Skip to content

Commit bac2690

Browse files
dongcarldongcarl
committed
guix: Package codesigning tools
1 parent 0a2176d commit bac2690

File tree

2 files changed

+351
-2
lines changed

2 files changed

+351
-2
lines changed

‎contrib/guix/manifest.scm

Lines changed: 338 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@
44
(gnu packages base)
55
(gnu packages bash)
66
(gnu packages bison)
7+
(gnu packages certs)
78
(gnu packages cdrom)
89
(gnu packages check)
910
(gnu packages cmake)
1011
(gnu packages commencement)
1112
(gnu packages compression)
1213
(gnu packages cross-base)
14+
(gnu packages curl)
1315
(gnu packages file)
1416
(gnu packages gawk)
1517
(gnu packages gcc)
@@ -23,7 +25,9 @@
2325
(gnu packages perl)
2426
(gnu packages pkg-config)
2527
(gnu packages python)
28+
(gnu packages python-web)
2629
(gnu packages shells)
30+
(gnu packages tls)
2731
(gnu packages version-control)
2832
(guix build-system font)
2933
(guix build-system gnu)
@@ -217,6 +221,337 @@ chain for " target " development."))
217221
parse, modify and abstract ELF, PE and MachO formats.")
218222
(license license:asl2.0)))
219223

