From 2fcfe8c830428928a16bd5c4d9dfb426ba5b534c Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 00:10:36 +0100
Subject: [PATCH 01/23] sgx-sdk: `nixpkgs-fmt`

---
 pkgs/os-specific/linux/sgx-sdk/default.nix    | 70 ++++++++++---------
 pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix |  2 +-
 2 files changed, 37 insertions(+), 35 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 130fd12cbb91..646812da7082 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -84,51 +84,53 @@ stdenv.mkDerivation rec {
   # Build external/ippcp_internal first. The Makefile is rewritten to make the
   # build faster by splitting different versions of ipp-crypto builds and to
   # avoid patching the Makefile for reproducibility issues.
-  buildPhase = let
-    ipp-crypto-no_mitigation = callPackage (import ./ipp-crypto.nix) {};
+  buildPhase =
+    let
+      ipp-crypto-no_mitigation = callPackage (import ./ipp-crypto.nix) { };
 
-    sgx-asm-pp = "python ${src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
+      sgx-asm-pp = "python ${src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
 
-    nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
-    ipp-crypto-cve_2020_0551_load = callPackage (import ./ipp-crypto.nix) {
-      extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ];
-    };
+      nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
+      ipp-crypto-cve_2020_0551_load = callPackage (import ./ipp-crypto.nix) {
+        extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ];
+      };
 
-    nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@";
-    ipp-crypto-cve_2020_0551_cf = callPackage (import ./ipp-crypto.nix) {
-      extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ];
-    };
-  in ''
-    cd external/ippcp_internal
+      nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@";
+      ipp-crypto-cve_2020_0551_cf = callPackage (import ./ipp-crypto.nix) {
+        extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ];
+      };
+    in
+    ''
+      cd external/ippcp_internal
 
-    mkdir -p lib/linux/intel64/no_mitigation
-    cp ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a lib/linux/intel64/no_mitigation
-    chmod a+w lib/linux/intel64/no_mitigation/libippcp.a
-    cp ${ipp-crypto-no_mitigation}/include/* ./inc
+      mkdir -p lib/linux/intel64/no_mitigation
+      cp ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a lib/linux/intel64/no_mitigation
+      chmod a+w lib/linux/intel64/no_mitigation/libippcp.a
+      cp ${ipp-crypto-no_mitigation}/include/* ./inc
 
-    mkdir -p lib/linux/intel64/cve_2020_0551_load
-    cp ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_load
-    chmod a+w lib/linux/intel64/cve_2020_0551_load/libippcp.a
+      mkdir -p lib/linux/intel64/cve_2020_0551_load
+      cp ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_load
+      chmod a+w lib/linux/intel64/cve_2020_0551_load/libippcp.a
 
-    mkdir -p lib/linux/intel64/cve_2020_0551_cf
-    cp ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_cf
-    chmod a+w lib/linux/intel64/cve_2020_0551_cf/libippcp.a
+      mkdir -p lib/linux/intel64/cve_2020_0551_cf
+      cp ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_cf
+      chmod a+w lib/linux/intel64/cve_2020_0551_cf/libippcp.a
 
-    rm -f ./inc/ippcp.h
-    patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp20u3.patch -o ./inc/ippcp.h
+      rm -f ./inc/ippcp.h
+      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp20u3.patch -o ./inc/ippcp.h
 
-    mkdir -p license
-    cp ${ipp-crypto-no_mitigation.src}/LICENSE ./license
+      mkdir -p license
+      cp ${ipp-crypto-no_mitigation.src}/LICENSE ./license
 
-    # Build the SDK installation package.
-    cd ../..
+      # Build the SDK installation package.
+      cd ../..
 
-    # Nix patches make so that $(SHELL) defaults to "sh" instead of "/bin/sh".
-    # The build uses $(SHELL) as an argument to file -L which requires a path.
-    make SHELL=$SHELL sdk_install_pkg
+      # Nix patches make so that $(SHELL) defaults to "sh" instead of "/bin/sh".
+      # The build uses $(SHELL) as an argument to file -L which requires a path.
+      make SHELL=$SHELL sdk_install_pkg
 
-    runHook postBuild
-  '';
+      runHook postBuild
+    '';
 
   postBuild = ''
     patchShebangs ./linux/installer/bin/sgx_linux_x64_sdk_*.bin
diff --git a/pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix
index 52cef4f82815..ac5fd2ad1ccc 100644
--- a/pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/ipp-crypto.nix
@@ -4,7 +4,7 @@
 , cmake
 , python3
 , nasm
-, extraCmakeFlags ? []
+, extraCmakeFlags ? [ ]
 }:
 
 stdenv.mkDerivation rec {

From 32375fb97cef0c23ab41141ca475d1bd2da79481 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 00:32:36 +0100
Subject: [PATCH 02/23] sgx-sdk: eliminate `patches`

