys)
 435                (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 436                  (substitute* (find-files "test" ".*")
 437                    (("/bin/sh")
 438                     (string-append bash "/bin/sh"))
 439                    (("/bin/rm")
 440                     "rm"))
 441                  #t)))
 442            (add-before 'configure 'patch-Makefile.org
 443              (lambda* (#:key outputs #:allow-other-keys)
 444                ;; The default MANDIR is some unusual place.  Fix that.
 445                (let ((out (assoc-ref outputs "out")))
 446                  (patch-makefile-SHELL "Makefile.org")
 447                  (substitute* "Makefile.org"
 448                    (("^MANDIR[[:blank:]]*=.*$")
 449                     (string-append "MANDIR = " out "/share/man\n")))
 450                  #t)))
 451            (replace 'configure
 452              ;; Override this phase because OpenSSL 1.0 does not understand -rpath.
 453              (lambda* (#:key outputs #:allow-other-keys)
 454                (let ((out (assoc-ref outputs "out")))
 455                  (invoke ,@(if (%current-target-system)
 456                                '("./Configure")
 457                                '("./config"))
 458                          "shared"                 ;build shared libraries
 459                          "--libdir=lib"
 460
 461                          ;; The default for this catch-all directory is
 462                          ;; PREFIX/ssl.  Change that to something more
 463                          ;; conventional.
 464                          (string-append "--openssldir=" out
 465                                         "/share/openssl-" ,version)
 466
 467                          (string-append "--prefix=" out)
 468                          ,@(if (%current-target-system)
 469                                '((getenv "CONFIGURE_TARGET_ARCH"))
 470                                '())))))
 471         (delete 'move-extra-documentation)
 472         (add-after 'install 'move-man3-pages
 473           (lambda* (#:key outputs #:allow-other-keys)
 474             ;; Move section 3 man pages to "doc".
 475             (let* ((out    (assoc-ref outputs "out"))
 476                    (man3   (string-append out "/share/man/man3"))
 477                    (doc    (assoc-ref outputs "doc"))
 478                    (target (string-append doc "/share/man/man3")))
 479               (mkdir-p target)
 480               (for-each (lambda (file)
 481                           (rename-file file
 482                                        (string-append target "/"
 483                                                       (basename file))))
 484                         (find-files man3))
 485               (delete-file-recursively man3)
 486               #t)))
 487            ;; XXX: Duplicate this phase to make sure 'version' evaluates
 488            ;; in the current scope and not the inherited one.
 489            (replace 'remove-miscellany
 490              (lambda* (#:key outputs #:allow-other-keys)
 491                ;; The 'misc' directory contains random undocumented shell and Perl
 492                ;; scripts.  Remove them to avoid retaining a reference on Perl.
 493                (let ((out (assoc-ref outputs "out")))
 494                  (delete-file-recursively (string-append out "/share/openssl-"
 495                                                          ,version "/misc"))
 496                  #t)))))))))
 497
 498 (define-public libressl
 499   (package
 500     (name "libressl")
 501     (version "3.0.2")
 502     (source (origin
 503               (method url-fetch)
 504               (uri (string-append "mirror://openbsd/LibreSSL/"
 505                                   "libressl-" version ".tar.gz"))
 506               (sha256
 507                (base32
 508                 "13ir2lpxz8y1m151k7lrx306498nzfhwlvgkgv97v5cvywmifyyz"))))
 509     (build-system gnu-build-system)
 510     (arguments
 511      ;; Do as if 'getentropy' was missing since older Linux kernels lack it
 512      ;; and libc would return ENOSYS, which is not properly handled.
 513      ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
 514      '(#:configure-flags '("ac_cv_func_getentropy=no"
 515                            ;; Provide a TLS-enabled netcat.
