enprot 0.5.12

Engyon Protected Text (EPT) — confidentiality processor and capability ledger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

# Nix flake for enprot — build from source, dev shell, and app.
#
# Usage:
#   nix run github:engyon/enprot/main -- --version
#   nix profile install github:engyon/enprot/main
#
# Or in a flake.nix:
#   inputs.enprot.url = "github:engyon/enprot/main";
#   outputs = { self, enprot, ... }: { packages.x86_64-linux.default = enprot.packages.x86_64-linux.default; };
#
# Dev shell:
#   nix develop

{
  description = "Engyon Protected Text — confidentiality and provenance for text/source files";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    rust-overlay.url = "github:oxalica/rust-overlay";
  };

  outputs = { self, nixpkgs, flake-utils, rust-overlay, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        overlays = [ (import rust-overlay) ];
        pkgs = import nixpkgs { inherit system overlays; };

        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;

        nativeBuildInputs = with pkgs; [
          rustToolchain
          pkg-config
          cmake
          makeWrapper
        ];

        buildInputs = with pkgs; [
          botan
          rnp
        ];

        # Build enprot as a Nix derivation. We disable vendored-rnp
        # because Nixpkgs already provides librnp; system libs are
        # preferred over bundled ones to avoid duplication.
        enprot = pkgs.rustPlatform.buildRustPackage {
          pname = "enprot";
          version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.version;
          src = ./.;
          cargoLock.lockFile = ./Cargo.lock;

          inherit nativeBuildInputs buildInputs;

          # Tests need the binary built + the FFI's shared lib on the
          # loader path.
          doCheck = true;
          preCheck = ''
            export DYLD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath buildInputs}:$DYLD_LIBRARY_PATH
          '';

          postInstall = ''
            # Shell completions
            mkdir -p $out/share/bash-completion/completions
            mkdir -p $out/share/fish/vendor_completions.d
            mkdir -p $out/share/zsh/site-functions
            $out/bin/enprot completions bash > $out/share/bash-completion/completions/enprot || true
            $out/bin/enprot completions fish > $out/share/fish/vendor_completions.d/enprot.fish || true
            $out/bin/enprot completions zsh  > $out/share/zsh/site-functions/_enprot || true
          '';

          meta = with pkgs.lib; {
            description = "Engyon Protected Text — confidentiality and provenance for text/source files";
            homepage = "https://github.com/engyon/enprot";
            license = licenses.bsd2;
            mainProgram = "enprot";
            platforms = platforms.unix ++ platforms.windows;
          };
        };
      in
      {
        packages.default = enprot;
        packages.enprot = enprot;

        apps.default = flake-utils.lib.mkApp {
          drv = enprot;
          name = "enprot";
        };

        devShells.default = pkgs.mkShell {
          packages = nativeBuildInputs ++ buildInputs ++ (with pkgs; [
            cargo-edit
            cargo-audit
            cargo-deny
            rust-analyzer
            python3    # for the bindings test suite
            nodejs     # for the Node bindings test suite
          ]);
          shellHook = ''
            echo "enprot dev shell — $(enprot --version 2>/dev/null || echo 'binary not built yet; run: cargo build --release')"
          '';
        };
      });
}