2018-07-21 02:44:44 +02:00
|
|
|
{ stdenv, fetchurl, fetchpatch, zlib, openssl, libedit, pkgconfig, pam, autoreconfHook
|
2009-10-01 14:07:33 +02:00
|
|
|
, etcDir ? null
|
2009-11-02 22:49:06 +01:00
|
|
|
, hpnSupport ? false
|
2018-01-28 22:34:04 +01:00
|
|
|
, withKerberos ? true
|
2016-03-08 21:14:25 +01:00
|
|
|
, withGssapiPatches ? false
|
2013-06-15 08:40:01 +02:00
|
|
|
, kerberos
|
2016-03-06 22:36:55 +01:00
|
|
|
, linkOpenssl? true
|
2006-12-11 04:24:35 +01:00
|
|
|
}:
|
2006-01-17 19:48:18 +01:00
|
|
|
|
2010-02-01 17:56:10 +01:00
|
|
|
let
|
2009-10-01 14:07:33 +02:00
|
|
|
|
2016-09-15 05:35:05 +02:00
|
|
|
# **please** update this patch when you update to a new openssh release.
|
2017-10-05 21:45:38 +02:00
|
|
|
gssapiPatch = fetchpatch {
|
2016-12-29 22:51:07 +01:00
|
|
|
name = "openssh-gssapi.patch";
|
2018-05-23 07:49:42 +02:00
|
|
|
url = "https://salsa.debian.org/ssh-team/openssh/raw/"
|
2018-10-26 01:17:55 +02:00
|
|
|
+ "d80ebbf028196b2478beebf5a290b97f35e1eed9"
|
2018-05-23 07:49:42 +02:00
|
|
|
+ "/debian/patches/gssapi.patch";
|
2018-10-26 01:17:55 +02:00
|
|
|
sha256 = "14j9cabb3gkhkjc641zbiv29mbvsmgsvis3fbj8ywsd21zc7m2wv";
|
2016-01-02 01:35:43 +01:00
|
|
|
};
|
|
|
|
|
2010-02-01 17:56:10 +01:00
|
|
|
in
|
2015-07-07 04:29:45 +02:00
|
|
|
with stdenv.lib;
|
2010-02-01 17:56:10 +01:00
|
|
|
stdenv.mkDerivation rec {
|
2016-08-07 19:55:20 +02:00
|
|
|
name = "openssh-${version}";
|
2018-10-26 01:17:55 +02:00
|
|
|
version = if hpnSupport then "7.8p1" else "7.9p1";
|
2006-12-11 04:24:35 +01:00
|
|
|
|
2017-03-17 17:20:48 +01:00
|
|
|
src = if hpnSupport then
|
|
|
|
fetchurl {
|
2018-10-26 01:17:55 +02:00
|
|
|
url = "https://github.com/rapier1/openssh-portable/archive/hpn-KitchenSink-7_8_P1.tar.gz";
|
|
|
|
sha256 = "05q5hxx7fzcgd8a5i0zk4fwvmnz4xqk04j489irnwm7cka7xdqxw";
|
2017-03-17 17:20:48 +01:00
|
|
|
}
|
|
|
|
else
|
|
|
|
fetchurl {
|
|
|
|
url = "mirror://openbsd/OpenSSH/portable/${name}.tar.gz";
|
2018-10-26 01:17:55 +02:00
|
|
|
sha256 = "1b8sy6v0b8v4ggmknwcqx3y1rjcpsll0f1f8f4vyv11x4ni3njvb";
|
2017-03-17 17:20:48 +01:00
|
|
|
};
|
2013-02-19 11:02:20 +01:00
|
|
|
|
2016-02-01 16:27:46 +01:00
|
|
|
patches =
|
2016-04-16 05:45:10 +02:00
|
|
|
[
|
|
|
|
./locale_archive.patch
|
2016-07-16 10:08:29 +02:00
|
|
|
|
|
|
|
# See discussion in https://github.com/NixOS/nixpkgs/pull/16966
|
|
|
|
./dont_create_privsep_path.patch
|
2019-01-13 21:26:05 +01:00
|
|
|
|
|
|
|
# CVE-2018-20685, can probably be dropped with next version bump
|
|
|
|
# See https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
|
|
|
|
# for details
|
|
|
|
(fetchpatch {
|
|
|
|
name = "CVE-2018-20685.patch";
|
|
|
|
url = https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2.patch;
|
|
|
|
sha256 = "0q27i9ymr97yb628y44qi4m11hk5qikb1ji1vhvax8hp18lwskds";
|
|
|
|
})
|
2016-04-01 15:52:59 +02:00
|
|
|
]
|
2018-01-28 22:34:04 +01:00
|
|
|
++ optional withGssapiPatches (assert withKerberos; gssapiPatch);
