blob: 47f4e5a7b835f6dc8fd0869f0add67569e557332 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
{ lib, stdenv, fetchFromGitHub, openssl, makeWrapper, runtimeShell }:
stdenv.mkDerivation rec {
pname = "easyrsa";
version = "3.1.7";
src = fetchFromGitHub {
owner = "OpenVPN";
repo = "easy-rsa";
rev = "v${version}";
hash = "sha256-zdVcT04nj7eE1a6M7WHeWpwG/TVTwyK+WgD70XwPXfY=";
};
nativeBuildInputs = [ makeWrapper ];
nativeInstallCheckInputs = [ openssl.bin ];
installPhase = ''
mkdir -p $out/share/easy-rsa
cp -r easyrsa3/{*.cnf,x509-types,vars.example} $out/share/easy-rsa
install -D -m755 easyrsa3/easyrsa $out/bin/easyrsa
substituteInPlace $out/bin/easyrsa \
--replace /usr/ $out/ \
--replace '~VER~' '${version}' \
--replace '~GITHEAD~' 'v${version}' \
--replace '~DATE~' '1970-01-01'
# Wrap it with the correct OpenSSL binary.
wrapProgram $out/bin/easyrsa \
--set-default EASYRSA_OPENSSL ${openssl.bin}/bin/openssl
# Helper utility
cat > $out/bin/easyrsa-init <<EOF
#!${runtimeShell} -e
cp -r $out/share/easy-rsa/* .
EOF
chmod +x $out/bin/easyrsa-init
'';
doInstallCheck = true;
postInstallCheck = ''
set -euo pipefail
export EASYRSA_BATCH=1
export EASYRSA_PASSIN=pass:nixpkgs
export EASYRSA_PASSOUT="$EASYRSA_PASSIN"
export EASYRSA_REQ_CN='nixpkgs test CA'
export EASYRSA_KEY_SIZE=3072
export EASYRSA_ALGO=rsa
export EASYRSA_DIGEST=sha512
$out/bin/easyrsa init-pki
$out/bin/easyrsa build-ca
openssl x509 -in pki/ca.crt -noout -subject | tee /dev/stderr | grep -zq "$EASYRSA_REQ_CN"
'';
meta = with lib; {
description = "Simple shell based CA utility";
homepage = "https://openvpn.net/";
license = licenses.gpl2Only;
maintainers = [ maintainers.offline maintainers.numinit ];
platforms = platforms.unix;
};
}
|