public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cacert: Build directly from nss instead of our own tarball

Browse Source
This commit is contained in:
William A. Kennington III 2015-05-29 13:51:55 -07:00
parent 02895e8211
commit d6cbb061e3
2 changed files with 21 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/security/ca.nix
View File

@ -22,7 +22,7 @@ in
security.pki.certificateFiles = mkOption { security.pki.certificateFiles = mkOption {
type = types.listOf types.path; type = types.listOf types.path;
default = []; default = [];
example = literalExample "[ \"\${pkgs.cacert}/etc/ca-bundle.crt\" ]"; example = literalExample "[ \"\${pkgs.cacert}/ca-bundle.crt\" ]";
description = '' description = ''
A list of files containing trusted root certificates in PEM A list of files containing trusted root certificates in PEM
format. These are concatenated to form format. These are concatenated to form
@ -53,7 +53,7 @@ in
config = { config = {
security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ca-bundle.crt" ]; security.pki.certificateFiles = [ "${pkgs.cacert}/ca-bundle.crt" ];
# NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility. # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
environment.etc."ssl/certs/ca-certificates.crt".source = caBundle; environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;

32
pkgs/data/misc/cacert/default.nix
View File

@ -1,23 +1,29 @@
{ stdenv, fetchurl }: { stdenv, nss, curl-full, perl, perlPackages }:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
name = "cacert-20140715"; name = "nss-cacert-${nss.version}";
src = fetchurl { src = nss.src;
url = "http://tarballs.nixos.org/${name}.pem.bz2";
sha256 = "1l4j7z6ysnllx99isjzlc8zc34rbbgj4kzlg1y5sy9bgphc8cssl";
};
unpackPhase = "true"; postPatch = ''
unpackFile ${curl-full.src};
installPhase =
''
mkdir -p $out/etc
bunzip2 < $src > $out/etc/ca-bundle.crt
''; '';
meta = { nativeBuildInputs = [ perl ] ++ (with perlPackages; [ LWP ]);
buildPhase = ''
perl curl-*/lib/mk-ca-bundle.pl -d "file://$(pwd)/nss/lib/ckfw/builtins/certdata.txt" ca-bundle.crt
'';
installPhase = ''
mkdir -pv $out
cp -v ca-bundle.crt $out
'';
meta = with stdenv.lib; {
homepage = http://curl.haxx.se/docs/caextract.html; homepage = http://curl.haxx.se/docs/caextract.html;
description = "A bundle of X.509 certificates of public Certificate Authorities (CA)"; description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
platforms = platforms.all;
maintainers = with maintainers; [ wkennington ];
}; };
} }