;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2014 David Thompson ;;; Copyright © 2015, 2017, 2018, 2019 Ricardo Wurmus ;;; Copyright © 2016, 2017, 2018, 2019 Leo Famulari ;;; Copyright © 2016 Lukas Gradl ;;; Copyright © 2016–2021 Tobias Geerinckx-Rice ;;; Copyright © 2016, 2017 Nikita ;;; Copyright © 2016, 2017, 2019, 2020 Eric Bavier ;;; Copyright © 2017 Pierre Langlois ;;; Copyright © 2018, 2020 Efraim Flashner ;;; Copyright © 2018 Arun Isaac ;;; Copyright © 2018 Nicolas Goaziou ;;; Copyright © 2018, 2020 Nicolò Balzarotti ;;; Copyright © 2018 Tim Gesthuizen ;;; Copyright © 2019 Pierre Neidhardt ;;; Copyright © 2019 Tanguy Le Carrour ;;; Copyright © 2020 Marius Bakke ;;; Copyright © 2020 Jakub Kądziołka ;;; Copyright © 2020 Brice Waegeneire ;;; Copyright © 2020 Hendur Saga ;;; Copyright © 2020 pukkamustard ;;; ;;; This file is part of GNU Guix. ;;; ;;; GNU Guix is free software; you can redistribute it and/or modify it ;;; under the terms of the GNU General Public License as published by ;;; the Free Software Foundation; either version 3 of the License, or (at ;;; your option) any later version. ;;; ;;; GNU Guix is distributed in the hope that it will be useful, but ;;; WITHOUT ANY WARRANTY; without even the implied warranty of ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ;;; GNU General Public License for more details. ;;; ;;; You should have received a copy of the GNU General Public License ;;; along with GNU Guix. If not, see
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2018, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
;;; Copyright © 2019, 2020, 2022 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2020 Florian Pelz <pelzflorian@pelzflorian.de>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu installer)
  #:use-module (guix discovery)
  #:use-module (guix packages)
  #:use-module (guix gexp)
  #:use-module (guix modules)
  #:use-module (guix utils)
  #:use-module (guix ui)
  #:use-module ((guix self) #:select (make-config.scm))
  #:use-module (guix describe)
  #:use-module (guix channels)
  #:use-module (guix packages)
  #:use-module (guix git-download)
  #:use-module (gnu installer utils)
  #:use-module (gnu packages admin)
  #:use-module (gnu packages base)
  #:use-module (gnu packages bash)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages connman)
  #:use-module (gnu packages cryptsetup)
  #:use-module (gnu packages disk)
  #:use-module (gnu packages file-systems)
  #:use-module (gnu packages guile)
  #:use-module (gnu packages guile-xyz)
  #:autoload   (gnu packages gnupg) (guile-gcrypt)
  #:use-module (gnu packages iso-codes)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages package-management)
  #:use-module (gnu packages pciutils)
  #:use-module (gnu packages text-editors)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages xorg)
  #:use-module (gnu system locale)
  #:use-module (ice-9 match)
  #:use-module (srfi srfi-1)
  #:use-module (web uri)
  #:export (installer-program))

(define module-to-import?
  ;; Return true for modules that should be imported.  For (gnu system …) and
  ;; (gnu packages …) modules, we simply add the whole 'guix' package via
  ;; 'with-extensions' (to avoid having to rebuild it all), which is why these
  ;; modules are excluded here.
  (match-lambda
    (('guix 'config) #f)
    (('gnu 'installer _ ...) #t)
    (('gnu 'build _ ...) #t)
    (('guix 'build _ ...) #t)
    (('guix 'read-print) #t)
    (_ #f)))

(define not-config?
  ;; Select (guix …) and (gnu …) modules, except (guix config).
  (match-lambda
    (('guix 'config) #f)
    (('guix _ ...) #t)
    (('gnu _ ...) #t)
    (_ #f)))

(define* (build-compiled-file name locale-builder)
  "Return a file-like object that evaluates the gexp LOCALE-BUILDER and store
its result in the scheme file NAME. The derivation will also build a compiled
version of this file."
  (define set-utf8-locale
    #~(begin
        (setenv "LOCPATH"
                #$(file-append
                   (libc-utf8-locales-for-target) "/lib/locale/"
                   (version-major+minor
                    (package-version (libc-utf8-locales-for-target)))))
        (setlocale LC_ALL "en_US.utf8")))

  (define builder
    (with-extensions (list guile-json-3)
      (with-imported-modules `(,@(source-module-closure
                                  '((gnu installer locale))
                                  #:select? not-config?)
                               ((guix config) => ,(make-config.scm)))
        #~(begin
            (use-modules (gnu installer locale))

            ;; The locale files contain non-ASCII characters.
            #$set-utf8-locale

            (mkdir #$output)
            (let ((locale-file
                   (string-append #$output "/" #$name ".scm"))
                  (locale-compiled-file
                   (string-append #$output "/" #$name ".go")))
              (call-with-output-file locale-file
                (lambda (port)
                  (write #$locale-builder port)))
              (compile-file locale-file
                            #:output-file locale-compiled-file))))))
  (computed-file name builder))

(define apply-locale
  ;; Install the specified locale.
  (with-imported-modules (source-module-closure '((gnu services herd)))
    #~(lambda (locale)
        (false-if-exception
         (setlocale LC_ALL locale))

