fd78240ac8
At some point, I'd like to make another attempt at71f1f4884b("openssl: stop static binaries referencing libs"), which was reverted in195c7da07d. One problem with my previous attempt is that I moved OpenSSL's libraries to a lib output, but many dependent packages were hardcoding the out output as the location of the libraries. This patch fixes every such case I could find in the tree. It won't have any effect immediately, but will mean these packages will automatically use an OpenSSL lib output if it is reintroduced in future. This patch should cause very few rebuilds, because it shouldn't make any change at all to most packages I'm touching. The few rebuilds that are introduced come from when I've changed a package builder not to use variable names like openssl.out in scripts / substitution patterns, which would be confusing since they don't hardcode the output any more. I started by making the following global replacements: ${pkgs.openssl.out}/lib -> ${lib.getLib pkgs.openssl}/lib ${openssl.out}/lib -> ${lib.getLib openssl}/lib Then I removed the ".out" suffix when part of the argument to lib.makeLibraryPath, since that function uses lib.getLib internally. Then I fixed up cases where openssl was part of the -L flag to the compiler/linker, since that unambigously is referring to libraries. Then I manually investigated and fixed the following packages: - pycurl - citrix-workspace - ppp - wraith - unbound - gambit - acl2 I'm reasonably confindent in my fixes for all of them. For acl2, since the openssl library paths are manually provided above anyway, I don't think openssl is required separately as a build input at all. Removing it doesn't make a difference to the output size, the file list, or the closure. I've tested evaluation with the OfBorg meta checks, to protect against introducing evaluation failures.
101 lines
3.1 KiB
Nix
101 lines
3.1 KiB
Nix
{ lib
|
|
, stdenv
|
|
, fetchFromGitHub
|
|
, autoreconfHook
|
|
, autoconf-archive
|
|
, pkg-config
|
|
, makeWrapper
|
|
, curl
|
|
, gtk3
|
|
, libassuan
|
|
, libbsd
|
|
, libproxy
|
|
, libxml2
|
|
, openssl
|
|
, p11-kit
|
|
, pcsclite
|
|
, nssTools
|
|
, substituteAll
|
|
}:
|
|
|
|
stdenv.mkDerivation rec {
|
|
pname = "eid-mw";
|
|
# NOTE: Don't just blindly update to the latest version/tag. Releases are always for a specific OS.
|
|
version = "5.0.28";
|
|
|
|
src = fetchFromGitHub {
|
|
owner = "Fedict";
|
|
repo = "eid-mw";
|
|
rev = "v${version}";
|
|
sha256 = "rrrzw8i271ZZkwY3L6aRw2Nlz+GmDr/1ahYYlUBvtzo=";
|
|
};
|
|
|
|
nativeBuildInputs = [ autoreconfHook autoconf-archive pkg-config makeWrapper ];
|
|
buildInputs = [ curl gtk3 libassuan libbsd libproxy libxml2 openssl p11-kit pcsclite ];
|
|
preConfigure = ''
|
|
mkdir openssl
|
|
ln -s ${lib.getLib openssl}/lib openssl
|
|
ln -s ${openssl.bin}/bin openssl
|
|
ln -s ${openssl.dev}/include openssl
|
|
export SSL_PREFIX=$(realpath openssl)
|
|
substituteInPlace plugins_tools/eid-viewer/Makefile.in \
|
|
--replace "c_rehash" "openssl rehash"
|
|
'';
|
|
# pinentry uses hardcoded `/usr/bin/pinentry`, so use the built-in (uglier) dialogs for pinentry.
|
|
configureFlags = [ "--disable-pinentry" ];
|
|
|
|
postPatch = ''
|
|
sed 's@m4_esyscmd_s(.*,@[${version}],@' -i configure.ac
|
|
'';
|
|
|
|
postInstall =
|
|
let
|
|
eid-nssdb-in = substituteAll {
|
|
inherit (stdenv) shell;
|
|
isExecutable = true;
|
|
src = ./eid-nssdb.in;
|
|
};
|
|
in
|
|
''
|
|
install -D ${eid-nssdb-in} $out/bin/eid-nssdb
|
|
substituteInPlace $out/bin/eid-nssdb \
|
|
--replace "modutil" "${nssTools}/bin/modutil"
|
|
|
|
rm $out/bin/about-eid-mw
|
|
wrapProgram $out/bin/eid-viewer --prefix XDG_DATA_DIRS : "$out/share/gsettings-schemas/$name"
|
|
'';
|
|
|
|
enableParallelBuilding = true;
|
|
|
|
doCheck = true;
|
|
|
|
meta = with lib; {
|
|
description = "Belgian electronic identity card (eID) middleware";
|
|
homepage = "https://eid.belgium.be/en";
|
|
license = licenses.lgpl3Only;
|
|
longDescription = ''
|
|
Allows user authentication and digital signatures with Belgian ID cards.
|
|
Also requires a running pcscd service and compatible card reader.
|
|
|
|
eid-viewer is also installed.
|
|
|
|
This package only installs the libraries. To use eIDs in Firefox or
|
|
Chromium, the eID Belgium add-on must be installed.
|
|
This package only installs the libraries. To use eIDs in NSS-compatible
|
|
browsers like Chrom{e,ium} or Firefox, each user must first execute:
|
|
~$ eid-nssdb add
|
|
(Running the script once as root with the --system option enables eID
|
|
support for all users, but will *not* work when using Chrom{e,ium}!)
|
|
Before uninstalling this package, it is a very good idea to run
|
|
~$ eid-nssdb [--system] remove
|
|
and remove all ~/.pki and/or /etc/pki directories no longer needed.
|
|
|
|
The above procedure doesn't seem to work in Firefox. You can override the
|
|
firefox wrapper to add this derivation to the PKCS#11 modules, like so:
|
|
|
|
firefox.override { pkcs11Modules = [ pkgs.eid-mw ]; }
|
|
'';
|
|
platforms = platforms.linux;
|
|
maintainers = with maintainers; [ bfortz chvp ];
|
|
};
|
|
}
|