gnu/packages/tls.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2014, 2015, 2016, 2017, 2018 Mark H Weaver <mhw@netris.org>
   4 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
   5 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
   6 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   7 ;;; Copyright © 2015, 2016, 2017, 2018 Leo Famulari <leo@famulari.name>
   8 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
   9 ;;; Copyright © 2016, 2017, 2018 Nils Gillmann <ng0@n0.is>
  10 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
  11 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
  12 ;;; Copyright © 2017, 2018 Marius Bakke <mbakke@fastmail.com>
  13 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
  14 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
  15 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages tls)
  33   #:use-module ((guix licenses) #:prefix license:)
  34   #:use-module (guix packages)
  35   #:use-module (guix download)
  36   #:use-module (guix utils)
  37   #:use-module (guix build-system gnu)
  38   #:use-module (guix build-system perl)
  39   #:use-module (guix build-system python)
  40   #:use-module (guix build-system cmake)
  41   #:use-module (guix build-system haskell)
  42   #:use-module (guix build-system trivial)
  43   #:use-module (gnu packages compression)
  44   #:use-module (gnu packages)
  45   #:use-module (gnu packages bash)
  46   #:use-module (gnu packages check)
  47   #:use-module (gnu packages curl)
  48   #:use-module (gnu packages dns)
  49   #:use-module (gnu packages gawk)
  50   #:use-module (gnu packages guile)
  51   #:use-module (gnu packages haskell)
  52   #:use-module (gnu packages haskell-check)
  53   #:use-module (gnu packages haskell-crypto)
  54   #:use-module (gnu packages libbsd)
  55   #:use-module (gnu packages libffi)
  56   #:use-module (gnu packages libidn)
  57   #:use-module (gnu packages linux)
  58   #:use-module (gnu packages ncurses)
  59   #:use-module (gnu packages nettle)
  60   #:use-module (gnu packages perl)
  61   #:use-module (gnu packages pkg-config)
  62   #:use-module (gnu packages python)
  63   #:use-module (gnu packages python-crypto)
  64   #:use-module (gnu packages python-web)
  65   #:use-module (gnu packages python-xyz)
  66   #:use-module (gnu packages texinfo)
  67   #:use-module (gnu packages time)
  68   #:use-module (gnu packages base)
  69   #:use-module (srfi srfi-1))
  70
  71 (define-public libtasn1
  72   (package
  73     (name "libtasn1")
  74     (version "4.13")
  75     (source
  76      (origin
  77       (method url-fetch)
  78       (uri (string-append "mirror://gnu/libtasn1/libtasn1-"
  79                           version ".tar.gz"))
  80       (sha256
  81        (base32
  82         "1jlc1iahj8k3haz28j55nzg7sgni5h41vqy461i1bpbx6668wlky"))))
  83     (build-system gnu-build-system)
  84     (arguments
  85      `(#:configure-flags '("--disable-static")))
  86     (native-inputs `(("perl" ,perl)))
  87     (home-page "https://www.gnu.org/software/libtasn1/")
  88     (synopsis "ASN.1 library")
  89     (description
  90      "GNU libtasn1 is a library implementing the ASN.1 notation.  It is used
  91 for transmitting machine-neutral encodings of data objects in computer
  92 networking, allowing for formal validation of data according to some
  93 specifications.")
  94     (license license:lgpl2.0+)))
  95
  96 (define-public asn1c
  97   (package
  98     (name "asn1c")
  99     (version "0.9.28")
 100     (source (origin
 101       (method url-fetch)
 102       (uri (string-append "https://lionet.info/soft/asn1c-"
 103                           version ".tar.gz"))
 104       (sha256
 105        (base32
 106         "1fc64g45ykmv73kdndr4zdm4wxhimhrir4rxnygxvwkych5l81w0"))))
 107     (build-system gnu-build-system)
 108     (native-inputs
 109      `(("perl" ,perl)))
 110     (home-page "https://lionet.info/asn1c")
 111     (synopsis "ASN.1 to C compiler")
 112     (description "The ASN.1 to C compiler takes ASN.1 module
 113 files and generates C++ compatible C source code.  That code can be
 114 used to serialize the native C structures into compact and unambiguous
 115 BER/XER/PER-based data files, and deserialize the files back.
 116
 117 Various ASN.1 based formats are widely used in the industry, such as to encode
 118 the X.509 certificates employed in the HTTPS handshake, to exchange control
 119 data between mobile phones and cellular networks, to car-to-car communication
 120 in intelligent transportation networks.")
 121     (license license:bsd-2)))
 122
 123 (define-public p11-kit
 124   (package
 125     (name "p11-kit")
 126     (version "0.23.15")
 127     (source
 128      (origin
 129       (method url-fetch)
 130       (uri (string-append "https://github.com/p11-glue/p11-kit/releases/"
 131                           "download/" version "/p11-kit-" version ".tar.gz"))
 132       (patches (search-patches "p11-kit-jks-timestamps.patch"))
 133       (sha256
 134        (base32
 135         "166pwj00cffv4qq4dvx0k53zka0b0r1fa0whc49007vsqyh3khgp"))))
 136     (build-system gnu-build-system)
 137     (native-inputs
 138      `(("pkg-config" ,pkg-config)))
 139     (inputs
 140      `(("libffi" ,libffi)
 141        ("libtasn1" ,libtasn1)))
 142     (arguments
 143      `(#:configure-flags '("--without-trust-paths")
 144        #:phases (modify-phases %standard-phases
 145                   (add-before 'check 'prepare-tests
 146                     (lambda _
 147                       ;; "test-runtime" expects XDG_RUNTIME_DIR to be set up
 148                       ;; and looks for .cache and other directories (only).
