From b11de88b221ed5fce626b0ff0562635273894fec Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 4 Feb 2023 18:32:56 -0800
Subject: [PATCH 1/2] ovftool: 4.4.1-16812187 -> 4.5.0-20459872

Use ovftool's bundled OpenSSL since they appear to be tied to it.
---
 pkgs/tools/virtualization/ovftool/default.nix | 128 +++++++-----------
 .../ovftool/installCheckPhase.ova             | Bin 0 -> 75264 bytes
 pkgs/top-level/all-packages.nix               |   4 +-
 3 files changed, 48 insertions(+), 84 deletions(-)
 create mode 100644 pkgs/tools/virtualization/ovftool/installCheckPhase.ova

diff --git a/pkgs/tools/virtualization/ovftool/default.nix b/pkgs/tools/virtualization/ovftool/default.nix
index 9db01094bb30..825cf8b90c20 100644
--- a/pkgs/tools/virtualization/ovftool/default.nix
+++ b/pkgs/tools/virtualization/ovftool/default.nix
@@ -1,51 +1,12 @@
-{ lib, stdenv, system ? builtins.currentSystem, ovftoolBundles ? {}
-, requireFile, buildFHSUserEnv, autoPatchelfHook, makeWrapper, unzip
-, glibc, c-ares, libressl, curl, expat, icu60, xercesc, zlib
+{ lib, stdenv, fetchurl, system ? builtins.currentSystem, ovftoolBundles ? {}
+, requireFile, autoPatchelfHook, makeWrapper, unzip
+, glibc, c-ares, libxcrypt, expat, icu60, xercesc, zlib
 }:
 
 let
-  version = "4.4.1-16812187";
+  version = "4.5.0-20459872";
 
-  # FHS environment required to unpack ovftool on x86.
-  ovftoolX86Unpacker = buildFHSUserEnv rec {
-    name = "ovftool-unpacker";
-    targetPkgs = pkgs: [ pkgs.bash ];
-    multiPkgs = targetPkgs;
-    runScript = "bash";
-  };
-
-  # unpackPhase for i686 and x86_64 ovftool self-extracting bundles.
-  ovftoolX86UnpackPhase = ''
-    runHook preUnpack
-    # This is a self-extracting shell script and needs a FHS environment to run.
-    # In reality, it could be doing anything, which is bad for reproducibility.
-    # Our postUnpack uses nix-hash to verify the hash to prevent problems.
-    #
-    # Note that the Arch PKGBUILD at
-    # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vmware-ovftool
-    # appears to use xvfb-run - this hasn't been proven necessary so far.
-    #
-    cp ${ovftoolSource} ./ovftool.bundle
-    chmod +x ./ovftool.bundle
-    ${ovftoolX86Unpacker}/bin/ovftool-unpacker ./ovftool.bundle -x ovftool
-    rm ovftool.bundle
-    extracted=ovftool/vmware-ovftool/
-    if [ -d "$extracted" ]; then
-      # Move the directory we care about to ovftool/
-      mv "$extracted" .
-      rm -r ovftool
-      mv "$(basename -- "$extracted")" ovftool
-      echo "ovftool extracted successfully" >&2
-    else
-      echo "Could not find $extracted - are you sure this is ovftool?" >&2
-      rm -r ovftool
-      exit 1
-    fi
-    runHook postUnpack
-  '';
-
-  # unpackPhase for aarch64 .zip.
-  ovftoolAarch64UnpackPhase = ''
+  ovftoolZipUnpackPhase = ''
     runHook preUnpack
     unzip ${ovftoolSource}
     extracted=ovftool/
@@ -58,29 +19,20 @@ let
     runHook postUnpack
   '';
 
