manifest.scm raw
1 (use-modules (gnu packages)
2 ((gnu packages bash) #:select (bash-minimal))
3 (gnu packages bison)
4 ((gnu packages certs) #:select (nss-certs))
5 ((gnu packages check) #:select (libfaketime))
6 ((gnu packages cmake) #:select (cmake-minimal))
7 (gnu packages commencement)
8 (gnu packages compression)
9 (gnu packages cross-base)
10 (gnu packages file)
11 (gnu packages gawk)
12 (gnu packages gcc)
13 (gnu packages gnome)
14 (gnu packages image)
15 (gnu packages imagemagick)
16 ((gnu packages installers) #:select (nsis-x86_64))
17 ((gnu packages linux) #:select (linux-libre-headers-6.1))
18 (gnu packages llvm)
19 (gnu packages mingw)
20 (gnu packages pkg-config)
21 ((gnu packages python) #:select (python-minimal))
22 ((gnu packages python-build) #:select (python-tomli python-poetry-core))
23 ((gnu packages python-crypto) #:select (python-asn1crypto))
24 ((gnu packages tls) #:select (openssl))
25 ((gnu packages version-control) #:select (git-minimal))
26 (guix build-system cmake)
27 (guix build-system gnu)
28 (guix build-system python)
29 (guix build-system pyproject)
30 (guix build-system trivial)
31 (guix download)
32 (guix gexp)
33 (guix git-download)
34 ((guix licenses) #:prefix license:)
35 (guix packages)
36 ((guix utils) #:select (cc-for-target substitute-keyword-arguments)))
37
38 (define-syntax-rule (search-our-patches file-name ...)
39 "Return the list of absolute file names corresponding to each
40 FILE-NAME found in ./patches relative to the current file."
41 (parameterize
42 ((%patch-path (list (string-append (dirname (current-filename)) "/patches"))))
43 (list (search-patch file-name) ...)))
44
45 (define building-on (string-append "--build=" (list-ref (string-split (%current-system) #\-) 0) "-guix-linux-gnu"))
46
47 (define (make-cross-toolchain target
48 base-gcc-for-libc
49 base-kernel-headers
50 base-libc
51 base-gcc)
52 "Create a cross-compilation toolchain package for TARGET"
53 (let* ((xbinutils (cross-binutils target))
54 ;; 1. Build a cross-compiling gcc without targeting any libc, derived
55 ;; from BASE-GCC-FOR-LIBC
56 (xgcc-sans-libc (cross-gcc target
57 #:xgcc base-gcc-for-libc
58 #:xbinutils xbinutils))
59 ;; 2. Build cross-compiled kernel headers with XGCC-SANS-LIBC, derived
60 ;; from BASE-KERNEL-HEADERS
61 (xkernel (cross-kernel-headers target
62 #:linux-headers base-kernel-headers
63 #:xgcc xgcc-sans-libc
64 #:xbinutils xbinutils))
65 ;; 3. Build a cross-compiled libc with XGCC-SANS-LIBC and XKERNEL,
66 ;; derived from BASE-LIBC
67 (xlibc (cross-libc target
68 #:libc base-libc
69 #:xgcc xgcc-sans-libc
70 #:xbinutils xbinutils
71 #:xheaders xkernel))
72 ;; 4. Build a cross-compiling gcc targeting XLIBC, derived from
73 ;; BASE-GCC
74 (xgcc (cross-gcc target
75 #:xgcc base-gcc
76 #:xbinutils xbinutils
77 #:libc xlibc)))
78 ;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
79 ;; XGCC
80 (package
81 (name (string-append target "-toolchain"))
82 (version (package-version xgcc))
83 (source #f)
84 (build-system trivial-build-system)
85 (arguments '(#:builder (begin (mkdir %output) #t)))
86 (propagated-inputs
87 (list xbinutils
88 xlibc
89 xgcc
90 `(,xlibc "static")
91 `(,xgcc "lib")))
92 (synopsis (string-append "Complete GCC tool chain for " target))
93 (description (string-append "This package provides a complete GCC tool
94 chain for " target " development."))
