11{
2- stdenv ,
3- lib ,
4- fetchFromGitHub ,
5- pkg-config ,
6- autoreconfHook ,
72 autoconf-archive ,
3+ autoreconfHook ,
4+ buildEnv ,
5+ clangStdenv ,
6+ cmocka ,
7+ dbus ,
8+ expect ,
9+ fetchFromGitHub ,
10+ glibc ,
11+ gnutls ,
12+ iproute2 ,
13+ lib ,
14+ libyaml ,
815 makeWrapper ,
9- patchelf ,
10- tpm2-tss ,
11- tpm2-tools ,
1216 opensc ,
17+ openssh ,
1318 openssl ,
14- sqlite ,
19+ nss ,
20+ p11-kit ,
21+ patchelf ,
22+ pkg-config ,
1523 python3 ,
16- glibc ,
17- libyaml ,
18- abrmdSupport ? true ,
19- tpm2-abrmd ? null ,
24+ stdenv ,
25+ sqlite ,
26+ swtpm ,
27+ tpm2-abrmd ,
28+ tpm2-openssl ,
29+ tpm2-pkcs11 , # for passthru abrmd tests
30+ tpm2-tools ,
31+ tpm2-tss ,
32+ which ,
33+ xxd ,
34+ abrmdSupport ? false ,
2035 fapiSupport ? true ,
36+ enableFuzzing ? false ,
2137} :
2238
23- stdenv . mkDerivation rec {
39+ let
40+ chosenStdenv = if enableFuzzing then clangStdenv else stdenv ;
41+ in
42+ chosenStdenv . mkDerivation ( finalAttrs : {
2443 pname = "tpm2-pkcs11" ;
25- version = "1.9.0 " ;
44+ version = "1.9.1 " ;
2645
2746 src = fetchFromGitHub {
2847 owner = "tpm2-software" ;
29- repo = pname ;
30- rev = version ;
31- sha256 = "sha256-SoHtgZRIYNJg4/w1MIocZAM26mkrM+UOQ+RKCh6nwCk =" ;
48+ repo = "tpm2-pkcs11" ;
49+ tag = finalAttrs . version ;
50+ hash = "sha256-W74ckrpK7ypny1L3Gn7nNbOVh8zbHavIk/TX3b8XbI8 =" ;
3251 } ;
3352
34- patches = [
35- ./version.patch
36- ./graceful-fapi-fail.patch
37- ] ;
53+ # Disable Java‐based tests because of missing dependencies
54+ patches = [ ./disable-java-integration.patch ] ;
3855
39- # The preConfigure phase doesn't seem to be working here
40- # ./bootstrap MUST be executed as the first step, before all
41- # of the autoreconfHook stuff
4256 postPatch = ''
43- echo ${ version } > VERSION
57+ echo ${ lib . escapeShellArg finalAttrs . version } >VERSION
58+
59+ # Don't run git in the bootstrap
60+ substituteInPlace bootstrap --replace-warn "git" "# git"
61+
62+ # Provide configuration file for D-Bus
63+ substituteInPlace Makefile.am --replace-fail \
64+ "dbus-run-session" \
65+ "dbus-run-session --config-file=${ dbus } /share/dbus-1/session.conf"
66+
67+ # Disable failing tests
68+ sed -E -i '/\<test\/integration\/(pkcs-crypt\.int|pkcs11-tool\.sh)\>/d' \
69+ Makefile-integration.am
70+
71+ patchShebangs test tools
72+
73+ # The preConfigure phase doesn't seem to be working here
74+ # ./bootstrap MUST be executed as the first step, before all
75+ # of the autoreconfHook stuff
4476 ./bootstrap
4577 '' ;
4678
47- configureFlags = lib . optionals ( ! fapiSupport ) [
48- # Note: this will be renamed to with-fapi in next release.
