Add packages for suricata #33886

dhess · 2018-01-15T06:42:48Z

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

Also add suricata-full with Redis and Rust support.

adisbladis · 2018-01-17T06:55:10Z

Are you willing to maintain these packages? If so you should add yourself as a maintainer in the meta.maintainers attribute.

adisbladis · 2018-01-17T06:56:37Z

pkgs/development/libraries/hyperscan/default.nix

+  meta = with stdenv.lib; {
+    homepage = https://01.org/hyperscan;
+    description = "A high-performance multiple regex matching library";
+    license = [ licenses.bsd3 licenses.bsd2 licenses.boost ];


This could be simplified as license = with licenses; [ bsd3 bsd2 boost ];

with licenses; [ ... boost ] does not evaluate, FYI, because boost is also included in the function arguments.

with clause will take precedence and shadow function arguments in that case.

Try it for yourself.

https://gist.github.com/dhess/ec32c05364c73a69b91813d0d4e7e71d

$ nix-build pkgs/top-level/release.nix -A hyperscan trace: WARNING: `addPassthru` is deprecated, replace with `extendDerivation true` trace: lib.zip is deprecated, use lib.zipAttrsWith instead trace: `mkStrict' is obsolete; use `mkOverride 0' instead. trace: `types.list` is deprecated; use `types.listOf` instead trace: types.optionSet is deprecated; use types.submodule instead error: Package ‘python2.7-dosage-2016.03.17’ in /home/dhess/git/nixpkgs/pkgs/top-level/python-packages.nix:1555 is marked as broken, refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowBroken = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowBroken = true; } to ~/.config/nixpkgs/config.nix. (use ‘--show-trace’ to show detailed location information)

You are right; interesting.

This prints 2:

let a = { foo = 1; }; b = { foo = 2; }; in with a; with b; builtins.trace foo foo

And this prints 1:

{ foo ? 1 }: let b = { foo = 2; }; in with b; builtins.trace foo foo

I'm not sure if that's intended; that doesn't seem to follow proper scoping rules. If there is no ticket against NixOS/nix on this, perhaps one should be opened.

Found it, see NixOS/nix#490.

adisbladis · 2018-01-17T06:57:04Z

pkgs/development/libraries/libnet/1.1.nix

+  meta = with stdenv.lib; {
+    homepage = https://github.com/sam-github/libnet;
+    description = "Portable framework for low-level network packet construction";
+    license = [ licenses.bsd2 licenses.bsd3 ];


Same here. Can be simplified.

adisbladis · 2018-01-17T06:58:00Z

pkgs/development/libraries/libprelude/default.nix

+, swig
+}:
+
+let


Empty let

adisbladis · 2018-01-17T07:01:16Z

pkgs/development/libraries/libprelude/default.nix

+    gnutls
+  ];
+
+  propagatedBuildInputs = [


Should all of these really be propagated?
I think these should probably be separate packages in their respective languages (eg python module in pkgs/development/python-modules).

lukateras · 2018-01-17T06:48:17Z

pkgs/applications/networking/ids/suricata/default.nix

+# - CUDA support (note: requires driver API, not the runtime API, so cudatoolkit doesn't work)
+
+{ stdenv
+, lib


Better use stdenv.lib instead of lib.

lukateras · 2018-01-17T06:49:56Z

pkgs/applications/networking/ids/suricata/default.nix

+, pcre
+, python
+, zlib
+, redisSupport ? false, redis, hiredis


If Redis support is optional, it would make sense to mark redis and hiredis attributes optional as well:

, redisSupport ? false, redis ? null, hiredis ? null

Same with rustSupport.

lukateras · 2018-01-17T06:57:37Z

pkgs/applications/networking/ids/suricata/default.nix

+  name = "suricata-${version}";
+
+  src = fetchurl {
+    name = "${name}.tar.gz";


This seemingly can be omitted.

lukateras · 2018-01-17T06:59:34Z

pkgs/applications/networking/ids/suricata/default.nix

+
+  postInstall = ''
+    wrapProgram "$out/bin/suricatasc" \
+      --prefix PYTHONPATH : $PYTHONPATH:$(toPythonPath "$out")


