ovftool: 4.6.2 -> 4.6.3
This removes the vulnerable version of OpenSSL that was packaged before and switches to OpenSSL 3 on Linux. macOS is still on OpenSSL 1.0.2. Since ovftool is now published by Broadcom, they have a new, exciting EULA that its usage is now gated behind. Since the website has a POST endpoint to download it now (but it's at least possible without an account) we can still automate it but need to add an `acceptBroadcomEula` package override argument that's false by default, similarly to how we handle Android. The license has not changed; it is still unfree.
This commit is contained in:
Morgan Jones
committed by
Morgan Jones
Morgan Jones
parent
8cd78079a4
commit
ee48cc91f8
@@ -1,62 +1,108 @@
|
||||
{
|
||||
autoPatchelfHook,
|
||||
c-ares,
|
||||
curl,
|
||||
darwin,
|
||||
expat,
|
||||
fetchurl,
|
||||
glibc,
|
||||
icu60,
|
||||
jq,
|
||||
lib,
|
||||
libiconv,
|
||||
libredirect,
|
||||
libxcrypt-legacy,
|
||||
libxml2,
|
||||
makeWrapper,
|
||||
openssl,
|
||||
stdenv,
|
||||
unzip,
|
||||
xercesc,
|
||||
zlib,
|
||||
acceptBroadcomEula ? false,
|
||||
}:
|
||||
|
||||
let
|
||||
# Returns the base URL for the given tool ID.
|
||||
mkBaseUrl = toolId: "https://developer.broadcom.com/tools/${toolId}/latest";
|
||||
ovftoolId = "open-virtualization-format-ovf-tool";
|
||||
|
||||
ovftoolSystems =
|
||||
let
|
||||
baseUrl = "https://vdc-download.vmware.com/vmwb-repository/dcr-public";
|
||||
in
|
||||
# Use browser devtools to figure out how this works.
|
||||
fetchFromBroadcom =
|
||||
{
|
||||
"i686-linux" = rec {
|
||||
name = "VMware-ovftool-${version}-lin.i386.zip";
|
||||
# As of 2024-02-20 the "Zip of OVF Tool for 32-bit Linux" download link
|
||||
# on the v4.6.2 page links to v4.6.0.
|
||||
version = "4.6.0-21452615";
|
||||
url = "${baseUrl}/7254abb2-434d-4f5d-83e2-9311ced9752e/57e666a2-874c-48fe-b1d2-4b6381f7fe97/${name}";
|
||||
hash = "sha256-qEOr/3SW643G5ZQQNJTelZbUxB8HmxPd5uD+Gqsoxz0=";
|
||||
};
|
||||
"x86_64-linux" = rec {
|
||||
name = "VMware-ovftool-${version}-lin.x86_64.zip";
|
||||
version = "4.6.2-22220919";
|
||||
url = "${baseUrl}/8a93ce23-4f88-4ae8-b067-ae174291e98f/c609234d-59f2-4758-a113-0ec5bbe4b120/${name}";
|
||||
hash = "sha256-3B1cUDldoTqLsbSARj2abM65nv+Ot0z/Fa35/klJXEY=";
|
||||
};
|
||||
"x86_64-darwin" = rec {
|
||||
name = "VMware-ovftool-${version}-mac.x64.zip";
|
||||
version = "4.6.2-22220919";
|
||||
