1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
{ stdenv, lib, fetchFromGitHub
, autoreconfHook, autoconf-archive, pkg-config, doxygen, perl
, openssl, json_c, curl, libgcrypt
, cmocka, uthash, ibm-sw-tpm2, iproute2, procps, which
, libuuid
}:
let
# Avoid a circular dependency on Linux systems (systemd depends on tpm2-tss,
# tpm2-tss tests depend on procps, procps depends on systemd by default). This
# needs to be conditional based on isLinux because procps for other systems
# might not support the withSystemd option.
procpsWithoutSystemd = procps.override { withSystemd = false; };
procps_pkg = if stdenv.hostPlatform.isLinux then procpsWithoutSystemd else procps;
in
stdenv.mkDerivation rec {
pname = "tpm2-tss";
version = "4.1.3";
src = fetchFromGitHub {
owner = "tpm2-software";
repo = pname;
rev = version;
hash = "sha256-BP28utEUI9g1VNv3lCXuiKrDtEImFQxxZfIjLiE3Wr8=";
};
outputs = [ "out" "man" "dev" ];
nativeBuildInputs = [
autoreconfHook autoconf-archive pkg-config doxygen perl
];
buildInputs = [
openssl json_c curl libgcrypt uthash libuuid
]
# cmocka is checked in the configure script
# when unit and/or integration testing is enabled
# cmocka doesn't build with pkgsStatic, and we don't need it anyway
# when tests are not run
++ lib.optional doInstallCheck cmocka;
nativeInstallCheckInputs = [
cmocka which openssl procps_pkg iproute2 ibm-sw-tpm2
];
strictDeps = true;
preAutoreconf = "./bootstrap";
enableParallelBuilding = true;
patches = [
# Do not rely on dynamic loader path
# TCTI loader relies on dlopen(), this patch prefixes all calls with the output directory
./no-dynamic-loader-path.patch
# Configure script expects tools from shadow (e.g. useradd) but they are
# actually optional (and we can’t use them in Nix sandbox anyway). Make the
# check in configure.ac a warning instead of an error so that we can run
# configure phase on platforms that don’t have shadow package (e.g. macOS).
# Note that *on platforms* does not mean *for platform* i.e. this is for
# cross-compilation, tpm2-tss does not support macOS, see upstream issue:
# https://github.com/tpm2-software/tpm2-tss/issues/2629
# See also
# https://github.com/tpm2-software/tpm2-tss/blob/6c46325b466f35d40c2ed1043bfdfcfb8a367a34/Makefile.am#L880-L898
./no-shadow.patch
];
postPatch = ''
patchShebangs script
substituteInPlace src/tss2-tcti/tctildr-dl.c \
--replace '@PREFIX@' $out/lib/
substituteInPlace ./test/unit/tctildr-dl.c \
--replace '@PREFIX@' $out/lib/
substituteInPlace ./bootstrap \
--replace 'git describe --tags --always --dirty' 'echo "${version}"'
'';
configureFlags = lib.optionals doInstallCheck [
"--enable-unit"
"--enable-integration"
];
postInstall = ''
# Do not install the upstream udev rules, they rely on specific
# users/groups which aren't guaranteed to exist on the system.
rm -R $out/lib/udev
'';
doCheck = false;
doInstallCheck = stdenv.buildPlatform == stdenv.hostPlatform;
# Since we rewrote the load path in the dynamic loader for the TCTI
# The various tcti implementation should be placed in their target directory
# before we could run tests, so we make turn checkPhase into installCheckPhase
installCheckTarget = "check";
meta = with lib; {
description = "OSS implementation of the TCG TPM2 Software Stack (TSS2)";
homepage = "https://github.com/tpm2-software/tpm2-tss";
license = licenses.bsd2;
platforms = platforms.linux;
maintainers = with maintainers; [ baloo ];
};
}
|