I think it should be --prefix PYTHONPATH : $(toPythonPath $out), seemingly $PYTHONPATH is not set. Also, consider using wrapPython.

lukateras · 2018-01-17T07:04:10Z

pkgs/development/libraries/hyperscan/default.nix

+
+let
+
+in


Empty let binding.

lukateras · 2018-01-17T07:05:09Z

pkgs/development/libraries/hyperscan/default.nix

+    boost
+    cmake
+    pkgconfig
+    python


Are boost, python and ragel build-time only dependencies in this case? Perhaps they are, I just wanted to make sure.

lukateras · 2018-01-17T07:06:10Z

pkgs/development/libraries/hyperscan/default.nix

+  meta = with stdenv.lib; {
+    homepage = https://01.org/hyperscan;
+    description = "A high-performance multiple regex matching library";
+    license = [ licenses.bsd3 licenses.bsd2 licenses.boost ];


From https://01.org/hyperscan it seems that hyperscan is only under BSD 3-Clause, and not under BSD 2-Clause or Boost licenses.

See https://github.com/intel/hyperscan/blob/master/LICENSE

It's common for big companies to list all dependencies' licenses in the license file. The package itself is still under BSD 3-Clause.

https://github.com/intel/hyperscan/blob/d2e5089dc33c3f9d762898eefece67fe5ab323ea/include/boost-patched/graph/dominator_tree.hpp#L4

https://github.com/intel/hyperscan/blob/a00bd3167cda4d963ed71220cbbb703c06955f2d/src/crc32.c#L47

--> https://opensource.org/licenses/bsd-license.html

lukateras · 2018-01-17T07:08:28Z

pkgs/development/libraries/libnet/1.1.nix

+
+let
+
+in


Empty let binding.

lukateras · 2018-01-17T07:09:04Z

pkgs/development/libraries/libprelude/default.nix

+    gnutls
+  ];
+
+  propagatedBuildInputs = [


Why are interpreters propagated?

lukateras · 2018-01-17T07:10:39Z

pkgs/development/libraries/libprelude/default.nix

+  meta = with stdenv.lib; {
+    homepage = https://www.prelude-siem.org/projects/libprelude;
+    description = "IDMEF transport library used by all Prelude agents";
+    license = licenses.gpl2;


Seemingly, it is under licenses.gpl2Plus: https://github.com/Prelude-SIEM/libprelude/blob/855888af18f38433322e24589bc254bc2ea9ec85/src/common.c#L10

dhess · 2018-01-17T07:16:29Z

OK, thanks for all the feedback. I don't have time to fix the major issues. Maybe another time.

dhess added 5 commits January 14, 2018 20:31

hyperscan: init at 4.6.0

a0854a8

libnet: add 1.1.6.

56b45df

libprelude: init at 4.1.0

ca24339

suricata: init at 4.0.3

8161658

Also add suricata-full with Redis and Rust support.

libnet: fix packaging.

434ddab

GrahamcOfBorg added 10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10 labels Jan 15, 2018

adisbladis requested changes Jan 17, 2018

View reviewed changes

lukateras reviewed Jan 17, 2018

View reviewed changes

dhess closed this Jan 17, 2018

dhess deleted the suricata branch January 17, 2018 07:16

magenbluten mentioned this pull request Jul 2, 2019

suricata: init at 4.1.4 #64166

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add packages for suricata #33886

Add packages for suricata #33886

dhess commented Jan 15, 2018

adisbladis commented Jan 17, 2018

adisbladis Jan 17, 2018

dhess Jan 17, 2018

lukateras Jan 17, 2018

dhess Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

adisbladis Jan 17, 2018

adisbladis Jan 17, 2018

adisbladis Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

dhess Jan 17, 2018

lukateras Jan 17, 2018

dhess Jan 17, 2018

lukateras Jan 17, 2018

dhess Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

lukateras Jan 17, 2018

dhess commented Jan 17, 2018

+              , swig
+              }:
+              let

Add packages for suricata #33886

Add packages for suricata #33886

Conversation

dhess commented Jan 15, 2018

Things done

adisbladis commented Jan 17, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dhess commented Jan 17, 2018