tjh.dev
1{ version, hash }:
2{ lib
3, stdenv
4, fetchFromGitHub
5, nspr
6, perl
7, zlib
8, sqlite
9, ninja
10, cctools
11, fixDarwinDylibNames
12, buildPackages
13, useP11kit ? true
14, p11-kit
15, # allow FIPS mode. Note that this makes the output non-reproducible.
16 # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
17 enableFIPS ? false
18, nixosTests
19, nss_latest
20}:
21
22let
23 underscoreVersion = lib.replaceStrings [ "." ] [ "_" ] version;
24in
25stdenv.mkDerivation rec {
26 pname = "nss";
27 inherit version;
28
29 src = fetchFromGitHub {
30 owner = "nss-dev";
31 repo = "nss";
32 rev = "NSS_${lib.replaceStrings ["."] ["_"] version}_RTM";
33 inherit hash;
34 };
35
36 depsBuildBuild = [ buildPackages.stdenv.cc ];
37
38 nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
39 ++ lib.optionals stdenv.hostPlatform.isDarwin [ cctools fixDarwinDylibNames ];
40
41 buildInputs = [ zlib sqlite ];
42
43 propagatedBuildInputs = [ nspr ];
44
45 patches = [
46 # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
47 ./85_security_load_3.85+.patch
48 ./fix-cross-compilation.patch
49 ];
50
51 postPatch = ''
52 patchShebangs .
53
54 for f in coreconf/config.gypi build.sh; do
55 substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
56 done
57
58 substituteInPlace coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
59 '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
60 substituteInPlace coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
61 substituteInPlace coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
62 '';
63
64 outputs = [ "out" "dev" "tools" ];
65
66 buildPhase =
67 let
68 getArch = platform:
69 if platform.isx86_64 then "x64"
70 else if platform.isx86_32 then "ia32"
71 else if platform.isAarch32 then "arm"
72 else if platform.isAarch64 then "arm64"
73 else if platform.isPower && platform.is64bit then
74 (
75 if platform.isLittleEndian then "ppc64le" else "ppc64"
76 )
77 else platform.parsed.cpu.name;
78 # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
79 target = getArch stdenv.hostPlatform;
80 host = getArch stdenv.buildPlatform;
81 in
82 ''
83 runHook preBuild
84
85 sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
86 ./build.sh -v --opt \
87 --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
88 --system-sqlite \
89 --enable-legacy-db \
90 --target ${target} \
91 -Dhost_arch=${host} \
92 -Duse_system_zlib=1 \
93 --enable-libpkix \
94 -j $NIX_BUILD_CORES \
95 ${lib.optionalString enableFIPS "--enable-fips"} \
96 ${lib.optionalString stdenv.isDarwin "--clang"} \
97 ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
98
99 runHook postBuild
100 '';
101
102 env.NIX_CFLAGS_COMPILE = toString ([
103 "-Wno-error"
104 "-DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\""
105 ] ++ lib.optionals stdenv.hostPlatform.is64bit [
106 "-DNSS_USE_64=1"
107 ] ++ lib.optionals stdenv.hostPlatform.isILP32 [
108 "-DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
109 ]);
110
111 installPhase = ''
112 runHook preInstall
113
114 rm -rf $out/private
115 find $out -name "*.TOC" -delete
116 mv $out/public $out/include
117
118 ln -s lib $out/lib64
119
120 # Upstream issue: https://bugzilla.mozilla.org/show_bug.cgi?id=530672
121 # https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/nss/files/nss-3.32-gentoo-fixups.patch?id=af1acce6c6d2c3adb17689261dfe2c2b6771ab8a
122 NSS_MAJOR_VERSION=`grep "NSS_VMAJOR" lib/nss/nss.h | awk '{print $3}'`
123 NSS_MINOR_VERSION=`grep "NSS_VMINOR" lib/nss/nss.h | awk '{print $3}'`
124 NSS_PATCH_VERSION=`grep "NSS_VPATCH" lib/nss/nss.h | awk '{print $3}'`
125 PREFIX="$out"
126
127 mkdir -p $out/lib/pkgconfig
128 sed -e "s,%prefix%,$PREFIX," \
129 -e "s,%exec_prefix%,$PREFIX," \
130 -e "s,%libdir%,$PREFIX/lib64," \
131 -e "s,%includedir%,$dev/include/nss," \
132 -e "s,%NSS_VERSION%,$NSS_MAJOR_VERSION.$NSS_MINOR_VERSION.$NSS_PATCH_VERSION,g" \
133 -e "s,%NSPR_VERSION%,4.16,g" \
134 pkg/pkg-config/nss.pc.in > $out/lib/pkgconfig/nss.pc
135 chmod 0644 $out/lib/pkgconfig/nss.pc
136
137 sed -e "s,@prefix@,$PREFIX," \
138 -e "s,@MOD_MAJOR_VERSION@,$NSS_MAJOR_VERSION," \
139 -e "s,@MOD_MINOR_VERSION@,$NSS_MINOR_VERSION," \
140 -e "s,@MOD_PATCH_VERSION@,$NSS_PATCH_VERSION," \
141 pkg/pkg-config/nss-config.in > $out/bin/nss-config
142 chmod 0755 $out/bin/nss-config
143 '';
144
145 postInstall = lib.optionalString useP11kit ''
146 # Replace built-in trust with p11-kit connection
147 ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
148 '';
149
150 postFixup =
151 let
152 isCross = stdenv.hostPlatform != stdenv.buildPlatform;
153 nss = if isCross then buildPackages.nss.tools else "$out";
154 in
155 (lib.optionalString enableFIPS (''
156 for libname in freebl3 nssdbm3 softokn3
157 do libfile="$out/lib/lib$libname${stdenv.hostPlatform.extensions.sharedLibrary}"'' +
158 (if stdenv.isDarwin
159 then ''
160 DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
161 '' else ''
162 LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
163 '') + ''
164 ${nss}/bin/shlibsign -v -i "$libfile"
165 done
166 '')) +
167 ''
168 moveToOutput bin "$tools"
169 moveToOutput bin/nss-config "$dev"
170 moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
171 rm -f "$out"/lib/*.a
172
173 runHook postInstall
174 '';
175
176 passthru.updateScript = ./update.sh;
177
178 passthru.tests = lib.optionalAttrs (lib.versionOlder version nss_latest.version) {
179 inherit (nixosTests) firefox-esr-115;
180 } // lib.optionalAttrs (lib.versionAtLeast version nss_latest.version) {
181 inherit (nixosTests) firefox;
182 };
183
184 meta = with lib; {
185 homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS";
186 description = "Set of libraries for development of security-enabled client and server applications";
187 changelog = "https://github.com/nss-dev/nss/blob/master/doc/rst/releases/nss_${underscoreVersion}.rst";
188 maintainers = with maintainers; [ hexa ajs124 ];
189 license = licenses.mpl20;
190 platforms = platforms.all;
191 };
192}