 516                            "--enable-nc")))
 517     (native-search-paths
 518      (list (search-path-specification
 519             (variable "SSL_CERT_DIR")
 520             (separator #f)              ;single entry
 521             (files '("etc/ssl/certs")))
 522            (search-path-specification
 523             (variable "SSL_CERT_FILE")
 524             (separator #f)              ;single entry
 525             (files '("etc/ssl/certs/ca-certificates.crt")))))
 526     (home-page "https://www.libressl.org/")
 527     (synopsis "SSL/TLS implementation")
 528     (description "LibreSSL is a version of the TLS/crypto stack, forked from
 529 OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
 530 and applying best practice development processes.  This package also includes a
 531 netcat implementation that supports TLS.")
 532     ;; Files taken from OpenSSL keep their license, others are under various
 533     ;; non-copyleft licenses.
 534     (license (list license:openssl
 535                    (license:non-copyleft
 536                      "file://COPYING"
 537                      "See COPYING in the distribution.")))))
 538
 539 (define-public python-acme
 540   (package
 541     (name "python-acme")
 542     ;; Remember to update the hash of certbot when updating python-acme.
 543     (version "1.3.0")
 544     (source (origin
 545               (method url-fetch)
 546               (uri (pypi-uri "acme" version))
 547               (sha256
 548                (base32
 549                 "03fjmg0fgfy7xfn3i8rzn9i0i4amajmijkash84qb8mlphgrxpn0"))))
 550     (build-system python-build-system)
 551     (arguments
 552      `(#:phases
 553        (modify-phases %standard-phases
 554          (add-after 'build 'build-documentation
 555            (lambda _
 556              (invoke "make" "-C" "docs" "man" "info")))
 557          (add-after 'install 'install-documentation
 558            (lambda* (#:key outputs #:allow-other-keys)
 559              (let* ((out (assoc-ref outputs "out"))
 560                     (man (string-append out "/share/man/man1"))
 561                     (info (string-append out "/info")))
 562                (install-file "docs/_build/texinfo/acme-python.info" info)
 563                (install-file "docs/_build/man/acme-python.1" man)
 564                #t))))))
 565     ;; TODO: Add optional inputs for testing.
 566     (native-inputs
 567      `(("python-mock" ,python-mock)
 568        ("python-pytest" ,python-pytest)
 569        ;; For documentation
 570        ("python-sphinx" ,python-sphinx)
 571        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 572        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 573        ("texinfo" ,texinfo)))
 574     (propagated-inputs
 575      `(("python-josepy" ,python-josepy)
 576        ("python-six" ,python-six)
 577        ("python-requests" ,python-requests)
 578        ("python-requests-toolbelt" ,python-requests-toolbelt)
 579        ("python-pytz" ,python-pytz)
 580        ("python-pyrfc3339" ,python-pyrfc3339)
 581        ("python-pyasn1" ,python-pyasn1)
 582        ("python-cryptography" ,python-cryptography)
 583        ("python-pyopenssl" ,python-pyopenssl)))
 584     (home-page "https://github.com/certbot/certbot")
 585     (synopsis "ACME protocol implementation in Python")
 586     (description "ACME protocol implementation in Python")
 587     (license license:asl2.0)))
 588
 589 (define-public certbot
 590   (package
 591     (name "certbot")
 592     ;; Certbot and python-acme are developed in the same repository, and their
 593     ;; versions should remain synchronized.
 594     (version (package-version python-acme))
 595     (source (origin
 596               (method url-fetch)
 597               (uri (pypi-uri "certbot" version))
 598               (sha256
 599                (base32
 600                 "1n5i0k6kwmd6wvivshfl3k4djwcpwx390c39xmr2hhrgpk5r285w"))))
 601     (build-system python-build-system)
 602     (arguments
 603      `(,@(substitute-keyword-arguments (package-arguments python-acme)
 604            ((#:phases phases)
 605             `(modify-phases ,phases
 606               (replace 'install-documentation
 607                 (lambda* (#:key outputs #:allow-other-keys)
 608                   (let* ((out (assoc-ref outputs "out"))
 609                          (man1 (string-append out "/share/man/man1"))
 610                          (man7 (string-append out "/share/man/man7"))
 611                          (info (string-append out "/info")))
 612                     (install-file "docs/_build/texinfo/Certbot.info" info)
 613                     (install-file "docs/_build/man/certbot.1" man1)
 614                     (install-file "docs/_build/man/certbot.7" man7)
 615                     #t))))))))
 616     ;; TODO: Add optional inputs for testing.
