diff options
Diffstat (limited to 'pkgs/data/misc/cacert/default.nix')
-rw-r--r-- | pkgs/data/misc/cacert/default.nix | 93 |
1 files changed, 75 insertions, 18 deletions
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index f72431c5a27..b4a8ebc4ef2 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -1,24 +1,36 @@ -{ stdenv, fetchurl, nss, python3 +{ lib, stdenv, fetchurl, nss, python3 , blacklist ? [] -, includeEmail ? false + +# Used for tests only +, runCommand +, cacert +, openssl }: -with stdenv.lib; +with lib; let + version = "3.66"; - certdata2pem = fetchurl { - name = "certdata2pem.py"; - url = "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py"; - sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy"; - }; - + underscoreVersion = builtins.replaceStrings ["."] ["_"] version; in stdenv.mkDerivation { - name = "nss-cacert-${nss.version}"; + name = "nss-cacert-${version}"; + + src = fetchurl { + url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz"; + sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9"; + }; - src = nss.src; + certdata2pem = fetchurl { + name = "certdata2pem.py"; + urls = [ + "https://salsa.debian.org/debian/ca-certificates/raw/debian/20170717/mozilla/certdata2pem.py" + "https://git.launchpad.net/ubuntu/+source/ca-certificates/plain/mozilla/certdata2pem.py?id=47e49e1e0a8a1ca74deda27f88fe181191562957" + ]; + sha256 = "1d4q27j1gss0186a5m8bs5dk786w07ccyq0qi6xmd2zr1a8q16wy"; + }; outputs = [ "out" "unbundled" ]; @@ -31,12 +43,8 @@ stdenv.mkDerivation { ${concatStringsSep "\n" (map (c: ''"${c}"'') blacklist)} EOF - cat ${certdata2pem} > certdata2pem.py - patch -p1 < ${./fix-unicode-ca-names.patch} - ${optionalString includeEmail '' - # Disable CAs used for mail signing - substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] ''' - ''} + # copy from the store, otherwise python will scan it for imports + cat "$certdata2pem" > certdata2pem.py ''; buildPhase = '' @@ -60,11 +68,60 @@ stdenv.mkDerivation { setupHook = ./setup-hook.sh; + passthru.updateScript = ./update.sh; + passthru.tests = { + # Test that building this derivation with a blacklist works, and that UTF-8 is supported. + blacklist-utf8 = let + blacklistCAToFingerprint = { + # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint. + "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD"; + "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98"; + }; + mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint); + in runCommand "verify-the-cacert-filter-output" { + cacert = cacert.unbundled; + cacertWithExcludes = (cacert.override { + blacklist = builtins.attrNames blacklistCAToFingerprint; + }).unbundled; + + nativeBuildInputs = [ openssl ]; + } '' + isPresent() { + # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint> + for f in $1/etc/ssl/certs/*.crt; do + fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)" + if [[ "x$fingerprint" == "x$3" ]]; then + return 0 + fi + done + return 1 + } + + # Ensure that each certificate is in the main "cacert". + ${mapBlacklist (caName: caFingerprint: '' + isPresent "$cacert" "${caName}" "${caFingerprint}" || ({ + echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2 + exit 1 + }) + '')} + + # Ensure that each certificate is NOT in the "cacertWithExcludes". + ${mapBlacklist (caName: caFingerprint: '' + isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({ + echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2 + exit 1 + }) + '')} + + touch $out + ''; + }; + meta = { homepage = "https://curl.haxx.se/docs/caextract.html"; description = "A bundle of X.509 certificates of public Certificate Authorities (CA)"; platforms = platforms.all; - maintainers = with maintainers; [ fpletz ]; + maintainers = with maintainers; [ andir fpletz lukegb ]; license = licenses.mpl20; }; } |