1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
{
lib,
stdenv,
fetchurl,
makeWrapper,
perl,
libassuan,
libgcrypt,
perlPackages,
lockfile-progs,
gnupg,
coreutils,
# For the tests:
openssh,
which,
socat,
cpio,
hexdump,
procps,
openssl,
}:
let
# A patch is needed to run the tests inside the Nix sandbox:
# /etc/passwd: "nixbld:x:1000:100:Nix build user:/build:/noshell"
# sshd: "User nixbld not allowed because shell /noshell does not exist"
opensshUnsafe = openssh.overrideAttrs (oldAttrs: {
patches = oldAttrs.patches ++ [ ./openssh-nixos-sandbox.patch ];
});
in
stdenv.mkDerivation rec {
pname = "monkeysphere";
version = "0.44";
# The patched OpenSSH binary MUST NOT be used (except in the check phase):
disallowedRequisites = [ opensshUnsafe ];
src = fetchurl {
url = "http://archive.monkeysphere.info/debian/pool/monkeysphere/m/monkeysphere/monkeysphere_${version}.orig.tar.gz";
sha256 = "1ah7hy8r9gj96pni8azzjb85454qky5l17m3pqn37854l6grgika";
};
patches = [ ./monkeysphere.patch ];
postPatch = ''
sed -i "s,/usr/bin/env,${coreutils}/bin/env," src/share/ma/update_users
'';
nativeBuildInputs = [ makeWrapper ];
buildInputs = [
perl
libassuan
libgcrypt
]
++ lib.optional doCheck (
[
gnupg
opensshUnsafe
which
socat
cpio
hexdump
procps
lockfile-progs
]
++ (with perlPackages; [
CryptOpenSSLRSA
CryptOpenSSLBignum
])
);
makeFlags = [
"PREFIX=/"
"DESTDIR=$(out)"
];
# The tests should be run (and succeed) when making changes to this package
# but they aren't enabled by default because they "drain" entropy (GnuPG
# still uses /dev/random).
doCheck = false;
preCheck = lib.optionalString doCheck ''
patchShebangs tests/
patchShebangs src/
sed -i \
-e "s,/usr/sbin/sshd,${opensshUnsafe}/bin/sshd," \
-e "s,/bin/true,${coreutils}/bin/true," \
-e "s,/bin/false,${coreutils}/bin/false," \
-e "s,openssl\ req,${openssl}/bin/openssl req," \
tests/basic
sed -i "s/<(hd/<(hexdump/" tests/keytrans
'';
postFixup =
let
wrapperArgs =
runtimeDeps:
"--prefix PERL5LIB : "
+ (
with perlPackages;
makePerlPath [
# Optional (only required for keytrans)
CryptOpenSSLRSA
CryptOpenSSLBignum
]
)
+ lib.optionalString (
builtins.length runtimeDeps > 0
) " --prefix PATH : ${lib.makeBinPath runtimeDeps}";
wrapMonkeysphere =
runtimeDeps: program: "wrapProgram $out/bin/${program} ${wrapperArgs runtimeDeps}\n";
wrapPrograms = runtimeDeps: programs: lib.concatMapStrings (wrapMonkeysphere runtimeDeps) programs;
in
wrapPrograms [ gnupg ] [ "monkeysphere-authentication" "monkeysphere-host" ]
+ wrapPrograms [ gnupg lockfile-progs ] [ "monkeysphere" ]
+ ''
# These 4 programs depend on the program name ($0):
for program in openpgp2pem openpgp2spki openpgp2ssh pem2openpgp; do
rm $out/bin/$program
ln -sf keytrans $out/share/monkeysphere/$program
makeWrapper $out/share/monkeysphere/$program $out/bin/$program \
${wrapperArgs [ ]}
done
'';
meta = {
homepage = "http://web.monkeysphere.info/";
description = "Leverage the OpenPGP web of trust for SSH and TLS authentication";
longDescription = ''
The Monkeysphere project's goal is to extend OpenPGP's web of
trust to new areas of the Internet to help us securely identify
servers we connect to, as well as each other while we work online.
The suite of Monkeysphere utilities provides a framework to
transparently leverage the web of trust for authentication of
TLS/SSL communications through the normal use of tools you are
familiar with, such as your web browser0 or secure shell.
'';
license = lib.licenses.gpl3Plus;
platforms = lib.platforms.linux;
maintainers = [ ];
};
}
|
