@@ -0,0 +1,168 @@
1+{ lib
2+, stdenv
3+, fetchFromGitLab
4+, mkDerivation
5+, buildGoModule
6+, wrapQtAppsHook
7+, python3Packages
8+, pkg-config
9+, openvpn
10+, cmake
11+, qmake
12+, which
13+, iproute2
14+, iptables
15+, procps
16+, qmltermwidget
17+, qtbase
18+, qtdeclarative
19+, qtinstaller
20+, qtquickcontrols
21+, qtquickcontrols2
22+, qttools
23+, CoreFoundation
24+, Security
25+, provider ? "riseup"
26+}:
27+let
28+ version = "0.21.6";
29+
30+ src = fetchFromGitLab {
31+ domain = "0xacab.org";
32+ owner = "leap";
33+ repo = "bitmask-vpn";
34+ rev = version;
35+ sha256 = "sha256-LMz+ZgQVFGujoLA8rlyZ3VnW/NSlPipD5KwCe+cFtnY=";
36+ };
37+
38+ # bitmask-root is only used on GNU/Linux
39+ # and may one day be replaced by pkg/helper
40+ bitmask-root = mkDerivation {
41+ inherit src version;
42+ sourceRoot = "source/helpers";
43+ pname = "bitmask-root";
44+ nativeBuildInputs = [ python3Packages.wrapPython ];
45+ postPatch = ''
46+ substituteInPlace bitmask-root \
47+ --replace 'swhich("ip")' '"${iproute2}/bin/ip"' \
48+ --replace 'swhich("iptables")' '"${iptables}/bin/iptables"' \
49+ --replace 'swhich("ip6tables")' '"${iptables}/bin/ip6tables"' \
50+ --replace 'swhich("sysctl")' '"${procps}/bin/sysctl"' \
51+ --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
52+ substituteInPlace se.leap.bitmask.policy \
53+ --replace /usr/sbin/bitmask-root $out/bin/bitmask-root
54+ '';
55+ installPhase = ''
56+ runHook preInstall
57+
58+ install -m 755 -D -t $out/bin bitmask-root
59+ install -m 444 -D -t $out/share/polkit-1/actions se.leap.bitmask.policy
60+ wrapPythonPrograms
61+
62+ runHook postInstall
63+ '';
64+ };
65+in
66+
67+buildGoModule rec {
68+ inherit src version;
69+ pname = "${provider}-vpn";
70+ vendorSha256 = null;
71+
72+ postPatch = ''
73+ substituteInPlace pkg/pickle/helpers.go \
74+ --replace /usr/share $out/share
75+
76+ # Using $PROVIDER is not working,
77+ # thus replacing directly into the vendor.conf
78+ substituteInPlace providers/vendor.conf \
79+ --replace "provider = riseup" "provider = ${provider}"
80+
81+ patchShebangs gui/build.sh
82+ wrapPythonProgramsIn branding/scripts
83+ '' + lib.optionalString stdenv.isLinux ''
84+ substituteInPlace pkg/helper/linux.go \
85+ --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
86+ substituteInPlace pkg/vpn/launcher_linux.go \
87+ --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn \
88+ --replace /usr/sbin/bitmask-root ${bitmask-root}/bin/bitmask-root \
89+ --replace /usr/bin/lxpolkit /run/wrappers/bin/polkit-agent-helper-1 \
90+ --replace '"polkit-gnome-authentication-agent-1",' '"polkit-gnome-authentication-agent-1","polkitd",'
91+ '';
92+
93+ nativeBuildInputs = [
94+ cmake
95+ pkg-config
96+ python3Packages.wrapPython
97+ qmake
98+ qtquickcontrols
99+ qtquickcontrols2
100+ qttools
101+ which
102+ wrapQtAppsHook
103+ ] ++ lib.optional (!stdenv.isLinux) qtinstaller;
104+
105+ buildInputs = [
106+ qtbase
107+ qmltermwidget
108+ qtdeclarative
109+ ] ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
110+ # FIXME: building on Darwin currently fails
111+ # due to missing debug symbols for Qt,
112+ # this should be fixable once darwin.apple_sdk >= 10.13
113+ # See https://bugreports.qt.io/browse/QTBUG-76777
114+
115+ # Not using buildGoModule's buildPhase:
116+ # gui/build.sh will build Go modules into lib/libgoshim.a
117+ buildPhase = ''
118+ runHook preBuild
119+
120+ make gen_providers_json
121+ make generate
122+ # Remove timestamps in comments
123+ sed -i -e '/^\/\//d' pkg/config/version/version.go
124+
125+ # Not using -j$NIX_BUILD_CORES because the Makefile's rules
126+ # are not thread-safe: lib/libgoshim.h is used before being built.
127+ make build
128+
129+ runHook postBuild
130+ '';
131+
132+ postInstall = ''
133+ install -m 755 -D -t $out/bin build/qt/release/${provider}-vpn
134+
135+ VERSION=${version} VENDOR_PATH=providers branding/scripts/generate-debian branding/templates/debian/data.json
136+ (cd branding/templates/debian && ${python3Packages.python}/bin/python3 generate.py)
137+ install -m 444 -D branding/templates/debian/app.desktop $out/share/applications/${provider}-vpn.desktop
138+ '' + lib.optionalString stdenv.isLinux ''
139+ install -m 444 -D -t $out/share/polkit-1/actions ${bitmask-root}/share/polkit-1/actions/se.leap.bitmask.policy
140+ '';
141+
142+ # Some tests need access to the Internet:
143+ # Post "https://api.black.riseup.net/3/cert": dial tcp: lookup api.black.riseup.net on [::1]:53: read udp [::1]:56553->[::1]:53: read: connection refused
144+ doCheck = false;
145+
146+ passthru = { inherit bitmask-root; };
147+
148+ meta = {
149+ description = "Generic VPN client by LEAP";
150+ longDescription = ''
151+ Bitmask, by LEAP (LEAP Encryption Access Project),
152+ is an application to provide easy and secure encrypted communication
153+ with a VPN (Virtual Private Network). It allows you to select from
154+ a variety of trusted service provider all from one app.
155+ Current providers include Riseup Networks
156+ and The Calyx Institute, where the former is default.
157+ The <literal>${provider}-vpn</literal> executable should appear
158+ in your desktop manager's XDG menu or could be launch in a terminal
159+ to get an execution log. A new icon should then appear in your systray
160+ to control the VPN and configure some options.
161+ '';
162+ homepage = "https://bitmask.net";
163+ license = lib.licenses.gpl3Plus;
164+ maintainers = with lib.maintainers; [ julm ];
165+ # darwin requires apple_sdk >= 10.13
166+ platforms = lib.platforms.linux;
167+ };
168+}