From 8defa559dc8224474ffac2717d9aaae31083d784 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 23 Oct 2024 12:23:19 +0200 Subject: [PATCH 1/3] libdigidoc: 3.17.1 -> 4.0.0 See https://github.com/open-eid/libdigidocpp/releases/tag/v4.0.0 for release notes. They dropped dependencies on xalan-c and xml-security-c and instead depend on libxml2 and xmlsec now. The change in the TSA_URL is now included as well, so we can stop patching it manually. It also doesn't complain about an invalid signature in the TSL list anymore. --- .../libraries/libdigidocpp/default.nix | 48 +++++++++++++------ 1 file changed, 34 insertions(+), 14 deletions(-) diff --git a/pkgs/development/libraries/libdigidocpp/default.nix b/pkgs/development/libraries/libdigidocpp/default.nix index 85dbf3a72b9d..81a129587dd7 100644 --- a/pkgs/development/libraries/libdigidocpp/default.nix +++ b/pkgs/development/libraries/libdigidocpp/default.nix @@ -1,31 +1,51 @@ -{ lib, stdenv, fetchurl, cmake, minizip, pcsclite, opensc, openssl -, xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }: +{ lib +, stdenv +, fetchurl +, cmake +, libtool +, libxml2 +, minizip +, pcsclite +, opensc +, openssl +, xercesc +, pkg-config +, xsd +, zlib +, xmlsec +, xxd +}: stdenv.mkDerivation rec { - version = "3.17.1"; + version = "4.0.0"; pname = "libdigidocpp"; src = fetchurl { - url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz"; - hash = "sha256-3qDsIAOiWMZDj2zLE+Os7BoeCPeC4JQ6p8jSBd7PdV0="; + url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz"; + hash = "sha256-0G7cjJEgLJ24SwHRznKJ18cRY0m50lr6HXstfbYq9f8="; }; nativeBuildInputs = [ cmake pkg-config xxd ]; buildInputs = [ - minizip pcsclite opensc openssl xercesc - xml-security-c xsd zlib xalanc + libxml2 + minizip + pcsclite + opensc + openssl + xercesc + xsd + zlib + xmlsec ]; outputs = [ "out" "lib" "dev" "bin" ]; - # Cherry-pick of - # https://github.com/open-eid/libdigidocpp/commit/2b5db855ba3ceb9bae1f11589ea1aea22bb7595a - # Fixes https://github.com/NixOS/nixpkgs/issues/334397 - postPatch = '' - substituteInPlace CMakeLists.txt \ - --replace-fail 'TSA_URL "http://dd-at.ria.ee/tsa"' 'TSA_URL "https://eid-dd.ria.ee/ts"' - ''; + # This wants to link to ${CMAKE_DL_LIBS} (ltdl), and there doesn't seem to be + # a way to tell CMake where this should be pulled from. + # A cleaner fix would probably be to patch cmake to use + # `-L${libtool.lib}/lib -ltdl` for `CMAKE_DL_LIBS`, but that's a world rebuild. + env.NIX_LDFLAGS = "-L${libtool.lib}/lib"; # libdigidocpp.so's `PKCS11Signer::PKCS11Signer()` dlopen()s "opensc-pkcs11.so" # itself, so add OpenSC to its DT_RUNPATH after the fixupPhase shrinked it. From fdd3d0aede0d675953aea9ba461eb55b5256f711 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 23 Oct 2024 11:40:30 +0200 Subject: [PATCH 2/3] qdigidoc: 4.5.1 -> 4.6.0 Release notes: https://github.com/open-eid/DigiDoc4-Client/releases/tag/v4.6.0 --- pkgs/tools/security/qdigidoc/default.nix | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix index 844e3d0771f2..4c6ecdae0ce6 100644 --- a/pkgs/tools/security/qdigidoc/default.nix +++ b/pkgs/tools/security/qdigidoc/default.nix @@ -18,27 +18,26 @@ mkDerivation rec { pname = "qdigidoc"; - version = "4.5.1"; + version = "4.6.0"; src = fetchurl { url = "https://github.com/open-eid/DigiDoc4-Client/releases/download/v${version}/qdigidoc4-${version}.tar.gz"; - hash = "sha256-grhSuexp5yd/s8h5AdmdSLBmQY85l9HKZ15oTTvC6PI="; + hash = "sha256-szFLY9PpZMMYhfV5joueShfu92YDVmcCC3MOWIOAKVg="; }; + patches = [ + (fetchpatch { + url = "https://github.com/open-eid/DigiDoc4-Client/commit/bb324d18f0452c2ab1b360ff6c42bb7f11ea60d7.patch"; + hash = "sha256-JpaU9inupSDsZKhHk+sp5g+oUynVFxR7lshjTXoFIbU="; + }) + ]; + tsl = fetchurl { url = "https://ec.europa.eu/tools/lotl/eu-lotl-pivot-300.xml"; sha256 = "1cikz36w9phgczcqnwk4k3mx3kk919wy2327jksmfa4cjfjq4a8d"; }; - patches = [ - # https://github.com/open-eid/DigiDoc4-Client/pull/1251 - (fetchpatch { - url = "https://github.com/open-eid/DigiDoc4-Client/commit/30281d14c5fb5582832eafbc254b56f8d685227d.patch"; - hash = "sha256-nv23NbPUogOhS8No3SMIrAcPChl+d1HkxnePpCKIoUw="; - }) - ]; - nativeBuildInputs = [ cmake gettext pkg-config qttools ]; postPatch = '' From afb354a242581f833161ab2098a68cd061e1dde3 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 23 Oct 2024 11:55:55 +0200 Subject: [PATCH 3/3] qdigidoc: bump TSL list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Also add a link on where to find the latest number. qdigidoc still complains about the signature being invalid: ``` 2024-10-23T09:52:36Z E [TSL.cpp:302] - TSL eu-lotl.xml signature is invalid 2024-10-23T09:52:37Z E [TSL.cpp:302] - TSL EE.xml signature is invalid 2024-10-23T09:52:38Z I [X509CertStore.cpp:63] - Loaded 60 certificates into TSL certificate store. ``` … but then still loads them into the certificate store? --- pkgs/tools/security/qdigidoc/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/security/qdigidoc/default.nix b/pkgs/tools/security/qdigidoc/default.nix index 4c6ecdae0ce6..b23f3abdc4b0 100644 --- a/pkgs/tools/security/qdigidoc/default.nix +++ b/pkgs/tools/security/qdigidoc/default.nix @@ -33,9 +33,10 @@ mkDerivation rec { }) ]; + # Check https://dss.nowina.lu/tl-info, "Pivots loaded" section tsl = fetchurl { - url = "https://ec.europa.eu/tools/lotl/eu-lotl-pivot-300.xml"; - sha256 = "1cikz36w9phgczcqnwk4k3mx3kk919wy2327jksmfa4cjfjq4a8d"; + url = "https://ec.europa.eu/tools/lotl/eu-lotl-pivot-341.xml"; + hash = "sha256-/TI8qYxXzourjGFPBpsQzi9Depi7lLQ2JaV+FyP0FtE="; }; nativeBuildInputs = [ cmake gettext pkg-config qttools ];