-  # When the version is bumped, postUnpackHash will change
-  # for all these supported systems. Update it from the printed error on build.
-  #
-  # This is just a sanity check, since ovftool is a self-extracting bundle
-  # that could be doing absolutely anything on 2/3 of the supported platforms.
-  ovftoolSystems = {
-    "i686-linux" = {
-      filename = "VMware-ovftool-${version}-lin.i386.bundle";
-      sha256 = "0gx78g3s77mmpir7jbiskna10i6262ihal1ywivlb6xxxxbhqzwj";
-      unpackPhase = ovftoolX86UnpackPhase;
-      postUnpackHash = "1k8rp8ywhs0cl9aad37v1p0493bdvkxrsvwg5pgv2bhvjs4hqk7n";
+  ovftoolSystems = let
+    baseUrl = "https://vdc-download.vmware.com/vmwb-repository/dcr-public";
+  in {
+    "i686-linux" = rec {
+      filename = "VMware-ovftool-${version}-lin.i386.zip";
+      url = "${baseUrl}/b70b2ad5-861a-4c11-b081-e541586bf934/57109c63-6b80-4ced-95f2-1b7255200a36/${filename}";
+      sha256 = "11zs5dm4gmssm94s501p66l4s8v9p7prrd87cfa903mwmyp0ihnx";
+      unpackPhase = ovftoolZipUnpackPhase;
     };
-    "x86_64-linux" = {
-      filename = "VMware-ovftool-${version}-lin.x86_64.bundle";
-      sha256 = "1kp2bp4d9i8y7q25yqff2bn62mh292lws7b66lyn8ka9b35kvnzc";
-      unpackPhase = ovftoolX86UnpackPhase;
-      postUnpackHash = "0zvyakwi4iishqxxisihgh91bmdsfvj5vchm2c192hia03a143py";
-    };
-    "aarch64-linux" = {
-      filename = "VMware-ovftool-${version}-lin.aarch64.zip";
-      sha256 = "0all8bwv5p5adnzqvrly6nzmxmfpywvlbfr0finr4n100yv0v1xy";
-      unpackPhase = ovftoolAarch64UnpackPhase;
-      postUnpackHash = "16vyyzrmryi8b7mrd6nxnhywvvj2pw0ban4qfiqfahw763fn6971";
+    "x86_64-linux" = rec {
+      filename = "VMware-ovftool-${version}-lin.x86_64.zip";
+      url = "${baseUrl}/f87355ff-f7a9-4532-b312-0be218a92eac/b2916af6-9f4f-4112-adac-49d1d6c81f63/${filename}";
+      sha256 = "1fkm18yfkkm92m7ccl6b4nxy5lagwwldq56b567091a5sgad38zw";
+      unpackPhase = ovftoolZipUnpackPhase;
     };
   };
 
@@ -91,9 +43,9 @@ let
   ovftoolSource = if builtins.hasAttr system ovftoolBundles then
                     ovftoolBundles.${system}
                   else
-                    requireFile {
+                    fetchurl {
                       name = ovftoolSystem.filename;
-                      url = "https://my.vmware.com/group/vmware/downloads/get-download?downloadGroup=OVFTOOL441";
+                      url = ovftoolSystem.url;
                       sha256 = ovftoolSystem.sha256;
                     };
 in
@@ -103,11 +55,13 @@ stdenv.mkDerivation rec {
 
   src = ovftoolSource;
 
+  # Maintainers: try downloading a NixOS OVA and run the following to test:
+  # `./result/bin/ovftool https://channels.nixos.org/nixos-unstable/latest-nixos-x86_64-linux.ova nixos.ovf`
+  # Some dependencies are not loaded until operations actually occur!
   buildInputs = [
     glibc
-    libressl
+    libxcrypt
     c-ares
-    (curl.override { openssl = libressl; })
     expat
     icu60
     xercesc
@@ -116,12 +70,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoPatchelfHook makeWrapper unzip ];
 
+  preferLocalBuild = true;
+
   sourceRoot = ".";
 
   unpackPhase = ovftoolSystem.unpackPhase;
 
-  postUnpackHash = ovftoolSystem.postUnpackHash;
-
   # Expects a directory named 'ovftool' containing the ovftool install.
   # Based on https://aur.archlinux.org/packages/vmware-ovftool/
   # with the addition of a libexec directory and a Nix-style binary wrapper.
@@ -133,22 +87,20 @@ stdenv.mkDerivation rec {
     fi
     # libraries
     install -m 755 -d "$out/lib/${pname}"
-    # These all appear to be VMWare proprietary except for libgoogleurl.
+    # These all appear to be VMWare proprietary except for libgoogleurl and libcurl.
     # The rest of the libraries that the installer extracts are omitted here,
-    # and provided in buildInputs.
+    # and provided in buildInputs. Since libcurl depends on VMWare's OpenSSL,
+    # we have to use both here too.
     #
     # FIXME: can we replace libgoogleurl? Possibly from Chromium?
+    # FIXME: tell VMware to use a modern version of OpenSSL.
     #
     install -m 644 -t "$out/lib/${pname}" \
       libgoogleurl.so.59 \
       libssoclient.so \
-      libvim-types.so libvmacore.so libvmomi.so
-    # ovftool specifically wants 1.0.2 but our libcrypto is named 1.0.0
-    ln -s "${lib.getLib libressl}/lib/libcrypto.so" \
-      "$out/lib/${pname}/libcrypto.so.1.0.2"
-    ln -s "${lib.getLib libressl}/lib/libssl.so" \
-      "$out/lib/${pname}/libssl.so.1.0.2"
-    # libexec
+      libvim-types.so libvmacore.so libvmomi.so \
+      libcurl.so.4 libcrypto.so.1.0.2 libssl.so.1.0.2
+    # libexec binaries
     install -m 755 -d "$out/libexec/${pname}"
     install -m 755 -t "$out/libexec/${pname}" ovftool.bin
     install -m 644 -t "$out/libexec/${pname}" icudt44l.dat
@@ -177,6 +129,20 @@ stdenv.mkDerivation rec {
     addAutoPatchelfSearchPath "$out/lib"
   '';
 