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 646812da7082..443efb72893b 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -1,7 +1,5 @@
 { lib
 , stdenv
-, fetchpatch
-, fetchurl
 , fetchFromGitHub
 , callPackage
 , autoconf
@@ -35,19 +33,14 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  patches = [
-    (fetchpatch {
-      name = "replace-bin-cp-with-cp.patch";
-      url = "https://github.com/intel/linux-sgx/commit/e0db5291d46d1c124980719d63829d65f89cf2c7.patch";
-      sha256 = "0xwlpm1r4rl4anfhjkr6fgz0gcyhr0ng46fv8iw9hfsh891yqb7z";
-    })
-    (fetchpatch {
-      name = "sgx_ippcp.h.patch";
-      url = "https://github.com/intel/linux-sgx/commit/e5929083f8161a8e7404afc0577936003fbb9d0b.patch";
-      sha256 = "12bgs9rxlq82hn5prl9qz2r4mwypink8hzdz4cki4k4cmkw961f5";
-    })
-  ];
   postPatch = ''
+    # https://github.com/intel/linux-sgx/pull/730
+    substituteInPlace buildenv.mk --replace '/bin/cp' 'cp'
+
+    # https://github.com/intel/linux-sgx/pull/752
+    ln -s "$src/external/epid-sdk/ext/ipp/include/sgx_ippcp.h" \
+          'external/ippcp_internal/inc/sgx_ippcp.h'
+
     patchShebangs ./linux/installer/bin/build-installpkg.sh \
       ./linux/installer/common/sdk/createTarball.sh \
       ./linux/installer/common/sdk/install.sh

From 96936f625468047b46a3ffdd35e823a7de8caa33 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 00:39:09 +0100
Subject: [PATCH 03/23] sgx-sdk: use tag instead of commit hash

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 443efb72893b..39f291a9438e 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
-    rev = "0cea078f17a24fb807e706409972d77f7a958db9";
+    rev = "sgx_${version}";
     sha256 = "1cr2mkk459s270ng0yddgcryi0zc3dfmg9rmdrdh9mhy2mc1kx0g";
     fetchSubmodules = true;
   };

From e08d39daa6a126478647072a62c6809596692434 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 01:13:24 +0100
Subject: [PATCH 04/23] sgx-sdk: use buildPhase attrs, run hooks, sort

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 50 ++++++++++++----------
 1 file changed, 27 insertions(+), 23 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 39f291a9438e..badd31d39837 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -46,25 +46,26 @@ stdenv.mkDerivation rec {
       ./linux/installer/common/sdk/install.sh
   '';
 
-  dontConfigure = true;
+  # We need `cmake` as a build input but don't use it to kick off the build phase
+  dontUseCmakeConfigure = true;
 
   # SDK built with stackprotector produces broken enclaves which crash at runtime.
   # Disable all to be safe, SDK build configures compiler mitigations manually.
   hardeningDisable = [ "all" ];
 
   nativeBuildInputs = [
+    autoconf
+    automake
     cmake
+    file
     git
+    nasm
+    ncurses
     ocaml
     ocamlPackages.ocamlbuild
     perl
     python3
     texinfo
-    nasm
-    file
-    ncurses
-    autoconf
-    automake
   ];
 
   buildInputs = [
@@ -77,24 +78,24 @@ stdenv.mkDerivation rec {
   # Build external/ippcp_internal first. The Makefile is rewritten to make the
   # build faster by splitting different versions of ipp-crypto builds and to
   # avoid patching the Makefile for reproducibility issues.
-  buildPhase =
+  preBuild =
     let
-      ipp-crypto-no_mitigation = callPackage (import ./ipp-crypto.nix) { };
+      ipp-crypto-no_mitigation = callPackage ./ipp-crypto.nix { };
 
       sgx-asm-pp = "python ${src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
 
       nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
-      ipp-crypto-cve_2020_0551_load = callPackage (import ./ipp-crypto.nix) {
+      ipp-crypto-cve_2020_0551_load = callPackage ./ipp-crypto.nix {
         extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ];
       };
 
       nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@";
-      ipp-crypto-cve_2020_0551_cf = callPackage (import ./ipp-crypto.nix) {
+      ipp-crypto-cve_2020_0551_cf = callPackage ./ipp-crypto.nix {
         extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ];
       };
     in
     ''
-      cd external/ippcp_internal
+      pushd 'external/ippcp_internal'
 
       mkdir -p lib/linux/intel64/no_mitigation
       cp ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a lib/linux/intel64/no_mitigation
@@ -109,39 +110,42 @@ stdenv.mkDerivation rec {
       cp ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_cf
       chmod a+w lib/linux/intel64/cve_2020_0551_cf/libippcp.a
 
-      rm -f ./inc/ippcp.h
+      rm ./inc/ippcp.h
       patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp20u3.patch -o ./inc/ippcp.h
 
       mkdir -p license
       cp ${ipp-crypto-no_mitigation.src}/LICENSE ./license
 
-      # Build the SDK installation package.
-      cd ../..
+      popd
+  '';
 
-      # Nix patches make so that $(SHELL) defaults to "sh" instead of "/bin/sh".
-      # The build uses $(SHELL) as an argument to file -L which requires a path.
-      make SHELL=$SHELL sdk_install_pkg
-
-      runHook postBuild
-    '';
+  buildFlags = [
+    "sdk_install_pkg"
+  ];
 
   postBuild = ''
     patchShebangs ./linux/installer/bin/sgx_linux_x64_sdk_*.bin
   '';
 
   installPhase = ''
-    echo -e 'no\n'$out | ./linux/installer/bin/sgx_linux_x64_sdk_*.bin
-  '';
+    runHook preInstall
 
