From ef9d5133540f95b1146a895546eb87a80d5ea6ce Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 22:22:23 +0200
Subject: [PATCH] python3Packages.dnsight: init at 1.0.1

SDK and CLI tool for DNS, email and web security hygiene

https://github.com/dnsight/dnsight
---
 pkgs/by-name/dn/dnsight/package.nix           |  5 +
 .../python-modules/dnsight/default.nix        | 93 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 3 files changed, 100 insertions(+)
 create mode 100644 pkgs/by-name/dn/dnsight/package.nix
 create mode 100644 pkgs/development/python-modules/dnsight/default.nix

diff --git a/pkgs/by-name/dn/dnsight/package.nix b/pkgs/by-name/dn/dnsight/package.nix
new file mode 100644
index 000000000000..73f35e491ff1
--- /dev/null
+++ b/pkgs/by-name/dn/dnsight/package.nix
@@ -0,0 +1,5 @@
+{ python3Packages }:
+
+(python3Packages.toPythonApplication python3Packages.dnsight).overrideAttrs {
+  __structuredAttrs = true;
+}
diff --git a/pkgs/development/python-modules/dnsight/default.nix b/pkgs/development/python-modules/dnsight/default.nix
new file mode 100644
index 000000000000..b62625bad763
--- /dev/null
+++ b/pkgs/development/python-modules/dnsight/default.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  cryptography,
+  dnspython,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  httpx,
+  hypothesis,
+  iana-etc,
+  libredirect,
+  pydantic,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+  pyyaml,
+  rich,
+  typer,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "dnsight";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dnsight";
+    repo = "dnsight";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WoYLAqNTbMVe+kd/cG1MPRSlYMMYPWP8wm96qr3IdY8=";
+  };
+
+  pythonRelaxDeps = [ "typer" ];
+
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
+    cryptography
+    dnspython
+    httpx
+    pydantic
+    pyyaml
+    rich
+    typer
+  ];
+
+  nativeCheckInputs = [
+    hypothesis
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "dnsight" ];
+
+  preCheck = lib.optionalString stdenv.hostPlatform.isLinux ''
+    echo "nameserver 127.0.0.1" > resolv.conf
+    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/resolv.conf=$(realpath resolv.conf)
+    export LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
+
+  postCheck = ''
+    unset NIX_REDIRECTS LD_PRELOAD
+  '';
+
+  disabledTests = [
+    # AssertionError
+    "test_audit_explicit_domains_honour_global_config_path"
+    "test_audit_manifest_runs_only_configured_checks"
+    # AssertionError: assert (None is not None)
+    "test_check_dmarc_async_config_slice_overrides_config"
+    "test_check_dmarc_sync_config_slice_overrides_config"
+    "test_check_spf_sync_with_mgr"
+    "test_run_check_for_target_matches_run_zone"
+    "test_run_check_sync_dmarc"
+    "test_run_check_sync_programmatic_config_no_file"
+    "test_run_check_sync_yaml_plus_overlay_merge"
+  ];
+
+  meta = {
+    description = "SDK and CLI tool for DNS, email and web security hygiene";
+    homepage = "https://github.com/dnsight/dnsight";
+    changelog = "https://github.com/dnsight/dnsight/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "dnsight";
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a9dd0eda53f7..a94d80432684 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4535,6 +4535,8 @@ self: super: with self; {
 
   dns-lexicon = callPackage ../development/python-modules/dns-lexicon { };
 
+  dnsight = callPackage ../development/python-modules/dnsight { };
+
   dnslib = callPackage ../development/python-modules/dnslib { };
 
   dnspython = callPackage ../development/python-modules/dnspython { };