url = "${baseUrl}/91091b23-280a-487a-a048-0c2594303c92/dc666e23-104f-4b9b-be11-6d88dcf3ab98/${name}";
|
||||
hash = "sha256-AZufZ0wxt5DYjnpahDfy36W8i7kjIfEkW6MoELSx11k=";
|
||||
fileName,
|
||||
version,
|
||||
toolId ? ovftoolId,
|
||||
artifactId ? 21342,
|
||||
fileType ? "Download",
|
||||
source ? "",
|
||||
hash ? "",
|
||||
}:
|
||||
let
|
||||
requestJson = builtins.toJSON {
|
||||
inherit
|
||||
fileName
|
||||
artifactId
|
||||
fileType
|
||||
source
|
||||
;
|
||||
};
|
||||
in
|
||||
fetchurl {
|
||||
name = fileName;
|
||||
url =
|
||||
(mkBaseUrl toolId)
|
||||
+ "?p_p_id=SDK_AND_TOOL_DETAILS_INSTANCE_iwlk&p_p_lifecycle=2&p_p_resource_id=documentDownloadArtifact";
|
||||
curlOptsList = [
|
||||
"--json"
|
||||
requestJson
|
||||
];
|
||||
downloadToTemp = true;
|
||||
nativeBuildInputs = [ jq ];
|
||||
postFetch = ''
|
||||
# Try again with the new URL
|
||||
urls="$(jq -r 'if (.success == true) then .data.downloadUrl else error(. | tostring) end' < "$downloadedFile" || exit $?)" \
|
||||
downloadToTemp="" \
|
||||
curlOptsList="" \
|
||||
curlOpts="" \
|
||||
postFetch="" \
|
||||
exec "$SHELL" "''${BASH_ARGV[@]}"
|
||||
'';
|
||||
inherit hash;
|
||||
};
|
||||
|
||||
ovftoolSystem = ovftoolSystems.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
|
||||
ovftoolSystems = {
|
||||
"x86_64-linux" = rec {
|
||||
version = "4.6.3-24031167";
|
||||
fileName = "VMware-ovftool-${version}-lin.x86_64.zip";
|
||||
hash = "sha256-NEwwgmEh/mrZkMMhI+Kq+SYdd3MJ0+IBLdUhd1+kPow=";
|
||||
};
|
||||
"x86_64-darwin" = rec {
|
||||
version = "4.6.3-24031167";
|
||||
fileName = "VMware-ovftool-${version}-mac.x64.zip";
|
||||
hash = "sha256-vhACcc4tjaQhvKwZyWkgpaKaoC+coWGl1zfSIC6WebM=";
|
||||
};
|
||||
};
|
||||
|
||||
ovftoolSystem = ovftoolSystems.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
|
||||
in
|
||||
stdenv.mkDerivation {
|
||||
stdenv.mkDerivation (final: {
|
||||
pname = "ovftool";
|
||||
inherit (ovftoolSystem) version;
|
||||
|
||||
src = fetchurl {
|
||||
inherit (ovftoolSystem) name url hash;
|
||||
};
|
||||
src =
|
||||
if acceptBroadcomEula then
|
||||
fetchFromBroadcom {
|
||||
inherit (ovftoolSystem) fileName version hash;
|
||||
}
|
||||
else
|
||||
throw ''
|
||||
See the following URL for terms of using this software:
|
||||
${mkBaseUrl ovftoolId}
|
||||
|
||||
Use `${final.pname}.override { acceptBroadcomEula = true; }` if you accept Broadcom's terms
|
||||
and would like to use this package.
|
||||
'';