-  dontFixup = true;
+    ./linux/installer/bin/sgx_linux_x64_sdk_*.bin -prefix "$out"
+
+    runHook postInstall
+  '';
 
   doInstallCheck = true;
   installCheckInputs = [ which ];
   installCheckPhase = ''
+    runHook preInstallCheck
+
     source $out/sgxsdk/environment
     cd SampleCode/SampleEnclave
     make SGX_MODE=SGX_SIM
     ./app
+
+    runHook postInstallCheck
   '';
 
   meta = with lib; {

From 0a23f360eeb49f65c6264a45d88a03982b8d1c30 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 01:36:16 +0100
Subject: [PATCH 05/23] sgx-sdk: use install(5)

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 35 ++++++++++------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index badd31d39837..bc283e1a16b5 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -41,9 +41,9 @@ stdenv.mkDerivation rec {
     ln -s "$src/external/epid-sdk/ext/ipp/include/sgx_ippcp.h" \
           'external/ippcp_internal/inc/sgx_ippcp.h'
 
-    patchShebangs ./linux/installer/bin/build-installpkg.sh \
-      ./linux/installer/common/sdk/createTarball.sh \
-      ./linux/installer/common/sdk/install.sh
+    patchShebangs linux/installer/bin/build-installpkg.sh \
+      linux/installer/common/sdk/createTarball.sh \
+      linux/installer/common/sdk/install.sh
   '';
 
   # We need `cmake` as a build input but don't use it to kick off the build phase
@@ -97,34 +97,29 @@ stdenv.mkDerivation rec {
     ''
       pushd 'external/ippcp_internal'
 
-      mkdir -p lib/linux/intel64/no_mitigation
-      cp ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a lib/linux/intel64/no_mitigation
-      chmod a+w lib/linux/intel64/no_mitigation/libippcp.a
-      cp ${ipp-crypto-no_mitigation}/include/* ./inc
+      install ${ipp-crypto-no_mitigation}/include/* inc/
 
-      mkdir -p lib/linux/intel64/cve_2020_0551_load
-      cp ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_load
-      chmod a+w lib/linux/intel64/cve_2020_0551_load/libippcp.a
+      install -D -m a+rw ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a \
+        lib/linux/intel64/no_mitigation/libippcp.a
+      install -D -m a+rw ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a \
+        lib/linux/intel64/cve_2020_0551_load/libippcp.a
+      install -D -m a+rw ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a \
+        lib/linux/intel64/cve_2020_0551_cf/libippcp.a
 
-      mkdir -p lib/linux/intel64/cve_2020_0551_cf
-      cp ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a lib/linux/intel64/cve_2020_0551_cf
-      chmod a+w lib/linux/intel64/cve_2020_0551_cf/libippcp.a
+      rm inc/ippcp.h
+      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i inc/ippcp20u3.patch -o inc/ippcp.h
 
-      rm ./inc/ippcp.h
-      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp20u3.patch -o ./inc/ippcp.h
-
-      mkdir -p license
-      cp ${ipp-crypto-no_mitigation.src}/LICENSE ./license
+      install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE
 
       popd
-  '';
+    '';
 
   buildFlags = [
     "sdk_install_pkg"
   ];
 
   postBuild = ''
-    patchShebangs ./linux/installer/bin/sgx_linux_x64_sdk_*.bin
+    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_*.bin
   '';
 
   installPhase = ''

From 89929bacab3909b981ecd3ca1e23cd400e93d0ca Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 01:49:49 +0100
Subject: [PATCH 06/23] sgx-sdk: remove superfluous `nasm` input

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index bc283e1a16b5..4771aa8796c1 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
     cmake
     file
     git
-    nasm
     ncurses
     ocaml
     ocamlPackages.ocamlbuild

From 141e8153fbf325bade994682e3aa210a701371de Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 01:57:40 +0100
Subject: [PATCH 07/23] sgx-sdk: fix pkg-config files

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 4771aa8796c1..013d7b06eb68 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -17,6 +17,7 @@
 , perl
 , python3
 , texinfo
+, validatePkgConfig
 , which
 , writeShellScript
 }:
@@ -65,6 +66,7 @@ stdenv.mkDerivation rec {
     perl
     python3
     texinfo
+    validatePkgConfig
   ];
 
   buildInputs = [
@@ -129,6 +131,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  preFixup = ''
+    echo "Fixing pkg-config files"
+    sed -i "s|prefix=.*|prefix=$out/sgxsdk|g" $out/sgxsdk/pkgconfig/*.pc
+  '';
+
   doInstallCheck = true;
   installCheckInputs = [ which ];
   installCheckPhase = ''

From a3b69162e9eab04801d428a0b306b9f98f00d01e Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 03:00:27 +0100
Subject: [PATCH 08/23] sgx-sdk: fix sgx-gdb