 149                       ;; For simplicity just drop it since it is irrelevant
 150                       ;; in the build container.
 151                       (substitute* "Makefile"
 152                         (("test-runtime\\$\\(EXEEXT\\)") ""))
 153                       #t)))))
 154     (home-page "https://p11-glue.freedesktop.org/p11-kit.html")
 155     (synopsis "PKCS#11 library")
 156     (description
 157      "p11-kit provides a way to load and enumerate PKCS#11 modules.  It
 158 provides a standard configuration setup for installing PKCS#11 modules
 159 in such a way that they are discoverable.  It also solves problems with
 160 coordinating the use of PKCS#11 by different components or libraries
 161 living in the same process.")
 162     (license license:bsd-3)))
 163
 164 (define-public gnutls
 165   (package
 166     (name "gnutls")
 167     (version "3.5.18")
 168     (source (origin
 169              (method url-fetch)
 170              (uri
 171               ;; Note: Releases are no longer on ftp.gnu.org since the
 172               ;; schism (after version 3.1.5).
 173               (string-append "mirror://gnupg/gnutls/v"
 174                              (version-major+minor version)
 175                              "/gnutls-" version ".tar.xz"))
 176              (patches
 177               (search-patches "gnutls-skip-trust-store-test.patch"
 178                               "gnutls-skip-pkgconfig-test.patch"))
 179              (sha256
 180               (base32
 181                "0d02x28fwkkx7xzn7807nww6idchizzq3plx8sfcyiw7wzclh8mf"))))
 182     (build-system gnu-build-system)
 183     (arguments
 184      `(; Ensure we don't keep a reference to this buggy software.
 185        #:disallowed-references (,net-tools)
 186        #:configure-flags
 187        (list
 188              ;; GnuTLS doesn't consult any environment variables to specify
 189              ;; the location of the system-wide trust store.  Instead it has a
 190              ;; configure-time option.  Unless specified, its configure script
 191              ;; attempts to auto-detect the location by looking for common
 192              ;; places in the file system, none of which are present in our
 193              ;; chroot build environment.  If not found, then no default trust
 194              ;; store is used, so each program has to provide its own
 195              ;; fallback, and users have to configure each program
 196              ;; independently.  This seems suboptimal.
 197              "--with-default-trust-store-dir=/etc/ssl/certs"
 198
 199              ;; FIXME: Temporarily disable p11-kit support since it is not
 200              ;; working on mips64el.
 201              "--without-p11-kit")
 202
 203        #:phases (modify-phases %standard-phases
 204                   (add-after
 205                    'install 'move-doc
 206                    (lambda* (#:key outputs #:allow-other-keys)
 207                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
 208                      (let* ((out    (assoc-ref outputs "out"))
 209                             (doc    (assoc-ref outputs "doc"))
 210                             (mandir (string-append doc "/share/man/man3"))
 211                             (oldman (string-append out "/share/man/man3")))
 212                        (mkdir-p mandir)
 213                        (copy-recursively oldman mandir)
 214                        (delete-file-recursively oldman)
 215                        #t))))))
 216     (outputs '("out"                              ;4.4 MiB
 217                "debug"
 218                "doc"))                            ;4.1 MiB of man pages
 219     (native-inputs
 220      `(("net-tools" ,net-tools)
 221        ("pkg-config" ,pkg-config)
 222        ("which" ,which)))
 223     (inputs
 224      `(("guile" ,guile-2.2)))
 225     (propagated-inputs
 226      ;; These are all in the 'Requires.private' field of gnutls.pc.
 227      `(("libtasn1" ,libtasn1)
 228        ("libidn2" ,libidn2)
 229        ("nettle" ,nettle)
 230        ("zlib" ,zlib)))
 231     (home-page "https://www.gnu.org/software/gnutls/")
 232     (synopsis "Transport layer security library")
 233     (description
 234      "GnuTLS is a secure communications library implementing the SSL, TLS
 235 and DTLS protocols.  It is provided in the form of a C library to support the
 236 protocols, as well as to parse and write X.5009, PKCS 12, OpenPGP and other
 237 required structures.")
 238     (license license:lgpl2.1+)
 239     (properties '((ftp-server . "ftp.gnutls.org")
 240                   (ftp-directory . "/gcrypt/gnutls")))))
 241
 242 (define-public gnutls/guile-2.2
 243   (deprecated-package "guile2.2-gnutls" gnutls))
 244
 245 (define-public gnutls/guile-2.0
 246   ;; GnuTLS for Guile 2.0.
 247   (package
 248     (inherit gnutls)
 249     (name "guile2.0-gnutls")
 250     (inputs `(("guile" ,guile-2.0)
 251               ,@(alist-delete "guile" (package-inputs gnutls))))))
 252
 253 (define-public gnutls/dane
 254   ;; GnuTLS with build libgnutls-dane, implementing DNS-based
 255   ;; Authentication of Named Entities.  This is required for GNS functionality
 256   ;; by GNUnet and gnURL.  This is done in an extra package definition
 257   ;; to have the choice between GnuTLS with Dane and without Dane.
