tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1{
2 lib,
3 buildPythonPackage,
4 dissect-cstruct,
5 dissect-util,
6 fetchFromGitHub,
7 flow-record,
8 hatch-vcs,
9 hatchling,
10 httpx,
11 lark,
12 pycryptodome,
13 pyshark,
14 pytest-httpserver,
15 pytestCheckHook,
16 rich,
17}:
18
19buildPythonPackage rec {
20 pname = "dissect-cobaltstrike";
21 version = "1.2.1";
22 pyproject = true;
23
24 src = fetchFromGitHub {
25 owner = "fox-it";
26 repo = "dissect.cobaltstrike";
27 tag = "v${version}";
28 hash = "sha256-0Wi0H9jL7suF/d92Sg2LuE6M2EzbIWsEC7Jjd1eJGTw=";
29 };
30
31 build-system = [
32 hatch-vcs
33 hatchling
34 ];
35
36 dependencies = [
37 dissect-cstruct
38 dissect-util
39 lark
40 ];
41
42 optional-dependencies = {
43 c2 = [
44 flow-record
45 httpx
46 pycryptodome
47 ];
48 pcap = [
49 flow-record
50 httpx
51 pycryptodome
52 pyshark
53 ];
54 full = [
55 flow-record
56 httpx
57 pycryptodome
58 pyshark
59 rich
60 ];
61 };
62
63 __darwinAllowLocalNetworking = true;
64
65 nativeCheckInputs = [
66 pytest-httpserver
67 pytestCheckHook
68 ]
69 ++ lib.concatAttrValues optional-dependencies;
70
71 pythonImportsCheck = [ "dissect.cobaltstrike" ];
72
73 disabledTests = [
74 # Don't run tests with a beacon
75 "test_c2profile_beacon_gate"
76 "test_beacon_dump_guardrails"
77 ];
78
79 meta = {
80 description = "Dissect module implementing a parser for Cobalt Strike related data";
81 homepage = "https://github.com/fox-it/dissect.cobaltstrike";
82 changelog = "https://github.com/fox-it/dissect.cobaltstrike/releases/tag/${src.tag}";
83 license = lib.licenses.mit;
84 maintainers = with lib.maintainers; [ fab ];
85 };
86}