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 013d7b06eb68..dcbbb115b9c8 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -7,6 +7,7 @@
 , binutils
 , cmake
 , file
+, gdb
 , git
 , libtool
 , nasm
@@ -132,8 +133,13 @@ stdenv.mkDerivation rec {
   '';
 
   preFixup = ''
+    sgxsdk="$out/sgxsdk"
+
     echo "Fixing pkg-config files"
-    sed -i "s|prefix=.*|prefix=$out/sgxsdk|g" $out/sgxsdk/pkgconfig/*.pc
+    sed -i "s|prefix=.*|prefix=$sgxsdk|g" $out/sgxsdk/pkgconfig/*.pc
+
+    echo "Patching GDB path in bin/sgx-gdb"
+    substituteInPlace "$sgxsdk/bin/sgx-gdb" --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 
   doInstallCheck = true;

From 92df329a98767ead857b9c418f1991c2c58294b1 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 10:33:00 +0100
Subject: [PATCH 09/23] sgx-sdk: use `header` command

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index dcbbb115b9c8..8631db4f8d66 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -97,6 +97,8 @@ stdenv.mkDerivation rec {
       };
     in
     ''
+      header "Setting up IPP crypto build artifacts"
+
       pushd 'external/ippcp_internal'
 
       install ${ipp-crypto-no_mitigation}/include/* inc/
@@ -135,10 +137,10 @@ stdenv.mkDerivation rec {
   preFixup = ''
     sgxsdk="$out/sgxsdk"
 
-    echo "Fixing pkg-config files"
+    header "Fixing pkg-config files"
     sed -i "s|prefix=.*|prefix=$sgxsdk|g" $out/sgxsdk/pkgconfig/*.pc
 
-    echo "Patching GDB path in bin/sgx-gdb"
+    header "Patching GDB path in bin/sgx-gdb"
     substituteInPlace "$sgxsdk/bin/sgx-gdb" --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 

From 4bad549b76da69fffd54ab6d9369ed26113dc1ca Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 11:08:19 +0100
Subject: [PATCH 10/23] sgx-sdk: create Nix output directory structure

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 82 ++++++++++++++++++++--
 1 file changed, 78 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 8631db4f8d66..d26f6d31154c 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -129,19 +129,93 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    ./linux/installer/bin/sgx_linux_x64_sdk_*.bin -prefix "$out"
+    installDir=$TMPDIR
+    ./linux/installer/bin/sgx_linux_x64_sdk_*.bin -prefix $installDir
+    installDir=$installDir/sgxsdk
+
+    header "Move files created by installer"
+
+    mkdir $out
+    pushd $out
+
+    mkdir $out/bin
+    mv $installDir/bin/sgx-gdb $out/bin
+    mkdir $out/bin/x64
+    for file in $installDir/bin/x64/*; do
+      mv $file bin/
+      ln -sr bin/$(basename $file) bin/x64/
+    done
+    rmdir $installDir/bin/{x64,}
+
+    # Move `lib64` to `lib` and symlink `lib64`
+    mv $installDir/lib64 lib
+    ln -s lib/ lib64
+
+    mv $installDir/include/ .
+
+    mkdir -p share/
+    mv $installDir/{SampleCode,licenses} share/
+
+    mkdir -p share/bin
+    mv $installDir/{environment,buildenv.mk} share/bin/
+    ln -s share/bin/{environment,buildenv.mk} .
+
+    # pkgconfig should go to lib/
+    mv $installDir/pkgconfig lib/
+    ln -s lib/pkgconfig/ .
+
+    # Also create the `sdk_libs` for compat. All the files
+    # link to libraries in `lib64/`, we shouldn't link the entire
+    # directory, however, as there seems to be some ambiguity between
+    # SDK and PSW libraries.
+    mkdir sdk_libs/
+    for file in $installDir/sdk_libs/*; do
+      ln -sr lib/$(basename $file) sdk_libs/
+      rm $file
+    done
+    rmdir $installDir/sdk_libs
+
+    # No uninstall script required
+    rm $installDir/uninstall.sh
+
+    # Create an `sgxsdk` symlink which points to `$out` for compat
+    ln -sr . sgxsdk
+
+    # Make sure we didn't forget any files
+    rmdir $installDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1)
+
+    popd
 
     runHook postInstall
   '';
 
+
   preFixup = ''
-    sgxsdk="$out/sgxsdk"
+    header "Strip sgxsdk prefix"
+    for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"
+    do
+      substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
+    done
 
     header "Fixing pkg-config files"
-    sed -i "s|prefix=.*|prefix=$sgxsdk|g" $out/sgxsdk/pkgconfig/*.pc
+    sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc
+
+    header "Fixing SGX_SDK default in samples"
+    substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \
+      --replace '/opt/intel/sgxsdk' "$out"
+    for file in $out/share/SampleCode/*/Makefile; do
+      substituteInPlace $file \
+        --replace '/opt/intel/sgxsdk' "$out" \
+        --replace '$(SGX_SDK)/buildenv.mk' "$out/share/bin/buildenv.mk"
+    done
+
+    header "Patching buildenv.mk to use Intel's prebuilt Nix binutils"
+    substituteInPlace $out/share/bin/buildenv.mk \
+      --replace 'BINUTILS_DIR := /usr/local/bin' \
+                'BINUTILS_DIR := ${BINUTILS_DIR}'
 
     header "Patching GDB path in bin/sgx-gdb"
-    substituteInPlace "$sgxsdk/bin/sgx-gdb" --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
+    substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 
   doInstallCheck = true;

