gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016, 2017, 2018 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015, 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016, 2017, 2019 Efraim Flashner <efraim@flashner.co.il>
   9 ;;; Copyright © 2016, 2017, 2018 ng0 <ng0@n0.is>
  10 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017, 2018, 2019, 2020 Marius Bakke <mbakke@fastmail.com>
  13 ;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
  14 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
  15 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
  16 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
  17 ;;;
  18 ;;; This file is part of GNU Guix.
  19 ;;;
  20 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  21 ;;; under the terms of the GNU General Public License as published by
  22 ;;; the Free Software Foundation; either version 3 of the License, or (at
  23 ;;; your option) any later version.
  24 ;;;
  25 ;;; GNU Guix is distributed in the hope that it will be useful, but
  26 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  27 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28 ;;; GNU General Public License for more details.
  29 ;;;
  30 ;;; You should have received a copy of the GNU General Public License
  31 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  32
  33 (define-module (gnu packages tls)
  34   #:use-module ((guix licenses) #:prefix license:)
  35   #:use-module (guix packages)
  36   #:use-module (guix download)
  37   #:use-module (guix git-download)
  38   #:use-module (guix utils)
  39   #:use-module (guix build-system gnu)
  40   #:use-module (guix build-system go)
  41   #:use-module (guix build-system perl)
  42   #:use-module (guix build-system python)
  43   #:use-module (guix build-system cmake)
  44   #:use-module (guix build-system trivial)
  45   #:use-module (gnu packages compression)
  46   #:use-module (gnu packages)
  47   #:use-module (gnu packages bash)
  48   #:use-module (gnu packages check)
  49   #:use-module (gnu packages curl)
  50   #:use-module (gnu packages dns)
  51   #:use-module (gnu packages gawk)
  52   #:use-module (gnu packages guile)
  53   #:use-module (gnu packages libbsd)
  54   #:use-module (gnu packages libffi)
  55   #:use-module (gnu packages libidn)
  56   #:use-module (gnu packages linux)
  57   #:use-module (gnu packages ncurses)
  58   #:use-module (gnu packages nettle)
  59   #:use-module (gnu packages perl)
  60   #:use-module (gnu packages pkg-config)
  61   #:use-module (gnu packages python)
  62   #:use-module (gnu packages python-crypto)
  63   #:use-module (gnu packages python-web)
  64   #:use-module (gnu packages python-xyz)
  65   #:use-module (gnu packages sphinx)
  66   #:use-module (gnu packages texinfo)
  67   #:use-module (gnu packages time)
  68   #:use-module (gnu packages base)
  69   #:use-module (srfi srfi-1))
  70
  71 (define-public libtasn1
  72   (package
  73     (name "libtasn1")
  74     (version "4.16.0")
  75     (source
  76      (origin
  77       (method url-fetch)
  78       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  79                           version ".tar.gz"))
  80       (sha256
  81        (base32
  82         "179jskl7dmfp1rd2khkzmlibzgki4wi6hvmmwfv7q49r728b03qf"))))
  83     (build-system gnu-build-system)
  84     (arguments
  85      `(#:configure-flags '("--disable-static")))
  86     (native-inputs `(("perl" ,perl)))
  87     (home-page "https://www.gnu.org/software/libtasn1/")
  88     (synopsis "ASN.1 library")
  89     (description
  90      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  91 for transmitting machine-neutral encodings of data objects in computer
  92 networking, allowing for formal validation of data according to some
  93 specifications.")
  94     (license license:lgpl2.0+)))
  95
  96 (define-public asn1c
  97   (package
  98     (name "asn1c")
  99     (version "0.9.28")
 100     (source (origin
 101       (method url-fetch)
 102       (uri (string-append "https://lionet.info/soft/asn1c-"
 103                           version ".tar.gz"))
 104       (sha256
 105        (base32
 106         "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
 107     (build-system gnu-build-system)
 108     (native-inputs
 109      `(("perl" ,perl)))
 110     (home-page "https://lionet.info/asn1c")
 111     (synopsis "ASN.1 to C compiler")
 112     (description "The ASN.1 to C compiler takes ASN.1 module
 113 files and generates C++ compatible C source code.  That code can be
 114 used to serialize the native C structures into compact and unambiguous
 115 BER/XER/PER-based data files, and deserialize the files back.
 116
 117 Various ASN.1 based formats are widely used in the industry, such as to encode
 118 the X.509 certificates employed in the HTTPS handshake, to exchange control
 119 data between mobile phones and cellular networks, to car-to-car communication
 120 in intelligent transportation networks.")
 121     (license license:bsd-2)))
 122
 123 (define-public p11-kit
 124   (package
 125     (name "p11-kit")
 126     (version "0.23.20")
 127     (source
 128      (origin
 129       (method url-fetch)
 130       (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
 131                           "download/" version "/p11-kit-" version ".tar.xz"))
 132       (sha256
 133        (base32
 134         "0131maw666ha4d6iyj13fkz18c4pnb3lw2xwv5kvkmnzqcj61n0l"))))
 135     (build-system gnu-build-system)
 136     (native-inputs
 137      `(("pkg-config" ,pkg-config)))
 138     (inputs
 139      `(("libffi" ,libffi)
 140        ("libtasn1" ,libtasn1)))
 141     (arguments
 142      `(#:configure-flags '("--without-trust-paths")
 143        #:phases (modify-phases %standard-phases
 144                   (add-before 'check 'prepare-tests
 145                     (lambda _
 146                       ;; "test-runtime" expects XDG_RUNTIME_DIR to be set up
 147                       ;; and looks for .cache and other directories (only).