 617     (native-inputs
 618      `(("python-mock" ,python-mock)
 619        ("python-pytest" ,python-pytest)
 620        ;; For documentation
 621        ("python-sphinx" ,python-sphinx)
 622        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 623        ("python-sphinx-repoze-autointerface" ,python-sphinx-repoze-autointerface)
 624        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 625        ("texinfo" ,texinfo)))
 626     (propagated-inputs
 627      `(("python-acme" ,python-acme)
 628        ("python-cryptography" ,python-cryptography)
 629        ("python-zope-interface" ,python-zope-interface)
 630        ("python-pyrfc3339" ,python-pyrfc3339)
 631        ("python-pyopenssl" ,python-pyopenssl)
 632        ("python-configobj" ,python-configobj)
 633        ("python-configargparse" ,python-configargparse)
 634        ("python-distro" ,python-distro)
 635        ("python-zope-component" ,python-zope-component)
 636        ("python-parsedatetime" ,python-parsedatetime)
 637        ("python-six" ,python-six)
 638        ("python-psutil" ,python-psutil)
 639        ("python-requests" ,python-requests)
 640        ("python-pytz" ,python-pytz)))
 641     (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
 642     (description "Certbot automatically receives and installs X.509 certificates
 643 to enable Transport Layer Security (TLS) on servers.  It interoperates with the
 644 Let’s Encrypt certificate authority (CA), which issues browser-trusted
 645 certificates for free.")
 646     (home-page "https://certbot.eff.org/")
 647     (license license:asl2.0)))
 648
 649 (define-public letsencrypt
 650   (package (inherit certbot)
 651     (name "letsencrypt")
 652     (properties `((superseded . ,certbot)))))
 653
 654 (define-public perl-net-ssleay
 655   (package
 656     (name "perl-net-ssleay")
 657     (version "1.88")
 658     (source (origin
 659               (method url-fetch)
 660               (uri (string-append "mirror://cpan/authors/id/C/CH/CHRISN/"
 661                                   "Net-SSLeay-" version ".tar.gz"))
 662               (sha256
 663                (base32
 664                 "1pfgh4h3szcpvqlcimc60pjbk9zwls99x5863sva0wc47i4dl010"))))
 665     (build-system perl-build-system)
 666     (inputs `(("openssl" ,openssl)))
 667     (arguments
 668      `(#:phases
 669        (modify-phases %standard-phases
 670          (add-before
 671           'configure 'set-ssl-prefix
 672           (lambda* (#:key inputs #:allow-other-keys)
 673             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 674             #t)))))
 675     (synopsis "Perl extension for using OpenSSL")
 676     (description
 677      "This module offers some high level convenience functions for accessing
 678 web pages on SSL servers (for symmetry, the same API is offered for accessing
 679 http servers, too), an sslcat() function for writing your own clients, and
 680 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 681 servers or clients for more complicated applications.")
 682     (license license:perl-license)
 683     (home-page "https://metacpan.org/release/Net-SSLeay")))
 684
 685 (define-public perl-crypt-openssl-rsa
 686  (package
 687   (name "perl-crypt-openssl-rsa")
 688   (version "0.31")
 689   (source
 690     (origin
 691       (method url-fetch)
 692       (uri (string-append
 693              "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
 694              version
 695              ".tar.gz"))
 696       (sha256
 697         (base32
 698           "0djl5i6kibl7862b6ih29q8dhg5zpwzq77q9j8hp6xngshx40ws1"))))
 699   (build-system perl-build-system)
 700   (native-inputs
 701    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 702   (inputs
 703     `(("perl-crypt-openssl-bignum" ,perl-crypt-openssl-bignum)
 704       ("perl-crypt-openssl-random" ,perl-crypt-openssl-random)
 705       ("openssl" ,openssl)))
 706   (arguments perl-crypt-arguments)
 707   (home-page
 708     "https://metacpan.org/release/Crypt-OpenSSL-RSA")
 709   (synopsis
 710     "RSA encoding and decoding, using the openSSL libraries")