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    # This is a NixOS 22.11 image (doesn't actually matter) with a 1 MiB root disk that's all zero.
+    # Make sure that it converts properly.
+    mkdir -p ovftool-check
+    cd ovftool-check
+
+    $out/bin/ovftool ${./installCheckPhase.ova} nixos.ovf
+    if [ ! -f nixos.ovf ] || [ ! -f nixos.mf ] || [ ! -f nixos-disk1.vmdk ]; then
+      exit 1
+    fi
+  '';
+
   meta = with lib; {
     description = "VMWare tools for working with OVF, OVA, and VMX images";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/tools/virtualization/ovftool/installCheckPhase.ova b/pkgs/tools/virtualization/ovftool/installCheckPhase.ova
new file mode 100644
index 0000000000000000000000000000000000000000..3bb164029925f3150ec3bafd952c0c1cd09a304e
GIT binary patch
literal 75264
zcmd1HtjI6c%P&h~pdBzUFfcGPF<}7Fh6V;Gw1I)4iJ7?pgQ1DBxv_zXfr*hhgMope
zk*TQ>g8}WFgfO|ZxFoTNL4lz-KQ}c$FBKty#v&w-rhKSyZR{&@a}>%_i;6Sz^K6w2
z^$e60QuC7YQ!?|?ZIwbp+;lCJ?CrR0T=U9ObMgyP74pl{tWcF#<mOoAB!ZNu=IMq8
zD=Adu=HwOIDrJ<E6j<r&7bj<=<|Y>FrR0{R>E#!t>*trH>8C=C(>H`Fx5_U|BUMXL
zVsQ#?J>^NMx%%bB$(gzOhWg2wxw;UC=o{%fd-}!)r55Lx7A2=T=H%ojCzfR9=LM&h
zlw{_myCjw*!rWArlwSe2puD_XuPn2uq%<)nDZc{llibAQjLf`LxR%^<R2{kHiAAY;
z$@#g^fB<<PuDF<d4}?LS5?onalA4Rf?G?qDC=Mw%20Pivz`#&H!q+Dl94oq+dBr7(
zdC93tc3cVyHbJRrsYR)I$*IL4u7ZM%TV@U<#xsgi(`=Q%g@tZPW^uNmURiERwh}ls
zWTx0ErDf)%8bY|mnN_K_N@k{}#%4<TAaiW=QO&h+$t=zePE7^{I!InY!NxN$E#J;3
zv$#YdKTV+|BUJ$!&<Y^CiWN$WQ&SW&^T09%iOJcC>8UpQU_D$43JMBf1Hn#7PAo`F
z&Mc|4RWi1;G&hDg2quV#>d?H*l44t>q{@<11uX@mI3ojyN|0@yDYi;wxgZwQKOnCK
zfqV~Qz{K*4auZ8X!nX_&(V2NAsYPjt$*INq#RaL!nQ57j6jrPc3N*cplH45S;*z4&
z#9aS^lFZ!9s?-#S{RR02r8$WusVTvbFtjwcFt;=}HM3As03}7M(o#@ZrzEGPnI@)~
z>zbq)80nf=Bqr%58YUU)CMG5srWzWVn53k@Lmn-tZTwP8%JYk`hJJo}W^!VVLLNi~
z;XsEP1rGPT#N1R{B|paya5{p-NosL&QDy-+l6_FkhQw!5r9w$YX0bwIK|xL?C=Ke_
z=(`|kf<&!8)EZDiv4L@r5|0f^J^(ug6h?lT75>2rMn-yuhI&S(rlxv{CZ>rNmWF0V
zCdLXH6&7akW+u8hnR%rZnouW0(x4+e<w5f`N;>l|NG(bP6%w#q2TsFqOAQSSpoYPc
zbVx?3LUv|e3Mg5FvszA0YKlU7X(}kC!wgd>2Ipa9n?PwADJXnE4mAR~8A}i;DA<4#
zhktNLCA54lN-ZqSEJ_9C%fy`GR3$rP1CSJh0#!l5MjyMspt8^a_DC#B0TpFPVGoXH