 148                       ;; For simplicity just drop it since it is irrelevant
 149                       ;; in the build container.
 150                       (substitute* "Makefile"
 151                         (("test-runtime\\$\\(EXEEXT\\)") ""))
 152                       #t)))))
 153     (home-page "https://p11-glue.freedesktop.org/p11-kit.html")
 154     (synopsis "PKCS#11 library")
 155     (description
 156      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 157 provides a standard configuration setup for installing PKCS#11 modules
 158 in such a way that they are discoverable.  It also solves problems with
 159 coordinating the use of PKCS#11 by different components or libraries
 160 living in the same process.")
 161     (license license:bsd-3)))
 162
 163 (define-public gnutls
 164   (package
 165     (name "gnutls")
 166     (version "3.6.12")
 167     (source (origin
 168              (method url-fetch)
 169              (uri
 170               ;; Note: Releases are no longer on ftp.gnu.org since the
 171               ;; schism (after version 3.1.5).
 172               (string-append "mirror://gnupg/gnutls/v"
 173                              (version-major+minor version)
 174                              "/gnutls-" version ".tar.xz"))
 175              (patches (search-patches "gnutls-skip-trust-store-test.patch"))
 176              (sha256
 177               (base32
 178                "0jvca1qahn9lrwv6f5kfs95icirc15b2a8x9fzczyj996ipg3b5z"))))
 179     (build-system gnu-build-system)
 180     (arguments
 181      `(; Ensure we don't keep a reference to this buggy software.
 182        #:disallowed-references (,net-tools)
 183        #:configure-flags
 184        (list
 185              ;; GnuTLS doesn't consult any environment variables to specify
 186              ;; the location of the system-wide trust store.  Instead it has a
 187              ;; configure-time option.  Unless specified, its configure script
 188              ;; attempts to auto-detect the location by looking for common
 189              ;; places in the file system, none of which are present in our
 190              ;; chroot build environment.  If not found, then no default trust
 191              ;; store is used, so each program has to provide its own
 192              ;; fallback, and users have to configure each program
 193              ;; independently.  This seems suboptimal.
 194              "--with-default-trust-store-dir=/etc/ssl/certs"
 195
 196              ;; Tell the build system that we want Guile bindings installed to
 197              ;; the output instead of Guiles own module directory.
 198              (string-append "--with-guile-site-dir="
 199                             "$(datarootdir)/guile/site/$(GUILE_EFFECTIVE_VERSION)")
 200              (string-append "--with-guile-site-ccache-dir="
 201                             "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/site-ccache")
 202              (string-append "--with-guile-extension-dir="
 203                             "$(libdir)/guile/$(GUILE_EFFECTIVE_VERSION)/extensions")
 204
 205              ;; FIXME: Temporarily disable p11-kit support since it is not
 206              ;; working on mips64el.
 207              "--without-p11-kit")
 208
 209        #:phases (modify-phases %standard-phases
 210                   (add-after
 211                    'install 'move-doc
 212                    (lambda* (#:key outputs #:allow-other-keys)
 213                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 214                      (let* ((out    (assoc-ref outputs "out"))
 215                             (doc    (assoc-ref outputs "doc"))
 216                             (mandir (string-append doc "/share/man/man3"))
 217                             (oldman (string-append out "/share/man/man3")))
 218                        (mkdir-p mandir)
 219                        (copy-recursively oldman mandir)
 220                        (delete-file-recursively oldman)
 221                        #t))))))
 222     (outputs '("out"                              ;4.4 MiB
 223                "debug"
 224                "doc"))                            ;4.1 MiB of man pages
 225     (native-inputs
 226      `(("net-tools" ,net-tools)
 227        ("pkg-config" ,pkg-config)
 228        ("which" ,which)
 229        ("datefudge" ,datefudge)                   ;tests rely on 'datefudge'
 230        ("util-linux" ,util-linux)))               ;one test needs 'setsid'
 231     (inputs
 232      `(("guile" ,guile-3.0)))
 233     (propagated-inputs
 234      ;; These are all in the 'Requires.private' field of gnutls.pc.
 235      `(("libtasn1" ,libtasn1)
 236        ("libidn2" ,libidn2)
 237        ("nettle" ,nettle)
 238        ("zlib" ,zlib)))
 239     (home-page "https://www.gnu.org/software/gnutls/")
 240     (synopsis "Transport layer security library")
 241     (description
 242      "GnuTLS is a secure communications library implementing the SSL, TLS
 243 and DTLS protocols.  It is provided in the form of a C library to support the
 244 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 245 required structures.")
 246     (license license:lgpl2.1+)
 247     (properties '((ftp-server . "ftp.gnutls.org")
 248                   (ftp-directory . "/gcrypt/gnutls")))))
 249
 250 (define-public gnutls/guile-2.0
 251   ;; GnuTLS for Guile 2.0.