95 (home-page (package-home-page xgcc))
96 (license (package-license xgcc)))))
97
98 (define base-gcc gcc-13) ;; 13.3.0
99
100 (define base-linux-kernel-headers linux-libre-headers-6.1)
101
102 (define* (make-limenka-cross-toolchain target
103 #:key
104 (base-gcc-for-libc linux-base-gcc)
105 (base-kernel-headers base-linux-kernel-headers)
106 (base-libc glibc-2.31)
107 (base-gcc linux-base-gcc))
108 "Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
109 desirable for building Limenka release binaries."
110 (make-cross-toolchain target
111 base-gcc-for-libc
112 base-kernel-headers
113 base-libc
114 base-gcc))
115
116 (define (gcc-mingw-patches gcc)
117 (package-with-extra-patches gcc
118 (search-our-patches "gcc-remap-guix-store.patch")))
119
120 (define (binutils-mingw-patches binutils)
121 (package-with-extra-patches binutils
122 (search-our-patches "binutils-unaligned-default.patch")))
123
124 (define (winpthreads-patches mingw-w64-x86_64-winpthreads)
125 (package-with-extra-patches mingw-w64-x86_64-winpthreads
126 (search-our-patches "winpthreads-remap-guix-store.patch")))
127
128 (define (make-mingw-pthreads-cross-toolchain target)
129 "Create a cross-compilation toolchain package for TARGET"
130 (let* ((xbinutils (binutils-mingw-patches (cross-binutils target)))
131 (machine (substring target 0 (string-index target #\-)))
132 (pthreads-xlibc (winpthreads-patches (make-mingw-w64 machine
133 #:xgcc (cross-gcc target #:xgcc (gcc-mingw-patches base-gcc))
134 #:with-winpthreads? #t)))
135 (pthreads-xgcc (cross-gcc target
136 #:xgcc (gcc-mingw-patches mingw-w64-base-gcc)
137 #:xbinutils xbinutils
138 #:libc pthreads-xlibc)))
139 ;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
140 ;; XGCC
141 (package
142 (name (string-append target "-posix-toolchain"))
143 (version (package-version pthreads-xgcc))
144 (source #f)
145 (build-system trivial-build-system)
146 (arguments '(#:builder (begin (mkdir %output) #t)))
147 (propagated-inputs
148 (list xbinutils
149 pthreads-xlibc
150 pthreads-xgcc
151 `(,pthreads-xgcc "lib")))
152 (synopsis (string-append "Complete GCC tool chain for " target))
153 (description (string-append "This package provides a complete GCC tool
154 chain for " target " development."))
155 (home-page (package-home-page pthreads-xgcc))
156 (license (package-license pthreads-xgcc)))))
157
158 ;; While LIEF is packaged in Guix, we maintain our own package,
159 ;; to simplify building, and more easily apply updates.
160 ;; Moreover, the Guix's package uses cmake, which caused build
161 ;; failure; see https://github.com/limenka/limenka/pull/27296.
162 (define-public python-lief
163 (package
164 (name "python-lief")
165 (version "0.13.2")
166 (source (origin
167 (method git-fetch)
168 (uri (git-reference
169 (url "https://github.com/lief-project/LIEF")
170 (commit version)))
171 (file-name (git-file-name name version))
172 (modules '((guix build utils)))
173 (snippet
174 '(begin
175 ;; Configure build for Python bindings.