224+
(define osslsigncode
225+
(package
226+
(name "osslsigncode")
227+
(version "2.0")
228+
(source (origin
229+
(method url-fetch)
230+
(uri (string-append "https://github.com/mtrojnar/"
231+
name "/archive/" version ".tar.gz"))
232+
(sha256
233+
(base32
234+
"0byri6xny770wwb2nciq44j5071122l14bvv65axdd70nfjf0q2s"))))
235+
(build-system gnu-build-system)
236+
(native-inputs
237+
`(("pkg-config" ,pkg-config)
238+
("autoconf" ,autoconf)
239+
("automake" ,automake)
240+
("libtool" ,libtool)))
241+
(inputs
242+
`(("openssl" ,openssl)))
243+
(arguments
244+
`(#:configure-flags
245+
`("--without-gsf"
246+
"--without-curl"
247+
"--disable-dependency-tracking")))
248+
(home-page "https://github.com/mtrojnar/osslsigncode")
249+
(synopsis "Authenticode signing and timestamping tool")
250+
(description "osslsigncode is a small tool that implements part of the
251+
functionality of the Microsoft tool signtool.exe - more exactly the Authenticode
252+
signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and
253+
thus should be able to compile on most platforms where these exist.")
254+
(license license:gpl3+))) ; license is with openssl exception
255+
256+
(define-public python-asn1crypto
257+
(package
258+
(name "python-asn1crypto")
259+
(version "1.4.0")
260+
(source
261+
(origin
262+
(method git-fetch)
263+
(uri (git-reference
264+
(url "https://github.com/wbond/asn1crypto")
265+
(commit version)))
266+
(file-name (git-file-name name version))
267+
(sha256
268+
(base32
269+
"19abibn6jw20mzi1ln4n9jjvpdka8ygm4m439hplyrdfqbvgm01r"))))
270+
(build-system python-build-system)
271+
(arguments
272+
'(#:phases
273+
(modify-phases %standard-phases
274+
(replace 'check
275+
(lambda _
276+
(invoke "python" "run.py" "tests"))))))
277+
(home-page "https://github.com/wbond/asn1crypto")
278+
(synopsis "ASN.1 parser and serializer in Python")
279+
(description "asn1crypto is an ASN.1 parser and serializer with definitions
280+
for private keys, public keys, certificates, CRL, OCSP, CMS, PKCS#3, PKCS#7,
281+
PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
282+
(license license:expat)))
283+
284+
(define-public python-elfesteem
285+
(let ((commit "87bbd79ab7e361004c98cc8601d4e5f029fd8bd5"))
286+
(package
287+
(name "python-elfesteem")
288+
(version (git-version "0.1" "1" commit))
289+
(source
290+
(origin
291+
(method git-fetch)
292+
(uri (git-reference
293+
(url "https://github.com/LRGH/elfesteem")
294+
(commit commit)))
295+
(file-name (git-file-name name commit))
296+
(sha256
297+
(base32
298+
"1nyvjisvyxyxnd0023xjf5846xd03lwawp5pfzr8vrky7wwm5maz"))))
299+
(build-system python-build-system)
300+
;; There are no tests, but attempting to run python setup.py test leads to
301+
;; PYTHONPATH problems, just disable the test
302+
(arguments '(#:tests? #f))
303+
(home-page "https://github.com/LRGH/elfesteem")
304+
(synopsis "ELF/PE/Mach-O parsing library")
305+
(description "elfesteem parses ELF, PE and Mach-O files.")
306+
(license license:lgpl2.1))))
307+
308+
(define-public python-oscrypto
309+
(package
310+
(name "python-oscrypto")
311+
(version "1.2.1")
312+
(source
313+
(origin
314+
(method git-fetch)
315+
(uri (git-reference
316+
(url "https://github.com/wbond/oscrypto")
317+
(commit version)))
318+
(file-name (git-file-name name version))
319+
(sha256
320+
(base32
321+
"1d4d8s4z340qhvb3g5m5v3436y3a71yc26wk4749q64m09kxqc3l"))
322+
(patches (search-our-patches "oscrypto-hard-code-openssl.patch"))))
323+
(build-system python-build-system)
324+
(native-search-paths
325+
(list (search-path-specification
326+
(variable "SSL_CERT_FILE")
327+
(file-type 'regular)
328+
(separator #f) ;single entry
329+
(files '("etc/ssl/certs/ca-certificates.crt")))))
330+
331+
(propagated-inputs
332+
`(("python-asn1crypto" ,python-asn1crypto)
333+
("openssl" ,openssl)))
334+
(arguments
335+
`(#:phases
336+
(modify-phases %standard-phases
337+
(add-after 'unpack 'hard-code-path-to-libscrypt
338+
(lambda* (#:key inputs #:allow-other-keys)
339+
(let ((openssl (assoc-ref inputs "openssl")))
340+
(substitute* "oscrypto/__init__.py"
341+
(("@GUIX_OSCRYPTO_USE_OPENSSL@")
342+
(string-append openssl "/lib/libcrypto.so" "," openssl "/lib/libssl.so")))
343+
#t)))
344+
(add-after 'unpack 'disable-broken-tests
345+
(lambda _
346+
;; This test is broken as there is no keyboard interrupt.
347+
(substitute* "tests/test_trust_list.py"
