tjh.dev
1{
2 lib,
3 stdenv,
4 buildNpmPackage,
5 nodejs_20,
6 fetchFromGitHub,
7 cctools,
8 nix-update-script,
9 nixosTests,
10 perl,
11 xcbuild,
12}:
13
14buildNpmPackage rec {
15 pname = "bitwarden-cli";
16 version = "2025.5.0";
17
18 src = fetchFromGitHub {
19 owner = "bitwarden";
20 repo = "clients";
21 tag = "cli-v${version}";
22 hash = "sha256-8jVKwqKhTfhur226SER4sb1i4dY+TjJRYmOY8YtO6CY=";
23 };
24
25 postPatch = ''
26 # remove code under unfree license
27 rm -r bitwarden_license
28 '';
29
30 nodejs = nodejs_20;
31
32 npmDepsHash = "sha256-0IoBPRGdtkMeTrT5cqZLHB/WrUCONtsJ6YHh0y4K5Ls=";
33
34 nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
35 cctools
36 perl
37 xcbuild.xcrun
38 ];
39
40 makeCacheWritable = true;
41
42 env = {
43 ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
44 npm_config_build_from_source = "true";
45 };
46
47 npmBuildScript = "build:oss:prod";
48
49 npmWorkspace = "apps/cli";
50
51 npmFlags = [ "--legacy-peer-deps" ];
52
53 npmRebuildFlags = [
54 # we'll run npm rebuild manually later
55 "--ignore-scripts"
56 ];
57
58 postConfigure = ''
59 # we want to build everything from source
60 shopt -s globstar
61 rm -r node_modules/**/prebuilds
62 shopt -u globstar
63
64 # FIXME one of the esbuild versions fails to download @esbuild/linux-x64
65 rm -r node_modules/esbuild node_modules/vite/node_modules/esbuild
66
67 npm rebuild --verbose
68 '';
69
70 postBuild = ''
71 # remove build artifacts that bloat the closure
72 shopt -s globstar
73 rm -r node_modules/**/{*.target.mk,binding.Makefile,config.gypi,Makefile,Release/.deps}
74 shopt -u globstar
75 '';
76
77 postInstall = ''
78 # The @bitwarden modules are actually npm workspaces inside the source tree, which
79 # leave dangling symlinks behind. They can be safely removed, because their source is
80 # bundled via webpack and thus not needed at run-time.
81 rm -rf $out/lib/node_modules/@bitwarden/clients/node_modules/{@bitwarden,.bin}
82 ''
83 + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
84 installShellCompletion --cmd bw --zsh <($out/bin/bw completion --shell zsh)
85 '';
86
87 passthru = {
88 tests = {
89 vaultwarden = nixosTests.vaultwarden.sqlite;
90 };
91 updateScript = nix-update-script {
92 extraArgs = [
93 "--version=stable"
94 "--version-regex=^cli-v(.*)$"
95 ];
96 };
97 };
98
99 meta = {
100 # https://github.com/NixOS/nixpkgs/issues/339576
101 broken = stdenv.hostPlatform.isDarwin;
102 changelog = "https://github.com/bitwarden/clients/releases/tag/${src.tag}";
103 description = "Secure and free password manager for all of your devices";
104 homepage = "https://bitwarden.com";
105 license = lib.licenses.gpl3Only;
106 mainProgram = "bw";
107 maintainers = with lib.maintainers; [ dotlambda ];
108 };
109}