From 867f6ffcd3a3e3c3638cc2fa498fd661289b2aa2 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 11:12:51 +0100
Subject: [PATCH 11/23] sgx-sdk: build and run most samples in
 `installCheckPhase`

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 38 +++++++++++++++++++---
 1 file changed, 33 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index d26f6d31154c..33b907b54370 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -209,25 +209,53 @@ stdenv.mkDerivation rec {
         --replace '$(SGX_SDK)/buildenv.mk' "$out/share/bin/buildenv.mk"
     done
 
-    header "Patching buildenv.mk to use Intel's prebuilt Nix binutils"
+    header "Fixing BINUTILS_DIR in buildenv.mk"
     substituteInPlace $out/share/bin/buildenv.mk \
       --replace 'BINUTILS_DIR := /usr/local/bin' \
                 'BINUTILS_DIR := ${BINUTILS_DIR}'
 
-    header "Patching GDB path in bin/sgx-gdb"
+    header "Fixing GDB path in bin/sgx-gdb"
     substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
   '';
 
   doInstallCheck = true;
   installCheckInputs = [ which ];
+
+  # Run the samples as tests in simulation mode.
+  # The following samples are omitted:
+  # - SampleCommonLoader: requires an actual SGX device
+  # - PowerTransition: requires interaction
   installCheckPhase = ''
     runHook preInstallCheck
 
-    source $out/sgxsdk/environment
-    cd SampleCode/SampleEnclave
-    make SGX_MODE=SGX_SIM
+    source $out/share/bin/environment
+
+    TESTDIR=`mktemp -d`
+    cp -r $out/share/SampleCode $TESTDIR/
+
+    for dir in "Cxx11SGXDemo" "SampleEnclave" "SampleEnclavePCL" "SealUnseal" "Switchless"; do
+      cd $TESTDIR/SampleCode/$dir/
+      make SGX_MODE=SIM
+      ./app
+    done
+
+    cd $TESTDIR/SampleCode/LocalAttestation
+    make SGX_MODE=SIM
+    cd bin/
     ./app
 
+    cd $TESTDIR/SampleCode/RemoteAttestation
+    make SGX_MODE=SIM
+    echo "a" | LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/sample_libcrypto ./app
+
+    # Make sure all symlinks are valid
+    output=$(find "$out" -type l -exec test ! -e {} \; -print)
+    if [[ -n "$output" ]]; then
+      echo "Broken symlinks:"
+      echo "$output"
+      exit 1
+    fi
+
     runHook postInstallCheck
   '';
 

From 8c2b6bbaefb2b2ea54d22715e813e1bed0579cbb Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 11:26:50 +0100
Subject: [PATCH 12/23] sgx-sdk: add veehaitch as a maintainer

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 33b907b54370..8db63e7f1712 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -262,7 +262,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ sbellem arturcygan ];
+    maintainers = with maintainers; [ sbellem arturcygan veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };

From cd057031317107f327c5080bc41923c510a38c15 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 13:04:05 +0100
Subject: [PATCH 13/23] sgx-sdk: fix BINUTILS_DIR substitute

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 8db63e7f1712..3cda94c73862 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -211,8 +211,8 @@ stdenv.mkDerivation rec {
 
     header "Fixing BINUTILS_DIR in buildenv.mk"
     substituteInPlace $out/share/bin/buildenv.mk \
-      --replace 'BINUTILS_DIR := /usr/local/bin' \
-                'BINUTILS_DIR := ${BINUTILS_DIR}'
+      --replace 'BINUTILS_DIR ?= /usr/local/bin' \
+                'BINUTILS_DIR ?= ${BINUTILS_DIR}'
 
     header "Fixing GDB path in bin/sgx-gdb"
     substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'

From e74ffcd3665dd61965f6040e6ced86b6f9804389 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 13:48:23 +0100
Subject: [PATCH 14/23] sgx-sdk: rework `installCheckPhase`

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 31 +++++++++++++---------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 3cda94c73862..28af8a32a646 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -228,25 +228,30 @@ stdenv.mkDerivation rec {
   installCheckPhase = ''
     runHook preInstallCheck
 
+    header "Building and running SGX samples"
+
     source $out/share/bin/environment
 
-    TESTDIR=`mktemp -d`
-    cp -r $out/share/SampleCode $TESTDIR/
+    TESTDIR=$(mktemp -d)
+    pushd $TESTDIR
 
-    for dir in "Cxx11SGXDemo" "SampleEnclave" "SampleEnclavePCL" "SealUnseal" "Switchless"; do
-      cd $TESTDIR/SampleCode/$dir/
-      make SGX_MODE=SIM
-      ./app
+    cp -r $out/share/SampleCode/. ./
+
+    for dir in "Cxx11SGXDemo" "LocalAttestation" "SampleEnclave" "SampleEnclavePCL" "SealUnseal" "Switchless"; do
+      pushd "$dir/"
+      make -j $NIX_BUILD_CORES SGX_MODE=SIM
+      ./app || ./bin/app
+      popd
     done
 