 258   (package
 259     (inherit gnutls)
 260     (name "gnutls-dane")
 261     (inputs `(("unbound" ,unbound)
 262               ,@(package-inputs gnutls)))))
 263
 264 (define-public openssl
 265   (package
 266    (name "openssl")
 267    (version "1.0.2p")
 268    (source (origin
 269              (method url-fetch)
 270              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 271                                        version ".tar.gz")
 272                         (string-append "ftp://ftp.openssl.org/source/"
 273                                        name "-" version ".tar.gz")
 274                         (string-append "ftp://ftp.openssl.org/source/old/"
 275                                        (string-trim-right version char-set:letter)
 276                                        "/" name "-" version ".tar.gz")))
 277              (sha256
 278               (base32
 279                "003xh9f898i56344vpvpxxxzmikivxig4xwlm7vbi7m8n43qxaah"))
 280              (patches (search-patches "openssl-runpath.patch"
 281                                       "openssl-c-rehash-in.patch"))))
 282    (build-system gnu-build-system)
 283    (outputs '("out"
 284               "doc"                               ;1.5MiB of man3 pages
 285               "static"))                          ;6MiB of .a files
 286    (native-inputs `(("perl" ,perl)))
 287    (arguments
 288     `(#:disallowed-references (,perl)
 289       #:parallel-build? #f
 290       #:parallel-tests? #f
 291       #:test-target "test"
 292
 293       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
 294       ;; so we explicitly disallow it here.
 295       #:disallowed-references ,(list (canonical-package perl))
 296       #:phases
 297       (modify-phases %standard-phases
 298         (add-before
 299          'configure 'patch-Makefile.org
 300          (lambda* (#:key outputs #:allow-other-keys)
 301            ;; The default MANDIR is some unusual place.  Fix that.
 302            (let ((out (assoc-ref outputs "out")))
 303              (patch-makefile-SHELL "Makefile.org")
 304              (substitute* "Makefile.org"
 305                (("^MANDIR[[:blank:]]*=.*$")
 306                 (string-append "MANDIR = " out "/share/man\n")))
 307              #t)))
 308         (replace
 309          'configure
 310          (lambda* (#:key outputs #:allow-other-keys)
 311            (let ((out (assoc-ref outputs "out")))
 312              (invoke "./config"
 313                      "shared"                 ;build shared libraries
 314                      "--libdir=lib"
 315
 316                      ;; The default for this catch-all directory is
 317                      ;; PREFIX/ssl.  Change that to something more
 318                      ;; conventional.
 319                      (string-append "--openssldir=" out
 320                                     "/share/openssl-" ,version)
 321
 322                      (string-append "--prefix=" out)))))
 323         (add-after
 324          'install 'make-libraries-writable
 325          (lambda* (#:key outputs #:allow-other-keys)
 326            ;; Make libraries writable so that 'strip' does its job.
 327            (let ((out (assoc-ref outputs "out")))
 328              (for-each (lambda (file)
 329                          (chmod file #o644))
 330                        (find-files (string-append out "/lib")
 331                                    "\\.so"))
 332              #t)))
 333         (add-after 'install 'move-static-libraries
 334           (lambda* (#:key outputs #:allow-other-keys)
 335             ;; Move static libraries to the "static" output.
 336             (let* ((out    (assoc-ref outputs "out"))
 337                    (lib    (string-append out "/lib"))
 338                    (static (assoc-ref outputs "static"))
 339                    (slib   (string-append static "/lib")))
 340               (for-each (lambda (file)
 341                           (install-file file slib)
 342                           (delete-file file))
 343                         (find-files lib "\\.a$"))
 344               #t)))
 345         (add-after 'install 'move-man3-pages
 346           (lambda* (#:key outputs #:allow-other-keys)
 347             ;; Move section 3 man pages to "doc".
 348             (let* ((out    (assoc-ref outputs "out"))
 349                    (man3   (string-append out "/share/man/man3"))
 350                    (doc    (assoc-ref outputs "doc"))
 351                    (target (string-append doc "/share/man/man3")))
 352               (mkdir-p target)
 353               (for-each (lambda (file)
 354                           (rename-file file
 355                                        (string-append target "/"
 356                                                       (basename file))))
 357                         (find-files man3))
 358               (delete-file-recursively man3)
 359               #t)))
 360         (add-before
 361          'patch-source-shebangs 'patch-tests
 362          (lambda* (#:key inputs native-inputs #:allow-other-keys)
 363            (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
 364              (substitute* (find-files "test" ".*")
 365                (("/bin/sh")
 366                 (string-append bash "/bin/sh"))
 367                (("/bin/rm")
 368                 "rm"))
 369              #t)))
 370         (add-after
 371          'install 'remove-miscellany
 372          (lambda* (#:key outputs #:allow-other-keys)
 373            ;; The 'misc' directory contains random undocumented shell and Perl
 374            ;; scripts.  Remove them to avoid retaining a reference on Perl.
 375            (let ((out (assoc-ref outputs "out")))
 376              (delete-file-recursively (string-append out "/share/openssl-"
 377                                                      ,version "/misc"))
 378              #t))))))
 379    (native-search-paths
 380     (list (search-path-specification
 381            (variable "SSL_CERT_DIR")
 382            (separator #f)                        ;single entry
 383            (files '("etc/ssl/certs")))
 384           (search-path-specification
 385            (variable "SSL_CERT_FILE")
 386            (file-type 'regular)
 387            (separator #f)                        ;single entry
 388            (files '("etc/ssl/certs/ca-certificates.crt")))))
 389    (synopsis "SSL/TLS implementation")
 390    (description
 391     "OpenSSL is an implementation of SSL/TLS.")
