@@ -0,0 +1,169 @@
1+{ stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja
2+, # allow FIPS mode. Note that this makes the output non-reproducible.
3+ # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
4+ enableFIPS ? false
5+}:
6+
7+let
8+ nssPEM = fetchurl {
9+ url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
10+ sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
11+ };
12+ version = "3.53.1";
13+ underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
14+
15+in stdenv.mkDerivation rec {
16+ pname = "nss";
17+ inherit version;
18+
19+ src = fetchurl {
20+ url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
21+ sha256 = "05jk65x3zy6q8lx2djj8ik7kg741n88iy4n3bblw89cv0xkxxk1d";
22+ };
23+
24+ depsBuildBuild = [ buildPackages.stdenv.cc ];
25+
26+ nativeBuildInputs = [ perl ninja (buildPackages.python3.withPackages (ps: with ps; [ gyp ])) ]
27+ ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [ darwin.cctools fixDarwinDylibNames ];
28+
29+ buildInputs = [ zlib sqlite ];
30+
31+ propagatedBuildInputs = [ nspr ];
32+
33+ prePatch = ''
34+ # strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_
35+ xz -d < ${nssPEM} | sed \
36+ -e 's/-DIRS = builtins $/-DIRS = . builtins/g' \
37+ -e 's/CKO_NETSCAPE_/CKO_NSS_/g' \
38+ -e 's/CKT_NETSCAPE_/CKT_NSS_/g' \
39+ | patch -p1
40+
41+ patchShebangs nss
42+
43+ for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
44+ substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
45+ done
46+
47+ substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
48+ '';
49+
50+ patches =
51+ [
52+ # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
53+ ./85_security_load.patch
54+ ./ckpem.patch
55+ ./fix-cross-compilation.patch
56+ ];
57+
58+ patchFlags = [ "-p0" ];
59+
60+ postPatch = stdenv.lib.optionalString stdenv.hostPlatform.isDarwin ''
61+ substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
62+ substituteInPlace nss/coreconf/config.gypi --replace "'DYLIB_INSTALL_NAME_BASE': '@executable_path'" "'DYLIB_INSTALL_NAME_BASE': '$out/lib'"
63+ '';
64+
65+ outputs = [ "out" "dev" "tools" ];
66+
67+ preConfigure = "cd nss";
68+
69+ buildPhase = let
70+ getArch = platform: if platform.isx86_64 then "x64"
71+ else if platform.isx86_32 then "ia32"
72+ else if platform.isAarch32 then "arm"
73+ else if platform.isAarch64 then "arm64"
74+ else if platform.isPower && platform.is64bit then (
75+ if platform.isLittleEndian then "ppc64le" else "ppc64"
76+ )
77+ else platform.parsed.cpu.name;
78+ # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
79+ target = getArch stdenv.hostPlatform;
80+ host = getArch stdenv.buildPlatform;
81+ in ''
82+ runHook preBuild
83+
84+ sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
85+ ./build.sh -v --opt \
86+ --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
87+ --system-sqlite \
88+ --enable-legacy-db \
89+ --target ${target} \
90+ -Dhost_arch=${host} \
91+ -Duse_system_zlib=1 \
92+ --enable-libpkix \
93+ ${stdenv.lib.optionalString enableFIPS "--enable-fips"} \
94+ ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
95+ ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}
96+
97+ runHook postBuild
98+ '';
99+
100+ NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
101+
102+ installPhase = ''
103+ runHook preInstall
104+
105+ rm -rf $out/private
106+ find $out -name "*.TOC" -delete
107+ mv $out/public $out/include
108+
109+ ln -s lib $out/lib64
110+
111+ # Upstream issue: https://bugzilla.mozilla.org/show_bug.cgi?id=530672
112+ # https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/nss/files/nss-3.32-gentoo-fixups.patch?id=af1acce6c6d2c3adb17689261dfe2c2b6771ab8a
113+ NSS_MAJOR_VERSION=`grep "NSS_VMAJOR" lib/nss/nss.h | awk '{print $3}'`
114+ NSS_MINOR_VERSION=`grep "NSS_VMINOR" lib/nss/nss.h | awk '{print $3}'`
115+ NSS_PATCH_VERSION=`grep "NSS_VPATCH" lib/nss/nss.h | awk '{print $3}'`
116+ PREFIX="$out"
117+
118+ mkdir -p $out/lib/pkgconfig
119+ sed -e "s,%prefix%,$PREFIX," \
120+ -e "s,%exec_prefix%,$PREFIX," \
121+ -e "s,%libdir%,$PREFIX/lib64," \
122+ -e "s,%includedir%,$dev/include/nss," \
123+ -e "s,%NSS_VERSION%,$NSS_MAJOR_VERSION.$NSS_MINOR_VERSION.$NSS_PATCH_VERSION,g" \
124+ -e "s,%NSPR_VERSION%,4.16,g" \
125+ pkg/pkg-config/nss.pc.in > $out/lib/pkgconfig/nss.pc
126+ chmod 0644 $out/lib/pkgconfig/nss.pc
127+
128+ sed -e "s,@prefix@,$PREFIX," \
129+ -e "s,@MOD_MAJOR_VERSION@,$NSS_MAJOR_VERSION," \
130+ -e "s,@MOD_MINOR_VERSION@,$NSS_MINOR_VERSION," \
131+ -e "s,@MOD_PATCH_VERSION@,$NSS_PATCH_VERSION," \
132+ pkg/pkg-config/nss-config.in > $out/bin/nss-config
133+ chmod 0755 $out/bin/nss-config
134+ '';
135+
136+ postFixup = let
137+ isCross = stdenv.hostPlatform != stdenv.buildPlatform;
138+ nss = if isCross then buildPackages.nss.tools else "$out";
139+ in
140+ (stdenv.lib.optionalString enableFIPS (''
141+ for libname in freebl3 nssdbm3 softokn3
142+ do '' +
143+ (if stdenv.isDarwin
144+ then ''
145+ libfile="$out/lib/lib$libname.dylib"
146+ DYLD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
147+ '' else ''
148+ libfile="$out/lib/lib$libname.so"
149+ LD_LIBRARY_PATH=$out/lib:${nspr.out}/lib \
150+ '') + ''
151+ ${nss}/bin/shlibsign -v -i "$libfile"
152+ done
153+ '')) +
154+ ''
155+ moveToOutput bin "$tools"
156+ moveToOutput bin/nss-config "$dev"
157+ moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
158+ rm -f "$out"/lib/*.a
159+
160+ runHook postInstall
161+ '';
162+
163+ meta = with stdenv.lib; {
164+ homepage = "https://developer.mozilla.org/en-US/docs/NSS";
165+ description = "A set of libraries for development of security-enabled client and server applications";
166+ license = licenses.mpl20;
167+ platforms = platforms.all;
168+ };
169+}