Wire Apple KMS release signing

flake.nix

@@ -51,6 +51,64 @@
           else
             pkgs.bazel-buildtools;
         optionalPackage = name: lib.optional (lib.hasAttr name pkgs) (lib.getAttr name pkgs);
+        googleKmsPkcs11Package =
+          if pkgs.stdenv.hostPlatform.isx86_64 && pkgs.stdenv.isLinux then
+            let
+              version = "1.9";
+            in
+            pkgs.stdenv.mkDerivation {
+              pname = "google-kms-pkcs11";
+              inherit version;
+              src = pkgs.fetchurl {
+                url = "https://github.com/GoogleCloudPlatform/kms-integrations/releases/download/pkcs11-v${version}/libkmsp11-${version}-linux-amd64.tar.gz";
+                sha256 = "sha256-U5f5ZQc81dHixD5RSPEC8xp8g1kC+X60HHycDxuHakA=";
+              };
+              nativeBuildInputs = [ pkgs.autoPatchelfHook ];
+              buildInputs = [ pkgs.stdenv.cc.cc.lib ];
+              installPhase = ''
+                runHook preInstall
+                install -Dm755 libkmsp11.so "$out/lib/libkmsp11.so"
+                install -Dm644 kmsp11.h "$out/include/kmsp11.h"
+                install -Dm644 LICENSE "$out/share/licenses/google-kms-pkcs11/LICENSE"
+                mkdir -p "$out/bin"
+                cat > "$out/bin/google-kms-pkcs11-module" <<EOF
+#!/usr/bin/env sh
+printf '%s\n' "$out/lib/libkmsp11.so"
+EOF
+                chmod 755 "$out/bin/google-kms-pkcs11-module"
+                runHook postInstall
+              '';
+              meta = with lib; {
+                description = "Google Cloud KMS PKCS#11 library";
+                homepage = "https://github.com/GoogleCloudPlatform/kms-integrations";
+                license = licenses.asl20;
+                platforms = [ "x86_64-linux" ];
+              };
+            }
+          else
+            null;
+        rcodesignPkcs11Package =
+          if pkgs ? rcodesign then
+            pkgs.rcodesign.overrideAttrs (old: {
+              pname = "rcodesign-pkcs11";
+              patches = (old.patches or [ ]) ++ [
+                ./patches/rcodesign-pkcs11-tool.patch
+              ];
+              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+              postInstall = (old.postInstall or "") + ''
+                wrapProgram "$out/bin/rcodesign" \
+                  --prefix PATH : ${lib.makeBinPath [ pkgs.opensc pkgs.openssl ]} \
+                  --set-default BURROW_OPENSSL_MODULES ${pkgs.pkcs11-provider}/lib/ossl-modules
+              '';
+              passthru = (old.passthru or { }) // {
+                isBurrowPkcs11Fork = true;
+              };
+              meta = (old.meta or { }) // {
+                description = "rcodesign with Burrow PKCS#11 signing support";
+              };
+            })
+          else
+            null;
         commonPackages = with pkgs; [
           cargo
           rustc
@@ -69,12 +127,17 @@
           jq
           nodejs_20
           python3
+          openssl
           rsync
           zip
           unzip
         ] ++ optionalPackage "google-cloud-sdk"
           ++ optionalPackage "awscli2"
-          ++ optionalPackage "attic-client";
+          ++ optionalPackage "attic-client"
+          ++ optionalPackage "opensc"
+          ++ optionalPackage "pkcs11-provider"
+          ++ lib.optional (googleKmsPkcs11Package != null) googleKmsPkcs11Package
+          ++ lib.optional (rcodesignPkcs11Package != null) rcodesignPkcs11Package;
         linuxRepositoryPackages = lib.optionals pkgs.stdenv.isLinux (
           (with pkgs; [
             dpkg
@@ -273,7 +336,9 @@
             forgejo-nsc-dispatcher = forgejoNscDispatcher;
             forgejo-nsc-autoscaler = forgejoNscAutoscaler;
           }
-          // lib.optionalAttrs (nscPkg != null) { nsc = nscPkg; };
+          // lib.optionalAttrs (nscPkg != null) { nsc = nscPkg; }
+          // lib.optionalAttrs (googleKmsPkcs11Package != null) { google-kms-pkcs11 = googleKmsPkcs11Package; }
+          // lib.optionalAttrs (rcodesignPkcs11Package != null) { rcodesign-pkcs11 = rcodesignPkcs11Package; };
       }))
     // {
       nixosModules.burrow-forge = import ./nixos/modules/burrow-forge.nix;