diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix index fb3d1109e14..84cdf556d02 100644 --- a/pkgs/applications/networking/browsers/chromium/default.nix +++ b/pkgs/applications/networking/browsers/chromium/default.nix @@ -32,7 +32,7 @@ let channel = "stable"; selinux = false; nacl = false; - openssl = true; + openssl = false; gnome = false; gnomeKeyring = false; proprietaryCodecs = true; @@ -59,7 +59,7 @@ let use_system_libpng = true; use_system_libxml = true; use_system_speex = true; - use_system_ssl = true; + use_system_ssl = config.openssl; use_system_stlport = true; use_system_xdg_utils = true; use_system_yasm = true; diff --git a/pkgs/applications/networking/browsers/firefox/12.0.nix b/pkgs/applications/networking/browsers/firefox/12.0.nix index 6a22b1d8e5f..97e23d1b8b2 100644 --- a/pkgs/applications/networking/browsers/firefox/12.0.nix +++ b/pkgs/applications/networking/browsers/firefox/12.0.nix @@ -33,7 +33,7 @@ rec { "--with-system-zlib" "--with-system-bz2" "--with-system-nspr" - # "--with-system-nss" + "--with-system-nss" # "--with-system-png" # <-- "--with-system-png won't work because the system's libpng doesn't have APNG support" # "--enable-system-cairo" # disabled for the moment because our Cairo is too old "--enable-system-sqlite" @@ -54,7 +54,7 @@ rec { [ pkgconfig gtk perl zip libIDL libjpeg libpng zlib cairo bzip2 python dbus dbus_glib pango freetype fontconfig xlibs.libXi xlibs.libX11 xlibs.libXrender xlibs.libXft xlibs.libXt file - alsaLib nspr /* nss */ libnotify xlibs.pixman yasm mesa + alsaLib nspr nss libnotify xlibs.pixman yasm mesa xlibs.libXScrnSaver xlibs.scrnsaverproto xlibs.libXext xlibs.xextproto sqlite unzip ]; @@ -129,7 +129,7 @@ rec { buildInputs = [ pkgconfig gtk perl zip libIDL libjpeg zlib cairo bzip2 python - dbus dbus_glib pango freetype fontconfig alsaLib nspr libnotify + dbus dbus_glib pango freetype fontconfig alsaLib nspr nss libnotify xlibs.pixman yasm mesa sqlite file unzip ]; diff --git a/pkgs/applications/networking/browsers/firefox/13.0.nix b/pkgs/applications/networking/browsers/firefox/13.0.nix index 1b021955742..fbbf3275ad1 100644 --- a/pkgs/applications/networking/browsers/firefox/13.0.nix +++ b/pkgs/applications/networking/browsers/firefox/13.0.nix @@ -33,7 +33,7 @@ rec { "--with-system-zlib" "--with-system-bz2" "--with-system-nspr" - # "--with-system-nss" + "--with-system-nss" # "--with-system-png" # <-- "--with-system-png won't work because the system's libpng doesn't have APNG support" # "--enable-system-cairo" # disabled for the moment because our Cairo is too old "--enable-system-sqlite" @@ -54,7 +54,7 @@ rec { [ pkgconfig gtk perl zip libIDL libjpeg libpng zlib cairo bzip2 python dbus dbus_glib pango freetype fontconfig xlibs.libXi xlibs.libX11 xlibs.libXrender xlibs.libXft xlibs.libXt file - alsaLib nspr /* nss */ libnotify xlibs.pixman yasm mesa + alsaLib nspr nss libnotify xlibs.pixman yasm mesa xlibs.libXScrnSaver xlibs.scrnsaverproto xlibs.libXext xlibs.xextproto sqlite unzip makeWrapper ]; @@ -136,7 +136,7 @@ rec { buildInputs = [ pkgconfig gtk perl zip libIDL libjpeg zlib cairo bzip2 python - dbus dbus_glib pango freetype fontconfig alsaLib nspr libnotify + dbus dbus_glib pango freetype fontconfig alsaLib nspr nss libnotify xlibs.pixman yasm mesa sqlite file unzip ]; diff --git a/pkgs/applications/networking/browsers/firefox/3.6.nix b/pkgs/applications/networking/browsers/firefox/3.6.nix index 40b7959139d..c430bb7089a 100644 --- a/pkgs/applications/networking/browsers/firefox/3.6.nix +++ b/pkgs/applications/networking/browsers/firefox/3.6.nix @@ -31,7 +31,7 @@ rec { "--with-system-zlib" "--with-system-bz2" "--with-system-nspr" - #"--with-system-nss" + "--with-system-nss" # "--with-system-png" # <-- "--with-system-png won't work because the system's libpng doesn't have APNG support" "--enable-system-cairo" #"--enable-system-sqlite" # <-- this seems to be discouraged @@ -59,7 +59,7 @@ rec { [ pkgconfig gtk perl zip libIDL libjpeg libpng zlib cairo bzip2 python dbus dbus_glib pango freetype fontconfig xlibs.libXi xlibs.libX11 xlibs.libXrender xlibs.libXft xlibs.libXt file - alsaLib nspr /* nss */ libnotify xlibs.pixman + alsaLib nspr nss libnotify xlibs.pixman ]; preConfigure = if stdenv.isMips then '' @@ -118,7 +118,7 @@ rec { buildInputs = [ pkgconfig gtk perl zip libIDL libjpeg zlib cairo bzip2 python - dbus dbus_glib pango freetype fontconfig alsaLib nspr libnotify + dbus dbus_glib pango freetype fontconfig alsaLib nspr nss libnotify xlibs.pixman ]; diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix index 3b4d10eaa08..38e9d80d5b7 100644 --- a/pkgs/development/libraries/nss/default.nix +++ b/pkgs/development/libraries/nss/default.nix @@ -1,82 +1,81 @@ -{ stdenv, fetchurl, nspr, perl, zlib, includeTools ? false}: +{ stdenv, fetchurl, fetchgit, nspr, perl, zlib, sqlite +, includeTools ? false +}: let - nssConfig = fetchurl { - url = "http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo-x86/dev-libs/nss/files/3.12-nss-config.in?rev=1.2"; - sha256 = "1ck9q68fxkjq16nflixbqi4xc6bmylmj994h3f1j42g8mp0xf0vd"; + nssPEM = fetchgit { + url = "git://git.fedorahosted.org/git/nss-pem.git"; + rev = "07a683505d4a0a1113c4085c1ce117425d0afd80"; + sha256 = "e4a9396d90e50e8b3cceff45f312eda9aaf356423f4eddd354a0e1afbbfd4cf8"; }; -in - -stdenv.mkDerivation { - name = "nss-3.13.3"; - - src = fetchurl { - url = http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_13_3_RTM/src/nss-3.13.3.tar.gz; - sha256 = "efa10f2c70da4bddabf1a6081964969bb23359b93d6eadbf4739274a77bc3587"; + secLoadPatch = fetchurl { + url = "http://patch-tracker.debian.org/patch/series/dl/nss/2:3.13.5-1/85_security_load.patch"; + sha256 = "8a8d0ae4ebbd7c389973fa5d26d8bc5f473046c6cb1d8283cb9a3c1f4c565c47"; }; - buildInputs = [nspr perl zlib]; +in stdenv.mkDerivation rec { + name = "nss-${version}"; + version = "3.13.6"; - patches = [ ./nss-3.12.5-gentoo-fixups.diff ]; + src = let + uscoreVersion = stdenv.lib.replaceChars ["."] ["_"] version; + releasePath = "releases/NSS_${uscoreVersion}_RTM/src/nss-${version}.tar.gz"; + in fetchurl { + url = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/${releasePath}"; + sha256 = "f7e90727e0ecc1c29de10da39a79bc9c53b814ccfbf40720e053b29c683d43a0"; + }; - # Based on the build instructions at - # http://www.mozilla.org/projects/security/pki/nss/nss-3.11.4/nss-3.11.4-build.html + buildInputs = [ nspr perl zlib sqlite ]; + + postUnpack = '' + cp -rdv "${nssPEM}/mozilla/security/nss/lib/ckfw/pem" \ + "$sourceRoot/mozilla/security/nss/lib/ckfw/" + chmod -R u+w "$sourceRoot/mozilla/security/nss/lib/ckfw/pem" + ''; + + patches = [ + ./nss-3.12.5-gentoo-fixups.diff + secLoadPatch + ./nix_secload_fixup.patch + ]; postPatch = '' + sed -i -e 's/^DIRS.*$/& pem/' mozilla/security/nss/lib/ckfw/manifest.mn sed -i -e "/^PREFIX =/s:= /usr:= $out:" mozilla/security/nss/config/Makefile ''; preConfigure = "cd mozilla/security/nss"; - BUILD_OPT = "1"; + makeFlags = [ + "NSPR_INCLUDE_DIR=${nspr}/include/nspr" + "NSPR_LIB_DIR=${nspr}/lib" + "NSDISTMODE=copy" + "BUILD_OPT=1" + "SOURCE_PREFIX=\$(out)" + "NSS_ENABLE_ECC=1" + "NSS_USE_SYSTEM_SQLITE=1" + ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"; - makeFlags = - [ "NSPR_CONFIG_STATUS=" "NSDISTMODE=copy" "BUILD_OPT=1" "SOURCE_PREFIX=\$(out)" - "NSS_ENABLE_ECC=1" - ] - ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"; + buildFlags = [ "build_coreconf" "build_dbm" "all" ]; - buildFlags = "nss_build_all"; + postInstall = '' + rm -rf $out/private + mv $out/public $out/include + mv $out/*.OBJ/* $out/ + rmdir $out/*.OBJ - NIX_CFLAGS_COMPILE = "-I${nspr}/include/nspr"; + cp -av config/nss-config $out/bin/nss-config + ''; - preBuild = - '' - # Fool it into thinking NSPR has already been built. - touch build_nspr - - # Hack to make -lz dependencies work. - touch cmd/signtool/-lz cmd/modutil/-lz - ''; - - postInstall = - '' - #find $out -name "*.a" | xargs rm - rm -rf $out/private - mv $out/public $out/include - mv $out/*.OBJ/* $out/ - rmdir $out/*.OBJ - ${if includeTools then "" else "rm -rf $out/bin"} - - # Borrowed from Gentoo. Firefox expects an nss-config script, - # but NSS doesn't provide it. - - NSS_VMAJOR=`cat lib/nss/nss.h | grep "#define.