348+
(("^(.*)class TrustListTests" line indent)
349+
(string-append indent
350+
"@unittest.skip(\"Disabled by Guix\")\n"
351+
line)))
352+
(substitute* "tests/test_tls.py"
353+
(("^(.*)class TLSTests" line indent)
354+
(string-append indent
355+
"@unittest.skip(\"Disabled by Guix\")\n"
356+
line)))
357+
#t))
358+
(replace 'check
359+
(lambda _
360+
(invoke "python" "run.py" "tests")
361+
#t)))))
362+
(home-page "https://github.com/wbond/oscrypto")
363+
(synopsis "Compiler-free Python crypto library backed by the OS")
364+
(description "oscrypto is a compilation-free, always up-to-date encryption library for Python.")
365+
(license license:expat)))
366+
367+
(define-public python-oscryptotests
368+
(package (inherit python-oscrypto)
369+
(name "python-oscryptotests")
370+
(arguments
371+
`(#:tests? #f
372+
#:phases
373+
(modify-phases %standard-phases
374+
(add-after 'unpack 'hard-code-path-to-libscrypt
375+
(lambda* (#:key inputs #:allow-other-keys)
376+
(chdir "tests")
377+
#t)))))))
378+
379+
(define-public python-certvalidator
380+
(let ((commit "e5bdb4bfcaa09fa0af355eb8867d00dfeecba08c"))
381+
(package
382+
(name "python-certvalidator")
383+
(version (git-version "0.1" "1" commit))
384+
(source
385+
(origin
386+
(method git-fetch)
387+
(uri (git-reference
388+
(url "https://github.com/achow101/certvalidator")
389+
(commit commit)))
390+
(file-name (git-file-name name commit))
391+
(sha256
392+
(base32
393+
"18pvxkvpkfkzgvfylv0kx65pmxfcv1hpsg03cip93krfvrrl4c75"))))
394+
(build-system python-build-system)
395+
(propagated-inputs
396+
`(("python-asn1crypto" ,python-asn1crypto)
397+
("python-oscrypto" ,python-oscrypto)
398+
("python-oscryptotests", python-oscryptotests))) ;; certvalidator tests import oscryptotests
399+
(arguments
400+
`(#:phases
401+
(modify-phases %standard-phases
402+
(add-after 'unpack 'disable-broken-tests
403+
(lambda _
404+
(substitute* "tests/test_certificate_validator.py"
405+
(("^(.*)class CertificateValidatorTests" line indent)
406+
(string-append indent
407+
"@unittest.skip(\"Disabled by Guix\")\n"
408+
line)))
409+
(substitute* "tests/test_crl_client.py"
410+
(("^(.*)def test_fetch_crl" line indent)
411+
(string-append indent
412+
"@unittest.skip(\"Disabled by Guix\")\n"
413+
line)))
414+
(substitute* "tests/test_ocsp_client.py"
415+
(("^(.*)def test_fetch_ocsp" line indent)
416+
(string-append indent
417+
"@unittest.skip(\"Disabled by Guix\")\n"
418+
line)))
419+
(substitute* "tests/test_registry.py"
420+
(("^(.*)def test_build_paths" line indent)
421+
(string-append indent
422+
"@unittest.skip(\"Disabled by Guix\")\n"
423+
line)))
424+
(substitute* "tests/test_validate.py"
425+
(("^(.*)def test_revocation_mode_hard" line indent)
426+
(string-append indent
427+
"@unittest.skip(\"Disabled by Guix\")\n"
428+
line)))
429+
#t))
430+
(replace 'check
431+
(lambda _
432+
(invoke "python" "run.py" "tests")
433+
#t)))))
434+
(home-page "https://github.com/wbond/certvalidator")
435+
(synopsis "Python library for validating X.509 certificates and paths")
436+
(description "certvalidator is a Python library for validating X.509
437+
certificates or paths. Supports various options, including: validation at a
438+
specific moment in time, whitelisting and revocation checks.")
439+
(license license:expat))))
440+
441+
(define-public python-requests-2.25.1
442+
(package (inherit python-requests)
443+
(version "2.25.1")
444+
(source (origin
445+
(method url-fetch)
446+
(uri (pypi-uri "requests" version))
447+
(sha256
448+
(base32
449+
"015qflyqsgsz09gnar69s6ga74ivq5kch69s4qxz3904m7a3v5r7"))))))
450+
451+
(define-public python-altgraph
452+
(package
453+
(name "python-altgraph")
454+
(version "0.17")
455+
(source
456+
(origin
457+
(method git-fetch)
458+
(uri (git-reference
459+
(url "https://github.com/ronaldoussoren/altgraph")
460+
(commit (string-append "v" version))))
461+
(file-name (git-file-name name version))
462+
(sha256
463+
(base32
464+
"09sm4srvvkw458pn48ga9q7ykr4xlz7q8gh1h9w7nxpf001qgpwb"))))
465+
(build-system python-build-system)
466+
(home-page "https://github.com/ronaldoussoren/altgraph")
467+
(synopsis "Python graph (network) package")
468+
(description "altgraph is a fork of graphlib: a graph (network) package for
469+
constructing graphs, BFS and DFS traversals, topological sort, shortest paths,
470+
etc. with graphviz output.")
