tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1{
2 lib,
3 stdenv,
4 buildPackages,
5 fetchurl,
6 zlib,
7 libtasn1,
8 nettle,
9 pkg-config,
10 perl,
11 gmp,
12 automake,
13 libidn2,
14 libiconv,
15 texinfo,
16 unbound,
17 dns-root-data,
18 gettext,
19 util-linuxMinimal,
20 cxxBindings ? !stdenv.hostPlatform.isStatic, # tries to link libstdc++.so
21 tpmSupport ? false,
22 trousers,
23 which,
24 net-tools,
25 libunistring,
26 withP11-kit ? !stdenv.hostPlatform.isStatic,
27 p11-kit,
28 # certificate compression - only zlib now, more possible: zstd, brotli
29
30 # for passthru.tests
31 curlWithGnuTls,
32 emacs,
33 ffmpeg,
34 haskellPackages,
35 knot-resolver_5,
36 ngtcp2-gnutls,
37 ocamlPackages,
38 pkgsStatic,
39 python3Packages,
40 qemu,
41 rsyslog,
42 openconnect,
43 samba,
44
45 gitUpdater,
46}:
47
48let
49
50 # XXX: Gnulib's `test-select' fails on FreeBSD:
51 # https://hydra.nixos.org/build/2962084/nixlog/1/raw .
52 doCheck =
53 !stdenv.hostPlatform.isFreeBSD
54 && !stdenv.hostPlatform.isDarwin
55 && stdenv.buildPlatform == stdenv.hostPlatform;
56
57 inherit (stdenv.hostPlatform) isDarwin;
58
59 # break the cyclic dependency
60 util-linux = util-linuxMinimal;
61in
62
63stdenv.mkDerivation rec {
64 pname = "gnutls";
65 version = "3.8.11";
66
67 src = fetchurl {
68 url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
69 hash = "sha256-kb0jxKhuvGFS6BMD0gz2zq65e8j4QmbQ+uxuKfF7qiA=";
70 };
71
72 outputs = [
73 "bin"
74 "dev"
75 "out"
76 ]
77 ++ lib.optionals (!stdenv.hostPlatform.isMinGW) [
78 "man"
79 "devdoc"
80 ];
81
82 # Not normally useful docs.
83 outputInfo = "devdoc";
84 outputDoc = "devdoc";
85
86 patches = [
87 ./nix-ssl-cert-file.patch
88
89 # Fixes test-float failure on ppc64 with C23
90 # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
91 # Multiple upstream commits squashed with adjustments, see header
92 ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
93 ];
94
95 # Skip some tests:
96 # - pkg-config: building against the result won't work before installing (3.5.11)
97 # - fastopen: no idea; it broke between 3.6.2 and 3.6.3 (3437fdde6 in particular)
98 # - trust-store: default trust store path (/etc/ssl/...) is missing in sandbox (3.5.11)
99 # - psk-file: no idea; it broke between 3.6.3 and 3.6.4
100 # - ktls: requires tls module loaded into kernel and ktls-utils which depends on gnutls
101 # Change p11-kit test to use pkg-config to find p11-kit
102 postPatch = ''
103 sed '2iexit 77' -i tests/{pkgconfig,fastopen}.sh
104 sed '/^void doit(void)/,/^{/ s/{/{ exit(77);/' -i tests/{trust-store,psk-file}.c
105 sed 's:/usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/:`pkg-config --variable=p11_module_path p11-kit-1`:' -i tests/p11-kit-trust.sh
106 ''
107 + lib.optionalString stdenv.hostPlatform.isMusl ''
108 # See https://gitlab.com/gnutls/gnutls/-/issues/945
109 sed '2iecho "certtool tests skipped in musl build"\nexit 0' -i tests/cert-tests/certtool.sh
110 ''
111 + lib.optionalString stdenv.hostPlatform.isLinux ''
112 sed '2iexit 77' -i tests/{ktls,ktls_keyupdate}.sh
113 sed '/-DUSE_KTLS/d' -i tests/Makefile.{am,in}
114 sed '/gnutls_ktls/d' -i tests/Makefile.am
115 sed '/ENABLE_KTLS_TRUE/d' -i tests/Makefile.in
116 ''
117 # https://gitlab.com/gnutls/gnutls/-/issues/1721
118 + ''
119 sed '2iexit 77' -i tests/system-override-compress-cert.sh
120 '';
121
122 preConfigure = "patchShebangs .";