 711   (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
 712 OpenSSL libraries).")
 713   (license license:perl-license)))
 714
 715 (define perl-crypt-arguments
 716    `(#:phases (modify-phases %standard-phases
 717       (add-before 'configure 'patch-Makefile.PL
 718         (lambda* (#:key inputs #:allow-other-keys)
 719           (substitute* "Makefile.PL"
 720             (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
 721                                              (assoc-ref inputs "openssl")
 722                                              "/lib -lcrypto'],")))
 723           #t)))))
 724
 725 (define-public perl-crypt-openssl-bignum
 726  (package
 727   (name "perl-crypt-openssl-bignum")
 728   (version "0.09")
 729   (source
 730     (origin
 731       (method url-fetch)
 732       (uri (string-append
 733              "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
 734              version
 735              ".tar.gz"))
 736       (sha256
 737         (base32
 738           "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
 739   (build-system perl-build-system)
 740   (inputs `(("openssl" ,openssl)))
 741   (arguments perl-crypt-arguments)
 742   (home-page
 743     "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
 744   (synopsis
 745     "OpenSSL's multiprecision integer arithmetic in Perl")
 746   (description "Crypt::OpenSSL::Bignum provides multiprecision integer
 747 arithmetic in Perl.")
 748   ;; At your option either gpl1+ or the Artistic License
 749   (license license:perl-license)))
 750
 751 (define-public perl-crypt-openssl-guess
 752   (package
 753     (name "perl-crypt-openssl-guess")
 754     (version "0.11")
 755     (source
 756      (origin
 757        (method url-fetch)
 758        (uri (string-append
 759              "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
 760              version ".tar.gz"))
 761        (sha256
 762         (base32
 763          "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
 764     (build-system perl-build-system)
 765     (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
 766     (synopsis "Guess the OpenSSL include path")
 767     (description
 768      "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
 769 correct OpenSSL include path.  It is intended for use in your
 770 @file{Makefile.PL}.")
 771     (license license:perl-license)))
 772
 773 (define-public perl-crypt-openssl-random
 774  (package
 775   (name "perl-crypt-openssl-random")
 776   (version "0.15")
 777   (source
 778     (origin
 779       (method url-fetch)
 780       (uri (string-append
 781              "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
 782              version
 783              ".tar.gz"))
 784       (sha256
 785         (base32 "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh"))))
 786   (build-system perl-build-system)
 787   (native-inputs
 788    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 789   (inputs
 790    `(("openssl" ,openssl)))
 791   (arguments perl-crypt-arguments)
 792   (home-page
 793     "https://metacpan.org/release/Crypt-OpenSSL-Random")
 794   (synopsis
 795     "OpenSSL/LibreSSL pseudo-random number generator access")
 796   (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
 797 number generator")
 798   (license license:perl-license)))
 799
 800 (define-public acme-client
 801   (package
 802     (name "acme-client")
 803     (version "0.1.16")
 804     (source (origin
 805               (method url-fetch)
 806               (uri (string-append "https://kristaps.bsd.lv/" name "/"
 807                                   "snapshots/" name "-portable-"
 808                                   version ".tgz"))
 809               (sha256
 810                (base32
 811                 "00q05b3b1dfnfp7sr1nbd212n0mqrycl3cr9lbs51m7ncaihbrz9"))))
 812     (build-system gnu-build-system)
 813     (arguments
 814      '(#:tests? #f ; no test suite
 815        #:make-flags
 816        (list "CC=gcc"
 817              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 818        #:phases
 819        (modify-phases %standard-phases
 820          (add-after 'unpack 'patch-paths
 821            (lambda* (#:key inputs #:allow-other-keys)
 822              (let ((pem (string-append (assoc-ref inputs "libressl")
 823                                        "/etc/ssl/cert.pem")))
 824                (substitute* "http.c"
 825                  (("/etc/ssl/cert.pem") pem))
 826                #t)))
 827          (delete 'configure)))) ; no './configure' script
 828     (native-inputs
 829      `(("pkg-config" ,pkg-config)))
 830     (inputs
 831      `(("libbsd" ,libbsd)
 832        ("libressl" ,libressl)))
 833     (synopsis "Let's Encrypt client by the OpenBSD project")
 834     (description "acme-client is a Let's Encrypt client implemented in C.  It
 835 uses a modular design, and attempts to secure itself by dropping privileges and
 836 operating in a chroot where possible.  acme-client is developed on OpenBSD and
 837 then ported to the GNU / Linux environment.")
