nordvpn: init at 5.2.0, maintainers: add different-error

maintainers/maintainer-list.nix

@@ -6905,6 +6905,11 @@
     githubId = 2096594;
     email = "Dietrich@Daroch.me";
   };
+  different-error = {
+    name = "Sanfer D'souza";
+    github = "different-error";
+    githubId = 9338001;
+  };
   different-name = {
     name = "different-name";
     email = "hello@different-name.dev";

pkgs/by-name/no/nordvpn/cli.nix

@@ -0,0 +1,151 @@
+{
+  desktopItemArgs,
+  meta,
+  src,
+  version,
+
+  buildGoModule,
+  copyDesktopItems,
+  e2fsprogs,
+  fetchFromGitHub,
+  iproute2,
+  lib,
+  libxslt,
+  makeDesktopItem,
+  makeWrapper,
+  nftables,
+  openvpn,
+  procps,
+  systemdMinimal,
+  wireguard-tools,
+}:
+let
+  patchedOpenvpn = openvpn.overrideAttrs (old: {
+    # Apply XOR obfuscation patches to disguise OpenVPN traffic,
+    # enabling connectivity on networks that block VPN protocols via DPI.
+    patches =
+      let
+        tunnelblickSrc = fetchFromGitHub {
+          owner = "Tunnelblick";
+          repo = "Tunnelblick";
+          # https://github.com/NordSecurity/nordvpn-linux/blob/4.6.0/ci/openvpn/env.sh#L11
+          tag = "v6.0beta09";
+          hash = "sha256-uLYrBgwX3HkEV06snlIYLsgfhD5lNDVR21D56ygoStY=";
+        };
+
+        pathDir = "third_party/sources/openvpn/openvpn-2.6.12/patches";
+      in
+      (old.patches or [ ])
+      ++ (map (fname: "${tunnelblickSrc}/${pathDir}/${fname}") [
+        "02-tunnelblick-openvpn_xorpatch-a.diff"
+        "03-tunnelblick-openvpn_xorpatch-b.diff"
+        "04-tunnelblick-openvpn_xorpatch-c.diff"
+        "05-tunnelblick-openvpn_xorpatch-d.diff"
+        "06-tunnelblick-openvpn_xorpatch-e.diff"
+      ]);
+  });
+
+in
+buildGoModule (finalAttrs: {
+  inherit src version;
+
+  pname = "nordvpn-cli";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  vendorHash = "sha256-I81sn+tHTny9bX5eNGQLPQtoabbaNZINMjYotCXt88A=";
+
+  preBuild = ''
+    # redirect AppDataPathStatic (/usr/lib/nordvpn) to $out/bin so that
+    # NorduserdBinaryPath resolves to $out/bin/norduserd.
+    substituteInPlace internal/constants.go \
+        --replace-fail "/usr/lib/nordvpn" "$out/bin"
+
+    # hardcode the openvpn path to the patched one
+    old_ovpn_path='filepath.Join(internal.AppDataPathStatic, "openvpn")'
+    new_ovpn_path='"${patchedOpenvpn}/bin/openvpn"'
+    substituteInPlace daemon/vpn/openvpn/config.go \
+        --replace-fail "$old_ovpn_path" "$new_ovpn_path"
+  '';
+
+  ldflags = [
+    "-X main.Environment=prod"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  subPackages = [
+    "cmd/cli"
+    "cmd/daemon"
+    "cmd/norduser"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    go test ./cli
+    # skip tests that require network access
+    go test ./daemon -skip \
+        'TestTransports|TestH1Transport_RoundTrip|Test.*FileList_RealURL'
+    go test ./norduser
+
+    runHook postCheck
+  '';
+
+  postInstall = ''
+    # rename to standard names
+    BIN_DIR=$out/bin
+    mv $BIN_DIR/cli $BIN_DIR/nordvpn
+    mv $BIN_DIR/daemon $BIN_DIR/nordvpnd
+    mv $BIN_DIR/norduser $BIN_DIR/norduserd
+
+    # nordvpn needs icons for the system tray and notifications
+    ICONS_PATH=$out/share/icons/hicolor/scalable/apps
+    install -d $ICONS_PATH
+    install --mode=0444 assets/icon.svg $ICONS_PATH/nordvpn.svg
+    for file in assets/tray-*.svg; do
+        install --mode=0444 "$file" "$ICONS_PATH/nordvpn-$(basename $file)"
+    done
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/nordvpnd --prefix PATH : ${
+      lib.makeBinPath [
+        e2fsprogs
+        iproute2
+        libxslt # xsltproc: used to populate OpenVPN configuration files from templates
+        nftables
+        patchedOpenvpn
+        procps
+        systemdMinimal
+        wireguard-tools
+      ]
+    }
+  '';
+
+  desktopItems = [
+    (makeDesktopItem (
+      desktopItemArgs
+      // {
+        comment = "Handles NordVPN OAuth browser login callbacks.";
+        desktopName = "NordVPN CLI";
+        exec = "nordvpn click %u";
+        mimeTypes = [ "x-scheme-handler/nordvpn" ];
+        name = "nordvpn";
+        noDisplay = true;
+        terminal = true;
+      }
+    ))
+  ];
+
+  meta = meta // {
+    description = "NordVPN command-line client and daemon";
+    longDescription = ''
+      Contains the nordvpn client and nordvpnd daemon.
+      Even if you intend to use the GUI only, you'd need this package.
+    '';
+    mainProgram = "nordvpn";
+  };
+})