        ;; Restart the documentation viewer so it displays the manual in
        ;; language that corresponds to LOCALE.  Make sure that nothing is
        ;; printed on the console.
        (parameterize ((shepherd-message-port
                        (%make-void-port "w")))
          (stop-service 'term-tty2)
          (start-service 'term-tty2 (list locale))))))

(define* (compute-locale-step #:key
                              locales-name
                              iso639-languages-name
                              iso3166-territories-name)
  "Return a gexp that run the locale-page of INSTALLER, and install the
selected locale. The list of locales, languages and territories passed to
locale-page are computed in derivations named respectively LOCALES-NAME,
ISO639-LANGUAGES-NAME and ISO3166-TERRITORIES-NAME. Those lists are compiled,
so that when the installer is run, all the lengthy operations have already
been performed at build time."
  (define (compiled-file-loader file name)
    #~(load-compiled
       (string-append #$file "/" #$name ".go")))

  (let* ((supported-locales #~(supported-locales->locales
                               #+(glibc-supported-locales)))
         (iso-codes #~(string-append #$iso-codes "/share/iso-codes/json/"))
         (iso639-3 #~(string-append #$iso-codes "iso_639-3.json"))
         (iso639-5 #~(string-append #$iso-codes "iso_639-5.json"))
         (iso3166 #~(string-append #$iso-codes "iso_3166-1.json"))
         (locales-file (build-compiled-file
                        locales-name
                        #~`(quote ,#$supported-locales)))
         (iso639-file (build-compiled-file
                       iso639-languages-name
                       #~`(quote ,(iso639->iso639-languages
                                   #$supported-locales
                                   #$iso639-3 #$iso639-5))))
         (iso3166-file (build-compiled-file
                        iso3166-territories-name
                        #~`(quote ,(iso3166->iso3166-territories #$iso3166))))
         (locales-loader (compiled-file-loader locales-file
                                               locales-name))
         (iso639-loader (compiled-file-loader iso639-file
                                              iso639-languages-name))
         (iso3166-loader (compiled-file-loader iso3166-file
                                               iso3166-territories-name)))
    #~(lambda (current-installer)
        (let ((result
               ((installer-locale-page current-installer)
                #:supported-locales #$locales-loader
                #:iso639-languages #$iso639-loader
                #:iso3166-territories #$iso3166-loader)))
          (#$apply-locale result)
          result))))

(define apply-keymap
  ;; Apply the specified keymap. Use the default keyboard model.
  #~(match-lambda
      ((layout variant options)
       (kmscon-update-keymap (default-keyboard-model)
                             layout variant options))))

(define* (compute-keymap-step context)
  "Return a gexp that runs the keymap-page of INSTALLER and install the
selected keymap."
  #~(lambda (current-installer)
      (let ((result
             (call-with-values
                 (lambda ()
                   (xkb-rules->models+layouts
                    (string-append #$xkeyboard-config
                                   "/share/X11/xkb/rules/base.xml")))
               (lambda (models layouts)
                 ((installer-keymap-page current-installer)
                  layouts '#$context)))))
        (and result (#$apply-keymap result))
        result)))

(define (installer-steps)
  (let ((locale-step (compute-locale-step
                      #:locales-name "locales"
                      #:iso639-languages-name "iso639-languages"
                      #:iso3166-territories-name "iso3166-territories"))
        (timezone-data #~(string-append #$tzdata
                                        "/share/zoneinfo/zone.tab")))
    #~(lambda (current-installer)
        ((installer-parameters-menu current-installer)
         (lambda ()
           ((installer-parameters-page current-installer)
            (lambda _
              (#$(compute-keymap-step 'param)
               current-installer)))))
        (list
         ;; Ask the user to choose a locale among those supported by
         ;; the glibc.  Install the selected locale right away, so that
         ;; the user may benefit from any available translation for the
         ;; installer messages.
         (installer-step
          (id 'locale)
          (description (G_ "Locale"))
          (compute (lambda _
                     (#$locale-step current-installer)))
          (configuration-formatter locale->configuration))

         ;; Welcome the user and ask them to choose between manual
         ;; installation and graphical install.
         (installer-step
          (id 'welcome)
          (compute (lambda _
                     ((installer-welcome-page current-installer)
                      #$(local-file "installer/aux-files/logo.txt")
                      #:pci-database
                      #$(file-append pciutils "/share/hwdata/pci.ids.gz")))))

         ;; Ask the user to select a timezone under glibc format.
         (installer-step
          (id 'timezone)
          (description (G_ "Timezone"))
          (compute (lambda _
                     ((installer-timezone-page current-installer)
                      #$timezone-data)))
          (configuration-formatter posix-tz->configuration))

         ;; The installer runs in a kmscon virtual terminal where loadkeys
         ;; won't work. kmscon uses libxkbcommon as a backend for keyboard
         ;; input. It is possible to update kmscon current keymap by sending
         ;; it a keyboard model, layout, variant and options, in a somehow
         ;; similar way as what is done with setxkbmap utility.
         ;;
         ;; So ask for a keyboard model, layout and variant to update the
         ;; current kmscon keymap.  For non-Latin layouts, we add an
         ;; appropriate second layout and toggle via Alt+Shift.
         (installer-step
          (id 'keymap)
          (description (G_ "Keyboard mapping selection"))
          (compute (lambda _
                     (#$(compute-keymap-step 'default)
                      current-installer)))
          (configuration-formatter keyboard-layout->configuration))

