3 files changed, 71 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/development/libraries/mbedtls/2.nix b/nixpkgs/pkgs/development/libraries/mbedtls/2.nix
new file mode 100644
index 000000000000..3711e2d2b4ff
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/mbedtls/2.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "2.28.4";
+  hash = "sha256-88Lnj9NgS5PWg2hydvb9cwi6s6BG3UMvkUH2Ny1jmtE=";
+}
diff --git a/nixpkgs/pkgs/development/libraries/mbedtls/3.nix b/nixpkgs/pkgs/development/libraries/mbedtls/3.nix
new file mode 100644
index 000000000000..01df03bbbadb
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/mbedtls/3.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  version = "3.4.1";
+  hash = "sha256-NIjyRcVbg6lT6+RlTz5Jt6V9T85mvta5grOSLIAK9Ts=";
+}
diff --git a/nixpkgs/pkgs/development/libraries/mbedtls/generic.nix b/nixpkgs/pkgs/development/libraries/mbedtls/generic.nix
new file mode 100644
index 000000000000..3ca0b491fb89
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/mbedtls/generic.nix
@@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, version
+, hash
+, fetchFromGitHub
+
+, cmake
+, ninja
+, perl # Project uses Perl for scripting and testing
+, python3
+
+, enableThreading ? true # Threading can be disabled to increase security https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mbedtls";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "Mbed-TLS";
+    repo = "mbedtls";
+    rev = "${pname}-${version}";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [ cmake ninja perl python3 ];
+
+  strictDeps = true;
+
+  postConfigure = lib.optionalString enableThreading ''
+    perl scripts/config.pl set MBEDTLS_THREADING_C    # Threading abstraction layer
+    perl scripts/config.pl set MBEDTLS_THREADING_PTHREAD    # POSIX thread wrapper layer for the threading layer.
+  '';
+
+  cmakeFlags = [
+    "-DUSE_SHARED_MBEDTLS_LIBRARY=${if stdenv.hostPlatform.isStatic then "off" else "on"}"
+
+    # Avoid a dependency on jsonschema and jinja2 by not generating source code
+    # using python. In releases, these generated files are already present in
+    # the repository and do not need to be regenerated. See:
+    # https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0 below "Requirement changes".
+    "-DGEN_FILES=off"
+  ];
+
+  doCheck = true;
+
+  # Parallel checking causes test failures
+  # https://github.com/Mbed-TLS/mbedtls/issues/4980
+  enableParallelChecking = false;
+
+  meta = with lib; {
+    homepage = "https://www.trustedfirmware.org/projects/mbed-tls/";
+    changelog = "https://github.com/Mbed-TLS/mbedtls/blob/${pname}-${version}/ChangeLog";
+    description = "Portable cryptographic and TLS library, formerly known as PolarSSL";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ raphaelr ];
+  };
+}