za5jXhQOJNQQh>T3H#M)MSRpOHNFfnlz$z%%KtdE^CD`1u;^Gu5*PK+45q^oesdg|s
zU=C4mOU%v8skG6@Pzg>s2tz!fWt^vrodHxek`S6=s4WoZc&4Q0m1L%6rWV<ekf5M;
z;4%rHg`gO;gO+_s`4zfGdPdkx11p1?W1|moD=g@2JWEn@VH^bo8&D-_<(vq~h=%Z3
za1IEy(MOSkng`Q@oE7~_bCXhwK#3UYHU;N^&|;{5WQAyEAV(iItC8i=v?9fjA=Dxy
zAvDFX${ZXn#!%%bf@m6`aT8dYm{*cnQfUXX0$m)c%|;(NP_c$ETIFKro0^{JR9TV=
z3ng@UsL8O<hDVU8v6+Ie6DX*2Q*-l+Dxsc%$)jmQ4trm)dIeC`0o8;oi>47d<PCAy
ziL3@qJ5p2_K`lcPLQ{+q5hhUOD1vAj&|?AQK&Uo!DX30jA}A%LD7Cm4R0M#Ny(5$l
zH32;$iW5r`o%8cbit=-EQi}|r))Ns8!Hyx03J9H0jYLKTc3X*y2w1u&91+2#N#LB~
z=;7=MbssD`U{YwI0+R-7GlGQ%iYQbE^<$#6I0@=VB0@hj*oo}GM_5E$fWwk9;Q)sO
z8!Un-3pW3}fW)HIyb?Q@anOVe7l%d!EI~V#mgMIqmSiR)N+7#5P^$nMsMzGujDUrE
zaeirD3RD|R3{5F=Iu8aZS8z@&g6Tn)MAL^H;>gw@i=$~l3U*VdqmYEq6vM(CmcCQ-
ziu3a_3k{9UVMRZ>3LFN2qtX~=Axslk6sm*x8~~3pScW1Hm9Q`ecTS*QhKWHfhs8Q_
zP=opa3ZA*(P7}E3LzYC-haBF>)*y?cY4OM}E`f!EojyntsG9@oBSM{sq5w@ZQjD2F
zl_LqEDMm~9P%fGxm{Y(}VrULE6h#!OgP4fIl6gvsN>ibxl8|>?OEOZ6@={9_5>pZj
zN<fXNJO#DHg8X7@KgSRV18OLa7<JCi%Y*ir{TxGJY7v4^Pr(uZa)c3YH?l4?1CgQy
z7N|%<Xo^vS+Ypw#QAD9SkR!oHA6mV`n)oPv4M;D?7c$(U0O{@6Dj|9{N(woN#U;Td
zi6yDd8Hsu6skTZ+21drZ21dGu#vz90R;GqlMn+Le3ee6f2|Yw`4-eX<fp@ADit`c+
ziZk*{-12i$Qj2Vrf}#9kB?U-Fy*e$;$RfqWz)aU9)xcQS#4ssUH_6;GQP(^zEyXC&
zz}!5=!k|_OdGyWD4ALt_^dmvzZQwqZbAE0?PHIW20yL1E@+%aeom7S7{JgZx^iojg
zG(QhCQi7x=4Lnw10~&X-0viMic~~eTbrzfhLJ>R#1)BgzSB2EP#H1WhUlNq?AtO4V
zz7+`D_~hrM`{t*l;#Cx3<QU-Tj8_TFDIjONR`?_qrKbiYrl%GoG=ZxuWZP}@Q5<Un
zZT<#1`hr@(wo0HzBZ_(tPZx!N{LDO1|J_z8G}tKw<gXGGH7=RO1v!b83Sn?#jE$5)
zp$lyX+A4+l28X#jqG)pR^bbY}HBWzn9uCe;%FHhgEzL~v$t)?!Np;Oj$xO^cco#ja
zZS+xXu?Y=!La`Ik;)IUff#L^*Z4ffhl<)81?5U(sQdy8{s|03)N9jOnAsADKE0PW{
z8%2kWKEetl%Wd>g+z1<bLUFYtv@rB_bcWV_wn_#T1_nmvW)>DsP9~tSXizMr*eZcT
zM4>n*zr<F_0Oov9cQi8}o>`#o_j3$Eb0E|ngx&C=BqSln(v-}6s7i&DqRcW-rgroR
zcEoT6G)s8q*(zbC%b*Zv1<;ssj(<^Th%;ym-5DjhIOk**B;_X-rNG^2qYq2}FxS`w
zm*f{Erl(>LSPV%8r~Ld9P&mPY$<xKvz&EkDB(=yj7c`=nnV%PsUjzv`kX&$1Vp%Gh
zl%bM>r;Dp0R&7QQIc(aDl@vfmJLi|?mDnnoz=~H;HwYF>pnirDXwVPT67ckQPE5{7
zg}M~xVNlH3IF^)vq*7c`%QBNw6;i+yIJPtLOA2yI)6*e-goL?50nA5`qzno}P*Vpz
zHGo?_uo9V=vC~@Q=mHIop}Gs<WE*{qn1D%Qk%DFo8-4Hq9JC$-sfSm4uz?&Keb{UZ
