pyrox.dev
1{ stdenv, fetchurl, buildPackages, perl
2, buildPlatform, hostPlatform
3, fetchpatch
4, withCryptodev ? false, cryptodevHeaders
5, enableSSL2 ? false
6}:
7
8with stdenv.lib;
9
10let
11 common = args@{ version, sha256, patches ? [] }: stdenv.mkDerivation rec {
12 name = "openssl-${version}";
13
14 src = fetchurl {
15 url = "http://www.openssl.org/source/${name}.tar.gz";
16 inherit sha256;
17 };
18
19 patches =
20 (args.patches or [])
21 ++ [ ./nix-ssl-cert-file.patch ]
22 ++ optional (versionOlder version "1.1.0")
23 (if hostPlatform.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch)
24 ++ optional (versionOlder version "1.0.2" && hostPlatform.isDarwin)
25 ./darwin-arch.patch;
26
27 postPatch = if (versionAtLeast version "1.1.0" && stdenv.hostPlatform.isMusl) then ''
28 substituteInPlace crypto/async/arch/async_posix.h \
29 --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
30 '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
31 '' else null;
32
33 outputs = [ "bin" "dev" "out" "man" ];
34 setOutputFlags = false;
35 separateDebugInfo = hostPlatform.isLinux;
36
37 nativeBuildInputs = [ perl ];
38 buildInputs = stdenv.lib.optional withCryptodev cryptodevHeaders;
39
40 # TODO(@Ericson2314): Improve with mass rebuild
41 configureScript = {
42 "x86_64-darwin" = "./Configure darwin64-x86_64-cc";
43 "x86_64-solaris" = "./Configure solaris64-x86_64-gcc";
44 }.${hostPlatform.system} or (
45 if hostPlatform == buildPlatform
46 then "./config"
47 else if hostPlatform.isMinGW
48 then "./Configure mingw${toString hostPlatform.parsed.cpu.bits}"
49 else if hostPlatform.isLinux
50 then "./Configure linux-generic${toString hostPlatform.parsed.cpu.bits}"
51 else
52 throw "Not sure what configuration to use for ${hostPlatform.config}"
53 );
54
55 # TODO(@Ericson2314): Make unconditional on mass rebuild
56 ${if buildPlatform != hostPlatform then "configurePlatforms" else null} = [];
57
58 preConfigure = ''
59 patchShebangs Configure
60 '';
61
62 configureFlags = [
63 "shared"
64 "--libdir=lib"
65 "--openssldir=etc/ssl"
66 ] ++ stdenv.lib.optionals withCryptodev [
67 "-DHAVE_CRYPTODEV"
68 "-DUSE_CRYPTODEV_DIGESTS"
69 ] ++ stdenv.lib.optional enableSSL2 "enable-ssl2"
70 ++ stdenv.lib.optional (versionAtLeast version "1.1.0" && hostPlatform.isAarch64) "no-afalgeng";
71
72 makeFlags = [ "MANDIR=$(man)/share/man" ];
73
74 # Parallel building is broken in OpenSSL.
75 enableParallelBuilding = false;
76
77 postInstall = ''
78 # If we're building dynamic libraries, then don't install static
79 # libraries.
80 if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
81 rm "$out/lib/"*.a
82 fi
83
84 mkdir -p $bin
85 mv $out/bin $bin/
86
87 mkdir $dev
88 mv $out/include $dev/
89
90 # remove dependency on Perl at runtime
91 rm -r $out/etc/ssl/misc
92
93 rmdir $out/etc/ssl/{certs,private}
94 '';
95
96 postFixup = ''
97 # Check to make sure the main output doesn't depend on perl
98 if grep -r '${buildPackages.perl}' $out; then
99 echo "Found an erroneous dependency on perl ^^^" >&2
100 exit 1
101 fi
102 '';
103
104 meta = {
105 homepage = https://www.openssl.org/;
106 description = "A cryptographic library that implements the SSL and TLS protocols";
107 platforms = stdenv.lib.platforms.all;
108 maintainers = [ stdenv.lib.maintainers.peti ];
109 priority = 10; # resolves collision with ‘man-pages’
110 };
111 };
112
113in {
114
115 openssl_1_0_2 = common {
116 version = "1.0.2n";
117 sha256 = "1zm82pyq5a9jm10q6iv7d3dih3xwjds4x30fqph3k317byvsn2rp";
118 };
119
120 openssl_1_1_0 = common {
121 version = "1.1.0g";
122 sha256 = "1bvka2wf33w2vxv7yw578nnjqyhz2b3chvfb0l4k2ffscw950kfy";
123 patches = [
124 (fetchpatch {
125 name = "CVE-2017-3738.patch";
126 url = "https://github.com/openssl/openssl/commit/563066.patch";
127 sha256 = "0ni9fwpxf8raw8b58pfa15akbqmxx4q64v0ldsm4b9dqhbxf8mkz";
128 })
129 ];
130 };
131
132}