 392    (license license:openssl)
 393    (home-page "https://www.openssl.org/")))
 394
 395 (define-public openssl-next
 396   (package
 397     (inherit openssl)
 398     (name "openssl")
 399     (version "1.1.1a")
 400     (source (origin
 401              (method url-fetch)
 402              (uri (list (string-append "https://www.openssl.org/source/openssl-"
 403                                        version ".tar.gz")
 404                         (string-append "ftp://ftp.openssl.org/source/"
 405                                        name "-" version ".tar.gz")
 406                         (string-append "ftp://ftp.openssl.org/source/old/"
 407                                        (string-trim-right version char-set:letter)
 408                                        "/" name "-" version ".tar.gz")))
 409               (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
 410               (sha256
 411                (base32
 412                 "0hcz7znzznbibpy3iyyhvlqrq44y88plxwdj32wjzgbwic7i687w"))))
 413     (outputs '("out"
 414                "doc"        ; 6.8 MiB of man3 pages and full HTML documentation
 415                "static"))   ; 6.4 MiB of .a files
 416     (arguments
 417      (substitute-keyword-arguments (package-arguments openssl)
 418        ((#:phases phases)
 419         `(modify-phases ,phases
 420            (delete 'patch-tests)          ; These two phases are not needed by
 421            (delete 'patch-Makefile.org)   ; OpenSSL 1.1.
 422
 423            ;; Override configure phase since -rpath is now a configure option.
 424            (replace 'configure
 425              (lambda* (#:key outputs #:allow-other-keys)
 426                (let* ((out (assoc-ref outputs "out"))
 427                       (lib (string-append out "/lib")))
 428                  ;; It's not a shebang so patch-source-shebangs misses it.
 429                  (substitute* "config"
 430                    (("/usr/bin/env")
 431                     (string-append (assoc-ref %build-inputs "coreutils")
 432                                    "/bin/env")))
 433                  (invoke "./config"
 434                          "shared"       ;build shared libraries
 435                          "--libdir=lib"
 436
 437                          ;; The default for this catch-all directory is
 438                          ;; PREFIX/ssl.  Change that to something more
 439                          ;; conventional.
 440                          (string-append "--openssldir=" out
 441                                         "/share/openssl-" ,version)
 442
 443                          (string-append "--prefix=" out)
 444                          (string-append "-Wl,-rpath," lib)
 445
 446                          ;; XXX FIXME: Work around a code generation bug in GCC
 447                          ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
 448                          ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
 449                          ,@(if (and (not (%current-target-system))
 450                                     (string-prefix? "armhf" (%current-system)))
 451                                '("-mfpu=vfpv3")
 452                                '())))))
 453
 454            (delete 'move-man3-pages)
 455            (add-after 'install 'move-extra-documentation
 456              (lambda* (#:key outputs #:allow-other-keys)
 457                ;; Move man3 pages and full HTML documentation to "doc".
 458                (let* ((out    (assoc-ref outputs "out"))
 459                       (man3   (string-append out "/share/man/man3"))
 460                       (html (string-append out "/share/doc/openssl"))
 461                       (doc    (assoc-ref outputs "doc"))
 462                       (man-target (string-append doc "/share/man/man3"))
 463                       (html-target (string-append doc "/share/doc/openssl")))
 464                  (copy-recursively man3 man-target)
 465                  (delete-file-recursively man3)
 466                  (copy-recursively html html-target)
 467                  (delete-file-recursively html)
 468                  #t)))
 469            ;; XXX: Duplicate this phase to make sure 'version' evaluates
 470            ;; in the current scope and not the inherited one.
 471            (replace 'remove-miscellany
 472              (lambda* (#:key outputs #:allow-other-keys)
 473                ;; The 'misc' directory contains random undocumented shell and Perl
 474                ;; scripts.  Remove them to avoid retaining a reference on Perl.
 475                (let ((out (assoc-ref outputs "out")))
 476                  (delete-file-recursively (string-append out "/share/openssl-"
 477                                                          ,version "/misc"))
 478                  #t)))))))))
 479
 480 (define-public libressl
 481   (package
 482     (name "libressl")
 483     (version "2.7.4")
 484     (source (origin
 485               (method url-fetch)
 486               (uri (string-append "mirror://openbsd/LibreSSL/"
 487                                   name "-" version ".tar.gz"))
 488               (sha256
 489                (base32
 490                 "19kxa5i97q7p6rrps9qm0nd8zqhdjvzx02j72400c73cl2nryfhy"))))
 491     (build-system gnu-build-system)
 492     (arguments
 493      ;; Do as if 'getentropy' was missing since older Linux kernels lack it
 494      ;; and libc would return ENOSYS, which is not properly handled.
 495      ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
 496      '(#:configure-flags '("ac_cv_func_getentropy=no"
 497                            ;; Provide a TLS-enabled netcat.
 498                            "--enable-nc")))
 499     (native-search-paths
 500       ;; FIXME: These two variables must designate a single file or directory
 501       ;; and are not actually "search paths."  In practice it works OK in
 502       ;; user profiles because there's always just one item that matches the
 503       ;; specification.