|
||||
|
||||
buildInputs =
|
||||
[
|
||||
@@ -67,9 +113,11 @@ stdenv.mkDerivation {
|
||||
libxcrypt-legacy
|
||||
xercesc
|
||||
zlib
|
||||
curl
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isLinux [
|
||||
glibc
|
||||
openssl
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isDarwin [
|
||||
darwin.Libsystem
|
||||
@@ -98,12 +146,11 @@ stdenv.mkDerivation {
|
||||
# with the addition of a libexec directory and a Nix-style binary wrapper.
|
||||
|
||||
# Almost all libs in the package appear to be VMware proprietary except for
|
||||
# libgoogleurl and libcurl. The rest of the libraries that the installer
|
||||
# extracts are omitted here, and provided in buildInputs. Since libcurl
|
||||
# depends on VMware's OpenSSL, both libs are still used.
|
||||
# libgoogleurl and libcurl.
|
||||
#
|
||||
# FIXME: Replace libgoogleurl? Possibly from Chromium?
|
||||
# FIXME: Tell VMware to use a modern version of OpenSSL. As of ovftool
|
||||
# v4.6.2 ovftool uses openssl-1.0.2zh which in seems to be the extended
|
||||
# FIXME: Tell VMware to use a modern version of OpenSSL on macOS. As of ovftool
|
||||
# v4.6.3 ovftool uses openssl-1.0.2zj which in seems to be the extended
|
||||
# support LTS release: https://www.openssl.org/support/contracts.html
|
||||
|
||||
# Install all libs that are not patched in preFixup.
|
||||
@@ -112,18 +159,15 @@ stdenv.mkDerivation {
|
||||
install -m 644 -t "$out/lib" \
|
||||
''
|
||||
+ lib.optionalString stdenv.hostPlatform.isLinux ''
|
||||
libcrypto.so.1.0.2 \
|
||||
libcurl.so.4 \
|
||||
libgoogleurl.so.59 \
|
||||
libssl.so.1.0.2 \
|
||||
libssoclient.so \
|
||||
libvim-types.so \
|
||||
libvmacore.so \
|
||||
libvmomi.so
|
||||
''
|
||||
# macOS still relies on OpenSSL 1.0.2 as of v4.6.3, but Linux is in the clear
|
||||
+ lib.optionalString stdenv.hostPlatform.isDarwin ''
|
||||
lib/libcrypto.1.0.2.dylib \
|
||||
lib/libcurl.4.dylib \
|
||||
lib/libgoogleurl.59.0.30.45.2.dylib \
|
||||
lib/libssl.1.0.2.dylib \
|
||||
lib/libssoclient.dylib \
|
||||
@@ -152,6 +196,7 @@ stdenv.mkDerivation {
|
||||
install -m 644 -t "$out/share/licenses" \
|
||||
"vmware.eula" \
|
||||
"vmware-eula.rtf" \
|
||||
"README.txt" \
|
||||
"open_source_licenses.txt"
|
||||
|
||||
# Install Docs
|
||||
@@ -197,8 +242,12 @@ stdenv.mkDerivation {
|
||||
change_args+=(-change @loader_path/lib/libicuuc.60.2.dylib ${icu60}/lib/libicuuc.60.2.dylib)
|
||||
change_args+=(-change @loader_path/lib/libxerces-c-3.2.dylib ${xercesc}/lib/libxerces-c-3.2.dylib)
|
||||
|
||||
# lolwut
|
||||
change_args+=(-change @GOBUILD_CAYMAN_CURL_ROOT@/apple_mac64/lib/libcurl.4.dylib ${curl.out}/lib/libcurl.4.dylib)
|
||||
|
||||
# Patch binary
|
||||
install_name_tool "''${change_args[@]}" "$out/libexec/ovftool"
|
||||
otool -L "$out/libexec/ovftool"
|
||||
|
||||
# Additional patches for ovftool dylibs
|
||||
change_args+=(-change /usr/lib/libresolv.9.dylib ${darwin.Libsystem}/lib/libresolv.9.dylib)
|
||||
@@ -208,7 +257,7 @@ stdenv.mkDerivation {
|
||||
change_args+=(-change @loader_path/libicuuc.60.2.dylib ${icu60}/lib/libicuuc.60.2.dylib)
|
||||
