From 95f3d6da26f281fa6dd14f14c82ec6452780bdaf Mon Sep 17 00:00:00 2001
From: Lucas Bergman <lucas@bergmans.us>
Date: Mon, 12 Jan 2026 13:55:40 +0000
Subject: [PATCH] openarc: init at 1.3.0

OpenARC is an implementation of RFC 8617, a protocol for attaching a
digitally signed chain of custody to mail messages. This is especially
useful when a host wants to forward mail for that host's users to another
provider. For example, Gmail recommends[1] that forwarding hosts attach an
ARC seal to messages.

The original implementation[2] from the Trusted Domain Project has not been
touched in about eight years, so this packages the @flowerysong repo. That
is the same version packaged by Arch Linux[3].

1. https://support.google.com/a/answer/81126
2. https://github.com/trusteddomainproject/OpenARC
3. https://wiki.archlinux.org/title/OpenARC
---
 pkgs/by-name/op/openarc/package.nix | 83 +++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)
 create mode 100644 pkgs/by-name/op/openarc/package.nix

diff --git a/pkgs/by-name/op/openarc/package.nix b/pkgs/by-name/op/openarc/package.nix
new file mode 100644
index 000000000000..b099b562de14
--- /dev/null
+++ b/pkgs/by-name/op/openarc/package.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  autoreconfHook,
+  fetchFromGitHub,
+  makeWrapper,
+  stdenv,
+
+  jansson,
+  libidn2,
+  libmilter,
+  openssl,
+  pkg-config,
+  python3,
+  python3Packages,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openarc";
+  version = "1.3.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "flowerysong";
+    repo = "OpenARC";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eEQ0iiAt/RCxHJPpEiZY1TNgjGJjg+kMsVWI7vNaWlc=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    jansson
+    libidn2
+    libmilter
+    openssl
+  ];
+
+  enableParallelBuilding = true;
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-DBIND_8_COMPAT";
+
+  postInstall = ''
+    wrapProgram $out/bin/openarc-keygen \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          openssl
+          python3
+        ]
+      }
+  '';
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    openssl
+    python3Packages.miltertest
+    python3Packages.pytest
+  ];
+
+  # The build sandbox breaks these file permission tests
+  preCheck = ''
+    substituteInPlace test/test_config.py \
+      --replace-fail "def test_config_requiresafekeys" "def disabled_test_config_requiresafekeys"
+  '';
+
+  meta = {
+    homepage = "https://github.com/flowerysong/OpenARC";
+    description = "Open source library and filter for adding Authenticated Received Chain (ARC) support (RFC 8617) to email messages";
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = with lib.licenses; [
+      bsd2
+      sendmail
+    ];
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ lucasbergman ];
+    mainProgram = "openarc";
+  };
+})