BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #132072 from SuperSandro2000/cacert

Browse source 
cacert: convert to pname + version, format, cleanup
This commit is contained in:
Robert Hensing 2021-08-01 00:40:06 +02:00 committed by GitHub
commit c9c39abadf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 69 additions and 65 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

134
pkgs/data/misc/cacert/default.nix
View file

@ -1,28 +1,17 @@
{ lib, stdenv, fetchurl, nss, python3
, blacklist ? []
{ lib
, stdenv
, fetchurl
, nss
, python3
, blacklist ? [ ]
# Used for tests only
# Used for tests only
, runCommand
, cacert
, openssl
}:
with lib;
let
version = "3.66";
underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
in
stdenv.mkDerivation {
name = "nss-cacert-${version}";
src = fetchurl {
url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
};
certdata2pem = fetchurl {
name = "certdata2pem.py";
urls = [
@ -31,6 +20,16 @@ stdenv.mkDerivation {
];
sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy";
};
in
stdenv.mkDerivation rec {
pname = "nss-cacert";
version = "3.66";
src = fetchurl {
url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
};
outputs = [ "out" "unbundled" ];
@ -40,11 +39,11 @@ stdenv.mkDerivation {
ln -s nss/lib/ckfw/builtins/certdata.txt
cat << EOF > blacklist.txt
${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
${lib.concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)}
EOF
# copy from the store, otherwise python will scan it for imports
cat "$certdata2pem" > certdata2pem.py
cat "${certdata2pem}" > certdata2pem.py
'';
buildPhase = ''
@ -63,61 +62,66 @@ stdenv.mkDerivation {
# install individual certs in unbundled output
mkdir -pv $unbundled/etc/ssl/certs
cp -v *.crt $unbundled/etc/ssl/certs
rm -f $unbundled/etc/ssl/certs/ca-bundle.crt # not wanted in unbundled
rm $unbundled/etc/ssl/certs/ca-bundle.crt # not wanted in unbundled
'';
setupHook = ./setup-hook.sh;
passthru.updateScript = ./update.sh;
passthru.tests = {
# Test that building this derivation with a blacklist works, and that UTF-8 is supported.
blacklist-utf8 = let
blacklistCAToFingerprint = {
# "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
"CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
"NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
};
mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
in runCommand "verify-the-cacert-filter-output" {
cacert = cacert.unbundled;
cacertWithExcludes = (cacert.override {
blacklist = builtins.attrNames blacklistCAToFingerprint;
}).unbundled;
passthru = {
updateScript = ./update.sh;
tests = {
# Test that building this derivation with a blacklist works, and that UTF-8 is supported.
blacklist-utf8 =
let
blacklistCAToFingerprint = {
# "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
"CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
"NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
};
mapBlacklist = f: lib.concatStringsSep "\n" (lib.mapAttrsToList f blacklistCAToFingerprint);
in
runCommand "verify-the-cacert-filter-output"
{
cacert = cacert.unbundled;
cacertWithExcludes = (cacert.override {
blacklist = builtins.attrNames blacklistCAToFingerprint;
}).unbundled;
nativeBuildInputs = [ openssl ];
} ''
isPresent() {
# isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
for f in $1/etc/ssl/certs/*.crt; do
fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
if [[ "x$fingerprint" == "x$3" ]]; then
return 0
fi
done
return 1
}
nativeBuildInputs = [ openssl ];
} ''
isPresent() {
# isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
for f in $1/etc/ssl/certs/*.crt; do
fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
if [[ "x$fingerprint" == "x$3" ]]; then
return 0
fi
done
return 1
}
# Ensure that each certificate is in the main "cacert".
${mapBlacklist (caName: caFingerprint: ''
isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
exit 1
})
'')}
# Ensure that each certificate is in the main "cacert".
${mapBlacklist (caName: caFingerprint: ''
isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
exit 1
})
'')}
# Ensure that each certificate is NOT in the "cacertWithExcludes".
${mapBlacklist (caName: caFingerprint: ''
isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
exit 1
})
'')}
# Ensure that each certificate is NOT in the "cacertWithExcludes".
${mapBlacklist (caName: caFingerprint: ''
isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
exit 1
})
'')}
touch $out
'';
touch $out
'';
};
};
meta = {
meta = with lib; {
homepage = "https://curl.haxx.se/docs/caextract.html";
description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
platforms = platforms.all;