diff --git a/modules/athena-bccr/sys.nix b/modules/athena-bccr/sys.nix index 5457ca5..2dd56e2 100644 --- a/modules/athena-bccr/sys.nix +++ b/modules/athena-bccr/sys.nix @@ -6,20 +6,17 @@ ... }: let athena = pkgs.${doctrine.prefix}.athena-bccr.${cfg.release}; - inherit (athena) vendor; in { environment = { - etc = - { - "pkcs11/modules/${vendor}".text = '' - module: ${athena.pkcs11-module} - ''; - } - // lib.optionalAttrs (vendor == "athena") { - "Athena".source = "${athena.card-driver}/etc/Athena"; - }; + etc = { + "Athena".source = "${athena.ase-pkcs11}/etc/Athena"; - systemPackages = [athena.card-driver]; + "pkcs11/modules/asep11".text = '' + module: ${athena.libasep11} + ''; + }; + + systemPackages = [athena.ase-pkcs11]; }; security = { diff --git a/modules/waybar/hm.nix b/modules/waybar/hm.nix index 6149a63..1bfa3e2 100644 --- a/modules/waybar/hm.nix +++ b/modules/waybar/hm.nix @@ -101,9 +101,9 @@ with lib; { box-shadow: none; } - /* Entire bar: solid black, no border */ + /* Entire bar: fully transparent, no border */ window#waybar { - background: #000000; + background: transparent; color: #eaeaea; margin: 0; padding: 0; diff --git a/pkgs/athena-bccr/default.nix b/pkgs/athena-bccr/default.nix index c4a8575..a5f79ca 100644 --- a/pkgs/athena-bccr/default.nix +++ b/pkgs/athena-bccr/default.nix @@ -2,7 +2,7 @@ callPackage, lib, }: let - latest = "deb64-rev26.2"; + latest = "deb64-rev26"; releases = lib.mapAttrs (name: release: release // {name = name;}) (import ./releases.nix); @@ -16,16 +16,15 @@ }; pkgsForRelease = release: let - inherit (unwrapped) card-driver bccr-cacerts; - + ase-pkcs11 = unwrapped.ase-idprotect.lib; + libasep11 = "${ase-pkcs11}/lib/x64-athena/libASEP11.so"; unwrapped = overrideUnwrapped {inherit release;} {}; - pkcs11-module = "${card-driver.lib}/${card-driver.pkcs11-path}"; in { - inherit card-driver bccr-cacerts pkcs11-module; - inherit (release) vendor; + inherit ase-pkcs11 libasep11; + inherit (unwrapped) ase-idprotect bccr-cacerts; gaudi = callPackage ./gaudi-env.nix {inherit unwrapped;}; - firmador = callPackage ./firmador.nix {inherit pkcs11-module;}; + firmador = callPackage ./firmador.nix {inherit libasep11;}; }; in lib.mapAttrs (_: pkgsForRelease) (releases // {latest = releases.${latest};}) diff --git a/pkgs/athena-bccr/firmador.nix b/pkgs/athena-bccr/firmador.nix index 82578e8..e07235b 100644 --- a/pkgs/athena-bccr/firmador.nix +++ b/pkgs/athena-bccr/firmador.nix @@ -5,7 +5,7 @@ maven, openjdk, wrapGAppsHook3, - pkcs11-module ? null, + libasep11 ? null, }: let jdk = openjdk.override { enableJavaFX = true; @@ -34,8 +34,8 @@ in wrapGAppsHook3 ]; - postPatch = lib.optionalString (pkcs11-module != null) '' - sed -i 's@/usr/lib/x64-athena/libASEP11.so@${pkcs11-module}@g' src/main/java/cr/libre/firmador/signers/CRSigner.java + postPatch = lib.optionalString (libasep11 != null) '' + sed -i 's@/usr/lib/x64-athena/libASEP11.so@${libasep11}@g' src/main/java/cr/libre/firmador/signers/CRSigner.java ''; installPhase = '' diff --git a/pkgs/athena-bccr/gaudi-env.nix b/pkgs/athena-bccr/gaudi-env.nix index db79641..0ca1b82 100644 --- a/pkgs/athena-bccr/gaudi-env.nix +++ b/pkgs/athena-bccr/gaudi-env.nix @@ -12,7 +12,7 @@ in name = "gaudi"; targetPkgs = pkgs: [ - unwrappedWithGaudi.card-driver.lib + unwrappedWithGaudi.ase-idprotect.lib unwrappedWithGaudi.gaudi (writeShellScriptBin "launch-gaudi" '' diff --git a/pkgs/athena-bccr/releases.nix b/pkgs/athena-bccr/releases.nix index cbc5bdb..e965172 100644 --- a/pkgs/athena-bccr/releases.nix +++ b/pkgs/athena-bccr/releases.nix @@ -2,26 +2,11 @@ "deb64-rev26" = { # nix hash convert --hash-algo sha256 --from base16 --to sri $(sha256sum sfd_ClientesLinux_DEB64_Rev26.zip | cut -d' ' -f1) hash = "sha256-ZPWP9TqJQ5coJAPzUSiaXKVItBWlqFM4smCjOf+gqQM="; - filename = "sfd_ClientesLinux_DEB64_Rev26.zip"; basename = "sfd_ClientesLinux_DEB64_Rev26"; - vendor = "athena"; srcPaths = { gaudi = "Firma Digital/Agente GAUDI/agente-gaudi_20.0_amd64.deb"; idprotect = "Firma Digital/PinTool/IDProtect PINTool 7.24.02/DEB/idprotectclient_7.24.02-0_amd64.deb"; }; }; - - "deb64-rev26.2" = { - # nix hash convert --hash-algo sha256 --from base16 --to sri $(sha256sum sfd_ClientesLinux_DEB64_Ubuntu24_rev26_02 | cut -d' ' -f1) - hash = "sha256-DNzP0YRnuUbfKLhi7JeQCirdGx4kM7ROqHDkTuVs0mA="; - filename = "sfd_ClientesLinux_DEB64_Ubuntu24_rev26_02.zip"; - basename = "sfd_ClientesLinux_DEB64_Ubuntu24_26_02"; - vendor = "idopte"; - - srcPaths = { - gaudi = "Firma Digital/Agente GAUDI/agente-gaudi_27.0_amd64.deb"; - idopte = "Firma Digital/Idopte/Idopte_6.23.44.0_ubun24_amd64.deb"; - }; - }; } diff --git a/pkgs/athena-bccr/unwrapped.nix b/pkgs/athena-bccr/unwrapped.nix index c7781e4..d6f3f38 100644 --- a/pkgs/athena-bccr/unwrapped.nix +++ b/pkgs/athena-bccr/unwrapped.nix @@ -5,11 +5,11 @@ gaudiHash ? null, ... }: let - inherit (release) srcPaths vendor; + inherit (release) srcPaths; src = requireFile { url = "https://soportefirmadigital.com"; - name = release.filename; + name = "${release.basename}.zip"; inherit (release) hash; }; @@ -42,7 +42,7 @@ ''; } // lib.removeAttrs args ["stdenv" "dpkg" "unzip" "srcPath" "nativeBuildInputs"]); - +in { ase-idprotect = { autoPatchelfHook, dpkg, @@ -89,200 +89,138 @@ preFixup = '' patchelf --set-rpath $lib/lib/x64-athena $out/bin/* ''; - - passthru.pkcs11-path = "lib/x64-athena/libASEP11.so"; }; - scmiddleware = { + gaudi = { autoPatchelfHook, dpkg, - glib, - gtk3, - libappindicator-gtk3, - libnotify, - openssl, - pcsclite, + makeWrapper, + openjdk, + pkgs, stdenv, unzip, - webkitgtk_4_1, + writeShellScriptBin, + update-gaudi, ... - }: - moduleFromDeb "idopte-scmiddleware" { - inherit dpkg stdenv unzip; - srcPath = srcPaths.idopte; + }: let + jdk = openjdk.override { + enableJavaFX = true; + openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override {withWebKit = true;}; + }; - buildInputs = [ - glib - gtk3 - libappindicator-gtk3 - libnotify - openssl - pcsclite - stdenv.cc.cc.lib - webkitgtk_4_1 - ]; + fakeSudo = writeShellScriptBin "sudo" ""; + gaudiUpdate = gaudiUpdateSrc {inherit update-gaudi;}; + in + moduleFromDeb "gaudi" { + inherit dpkg stdenv unzip; + srcPath = srcPaths.gaudi; nativeBuildInputs = [ autoPatchelfHook + jdk + makeWrapper ]; - outputs = ["out" "lib"]; + preBuild = lib.optionalString (gaudiHash != null) '' + unzip -o ${gaudiUpdate} -d opt/Agente-GAUDI/lib/app + ''; + + buildPhase = '' + runHook preBuild + + install -m755 -d $out/{bin,opt/Firmador-BCCR/lib} + cp -r opt/Agente-GAUDI/lib/app $out/opt/Firmador-BCCR/lib/app + + # Preserves the original filename and avoids -LaunchGaudi.java + ln -s ${./LaunchGaudi.java} LaunchGaudi.java + + javac \ + -cp