tjh.dev
1{ lib
2, buildPythonPackage
3, dissect-cstruct
4, dissect-util
5, fetchFromGitHub
6, flow-record
7, httpx
8, lark
9, pycryptodome
10, pyshark
11, pytest-httpserver
12, pytestCheckHook
13, pythonOlder
14, rich
15, setuptools
16, setuptools-scm
17}:
18
19buildPythonPackage rec {
20 pname = "dissect-cobaltstrike";
21 version = "1.0.0";
22 format = "pyproject";
23
24 disabled = pythonOlder "3.7";
25
26 src = fetchFromGitHub {
27 owner = "fox-it";
28 repo = "dissect.cobaltstrike";
29 rev = "refs/tags/v${version}";
30 hash = "sha256-CS50c3r7sdxp3CRS6XJ4QUmUFtmhFg6rSdKfYzJSOV4=";
31 };
32
33 SETUPTOOLS_SCM_PRETEND_VERSION = version;
34
35 nativeBuildInputs = [
36 setuptools
37 setuptools-scm
38 ];
39
40 propagatedBuildInputs = [
41 dissect-cstruct
42 dissect-util
43 lark
44 ];
45
46 passthru.optional-dependencies = {
47 c2 = [
48 flow-record
49 httpx
50 pycryptodome
51 ];
52 pcap = [
53 flow-record
54 httpx
55 pycryptodome
56 pyshark
57 ];
58 full = [
59 flow-record
60 httpx
61 pycryptodome
62 pyshark
63 rich
64 ];
65 };
66
67 nativeCheckInputs = [
68 pytest-httpserver
69 pytestCheckHook
70 ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
71
72 pythonImportsCheck = [
73 "dissect.cobaltstrike"
74 ];
75
76 meta = with lib; {
77 description = "Dissect module implementing a parser for Cobalt Strike related data";
78 homepage = "https://github.com/fox-it/dissect.cobaltstrike";
79 changelog = "https://github.com/fox-it/dissect.cobaltstrike/releases/tag/${version}";
80 license = licenses.agpl3Only;
81 maintainers = with maintainers; [ fab ];
82 };
83}