nixpkgs/pkgs/servers/dns/knot-resolver/default.nix
Vladimír Čunát c3badbb366 knot-resolver: 1.2.0 -> 1.2.1
It mainly fixes a single issue that perhaps has a minor security impact.
https://lists.nic.cz/pipermail/knot-dns-users/2017-February/001045.html
2017-02-01 22:46:15 +01:00

70 lines
1.9 KiB
Nix

{ stdenv, fetchurl, pkgconfig, utillinux, hexdump, which
, knot-dns, luajit, libuv, lmdb
, cmocka, systemd, hiredis, libmemcached
, gnutls, nettle
, luajitPackages, makeWrapper
}:
let
inherit (stdenv.lib) optional;
in
stdenv.mkDerivation rec {
name = "knot-resolver-${version}";
version = "1.2.1";
src = fetchurl {
url = "http://secure.nic.cz/files/knot-resolver/${name}.tar.xz";
sha256 = "1b6f55ea1dfec90f45c437f23e1ab440e478570498161d0f8a8f94a439305f8c";
};
outputs = [ "out" "dev" ];
configurePhase = ":";
nativeBuildInputs = [ pkgconfig which makeWrapper hexdump ];
buildInputs = [ knot-dns luajit libuv gnutls ]
# TODO: lmdb needs lmdb.pc; embedded for now
## optional dependencies
++ optional doInstallCheck cmocka
++ optional stdenv.isLinux systemd # socket activation
++ [
nettle # DNS cookies
hiredis libmemcached # additional cache backends
# http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
];
makeFlags = [ "PREFIX=$(out)" ];
CFLAGS = [ "-O2" "-DNDEBUG" ];
enableParallelBuilding = true;
doInstallCheck = true;
installCheckTarget = "check";
preInstallCheck = ''
export LD_LIBRARY_PATH="$out/lib"
'';
# optional: to allow auto-bootstrapping root trust anchor via https
postInstall = with luajitPackages; ''
wrapProgram "$out/sbin/kresd" \
--set LUA_PATH '${
stdenv.lib.concatStringsSep ";"
(map getLuaPath [ luasec luasocket ])
}' \
--set LUA_CPATH '${
stdenv.lib.concatStringsSep ";"
(map getLuaCPath [ luasec luasocket ])
}'
'';
meta = with stdenv.lib; {
description = "Caching validating DNS resolver, from .cz domain registry";
homepage = https://knot-resolver.cz;
license = licenses.gpl3Plus;
platforms = platforms.unix;
maintainers = [ maintainers.vcunat /* upstream developer */ ];
};
}