         ;; Ask the user to input a hostname for the system.
         (installer-step
          (id 'hostname)
          (description (G_ "Hostname"))
          (compute (lambda _
                     ((installer-hostname-page current-installer))))
          (configuration-formatter hostname->configuration))

         ;; Provide an interface above connmanctl, so that the user can select
         ;; a network susceptible to acces Internet.
         (installer-step
          (id 'network)
          (description (G_ "Network selection"))
          (compute (lambda _
                     ((installer-network-page current-installer)))))

         ;; Ask whether to enable substitute server discovery.
         (installer-step
          (id 'substitutes)
          (description (G_ "Substitute server discovery"))
          (compute (lambda _
                     ((installer-substitutes-page current-installer)))))

         ;; Prompt for users (name, group and home directory).
         (installer-step
          (id 'user)
          (description (G_ "User creation"))
          (compute (lambda _
                     ((installer-user-page current-installer))))
          (configuration-formatter users->configuration))

         ;; Ask the user to choose one or many desktop environment(s).
         (installer-step
          (id 'services)
          (description (G_ "Services"))
          (compute (lambda _
                     ((installer-services-page current-installer))))
          (configuration-formatter system-services->configuration))

         ;; Run a partitioning tool allowing the user to modify
         ;; partition tables, partitions and their mount points.
         ;; Do this last so the user has something to boot if any
         ;; of the previous steps didn't go as expected.
         (installer-step
          (id 'partition)
          (description (G_ "Partitioning"))
          (compute (lambda _
                     ((installer-partition-page current-installer))))
          (configuration-formatter user-partitions->configuration))

         (installer-step
          (id 'final)
          (description (G_ "Configuration file"))
          (compute
           (lambda (result prev-steps)
             ((installer-final-page current-installer)
              result prev-steps))))))))

(define (provenance-sexp)
  "Return an sexp representing the currently-used channels, for logging
purposes."
  (match (match (current-channels)
           (() (and=> (repository->guix-channel (dirname (current-filename)))
                      list))
           (channels channels))
    (#f
     (warning (G_ "cannot determine installer provenance~%"))
     'unknown)
    ((channels ...)
     (map (lambda (channel)
            (let* ((uri (string->uri (channel-url channel)))
                   (url (if (or (not uri) (eq? 'file (uri-scheme uri)))
                            "local checkout"
                            (channel-url channel))))
             `(channel ,(channel-name channel) ,url ,(channel-commit channel))))
          channels))))

(define (installer-program)
  "Return a file-like object that runs the given INSTALLER."
  (define init-gettext
    ;; Initialize gettext support, so that installer messages can be
    ;; translated.
    #~(begin
        (bindtextdomain "guix" (string-append #$guix "/share/locale"))
        (textdomain "guix")
        (setlocale LC_ALL "")))

  (define set-installer-path
    ;; Add the specified binary to PATH for later use by the installer.
    #~(let* ((inputs
              '#$(list bash ;start subshells
                       connman ;call connmanctl
                       cryptsetup
                       dosfstools ;mkfs.fat
                       e2fsprogs ;mkfs.ext4
                       lvm2-static ;dmsetup
                       btrfs-progs
                       jfsutils ;jfs_mkfs
                       ntfs-3g ;mkfs.ntfs
                       xfsprogs ;mkfs.xfs
                       kbd ;chvt
                       util-linux ;mkwap
                       nano
                       shadow
                       tar ;dump
                       gzip ;dump
                       coreutils)))
        (with-output-to-port (%make-void-port "w")
          (lambda ()
            (set-path-environment-variable "PATH" '("bin" "sbin") inputs)))))

  (define steps (installer-steps))
  (define modules
    (scheme-modules*
     (string-append (current-source-directory) "/..")
     "gnu/installer"))

  (define installer-builder
    ;; Note: Include GUIX as an extension to get all the (gnu system …), (gnu
    ;; packages …), etc. modules.
    (with-extensions (list guile-gcrypt guile-newt
                           guile-parted guile-bytestructures
                           guile-json-3 guile-git guile-webutils
                           guile-gnutls
                           guile-zlib           ;for (gnu build linux-modules)
                           guile-zstd           ;for (gnu build linux-modules)
                           (current-guix))
      (with-imported-modules `(,@(source-module-closure
                                  `(,@modules
                                    (gnu services herd)
                                    (guix build utils))
                                  #:select? module-to-import?)
                               ((guix config) => ,(make-config.scm)))
        #~(begin
            (use-modules (gnu installer record)
                         (gnu installer keymap)
                         (gnu installer steps)
                         (gnu installer dump)
                         (gnu installer final)
                         (gnu installer hostname)
                         (gnu installer locale)
                         (gnu installer parted)
                         (gnu installer services)
                         (gnu installer timezone)
                         (gnu installer user)
                         (gnu installer utils)
                         (gnu installer newt)
                         ((gnu installer newt keymap)
                          #:select (keyboard-layout->configuration))
                         (gnu services herd)
                         (guix i18n)
                         (guix build utils)
                         ((system repl debug)
                          #:select (terminal-width))
                         (ice-9 match)
                         (ice-9 textual-ports))

            ;; Enable core dump generation.
            (setrlimit 'core #f #f)
            (call-with-output-file "/proc/sys/kernel/core_pattern"
              (lambda (port)
                (format port %core-dump)))

            ;; Initialize gettext support so that installers can use
            ;; (guix i18n) module.
            #$init-gettext

            ;; Add some binaries used by the installers to PATH.
            #$set-installer-path