 838     (home-page "https://kristaps.bsd.lv/acme-client/")
 839     ;; acme-client is distributed under the ISC license, but the files 'jsmn.h'
 840     ;; and 'jsmn.c' are distributed under the Expat license.
 841     (license (list license:isc license:expat))))
 842
 843 ;; The "-apache" variant is the upstreamed prefered variant. A "-gpl"
 844 ;; variant exists in addition to the "-apache" one.
 845 (define-public mbedtls-apache
 846   (package
 847     (name "mbedtls-apache")
 848     (version "2.16.5")
 849     (source
 850      (origin
 851        (method url-fetch)
 852        ;; XXX: The download links on the website are script redirection links
 853        ;; which effectively lead to the format listed in the uri here.
 854        (uri (string-append "https://tls.mbed.org/download/mbedtls-"
 855                            version "-apache.tgz"))
 856        (sha256
 857         (base32
 858          "0kdhwy241xsk4isbadqx6z80m8sf76da5sbmqv8qy11yr37cdd35"))))
 859     (build-system cmake-build-system)
 860     (arguments
 861      `(#:configure-flags
 862        (list "-DUSE_SHARED_MBEDTLS_LIBRARY=ON"
 863              "-DUSE_STATIC_MBEDTLS_LIBRARY=OFF")))
 864     (native-inputs
 865      `(("perl" ,perl)
 866        ("python" ,python)))
 867     (synopsis "Small TLS library")
 868     (description
 869      "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
 870 for developers to include cryptographic and SSL/TLS capabilities in their
 871 (embedded) products, facilitating this functionality with a minimal
 872 coding footprint.")
 873     (home-page "https://tls.mbed.org")
 874     (license license:asl2.0)))
 875
 876 ;; The Hiawatha Web server requires some specific features to be enabled.