 252   (package
 253     (inherit gnutls)
 254     (name "guile2.0-gnutls")
 255     (inputs `(("guile" ,guile-2.0)
 256               ,@(alist-delete "guile" (package-inputs gnutls))))))
 257
 258 (define-public gnutls/dane
 259   ;; GnuTLS with build libgnutls-dane, implementing DNS-based
 260   ;; Authentication of Named Entities.  This is required for GNS functionality
 261   ;; by GNUnet and gnURL.  This is done in an extra package definition
 262   ;; to have the choice between GnuTLS with Dane and without Dane.
 263   (package
 264     (inherit gnutls)
 265     (name "gnutls-dane")
 266     (inputs `(("unbound" ,unbound)
 267               ,@(package-inputs gnutls)))))
 268
 269 (define-public guile2.2-gnutls
 270   (package
 271     (inherit gnutls)
 272     (name "guile2.2-gnutls")
 273     (inputs `(("guile" ,guile-2.2)
 274               ,@(alist-delete "guile"
 275                               (package-inputs gnutls))))))
 276
 277 (define-public guile3.0-gnutls
 278   (deprecated-package "guile3.0-gnutls" gnutls))
 279
 280 (define-public openssl
 281   (package
 282    (name "openssl")
 283    (version "1.1.1d")
 284    (replacement openssl-1.1.1e)
 285    (source (origin
 286              (method url-fetch)
 287              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 288                                        version ".tar.gz")
 289                         (string-append "ftp://ftp.openssl.org/source/"
 290                                        "openssl-" version ".tar.gz")
 291                         (string-append "ftp://ftp.openssl.org/source/old/"
 292                                        (string-trim-right version char-set:letter)
 293                                        "/openssl-" version ".tar.gz")))
 294              (sha256
 295               (base32
 296                "1whinyw402z3b9xlb3qaxv4b9sk4w1bgh9k0y8df1z4x3yy92fhy"))
 297              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))))
 298    (build-system gnu-build-system)
 299    (outputs '("out"
 300               "doc"         ;6.8 MiB of man3 pages and full HTML documentation
 301               "static"))    ;6.4 MiB of .a files
 302    (native-inputs `(("perl" ,perl)))
 303    (arguments
 304     `(#:parallel-tests? #f
 305       #:test-target "test"
 306
 307       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
 308       ;; so we explicitly disallow it here.
 309       #:disallowed-references ,(list (canonical-package perl))
 310       #:phases
 311       (modify-phases %standard-phases
 312         ,@(if (%current-target-system)
 313               '((add-before
 314                     'configure 'set-cross-compile
 315                   (lambda* (#:key target outputs #:allow-other-keys)
 316                     (setenv "CROSS_COMPILE" (string-append target "-"))
 317                     (setenv "CONFIGURE_TARGET_ARCH"
 318                             (cond
 319                              ((string-prefix? "i686" target)
 320                               "linux-x86")
 321                              ((string-prefix? "x86_64" target)
 322                               "linux-x86_64")
 323                              ((string-prefix? "arm" target)
 324                               "linux-armv4")
 325                              ((string-prefix? "aarch64" target)
 326                               "linux-aarch64")))
 327                     #t)))
 328               '())
 329         (replace 'configure
 330           (lambda* (#:key outputs #:allow-other-keys)
 331             (let* ((out (assoc-ref outputs "out"))
 332                    (lib (string-append out "/lib")))
 333               ;; It's not a shebang so patch-source-shebangs misses it.
 334               (substitute* "config"
 335                 (("/usr/bin/env")
 336                  (string-append (assoc-ref %build-inputs "coreutils")
 337                                 "/bin/env")))
 338               (invoke ,@(if (%current-target-system)
 339                             '("./Configure")
 340                             '("./config"))
 341                       "shared"       ;build shared libraries
 342                       "--libdir=lib"
 343
 344                       ;; The default for this catch-all directory is
 345                       ;; PREFIX/ssl.  Change that to something more
 346                       ;; conventional.
 347                       (string-append "--openssldir=" out
 348                                      "/share/openssl-" ,version)
 349
 350                       (string-append "--prefix=" out)
 351                       (string-append "-Wl,-rpath," lib)
 352                       ,@(if (%current-target-system)
 353                             '((getenv "CONFIGURE_TARGET_ARCH"))
 354                             '())))))
 355         (add-after 'install 'move-static-libraries
 356           (lambda* (#:key outputs #:allow-other-keys)
 357             ;; Move static libraries to the "static" output.
 358             (let* ((out    (assoc-ref outputs "out"))
 359                    (lib    (string-append out "/lib"))
 360                    (static (assoc-ref outputs "static"))
 361                    (slib   (string-append static "/lib")))
 362               (for-each (lambda (file)
 363                           (install-file file slib)
 364                           (delete-file file))
 365                         (find-files lib "\\.a$"))
 366               #t)))
 367         (add-after 'install 'move-extra-documentation
 368           (lambda* (#:key outputs #:allow-other-keys)
 369                ;; Move man3 pages and full HTML documentation to "doc".