 504      (list (search-path-specification
 505             (variable "SSL_CERT_DIR")
 506             (files '("etc/ssl/certs")))
 507            (search-path-specification
 508             (variable "SSL_CERT_FILE")
 509             (files '("etc/ssl/certs/ca-certificates.crt")))))
 510     (home-page "https://www.libressl.org/")
 511     (synopsis "SSL/TLS implementation")
 512     (description "LibreSSL is a version of the TLS/crypto stack, forked from
 513 OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
 514 and applying best practice development processes.  This package also includes a
 515 netcat implementation that supports TLS.")
 516     ;; Files taken from OpenSSL keep their license, others are under various
 517     ;; non-copyleft licenses.
 518     (license (list license:openssl
 519                    (license:non-copyleft
 520                      "file://COPYING"
 521                      "See COPYING in the distribution.")))))
 522
 523 (define-public python-acme
 524   (package
 525     (name "python-acme")
 526     ;; Remember to update the hash of certbot when updating python-acme.
 527     (version "0.30.2")
 528     (source (origin
 529               (method url-fetch)
 530               (uri (pypi-uri "acme" version))
 531               (sha256
 532                (base32
 533                 "1wmqxrl4w9w79jd16bmxp8g3xbrx3az4137zbip8x44zrrzmnni9"))))
 534     (build-system python-build-system)
 535     (arguments
 536      `(#:phases
 537        (modify-phases %standard-phases
 538          (add-after 'build 'build-documentation
 539            (lambda _
 540              (invoke "make" "-C" "docs" "man" "info")))
 541          (add-after 'install 'install-documentation
 542            (lambda* (#:key outputs #:allow-other-keys)
 543              (let* ((out (assoc-ref outputs "out"))
 544                     (man (string-append out "/share/man/man1"))
 545                     (info (string-append out "/info")))
 546                (install-file "docs/_build/texinfo/acme-python.info" info)
 547                (install-file "docs/_build/man/acme-python.1" man)
 548                #t))))))
 549     ;; TODO: Add optional inputs for testing.
 550     (native-inputs
 551      `(("python-mock" ,python-mock)
 552        ("python-pytest" ,python-pytest)
 553        ;; For documentation
 554        ("python-sphinx" ,python-sphinx)
 555        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 556        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 557        ("texinfo" ,texinfo)))
 558     (propagated-inputs
 559      `(("python-josepy" ,python-josepy)
 560        ("python-six" ,python-six)
 561        ("python-requests" ,python-requests)
 562        ("python-requests-toolbelt" ,python-requests-toolbelt)
 563        ("python-pytz" ,python-pytz)
 564        ("python-pyrfc3339" ,python-pyrfc3339)
 565        ("python-pyasn1" ,python-pyasn1)
 566        ("python-cryptography" ,python-cryptography)
 567        ("python-pyopenssl" ,python-pyopenssl)))
 568     (home-page "https://github.com/certbot/certbot")
 569     (synopsis "ACME protocol implementation in Python")
 570     (description "ACME protocol implementation in Python")
 571     (license license:asl2.0)))
 572
 573 (define-public certbot
 574   (package
 575     (name "certbot")
 576     ;; Certbot and python-acme are developed in the same repository, and their
 577     ;; versions should remain synchronized.
 578     (version (package-version python-acme))
 579     (source (origin
 580               (method url-fetch)
 581               (uri (pypi-uri name version))
 582               (sha256
 583                (base32
 584                 "0vkpqwps1c8ja140kiiz2cws9hqjrbkx58wbji3qxv9cap5qfi2k"))))
 585     (build-system python-build-system)
 586     (arguments
 587      `(,@(substitute-keyword-arguments (package-arguments python-acme)
 588            ((#:phases phases)
 589             `(modify-phases ,phases
 590               (replace 'install-documentation
 591                 (lambda* (#:key outputs #:allow-other-keys)
 592                   (let* ((out (assoc-ref outputs "out"))
 593                          (man1 (string-append out "/share/man/man1"))
 594                          (man7 (string-append out "/share/man/man7"))
 595                          (info (string-append out "/info")))
 596                     (install-file "docs/_build/texinfo/Certbot.info" info)
 597                     (install-file "docs/_build/man/certbot.1" man1)
 598                     (install-file "docs/_build/man/certbot.7" man7)
 599                     #t))))))))
 600     ;; TODO: Add optional inputs for testing.
 601     (native-inputs
 602      `(("python-nose" ,python-nose)
 603        ("python-mock" ,python-mock)
 604        ;; For documentation
 605        ("python-sphinx" ,python-sphinx)
 606        ("python-sphinx-rtd-theme" ,python-sphinx-rtd-theme)
 607        ("python-sphinx-repoze-autointerface" ,python-sphinx-repoze-autointerface)
 608        ("python-sphinxcontrib-programoutput" ,python-sphinxcontrib-programoutput)
 609        ("texinfo" ,texinfo)))
 610     (propagated-inputs
 611      `(("python-acme" ,python-acme)
 612        ("python-zope-interface" ,python-zope-interface)
 613        ("python-pyrfc3339" ,python-pyrfc3339)
 614        ("python-pyopenssl" ,python-pyopenssl)
 615        ("python-configobj" ,python-configobj)
 616        ("python-configargparse" ,python-configargparse)
 617        ("python-zope-component" ,python-zope-component)
 618        ("python-parsedatetime" ,python-parsedatetime)
 619        ("python-six" ,python-six)
 620        ("python-psutil" ,python-psutil)
 621        ("python-requests" ,python-requests)
 622        ("python-pytz" ,python-pytz)))
 623     (synopsis "Let's Encrypt client by the Electronic Frontier Foundation")
 624     (description "Certbot automatically receives and installs X.509 certificates
 625 to enable Transport Layer Security (TLS) on servers.  It interoperates with the
 626 Let’s Encrypt certificate authority (CA), which issues browser-trusted
 627 certificates for free.")
