diff options
Diffstat (limited to 'nixpkgs/pkgs/development/libraries/openssl')
9 files changed, 814 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/development/libraries/openssl/1.1/nix-ssl-cert-file.patch b/nixpkgs/pkgs/development/libraries/openssl/1.1/nix-ssl-cert-file.patch new file mode 100644 index 000000000000..9e871cfb1d31 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/1.1/nix-ssl-cert-file.patch @@ -0,0 +1,15 @@ +diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c +index 244512c935..f0b70d7ea1 100644 +--- a/crypto/x509/by_file.c ++++ b/crypto/x509/by_file.c +@@ -46,7 +46,9 @@ static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argp, + switch (cmd) { + case X509_L_FILE_LOAD: + if (argl == X509_FILETYPE_DEFAULT) { +- file = ossl_safe_getenv(X509_get_default_cert_file_env()); ++ file = ossl_safe_getenv("NIX_SSL_CERT_FILE"); ++ if (!file) ++ file = ossl_safe_getenv(X509_get_default_cert_file_env()); + if (file) + ok = (X509_load_cert_crl_file(ctx, file, + X509_FILETYPE_PEM) != 0); diff --git a/nixpkgs/pkgs/development/libraries/openssl/3.0/legacy.cnf b/nixpkgs/pkgs/development/libraries/openssl/3.0/legacy.cnf new file mode 100644 index 000000000000..a6485a8c3796 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/3.0/legacy.cnf @@ -0,0 +1,395 @@ +# Taken from OpenSSL 3.0.7 and modified according to: https://wiki.openssl.org/index.php/OpenSSL_3.0#Programming_in_OpenSSL_3.0 +# +# OpenSSL example configuration file. +# See doc/man5/config.pod for more info. +# +# This is mostly being used for generation of certificate requests, +# but may be used for auto loading of providers + +# Note that you can include other files from the main configuration +# file using the .include directive. +#.include filename + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . + + # Use this in order to automatically load providers. +openssl_conf = openssl_init + +# Comment out the next line to ignore configuration errors +config_diagnostics = 1 + +# Extra OBJECT IDENTIFIER info: +# oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] +# We can add new OIDs in here for use by 'ca', 'req' and 'ts'. +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +# Policies used by the TSA examples. +tsa_policy1 = 1.2.3.4.1 +tsa_policy2 = 1.2.3.4.5.6 +tsa_policy3 = 1.2.3.4.5.7 + +# For FIPS +# Optionally include a file that is generated by the OpenSSL fipsinstall +# application. This file contains configuration data required by the OpenSSL +# fips provider. It contains a named section e.g. [fips_sect] which is +# referenced from the [provider_sect] below. +# Refer to the OpenSSL security policy for more information. +# .include fipsmodule.cnf + +[openssl_init] +providers = provider_sect + +# List of providers to load +[provider_sect] +default = default_sect +legacy = legacy_sect + +# The fips section name should match the section name inside the +# included fipsmodule.cnf. +# fips = fips_sect + +# If no providers are activated explicitly, the default one is activated implicitly. +# See man 7 OSSL_PROVIDER-default for more details. +# +# If you add a section explicitly activating any other provider(s), you most +# probably need to explicitly activate the default provider, otherwise it +# becomes unavailable in openssl. As a consequence applications depending on +# OpenSSL may not work correctly which could lead to significant system +# problems including inability to remotely access the system. +[default_sect] +activate = 1 + +[legacy_sect] +activate = 1 + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = ./demoCA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +#unique_subject = no # Set to 'no' to allow creation of + # several certs with same subject. