9e86984fe0
The GSSAPI patch is useful but maintained by Debian, not upstream, and can be slow to update. To avoid breaking openssh_with_kerberos when the openssh version is bumped but the GSSAPI patch has not been updated, don't enable the GSSAPI patch implicitly but require it to be explicitly enabled.
92 lines
2.6 KiB
Nix
92 lines
2.6 KiB
Nix
{ stdenv, fetchurl, fetchpatch, zlib, openssl, perl, libedit, pkgconfig, pam
|
|
, etcDir ? null
|
|
, hpnSupport ? false
|
|
, withKerberos ? false
|
|
, withGssapiPatches ? false
|
|
, kerberos
|
|
, linkOpenssl? true
|
|
}:
|
|
|
|
assert withKerberos -> kerberos != null;
|
|
assert withGssapiPatches -> withKerberos;
|
|
|
|
let
|
|
|
|
hpnSrc = fetchurl {
|
|
url = mirror://sourceforge/hpnssh/openssh-6.6p1-hpnssh14v5.diff.gz;
|
|
sha256 = "682b4a6880d224ee0b7447241b684330b731018585f1ba519f46660c10d63950";
|
|
};
|
|
|
|
gssapiSrc = fetchpatch {
|
|
url = "http://anonscm.debian.org/cgit/pkg-ssh/openssh.git/plain/debian/patches/gssapi.patch?h=debian/7.1p2-2";
|
|
sha256 = "05nsch879nlpyyiwm240wlq9rasy71j9d03j1rfi8kp865zhjfbm";
|
|
};
|
|
|
|
in
|
|
with stdenv.lib;
|
|
stdenv.mkDerivation rec {
|
|
# Please ensure that openssh_with_kerberos still builds when
|
|
# bumping the version here!
|
|
name = "openssh-7.2p1";
|
|
|
|
src = fetchurl {
|
|
url = "mirror://openbsd/OpenSSH/portable/${name}.tar.gz";
|
|
sha256 = "1hsa1f3641pdj57a55gmnvcya3wwww2fc2cvb77y95rm5xxw6g4p";
|
|
};
|
|
|
|
prePatch = optionalString hpnSupport
|
|
''
|
|
gunzip -c ${hpnSrc} | patch -p1
|
|
export NIX_LDFLAGS="$NIX_LDFLAGS -lgcc_s"
|
|
'';
|
|
|
|
patches =
|
|
[ ./locale_archive.patch ]
|
|
++ optional withGssapiPatches gssapiSrc;
|
|
|
|
buildInputs = [ zlib openssl libedit pkgconfig pam ]
|
|
++ optional withKerberos [ kerberos ];
|
|
|
|
# I set --disable-strip because later we strip anyway. And it fails to strip
|
|
# properly when cross building.
|
|
configureFlags = [
|
|
"--sbindir=\${out}/bin"
|
|
"--localstatedir=/var"
|
|
"--with-pid-dir=/run"
|
|
"--with-mantype=man"
|
|
"--with-libedit=yes"
|
|
"--disable-strip"
|
|
(if pam != null then "--with-pam" else "--without-pam")
|
|
] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
|
|
++ optional withKerberos "--with-kerberos5=${kerberos}"
|
|
++ optional stdenv.isDarwin "--disable-libutil"
|
|
++ optional (!linkOpenssl) "--without-openssl";
|
|
|
|
preConfigure = ''
|
|
configureFlagsArray+=("--with-privsep-path=$out/empty")
|
|
mkdir -p $out/empty
|
|
'';
|
|
|
|
enableParallelBuilding = true;
|
|
|
|
postInstall = ''
|
|
# Install ssh-copy-id, it's very useful.
|
|
cp contrib/ssh-copy-id $out/bin/
|
|
chmod +x $out/bin/ssh-copy-id
|
|
cp contrib/ssh-copy-id.1 $out/share/man/man1/
|
|
'';
|
|
|
|
installTargets = [ "install-nokeys" ];
|
|
installFlags = [
|
|
"sysconfdir=\${out}/etc/ssh"
|
|
];
|
|
|
|
meta = {
|
|
homepage = "http://www.openssh.org/";
|
|
description = "An implementation of the SSH protocol";
|
|
license = stdenv.lib.licenses.bsd2;
|
|
platforms = platforms.unix;
|
|
maintainers = with maintainers; [ eelco ];
|
|
broken = hpnSupport; # probably after 6.7 update
|
|
};
|
|
}
|