From a9c1dfc9d387251c5275e1e528c28aa5aaa10b71 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <git@danielschaefer.me>
Date: Sat, 12 Jul 2025 20:05:18 +0800
Subject: [PATCH] jsign: init at 7.2

Signed-off-by: Daniel Schaefer <git@danielschaefer.me>

Tested with yubikey (must have `services.pcscd.enable = true;`):

> jsign --storetype PIV --storepass FOO --tsaurl http://ts.ssl.com --tsmode RFC3161 foo.exe
> jsign --storetype YUBIKEY --storepass FOO --tsaurl http://ts.ssl.com --tsmode RFC3161 foo.exe

Signed-off-by: Daniel Schaefer <git@danielschaefer.me>
---
 pkgs/by-name/js/jsign/package.nix | 67 +++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 pkgs/by-name/js/jsign/package.nix

diff --git a/pkgs/by-name/js/jsign/package.nix b/pkgs/by-name/js/jsign/package.nix
new file mode 100644
index 000000000000..82e5ca98ede3
--- /dev/null
+++ b/pkgs/by-name/js/jsign/package.nix
@@ -0,0 +1,67 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  makeBinaryWrapper,
+  jre_headless,
+  maven,
+  pcsclite,
+  yubico-piv-tool,
+  opensc,
+}:
+
+let
+  jre = jre_headless;
+in
+maven.buildMavenPackage rec {
+  pname = "jsign";
+  # For build from non-release, increment version by one and add -SNAPSHOT
+  # e.g. 7.3-SNAPSHOT
+  version = "7.2";
+
+  src = fetchFromGitHub {
+    owner = "ebourg";
+    repo = "jsign";
+    tag = version;
+    hash = "sha256-ngAwtd4C3KeLq9sM15B8tWS34AH81azYEjXg3+Gy5NA=";
+  };
+
+  mvnHash = "sha256-N91gwM3vsDZQM/BptF5RgRQ/A8g56NOJ6bc2SkxLnBs=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  # The tests try to access the network
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share
+    install -Dm644 jsign/target/jsign-${version}.jar $out/share/jsign.jar
+
+    makeWrapper ${jre}/bin/java $out/bin/jsign \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          yubico-piv-tool
+          opensc
+        ]
+      } \
+      --add-flags "-Dsun.security.smartcardio.library=${lib.getLib pcsclite}/lib/libpcsclite.so.1 -jar $out/share/jsign.jar"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Authenticode signing for Windows executables, installers & scripts";
+    homepage = "https://ebourg.github.io/jsign";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      johnazoidberg
+    ];
+    mainProgram = "jsign";
+    # Build doesn't work, upstream says running the .jar is supported on darwin though
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+}