1 files changed, 64 insertions, 0 deletions
diff --git a/pkgs/development/python-modules/stix2-patterns/default.nix b/pkgs/development/python-modules/stix2-patterns/default.nix
new file mode 100644
index 00000000000..3817a96fe99
--- /dev/null
+++ b/pkgs/development/python-modules/stix2-patterns/default.nix
@@ -0,0 +1,64 @@
+{ lib
+, antlr4-python3-runtime
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, pytestCheckHook
+, wheel
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "stix2-patterns";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "oasis-open";
+    repo = "cti-pattern-validator";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lFgnvI5a7U7/Qj4Pqjr3mx4TNDnC2/Ru7tVG7VggR7Y=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "antlr4-python3-runtime~=" "antlr4-python3-runtime>="
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    antlr4-python3-runtime
+    six
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "stix2patterns"
+  ];
+
+  disabledTestPaths = [
+    # Exception: Could not deserialize ATN with version  (expected 4)
+    "stix2patterns/test/v20/test_inspector.py"
+    "stix2patterns/test/v21/test_inspector.py"
+    "stix2patterns/test/v20/test_validator.py"
+    "stix2patterns/test/v21/test_validator.py"
+  ];
+
+  meta = with lib; {
+    description = "Validate patterns used to express cyber observable content in STIX Indicators";
+    homepage = "https://github.com/oasis-open/cti-pattern-validator";
+    changelog = "https://github.com/oasis-open/cti-pattern-validator/blob/${version}/CHANGELOG.rst";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}