            ;; Arrange for language and territory name translations to be
            ;; available.  We need them at run time, not just compile time,
            ;; because some territories have several corresponding languages
            ;; (e.g., "French" is always displayed as "français", but
            ;; "Belgium" could be translated to Dutch, French, or German.)
            (bindtextdomain "iso_639-3"           ;languages
                            #+(file-append iso-codes "/share/locale"))
            (bindtextdomain "iso_3166-1"          ;territories
                            #+(file-append iso-codes "/share/locale"))

            ;; Likewise for XKB keyboard layout names.
            (bindtextdomain "xkeyboard-config"
                            #+(file-append xkeyboard-config "/share/locale"))

            ;; Initialize 'terminal-width' in (system repl debug)
            ;; to a large-enough value to make backtrace more
            ;; verbose.
            (terminal-width 200)

            (define current-installer newt-installer)
            (define steps (#$steps current-installer))

            (installer-log-line "installer provenance: ~s"
                                '#$(provenance-sexp))

            (dynamic-wind
              (installer-init current-installer)
              (lambda ()
                (parameterize
                    ((run-command-in-installer
                      (installer-run-command current-installer)))
                  (catch #t
                    (lambda ()
                      (define results
                        (run-installer-steps
                         #:rewind-strategy 'menu
                         #:menu-proc (installer-menu-page current-installer)
                         #:steps steps))

                      (match (result-step results 'final)
                        ('success
                         ;; We did it!  Let's reboot!
                         (sync)
                         (stop-service 'root))
                        (_
                         ;; The installation failed, exit so that it is
                         ;; restarted by login.
                         #f)))
                    (const #f)
                    (lambda (key . args)
                      (installer-log-line "crashing due to uncaught exception: ~s ~s"
                                          key args)
                      (define dump-dir
                        (prepare-dump key args #:result %current-result))

                      (define user-abort?
                        (match args
                          (((? user-abort-error? obj)) #t)
                          (_ #f)))

                      (define action
                        (if user-abort?
                            'dump
                            ((installer-exit-error current-installer)
                             (get-string-all
                              (open-input-file
                               (string-append dump-dir
                                              "/installer-backtrace"))))))

                      (match action
                        ('dump
                         (let* ((dump-files
                                 ((installer-dump-page current-installer)
                                  dump-dir))
                                (dump-archive
                                 (make-dump dump-dir dump-files)))
                           ((installer-report-page current-installer)
                            dump-archive)))
                        (_ #f))
                      (exit 1)))))

              (installer-exit current-installer))))))

