nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-02-12 07:04:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

unbound: lighten direct security deps of libunbound

Browse Source 
Unfortunately, it seems easiest to build all twice.
Debian testing does this in a very similar way.

Tested briefly some individual queries and resperf :-)
This commit is contained in:
Vladimír Čunát 2017-02-27 17:41:35 +01:00
parent 78e4f9d8d7
commit d00c26a595
No known key found for this signature in database
GPG Key ID: E747DF1F9575A3AA
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
pkgs/tools/networking/unbound/default.nix
View File

@ -1,4 +1,4 @@
{ stdenv, fetchurl, openssl, expat, libevent }: { stdenv, fetchurl, openssl, nettle, expat, libevent }:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
name = "unbound-${version}"; name = "unbound-${version}";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
buildInputs = [ openssl expat libevent ]; buildInputs = [ openssl nettle expat libevent ];
configureFlags = [ configureFlags = [
"--with-ssl=${openssl.dev}" "--with-ssl=${openssl.dev}"
@ -26,11 +26,20 @@ stdenv.mkDerivation rec {
installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ]; installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];
preFixup =
# Build libunbound again, but only against nettle instead of openssl.
# This avoids gnutls.out -> unbound.lib -> openssl.out.
''
configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
configurePhase
buildPhase
installPhase
''
# get rid of runtime dependencies on $dev outputs # get rid of runtime dependencies on $dev outputs
postInstall = ''substituteInPlace "$lib/lib/libunbound.la" '' + ''substituteInPlace "$lib/lib/libunbound.la" ''
+ stdenv.lib.concatMapStrings + stdenv.lib.concatMapStrings
(pkg: " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' ") (pkg: " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' ")
[ openssl expat libevent ]; buildInputs;
meta = with stdenv.lib; { meta = with stdenv.lib; {
description = "Validating, recursive, and caching DNS resolver"; description = "Validating, recursive, and caching DNS resolver";