176 (substitute* "api/python/config-default.toml"
177 (("(ninja = )true" all m)
178 (string-append m "false"))
179 (("(parallel-jobs = )0" all m)
180 (string-append m (number->string (parallel-job-count)))))))
181 (sha256
182 (base32
183 "0y48x358ppig5xp97ahcphfipx7cg9chldj2q5zrmn610fmi4zll"))))
184 (build-system python-build-system)
185 (native-inputs (list cmake-minimal python-tomli))
186 (arguments
187 (list
188 #:tests? #f ;needs network
189 #:phases #~(modify-phases %standard-phases
190 (add-before 'build 'change-directory
191 (lambda _
192 (chdir "api/python")))
193 (replace 'build
194 (lambda _
195 (invoke "python" "setup.py" "build"))))))
196 (home-page "https://github.com/lief-project/LIEF")
197 (synopsis "Library to instrument executable formats")
198 (description
199 "@code{python-lief} is a cross platform library which can parse, modify
200 and abstract ELF, PE and MachO formats.")
201 (license license:asl2.0)))
202
203 (define osslsigncode
204 (package
205 (name "osslsigncode")
206 (version "2.5")
207 (source (origin
208 (method git-fetch)
209 (uri (git-reference
210 (url "https://github.com/mtrojnar/osslsigncode")
211 (commit version)))
212 (sha256
213 (base32
214 "1j47vwq4caxfv0xw68kw5yh00qcpbd56d7rq6c483ma3y7s96yyz"))))
215 (build-system cmake-build-system)
216 (arguments
217 (list
218 #:phases
219 #~(modify-phases %standard-phases
220 (replace 'check
221 (lambda* (#:key tests? #:allow-other-keys)
222 (if tests?
223 (invoke "faketime" "-f" "@2025-01-01 00:00:00" ;; Tests fail after 2025.
224 "ctest" "--output-on-failure" "--no-tests=error")
225 (format #t "test suite not run~%")))))))
226 (inputs (list libfaketime openssl))
227 (home-page "https://github.com/mtrojnar/osslsigncode")
228 (synopsis "Authenticode signing and timestamping tool")
229 (description "osslsigncode is a small tool that implements part of the
230 functionality of the Microsoft tool signtool.exe - more exactly the Authenticode
231 signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and
232 thus should be able to compile on most platforms where these exist.")
233 (license license:gpl3+))) ; license is with openssl exception
234
235 (define-public python-elfesteem
236 (let ((commit "2eb1e5384ff7a220fd1afacd4a0170acff54fe56"))
237 (package
238 (name "python-elfesteem")
239 (version (git-version "0.1" "1" commit))
240 (source
241 (origin
242 (method git-fetch)
243 (uri (git-reference
244 (url "https://github.com/LRGH/elfesteem")
245 (commit commit)))
246 (file-name (git-file-name name commit))
247 (sha256
248 (base32
249 "07x6p8clh11z8s1n2kdxrqwqm2almgc5qpkcr9ckb6y5ivjdr5r6"))))
250 (build-system python-build-system)
251 ;; There are no tests, but attempting to run python setup.py test leads to
252 ;; PYTHONPATH problems, just disable the test
253 (arguments '(#:tests? #f))
254 (home-page "https://github.com/LRGH/elfesteem")
255 (synopsis "ELF/PE/Mach-O parsing library")
256 (description "elfesteem parses ELF, PE and Mach-O files.")
257 (license license:lgpl2.1))))
258
259 (define-public python-oscrypto
260 (package
261 (name "python-oscrypto")
262 (version "1.3.0")
263 (source
264 (origin
265 (method git-fetch)
266 (uri (git-reference
267 (url "https://github.com/wbond/oscrypto")
268 (commit version)))
269 (file-name (git-file-name name version))
270 (sha256
271 (base32
272 "1v5wkmzcyiqy39db8j2dvkdrv2nlsc48556h73x4dzjwd6kg4q0a"))
273 (patches (search-our-patches "oscrypto-hard-code-openssl.patch"))))
274 (build-system python-build-system)
275 (native-search-paths
276 (list (search-path-specification
277 (variable "SSL_CERT_FILE")
278 (file-type 'regular)
279 (separator #f) ;single entry
280 (files '("etc/ssl/certs/ca-certificates.crt")))))
281
282 (propagated-inputs
283 (list python-asn1crypto openssl))
284 (arguments
285 `(#:phases
286 (modify-phases %standard-phases
287 (add-after 'unpack 'hard-code-path-to-libscrypt
288 (lambda* (#:key inputs #:allow-other-keys)
289 (let ((openssl (assoc-ref inputs "openssl")))
290 (substitute* "oscrypto/__init__.py"
291 (("@GUIX_OSCRYPTO_USE_OPENSSL@")
292 (string-append openssl "/lib/libcrypto.so" "," openssl "/lib/libssl.so")))
293 #t)))
294 (add-after 'unpack 'disable-broken-tests
295 (lambda _
296 ;; This test is broken as there is no keyboard interrupt.