 370                (let* ((out    (assoc-ref outputs "out"))
 371                       (man3   (string-append out "/share/man/man3"))
 372                       (html (string-append out "/share/doc/openssl"))
 373                       (doc    (assoc-ref outputs "doc"))
 374                       (man-target (string-append doc "/share/man/man3"))
 375                       (html-target (string-append doc "/share/doc/openssl")))
 376                  (copy-recursively man3 man-target)
 377                  (delete-file-recursively man3)
 378                  (copy-recursively html html-target)
 379                  (delete-file-recursively html)
 380                  #t)))
 381         (add-after
 382          'install 'remove-miscellany
 383          (lambda* (#:key outputs #:allow-other-keys)
 384            ;; The 'misc' directory contains random undocumented shell and Perl
 385            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 386            (let ((out (assoc-ref outputs "out")))
 387              (delete-file-recursively (string-append out "/share/openssl-"
 388                                                      ,version "/misc"))
 389              #t))))))
 390    (native-search-paths
 391     (list (search-path-specification
 392            (variable "SSL_CERT_DIR")
 393            (separator #f)                        ;single entry
 394            (files '("etc/ssl/certs")))
 395           (search-path-specification
 396            (variable "SSL_CERT_FILE")
 397            (file-type 'regular)
 398            (separator #f)                        ;single entry
 399            (files '("etc/ssl/certs/ca-certificates.crt")))))
 400    (synopsis "SSL/TLS implementation")
 401    (description
 402     "OpenSSL is an implementation of SSL/TLS.")
 403    (license license:openssl)
 404    (home-page "https://www.openssl.org/")))
 405
 406 (define openssl-1.1.1e
 407   (package
 408    (inherit openssl)
 409    (version "1.1.1e")
 410    (source (origin
 411              (method url-fetch)
 412              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 413                                        version ".tar.gz")
 414                         (string-append "ftp://ftp.openssl.org/source/"
 415                                        "openssl-" version ".tar.gz")
 416                         (string-append "ftp://ftp.openssl.org/source/old/"
 417                                        (string-trim-right version char-set:letter)
 418                                        "/openssl-" version ".tar.gz")))
 419              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
 420              (sha256
 421               (base32
 422                "1gnwlri1dphr5wdzmg9vlhkh6aq2yqgpfkpmffzwjlfb26n62kv9"))))))
 423
 424 (define-public openssl-1.0
 425   (package
 426     (inherit openssl)
 427     (name "openssl")
 428     (version "1.0.2u")
 429     (source (origin
 430               (method url-fetch)
 431               (uri (list (string-append "https://www.openssl.org/source/openssl-"
 432                                         version ".tar.gz")
 433                          (string-append "ftp://ftp.openssl.org/source/"
 434                                         "openssl-" version ".tar.gz")
 435                          (string-append "ftp://ftp.openssl.org/source/old/"
 436                                         (string-trim-right version char-set:letter)
 437                                         "/openssl-" version ".tar.gz")))
 438               (sha256
 439                (base32
 440                 "05lxcs4hzyfqd5jn0d9p0fvqna62v2s4pc9qgmq0dpcknkzwdl7c"))
 441               (patches (search-patches "openssl-runpath.patch"
 442                                        "openssl-c-rehash-in.patch"))))
 443     (outputs '("out"
 444                "doc"                    ;1.5MiB of man3 pages
 445                "static"))               ;6MiB of .a files
 446     (arguments
 447      (substitute-keyword-arguments (package-arguments openssl)
 448        ;; Parallel build is not supported in 1.0.x.
 449        ((#:parallel-build? _ #f) #f)
 450        ((#:phases phases)
 451         `(modify-phases ,phases
 452            (add-before 'patch-source-shebangs 'patch-tests
 453              (lambda* (#:key inputs native-inputs #:allow-other-keys)
 454                (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 455                  (substitute* (find-files "test" ".*")
 456                    (("/bin/sh")
 457                     (string-append bash "/bin/sh"))
 458                    (("/bin/rm")
 459                     "rm"))
 460                  #t)))
 461            (add-before 'configure 'patch-Makefile.org
 462              (lambda* (#:key outputs #:allow-other-keys)
 463                ;; The default MANDIR is some unusual place.  Fix that.
 464                (let ((out (assoc-ref outputs "out")))
 465                  (patch-makefile-SHELL "Makefile.org")
 466                  (substitute* "Makefile.org"
 467                    (("^MANDIR[[:blank:]]*=.*$")
 468                     (string-append "MANDIR = " out "/share/man\n")))
 469                  #t)))
 470            (replace 'configure
 471              ;; Override this phase because OpenSSL 1.0 does not understand -rpath.
 472              (lambda* (#:key outputs #:allow-other-keys)
 473                (let ((out (assoc-ref outputs "out")))
 474                  (invoke ,@(if (%current-target-system)
 475                                '("./Configure")
 476                                '("./config"))
 477                          "shared"                 ;build shared libraries
 478                          "--libdir=lib"
 479
 480                          ;; The default for this catch-all directory is
 481                          ;; PREFIX/ssl.  Change that to something more
 482                          ;; conventional.
 483                          (string-append "--openssldir=" out
 484                                         "/share/openssl-" ,version)
 485
 486                          (string-append "--prefix=" out)
 487                          ,@(if (%current-target-system)
 488                                '((getenv "CONFIGURE_TARGET_ARCH"))
 489                                '())))))
 490         (delete 'move-extra-documentation)
 491         (add-after 'install 'move-man3-pages
 492           (lambda* (#:key outputs #:allow-other-keys)
 493             ;; Move section 3 man pages to "doc".
 494             (let* ((out    (assoc-ref outputs "out"))
 495                    (man3   (string-append out "/share/man/man3"))
 496                    (doc    (assoc-ref outputs "doc"))
 497                    (target (string-append doc "/share/man/man3")))
 498               (mkdir-p target)
 499               (for-each (lambda (file)
 500                           (rename-file file
 501                                        (string-append target "/"
 502                                                       (basename file))))
 503                         (find-files man3))
 504               (delete-file-recursively man3)
 505               #t)))
 506            ;; XXX: Duplicate this phase to make sure 'version' evaluates
 507            ;; in the current scope and not the inherited one.