 628     (home-page "https://certbot.eff.org/")
 629     (license license:asl2.0)))
 630
 631 (define-public letsencrypt
 632   (package (inherit certbot)
 633     (name "letsencrypt")
 634     (properties `((superseded . ,certbot)))))
 635
 636 (define-public perl-net-ssleay
 637   (package
 638     (name "perl-net-ssleay")
 639     (version "1.85")
 640     (source (origin
 641               (method url-fetch)
 642               (uri (string-append "mirror://cpan/authors/id/M/MI/MIKEM/"
 643                                   "Net-SSLeay-" version ".tar.gz"))
 644               (sha256
 645                (base32
 646                 "1j5h4ycm8538397l204d2d5fkm9595aj174pj7bkpbhwzfwqi0cx"))))
 647     (build-system perl-build-system)
 648     (inputs `(("openssl" ,openssl)))
 649     (arguments
 650      `(#:phases
 651        (modify-phases %standard-phases
 652          (add-before
 653           'configure 'set-ssl-prefix
 654           (lambda* (#:key inputs #:allow-other-keys)
 655             (setenv "OPENSSL_PREFIX" (assoc-ref inputs "openssl"))
 656             #t)))))
 657     (synopsis "Perl extension for using OpenSSL")
 658     (description
 659      "This module offers some high level convenience functions for accessing
 660 web pages on SSL servers (for symmetry, the same API is offered for accessing
 661 http servers, too), an sslcat() function for writing your own clients, and
 662 finally access to the SSL api of the SSLeay/OpenSSL package so you can write
 663 servers or clients for more complicated applications.")
 664     (license license:perl-license)
 665     (home-page "https://metacpan.org/release/Net-SSLeay")))
 666
 667 (define-public perl-crypt-openssl-rsa
 668  (package
 669   (name "perl-crypt-openssl-rsa")
 670   (version "0.31")
 671   (source
 672     (origin
 673       (method url-fetch)
 674       (uri (string-append
 675              "mirror://cpan/authors/id/T/TO/TODDR/Crypt-OpenSSL-RSA-"
 676              version
 677              ".tar.gz"))
 678       (sha256
 679         (base32
 680           "0djl5i6kibl7862b6ih29q8dhg5zpwzq77q9j8hp6xngshx40ws1"))))
 681   (build-system perl-build-system)
 682   (native-inputs
 683    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 684   (inputs
 685     `(("perl-crypt-openssl-bignum" ,perl-crypt-openssl-bignum)
 686       ("perl-crypt-openssl-random" ,perl-crypt-openssl-random)
 687       ("openssl" ,openssl)))
 688   (arguments perl-crypt-arguments)
 689   (home-page
 690     "https://metacpan.org/release/Crypt-OpenSSL-RSA")
 691   (synopsis
 692     "RSA encoding and decoding, using the openSSL libraries")
 693   (description "Crypt::OpenSSL::RSA does RSA encoding and decoding (using the
 694 OpenSSL libraries).")
 695   (license license:perl-license)))
 696
 697 (define perl-crypt-arguments
 698    `(#:phases (modify-phases %standard-phases
 699       (add-before 'configure 'patch-Makefile.PL
 700         (lambda* (#:key inputs #:allow-other-keys)
 701           (substitute* "Makefile.PL"
 702             (("'LIBS'.*=>.*") (string-append "'LIBS' => ['-L"
 703                                              (assoc-ref inputs "openssl")
 704                                              "/lib -lcrypto'],")))
 705           #t)))))
 706
 707 (define-public perl-crypt-openssl-bignum
 708  (package
 709   (name "perl-crypt-openssl-bignum")
 710   (version "0.09")
 711   (source
 712     (origin
 713       (method url-fetch)
 714       (uri (string-append
 715              "mirror://cpan/authors/id/K/KM/KMX/Crypt-OpenSSL-Bignum-"
 716              version
 717              ".tar.gz"))
 718       (sha256
 719         (base32
 720           "1p22znbajq91lbk2k3yg12ig7hy5b4vy8igxwqkmbm4nhgxp4ki3"))))
 721   (build-system perl-build-system)
 722   (inputs `(("openssl" ,openssl)))
 723   (arguments perl-crypt-arguments)
 724   (home-page
 725     "https://metacpan.org/release/Crypt-OpenSSL-Bignum")
 726   (synopsis
 727     "OpenSSL's multiprecision integer arithmetic in Perl")
 728   (description "Crypt::OpenSSL::Bignum provides multiprecision integer
 729 arithmetic in Perl.")