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crlnumber = $dir/crlnumber # the current crl number + # must be commented out to leave a V1 CRL +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem# The private key + +x509_extensions = usr_cert # The extensions to add to the cert + +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + +# Extension copying option: use with caution. +# copy_extensions = copy + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crlnumber must also be commented out to leave a V1 CRL. +# crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = default # use public key default MD +preserve = no # keep passed DN ordering + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +default_bits = 2048 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extensions to add to the self signed cert + +# Passwords for private keys if not present they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString (PKIX recommendation before 2004) +# utf8only: only UTF8Strings (PKIX recommendation after 2004). +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. +string_mask = utf8only + +# req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = AU +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = Some-State + +localityName = Locality Name (eg, city) + +0.organizationName = Organization Name (eg, company) +0.organizationName_default = Internet Widgits Pty Ltd + +# we can do this but it is not needed normally :-) +#1.organizationName = Second Organization Name (eg, company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Organizational Unit Name (eg, section) +#organizationalUnitName_default = + +commonName = Common Name (e.g. server FQDN or YOUR name) +commonName_max = 64 + +emailAddress = Email Address +emailAddress_max = 64 + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +# These extensions are added when 'ca' signs a request. + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This is required for TSA certificates. +# extendedKeyUsage = critical,timeStamping + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +[ v3_ca ] + + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer + +basicConstraints = critical,CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always + +[ proxy_cert_ext ] +# These extensions should be added when creating a proxy certificate + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This really needs to be in place for it to be a proxy certificate. +proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo + +#################################################################### +[ tsa ] + +default_tsa = tsa_config1 # the default TSA section + +[ tsa_config1 ] + +# These are used by the TSA reply generation only. +dir = ./demoCA # TSA root directory +serial = $dir/tsaserial # The current serial number (mandatory) +crypto_device = builtin # OpenSSL engine to use for signing +signer_cert = $dir/tsacert.pem # The TSA signing certificate + # (optional) +certs = $dir/cacert.pem # Certificate chain to include in reply + # (optional) +signer_key = $dir/private/tsakey.pem # The TSA private key (optional) +signer_digest = sha256 # Signing digest to use. (Optional) +default_policy = tsa_policy1 # Policy if request did not specify it + # (optional) +other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) +digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) +accuracy = secs:1, millisecs:500, microsecs:100 # (optional) +clock_precision_digits = 0 # number of digits after dot. (optional) +ordering = yes # Is ordering defined for timestamps? + # (optional, default: no) +tsa_name = yes # Must the TSA name be included in the reply? + # (optional, default: no) +ess_cert_id_chain = no # Must the ESS cert id chain be included? + # (optional, default: no) +ess_cert_id_alg = sha1 # algorithm to compute certificate + # identifier (optional, default: sha1) + +[insta] # CMP using Insta Demo CA +# Message transfer +server = pki.certificate.fi:8700 +# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080 +# tls_use = 0 +path = pkix/ + +# Server authentication +recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer +ignore_keyusage = 1 # potentially needed quirk +unprotected_errors = 1 # potentially needed quirk +extracertsout = insta.extracerts.pem + +# Client authentication +ref = 3078 # user identification +secret = pass:insta # can be used for both client and server side + +# Generic message options +cmd = ir # default operation, can be overridden on cmd line with, e.g., kur + +# Certificate enrollment +subject = "/CN=openssl-cmp-test" +newkey = insta.priv.pem +out_trusted = insta.ca.crt +certout = insta.cert.pem + +[pbm] # Password-based protection for Insta CA +# Server and client authentication +ref = $insta::ref # 3078 +secret = $insta::secret # pass:insta + +[signature] # Signature-based protection