|
2010-05-19 14:26:06 +02:00
|
|
|
|
2017-06-07 09:33:26 +02:00
|
|
|
postPatch =
|
|
|
|
# On Hydra this makes installation fail (sometimes?),
|
|
|
|
# and nix store doesn't allow such fancy permission bits anyway.
|
|
|
|
''
|
|
|
|
substituteInPlace Makefile.in --replace '$(INSTALL) -m 4711' '$(INSTALL) -m 0711'
|
|
|
|
'';
|
|
|
|
|
2017-09-05 23:26:13 +02:00
|
|
|
nativeBuildInputs = [ pkgconfig ];
|
|
|
|
buildInputs = [ zlib openssl libedit pam ]
|
2017-03-17 17:20:48 +01:00
|
|
|
++ optional withKerberos kerberos
|
2018-01-28 22:34:04 +01:00
|
|
|
++ optional hpnSupport autoreconfHook
|
|
|
|
;
|
2010-02-01 17:56:10 +01:00
|
|
|
|
2017-07-19 15:44:55 +02:00
|
|
|
preConfigure = ''
|
|
|
|
# Setting LD causes `configure' and `make' to disagree about which linker
|
|
|
|
# to use: `configure' wants `gcc', but `make' wants `ld'.
|
|
|
|
unset LD
|
|
|
|
'';
|
|
|
|
|
2011-04-25 17:41:32 +02:00
|
|
|
# I set --disable-strip because later we strip anyway. And it fails to strip
|
|
|
|
# properly when cross building.
|
2015-07-07 04:29:45 +02:00
|
|
|
configureFlags = [
|
2016-03-06 05:56:32 +01:00
|
|
|
"--sbindir=\${out}/bin"
|
2015-07-07 04:29:45 +02:00
|
|
|
"--localstatedir=/var"
|
2015-12-27 23:02:44 +01:00
|
|
|
"--with-pid-dir=/run"
|
2015-07-07 04:29:45 +02:00
|
|
|
"--with-mantype=man"
|
|
|
|
"--with-libedit=yes"
|
|
|
|
"--disable-strip"
|
|
|
|
(if pam != null then "--with-pam" else "--without-pam")
|
|
|
|
] ++ optional (etcDir != null) "--sysconfdir=${etcDir}"
|
2018-01-28 22:34:04 +01:00
|
|
|
++ optional withKerberos (assert kerberos != null; "--with-kerberos5=${kerberos}")
|
2016-03-06 22:36:55 +01:00
|
|
|
++ optional stdenv.isDarwin "--disable-libutil"
|
|
|
|
++ optional (!linkOpenssl) "--without-openssl";
|
2015-07-07 04:29:45 +02:00
|
|
|
|
2014-11-20 12:12:33 +01:00
|
|
|
enableParallelBuilding = true;
|
|
|
|
|
2016-02-26 18:38:15 +01:00
|
|
|
hardeningEnable = [ "pie" ];
|
2016-02-26 17:30:26 +01:00
|
|
|
|
2015-07-07 04:29:45 +02:00
|
|
|
postInstall = ''
|
|
|
|
# Install ssh-copy-id, it's very useful.
|
|
|
|
cp contrib/ssh-copy-id $out/bin/
|
|
|
|
chmod +x $out/bin/ssh-copy-id
|
|
|
|
cp contrib/ssh-copy-id.1 $out/share/man/man1/
|
|
|
|
'';
|
2007-05-15 15:10:41 +02:00
|
|
|
|
2015-12-27 23:02:44 +01:00
|
|
|
installTargets = [ "install-nokeys" ];
|
2015-07-07 04:29:45 +02:00
|
|
|
installFlags = [
|
|
|
|
"sysconfdir=\${out}/etc/ssh"
|
|
|
|
];
|
2010-02-01 17:56:10 +01:00
|
|
|
|
2015-07-07 04:29:45 +02:00
|
|
|
meta = {
|
2017-08-01 22:03:30 +02:00
|
|
|
homepage = http://www.openssh.com/;
|
2010-02-01 17:56:10 +01:00
|
|
|
description = "An implementation of the SSH protocol";
|
2014-11-06 01:44:33 +01:00
|
|
|
license = stdenv.lib.licenses.bsd2;
|
2018-11-22 22:25:05 +01:00
|
|
|
platforms = platforms.unix ++ platforms.windows;
|
2016-10-20 20:49:08 +02:00
|
|
|
maintainers = with maintainers; [ eelco aneeshusa ];
|
2010-02-01 17:56:10 +01:00
|
|
|
};
|
2004-08-02 13:55:31 +02:00
|
|
|
}
|