 508            (replace 'remove-miscellany
 509              (lambda* (#:key outputs #:allow-other-keys)
 510                ;; The 'misc' directory contains random undocumented shell and Perl
 511                ;; scripts.  Remove them to avoid retaining a reference on Perl.
 512                (let ((out (assoc-ref outputs "out")))
 513                  (delete-file-recursively (string-append out "/share/openssl-"
 514                                                          ,version "/misc"))
 515                  #t)))))))))
 516
 517 (define-public libressl
 518   (package
 519     (name "libressl")
 520     (version "3.0.2")
 521     (source (origin
 522               (method url-fetch)
 523               (uri (string-append "mirror://openbsd/LibreSSL/"
 524                                   "libressl-" version ".tar.gz"))
 525               (sha256
 526                (base32
 527                 "13ir2lpxz8y1m151k7lrx306498nzfhwlvgkgv97v5cvywmifyyz"))))
 528     (build-system gnu-build-system)
 529     (arguments
 530      ;; Do as if 'getentropy' was missing since older Linux kernels lack it
 531      ;; and libc would return ENOSYS, which is not properly handled.
 532      ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
 533      '(#:configure-flags '("ac_cv_func_getentropy=no"
 534                            ;; Provide a TLS-enabled netcat.
 535                            "--enable-nc")))
 536     (native-search-paths
 537      (list (search-path-specification
 538             (variable "SSL_CERT_DIR")
 539             (separator #f)              ;single entry
 540             (files '("etc/ssl/certs")))
 541            (search-path-specification
 542             (variable "SSL_CERT_FILE")
 543             (separator #f)              ;single entry
 544             (files '("etc/ssl/certs/ca-certificates.crt")))))
 545     (home-page "https://www.libressl.org/")
 546     (synopsis "SSL/TLS implementation")
 547     (description "LibreSSL is a version of the TLS/crypto stack, forked from
 548 OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
 549 and applying best practice development processes.  This package also includes a
 550 netcat implementation that supports TLS.")
 551     ;; Files taken from OpenSSL keep their license, others are under various
 552     ;; non-copyleft licenses.
 553     (license (list license:openssl
 554                    (license:non-copyleft
 555                      "file://COPYING"
 556                      "See COPYING in the distribution.")))))
 557
 558 (define-public python-acme
 559   (package
 560     (name "python-acme")
 561     ;; Remember to update the hash of certbot when updating python-acme.
 562     (version "1.3.0")
 563     (source (origin
 564               (method url-fetch)
 565               (uri (pypi-uri "acme" version))
 566               (sha256
 567                (base32
 568                 "03fjmg0fgfy7xfn3i8rzn9i0i4amajmijkash84qb8mlphgrxpn0"))))
 569     (build-system python-build-system)
 570     (arguments
 571      `(#:phases
 572        (modify-phases %standard-phases
 573          (add-after 'build 'build-documentation
 574            (lambda _
 575              (invoke "make" "-C" "docs" "man" "info")))
 576          (add-after 'install 'install-documentation
 577            (lambda* (#:key outputs #:allow-other-keys)
 578              (let* ((out (assoc-ref outputs "out"))
 579                     (man (string-append out "/share/man/man1"))
 580                     (info (string-append out "/info")))
 581                (install-file "docs/_build/texinfo/acme-python.info" info)
 582                (install-file "docs/_build/man/acme-python.1" man)
 583                #t))))))
 584     ;; TODO: Add optional inputs for testing.
 585     (native-inputs
 586      `(("python-mock" ,python-mock)
 587        ("python-pytest" ,python-pytest)
 588        ;; For documentation
 589        ("python-sphinx" ,python-sphinx)
 590        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 591        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 592        ("texinfo" ,texinfo)))
 593     (propagated-inputs
 594      `(("python-josepy" ,python-josepy)
 595        ("python-six" ,python-six)
 596        ("python-requests" ,python-requests)
 597        ("python-requests-toolbelt" ,python-requests-toolbelt)
 598        ("python-pytz" ,python-pytz)
 599        ("python-pyrfc3339" ,python-pyrfc3339)
 600        ("python-pyasn1" ,python-pyasn1)
 601        ("python-cryptography" ,python-cryptography)
 602        ("python-pyopenssl" ,python-pyopenssl)))
 603     (home-page "https://github.com/certbot/certbot")
 604     (synopsis "ACME protocol implementation in Python")
 605     (description "ACME protocol implementation in Python")
 606     (license license:asl2.0)))
 607
 608 (define-public certbot
 609   (package
 610     (name "certbot")
 611     ;; Certbot and python-acme are developed in the same repository, and their
 612     ;; versions should remain synchronized.