123 configureFlags =
124 lib.optionals withP11-kit [
125 "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
126 "--with-default-trust-store-pkcs11=pkcs11:"
127 ]
128 ++ [
129 "--disable-dependency-tracking"
130 "--enable-fast-install"
131 "--with-unbound-root-key-file=${dns-root-data}/root.key"
132 (lib.withFeature withP11-kit "p11-kit")
133 (lib.enableFeature cxxBindings "cxx")
134 ]
135 ++ lib.optionals stdenv.hostPlatform.isLinux [
136 "--enable-ktls"
137 ]
138 ++ lib.optionals (stdenv.hostPlatform.isMinGW) [
139 "--disable-doc"
140 ]
141 ++ lib.optionals (stdenv.hostPlatform.isLinux && tpmSupport) [
142 "--with-trousers-lib=${trousers}/lib/libtspi.so"
143 ]
144 ++ [
145 # do not dlopen in nixpkgs
146 "--with-zlib=link"
147 ];
148
149 enableParallelBuilding = true;
150
151 hardeningDisable = [ "trivialautovarinit" ];
152
153 buildInputs = [
154 libtasn1
155 libidn2
156 zlib
157 gmp
158 libunistring
159 unbound
160 gettext
161 libiconv
162 ]
163 ++ lib.optional withP11-kit p11-kit
164 ++ lib.optional (tpmSupport && stdenv.hostPlatform.isLinux) trousers;
165
166 nativeBuildInputs = [
167 perl
168 pkg-config
169 texinfo
170 ]
171 ++ [
172 buildPackages.autoconf269
173 automake
174 ]
175 ++ lib.optionals doCheck [
176 which
177 net-tools
178 util-linux
179 ];
180
181 propagatedBuildInputs = [ nettle ];
182
183 inherit doCheck;
184 # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
185 # Also empty files won't work, and we want to avoid potentially impure /etc/
186 preCheck = "NIX_SSL_CERT_FILE=${./dummy.crt}";
187
188 # Fixup broken libtool and pkg-config files
189 preFixup =
190 lib.optionalString (!isDarwin) ''
191 sed ${lib.optionalString tpmSupport "-e 's,-ltspi,-L${trousers}/lib -ltspi,'"} \
192 -e 's,-lz,-L${zlib.out}/lib -lz,' \
193 -e 's,-L${gmp.dev}/lib,-L${gmp.out}/lib,' \
194 -e 's,-lgmp,-L${gmp.out}/lib -lgmp,' \
195 -i $out/lib/*.la "$dev/lib/pkgconfig/gnutls.pc"
196 ''
197 + ''
198 # It seems only useful for static linking but basically noone does that.
199 substituteInPlace "$out/lib/libgnutls.la" \
200 --replace "-lunistring" ""
201 '';
202
203 passthru.updateScript = gitUpdater {
204 url = "https://gitlab.com/gnutls/gnutls.git";
205 };
206
207 passthru.tests = {
208 inherit
209 ngtcp2-gnutls
210 curlWithGnuTls
211 ffmpeg
212 emacs
213 qemu
214 knot-resolver_5
215 samba
216 openconnect
217 ;
218 #inherit (ocamlPackages) ocamlnet;
219 #haskell-gnutls = haskellPackages.gnutls;
220 python3-gnutls = python3Packages.python3-gnutls;
221 rsyslog = rsyslog.override { withGnutls = true; };
222 static = pkgsStatic.gnutls;
223 };
224
225 meta = {
226 description = "GNU Transport Layer Security Library";
227
228 longDescription = ''
229 GnuTLS is a project that aims to develop a library which
230 provides a secure layer, over a reliable transport
231 layer. Currently the GnuTLS library implements the proposed standards by
232 the IETF's TLS working group.
233
234 Quoting from the TLS protocol specification:
235
236 "The TLS protocol provides communications privacy over the
237 Internet. The protocol allows client/server applications to
238 communicate in a way that is designed to prevent eavesdropping,
239 tampering, or message forgery."
240 '';
241
242 homepage = "https://gnutls.org/";
243 license = lib.licenses.lgpl21Plus;
244 maintainers = with lib.maintainers; [ vcunat ];
245 platforms = lib.platforms.all;
246 };
247}