  (program-file
   "installer"
   #~(begin
       ;; Set the default locale to install unicode support.  For
       ;; some reason, unicode support is not correctly installed
       ;; when calling this in 'installer-builder'.
       (setenv "LANG" "en_US.UTF-8")
       (execl #$(program-file "installer-real" installer-builder
                              #:guile guile-3.0-latest)
              "installer-real"))))
generated by cgit
ames. The results are uniformly distributed, unbiased, and unpredictable unless you know the seed. This package implements the same interface as @code{Math::Random::ISAAC}.") (license license:public-domain))) (define-public perl-math-random-isaac (package (name "perl-math-random-isaac") (version "1.004") (source (origin (method url-fetch) (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/" "Math-Random-ISAAC-" version ".tar.gz")) (sha256 (base32 "0z1b3xbb3xz71h25fg6jgsccra7migq7s0vawx2rfzi0pwpz0wr7")))) (build-system perl-build-system) (native-inputs `(("perl-test-nowarnings" ,perl-test-nowarnings))) (propagated-inputs `(("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs))) (home-page "https://metacpan.org/release/Math-Random-ISAAC") (synopsis "Perl interface to the ISAAC PRNG algorithm") (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a fast pseudo-random number generator. It is suitable for applications where a significant amount of random data needs to be produced quickly, such as solving using the Monte Carlo method or for games. The results are uniformly distributed, unbiased, and unpredictable unless you know the seed. This package provides a Perl interface to the ISAAC pseudo random number generator.") (license license:public-domain))) (define-public perl-crypt-random-source (package (name "perl-crypt-random-source") (version "0.14") (source (origin (method url-fetch) (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/" "Crypt-Random-Source-" version ".tar.gz")) (sha256 (base32 "1rpdds3sy5l1fhngnkrsgwsmwd54wpicx3i9ds69blcskwkcwkpc")))) (build-system perl-build-system) (native-inputs `(("perl-module-build-tiny" ,perl-module-build-tiny) ("perl-test-fatal" ,perl-test-fatal))) (propagated-inputs `(("perl-capture-tiny" ,perl-capture-tiny) ("perl-module-find" ,perl-module-find) ("perl-module-runtime" ,perl-module-runtime) ("perl-moo" ,perl-moo) ("perl-namespace-clean" ,perl-namespace-clean) ("perl-sub-exporter" ,perl-sub-exporter) ("perl-type-tiny" ,perl-type-tiny))) (home-page "https://metacpan.org/release/Crypt-Random-Source") (synopsis "Get weak or strong random data from pluggable sources") (description "This module provides implementations for a number of byte-oriented sources of random data.") (license license:perl-license))) (define-public perl-math-random-secure (package (name "perl-math-random-secure") (version "0.080001") (source (origin (method url-fetch) (uri (string-append "mirror://cpan/authors/id/F/FR/FREW/" "Math-Random-Secure-" version ".tar.gz")) (sha256 (base32 "0dgbf4ncll4kmgkyb9fsaxn0vf2smc9dmwqzgh3259zc2zla995z")))) (build-system perl-build-system) (native-inputs `(("perl-list-moreutils" ,perl-list-moreutils) ("perl-test-leaktrace" ,perl-test-leaktrace) ("perl-test-sharedfork" ,perl-test-sharedfork) ("perl-test-warn" ,perl-test-warn))) (inputs `(("perl-crypt-random-source" ,perl-crypt-random-source) ("perl-math-random-isaac" ,perl-math-random-isaac) ("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs) ("perl-moo" ,perl-moo))) (home-page "https://metacpan.org/release/Math-Random-Secure") (synopsis "Cryptographically secure replacement for rand()") (description "This module is intended to provide a cryptographically-secure replacement for Perl's built-in @code{rand} function. \"Crytographically secure\", in this case, means: @enumerate @item No matter how many numbers you see generated by the random number generator, you cannot guess the future numbers, and you cannot guess the seed. @item There are so many possible seeds that it would take decades, centuries, or millennia for an attacker to try them all. @item The seed comes from a source that generates relatively strong random data on your platform, so the seed itself will be as random as possible. @end enumerate\n") (license license:artistic2.0))) (define-public crypto++ (package (name "crypto++") (version "8.4.0") (source (origin (method url-fetch/zipbomb) (uri (string-append "https://cryptopp.com/cryptopp" (string-join (string-split version #\.) "") ".zip")) (sha256 (base32 "16kvfm11xv7j9a3yykzysjgw38a9b7lnc5n5x5h82g395k6ybxf0")))) (build-system gnu-build-system) (arguments `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")) ;; Override "/sbin/ldconfig" with simply "echo" since ;; we don't need ldconfig(8). "LDCONF=echo") #:phases (modify-phases %standard-phases (add-after 'unpack 'disable-native-optimisation ;; This package installs more than just headers. Ensure that the ;; cryptest.exe binary & static library aren't CPU model specific. (lambda _ (substitute* "GNUmakefile" ((" -march=native") "")) #t)) (delete 'configure) (replace 'build ;; By default, only the static library is built. (lambda* (#:key (make-flags '()) #:allow-other-keys) (apply invoke "make" "shared" "-j" (number->string (parallel-job-count)) make-flags))) (add-after 'install 'install-shared-library-links ;; By default, only .so and .so.x.y.z are installed. ;; Create all the ‘intermediates’ expected by dependent packages. (lambda* (#:key outputs #:allow-other-keys) (let* ((out (assoc-ref outputs "out")) (lib (string-append out "/lib")) (prefix "libcryptopp.so.") (target (string-append prefix ,version))) (with-directory-excursion lib (symlink target (string-append prefix ,(version-major+minor version))) (symlink target (string-append prefix ,(version-major version))) #t)))) (add-after 'install 'install-pkg-config (lambda* (#:key outputs #:allow-other-keys) (let* ((out (assoc-ref outputs "out")) (pkg-dir (string-append out "/lib/pkgconfig"))) (mkdir-p pkg-dir) (with-output-to-file (string-append pkg-dir "/libcrypto++.pc") (lambda _ (display (string-append "prefix=" out "\n" "libdir=" out "/lib\n" "includedir=" out "/include\n\n" "Name: libcrypto++-" ,version "\n" "Description: Class library of cryptographic schemes\n" "Version: " ,version "\n" "Libs: -L${libdir} -lcryptopp\n" "Cflags: -I${includedir}\n")) #t)))))))) (native-inputs `(("unzip" ,unzip))) (home-page "https://cryptopp.com/") (synopsis "C++ class library of cryptographic schemes") (description "Crypto++ is a C++ class library of cryptographic schemes.") ;; The compilation is distributed under the Boost license; the individual ;; files in the compilation are in the public domain. (license (list license:boost1.0 license:public-domain)))) (define-public libb2 (package (name "libb2") (version "0.98.1") (source (origin (method url-fetch) (uri (string-append "https://github.com/BLAKE2/libb2/releases/download/v" version "/libb2-" version ".tar.gz")) (sha256 (base32 "0bn7yrzdixdvzm46shbhpkqbr6zyqyxiqn7a7x54ag3mrvfnyqjk")))) (build-system gnu-build-system) (arguments `(#:configure-flags (list ,@(if (any (cute string-prefix? <> (or (%current-system) (%current-target-system))) '("x86_64" "i686")) ;; fat only checks for Intel optimisations '("--enable-fat") '()) "--disable-native"))) ;don't optimise at build time (home-page "https://blake2.net/") (synopsis "Library implementing the BLAKE2 family of hash functions") (description "libb2 is a portable implementation of the BLAKE2 family of cryptographic hash functions. It includes optimised implementations for IA-32 and AMD64 processors, and an interface layer that automatically selects the best implementation for the processor it is run on. @dfn{BLAKE2} (RFC 7693) is a family of high-speed cryptographic hash functions that are faster than MD5, SHA-1, SHA-2, and SHA-3, yet are at least as secure as the latest standard, SHA-3. It is an improved version of the SHA-3 finalist BLAKE.") (license license:public-domain))) (define-public rhash (package (name "rhash") (version "1.3.9") (source (origin (method url-fetch) (uri (string-append "mirror://sourceforge/rhash/rhash/" version "/rhash-" version "-src.tar.gz")) (file-name (string-append "rhash-" version ".tar.gz")) (sha256 (base32 "1xn9fqa6rlnhsbgami45g82dlw9i1skg2sri3ydiinwak5ph1ca2")))) (build-system gnu-build-system) (arguments `(#:configure-flags (list (string-append "--prefix=" (assoc-ref %outputs "out")) ,@(let ((target (%current-target-system))) (if target `((string-append "--target=" ,target) (string-append "--cc=" (assoc-ref %build-inputs "cross-gcc") "/bin/" ,target "-gcc")) '()))) #:make-flags ;; The binaries in /bin need some help finding librhash.so.0. (list (string-append "LDFLAGS=-Wl,-rpath=" %output "/lib")) #:test-target "test" ; ‘make check’ just checks the sources #:phases (modify-phases %standard-phases (replace 'configure ;; ./configure is not GNU autotools' and doesn't gracefully handle ;; unrecognized options, so we must call it manually. (lambda* (#:key configure-flags #:allow-other-keys) (apply invoke "./configure" configure-flags))) (add-before 'check 'patch-/bin/sh (lambda _ (substitute* "Makefile" (("/bin/sh") (which "sh"))) #t)) (add-after 'install 'install-library-extras (lambda* (#:key make-flags #:allow-other-keys) (apply invoke "make" "-C" "librhash" "install-lib-headers" "install-so-link" make-flags)))))) (home-page "https://sourceforge.net/projects/rhash/") (synopsis "Utility for computing hash sums") (description "RHash is a console utility for calculation and verification of magnet links and a wide range of hash sums like CRC32, MD4, MD5, SHA1, SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R 34.11-94, RIPEMD-160, HAS-160, EDON-R, Whirlpool and Snefru.") (license (license:non-copyleft "file://COPYING")))) (define-public botan (package (name "botan") (version "2.12.1") (source (origin (method url-fetch) (uri (string-append "https://botan.randombit.net/releases/" "Botan-" version ".tar.xz")) (sha256 (base32 "1ada3ga7b0z4m0vjmxlvfi4nsic2l8kjcy85jwss3z2i58a5y0vy")))) (build-system gnu-build-system) (arguments '(#:phases (modify-phases %standard-phases (replace 'configure (lambda* (#:key inputs outputs #:allow-other-keys) (let* ((out (assoc-ref %outputs "out")) (lib (string-append out "/lib"))) ;; Upstream tests and benchmarks with -O3. (setenv "CXXFLAGS" "-O3") (invoke "python" "./configure.py" (string-append "--prefix=" out) ;; Otherwise, the `botan` executable cannot find ;; libbotan. (string-append "--ldflags=-Wl,-rpath=" lib) "--with-os-feature=getentropy" "--with-rst2man" ;; Recommended by upstream "--with-zlib" "--with-bzip2" "--with-sqlite3")))) (replace 'check (lambda _ (invoke "./botan-test")))))) (native-inputs `(("python" ,python-wrapper) ("python-docutils" ,python-docutils))) (inputs `(("sqlite" ,sqlite) ("bzip2" ,bzip2) ("zlib" ,zlib))) (synopsis "Cryptographic library in C++11") (description "Botan is a cryptography library, written in C++11, offering the tools necessary to implement a range of practical systems, such as TLS/DTLS, PKIX certificate handling, PKCS#11 and TPM hardware support, password hashing, and post-quantum crypto schemes. In addition to the C++, botan has a C89 API specifically designed to be easy to call from other languages. A Python binding using ctypes is included, and several other language bindings are available.") (home-page "https://botan.randombit.net") (license license:bsd-2))) (define-public ccrypt (package (name "ccrypt") (version "1.11") (source (origin (method url-fetch) (uri (string-append "mirror://sourceforge/ccrypt/" version "/ccrypt-" version ".tar.gz")) (sha256 (base32 "0kx4a5mhmp73ljknl2lcccmw9z3f5y8lqw0ghaymzvln1984g75i")))) (build-system gnu-build-system) (home-page "http://ccrypt.sourceforge.net") (synopsis "Command-line utility for encrypting and decrypting files and streams") (description "@command{ccrypt} is a utility for encrypting and decrypting files and streams. It was designed as a replacement for the standard unix @command{crypt} utility, which is notorious for using a very weak encryption algorithm. @command{ccrypt} is based on the Rijndael block cipher, a