 613     (version (package-version python-acme))
 614     (source (origin
 615               (method url-fetch)
 616               (uri (pypi-uri "certbot" version))
 617               (sha256
 618                (base32
 619                 "1n5i0k6kwmd6wvivshfl3k4djwcpwx390c39xmr2hhrgpk5r285w"))))
 620     (build-system python-build-system)
 621     (arguments
 622      `(,@(substitute-keyword-arguments (package-arguments python-acme)
 623            ((#:phases phases)
 624             `(modify-phases ,phases
 625               (replace 'install-documentation
 626                 (lambda* (#:key outputs #:allow-other-keys)
 627                   (let* ((out (assoc-ref outputs "out"))
 628                          (man1 (string-append out "/share/man/man1"))
 629                          (man7 (string-append out "/share/man/man7"))
 630                          (info (string-append out "/info")))
 631                     (install-file "docs/_build/texinfo/Certbot.info" info)
 632                     (install-file "docs/_build/man/certbot.1" man1)
 633                     (install-file "docs/_build/man/certbot.7" man7)
 634                     #t))))))))
 635     ;; TODO: Add optional inputs for testing.
 636     (native-inputs
 637      `(("python-mock" ,python-mock)
 638        ("python-pytest" ,python-pytest)
 639        ;; For documentation
 640        ("python-sphinx" ,python-sphinx)
 641        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 642        ("python-sphinx-repoze-autointerface" ,python-sphinx-repoze-autointerface)
 643        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 644        ("texinfo" ,texinfo)))
 645     (propagated-inputs
 646      `(("python-acme" ,python-acme)
 647        ("python-cryptography" ,python-cryptography)
 648        ("python-zope-interface" ,python-zope-interface)
 649        ("python-pyrfc3339" ,python-pyrfc3339)
 650        ("python-pyopenssl" ,python-pyopenssl)
 651        ("python-configobj" ,python-configobj)
 652        ("python-configargparse" ,python-configargparse)
 653        ("python-distro" ,python-distro)
 654        ("python-zope-component" ,python-zope-component)
 655        ("python-parsedatetime" ,python-parsedatetime)
 656        ("python-six" ,python-six)
 657        ("python-psutil" ,python-psutil)
 658        ("python-requests" ,python-requests)
 659        ("python-pytz" ,python-pytz)))
 660     (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
 661     (description "Certbot automatically receives and installs X.509 certificates
 662 to enable Transport Layer Security (TLS) on servers.  It interoperates with the
 663 Let’s Encrypt certificate authority (CA), which issues browser-trusted
 664 certificates for free.")
 665     (home-page "https://certbot.eff.org/")
 666     (license license:asl2.0)))
 667
 668 (define-public letsencrypt
 669   (package (inherit certbot)
 670     (name "letsencrypt")
 671     (properties `((superseded . ,certbot)))))
 672
 673 (define-public perl-net-ssleay
 674   (package
 675     (name "perl-net-ssleay")
 676     (version "1.88")
 677     (source (origin
 678               (method url-fetch)
 679               (uri (string-append "mirror://cpan/authors/id/C/CH/CHRISN/"
 680                                   "Net-SSLeay-" version ".tar.gz"))
 681               (sha256
 682                (base32
 683                 "1pfgh4h3szcpvqlcimc60pjbk9zwls99x5863sva0wc47i4dl010"))))
 684     (build-system perl-build-system)
 685     (inputs `(("openssl" ,openssl)))
 686     (arguments
 687      `(#:phases
 688        (modify-phases %standard-phases
 689          (add-before
 690           'configure 'set-ssl-prefix
 691           (lambda* (#:key inputs #:allow-other-keys)
 692             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 693             #t)))))
 694     (synopsis "Perl extension for using OpenSSL")
 695     (description
 696      "This module offers some high level convenience functions for accessing
 697 web pages on SSL servers (for symmetry, the same API is offered for accessing
 698 http servers, too), an sslcat() function for writing your own clients, and
 699 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 700 servers or clients for more complicated applications.")
 701     (license license:perl-license)
 702     (home-page "https://metacpan.org/release/Net-SSLeay")))
 703
 704 (define-public perl-crypt-openssl-rsa
 705  (package
 706   (name "perl-crypt-openssl-rsa")
 707   (version "0.31")
 708   (source
 709     (origin
 710       (method url-fetch)
 711       (uri (string-append
 712              "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
 713              version
 714              ".tar.gz"))
 715       (sha256
 716         (base32
 717           "0djl5i6kibl7862b6ih29q8dhg5zpwzq77q9j8hp6xngshx40ws1"))))
 718   (build-system perl-build-system)
 719   (native-inputs
 720    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 721   (inputs
 722     `(("perl-crypt-openssl-bignum" ,perl-crypt-openssl-bignum)
 723       ("perl-crypt-openssl-random" ,perl-crypt-openssl-random)
 724       ("openssl" ,openssl)))
 725   (arguments perl-crypt-arguments)
 726   (home-page
 727     "https://metacpan.org/release/Crypt-OpenSSL-RSA")
 728   (synopsis
 729     "RSA encoding and decoding, using the openSSL libraries")
 730   (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
 731 OpenSSL libraries).")
 732   (license license:perl-license)))
 733
 734 (define perl-crypt-arguments
 735    `(#:phases (modify-phases %standard-phases
 736       (add-before 'configure 'patch-Makefile.PL
 737         (lambda* (#:key inputs #:allow-other-keys)
 738           (substitute* "Makefile.PL"
 739             (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
 740                                              (assoc-ref inputs "openssl")
 741                                              "/lib -lcrypto'],")))
 742           #t)))))
 743
 744 (define-public perl-crypt-openssl-bignum
 745  (package
 746   (name "perl-crypt-openssl-bignum")
 747   (version "0.09")
 748   (source
 749     (origin
 750       (method url-fetch)
 751       (uri (string-append
 752              "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
 753              version
 754              ".tar.gz"))
 755       (sha256
 756         (base32
 757           "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
 758   (build-system perl-build-system)
 759   (inputs `(("openssl" ,openssl)))
 760   (arguments perl-crypt-arguments)
 761   (home-page
 762     "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
 763   (synopsis
 764     "OpenSSL's multiprecision integer arithmetic in Perl")
 765   (description "Crypt::OpenSSL::Bignum provides multiprecision integer
 766 arithmetic in Perl.")