49- "--enable-fapi=no"
50- ] ;
79+ configureFlags =
80+ [
81+ ( lib . enableFeature finalAttrs . doCheck "unit" )
82+ ( lib . enableFeature finalAttrs . doCheck "integration" )
83+ ]
84+ ++ lib . optionals enableFuzzing [
85+ "--enable-fuzzing"
86+ "--disable-hardening"
87+ ]
88+ ++ lib . optional fapiSupport "--with-fapi" ;
89+
90+ strictDeps = true ;
5191
5292 nativeBuildInputs = [
53- pkg-config
54- autoreconfHook
5593 autoconf-archive
94+ autoreconfHook
5695 makeWrapper
5796 patchelf
58- ] ;
59- buildInputs = [
60- tpm2-tss
61- tpm2-tools
62- opensc
63- openssl
64- sqlite
65- libyaml
97+ pkg-config
6698 ( python3 . withPackages (
67- ps : with ps ; [
99+ ps :
100+ with ps ;
101+ [
68102 packaging
69103 pyyaml
104+ python-pkcs11
70105 cryptography
71106 pyasn1-modules
72107 tpm2-pytss
73108 ]
109+ ++ cryptography . optional-dependencies . ssh
74110 ) )
75111 ] ;
76112
113+ buildInputs = [
114+ libyaml
115+ opensc
116+ openssl
117+ sqlite
118+ tpm2-tools
119+ tpm2-tss
120+ ] ;
121+
122+ nativeCheckInputs = [
123+ dbus
124+ expect
125+ gnutls
126+ iproute2
127+ nss . tools
128+ opensc
129+ openssh
130+ openssl
131+ p11-kit
132+ sqlite
133+ swtpm
134+ tpm2-abrmd
135+ tpm2-tools
136+ which
137+ xxd
138+ ] ;
139+
140+ checkInputs = [
141+ cmocka
142+ tpm2-abrmd
143+ ] ;
144+
145+ enableParallelBuilding = true ;
146+ hardeningDisable = lib . optional enableFuzzing "all" ;
147+
77148 outputs = [
78149 "out"
79150 "bin"
80151 "dev"
81152 ] ;
82153
154+ doCheck = true ;
83155 dontStrip = true ;
84156 dontPatchELF = true ;
85157
158+ preCheck =
159+ let
160+ openssl-modules = buildEnv {
161+ name = "openssl-modules" ;
162+ pathsToLink = [ "/lib/ossl-modules" ] ;
163+ paths = map lib . getLib [
164+ openssl
165+ tpm2-openssl
166+ ] ;
167+ } ;
168+ in
169+ ''
170+ # Enable tests to load TCTI modules
171+ export LD_LIBRARY_PATH+=":${
172+ lib . makeLibraryPath [
173+ swtpm
174+ tpm2-tools
175+ tpm2-abrmd
176+ ]
177+ } "
178+
179+ # Enable tests to load TPM2 OpenSSL module
180+ export OPENSSL_MODULES="${ openssl-modules } /lib/ossl-modules"
181+ '' ;
182+
183+ postInstall = ''
184+ mkdir -p $bin/bin/ $bin/share/tpm2_pkcs11/
185+ mv ./tools/* $bin/share/tpm2_pkcs11/
186+ makeWrapper $bin/share/tpm2_pkcs11/tpm2_ptool.py $bin/bin/tpm2_ptool \
187+ --prefix PATH : ${ lib . makeBinPath [ tpm2-tools ] }
188+ '' ;
189+
86190 # To be able to use the userspace resource manager, the RUNPATH must
87191 # explicitly include the tpm2-abrmd shared libraries.
88192 preFixup =
89193 let
90194 rpath = lib . makeLibraryPath (
91- ( lib . optional abrmdSupport tpm2-abrmd )
92- ++ [
93- tpm2-tss
94- sqlite
95- openssl
195+ [
96196 glibc
97197 libyaml
198+ openssl
199+ sqlite
200+ tpm2-tss
98201 ]
202+ ++ ( lib . optional abrmdSupport tpm2-abrmd )
99203 ) ;
100204 in
101205 ''
@@ -106,19 +210,18 @@ stdenv.mkDerivation rec {
106210 $out/lib/libtpm2_pkcs11.so.0.0.0
107211 '' ;
108212
109- postInstall = ''
110- mkdir -p $bin/bin/ $bin/share/tpm2_pkcs11/
111- mv ./tools/* $bin/share/tpm2_pkcs11/
112- makeWrapper $bin/share/tpm2_pkcs11/tpm2_ptool.py $bin/bin/tpm2_ptool \
113- --prefix PATH : ${ lib . makeBinPath [ tpm2-tools ] }
114- '' ;
213+ passthru = {
214+ tests . tpm2-pkcs11-abrmd = tpm2-pkcs11 . override {
215+ abrmdSupport = true ;
216+ } ;
217+ } ;
115218
116- meta = with lib ; {
219+ meta = {
117220 description = "PKCS#11 interface for TPM2 hardware" ;
118221 homepage = "https://github.com/tpm2-software/tpm2-pkcs11" ;
119- license = licenses . bsd2 ;
120- platforms = platforms . linux ;
121- maintainers = [ ] ;
222+ license = lib . licenses . bsd2 ;
223+ platforms = lib . platforms . linux ;
224+ maintainers = with lib . maintainers ; [ numinit ] ;
122225 mainProgram = "tpm2_ptool" ;
123226 } ;
124- }
227+ } )
0 commit comments