···
1
-
{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, python3, perl, bison, flex
2
-
, texinfo, perlPackages
3
-
, openldap, libcap_ng, sqlite, openssl, db, libedit, pam
4
-
, CoreFoundation, Security, SystemConfiguration
26
+
, SystemConfiguration
36
+
, withCapNG ? stdenv.isLinux
37
+
# libmicrohttpd should theoretically work for darwin as well, but something is broken.
38
+
# It affects tests check-bx509d and check-httpkadmind.
39
+
, withMicroHTTPD ? stdenv.isLinux
40
+
, withOpenLDAP ? true
41
+
, withOpenLDAPAsHDBModule ? false
42
+
, withOpenSSL ? true
43
+
, withSQLite3 ? true
7
-
stdenv.mkDerivation rec {
46
+
assert lib.assertMsg (withOpenLDAPAsHDBModule -> withOpenLDAP) ''
47
+
OpenLDAP needs to be enabled in order to build the OpenLDAP HDB Module.
50
+
stdenv.mkDerivation {
52
+
version = "7.8.0-unstable-2023-11-29";
14
-
rev = "heimdal-${version}";
15
-
sha256 = "sha256-iXOaar1S3y0xHdL0S+vS0uxoFQjy43kABxqE+KEhxjU=";
57
+
rev = "3253c49544eacb33d5ad2f6f919b0696e5aab794";
58
+
hash = "sha256-uljzQBzXrZCZjcIWfioqHN8YsbUUNy14Vo+A3vZIXzM=";
outputs = [ "out" "dev" "man" "info" ];
20
-
patches = [ ./heimdal-make-missing-headers.patch ];
63
+
nativeBuildInputs = [
72
+
++ (with perlPackages; [ JSON ]);
22
-
nativeBuildInputs = [ autoreconfHook pkg-config python3 perl bison flex texinfo ]
23
-
++ (with perlPackages; [ JSON ]);
24
-
buildInputs = lib.optionals (stdenv.isLinux) [ libcap_ng ]
25
-
++ [ db sqlite openssl libedit openldap pam]
26
-
++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ];
74
+
buildInputs = [ db libedit pam ]
75
+
++ lib.optionals (stdenv.isDarwin) [ CoreFoundation Security SystemConfiguration ]
76
+
++ lib.optionals (withCJSON) [ cjson ]
77
+
++ lib.optionals (withCapNG) [ libcap_ng ]
78
+
++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
79
+
++ lib.optionals (withOpenLDAP) [ openldap ]
80
+
++ lib.optionals (withOpenSSL) [ openssl ]
81
+
++ lib.optionals (withSQLite3) [ sqlite ];
28
-
## ugly, X should be made an option
84
+
nativeCheckInputs = [
31
-
"--localstatedir=/var"
32
-
"--infodir=$info/share/info"
33
-
"--enable-hdb-openldap-module"
34
-
"--with-sqlite3=${sqlite.dev}"
36
-
# ugly, --with-libedit is not enought, it fall back to bundled libedit
"--with-libedit-include=${libedit.dev}/include"
"--with-libedit-lib=${libedit}/lib"
39
-
"--with-openssl=${openssl.dev}"
94
+
"--with-berkeley-db-include=${db.dev}/include"
42
-
"--with-berkeley-db-include=${db.dev}/include"
43
-
"--with-openldap=${openldap.dev}"
44
-
] ++ lib.optionals (stdenv.isLinux) [
98
+
"--disable-afs-string-to-key"
99
+
] ++ lib.optionals (withCapNG) [
101
+
] ++ lib.optionals (withCJSON) [
102
+
"--with-cjson=${cjson}"
103
+
] ++ lib.optionals (withOpenLDAP) [
104
+
"--with-openldap=${openldap.dev}"
105
+
] ++ lib.optionals (withOpenLDAPAsHDBModule) [
106
+
"--enable-hdb-openldap-module"
107
+
] ++ lib.optionals (withSQLite3) [
108
+
"--with-sqlite3=${sqlite.dev}"
49
-
sed -i '/^DEFAULT_INCLUDES/ s,$, -I..,' source/cf/Makefile.am.common
50
-
sed -i -e 's/date/date --date="@$SOURCE_DATE_EPOCH"/' source/configure.ac
111
+
# (check-ldap) slapd resides within ${openldap}/libexec,
112
+
# which is not part of $PATH by default.
113
+
# (check-ldap) prepending ${openldap}/bin to the path to avoid
114
+
# using the default installation of openldap on unsandboxed darwin systems,
115
+
# which does not support the new mdb backend at the moment (2024-01-13).
116
+
# (check-ldap) the bdb backend got deprecated in favour of mdb in openldap 2.5.0,
117
+
# but the heimdal tests still seem to expect bdb as the openldap backend.
118
+
# This might be fixed upstream in a future update.
122
+
substituteInPlace tests/ldap/slapd-init.in \
123
+
--replace 'SCHEMA_PATHS="' 'SCHEMA_PATHS="${openldap}/etc/schema '
124
+
substituteInPlace tests/ldap/check-ldap.in \
125
+
--replace 'PATH=' 'PATH=${openldap}/libexec:${openldap}/bin:'
126
+
substituteInPlace tests/ldap/slapd.conf \
127
+
--replace 'database bdb' 'database mdb'
54
-
configureFlagsArray+=(
56
-
"--sbindir=$out/sbin"
57
-
"--libexecdir=$out/libexec/heimdal"
58
-
"--mandir=$man/share/man"
59
-
"--infodir=$man/share/info"
60
-
"--includedir=$dev/include")
132
+
# (test_cc) heimdal uses librokens implementation of `secure_getenv` on darwin,
133
+
# which expects either USER or LOGNAME to be set.
134
+
preCheck = lib.optionalString (stdenv.isDarwin) ''
135
+
export USER=nix-builder
# We need to build hcrypt for applications like samba
···
(cd include/hcrypto; make -j $NIX_BUILD_CORES install)
(cd lib/hcrypto; make -j $NIX_BUILD_CORES install)
mv $out/bin/krb5-config $dev/bin/
# asn1 compilers, move them to $dev
81
-
mv $out/libexec/heimdal/heimdal/* $dev/bin
82
-
rmdir $out/libexec/heimdal/heimdal
153
+
mv $out/libexec/heimdal/* $dev/bin
154
+
rmdir $out/libexec/heimdal
# compile_et is needed for cross-compiling this package and samba
mv lib/com_err/.libs/compile_et $dev/bin
···
# hx_locl.h:67:25: fatal error: pkcs10_asn1.h: No such file or directory
#enableParallelBuilding = true;
166
+
implementation = "heimdal";
167
+
tests.nixos = nixosTests.kerberos.heimdal;
171
+
homepage = "https://www.heimdal.software";
172
+
changelog = "https://github.com/heimdal/heimdal/releases";
description = "An implementation of Kerberos 5 (and some more stuff)";
platforms = platforms.unix;
176
+
maintainers = with maintainers; [ h7x4 ];
99
-
passthru.implementation = "heimdal";
pyrox.dev