471+
(license license:expat)))
472+
473+
474+
(define-public python-macholib
475+
(package
476+
(name "python-macholib")
477+
(version "1.14")
478+
(source
479+
(origin
480+
(method git-fetch)
481+
(uri (git-reference
482+
(url "https://github.com/ronaldoussoren/macholib")
483+
(commit (string-append "v" version))))
484+
(file-name (git-file-name name version))
485+
(sha256
486+
(base32
487+
"0aislnnfsza9wl4f0vp45ivzlc0pzhp9d4r08700slrypn5flg42"))))
488+
(build-system python-build-system)
489+
(propagated-inputs
490+
`(("python-altgraph" ,python-altgraph)))
491+
(arguments
492+
'(#:phases
493+
(modify-phases %standard-phases
494+
(add-after 'unpack 'disable-broken-tests
495+
(lambda _
496+
;; This test is broken as there is no keyboard interrupt.
497+
(substitute* "macholib_tests/test_command_line.py"
498+
(("^(.*)class TestCmdLine" line indent)
499+
(string-append indent
500+
"@unittest.skip(\"Disabled by Guix\")\n"
501+
line)))
502+
(substitute* "macholib_tests/test_dyld.py"
503+
(("^(.*)def test_\\S+_find" line indent)
504+
(string-append indent
505+
"@unittest.skip(\"Disabled by Guix\")\n"
506+
line))
507+
(("^(.*)def testBasic" line indent)
508+
(string-append indent
509+
"@unittest.skip(\"Disabled by Guix\")\n"
510+
line))
511+
)
512+
#t)))))
513+
(home-page "https://github.com/ronaldoussoren/macholib")
514+
(synopsis "Python library for analyzing and editing Mach-O headers")
515+
(description "macholib is a Macho-O header analyzer and editor. It's
516+
typically used as a dependency analysis tool, and also to rewrite dylib
517+
references in Mach-O headers to be @executable_path relative. Though this tool
518+
targets a platform specific file format, it is pure python code that is platform
519+
and endian independent.")
520+
(license license:expat)))
521+
522+
(define-public python-signapple
523+
(let ((commit "4ff1c1754e37042c002a3f6375c47fd931f2030b"))
524+
(package
525+
(name "python-signapple")
526+
(version (git-version "0.1" "1" commit))
527+
(source
528+
(origin
529+
(method git-fetch)
530+
(uri (git-reference
531+
(url "https://github.com/dongcarl/signapple")
532+
(commit commit)))
533+
(file-name (git-file-name name commit))
534+
(sha256
535+
(base32
536+
"043czyzfm04rcx5xsp59vsppla3vm5g45dbp1npy2hww4066rlnh"))))
537+
(build-system python-build-system)
538+
(propagated-inputs
539+
`(("python-asn1crypto" ,python-asn1crypto)
540+
("python-oscrypto" ,python-oscrypto)
541+
("python-certvalidator" ,python-certvalidator)
542+
("python-elfesteem" ,python-elfesteem)
543+
("python-requests" ,python-requests-2.25.1)
544+
("python-macholib" ,python-macholib)
545+
("libcrypto" ,openssl)))
546+
;; There are no tests, but attempting to run python setup.py test leads to
547+
;; problems, just disable the test
548+
(arguments '(#:tests? #f))
549+
(home-page "https://github.com/achow101/signapple")
550+
(synopsis "Mach-O binary signature tool")
551+
(description "signapple is a Python tool for creating, verifying, and
552+
inspecting signatures in Mach-O binaries.")
553+
(license license:expat))))
554+
220555
(packages->manifest
221556
(append
222557
(list ;; The Basics
@@ -262,9 +597,10 @@ parse, modify and abstract ELF, PE and MachO formats.")
262597
;; Windows
263598
(list zip
264599
(make-mingw-pthreads-cross-toolchain "x86_64-w64-mingw32")
265-
(make-nsis-with-sde-support nsis-x86_64)))
600+
(make-nsis-with-sde-support nsis-x86_64)
601+
osslsigncode))
266602
((string-contains target "-linux-")
267603
(list (make-bitcoin-cross-toolchain target)))
268604
((string-contains target "darwin")
269-
(list clang-toolchain-10 binutils imagemagick libtiff librsvg font-tuffy cmake xorriso))
605+
(list clang-toolchain-10 binutils imagemagick libtiff librsvg font-tuffy cmake xorriso python-signapple))
270606
(else '())))))

‎contrib/guix/patches/oscrypto-hard-code-openssl.patch

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/oscrypto/__init__.py b/oscrypto/__init__.py
2+
index eb27313..371ab24 100644
3+
--- a/oscrypto/__init__.py
4+
+++ b/oscrypto/__init__.py
5+
@@ -302,3 +302,8 @@ def load_order():
6+
'oscrypto._win.tls',
7+
'oscrypto.tls',
8+
]
9+
+
10+
+
11+
+paths = '@GUIX_OSCRYPTO_USE_OPENSSL@'.split(',')
12+
+assert len(paths) == 2, 'Value for OSCRYPTO_USE_OPENSSL env var must be two paths separated by a comma'
13+
+use_openssl(*paths)

0 commit comments

Comments
 (0)