diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix index c21f8ea8a644..99e5c4b1a09c 100644 --- a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix +++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix @@ -16,7 +16,7 @@ let find "$out" -mindepth 1 -delete cp ${lib.concatStringsSep " " list} "$out/" ''; - headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [ + headers = linkFarmFromDrvs "azure-dcap-client-intel-headers" [ (fetchFromGitHub rec { name = "${repo}-headers"; owner = "intel"; @@ -69,8 +69,8 @@ stdenv.mkDerivation rec { find -L '${headers}' -type f -exec ln -s {} src/Linux/ext/intel \; substitute src/Linux/Makefile{.in,} \ - --replace '##CURLINC##' '${curl.dev}/include/curl/' \ - --replace '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)' + --replace-fail '##CURLINC##' '${curl.dev}/include/curl/' \ + --replace-fail '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)' ''; env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations"; @@ -84,11 +84,11 @@ stdenv.mkDerivation rec { # $(nix-build -A sgx-azure-dcap-client.tests.suite)/bin/tests passthru.tests.suite = callPackage ./test-suite.nix { }; - meta = with lib; { + meta = { description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache"; homepage = "https://github.com/microsoft/azure-dcap-client"; - maintainers = with maintainers; [ phlip9 trundle veehaitch ]; + maintainers = with lib.maintainers; [ phlip9 trundle veehaitch ]; platforms = [ "x86_64-linux" ]; - license = [ licenses.mit ]; + license = [ lib.licenses.mit ]; }; } diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix index 42e00071d810..829b0c6525ec 100644 --- a/pkgs/os-specific/linux/sgx/psw/default.nix +++ b/pkgs/os-specific/linux/sgx/psw/default.nix @@ -29,11 +29,11 @@ stdenv.mkDerivation rec { # Also include the Data Center Attestation Primitives (DCAP) platform # enclaves. dcap = rec { - version = "1.20"; + version = "1.21"; filename = "prebuilt_dcap_${version}.tar.gz"; prebuilt = fetchurl { url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}"; - hash = "sha256-nPsI89KSBA3cSNTMWyktZP5dkf+BwL3NZ4MuUf6G98o="; + hash = "sha256-/PPD2MyNxoCwzNljIFcpkFvItXbyvymsJ7+Uf4IyZuk="; }; }; in @@ -158,31 +158,31 @@ stdenv.mkDerivation rec { # is helpful to have properly patched versions for non-NixOS distributions. echo "Fixing aesmd.service" substituteInPlace $out/lib/systemd/system/aesmd.service \ - --replace '@aesm_folder@' \ - "$out/aesm" \ - --replace 'Type=forking' \ - 'Type=simple' \ - --replace "ExecStart=$out/aesm/aesm_service" \ - "ExecStart=$out/bin/aesm_service --no-daemon"\ - --replace "/bin/mkdir" \ - "${coreutils}/bin/mkdir" \ - --replace "/bin/chown" \ - "${coreutils}/bin/chown" \ - --replace "/bin/chmod" \ - "${coreutils}/bin/chmod" \ - --replace "/bin/kill" \ - "${coreutils}/bin/kill" + --replace-fail '@aesm_folder@' \ + "$out/aesm" \ + --replace-fail 'Type=forking' \ + 'Type=simple' \ + --replace-fail "ExecStart=$out/aesm/aesm_service" \ + "ExecStart=$out/bin/aesm_service --no-daemon"\ + --replace-fail "/bin/mkdir" \ + "${coreutils}/bin/mkdir" \ + --replace-fail "/bin/chown" \ + "${coreutils}/bin/chown" \ + --replace-fail "/bin/chmod" \ + "${coreutils}/bin/chmod" \ + --replace-fail "/bin/kill" \ + "${coreutils}/bin/kill" ''; passthru.tests = { service = nixosTests.aesmd; }; - meta = with lib; { + meta = { description = "Intel SGX Architectural Enclave Service Manager"; homepage = "https://github.com/intel/linux-sgx"; - maintainers = with maintainers; [ phlip9 veehaitch citadelcore ]; + maintainers = with lib.maintainers; [ phlip9 veehaitch citadelcore ]; platforms = [ "x86_64-linux" ]; - license = with licenses; [ bsd3 ]; + license = [ lib.licenses.bsd3 ]; }; } diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix index 67489ee3c07c..4f7374d634f3 100644 --- a/pkgs/os-specific/linux/sgx/sdk/default.nix +++ b/pkgs/os-specific/linux/sgx/sdk/default.nix @@ -26,15 +26,15 @@ stdenv.mkDerivation rec { pname = "sgx-sdk"; # Version as given in se_version.h - version = "2.23.100.2"; + version = "2.24.100.3"; # Version as used in the Git tag - versionTag = "2.23"; + versionTag = "2.24"; src = fetchFromGitHub { owner = "intel"; repo = "linux-sgx"; rev = "sgx_${versionTag}"; - hash = "sha256-i+fE6xKiuljG8LY8TIHgrW15DVpdp46bZdNo/BjgT/I="; + hash = "sha256-1urEdfMKNUqqyJ3wQ10+tvtlRuAKELpaCWIOzjCbYKw="; fetchSubmodules = true; }; @@ -121,8 +121,6 @@ stdenv.mkDerivation rec { pushd 'external/ippcp_internal' - cp -r ${ipp-crypto-no_mitigation}/include/. inc/ - install -D -m a+rw ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a \ lib/linux/intel64/no_mitigation/libippcp.a install -D -m a+rw ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a \ @@ -130,8 +128,13 @@ stdenv.mkDerivation rec { install -D -m a+rw ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a \ lib/linux/intel64/cve_2020_0551_cf/libippcp.a + cp -r ${ipp-crypto-no_mitigation}/include/* inc/ + + mkdir inc/ippcp + cp ${ipp-crypto-no_mitigation}/include/fips_cert.h inc/ippcp/ + rm inc/ippcp.h - patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i inc/ippcp21u7.patch -o inc/ippcp.h + patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp21u11.patch -o ./inc/ippcp.h install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE @@ -285,11 +288,11 @@ stdenv.mkDerivation rec { ''; }; - meta = with lib; { + meta = { description = "Intel SGX SDK for Linux built with IPP Crypto Library"; homepage = "https://github.com/intel/linux-sgx"; - maintainers = with maintainers; [ phlip9 sbellem arturcygan veehaitch ]; + maintainers = with lib.maintainers; [ phlip9 sbellem arturcygan veehaitch ]; platforms = [ "x86_64-linux" ]; - license = with licenses; [ bsd3 ]; + license = [ lib.licenses.bsd3 ]; }; } diff --git a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch index bdf9b9f9136e..c045606df144 100644 --- a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch +++ b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch @@ -1,8 +1,8 @@ diff --git a/Makefile b/Makefile -index 32433051..2e480efb 100644 +index 73502a7..f24bd11 100644 --- a/Makefile +++ b/Makefile -@@ -50,8 +50,8 @@ tips: +@@ -50,18 +50,18 @@ tips: preparation: # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip. # Only enable the download from git @@ -12,8 +12,10 @@ index 32433051..2e480efb 100644 + # ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R +- cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R ++ cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R ./external/sgx-emm/create_symlink.sh -@@ -59,8 +59,8 @@ preparation: + cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R cd external/cbor && cp -r libcbor sgx_libcbor cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix index c72a0c528516..eba9e7f6a0e5 100644 --- a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix +++ b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix @@ -8,16 +8,20 @@ }: gcc11Stdenv.mkDerivation rec { pname = "ipp-crypto"; - version = "2021.10.0"; + version = "2021.11.1"; src = fetchFromGitHub { owner = "intel"; repo = "ipp-crypto"; rev = "ippcp_${version}"; - hash = "sha256-DfXsJ+4XqyjCD+79LUD53Cx8D46o1a4fAZa2UxGI1Xg="; + hash = "sha256-OgNrrPE8jFVD/hcv7A43Bno96r4Z/lb7/SE6TEL7RDI="; }; - cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags; + cmakeFlags = [ + "-DARCH=intel64" + # sgx-sdk now requires FIPS-compliance mode turned on + "-DIPPCP_FIPS_MODE=on" + ] ++ extraCmakeFlags; nativeBuildInputs = [ cmake diff --git a/pkgs/os-specific/linux/sgx/ssl/default.nix b/pkgs/os-specific/linux/sgx/ssl/default.nix index 94d7e20b21c4..73cde2e030af 100644 --- a/pkgs/os-specific/linux/sgx/ssl/default.nix +++ b/pkgs/os-specific/linux/sgx/ssl/default.nix @@ -10,7 +10,7 @@ }: let sgxVersion = sgx-sdk.versionTag; - opensslVersion = "3.0.12"; + opensslVersion = "3.0.13"; in stdenv.mkDerivation { pname = "sgx-ssl" + lib.optionalString debug "-debug"; @@ -27,7 +27,7 @@ stdenv.mkDerivation { let opensslSourceArchive = fetchurl { url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz"; - hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E="; + hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM="; }; in '' @@ -39,8 +39,8 @@ stdenv.mkDerivation { # Skip the tests. Build and run separately (see below). substituteInPlace Linux/sgx/Makefile \ - --replace '$(MAKE) -C $(TEST_DIR) all' \ - 'bash -c "true"' + --replace-fail '$(MAKE) -C $(TEST_DIR) all' \ + 'bash -c "true"' ''; nativeBuildInputs = [ @@ -71,11 +71,11 @@ stdenv.mkDerivation { SIM = callPackage ./tests.nix { sgxMode = "SIM"; inherit opensslVersion; }; }; - meta = with lib; { + meta = { description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL"; homepage = "https://github.com/intel/intel-sgx-ssl"; - maintainers = with maintainers; [ phlip9 trundle veehaitch ]; + maintainers = with lib.maintainers; [ phlip9 trundle veehaitch ]; platforms = [ "x86_64-linux" ]; - license = [ licenses.bsd3 licenses.openssl ]; + license = with lib.licenses; [ bsd3 openssl ]; }; }