pkgs/by-name/no/nordvpn/gui.nix

@@ -0,0 +1,48 @@
+{
+  desktopItemArgs,
+  meta,
+  src,
+  version,
+
+  copyDesktopItems,
+  flutter,
+  lib,
+  makeDesktopItem,
+  libx11,
+}:
+flutter.buildFlutterApplication {
+  pname = "nordvpn-gui";
+  inherit src version;
+
+  sourceRoot = "${src.name}/gui";
+
+  buildInputs = [
+    libx11
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+  ];
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  # finds X11 using pkg-config
+  patches = [ ./linux-cmake.patch ];
+
+  desktopItems = [
+    (makeDesktopItem (
+      desktopItemArgs
+      // {
+        comment = "NordVPN's GUI to manage vpn connection, settings, etc.";
+        desktopName = "NordVPN GUI";
+        exec = "nordvpn-gui";
+        name = "nordvpn-gui";
+      }
+    ))
+  ];
+
+  meta = meta // {
+    description = "NordVPN graphical interface";
+    mainProgram = "nordvpn-gui";
+  };
+}

pkgs/by-name/no/nordvpn/linux-cmake.patch

@@ -0,0 +1,23 @@
+--- a/linux/CMakeLists.txt
++++ b/linux/CMakeLists.txt
+@@ -51,10 +51,10 @@
+ # System-level dependencies.
+ find_package(PkgConfig REQUIRED)
+ pkg_check_modules(GTK REQUIRED IMPORTED_TARGET gtk+-3.0)
++pkg_check_modules(X11 REQUIRED IMPORTED_TARGET x11)
+
+ add_definitions(-DAPPLICATION_ID="${APPLICATION_ID}")
+ # Fix for: https://github.com/NordSecurity/nordvpn-linux/issues/1136
+-find_package(X11 REQUIRED)
+
+ # Define the application target. To change its name, change BINARY_NAME above,
+ # not the value here, or `flutter run` will no longer work.
+@@ -73,7 +73,7 @@
+ # Add dependency libraries. Add any application-specific dependencies here.
+ target_link_libraries(${BINARY_NAME} PRIVATE flutter)
+ target_link_libraries(${BINARY_NAME} PRIVATE PkgConfig::GTK)
+-target_link_libraries(${BINARY_NAME} PRIVATE X11::X11)
++target_link_libraries(${BINARY_NAME} PRIVATE PkgConfig::X11)
+
+ # Run the Flutter tool portions of the build. This must not be removed.
+ add_dependencies(${BINARY_NAME} flutter_assemble)

pkgs/by-name/no/nordvpn/package.nix

@@ -0,0 +1,66 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  symlinkJoin,
+}:
+let
+  version = "5.2.0";
+
+  common = {
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "NordSecurity";
+      repo = "nordvpn-linux";
+      tag = version;
+      hash = "sha256-F7iw856HVLbOz97j9sMkVwyZl0ZDwID1Tf0YwtdvZsU=";
+    };
+
+    # rec so that changelog can reference homepage
+    meta = rec {
+      homepage = "https://github.com/NordSecurity/nordvpn-linux";
+      changelog = "${homepage}/releases/tag/${version}";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [ different-error ];
+      platforms = lib.platforms.linux;
+    };
+
+    desktopItemArgs = {
+      categories = [ "Network" ];
+      genericName = "VPN Client";
+      icon = "nordvpn";
+      type = "Application";
+    };
+  };
+in
+symlinkJoin {
+  pname = "nordvpn";
+  inherit version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  paths = [
+    (callPackage ./cli.nix common)
+    (callPackage ./gui.nix common)
+  ];
+
+  passthru = {
+    cli = callPackage ./cli.nix common;
+    gui = callPackage ./gui.nix common;
+    updateScript = nix-update-script { };
+  };
+
+  meta = common.meta // {
+    description = "NordVPN client and GUI for Linux";
+    longDescription = ''
+      NordVPN CLI and GUI applications for Linux.
+      This package currently does not support meshnet.
+      Additionally, if `networking.firewall.enable = true;`,
+      then also set `networking.firewall.checkReversePath = "loose";`.
+      The closed-source nordwhisper protocol is also not supported.
+    '';
+  };
+}