 877 (define-public mbedtls-for-hiawatha
 878   (hidden-package
 879    (package
 880      (inherit mbedtls-apache)
 881      (arguments
 882       (substitute-keyword-arguments
 883           `(#:phases
 884             (modify-phases %standard-phases
 885               (add-after 'configure 'configure-extra-features
 886                 (lambda _
 887                   (for-each (lambda (feature)
 888                               (invoke "scripts/config.pl" "set" feature))
 889                             (list "MBEDTLS_THREADING_C"
 890                                   "MBEDTLS_THREADING_PTHREAD"))
 891                   #t)))
 892             ,@(package-arguments mbedtls-apache)))))))
 893
 894 (define-public dehydrated
 895   (package
 896     (name "dehydrated")
 897     (version "0.6.5")
 898     (source (origin
 899               (method url-fetch)
 900               (uri (string-append
 901                     "https://github.com/dehydrated-io/dehydrated/releases/download/"
 902                     "v" version "/dehydrated-" version ".tar.gz"))
 903               (sha256
 904                (base32
 905                 "0dgskgbdd95p13jx6s13p77y15wngb5cm6p4305cf2s54w0bvahh"))))
 906     (build-system trivial-build-system)
 907     (arguments
 908      `(#:modules ((guix build utils)
 909                   (srfi srfi-26))
 910        #:builder
 911        (begin
 912          (use-modules (guix build utils)
 913                       (srfi srfi-26))
 914          (let* ((source (assoc-ref %build-inputs "source"))
 915                 (tar (assoc-ref %build-inputs "tar"))
 916                 (gz  (assoc-ref %build-inputs "gzip"))
 917                 (out (assoc-ref %outputs "out"))
 918                 (bin (string-append out "/bin"))
 919                 (doc (string-append out "/share/doc/" ,name "-" ,version))
 920                 (man (string-append out "/share/man"))
 921                 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
 922
 923            (setenv "PATH" (string-append gz "/bin"))
 924            (invoke (string-append tar "/bin/tar") "xvf" source)
 925            (chdir (string-append ,name "-" ,version))
 926
 927            (copy-recursively "docs" doc)
 928            (install-file "LICENSE" doc)
 929
 930            (mkdir-p man)
 931            (rename-file (string-append doc "/man")
 932                         (string-append man "/man1"))
 933            (for-each (cut invoke "gzip" "-9" <>)
 934                      (find-files man ".*"))
 935
 936            (install-file "dehydrated" bin)
 937            (with-directory-excursion bin
 938              (patch-shebang "dehydrated" (list bash))
 939
 940              ;; Do not try to write to the store.
 941              (substitute* "dehydrated"
 942                (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
 943
 944              (setenv "PATH" bash)
 945              (wrap-program "dehydrated"
 946                `("PATH" ":" prefix
 947                  ,(map (lambda (dir)
 948                          (string-append dir "/bin"))
 949                        (map (lambda (input)
 950                               (assoc-ref %build-inputs input))
 951                             '("coreutils"
 952                               "curl"
 953                               "diffutils"
 954                               "gawk"
 955                               "grep"
 956                               "openssl"
 957                               "sed"))))))
 958            #t))))
 959     (inputs
 960      `(("bash" ,bash)
 961        ("coreutils" ,coreutils)
 962        ("curl" ,curl)
 963        ("diffutils" ,diffutils)
 964        ("gawk" ,gawk)
 965        ("grep" ,grep)
 966        ("openssl" ,openssl)
 967        ("sed" ,sed)))
 968     (native-inputs
 969      `(("gzip" ,gzip)
 970        ("tar" ,tar)))
 971     (home-page "https://dehydrated.io/")
 972     (synopsis "Let's Encrypt/ACME client implemented as a shell script")
 973     (description "Dehydrated is a client for signing certificates with an
 974 ACME-server (currently only provided by Let's Encrypt) implemented as a
 975 relatively simple Bash script.")
 976     (license license:expat)))
 977
 978 (define-public go-github-com-certifi-gocertifi
 979   (let ((commit "a5e0173ced670013bfb649c7e806bc9529c986ec")
 980         (revision "1"))
 981     (package
 982       (name "go-github-com-certifi-gocertifi")
 983       (version (git-version "2018.01.18" revision commit))
 984       (source (origin
 985                 (method git-fetch)
 986                 (uri (git-reference
 987                        (url "https://github.com/certifi/gocertifi")
 988                        (commit commit)))
 989                 (file-name (git-file-name name version))
 990                 (sha256
 991                  (base32
 992                   "1n9drccl3q1rr8wg3nf60slkf1lgsmz5ahifrglbdrc6har3rryj"))))
 993       (build-system go-build-system)
 994       (arguments
 995        '(#:import-path "github.com/certifi/gocertifi"))
 996       (synopsis "X.509 TLS root certificate bundle for Go")
 997       (description "This package is a Go language X.509 TLS root certificate bundle,
 998 derived from Mozilla's collection.")
 999       (home-page "https://certifi.io")
1000       (license license:mpl2.0))))