for Insta CA +# Server authentication +trusted = insta.ca.crt # does not include keyUsage digitalSignature + +# Client authentication +secret = # disable PBM +key = $insta::newkey # insta.priv.pem +cert = $insta::certout # insta.cert.pem + +[ir] +cmd = ir + +[cr] +cmd = cr + +[kur] +# Certificate update +cmd = kur +oldcert = $insta::certout # insta.cert.pem + +[rr] +# Certificate revocation +cmd = rr +oldcert = $insta::certout # insta.cert.pem diff --git a/nixpkgs/pkgs/development/libraries/openssl/3.0/nix-ssl-cert-file.patch b/nixpkgs/pkgs/development/libraries/openssl/3.0/nix-ssl-cert-file.patch new file mode 100644 index 000000000000..e7090f49db6a --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/3.0/nix-ssl-cert-file.patch @@ -0,0 +1,15 @@ +diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c +index 37d73ca84c..e328896234 100644 +--- a/crypto/x509/by_file.c ++++ b/crypto/x509/by_file.c +@@ -54,7 +54,9 @@ static int by_file_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argp, + switch (cmd) { + case X509_L_FILE_LOAD: + if (argl == X509_FILETYPE_DEFAULT) { +- file = ossl_safe_getenv(X509_get_default_cert_file_env()); ++ file = ossl_safe_getenv("NIX_SSL_CERT_FILE"); ++ if (!file) ++ file = ossl_safe_getenv(X509_get_default_cert_file_env()); + if (file) + ok = (X509_load_cert_crl_file_ex(ctx, file, X509_FILETYPE_PEM, + libctx, propq) != 0); diff --git a/nixpkgs/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch b/nixpkgs/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch new file mode 100644 index 000000000000..04585565a331 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/3.0/openssl-disable-kernel-detection.patch @@ -0,0 +1,25 @@ +diff --git a/Configure b/Configure +index a558e5ab1a..9a884f0b0f 100755 +--- a/Configure ++++ b/Configure +@@ -1714,20 +1714,6 @@ unless ($disabled{devcryptoeng}) { + + unless ($disabled{ktls}) { + $config{ktls}=""; +- my $cc = $config{CROSS_COMPILE}.$config{CC}; +- if ($target =~ m/^linux/) { +- system("printf '#include <sys/types.h>\n#include <linux/tls.h>' | $cc -E - >/dev/null 2>&1"); +- if ($? != 0) { +- disable('too-old-kernel', 'ktls'); +- } +- } elsif ($target =~ m/^BSD/) { +- system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1"); +- if ($? != 0) { +- disable('too-old-freebsd', 'ktls'); +- } +- } else { +- disable('not-linux-or-freebsd', 'ktls'); +- } + } + + push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls}); diff --git a/nixpkgs/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch b/nixpkgs/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch new file mode 100644 index 000000000000..e8b07b4ae599 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs-darwin.patch @@ -0,0 +1,13 @@ +diff --git a/include/internal/common.h b/include/internal/common.h +index 15666f1..d91e25b 100644 +--- a/include/internal/common.h ++++ b/include/internal/common.h +@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr, + # ifndef OPENSSL_SYS_VMS + # define X509_CERT_AREA OPENSSLDIR + # define X509_CERT_DIR OPENSSLDIR "/certs" +-# define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++# define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + # define X509_PRIVATE_DIR OPENSSLDIR "/private" + # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + # else diff --git a/nixpkgs/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch b/nixpkgs/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch new file mode 100644 index 000000000000..13a36fbcd031 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/3.2/use-etc-ssl-certs.patch @@ -0,0 +1,13 @@ +diff --git a/include/internal/common.h b/include/internal/common.h +index 15666f1..d91e25b 100644 +--- a/include/internal/common.h ++++ b/include/internal/common.h +@@ -83,7 +83,7 @@ __owur static ossl_inline int ossl_assert_int(int expr, const char *exprstr, + # ifndef OPENSSL_SYS_VMS + # define X509_CERT_AREA OPENSSLDIR + # define X509_CERT_DIR OPENSSLDIR "/certs" +-# define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++# define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt" + # define X509_PRIVATE_DIR OPENSSLDIR "/private" + # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + # else diff --git a/nixpkgs/pkgs/development/libraries/openssl/default.nix