pyrox.dev
1{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
2, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
3, libxcrypt, pam ? null, glibcCross ? null
4}:
5
6let
7
8 glibc =
9 if stdenv.hostPlatform != stdenv.buildPlatform
10 then glibcCross
11 else assert stdenv.hostPlatform.libc == "glibc"; stdenv.cc.libc;
12
13 dots_in_usernames = fetchpatch {
14 url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch";
15 sha256 = "1fj3rg6x3jppm5jvi9y7fhd2djbi4nc5pgwisw00xlh4qapgz692";
16 };
17
18in
19
20stdenv.mkDerivation rec {
21 pname = "shadow";
22 version = "4.11.1";
23
24 src = fetchFromGitHub {
25 owner = "shadow-maint";
26 repo = "shadow";
27 rev = "v${version}";
28 sha256 = "sha256-PxLX5V0t18JftT5wT41krNv18Ew7Kz3MfZkOi/80ODA=";
29 };
30
31 buildInputs = [ libxcrypt ]
32 ++ lib.optional (pam != null && stdenv.isLinux) pam;
33 nativeBuildInputs = [autoreconfHook libxslt libxml2
34 docbook_xml_dtd_45 docbook_xsl flex bison itstool
35 ];
36
37 patches =
38 [ ./keep-path.patch
39 # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
40 ./respect-xml-catalog-files-var.patch
41 dots_in_usernames
42 ./runtime-shell.patch
43 ];
44
45 RUNTIME_SHELL = runtimeShell;
46
47 # The nix daemon often forbids even creating set[ug]id files.
48 postPatch =
49 ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
50 '';
51
52 outputs = [ "out" "su" "man" ];
53
54 enableParallelBuilding = true;
55
56 # Assume System V `setpgrp (void)', which is the default on GNU variants
57 # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
58 preConfigure = ''
59 export ac_cv_func_setpgrp_void=yes
60 export shadow_cv_logdir=/var/log
61 '';
62
63 configureFlags = [
64 "--enable-man"
65 "--with-group-name-max-length=32"
66 "--with-bcrypt"
67 "--with-yescrypt"
68 ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd";
69
70 preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc")
71 ''
72 substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
73 '';
74
75 postInstall =
76 ''
77 # Don't install ‘groups’, since coreutils already provides it.
78 rm $out/bin/groups
79 rm $man/share/man/man1/groups.*
80
81 # Move the su binary into the su package
82 mkdir -p $su/bin
83 mv $out/bin/su $su/bin
84 '';
85
86 disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;
87
88 meta = with lib; {
89 homepage = "https://github.com/shadow-maint";
90 description = "Suite containing authentication-related tools such as passwd and su";
91 license = licenses.bsd3;
92 platforms = platforms.linux;
93 };
94
95 passthru = {
96 shellPath = "/bin/nologin";
97 tests = { inherit (nixosTests) shadow; };
98 };
99}