297 (substitute* "tests/test_trust_list.py"
298 (("^(.*)class TrustListTests" line indent)
299 (string-append indent
300 "@unittest.skip(\"Disabled by Guix\")\n"
301 line)))
302 (substitute* "tests/test_tls.py"
303 (("^(.*)class TLSTests" line indent)
304 (string-append indent
305 "@unittest.skip(\"Disabled by Guix\")\n"
306 line)))
307 #t))
308 (replace 'check
309 (lambda _
310 (invoke "python" "run.py" "tests")
311 #t)))))
312 (home-page "https://github.com/wbond/oscrypto")
313 (synopsis "Compiler-free Python crypto library backed by the OS")
314 (description "oscrypto is a compilation-free, always up-to-date encryption library for Python.")
315 (license license:expat)))
316
317 (define-public python-oscryptotests
318 (package (inherit python-oscrypto)
319 (name "python-oscryptotests")
320 (propagated-inputs
321 (list python-oscrypto))
322 (arguments
323 `(#:tests? #f
324 #:phases
325 (modify-phases %standard-phases
326 (add-after 'unpack 'hard-code-path-to-libscrypt
327 (lambda* (#:key inputs #:allow-other-keys)
328 (chdir "tests")
329 #t)))))))
330
331 (define-public python-certvalidator
332 (let ((commit "a145bf25eb75a9f014b3e7678826132efbba6213"))
333 (package
334 (name "python-certvalidator")
335 (version (git-version "0.1" "1" commit))
336 (source
337 (origin
338 (method git-fetch)
339 (uri (git-reference
340 (url "https://github.com/achow101/certvalidator")
341 (commit commit)))
342 (file-name (git-file-name name commit))
343 (sha256
344 (base32
345 "1qw2k7xis53179lpqdqyylbcmp76lj7sagp883wmxg5i7chhc96k"))))
346 (build-system python-build-system)
347 (propagated-inputs
348 (list python-asn1crypto
349 python-oscrypto
350 python-oscryptotests)) ;; certvalidator tests import oscryptotests
351 (arguments
352 `(#:phases
353 (modify-phases %standard-phases
354 (add-after 'unpack 'disable-broken-tests
355 (lambda _
356 (substitute* "tests/test_certificate_validator.py"
357 (("^(.*)class CertificateValidatorTests" line indent)
358 (string-append indent
359 "@unittest.skip(\"Disabled by Guix\")\n"
360 line)))
361 (substitute* "tests/test_crl_client.py"
362 (("^(.*)def test_fetch_crl" line indent)
363 (string-append indent
364 "@unittest.skip(\"Disabled by Guix\")\n"
365 line)))
366 (substitute* "tests/test_ocsp_client.py"
367 (("^(.*)def test_fetch_ocsp" line indent)
368 (string-append indent
369 "@unittest.skip(\"Disabled by Guix\")\n"
370 line)))
371 (substitute* "tests/test_registry.py"
372 (("^(.*)def test_build_paths" line indent)
373 (string-append indent
374 "@unittest.skip(\"Disabled by Guix\")\n"
375 line)))
376 (substitute* "tests/test_validate.py"
377 (("^(.*)def test_revocation_mode_hard" line indent)
378 (string-append indent
379 "@unittest.skip(\"Disabled by Guix\")\n"
380 line)))
381 (substitute* "tests/test_validate.py"
382 (("^(.*)def test_revocation_mode_soft" line indent)
383 (string-append indent
384 "@unittest.skip(\"Disabled by Guix\")\n"
385 line)))
386 #t))
387 (replace 'check
388 (lambda _
389 (invoke "python" "run.py" "tests")
390 #t)))))
391 (home-page "https://github.com/wbond/certvalidator")
392 (synopsis "Python library for validating X.509 certificates and paths")
393 (description "certvalidator is a Python library for validating X.509
394 certificates or paths. Supports various options, including: validation at a
395 specific moment in time, whitelisting and revocation checks.")