b/nixpkgs/pkgs/development/libraries/openssl/default.nix new file mode 100644 index 000000000000..c0b4fe75b610 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/default.nix @@ -0,0 +1,312 @@ +{ lib, stdenv, fetchurl, buildPackages, perl, coreutils, writeShellScript +, makeWrapper +, withCryptodev ? false, cryptodev +, withZlib ? false, zlib +, enableSSL2 ? false +, enableSSL3 ? false +, enableKTLS ? stdenv.isLinux +, static ? stdenv.hostPlatform.isStatic +# path to openssl.cnf file. will be placed in $etc/etc/ssl/openssl.cnf to replace the default +, conf ? null +, removeReferencesTo +, testers +}: + +# Note: this package is used for bootstrapping fetchurl, and thus +# cannot use fetchpatch! All mutable patches (generated by GitHub or +# cgit) that are needed here should be included directly in Nixpkgs as +# files. + +let + common = { version, hash, patches ? [], withDocs ? false, extraMeta ? {} }: + stdenv.mkDerivation (finalAttrs: { + pname = "openssl"; + inherit version; + + src = fetchurl { + url = "https://www.openssl.org/source/${finalAttrs.pname}-${version}.tar.gz"; + inherit hash; + }; + + inherit patches; + + postPatch = '' + patchShebangs Configure + '' + lib.optionalString (lib.versionOlder version "1.1.1") '' + patchShebangs test/* + for a in test/t* ; do + substituteInPlace "$a" \ + --replace /bin/rm rm + done + '' + # config is a configure script which is not installed. + + lib.optionalString (lib.versionAtLeast version "1.1.1") '' + substituteInPlace config --replace '/usr/bin/env' '${buildPackages.coreutils}/bin/env' + '' + lib.optionalString (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isMusl) '' + substituteInPlace crypto/async/arch/async_posix.h \ + --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \ + '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0' + '' + # Move ENGINESDIR into OPENSSLDIR for static builds, in order to move + # it to the separate etc output. + + lib.optionalString static '' + substituteInPlace Configurations/unix-Makefile.tmpl \ + --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \ + 'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}' + ''; + + outputs = [ "bin" "dev" "out" "man" ] + ++ lib.optional withDocs "doc" + # Separate output for the runtime dependencies of the static build. + # Specifically, move OPENSSLDIR into this output, as its path will be + # compiled into 'libcrypto.a'. This makes it a runtime dependency of + # any package that statically links openssl, so we want to keep that + # output minimal. + ++ lib.optional static "etc"; + setOutputFlags = false; + separateDebugInfo = + !stdenv.hostPlatform.isDarwin && + !(stdenv.hostPlatform.useLLVM or false) && + stdenv.cc.isGNU; + + nativeBuildInputs = + lib.optional (!stdenv.hostPlatform.isWindows) makeWrapper + ++ [ perl ] + ++ lib.optionals static [ removeReferencesTo ]; + buildInputs = lib.optional withCryptodev cryptodev + ++ lib.optional withZlib zlib; + + # TODO(@Ericson2314): Improve with mass rebuild + configurePlatforms = []; + configureScript = { + armv5tel-linux = "./Configure linux-armv4 -march=armv5te"; + armv6l-linux = "./Configure linux-armv4 -march=armv6"; + armv7l-linux = "./Configure linux-armv4 -march=armv7-a"; + x86_64-darwin = "./Configure darwin64-x86_64-cc"; + aarch64-darwin = "./Configure darwin64-arm64-cc"; + x86_64-linux = "./Configure linux-x86_64"; + x86_64-solaris = "./Configure solaris64-x86_64-gcc"; + powerpc64-linux = "./Configure linux-ppc64"; + riscv64-linux = "./Configure linux64-riscv64"; + }.${stdenv.hostPlatform.system} or ( + if stdenv.hostPlatform == stdenv.buildPlatform + then "./config" + else if stdenv.hostPlatform.isBSD + then if stdenv.hostPlatform.isx86_64 then "./Configure BSD-x86_64" + else if stdenv.hostPlatform.isx86_32 + then "./Configure BSD-x86" + lib.optionalString stdenv.hostPlatform.isElf "-elf" + else "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}" + else if stdenv.hostPlatform.isMinGW + then "./Configure mingw${lib.optionalString + (stdenv.hostPlatform.parsed.cpu.bits != 32) + (toString stdenv.hostPlatform.parsed.cpu.bits)}" + else if stdenv.hostPlatform.isLinux + then if stdenv.hostPlatform.isx86_64 then "./Configure linux-x86_64" + else if stdenv.hostPlatform.isMips32 then "./Configure linux-mips32" + else if stdenv.hostPlatform.isMips64n32 