 767   ;; At your option either gpl1+ or the Artistic License
 768   (license license:perl-license)))
 769
 770 (define-public perl-crypt-openssl-guess
 771   (package
 772     (name "perl-crypt-openssl-guess")
 773     (version "0.11")
 774     (source
 775      (origin
 776        (method url-fetch)
 777        (uri (string-append
 778              "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
 779              version ".tar.gz"))
 780        (sha256
 781         (base32
 782          "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
 783     (build-system perl-build-system)
 784     (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
 785     (synopsis "Guess the OpenSSL include path")
 786     (description
 787      "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
 788 correct OpenSSL include path.  It is intended for use in your
 789 @file{Makefile.PL}.")
 790     (license license:perl-license)))
 791
 792 (define-public perl-crypt-openssl-random
 793  (package
 794   (name "perl-crypt-openssl-random")
 795   (version "0.15")
 796   (source
 797     (origin
 798       (method url-fetch)
 799       (uri (string-append
 800              "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
 801              version
 802              ".tar.gz"))
 803       (sha256
 804         (base32 "1x6ffps8q7mnawmcfq740llzy7i10g3319vap0wiw4d33fm6z1zh"))))
 805   (build-system perl-build-system)
 806   (native-inputs
 807    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 808   (inputs
 809    `(("openssl" ,openssl)))
 810   (arguments perl-crypt-arguments)
 811   (home-page
 812     "https://metacpan.org/release/Crypt-OpenSSL-Random")
 813   (synopsis
 814     "OpenSSL/LibreSSL pseudo-random number generator access")
 815   (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
 816 number generator")
 817   (license license:perl-license)))
 818
 819 (define-public acme-client
 820   (package
 821     (name "acme-client")
 822     (version "0.1.16")
 823     (source (origin
 824               (method url-fetch)
 825               (uri (string-append "https://kristaps.bsd.lv/" name "/"
 826                                   "snapshots/" name "-portable-"
 827                                   version ".tgz"))
 828               (sha256
 829                (base32
 830                 "00q05b3b1dfnfp7sr1nbd212n0mqrycl3cr9lbs51m7ncaihbrz9"))))
 831     (build-system gnu-build-system)
 832     (arguments
 833      '(#:tests? #f ; no test suite
 834        #:make-flags
 835        (list "CC=gcc"
 836              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 837        #:phases
 838        (modify-phases %standard-phases
 839          (add-after 'unpack 'patch-paths
 840            (lambda* (#:key inputs #:allow-other-keys)
 841              (let ((pem (string-append (assoc-ref inputs "libressl")
 842                                        "/etc/ssl/cert.pem")))
 843                (substitute* "http.c"
 844                  (("/etc/ssl/cert.pem") pem))
 845                #t)))
 846          (delete 'configure)))) ; no './configure' script
 847     (native-inputs
 848      `(("pkg-config" ,pkg-config)))
 849     (inputs
 850      `(("libbsd" ,libbsd)
 851        ("libressl" ,libressl)))
 852     (synopsis "Let's Encrypt client by the OpenBSD project")
 853     (description "acme-client is a Let's Encrypt client implemented in C.  It
 854 uses a modular design, and attempts to secure itself by dropping privileges and
 855 operating in a chroot where possible.  acme-client is developed on OpenBSD and
 856 then ported to the GNU / Linux environment.")
 857     (home-page "https://kristaps.bsd.lv/acme-client/")
 858     ;; acme-client is distributed under the ISC license, but the files 'jsmn.h'
 859     ;; and 'jsmn.c' are distributed under the Expat license.
 860     (license (list license:isc license:expat))))
 861
 862 ;; The "-apache" variant is the upstreamed prefered variant. A "-gpl"
 863 ;; variant exists in addition to the "-apache" one.
 864 (define-public mbedtls-apache
 865   (package
 866     (name "mbedtls-apache")
 867     (version "2.16.5")
 868     (source
 869      (origin
 870        (method url-fetch)
 871        ;; XXX: The download links on the website are script redirection links
 872        ;; which effectively lead to the format listed in the uri here.
 873        (uri (string-append "https://tls.mbed.org/download/mbedtls-"
 874                            version "-apache.tgz"))
 875        (sha256
 876         (base32
 877          "0kdhwy241xsk4isbadqx6z80m8sf76da5sbmqv8qy11yr37cdd35"))))
 878     (build-system cmake-build-system)
 879     (arguments
 880      `(#:configure-flags
 881        (list "-DUSE_SHARED_MBEDTLS_LIBRARY=ON"
 882              "-DUSE_STATIC_MBEDTLS_LIBRARY=OFF")))
 883     (native-inputs
 884      `(("perl" ,perl)
 885        ("python" ,python)))
 886     (synopsis "Small TLS library")
 887     (description
 888      "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
 889 for developers to include cryptographic and SSL/TLS capabilities in their
 890 (embedded) products, facilitating this functionality with a minimal
 891 coding footprint.")