-    cd $TESTDIR/SampleCode/LocalAttestation
-    make SGX_MODE=SIM
-    cd bin/
-    ./app
-
-    cd $TESTDIR/SampleCode/RemoteAttestation
-    make SGX_MODE=SIM
+    pushd "RemoteAttestation"
+    make -j $NIX_BUILD_CORES SGX_MODE=SIM
     echo "a" | LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/sample_libcrypto ./app
+    popd
+
+    popd
+
+    header "Checking symlink targets"
 
     # Make sure all symlinks are valid
     output=$(find "$out" -type l -exec test ! -e {} \; -print)

From 91cd6660108d3ee1d2c98b70726b2531166d39de Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 13:49:54 +0100
Subject: [PATCH 15/23] sgx-sdk: nits

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 28af8a32a646..bb60af622bc4 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -135,10 +135,9 @@ stdenv.mkDerivation rec {
 
     header "Move files created by installer"
 
-    mkdir $out
+    mkdir -p $out/bin
     pushd $out
 
-    mkdir $out/bin
     mv $installDir/bin/sgx-gdb $out/bin
     mkdir $out/bin/x64
     for file in $installDir/bin/x64/*; do
@@ -192,8 +191,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     header "Strip sgxsdk prefix"
-    for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"
-    do
+    for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do
       substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
     done
 

From 007b606892f7b738495e8dd1b413a451edc09be9 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 18:56:28 +0100
Subject: [PATCH 16/23] sgxsdk: add setup hook

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 38 +++++-----------------
 1 file changed, 9 insertions(+), 29 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index bb60af622bc4..8c6351fb8ee0 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -21,6 +21,7 @@
 , validatePkgConfig
 , which
 , writeShellScript
+, writeText
 }:
 
 stdenv.mkDerivation rec {
@@ -219,38 +220,9 @@ stdenv.mkDerivation rec {
   doInstallCheck = true;
   installCheckInputs = [ which ];
 
-  # Run the samples as tests in simulation mode.
-  # The following samples are omitted:
-  # - SampleCommonLoader: requires an actual SGX device
-  # - PowerTransition: requires interaction
   installCheckPhase = ''
     runHook preInstallCheck
 
-    header "Building and running SGX samples"
-
-    source $out/share/bin/environment
-
-    TESTDIR=$(mktemp -d)
-    pushd $TESTDIR
-
-    cp -r $out/share/SampleCode/. ./
-
-    for dir in "Cxx11SGXDemo" "LocalAttestation" "SampleEnclave" "SampleEnclavePCL" "SealUnseal" "Switchless"; do
-      pushd "$dir/"
-      make -j $NIX_BUILD_CORES SGX_MODE=SIM
-      ./app || ./bin/app
-      popd
-    done
-
-    pushd "RemoteAttestation"
-    make -j $NIX_BUILD_CORES SGX_MODE=SIM
-    echo "a" | LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/sample_libcrypto ./app
-    popd
-
-    popd
-
-    header "Checking symlink targets"
-
     # Make sure all symlinks are valid
     output=$(find "$out" -type l -exec test ! -e {} \; -print)
     if [[ -n "$output" ]]; then
@@ -262,6 +234,14 @@ stdenv.mkDerivation rec {
     runHook postInstallCheck
   '';
 
+  setupHook = writeText "setup-hook.sh" ''
+    sgxsdk() {
+        export SGX_SDK=@out@
+    }
+
+    postHooks+=(sgxsdk)
+  '';
+
   meta = with lib; {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";

From a25482ffa725d306558d0a88db9aaac29cc54759 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Mon, 15 Nov 2021 18:57:27 +0100
Subject: [PATCH 17/23] sgxsdk: use samples as passthru tests

---
 pkgs/os-specific/linux/sgx-sdk/default.nix |  4 +-
 pkgs/os-specific/linux/sgx-sdk/samples.nix | 57 ++++++++++++++++++++++
 2 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/os-specific/linux/sgx-sdk/samples.nix

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 8c6351fb8ee0..7544ac0fed37 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -19,7 +19,6 @@
 , python3
 , texinfo
 , validatePkgConfig
-, which
 , writeShellScript
 , writeText
 }:
@@ -218,7 +217,6 @@ stdenv.mkDerivation rec {
   '';
 
   doInstallCheck = true;
-  installCheckInputs = [ which ];
 
   installCheckPhase = ''
     runHook preInstallCheck
@@ -242,6 +240,8 @@ stdenv.mkDerivation rec {
     postHooks+=(sgxsdk)
   '';
 