zNE#G0n3!7gOW+}Wy<A#O|AFWGaL@l47#NwFW6b{<o0^Tz|4}QF@t70r;b>%PrU6L?
z`DJOEwhHE!NtQ{eX{qMMsRout7Um|#X~|~h28IS{X$C1KCP_xg#-;|w#)&BwCW%I-
zNhXG7iALr|#^#pBCI*&CmL^=tW+KfNY1%3nn_8rrC#IMrrC3-R877)qrX;6X7+544
zry3?FCL0)ASR`6nrkN(0BqkarCL0?Wr==R0rJ1Lu85tNQo13O_;ql3+6geRPj(DU<
zBF79udO-93IP<>|NET!M-`L!6bpD@ExKcyj+r>AGk%57M8Dtm-h+tr7fKUt|aS&4k
zM1U|81A{1tW?*2Dg3>Ux3|tDlqq!3rC_{)+Rsgk`6ktO_`9+{9e=gVp4?`|zPZwK5
z3j?FHq|`L70`SNqNGJ^oxRQ%f6H8J-gDtj7x%qkdIhiFHnaRNgiABY!N?csZ3a%9;
zsd*&|DTwJzuAp!QBLfo)h2Q|kpkP-8rK0@&63BW2kOt74Da1{QC5Z}7iN&d0$}TQW
zTwEzBNw5VN9^qk-6)Ot13Q8tQV5#)f{M^)%qDsBw%ACx+l+>bPkfafsWJYRY3RuF>
z3{9puHMt}oqRGq{A_pC-0r?JOR%S{nM7$(FKc^VU1xAJ@<|Y=#W+vuJqj_KmCH_&T
zj)uT!2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin5Do#cA?)^1r;mofXb6mk
zz-S1JhQMeDjE2By2#_8E(xht{)iD|ZqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF
z0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*U^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ON
UU^E0qLtr!nMnhmU1V|1605Gxf*8l(j

literal 0
HcmV?d00001

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6494d4885af2..cc136b1dbff1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10638,9 +10638,7 @@ with pkgs;
 
   otpw = callPackage ../os-specific/linux/otpw { };
 
-  ovftool = callPackage ../tools/virtualization/ovftool {
-    libressl = libressl_3_4;
-  };
+  ovftool = callPackage ../tools/virtualization/ovftool { };
 
   overcommit = callPackage ../development/tools/overcommit { };
 

From 5e6a7aab54dc26cfc8f2c14867f04972eb3b6fe5 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 15 Feb 2023 23:52:04 -0800
Subject: [PATCH 2/2] .editorconfig: exempt test OVA files packaged with
 ovftool

---
 .editorconfig | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.editorconfig b/.editorconfig
index 3ff05f9a7fa0..c9711d519408 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -95,3 +95,9 @@ trim_trailing_whitespace = unset
 
 [pkgs/tools/misc/timidity/timidity.cfg]
 trim_trailing_whitespace = unset
+
+[pkgs/tools/virtualization/ovftool/*.ova]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+charset = unset