version of which is also used in the Advanced Encryption Standard (AES, see @url{http://www.nist.gov/aes}). This cipher is believed to provide very strong security.") (license license:gpl2))) (define-public asignify (let ((commit "f58e7977a599f040797975d649ed318e25cbd2d5") (revision "0")) (package (name "asignify") (version (git-version "1.1" revision commit)) (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/vstakhov/asignify") (commit commit))) (file-name (git-file-name name version)) (sha256 (base32 "1zl68qq6js6fdahxzyhvhrpyrwlv8c2zhdplycnfxyr1ckkhq8dw")))) (build-system gnu-build-system) (arguments `(#:configure-flags (list "--enable-openssl" (string-append "--with-openssl=" (assoc-ref %build-inputs "openssl"))))) (native-inputs `(("autoconf" ,autoconf) ("automake" ,automake) ("libtool" ,libtool))) (inputs `(("openssl" ,openssl))) (home-page "https://github.com/vstakhov/asignify") (synopsis "Cryptographic authentication and encryption tool and library") (description "Asignify offers public cryptographic signatures and encryption with a library or a command-line tool. The tool is heavily inspired by signify as used in OpenBSD. The main goal of this project is to define a high level API for signing files, validating signatures and encrypting using public-key cryptography. Asignify is designed to be portable and self-contained with zero external dependencies. Asignify can verify OpenBSD signatures, but it cannot sign messages in OpenBSD format yet.") (license license:bsd-2)))) (define-public enchive (package (name "enchive") (version "3.5") (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/skeeto/enchive") (commit version))) (sha256 (base32 "0fdrfc5l42lj2bvmv9dmkmhmm7qiszwk7cmdvnqad3fs7652g0qa")) (file-name (git-file-name name version)))) (build-system gnu-build-system) (arguments '(#:tests? #f ; no check target ' #:make-flags (list "CC=gcc" "PREFIX=$(out)") #:phases (modify-phases %standard-phases (delete 'configure) (add-after 'install 'post-install (lambda _ (let* ((out (assoc-ref %outputs "out")) (lisp (string-append out "/share/emacs/site-lisp"))) (install-file "enchive-mode.el" lisp) #t)))))) (synopsis "Encrypted personal archives") (description "Enchive is a tool to encrypt files to yourself for long-term archival. It's a focused, simple alternative to more complex solutions such as GnuPG or encrypted filesystems. Enchive has no external dependencies and is trivial to build for local use. Portability is emphasized over performance.") (home-page "https://github.com/skeeto/enchive") (license license:unlicense))) (define-public libsecp256k1 (let ((commit "dbd41db16a0e91b2566820898a3ab2d7dad4fe00")) (package (name "libsecp256k1") (version (git-version "20200615" "1" commit)) (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/bitcoin-core/secp256k1") (commit commit))) (sha256 (base32 "1fcpnksq5cqwqzshn5f0lq94b73p3frwbp04hgmmbnrndpqg6mpy")) (file-name (git-file-name name version)))) (build-system gnu-build-system) (arguments '(#:configure-flags '("--enable-module-recovery" "--enable-experimental" "--enable-module-ecdh" "--enable-shared"))) (native-inputs `(("autoconf" ,autoconf) ("automake" ,automake) ("libtool" ,libtool))) ;; WARNING: This package might need additional configure flags to run properly. ;; See https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/libsecp256k1. (synopsis "C library for EC operations on curve secp256k1") (description "Optimized C library for EC operations on curve secp256k1. This library is a work in progress and is being used to research best practices. Use at your own risk. Features: @itemize @item secp256k1 ECDSA signing/verification and key generation. @item Adding/multiplying private/public keys. @item Serialization/parsing of private keys, public keys, signatures. @item Constant time, constant memory access signing and pubkey generation. @item Derandomized DSA (via RFC6979 or with a caller provided function.) @item Very efficient implementation. @end itemize\n") (home-page "https://github.com/bitcoin-core/secp256k1") (license license:unlicense)))) (define-public libsecp256k1-bitcoin-cash (package (name "libsecp256k1-bitcoin-cash") (version "0.22.1") (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/Bitcoin-ABC/secp256k1") (commit (string-append "v" version)))) (file-name (git-file-name name version)) (sha256 (base32 "1rnif3iny6pz1r3g69bagzr342mm3x0v66b60csnmm1rg44bd5v1")))) (build-system gnu-build-system) (native-inputs `(("autoconf" ,autoconf) ("automake" ,automake) ("libtool" ,libtool))) (arguments '(#:configure-flags '("--enable-module-recovery" "--enable-experimental" "--enable-module-ecdh" "--disable-jni" "--with-bignum=no" "--enable-module-schnorr" "--disable-static" "--enable-shared"))) (synopsis "Optimized C library for EC operations on curve secp256k1") (description "Optimized C library for cryptographic operations on curve secp256k1. This library is used for consensus critical cryptographic operations on the Bitcoin Cash network. Features: @itemize @item secp256k1 ECDSA signing/verification and key generation. @item secp256k1 Schnorr signing/verification (Bitcoin Cash Schnorr variant). @item Additive and multiplicative tweaking of secret/public keys. @item Serialization/parsing of secret keys, public keys, signatures. @item Constant time, constant memory access signing and pubkey generation. @item Derandomized ECDSA (via RFC6979 or with a caller provided function). @item Very efficient implementation. @item Suitable for embedded systems. @item Optional module for public key recovery. @item Optional module for ECDH key exchange (experimental). @item Optional module for multiset hash (experimental). @end itemize\n") (home-page "https://github.com/Bitcoin-ABC/secp256k1") (license license:expat))) (define-public stoken (package (name "stoken") (version "0.92") (source (origin (method url-fetch) (uri (string-append "mirror://sourceforge/stoken/" "stoken-" version ".tar.gz")) (sha256 (base32 "0npgr6y85gzwksy8jkwa4yzvqwjprwnplx3yiw3ayk4f0ldlhaxa")))) (build-system gnu-build-system) (native-inputs `(("pkg-config" ,pkg-config))) (inputs `(("nettle" ,nettle) ("libxml2" ,libxml2))) (home-page "http://stoken.sf.net") (synopsis "Software Token for cryptographic authentication") (description "@code{stoken} is a token code generator compatible with RSA SecurID 128-bit (AES) tokens. This package contains a standalone command-line program that allows for importing token seeds, generating token codes, and various utility/testing functions.") (license license:lgpl2.1+))) (define-public hpenc (package (name "hpenc") (version "3.0") (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/vstakhov/hpenc") (commit version))) (file-name (git-file-name name version)) (sha256 (base32 "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1")))) (build-system gnu-build-system) (arguments `(#:tests? #f ; No test suite #:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")) ;; Build the program and the docs. "SUBDIRS=src doc") #:phases (modify-phases %standard-phases (delete 'configure) ; No ./configure script (add-after 'unpack 'patch-path (lambda _ (substitute* '("src/Makefile" "doc/Makefile") (("/usr/bin/install") "install")))) (add-before 'install 'make-output-directories (lambda* (#:key outputs #:allow-other-keys) (let* ((out (assoc-ref outputs "out")) (bin (string-append out "/bin")) (man1 (string-append out "/share/man/man1"))) (mkdir-p bin) (mkdir-p man1) #t)))))) (inputs `(("libsodium" ,libsodium) ("openssl" ,openssl))) (synopsis "High-performance command-line tool for stream encryption") (description "Hpenc is a command-line tool for performing authenticated encryption (AES-GCM and ChaCha20-Poly1305) of streaming data. It does not perform an asymmetric key exchange, instead requiring the user to distribute pre-shared keys out of band. It is designed to handle large amounts of data quickly by using all your CPU cores and hardware acceleration.") (home-page "https://github.com/vstakhov/hpenc") (license license:bsd-3))) (define-public minisign (package (name "minisign") (version "0.9") (source (origin (method url-fetch) (uri (string-append "https://github.com/jedisct1/minisign/releases/download/" version "/minisign-" version ".tar.gz")) (sha256 (base32 "1h9cfvvm6lqq33b2wdar1x3w4k7zyrscavllyb0l5dmcdabq60r2")))) (build-system cmake-build-system) (arguments ; No test suite `(#:tests? #f)) (native-inputs `(("pkg-config" ,pkg-config))) (inputs `(("libsodium" ,libsodium))) (home-page "https://jedisct1.github.io/minisign") (synopsis "Tool to sign files and verify signatures") (description "Minisign is a dead simple tool to sign files and verify signatures. It is portable, lightweight, and uses the highly secure Ed25519 public-key signature system. Signature written by minisign can be verified using OpenBSD's signify tool: public key files and signature files are compatible. However, minisign uses a slightly different format to store secret keys. Minisign signatures include trusted comments in addition to untrusted comments. Trusted comments are signed, thus verified, before being displayed.") (license license:isc))) (define-public libolm (package (name "libolm") (version "3.2.1") (source (origin (method git-fetch) (uri (git-reference (url "https://git.matrix.org/git/olm") (commit version))) (sha256 (base32 "14b5cplcnbf2baq0lvz4f97m6swxpb13rvxdajxyw3s4mbvasia4")) (file-name (git-file-name name version)))) (build-system cmake-build-system) (arguments `(#:phases (modify-phases %standard-phases (replace 'check (lambda _ (with-directory-excursion "tests" (invoke "ctest" "."))))))) (synopsis "Implementation of the olm and megolm cryptographic ratchets") (description "The libolm library implements the Double Ratchet cryptographic ratchet. It is written in C and C++11, and exposed as a C API.") (home-page "https://matrix.org/docs/projects/other/olm/") (license license:asl2.0))) (define-public hash-extender (let ((commit "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d") (revision "2")) (package (name "hash-extender") (version (git-version "0.0" revision commit)) (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/iagox86/hash_extender") (commit commit))) (sha256 (base32 "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b")) (file-name (git-file-name name version)))) (build-system gnu-build-system) (arguments `(#:phases (modify-phases %standard-phases (delete 'configure) (replace 'check (lambda _ (invoke "./hash_extender_test"))) (replace 'install (lambda* (#:key outputs #:allow-other-keys) (let* ((outdir (assoc-ref outputs "out")) (bindir (string-append outdir "/bin")) (docdir (string-append outdir "/share/doc/hash-extender-" ,version))) (install-file "hash_extender" bindir) (install-file "README.md" docdir) #t)))))) (inputs `(("openssl" ,openssl))) (synopsis "Tool for hash length extension attacks") (description "@command{hash_extender} is a utility for performing hash length extension attacks supporting MD4, MD5, RIPEMD-160, SHA-0, SHA-1, SHA-256, SHA-512, and WHIRLPOOL hashes.") (home-page "https://github.com/iagox86/hash_extender") (license license:bsd-3)))) (define-public mkp224o (package (name "mkp224o") (version "1.5.0") (source (origin (method git-fetch) (uri (git-reference (url "https://github.com/cathugger/mkp224o") (commit (string-append "v" version)))) (sha256 (base32 "0b2cn96wg4l8jkkqqp8l2295xlmm2jc8nrw6rdqb5g0zkpfmrxbb")) (file-name (git-file-name name version)))) (build-system gnu-build-system) (arguments `(#:tests? #f ; no test suite #:phases (modify-phases %standard-phases (replace 'install (lambda* (#:key outputs #:allow-other-keys) (let* ((outdir (assoc-ref outputs "out")) (bindir (string-append outdir "/bin"))) (install-file "mkp224o" bindir) #t)))))) (native-inputs `(("autoconf" ,autoconf))) (inputs `(("libsodium" ,libsodium))) (synopsis "Tor hidden service v3 name generator") (description "@code{mkp224o} generates valid ed25519 (hidden service version 3) onion addresses. It allows one to produce customized vanity .onion addresses using a brute-force method.") (home-page "https://github.com/cathugger/mkp224o") (license license:cc0)))