*NSS_VMAJOR" | awk '{print $3}'` - NSS_VMINOR=`cat lib/nss/nss.h | grep "#define.*NSS_VMINOR" | awk '{print $3}'` - NSS_VPATCH=`cat lib/nss/nss.h | grep "#define.*NSS_VPATCH" | awk '{print $3}'` - - ${if includeTools then "" else "mkdir $out/bin"} - cp ${nssConfig} $out/bin/nss-config - chmod u+x $out/bin/nss-config - substituteInPlace $out/bin/nss-config \ - --subst-var-by MOD_MAJOR_VERSION $NSS_VMAJOR \ - --subst-var-by MOD_MINOR_VERSION $NSS_VMINOR \ - --subst-var-by MOD_PATCH_VERSION $NSS_VPATCH \ - --subst-var-by prefix $out \ - --subst-var-by exec_prefix $out \ - --subst-var-by includedir $out/include/nss \ - --subst-var-by libdir $out/lib - ''; # */ + postFixup = '' + for libname in freebl3 nssdbm3 softokn3 + do + libfile="$out/lib/lib$libname.so" + LD_LIBRARY_PATH=$out/lib $out/bin/shlibsign -v -i "$libfile" + done + '' + stdenv.lib.optionalString (!includeTools) '' + find $out/bin -type f \( -name nss-config -o -delete \) + ''; } diff --git a/pkgs/development/libraries/nss/nix_secload_fixup.patch b/pkgs/development/libraries/nss/nix_secload_fixup.patch new file mode 100644 index 00000000000..960fe0ef7a7 --- /dev/null +++ b/pkgs/development/libraries/nss/nix_secload_fixup.patch @@ -0,0 +1,50 @@ +diff --git a/mozilla/security/coreconf/config.mk b/mozilla/security/coreconf/config.mk +index 72557c6..bdcbf88 100644 +--- a/mozilla/security/coreconf/config.mk ++++ b/mozilla/security/coreconf/config.mk +@@ -207,3 +207,5 @@ endif + DEFINES += -DUSE_UTIL_DIRECTLY + USE_UTIL_DIRECTLY = 1 + ++# nix specific stuff: ++DEFINES += -DNIX_NSS_LIBDIR=\"$(out)/lib/\" +diff --git a/mozilla/security/nss/cmd/shlibsign/shlibsign.c b/mozilla/security/nss/cmd/shlibsign/shlibsign.c +index 5ce626e..e1e8039 100644 +--- a/mozilla/security/nss/cmd/shlibsign/shlibsign.c ++++ b/mozilla/security/nss/cmd/shlibsign/shlibsign.c +@@ -770,7 +770,7 @@ int main(int argc, char **argv) + assert(libname != NULL); + lib = PR_LoadLibrary(libname); + if (!lib) +- lib = PR_LoadLibrary("/usr/lib/nss/libsoftokn3.so"); ++ lib = PR_LoadLibrary(NIX_NSS_LIBDIR"libsoftokn3.so"); + assert(lib != NULL); + PR_FreeLibraryName(libname); + +diff --git a/mozilla/security/nss/lib/util/secload.c b/mozilla/security/nss/lib/util/secload.c +index 7d6fc22..0b7759b 100644 +--- a/mozilla/security/nss/lib/util/secload.c ++++ b/mozilla/security/nss/lib/util/secload.c +@@ -105,9 +105,9 @@ loader_LoadLibInReferenceDir(const char *referencePath, const char *name) + /* Remove the trailing filename from referencePath and add the new one */ + c = strrchr(referencePath, PR_GetDirectorySeparator()); + if (!c) { /* referencePath doesn't contain a / means that dladdr gave us argv[0] +- * and program was called from $PATH. Hack to get libs from /usr/lib */ +- referencePath = "/usr/lib/"; +- c = &referencePath[8]; /* last / */ ++ * and program was called from $PATH. Hack to get libs from NIX_NSS_LIBDIR */ ++ referencePath = NIX_NSS_LIBDIR; ++ c = &referencePath[sizeof(NIX_NSS_LIBDIR) - 1]; /* last / */ + } + if (c) { + size_t referencePathSize = 1 + c - referencePath; +@@ -125,8 +125,7 @@ loader_LoadLibInReferenceDir(const char *referencePath, const char *name) + (strncmp(fullName + referencePathSize - 4, "bin", 3) == 0)) { + memcpy(fullName + referencePathSize -4, "lib", 3); + } +- strcpy(fullName + referencePathSize, "nss/"); +- strcpy(fullName + referencePathSize + 4, name); ++ strcpy(fullName + referencePathSize, name); + dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL + #ifdef PR_LD_ALT_SEARCH_PATH + /* allow library's dependencies to be found in the same directory