+  passthru.tests = callPackage ./samples.nix { };
+
   meta = with lib; {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
diff --git a/pkgs/os-specific/linux/sgx-sdk/samples.nix b/pkgs/os-specific/linux/sgx-sdk/samples.nix
new file mode 100644
index 000000000000..2036a1c5d0d4
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx-sdk/samples.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, sgx-sdk
+, which
+}:
+let
+  buildSample = name: stdenv.mkDerivation rec {
+    inherit name;
+
+    src = sgx-sdk.out;
+    sourceRoot = "${sgx-sdk.name}/share/SampleCode/${name}";
+
+    buildInputs = [
+      sgx-sdk
+    ];
+
+    buildFlags = [
+      "SGX_MODE=SIM"
+    ];
+
+    installPhase = ''
+      mkdir $out
+      install -m 755 app $out/app
+      install *.so $out/
+    '';
+
+    doInstallCheck = true;
+    installCheckInputs = [ which ];
+    installCheckPhase = ''
+      pushd $out
+      ./app
+      popd
+    '';
+  };
+in
+{
+  cxx11SGXDemo = buildSample "Cxx11SGXDemo";
+  localAttestation = (buildSample "LocalAttestation").overrideAttrs (oldAttrs: {
+    installPhase = ''
+      mkdir $out
+      cp -r bin/. $out/
+    '';
+  });
+  powerTransition = (buildSample "PowerTransition").overrideAttrs (oldAttrs: {
+    # Requires interaction
+    doInstallCheck = false;
+  });
+  remoteAttestation = (buildSample "RemoteAttestation").overrideAttrs (oldAttrs: {
+    dontFixup = true;
+    installCheckPhase = ''
+      echo "a" | LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$PWD/sample_libcrypto ./app
+    '';
+  });
+  sampleEnclave = buildSample "SampleEnclave";
+  sampleEnclavePCL = buildSample "SampleEnclavePCL";
+  sealUnseal = buildSample "SealUnseal";
+  switchless = buildSample "Switchless";
+}

From d6a0da1e5dff14feb3b783eb1590f92f9725847a Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Fri, 19 Nov 2021 01:04:18 +0100
Subject: [PATCH 18/23] sgx-sdk: use full version

Actually, 2.14 isn't the full version the Makefile uses for the Debian
and RPM packages. Also, pkg-config files contain the version 2.14.100.2.
---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 7544ac0fed37..c490ead23b02 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -22,19 +22,26 @@
 , writeShellScript
 , writeText
 }:
+with lib;
 
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
-  version = "2.14";
+  version = "2.14.100.2";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
-    rev = "sgx_${version}";
+    rev = "sgx_${concatStringsSep "." (take 2 (splitVersion version))}";
     sha256 = "1cr2mkk459s270ng0yddgcryi0zc3dfmg9rmdrdh9mhy2mc1kx0g";
     fetchSubmodules = true;
   };
 
+  postUnpack = ''
+    # Make sure this is the right version
+    grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
+      || (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
+  '';
+
   postPatch = ''
     # https://github.com/intel/linux-sgx/pull/730
     substituteInPlace buildenv.mk --replace '/bin/cp' 'cp'
@@ -123,14 +130,14 @@ stdenv.mkDerivation rec {
   ];
 
   postBuild = ''
-    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_*.bin
+    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${version}.bin
   '';
 
   installPhase = ''
     runHook preInstall
 
     installDir=$TMPDIR
-    ./linux/installer/bin/sgx_linux_x64_sdk_*.bin -prefix $installDir
+    ./linux/installer/bin/sgx_linux_x64_sdk_${version}.bin -prefix $installDir
     installDir=$installDir/sgxsdk
 
     header "Move files created by installer"
@@ -242,7 +249,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = callPackage ./samples.nix { };
 
-  meta = with lib; {
+  meta = {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
     maintainers = with maintainers; [ sbellem arturcygan veehaitch ];

From 4d4689928936ba6cf0a80135a95e100eaf8f5b8c Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Tue, 23 Nov 2021 17:12:44 +0100
Subject: [PATCH 19/23] sgx-sdk: use SRI hash

$ rnix-hashes 1cr2mkk459s270ng0yddgcryi0zc3dfmg9rmdrdh9mhy2mc1kx0g
SRI     sha256-D/QZWBUe1gRbbjWnV10b7IPoM3utefAsOEKnQuasIrM=
base16  0ff41958151ed6045b6e35a7575d1bec83e8337bad79f02c3842a742e6ac22b3
base32  1cr2mkk459s270ng0yddgcryi0zc3dfmg9rmdrdh9mhy2mc1kx0g
base64  D/QZWBUe1gRbbjWnV10b7IPoM3utefAsOEKnQuasIrM
---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index c490ead23b02..164a86882dae 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "linux-sgx";
     rev = "sgx_${concatStringsSep "." (take 2 (splitVersion version))}";
-    sha256 = "1cr2mkk459s270ng0yddgcryi0zc3dfmg9rmdrdh9mhy2mc1kx0g";
+    hash = "sha256-D/QZWBUe1gRbbjWnV10b7IPoM3utefAsOEKnQuasIrM=";
     fetchSubmodules = true;
   };
 

From 406fb9b14db226fed9b49d6e95b0373683b2a586 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Tue, 23 Nov 2021 18:32:44 +0100
Subject: [PATCH 20/23] sgx-sdk: use sgx_ippcp.h from prebuilt optimized
 libraries

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 37 +++++++++++++++-------
 1 file changed, 26 insertions(+), 11 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 164a86882dae..1c523b48ba23 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchzip
 , fetchFromGitHub
 , callPackage
 , autoconf
@@ -23,33 +24,47 @@
 , writeText
 }:
 with lib;
-
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
   version = "2.14.100.2";
 