 892     (home-page "https://tls.mbed.org")
 893     (license license:asl2.0)))
 894
 895 ;; The Hiawatha Web server requires some specific features to be enabled.
 896 (define-public mbedtls-for-hiawatha
 897   (hidden-package
 898    (package
 899      (inherit mbedtls-apache)
 900      (arguments
 901       (substitute-keyword-arguments
 902           `(#:phases
 903             (modify-phases %standard-phases
 904               (add-after 'configure 'configure-extra-features
 905                 (lambda _
 906                   (for-each (lambda (feature)
 907                               (invoke "scripts/config.pl" "set" feature))
 908                             (list "MBEDTLS_THREADING_C"
 909                                   "MBEDTLS_THREADING_PTHREAD"))
 910                   #t)))
 911             ,@(package-arguments mbedtls-apache)))))))
 912
 913 (define-public dehydrated
 914   (package
 915     (name "dehydrated")
 916     (version "0.6.5")
 917     (source (origin
 918               (method url-fetch)
 919               (uri (string-append
 920                     "https://github.com/dehydrated-io/dehydrated/releases/download/"
 921                     "v" version "/dehydrated-" version ".tar.gz"))
 922               (sha256
 923                (base32
 924                 "0dgskgbdd95p13jx6s13p77y15wngb5cm6p4305cf2s54w0bvahh"))))
 925     (build-system trivial-build-system)
 926     (arguments
 927      `(#:modules ((guix build utils)
 928                   (srfi srfi-26))
 929        #:builder
 930        (begin
 931          (use-modules (guix build utils)
 932                       (srfi srfi-26))
 933          (let* ((source (assoc-ref %build-inputs "source"))
 934                 (tar (assoc-ref %build-inputs "tar"))
 935                 (gz  (assoc-ref %build-inputs "gzip"))
 936                 (out (assoc-ref %outputs "out"))
 937                 (bin (string-append out "/bin"))
 938                 (doc (string-append out "/share/doc/" ,name "-" ,version))
 939                 (man (string-append out "/share/man"))
 940                 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
 941
 942            (setenv "PATH" (string-append gz "/bin"))
 943            (invoke (string-append tar "/bin/tar") "xvf" source)
 944            (chdir (string-append ,name "-" ,version))
 945
 946            (copy-recursively "docs" doc)
 947            (install-file "LICENSE" doc)
 948
 949            (mkdir-p man)
 950            (rename-file (string-append doc "/man")
 951                         (string-append man "/man1"))
 952            (for-each (cut invoke "gzip" "-9" <>)
 953                      (find-files man ".*"))
 954
 955            (install-file "dehydrated" bin)
 956            (with-directory-excursion bin
 957              (patch-shebang "dehydrated" (list bash))
 958
 959              ;; Do not try to write to the store.
 960              (substitute* "dehydrated"
 961                (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
 962
 963              (setenv "PATH" bash)
 964              (wrap-program "dehydrated"
 965                `("PATH" ":" prefix
 966                  ,(map (lambda (dir)
 967                          (string-append dir "/bin"))
 968                        (map (lambda (input)
 969                               (assoc-ref %build-inputs input))
 970                             '("coreutils"
 971                               "curl"
 972                               "diffutils"
 973                               "gawk"
 974                               "grep"
 975                               "openssl"
 976                               "sed"))))))
 977            #t))))
 978     (inputs
 979      `(("bash" ,bash)
 980        ("coreutils" ,coreutils)
 981        ("curl" ,curl)
 982        ("diffutils" ,diffutils)
 983        ("gawk" ,gawk)
 984        ("grep" ,grep)
 985        ("openssl" ,openssl)
 986        ("sed" ,sed)))
 987     (native-inputs
 988      `(("gzip" ,gzip)
 989        ("tar" ,tar)))
 990     (home-page "https://dehydrated.io/")
 991     (synopsis "Let's Encrypt/ACME client implemented as a shell script")
 992     (description "Dehydrated is a client for signing certificates with an
 993 ACME-server (currently only provided by Let's Encrypt) implemented as a
 994 relatively simple Bash script.")
 995     (license license:expat)))
 996
 997 (define-public go-github-com-certifi-gocertifi
 998   (let ((commit "a5e0173ced670013bfb649c7e806bc9529c986ec")
 999         (revision "1"))
1000     (package
1001       (name "go-github-com-certifi-gocertifi")
1002       (version (git-version "2018.01.18" revision commit))
1003       (source (origin
1004                 (method git-fetch)
1005                 (uri (git-reference
1006                        (url "https://github.com/certifi/gocertifi")
1007                        (commit commit)))
1008                 (file-name (git-file-name name version))
1009                 (sha256
1010                  (base32
1011                   "1n9drccl3q1rr8wg3nf60slkf1lgsmz5ahifrglbdrc6har3rryj"))))
1012       (build-system go-build-system)
1013       (arguments
1014        '(#:import-path "github.com/certifi/gocertifi"))
1015       (synopsis "X.509 TLS root certificate bundle for Go")
1016       (description "This package is a Go language X.509 TLS root certificate bundle,
1017 derived from Mozilla's collection.")
1018       (home-page "https://certifi.io")
1019       (license license:mpl2.0))))