pkgs/development/libraries/nss/3.53.nix

   1 { lib, stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja
   2 , # allow FIPS mode. Note that this makes the output non-reproducible.
   3   # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
   4   enableFIPS ? false
   5 }:
   6
   7 let
   8   nssPEM = fetchurl {
   9     url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
  10     sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
  11   };
  12   version = "3.53.1";
  13   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
  14
  15 in stdenv.mkDerivation rec {
  16   pname = "nss";
  17   inherit version;
  18
  19   src = fetchurl {
  20     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
  21     sha256 = "05jk65x3zy6q8lx2djj8ik7kg741n88iy4n3bblw89cv0xkxxk1d";
  22   };
  23
  24   depsBuildBuild = [ buildPackages.stdenv.cc ];
  25
  26   nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
  27     ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.cctools fixDarwinDylibNames ];
  28
  29   buildInputs = [ zlib sqlite ];
  30
  31   propagatedBuildInputs = [ nspr ];
  32
  33   prePatch = ''
  34     # strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_
  35     xz -d < ${nssPEM} | sed \
  36        -e 's/-DIRS = builtins $/-DIRS = . builtins/g' \
  37        -e 's/CKO_NETSCAPE_/CKO_NSS_/g' \
  38        -e 's/CKT_NETSCAPE_/CKT_NSS_/g' \
  39        | patch -p1
  40
  41     patchShebangs nss
  42
  43     for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
  44       substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
  45     done
  46
  47     substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
  48   '';
  49
  50   patches =
  51     [
  52       # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
  53       ./85_security_load.patch
  54       ./ckpem.patch
  55       ./fix-cross-compilation.patch
  56     ];
  57
  58   patchFlags = [ "-p0" ];
  59
  60   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
  61      substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
  62      substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
  63    '';
  64
  65   outputs = [ "out" "dev" "tools" ];
  66
  67   preConfigure = "cd nss";
  68
  69   buildPhase = let
  70     getArch = platform: if platform.isx86_64 then "x64"
  71           else if platform.isx86_32 then "ia32"
  72           else if platform.isAarch32 then "arm"
  73           else if platform.isAarch64 then "arm64"
  74           else if platform.isPower && platform.is64bit then (
  75             if platform.isLittleEndian then "ppc64le" else "ppc64"
  76           )
  77           else platform.parsed.cpu.name;
  78     # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
  79     target = getArch stdenv.hostPlatform;
  80     host = getArch stdenv.buildPlatform;
  81   in ''
  82     runHook preBuild
  83
  84     sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
  85     ./build.sh -v --opt \
  86       --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
  87       --system-sqlite \
  88       --enable-legacy-db \
  89       --target ${target} \
  90       -Dhost_arch=${host} \
  91       -Duse_system_zlib=1 \
  92       --enable-libpkix \
  93       ${lib.optionalString enableFIPS "--enable-fips"} \
  94       ${lib.optionalString stdenv.isDarwin "--clang"} \
  95       ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
  96
  97     runHook postBuild
  98   '';
  99
 100   NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
 101
 102   installPhase = ''
 103     runHook preInstall
 104
 105     rm -rf $out/private
 106     find $out -name "*.TOC" -delete
 107     mv $out/public $out/include
 108
 109     ln -s lib $out/lib64
 110
 111     # Upstream issue: https://bugzilla.mozilla.org/show_bug.cgi?id=530672
 112     # https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/nss/files/nss-3.32-gentoo-fixups.patch?id=af1acce6c6d2c3adb17689261dfe2c2b6771ab8a
 113     NSS_MAJOR_VERSION=`grep "NSS_VMAJOR" lib/nss/nss.h | awk '{print $3}'`
 114     NSS_MINOR_VERSION=`grep "NSS_VMINOR" lib/nss/nss.h | awk '{print $3}'`
 115     NSS_PATCH_VERSION=`grep "NSS_VPATCH" lib/nss/nss.h | awk '{print $3}'`
 116     PREFIX="$out"
 117
 118     mkdir -p $out/lib/pkgconfig
 119     sed -e "s,%prefix%,$PREFIX," \
 120         -e "s,%exec_prefix%,$PREFIX," \
 121         -e "s,%libdir%,$PREFIX/lib64," \
 122         -e "s,%includedir%,$dev/include/nss," \
 123         -e "s,%NSS_VERSION%,$NSS_MAJOR_VERSION.$NSS_MINOR_VERSION.$NSS_PATCH_VERSION,g" \
 124         -e "s,%NSPR_VERSION%,4.16,g" \
 125         pkg/pkg-config/nss.pc.in > $out/lib/pkgconfig/nss.pc
 126     chmod 0644 $out/lib/pkgconfig/nss.pc
 127
 128     sed -e "s,@prefix@,$PREFIX," \
 129         -e "s,@MOD_MAJOR_VERSION@,$NSS_MAJOR_VERSION," \
 130         -e "s,@MOD_MINOR_VERSION@,$NSS_MINOR_VERSION," \
 131         -e "s,@MOD_PATCH_VERSION@,$NSS_PATCH_VERSION," \
 132         pkg/pkg-config/nss-config.in > $out/bin/nss-config
 133     chmod 0755 $out/bin/nss-config
 134   '';
 135
 136   postFixup = let
 137     isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 138     nss = if isCross then buildPackages.nss.tools else "$out";
 139   in
 140   (lib.optionalString enableFIPS (''
 141     for libname in freebl3 nssdbm3 softokn3
 142     do '' +
 143     (if stdenv.isDarwin
 144      then ''
 145        libfile="$out/lib/lib$libname.dylib"
 146        DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
 147      '' else ''
 148        libfile="$out/lib/lib$libname.so"
 149        LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
 150      '') + ''
 151         ${nss}/bin/shlibsign -v -i "$libfile"
 152     done
 153   '')) +
 154   ''
 155     moveToOutput bin "$tools"
 156     moveToOutput bin/nss-config "$dev"
 157     moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
 158     rm -f "$out"/lib/*.a
 159
 160     runHook postInstall
 161   '';
 162
 163   meta = with lib; {
 164     homepage = "https://developer.mozilla.org/en-US/docs/NSS";
 165     description = "A set of libraries for development of security-enabled client and server applications";
 166     license = licenses.mpl20;
 167     platforms = platforms.all;
 168   };
 169 }