pyrox.dev
1{ version, hash }:
2{ lib
3, stdenv
4, fetchurl
5, nspr
6, perl
7, zlib
8, sqlite
9, ninja
10, darwin
11, fixDarwinDylibNames
12, buildPackages
13, useP11kit ? true
14, p11-kit
15, # allow FIPS mode. Note that this makes the output non-reproducible.
16 # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
17 enableFIPS ? false
18, nixosTests
19, nss_latest
20}:
21
22let
23 underscoreVersion = lib.replaceStrings [ "." ] [ "_" ] version;
24in
25stdenv.mkDerivation rec {
26 pname = "nss";
27 inherit version;
28
29 src = fetchurl {
30 url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
31 inherit hash;
32 };
33
34 depsBuildBuild = [ buildPackages.stdenv.cc ];
35
36 nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
37 ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.cctools fixDarwinDylibNames ];
38
39 buildInputs = [ zlib sqlite ];
40
41 propagatedBuildInputs = [ nspr ];
42
43 patches = [
44 # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
45 ./85_security_load_3.85+.patch
46 ./fix-cross-compilation.patch
47 ] ++ lib.optionals (lib.versionOlder version "3.91") [
48 # https://bugzilla.mozilla.org/show_bug.cgi?id=1836925
49 # https://phabricator.services.mozilla.com/D180068
50 ./remove-c25519-support.patch
51 ];
52
53 patchFlags = [ "-p0" ];
54
55 postPatch = ''
56 patchShebangs nss
57
58 for f in nss/coreconf/config.gypi nss/build.sh; do
59 substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
60 done
61
62 substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
63 '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
64 substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
65 substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
66 '';
67
68 outputs = [ "out" "dev" "tools" ];
69
70 preConfigure = "cd nss";
71
72 buildPhase =
73 let
74 getArch = platform:
75 if platform.isx86_64 then "x64"
76 else if platform.isx86_32 then "ia32"
77 else if platform.isAarch32 then "arm"
78 else if platform.isAarch64 then "arm64"
79 else if platform.isPower && platform.is64bit then
80 (
81 if platform.isLittleEndian then "ppc64le" else "ppc64"
82 )
83 else platform.parsed.cpu.name;
84 # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
85 target = getArch stdenv.hostPlatform;
86 host = getArch stdenv.buildPlatform;
87 in
88 ''
89 runHook preBuild
90
91 sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
92 ./build.sh -v --opt \
93 --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
94 --system-sqlite \
95 --enable-legacy-db \
96 --target ${target} \
97 -Dhost_arch=${host} \
98 -Duse_system_zlib=1 \
99 --enable-libpkix \
100 -j $NIX_BUILD_CORES \
101 ${lib.optionalString enableFIPS "--enable-fips"} \
102 ${lib.optionalString stdenv.isDarwin "--clang"} \
103 ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
104
105 runHook postBuild
106 '';
107
108 env.NIX_CFLAGS_COMPILE = toString ([
109 "-Wno-error"
110 "-DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\""
111 ] ++ lib.optionals stdenv.hostPlatform.is64bit [
112 "-DNSS_USE_64=1"
113 ] ++ lib.optionals stdenv.hostPlatform.isILP32 [
114 "-DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
115 ]);
116
117 installPhase = ''
118 runHook preInstall
119
120 rm -rf $out/private
121 find $out -name "*.TOC" -delete
122 mv $out/public $out/include
123
124 ln -s lib $out/lib64
125
126 # Upstream issue: https://bugzilla.mozilla.org/show_bug.cgi?id=530672
127 # https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/nss/files/nss-3.32-gentoo-fixups.patch?id=af1acce6c6d2c3adb17689261dfe2c2b6771ab8a
128 NSS_MAJOR_VERSION=`grep "NSS_VMAJOR" lib/nss/nss.h | awk '{print $3}'`
129 NSS_MINOR_VERSION=`grep "NSS_VMINOR" lib/nss/nss.h | awk '{print $3}'`
130 NSS_PATCH_VERSION=`grep "NSS_VPATCH" lib/nss/nss.h | awk '{print $3}'`
131 PREFIX="$out"
132
133 mkdir -p $out/lib/pkgconfig
134 sed -e "s,%prefix%,$PREFIX," \
135 -e "s,%exec_prefix%,$PREFIX," \
136 -e "s,%libdir%,$PREFIX/lib64," \
137 -e "s,%includedir%,$dev/include/nss," \
138 -e "s,%NSS_VERSION%,$NSS_MAJOR_VERSION.$NSS_MINOR_VERSION.$NSS_PATCH_VERSION,g" \
139 -e "s,%NSPR_VERSION%,4.16,g" \
140 pkg/pkg-config/nss.pc.in > $out/lib/pkgconfig/nss.pc
141 chmod 0644 $out/lib/pkgconfig/nss.pc
142
143 sed -e "s,@prefix@,$PREFIX," \
144 -e "s,@MOD_MAJOR_VERSION@,$NSS_MAJOR_VERSION," \
145 -e "s,@MOD_MINOR_VERSION@,$NSS_MINOR_VERSION," \
146 -e "s,@MOD_PATCH_VERSION@,$NSS_PATCH_VERSION," \
147 pkg/pkg-config/nss-config.in > $out/bin/nss-config
148 chmod 0755 $out/bin/nss-config
149 '';
150
151 postInstall = lib.optionalString useP11kit ''
152 # Replace built-in trust with p11-kit connection
153 ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
154 '';
155
156 postFixup =
157 let
158 isCross = stdenv.hostPlatform != stdenv.buildPlatform;
159 nss = if isCross then buildPackages.nss.tools else "$out";
160 in
161 (lib.optionalString enableFIPS (''
162 for libname in freebl3 nssdbm3 softokn3
163 do libfile="$out/lib/lib$libname${stdenv.hostPlatform.extensions.sharedLibrary}"'' +
164 (if stdenv.isDarwin
165 then ''
166 DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
167 '' else ''
168 LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
169 '') + ''
170 ${nss}/bin/shlibsign -v -i "$libfile"
171 done
172 '')) +
173 ''
174 moveToOutput bin "$tools"
175 moveToOutput bin/nss-config "$dev"
176 moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
177 rm -f "$out"/lib/*.a
178
179 runHook postInstall
180 '';
181
182 passthru.updateScript = ./update.sh;
183
184 passthru.tests = lib.optionalAttrs (lib.versionOlder version nss_latest.version) {
185 inherit (nixosTests) firefox-esr-115;
186 } // lib.optionalAttrs (lib.versionAtLeast version nss_latest.version) {
187 inherit (nixosTests) firefox;
188 };
189
190 meta = with lib; {
191 homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS";
192 description = "A set of libraries for development of security-enabled client and server applications";
193 changelog = "https://github.com/nss-dev/nss/blob/master/doc/rst/releases/nss_${underscoreVersion}.rst";
194 maintainers = with maintainers; [ hexa ajs124 ];
195 license = licenses.mpl20;
196 platforms = platforms.all;
197 };
198}