then "./Configure linux-mips64" + else if stdenv.hostPlatform.isMips64n64 then "./Configure linux64-mips64" + else "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}" + else if stdenv.hostPlatform.isiOS + then "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross" + else + throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}" + ); + + # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags. + dontAddStaticConfigureFlags = true; + configureFlags = [ + "shared" # "shared" builds both shared and static libraries + "--libdir=lib" + (if !static then + "--openssldir=etc/ssl" + else + # Move OPENSSLDIR to the 'etc' output for static builds. Prepend '/.' + # to the path to make it appear absolute before variable expansion, + # else the 'prefix' would be prepended to it. + "--openssldir=/.$(etc)/etc/ssl" + ) + ] ++ lib.optionals withCryptodev [ + "-DHAVE_CRYPTODEV" + "-DUSE_CRYPTODEV_DIGESTS" + ] ++ lib.optional enableSSL2 "enable-ssl2" + ++ lib.optional enableSSL3 "enable-ssl3" + # We select KTLS here instead of the configure-time detection (which we patch out). + # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it. + ++ lib.optional (lib.versionAtLeast version "3.0.0" && enableKTLS) "enable-ktls" + ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng" + # OpenSSL needs a specific `no-shared` configure flag. + # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options + # for a comprehensive list of configuration options. + ++ lib.optional (lib.versionAtLeast version "1.1.1" && static) "no-shared" + ++ lib.optional (lib.versionAtLeast version "3.0.0" && static) "no-module" + # This introduces a reference to the CTLOG_FILE which is undesired when + # trying to build binaries statically. + ++ lib.optional static "no-ct" + ++ lib.optional withZlib "zlib" + ++ lib.optionals (stdenv.hostPlatform.isMips && stdenv.hostPlatform ? gcc.arch) [ + # This is necessary in order to avoid openssl adding -march + # flags which ultimately conflict with those added by + # cc-wrapper. Openssl assumes that it can scan CFLAGS to + # detect any -march flags, using this perl code: + # + # && !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}}) + # + # The following bogus CFLAGS environment variable triggers the + # the code above, inhibiting `./Configure` from adding the + # conflicting flags. + "CFLAGS=-march=${stdenv.hostPlatform.gcc.arch}" + ]; + + makeFlags = [ + "MANDIR=$(man)/share/man" + # This avoids conflicts between man pages of openssl subcommands (for + # example 'ts' and 'err') man pages and their equivalent top-level + # command in other packages (respectively man-pages and moreutils). + # This is done in ubuntu and archlinux, and possiibly many other distros. + "MANSUFFIX=ssl" + ]; + + enableParallelBuilding = true; + + postInstall = + (if static then '' + # OPENSSLDIR has a reference to self + remove-references-to -t $out $out/lib/*.a + '' else '' + # If we're building dynamic libraries, then don't install static + # libraries. + if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then + rm "$out/lib/"*.a + fi + + # 'etc' is a separate output on static builds only. + etc=$out + '') + '' + mkdir -p $bin + mv $out/bin $bin/bin + + '' + lib.optionalString (!stdenv.hostPlatform.isWindows) + # makeWrapper is broken for windows cross (https://github.com/NixOS/nixpkgs/issues/120726) + '' + # c_rehash is a legacy perl script with the same functionality + # as `openssl rehash` + # this wrapper script is created to maintain backwards compatibility without + # depending on perl + makeWrapper $bin/bin/openssl $bin/bin/c_rehash \ + --add-flags "rehash" + '' + '' + + mkdir $dev + mv $out/include $dev/ + + # remove dependency on Perl at runtime + rm -r $etc/etc/ssl/misc + + rmdir $etc/etc/ssl/{certs,private} + + ${lib.optionalString (conf != null) "cat ${conf} > $etc/etc/ssl/openssl.cnf"} + ''; + + postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) '' + # Check to make sure the main output and the static runtime dependencies + # don't depend on perl + if grep -r '${buildPackages.perl}' $out $etc; then + echo "Found an erroneous dependency on perl ^^^" >&2 + exit 1 + fi + ''; + + passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + + meta = with lib; { + homepage = "https://www.openssl.org/"; + changelog = "https://github.com/openssl/openssl/blob/openssl-${version}/CHANGES.md"; + description = "A cryptographic library that implements the SSL and TLS protocols"; + license = licenses.openssl; + mainProgram = "openssl"; + maintainers = with maintainers; [ thillux ]; + pkgConfigModules = [ + "libcrypto" + "libssl" + "openssl" + ]; + platforms = platforms.all; + } // extraMeta; + }); + +in { + # intended version "policy": + # - 1.1 as long as some package exists, which does not build without it + # - latest 3.x LTS + # - latest 3.x non-LTS as preview/for development + # + # - other versions in between only when reasonable need is stated for some package + # - backport every security critical fix release e.g. 3.0.y -> 3.0.y+1 but no new version, e.g. 3.1 -> 3.2 + + # If you do upgrade here, please update in pkgs/top-level/release.nix + # the permitted insecure version to ensure it gets cached for our users + # and backport this to stable release (23.05). + openssl_1_1 = common { + version = "1.1.1w"; + hash = "sha256-zzCYlQy02FOtlcCEHx+cbT3BAtzPys1SHZOSUgi3asg="; + patches = [ + ./1.1/nix-ssl-cert-file.patch + + (if stdenv.hostPlatform.isDarwin + then ./use-etc-ssl-certs-darwin.patch + else ./use-etc-ssl-certs.patch) + ]; + withDocs = true; + extraMeta = { + knownVulnerabilities = [ + "OpenSSL 1.1 is reaching its end of life on 2023/09/11 and cannot be supported through the NixOS 23.05 release cycle. https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/" + ]; + }; + }; + + openssl_3 = common { + version = "3.0.13"; + hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM="; + + patches = [ + ./3.0/nix-ssl-cert-file.patch + + # openssl will only compile in KTLS if the current kernel supports it. + # This patch disables build-time detection. + ./3.0/openssl-disable-kernel-detection.patch + + (if stdenv.hostPlatform.isDarwin + then ./use-etc-ssl-certs-darwin.patch + else ./use-etc-ssl-certs.patch) + ]; + + withDocs = true; + + extraMeta = with lib; { + license = licenses.asl20; + }; + }; + + openssl_3_2 = common { + version = "3.2.1"; + hash = "sha256-g8cyn+UshQZ3115dCwyiRTCbl+jsvP3B39xKufrDWzk="; + + patches = [ + ./3.0/nix-ssl-cert-file.patch + + # openssl will only compile in KTLS if the current kernel supports it. + # This patch disables build-time detection. + ./3.0/openssl-disable-kernel-detection.patch + + (if stdenv.hostPlatform.isDarwin + then ./3.2/use-etc-ssl-certs-darwin.patch + else ./3.2/use-etc-ssl-certs.patch) + ]; + + withDocs = true; + + extraMeta = with lib; { + license = licenses.asl20; + }; + }; +} diff --git a/nixpkgs/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch b/nixpkgs/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch new file mode 100644 index 000000000000..2c98ccfa7ed0 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/use-etc-ssl-certs-darwin.patch @@ -0,0 +1,13 @@ +diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h +index 329ef62..9a8df64 100644 +--- a/include/internal/cryptlib.h ++++ b/include/internal/cryptlib.h +@@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM); + # ifndef OPENSSL_SYS_VMS + # define X509_CERT_AREA OPENSSLDIR + # define X509_CERT_DIR OPENSSLDIR "/certs" +-# define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++# define X509_CERT_FILE "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt" + # define X509_PRIVATE_DIR OPENSSLDIR "/private" + # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + # else diff --git a/nixpkgs/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch b/nixpkgs/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch new file mode 100644 index 000000000000..67d199681f96 --- /dev/null +++ b/nixpkgs/pkgs/development/libraries/openssl/use-etc-ssl-certs.patch @@ -0,0 +1,13 @@ +diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h +index 329ef62..9a8df64 100644 +--- a/include/internal/cryptlib.h ++++ b/include/internal/cryptlib.h +@@ -56,7 +56,7 @@ DEFINE_LHASH_OF(MEM); + # ifndef OPENSSL_SYS_VMS + # define X509_CERT_AREA OPENSSLDIR + # define X509_CERT_DIR OPENSSLDIR "/certs" +-# define X509_CERT_FILE OPENSSLDIR "/cert.pem" ++# define X509_CERT_FILE "/etc/ssl/certs/ca-certificates.crt" + # define X509_PRIVATE_DIR OPENSSLDIR "/private" + # define CTLOG_FILE OPENSSLDIR "/ct_log_list.cnf" + # else |