@@ -1,7 +1,16 @@
1−{ lib, stdenv, fetchurl, nspr, perl, zlib
2−, sqlite, ninja
3−, darwin, fixDarwinDylibNames, buildPackages
4−, useP11kit ? true, p11-kit
1+{ lib
2+, stdenv
3+, fetchurl
4+, nspr
5+, perl
6+, zlib
7+, sqlite
8+, ninja
9+, darwin
10+, fixDarwinDylibNames
11+, buildPackages
12+, useP11kit ? true
13+, p11-kit
514, # allow FIPS mode. Note that this makes the output non-reproducible.
615 # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
716 enableFIPS ? false
@@ -19,14 +28,14 @@ let
1928 # an update is required do the required changes to the expression.
2029 # Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
2130 version = "3.68";
22− underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
2331
24−in stdenv.mkDerivation rec {
32+in
33+stdenv.mkDerivation rec {
2534 pname = "nss";
2635 inherit version;
2736
2837 src = fetchurl {
29− url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
38+ url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM/src/${pname}-${version}.tar.gz";
3039 sha256 = "0nvj7h2brcw21p1z99nrsxka056d0r1yy9nqqg0lw0w3mhnb60n4";
3140 };
3241
@@ -56,55 +65,58 @@ in stdenv.mkDerivation rec {
5665 substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
5766 '';
5867
59− patches =
60− [
61− # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
62− ./85_security_load.patch
63− ./ckpem.patch
64− ./fix-cross-compilation.patch
65− ];
68+ patches = [
69+ # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
70+ ./85_security_load.patch
71+ ./ckpem.patch
72+ ./fix-cross-compilation.patch
73+ ];
6674
6775 patchFlags = [ "-p0" ];
6876
6977 postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
70− substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
71− substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
72− '';
78+ substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
79+ substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
80+ '';
7381
7482 outputs = [ "out" "dev" "tools" ];
7583
7684 preConfigure = "cd nss";
7785
78− buildPhase = let
79− getArch = platform: if platform.isx86_64 then "x64"
80− else if platform.isx86_32 then "ia32"
81− else if platform.isAarch32 then "arm"
82− else if platform.isAarch64 then "arm64"
83− else if platform.isPower && platform.is64bit then (
86+ buildPhase =
87+ let
88+ getArch = platform:
89+ if platform.isx86_64 then "x64"
90+ else if platform.isx86_32 then "ia32"
91+ else if platform.isAarch32 then "arm"
92+ else if platform.isAarch64 then "arm64"
93+ else if platform.isPower && platform.is64bit then
94+ (
8495 if platform.isLittleEndian then "ppc64le" else "ppc64"
8596 )
86− else platform.parsed.cpu.name;
87− # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
88− target = getArch stdenv.hostPlatform;
89− host = getArch stdenv.buildPlatform;
90− in ''
91− runHook preBuild
92−
93− sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
94− ./build.sh -v --opt \
95− --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
96− --system-sqlite \
97− --enable-legacy-db \
98− --target ${target} \
99− -Dhost_arch=${host} \
100− -Duse_system_zlib=1 \
101− --enable-libpkix \
102− ${lib.optionalString enableFIPS "--enable-fips"} \
103− ${lib.optionalString stdenv.isDarwin "--clang"} \
104− ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
105−
106− runHook postBuild
107− '';
97+ else platform.parsed.cpu.name;
98+ # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
99+ target = getArch stdenv.hostPlatform;
100+ host = getArch stdenv.buildPlatform;
101+ in
102+ ''
103+ runHook preBuild
104+
105+ sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
106+ ./build.sh -v --opt \
107+ --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
108+ --system-sqlite \
109+ --enable-legacy-db \
110+ --target ${target} \
111+ -Dhost_arch=${host} \
112+ -Duse_system_zlib=1 \
113+ --enable-libpkix \
114+ ${lib.optionalString enableFIPS "--enable-fips"} \
115+ ${lib.optionalString stdenv.isDarwin "--clang"} \
116+ ${lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
117+
118+ runHook postBuild
119+ '';
108120
109121 NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" " + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1";
110122
@@ -147,36 +159,38 @@ in stdenv.mkDerivation rec {
147159 ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
148160 '';
149161
150− postFixup = let
151− isCross = stdenv.hostPlatform != stdenv.buildPlatform;
152− nss = if isCross then buildPackages.nss.tools else "$out";
153− in
154− (lib.optionalString enableFIPS (''
155− for libname in freebl3 nssdbm3 softokn3
156− do '' +
162+ postFixup =
163+ let
164+ isCross = stdenv.hostPlatform != stdenv.buildPlatform;
165+ nss = if isCross then buildPackages.nss.tools else "$out";
166+ in
167+ (lib.optionalString enableFIPS (''
168+ for libname in freebl3 nssdbm3 softokn3
169+ do '' +
157170 (if stdenv.isDarwin
158− then ''
159− libfile="$out/lib/lib$libname.dylib"
160− DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
161− '' else ''
162− libfile="$out/lib/lib$libname.so"
163− LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
164− '') + ''
165− ${nss}/bin/shlibsign -v -i "$libfile"
166− done
167− '')) +
168− ''
169− moveToOutput bin "$tools"
170− moveToOutput bin/nss-config "$dev"
171− moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
172− rm -f "$out"/lib/*.a
173−
174− runHook postInstall
175− '';
171+ then ''
172+ libfile="$out/lib/lib$libname.dylib"
173+ DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
174+ '' else ''
175+ libfile="$out/lib/lib$libname.so"
176+ LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
177+ '') + ''
178+ ${nss}/bin/shlibsign -v -i "$libfile"
179+ done
180+ '')) +
181+ ''
182+ moveToOutput bin "$tools"
183+ moveToOutput bin/nss-config "$dev"
184+ moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
185+ rm -f "$out"/lib/*.a
186+
187+ runHook postInstall
188+ '';
176189
177190 meta = with lib; {
178− homepage = "https://developer.mozilla.org/en-US/docs/NSS";
191+ homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS";
179192 description = "A set of libraries for development of security-enabled client and server applications";
193+ maintainers = with maintainers; [ ];
180194 license = licenses.mpl20;
181195 platforms = platforms.all;
182196 };