396 (license license:expat))))
397
398 (define-public python-signapple
399 (let ((commit "85bfcecc33d2773bc09bc318cec0614af2c8e287"))
400 (package
401 (name "python-signapple")
402 (version (git-version "0.2.0" "1" commit))
403 (source
404 (origin
405 (method git-fetch)
406 (uri (git-reference
407 (url "https://github.com/achow101/signapple")
408 (commit commit)))
409 (file-name (git-file-name name commit))
410 (sha256
411 (base32
412 "17yqjll8nw83q6dhgqhkl7w502z5vy9sln8m6mlx0f1c10isg8yg"))))
413 (build-system pyproject-build-system)
414 (propagated-inputs
415 (list python-asn1crypto
416 python-oscrypto
417 python-certvalidator
418 python-elfesteem))
419 (native-inputs (list python-poetry-core))
420 ;; There are no tests, but attempting to run python setup.py test leads to
421 ;; problems, just disable the test
422 (arguments '(#:tests? #f))
423 (home-page "https://github.com/achow101/signapple")
424 (synopsis "Mach-O binary signature tool")
425 (description "signapple is a Python tool for creating, verifying, and
426 inspecting signatures in Mach-O binaries.")
427 (license license:expat))))
428
429 (define-public mingw-w64-base-gcc
430 (package
431 (inherit base-gcc)
432 (arguments
433 (substitute-keyword-arguments (package-arguments base-gcc)
434 ((#:configure-flags flags)
435 `(append ,flags
436 ;; https://gcc.gnu.org/install/configure.html
437 (list "--enable-threads=posix",
438 "--enable-default-ssp=yes",
439 "--disable-gcov",
440 building-on)))))))
441
442 (define-public linux-base-gcc
443 (package
444 (inherit base-gcc)
445 (arguments
446 (substitute-keyword-arguments (package-arguments base-gcc)
447 ((#:configure-flags flags)
448 `(append ,flags
449 ;; https://gcc.gnu.org/install/configure.html
450 (list "--enable-initfini-array=yes",
451 "--enable-default-ssp=yes",
452 "--enable-default-pie=yes",
453 "--enable-standard-branch-protection=yes",
454 "--enable-cet=yes",
455 "--disable-gcov",
456 building-on)))
457 ((#:phases phases)
458 `(modify-phases ,phases
459 ;; Given a XGCC package, return a modified package that replace each instance of
460 ;; -rpath in the default system spec that's inserted by Guix with -rpath-link
461 (add-after 'pre-configure 'replace-rpath-with-rpath-link
462 (lambda _
463 (substitute* (cons "gcc/config/rs6000/sysv4.h"
464 (find-files "gcc/config"
465 "^gnu-user.*\\.h$"))
466 (("-rpath=") "-rpath-link="))
467 #t))))))))
468
469 (define-public glibc-2.31
470 (let ((commit "7b27c450c34563a28e634cccb399cd415e71ebfe"))
471 (package
472 (inherit glibc) ;; 2.35
473 (version "2.31")
474 (source (origin
475 (method git-fetch)
476 (uri (git-reference
477 (url "https://sourceware.org/git/glibc.git")
478 (commit commit)))
479 (file-name (git-file-name "glibc" commit))
480 (sha256
481 (base32
482 "017qdpr5id7ddb4lpkzj2li1abvw916m3fc6n7nw28z4h5qbv2n0"))
483 (patches (search-our-patches "glibc-guix-prefix.patch"))))
484 (arguments
485 (substitute-keyword-arguments (package-arguments glibc)
486 ((#:configure-flags flags)
487 `(append ,flags
488 ;; https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
489 (list "--enable-stack-protector=all",
490 "--enable-cet",
491 "--enable-bind-now",
492 "--disable-werror",
493 "--disable-timezone-tools",
494 "--disable-profile",
495 building-on)))
496 ((#:phases phases)
497 `(modify-phases ,phases
498 (add-before 'configure 'set-etc-rpc-installation-directory
499 (lambda* (#:key outputs #:allow-other-keys)
500 ;; Install the rpc data base file under `$out/etc/rpc'.