+  versionTag = concatStringsSep "." (take 2 (splitVersion version));
+
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
-    rev = "sgx_${concatStringsSep "." (take 2 (splitVersion version))}";
+    rev = "sgx_${versionTag}";
     hash = "sha256-D/QZWBUe1gRbbjWnV10b7IPoM3utefAsOEKnQuasIrM=";
     fetchSubmodules = true;
   };
 
-  postUnpack = ''
-    # Make sure this is the right version
-    grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
-      || (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
-  '';
+  postUnpack =
+    let
+      optlibName = "optimized_libs_${versionTag}.tar.gz";
+      optimizedLibs = fetchzip {
+        url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/${optlibName}";
+        hash = "sha256-FjNhNV9+KDMvBYdWXZbua6qYOc3Z1/jtcF4j52TSxQY=";
+        stripRoot = false;
+      };
+      sgxIPPCryptoHeader = "${optimizedLibs}/external/ippcp_internal/inc/sgx_ippcp.h";
+    in
+    ''
+      # Make sure this is the right version of linux-sgx
+      grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
+        || (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
+
+      # Make sure we use the correct version to build IPP Crypto
+      grep -q 'optlib_name=${optlibName}' "$src/download_prebuilt.sh" \
+        || (echo "Could not find expected optimized libs ${optlibName} in in linux-sgx source" >&2 && exit 1)
+
+      # Add missing sgx_ippcp.h: https://github.com/intel/linux-sgx/pull/752
+      ln -s ${sgxIPPCryptoHeader} "$sourceRoot/external/ippcp_internal/inc/sgx_ippcp.h"
+    '';
 
   postPatch = ''
     # https://github.com/intel/linux-sgx/pull/730
     substituteInPlace buildenv.mk --replace '/bin/cp' 'cp'
 
-    # https://github.com/intel/linux-sgx/pull/752
-    ln -s "$src/external/epid-sdk/ext/ipp/include/sgx_ippcp.h" \
-          'external/ippcp_internal/inc/sgx_ippcp.h'
-
     patchShebangs linux/installer/bin/build-installpkg.sh \
       linux/installer/common/sdk/createTarball.sh \
       linux/installer/common/sdk/install.sh

From 68201583056b6183d284754d0315be97e4c25b50 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Wed, 24 Nov 2021 00:11:19 +0100
Subject: [PATCH 21/23] sgx-sdk: fix typo

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 1c523b48ba23..611a402e66f9 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
 
       # Make sure we use the correct version to build IPP Crypto
       grep -q 'optlib_name=${optlibName}' "$src/download_prebuilt.sh" \
-        || (echo "Could not find expected optimized libs ${optlibName} in in linux-sgx source" >&2 && exit 1)
+        || (echo "Could not find expected optimized libs ${optlibName} in linux-sgx source" >&2 && exit 1)
 
       # Add missing sgx_ippcp.h: https://github.com/intel/linux-sgx/pull/752
       ln -s ${sgxIPPCryptoHeader} "$sourceRoot/external/ippcp_internal/inc/sgx_ippcp.h"

From 8a713779ee57877504e67f03d92905d3107e349d Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Sat, 4 Dec 2021 14:09:20 +0100
Subject: [PATCH 22/23] sgx-sdk: remove superfluous `ncurses` input

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 611a402e66f9..7d5c7e3c8f0b 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -12,7 +12,6 @@
 , git
 , libtool
 , nasm
-, ncurses
 , ocaml
 , ocamlPackages
 , openssl
@@ -83,7 +82,6 @@ stdenv.mkDerivation rec {
     cmake
     file
     git
-    ncurses
     ocaml
     ocamlPackages.ocamlbuild
     perl

From dd2001942d47452e7207f1144d8b59f58ce9d32d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Sat, 4 Dec 2021 13:24:32 +0000
Subject: [PATCH 23/23] sgx-sdk: enable parallel building

---
 pkgs/os-specific/linux/sgx-sdk/default.nix | 2 ++
 pkgs/os-specific/linux/sgx-sdk/samples.nix | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/sgx-sdk/default.nix b/pkgs/os-specific/linux/sgx-sdk/default.nix
index 7d5c7e3c8f0b..cb9d140e4edd 100644
--- a/pkgs/os-specific/linux/sgx-sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/default.nix
@@ -142,6 +142,8 @@ stdenv.mkDerivation rec {
     "sdk_install_pkg"
   ];
 
+  enableParallelBuilding = true;
+
   postBuild = ''
     patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${version}.bin
   '';
diff --git a/pkgs/os-specific/linux/sgx-sdk/samples.nix b/pkgs/os-specific/linux/sgx-sdk/samples.nix
index 2036a1c5d0d4..82dbc24568ef 100644
--- a/pkgs/os-specific/linux/sgx-sdk/samples.nix
+++ b/pkgs/os-specific/linux/sgx-sdk/samples.nix
@@ -12,7 +12,7 @@ let
     buildInputs = [
       sgx-sdk
     ];
-
+    enableParallelBuilding = true;
     buildFlags = [
       "SGX_MODE=SIM"
     ];