You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

214 lines
8.7 KiB

;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2015 Andreas Enge <>
;;; Copyright © 2015 Mark H Weaver <>
;;; Copyright © 2016, 2017 Ludovic Courtès <>
;;; Copyright © 2017 Leo Famulari <>
;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <>
;;; This file is part of GNU Guix.
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; GNU General Public License for more details.
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix. If not, see <>.
(define-module (gnu packages certs)
#:use-module ((guix licenses) #:prefix license:)
#:use-module (guix packages)
#:use-module (guix download)
#:use-module (guix build-system gnu)
#:use-module (guix build-system trivial)
#:use-module (gnu packages)
#:use-module (gnu packages python)
#:use-module (gnu packages perl)
#:use-module (gnu packages tls))
(define certdata2pem
(name "certdata2pem")
(version "2013")
(method url-fetch)
(file-name "")
(build-system trivial-build-system)
`(("python" ,python-2)))
`(#:modules ((guix build utils))
(use-modules (guix build utils))
(let ((bin (string-append %output "/bin")))
(copy-file (assoc-ref %build-inputs "source") "")
(chmod "" #o555)
(substitute* ""
(string-append (assoc-ref %build-inputs "python")
;; Use the file extension .pem instead of .crt.
(("crt") "pem"))
(mkdir-p bin)
(copy-file ""
(string-append bin "/"))
(synopsis "Python script to extract .pem data from certificate collection")
" is a Python script to transform X.509 certificate
\"source code\" as contained, for example, in the Mozilla sources, into
.pem formatted certificates.")
(license license:gpl2+)
(home-page "")))
(define-public nss-certs
(name "nss-certs")
(version "3.52.1")
(source (origin
(method url-fetch)
(uri (let ((version-with-underscores
(string-join (string-split version #\.) "_")))
"releases/NSS_" version-with-underscores "_RTM/src/"
"nss-" version ".tar.gz")))
(build-system gnu-build-system)
(outputs '("out"))
`(("certdata2pem" ,certdata2pem)
("openssl" ,openssl)
("perl" ,perl))) ;for OpenSSL's 'c_rehash'
(inputs '())
(propagated-inputs '())
`(#:modules ((guix build gnu-build-system)
(guix build utils)
(rnrs io ports)
(srfi srfi-26)
(ice-9 regex))
(map (cut assq <> %standard-phases)
'(set-paths install-locale unpack))
(add-after 'unpack 'install
(lambda _
(let ((certsdir (string-append %output "/etc/ssl/certs/"))
(trusted-rx (make-regexp "^# openssl-trust=[a-zA-Z]"
(define (maybe-install-cert file)
(let ((cert (call-with-input-file file get-string-all)))
(when (regexp-exec trusted-rx cert)
(string-append certsdir file)
(cut display cert <>)))))
(mkdir-p certsdir)
(with-directory-excursion "nss/lib/ckfw/builtins/"
;; extract single certificates from blob
(invoke "" "certdata.txt")
;; copy selected .pem files into the output
(for-each maybe-install-cert
(find-files "." ".*\\.pem")))
(with-directory-excursion certsdir
;; create symbolic links for and by openssl
;; Strangely, the call (system* "c_rehash" certsdir)
;; from inside the build dir fails with
;; "Usage error; try -help."
;; This looks like a bug in openssl-1.0.2, but we can also
;; switch into the target directory.
(invoke "c_rehash" "."))
(synopsis "CA certificates from Mozilla")
"This package provides certificates for Certification Authorities (CA)
taken from the NSS package and thus ultimately from the Mozilla project.")
(home-page "")
(license license:mpl2.0)))
(define-public le-certs
(name "le-certs")
(version "0")
(source #f)
(build-system trivial-build-system)
'(#:modules ((guix build utils))
(use-modules (guix build utils))
(let ((root (assoc-ref %build-inputs "isrgrootx1.pem"))
(intermediate (assoc-ref %build-inputs "letsencryptauthorityx3.pem"))
(backup (assoc-ref %build-inputs "letsencryptauthorityx4.pem"))
(out (string-append (assoc-ref %outputs "out") "/etc/ssl/certs"))
(openssl (assoc-ref %build-inputs "openssl"))
(perl (assoc-ref %build-inputs "perl")))
(mkdir-p out)
(lambda (cert)
(copy-file cert (string-append out "/"
(strip-store-file-name cert))))
(list root intermediate backup))
;; Create hash symlinks suitable for OpenSSL ('SSL_CERT_DIR' and
;; similar.)
(chdir (string-append %output "/etc/ssl/certs"))
(invoke (string-append perl "/bin/perl")
(string-append openssl "/bin/c_rehash")
`(("openssl" ,openssl)
("perl" ,perl))) ;for 'c_rehash'
`(; The Let's Encrypt root certificate, "ISRG Root X1".
(method url-fetch)
(uri "")
;; "Let’s Encrypt Authority X3", the active Let's Encrypt intermediate
;; certificate.
(method url-fetch)
(uri "")
;; "Let’s Encrypt Authority X4", the backup Let's Encrypt intermediate
;; certificate. This will be used for disaster recovery and will only be
;; used should Let's Encrypt lose the ability to issue with "Let’s
;; Encrypt Authority X3".
(method url-fetch)
(uri "")
(home-page "")
(synopsis "Let's Encrypt root and intermediate certificates")
(description "This package provides a certificate store containing only the
Let's Encrypt root and intermediate certificates. It is intended to be used
within Guix.")
(license license:public-domain)))