cacert: Build directly from nss instead of our own tarball

1 files changed, 19 insertions, 13 deletions

diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 0a2c43fc5812..205d051ddb29 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -1,23 +1,29 @@
-{ stdenv, fetchurl }:
+{ stdenv, nss, curl-full, perl, perlPackages }:
 
 stdenv.mkDerivation rec {
-  name = "cacert-20140715";
+  name = "nss-cacert-${nss.version}";
 
-  src = fetchurl {
-    url = "http://tarballs.nixos.org/${name}.pem.bz2";
-    sha256 = "1l4j7z6ysnllx99isjzlc8zc34rbbgj4kzlg1y5sy9bgphc8cssl";
-  };
+  src = nss.src;
+
+  postPatch = ''
+    unpackFile ${curl-full.src};
+  '';
+
+  nativeBuildInputs = [ perl ] ++ (with perlPackages; [ LWP ]);
 
-  unpackPhase = "true";
+  buildPhase = ''
+    perl curl-*/lib/mk-ca-bundle.pl -d "file://$(pwd)/nss/lib/ckfw/builtins/certdata.txt" ca-bundle.crt
+  '';
 
-  installPhase =
-    ''
-      mkdir -p $out/etc
-      bunzip2 < $src > $out/etc/ca-bundle.crt
-    '';
+  installPhase = ''
+    mkdir -pv $out
+    cp -v ca-bundle.crt $out
+  '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://curl.haxx.se/docs/caextract.html;
     description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ wkennington ];
   };
 }