 730   ;; At your option either gpl1+ or the Artistic License
 731   (license license:perl-license)))
 732
 733 (define-public perl-crypt-openssl-guess
 734   (package
 735     (name "perl-crypt-openssl-guess")
 736     (version "0.11")
 737     (source
 738      (origin
 739        (method url-fetch)
 740        (uri (string-append
 741              "mirror://cpan/authors/id/A/AK/AKIYM/Crypt-OpenSSL-Guess-"
 742              version ".tar.gz"))
 743        (sha256
 744         (base32
 745          "0rvi9l4ljcbhwwvspq019nfq2h2v746dk355h2nwnlmqikiihsxa"))))
 746     (build-system perl-build-system)
 747     (home-page "https://metacpan.org/release/Crypt-OpenSSL-Guess")
 748     (synopsis "Guess the OpenSSL include path")
 749     (description
 750      "The Crypt::OpenSSL::Guess Perl module provides helpers to guess the
 751 correct OpenSSL include path.  It is intended for use in your
 752 @file{Makefile.PL}.")
 753     (license license:perl-license)))
 754
 755 (define-public perl-crypt-openssl-random
 756  (package
 757   (name "perl-crypt-openssl-random")
 758   (version "0.13")
 759   (source
 760     (origin
 761       (method url-fetch)
 762       (uri (string-append
 763              "mirror://cpan/authors/id/R/RU/RURBAN/Crypt-OpenSSL-Random-"
 764              version
 765              ".tar.gz"))
 766       (sha256
 767         (base32
 768           "0vmvrb3shrzjzri3qn524dzdasbq8zhhbpc1vmq8sx68n4jhizb0"))))
 769   (build-system perl-build-system)
 770   (native-inputs
 771    `(("perl-crypt-openssl-guess" ,perl-crypt-openssl-guess)))
 772   (inputs
 773    `(("openssl" ,openssl)))
 774   (arguments perl-crypt-arguments)
 775   (home-page
 776     "https://metacpan.org/release/Crypt-OpenSSL-Random")
 777   (synopsis
 778     "OpenSSL/LibreSSL pseudo-random number generator access")
 779   (description "Crypt::OpenSSL::Random is a OpenSSL/LibreSSL pseudo-random
 780 number generator")
 781   (license license:perl-license)))
 782
 783 (define-public acme-client
 784   (package
 785     (name "acme-client")
 786     (version "0.1.16")
 787     (source (origin
 788               (method url-fetch)
 789               (uri (string-append "https://kristaps.bsd.lv/" name "/"
 790                                   "snapshots/" name "-portable-"
 791                                   version ".tgz"))
 792               (sha256
 793                (base32
 794                 "00q05b3b1dfnfp7sr1nbd212n0mqrycl3cr9lbs51m7ncaihbrz9"))))
 795     (build-system gnu-build-system)
 796     (arguments
 797      '(#:tests? #f ; no test suite
 798        #:make-flags
 799        (list "CC=gcc"
 800              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 801        #:phases
 802        (modify-phases %standard-phases
 803          (add-after 'unpack 'patch-paths
 804            (lambda* (#:key inputs #:allow-other-keys)
 805              (let ((pem (string-append (assoc-ref inputs "libressl")
 806                                        "/etc/ssl/cert.pem")))
 807                (substitute* "http.c"
 808                  (("/etc/ssl/cert.pem") pem))
 809                #t)))
 810          (delete 'configure)))) ; no './configure' script
 811     (native-inputs
 812      `(("pkg-config" ,pkg-config)))
 813     (inputs
 814      `(("libbsd" ,libbsd)
 815        ("libressl" ,libressl)))
 816     (synopsis "Let's Encrypt client by the OpenBSD project")
 817     (description "acme-client is a Let's Encrypt client implemented in C.  It
 818 uses a modular design, and attempts to secure itself by dropping privileges and
 819 operating in a chroot where possible.  acme-client is developed on OpenBSD and
 820 then ported to the GNU / Linux environment.")
 821     (home-page "https://kristaps.bsd.lv/acme-client/")
 822     ;; acme-client is distributed under the ISC license, but the files 'jsmn.h'
 823     ;; and 'jsmn.c' are distributed under the Expat license.
 824     (license (list license:isc license:expat))))
 825
 826 ;; The "-apache" variant is the upstreamed prefered variant. A "-gpl"
 827 ;; variant exists in addition to the "-apache" one.
 828 (define-public mbedtls-apache
 829   (package
 830     (name "mbedtls-apache")
 831     (version "2.16.0")
 832     (source
 833      (origin
 834        (method url-fetch)
 835        ;; XXX: The download links on the website are script redirection links
 836        ;; which effectively lead to the format listed in the uri here.
 837        (uri (string-append "https://tls.mbed.org/download/mbedtls-"
 838                            version "-apache.tgz"))
 839        (sha256
 840         (base32
 841          "1qlscr0m97favkqmrlj90rlgw40h8lcypxz0snvr1iwkj1pbbnp3"))))
 842     (build-system cmake-build-system)
 843     (arguments
 844      `(#:configure-flags
 845        (list "-DUSE_SHARED_MBEDTLS_LIBRARY=ON")))
 846     (native-inputs
 847      `(("perl" ,perl)
 848        ("python" ,python)))
 849     (synopsis "Small TLS library")
 850     (description
 851      "@code{mbed TLS}, formerly known as PolarSSL, makes it trivially easy
 852 for developers to include cryptographic and SSL/TLS capabilities in their
 853 (embedded) products, facilitating this functionality with a minimal
 854 coding footprint.")
 855     (home-page "https://tls.mbed.org")
 856     (license license:asl2.0)))
 857
 858 ;; The Hiawatha Web server requires some specific features to be enabled.