opt/Agente-GAUDI/lib/app/bccr-firma-fva-clienteMultiplataforma.jar \ + -d $out/opt/Firmador-BCCR/lib/app \ + LaunchGaudi.java + + runHook postBuild + ''; installPhase = '' runHook preInstall - install -m755 -d $out/bin $lib/{etc,lib/SCMiddleware} - install -m755 usr/lib/SCMiddleware/{idocachesrv,SCManager} $out/bin - install -m755 usr/lib/SCMiddleware/*.so $lib/lib/SCMiddleware - cp -r etc/id* $lib/etc + install -m755 -d $out/{share,opt/Firmador-BCCR/lib/runtime/lib} + install -m755 -D opt/Agente-GAUDI/bin/Agente-GAUDI $out/opt/Firmador-BCCR/bin/Agente-GAUDI + install -m755 -D opt/Agente-GAUDI/lib/libapplauncher.so $out/opt/Firmador-BCCR/lib/libapplauncher.so + + ln -s ../opt/Firmador-BCCR/lib/app $out/share/java + ln -s Firmador-BCCR $out/opt/Agente-GAUDI + ln -s ${jdk}/lib/openjdk/lib/libjli.so $out/opt/Firmador-BCCR/lib/runtime/lib/libjli.so + + makeWrapper ${jdk}/bin/java $out/bin/gaudi \ + --prefix PATH : ${fakeSudo}/bin \ + --add-flags "-cp $out/share/java:$out/share/java/bccr-firma-fva-clienteMultiplataforma.jar" \ + --add-flags "-Djavax.net.ssl.trustStore=$out/opt/Firmador-BCCR/lib/app/bccr.cacerts" \ + --add-flags "LaunchGaudi" runHook postInstall ''; - - preFixup = '' - patchelf --set-rpath $lib/lib/SCMiddleware $lib/lib/SCMiddleware/* $out/bin/* - ''; - - passthru.pkcs11-path = "lib/SCMiddleware/libidop11.so"; }; -in - { - gaudi = { - autoPatchelfHook, - dpkg, - makeWrapper, - openjdk, - pkgs, - stdenv, - unzip, - writeShellScriptBin, - update-gaudi, - ... - }: let - jdk = openjdk.override { - enableJavaFX = true; - openjfx_jdk = pkgs."openjfx${lib.head (lib.splitString "." openjdk.version)}".override {withWebKit = true;}; - }; - fakeSudo = writeShellScriptBin "sudo" ""; - gaudiUpdate = gaudiUpdateSrc {inherit update-gaudi;}; - in - moduleFromDeb "gaudi" { - inherit dpkg stdenv unzip; - srcPath = srcPaths.gaudi; + bccr-cacerts = { + openssl, + stdenv, + unzip, + ... + }: + stdenv.mkDerivation { + pname = "bccr-cacerts"; + version = release.name; - nativeBuildInputs = [ - autoPatchelfHook - jdk - makeWrapper - ]; + inherit src; - preBuild = lib.optionalString (gaudiHash != null) '' - unzip -o ${gaudiUpdate} -d opt/Agente-GAUDI/lib/app - ''; + nativeBuildInputs = [ + openssl + unzip + ]; - buildPhase = '' - runHook preBuild - - install -m755 -d $out/{bin,opt/Firmador-BCCR/lib} - cp -r opt/Agente-GAUDI/lib/app $out/opt/Firmador-BCCR/lib/app - - # Preserves the original filename and avoids -LaunchGaudi.java - ln -s ${./LaunchGaudi.java} LaunchGaudi.java - - javac \ - -cp opt/Agente-GAUDI/lib/app/bccr-firma-fva-clienteMultiplataforma.jar \ - -d $out/opt/Firmador-BCCR/lib/app \ - LaunchGaudi.java - - runHook postBuild - ''; - - installPhase = '' - runHook preInstall - - install -m755 -d $out/{share,opt/Firmador-BCCR/lib/runtime/lib} - install -m755 -D opt/Agente-GAUDI/bin/Agente-GAUDI $out/opt/Firmador-BCCR/bin/Agente-GAUDI - install -m755 -D opt/Agente-GAUDI/lib/libapplauncher.so $out/opt/Firmador-BCCR/lib/libapplauncher.so - - ln -s ../opt/Firmador-BCCR/lib/app $out/share/java - ln -s Firmador-BCCR $out/opt/Agente-GAUDI - ln -s ${jdk}/lib/openjdk/lib/libjli.so $out/opt/Firmador-BCCR/lib/runtime/lib/libjli.so - - makeWrapper ${jdk}/bin/java $out/bin/gaudi \ - --prefix PATH : ${fakeSudo}/bin \ - --add-flags "-cp $out/share/java:$out/share/java/bccr-firma-fva-clienteMultiplataforma.jar" \ - --add-flags "-Djavax.net.ssl.trustStore=$out/opt/Firmador-BCCR/lib/app/bccr.cacerts" \ - --add-flags "LaunchGaudi" - - runHook postInstall - ''; - }; - - bccr-cacerts = { - openssl, - stdenv, - unzip, - ... - }: - stdenv.mkDerivation { - pname = "bccr-cacerts"; - version = release.name; - - inherit src; - - nativeBuildInputs = [ - openssl - unzip - ]; - - installPhase = '' - cp -r Firma\ Digital/Certificados $out - openssl x509 -in $out/CA\ RAIZ\ NACIONAL\ -\ COSTA\ RICA\ v2.crt -out $out/root-ca.pem -text - ''; - }; - - update-gaudi = { - wget, - writeShellScript, - zip, - bccr-cacerts, - ... - }: - writeShellScript "update-gaudi" '' - set -o errexit - set -o pipefail - set -o nounset - - temp_dir="$(mktemp -d)" - trap 'cd / && rm -rf -- "$temp_dir"' EXIT - cd "$temp_dir" - - PATH="${lib.makeBinPath [wget zip]}:$PATH" - ca_cert="${bccr-cacerts}/root-ca.pem" - base_url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador" - - wget --ca-certificate="$ca_cert" "$base_url/bccr.cacerts" - wget --ca-certificate="$ca_cert" "$base_url/config.properties" - wget --ca-certificate="$ca_cert" "$base_url/bccr-firma-fva-clienteMultiplataforma.jar" - wget --ca-certificate="$ca_cert" "$base_url/ServicioActualizadorClienteBCCR.jar" - - # https://gist.github.com/stokito/c588b8d6a6a0aee211393d68eea678f2 - TZ=UTC find . -exec touch --no-dereference -a -m -t 198002010000.00 {} + - zip_path="$PWD/gaudi-update-${release.name}.zip" - TZ=UTC zip -q --move --recurse-paths --symlinks -X "$zip_path" . - TZ=UTC touch -a -m -t 198002010000.00 "$zip_path" - - set -x - nix-store --add-fixed sha256 "$zip_path" - set +x - - echo -e "\ngaudiHash: $(nix-hash --to-sri --type sha256 $(sha256sum "$zip_path" | cut -d' ' -f1))" + installPhase = '' + cp -r Firma\ Digital/Certificados $out + openssl x509 -in $out/CA\ RAIZ\ NACIONAL\ -\ COSTA\ RICA\ v2.crt -out $out/root-ca.pem -text ''; - } - // lib.optionalAttrs (vendor == "athena") { - card-driver = ase-idprotect; - } - // lib.optionalAttrs (vendor == "idopte") { - card-driver = scmiddleware; - } + }; + + update-gaudi = { + wget, + writeShellScript, + zip, + bccr-cacerts, + ... + }: + writeShellScript "update-gaudi" '' + set -o errexit + set -o pipefail + set -o nounset + + temp_dir="$(mktemp -d)" + trap 'cd / && rm -rf -- "$temp_dir"' EXIT + cd "$temp_dir" + + PATH="${lib.makeBinPath [wget zip]}:$PATH" + ca_cert="${bccr-cacerts}/root-ca.pem" + base_url="https://www.firmadigital.go.cr/Bccr.Firma.Fva.Actualizador.ClienteFirmadorJava//recursosLiberica17/actualizador" + + wget --ca-certificate="$ca_cert" "$base_url/bccr.cacerts" + wget --ca-certificate="$ca_cert" "$base_url/config.properties" + wget --ca-certificate="$ca_cert" "$base_url/bccr-firma-fva-clienteMultiplataforma.jar" + wget --ca-certificate="$ca_cert" "$base_url/ServicioActualizadorClienteBCCR.jar" + + # https://gist.github.com/stokito/c588b8d6a6a0aee211393d68eea678f2 + TZ=UTC find . -exec touch --no-dereference -a -m -t 198002010000.00 {} + + zip_path="$PWD/gaudi-update-${release.name}.zip" + TZ=UTC zip -q --move --recurse-paths --symlinks -X "$zip_path" . + TZ=UTC touch -a -m -t 198002010000.00 "$zip_path" + + set -x + nix-store --add-fixed sha256 "$zip_path" + set +x + + echo -e "\ngaudiHash: $(nix-hash --to-sri --type sha256 $(sha256sum "$zip_path" | cut -d' ' -f1))" + ''; +}