change_args+=(-change @loader_path/libxerces-c-3.2.dylib ${xercesc}/lib/libxerces-c-3.2.dylib)
|
||||
|
||||
# Add new abolute paths for other libs to all libs
|
||||
# Add new absolute paths for other libs to all libs
|
||||
for lib in $out/lib/*.dylib; do
|
||||
libname=$(basename $lib)
|
||||
change_args+=(-change "@loader_path/$libname" "$out/lib/$libname")
|
||||
@@ -219,6 +268,7 @@ stdenv.mkDerivation {
|
||||
libname=$(basename $lib)
|
||||
install_name_tool -id "$libname" "$lib"
|
||||
install_name_tool "''${change_args[@]}" "$lib"
|
||||
otool -L "$lib"
|
||||
done
|
||||
'';
|
||||
|
||||
@@ -229,29 +279,34 @@ stdenv.mkDerivation {
|
||||
(allow file-read* (subpath "/System/Library/TextEncodings"))
|
||||
'';
|
||||
|
||||
doInstallCheck = true;
|
||||
# Seems to get stuck and return 255, but works outside the sandbox
|
||||
doInstallCheck = !stdenv.hostPlatform.isDarwin;
|
||||
|
||||
postInstallCheck =
|
||||
lib.optionalString stdenv.hostPlatform.isDarwin ''
|
||||
export HOME=$TMPDIR
|
||||
# Construct a dummy /etc/passwd file - ovftool attempts to determine the
|
||||
# user's "real" home using this
|
||||
DUMMY_PASSWD="$(realpath $HOME/dummy-passwd)"
|
||||
DUMMY_PASSWD="$HOME/dummy-passwd"
|
||||
cat > $DUMMY_PASSWD <<EOF
|
||||
$(whoami)::$(id -u):$(id -g)::$HOME:$SHELL
|
||||
EOF
|
||||
export DYLD_INSERT_LIBRARIES="${libredirect}/lib/libredirect.dylib"
|
||||
export NIX_REDIRECTS="/etc/passwd=$DUMMY_PASSWD"
|
||||
export NIX_REDIRECTS="/etc/passwd=$(realpath "$DUMMY_PASSWD")"
|
||||
''
|
||||
+ ''
|
||||
mkdir -p ovftool-check && cd ovftool-check
|
||||
|
||||
ovftool_with_args="$out/bin/ovftool --X:logToConsole"
|
||||
|
||||
# There are non-fatal warnings if we don't provide this, due to the sandbox.
|
||||
export LC_ALL=C
|
||||
|
||||
# `installCheckPhase.ova` is a NixOS 22.11 image (doesn't actually matter)
|
||||
# with a 1 MiB root disk that's all zero. Make sure that it converts
|
||||
# properly.
|
||||
|
||||
set -x
|
||||
$ovftool_with_args --schemaValidate ${./installCheckPhase.ova}
|
||||
$ovftool_with_args --sourceType=OVA --targetType=OVF ${./installCheckPhase.ova} nixos.ovf
|
||||
|
||||
@@ -261,6 +316,7 @@ stdenv.mkDerivation {
|
||||
test -f nixos-disk1.vmdk
|
||||
|
||||
$ovftool_with_args --schemaValidate nixos.ovf
|
||||
set +x
|
||||
'';
|
||||
|
||||
meta = with lib; {
|
||||
@@ -274,15 +330,13 @@ stdenv.mkDerivation {
|
||||
];
|
||||
platforms = builtins.attrNames ovftoolSystems;
|
||||
mainProgram = "ovftool";
|
||||
knownVulnerabilities = [
|
||||
"The bundled version of openssl 1.0.2zh in ovftool has open vulnerabilities."
|
||||
knownVulnerabilities = lib.optionals (stdenv.isDarwin) [
|
||||
"The bundled version of openssl 1.0.2zj in ovftool for Darwin has open vulnerabilities."
|
||||
"https://openssl-library.org/news/vulnerabilities-1.0.2/"
|
||||
"CVE-2024-0727"
|
||||
"CVE-2023-5678"
|
||||
"CVE-2023-3817"
|
||||
"CVE-2009-3767"
|
||||
"CVE-2009-3766"
|
||||
"CVE-2009-3765"
|
||||
"CVE-2009-1390"
|
||||
"CVE-2024-5535"
|
||||
"CVE-2024-9143"
|
||||
"CVE-2024-13176"
|
||||
];
|
||||
};
|
||||
}
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user