501 ;; Otherwise build will fail with "Permission denied."
502 ;; Can be removed when we are building 2.32 or later.
503 (let ((out (assoc-ref outputs "out")))
504 (substitute* "sunrpc/Makefile"
505 (("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
506 (string-append out "/etc/rpc" suffix "\n"))
507 (("^install-others =.*$")
508 (string-append "install-others = " out "/etc/rpc\n")))))))))))))
509
510 ;; The sponge tool from moreutils.
511 (define-public sponge
512 (package
513 (name "sponge")
514 (version "0.69")
515 (source (origin
516 (method url-fetch)
517 (uri (string-append
518 "https://git.joeyh.name/index.cgi/moreutils.git/snapshot/
519 moreutils-" version ".tar.gz"))
520 (file-name (string-append "moreutils-" version ".tar.gz"))
521 (sha256
522 (base32
523 "1l859qnzccslvxlh5ghn863bkq2vgmqgnik6jr21b9kc6ljmsy8g"))))
524 (build-system gnu-build-system)
525 (arguments
526 (list #:phases
527 #~(modify-phases %standard-phases
528 (delete 'configure)
529 (replace 'install
530 (lambda* (#:key outputs #:allow-other-keys)
531 (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
532 (install-file "sponge" bin)))))
533 #:make-flags
534 #~(list "sponge" (string-append "CC=" #$(cc-for-target)))))
535 (home-page "https://joeyh.name/code/moreutils/")
536 (synopsis "Miscellaneous general-purpose command-line tools")
537 (description "Just sponge")
538 (license license:gpl2+)))
539
540 (packages->manifest
541 (append
542 (list ;; The Basics
543 bash-minimal
544 which
545 coreutils-minimal
546 ;; File(system) inspection
547 file
548 grep
549 diffutils
550 findutils
551 ;; File transformation
552 patch
553 gawk
554 sed
555 sponge
556 ;; Compression and archiving
557 tar
558 gzip
559 xz
560 ;; Build tools
561 gcc-toolchain-13
562 cmake-minimal
563 gnu-make
564 pkg-config
565 imagemagick
566 libicns
567 librsvg-2.40
568 ;; Scripting
569 python-minimal ;; (3.10)
570 ;; Git
571 git-minimal
572 ;; Tests
573 python-lief)
574 (let ((target (getenv "HOST")))
575 (cond ((string-suffix? "-mingw32" target)
576 (list zip
577 (make-mingw-pthreads-cross-toolchain "x86_64-w64-mingw32")
578 nsis-x86_64
579 nss-certs
580 osslsigncode))
581 ((string-contains target "-linux-")
582 (list bison
583 (list gcc-toolchain-13 "static")
584 (make-limenka-cross-toolchain target)))
585 ((string-contains target "darwin")
586 (list clang-toolchain-18
587 lld-18
588 (make-lld-wrapper lld-18 #:lld-as-ld? #t)
589 python-signapple
590 zip))
591 (else '())))))
592