 859 (define-public mbedtls-for-hiawatha
 860   (hidden-package
 861    (package
 862      (inherit mbedtls-apache)
 863      (arguments
 864       (substitute-keyword-arguments
 865           `(#:phases
 866             (modify-phases %standard-phases
 867               (add-after 'configure 'configure-extra-features
 868                 (lambda _
 869                   (for-each (lambda (feature)
 870                               (invoke "scripts/config.pl" "set" feature))
 871                             (list "MBEDTLS_THREADING_C"
 872                                   "MBEDTLS_THREADING_PTHREAD"))
 873                   #t)))
 874             ,@(package-arguments mbedtls-apache)))))))
 875
 876 (define-public ghc-tls
 877   (package
 878     (name "ghc-tls")
 879     (version "1.4.1")
 880     (source (origin
 881               (method url-fetch)
 882               (uri (string-append "https://hackage.haskell.org/package/"
 883                                   "tls/tls-" version ".tar.gz"))
 884               (sha256
 885                (base32
 886                 "1y083724mym28n6xfaz7pcc7zqxdhjpaxpbvzxfbs25qq2px3smv"))))
 887     (build-system haskell-build-system)
 888     (inputs
 889      `(("ghc-cereal" ,ghc-cereal)
 890        ("ghc-data-default-class" ,ghc-data-default-class)
 891        ("ghc-memory" ,ghc-memory)
 892        ("ghc-cryptonite" ,ghc-cryptonite)
 893        ("ghc-asn1-types" ,ghc-asn1-types)
 894        ("ghc-asn1-encoding" ,ghc-asn1-encoding)
 895        ("ghc-x509" ,ghc-x509)
 896        ("ghc-x509-store" ,ghc-x509-store)
 897        ("ghc-x509-validation" ,ghc-x509-validation)
 898        ("ghc-async" ,ghc-async)
 899        ("ghc-network" ,ghc-network)
 900        ("ghc-hourglass" ,ghc-hourglass)))
 901     (native-inputs
 902      `(("ghc-tasty" ,ghc-tasty)
 903        ("ghc-tasty-quickcheck" ,ghc-tasty-quickcheck)
 904        ("ghc-quickcheck" ,ghc-quickcheck)))
 905     (home-page "https://github.com/vincenthz/hs-tls")
 906     (synopsis
 907      "TLS/SSL protocol native implementation (Server and Client)")
 908     (description
 909      "Native Haskell TLS and SSL protocol implementation for server and client.
 910 This provides a high-level implementation of a sensitive security protocol,
 911 eliminating a common set of security issues through the use of the advanced
 912 type system, high level constructions and common Haskell features.  Currently
 913 implement the SSL3.0, TLS1.0, TLS1.1 and TLS1.2 protocol, and support RSA and
 914 Ephemeral (Elliptic curve and regular) Diffie Hellman key exchanges, and many
 915 extensions.")
 916     (license license:bsd-3)))
 917
 918 (define-public dehydrated
 919   (package
 920     (name "dehydrated")
 921     (version "0.6.2")
 922     (source (origin
 923               (method url-fetch/tarbomb)
 924               (uri (string-append
 925                     "https://github.com/lukas2511/dehydrated/archive/v"
 926                     version ".tar.gz"))
 927               (sha256
 928                (base32
 929                 "03p80yj6bnzjc6dkp5hb9wpplmlrla8n5src71cnzw4rj53q8cqn"))
 930               (file-name (string-append name "-" version ".tar.gz"))))
 931     (build-system trivial-build-system)
 932     (arguments
 933      `(#:modules ((guix build utils))
 934        #:builder
 935        (begin
 936          (use-modules (guix build utils))
 937          (let* ((source (assoc-ref %build-inputs "source"))
 938                 (out (assoc-ref %outputs "out"))
 939                 (bin (string-append out "/bin"))
 940                 (bash (in-vicinity (assoc-ref %build-inputs "bash") "bin")))
 941            (mkdir-p bin)
 942            (with-directory-excursion bin
 943              (copy-file
 944               (in-vicinity source (string-append "/dehydrated-" ,version
 945                                                  "/dehydrated"))
 946               (in-vicinity bin "dehydrated"))
 947              (patch-shebang "dehydrated" (list bash))
 948
 949              ;; Do not try to write in the store.
 950              (substitute* "dehydrated"
 951                (("SCRIPTDIR=\"\\$.*\"") "SCRIPTDIR=~/.dehydrated"))
 952
 953              (setenv "PATH" bash)
 954              (wrap-program "dehydrated"
 955                `("PATH" ":" prefix
 956                  ,(map (lambda (dir)
 957                          (string-append dir "/bin"))
 958                        (map (lambda (input)
 959                               (assoc-ref %build-inputs input))
 960                             '("coreutils"
 961                               "curl"
 962                               "diffutils"
 963                               "gawk"
 964                               "grep"
 965                               "openssl"
 966                               "sed"))))))
 967            #t))))
 968     (inputs
 969      `(("bash" ,bash)
 970        ("coreutils" ,coreutils)
 971        ("curl" ,curl)
 972        ("diffutils" ,diffutils)
 973        ("gawk" ,gawk)
 974        ("grep" ,grep)
 975        ("openssl" ,openssl)
 976        ("sed" ,sed)))
 977     (home-page "https://dehydrated.io/")
 978     (synopsis "Let's Encrypt/ACME client implemented as a shell script")
 979     (description "Dehydrated is a client for signing certificates with an
 980 ACME-server (currently only provided by Let's Encrypt) implemented as a
 981 relatively simple Bash script.")
 982     (license license:expat)))