push sheeet

pkgs/development/libraries/mbedtls/2.nix

@@ -0,0 +1,14 @@
+{ callPackage, fetchpatch }:
+
+callPackage ./generic.nix {
+  version = "2.28.10";
+  hash = "sha256-09XWds45TFH7GORrju8pVQQQQomU8MlFAq1jJXrLW0s=";
+
+  patches = [
+    # cmake 4 compatibility
+    (fetchpatch {
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/be4af04fcffcfebe44fa12d39388817d9949a9f3.patch";
+      hash = "sha256-CbDm6CchzoTia7Wbpbe3bo9CmHPOsxY2d055AfbCS0g=";
+    })
+  ];
+}

pkgs/development/libraries/mbedtls/3.nix

@@ -0,0 +1,18 @@
+{ callPackage, fetchurl }:
+
+callPackage ./generic.nix {
+  version = "3.6.4";
+  hash = "sha256-y5YqKtjW4IXyIZkoJvwCGC4scx0qdeV40rynHza4NUE=";
+
+  patches = [
+    # Fixes the build with GCC 14 on aarch64.
+    #
+    # See:
+    # * <https://github.com/openwrt/openwrt/pull/15479>
+    # * <https://github.com/Mbed-TLS/mbedtls/issues/9003>
+    (fetchurl {
+      url = "https://raw.githubusercontent.com/openwrt/openwrt/52b6c9247997e51a97f13bb9e94749bc34e2d52e/package/libs/mbedtls/patches/100-fix-gcc14-build.patch";
+      hash = "sha256-20bxGoUHkrOEungN3SamYKNgj95pM8IjbisNRh68Wlw=";
+    })
+  ];
+}

pkgs/development/libraries/mbedtls/generic.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  version,
+  hash,
+  patches ? [ ],
+  fetchFromGitHub,
+
+  cmake,
+  ninja,
+  perl, # Project uses Perl for scripting and testing
+  python3,
+
+  enableThreading ? true, # Threading can be disabled to increase security https://tls.mbed.org/kb/development/thread-safety-and-multi-threading
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mbedtls";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "Mbed-TLS";
+    repo = "mbedtls";
+    rev = "${pname}-${version}";
+    inherit hash;
+    # mbedtls >= 3.6.0 uses git submodules
+    fetchSubmodules = true;
+  };
+
+  inherit patches;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    perl
+    python3
+  ];
+
+  strictDeps = true;
+
+  # trivialautovarinit on clang causes test failures
+  hardeningDisable = lib.optional stdenv.cc.isClang "trivialautovarinit";
+
+  postConfigure = lib.optionalString enableThreading ''
+    perl scripts/config.pl set MBEDTLS_THREADING_C    # Threading abstraction layer
+    perl scripts/config.pl set MBEDTLS_THREADING_PTHREAD    # POSIX thread wrapper layer for the threading layer.
+  '';
+
+  cmakeFlags = [
+    "-DUSE_SHARED_MBEDTLS_LIBRARY=${if stdenv.hostPlatform.isStatic then "off" else "on"}"
+
+    # Avoid a dependency on jsonschema and jinja2 by not generating source code
+    # using python. In releases, these generated files are already present in
+    # the repository and do not need to be regenerated. See:
+    # https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0 below "Requirement changes".
+    "-DGEN_FILES=off"
+  ];
+
+  doCheck = true;
+
+  # Parallel checking causes test failures
+  # https://github.com/Mbed-TLS/mbedtls/issues/4980
+  enableParallelChecking = false;
+
+  meta = with lib; {
+    homepage = "https://www.trustedfirmware.org/projects/mbed-tls/";
+    changelog = "https://github.com/Mbed-TLS/mbedtls/blob/${pname}-${version}/ChangeLog";
+    description = "Portable cryptographic and TLS library, formerly known as PolarSSL";
+    license = [
+      licenses.asl20 # or
+      licenses.gpl2Plus
+    ];
+    platforms = platforms.all;
+    maintainers = with maintainers; [ raphaelr ];
+  };
+}