minica-deterministic.nix

{ pkgs ? import <nixpkgs> {}, lib ? pkgs.lib }:

pkgs.runCommand "testcerts" {
  nativeBuildInputs = let
    patchedPkgs = pkgs.extend (lib.const (super: {
      buildGoPackage = super.buildGoPackage.override (attrs: {
        go = attrs.go.overrideAttrs (drv: {
          # Make MaybeReadByte a no-op, since this is used to *prevent*
          # determinism.
          postPatch = (drv.postPatch or "") + ''
            sed -i -n -e '/^func MaybeReadByte.*{/ { p; :l; n; /^}/!bl }; p' \
              src/crypto/internal/randutil/randutil.go
          '';
        });
      });
    }));
  in lib.singleton (patchedPkgs.minica.overrideAttrs (drv: {
    pname = "minica-deterministic";
    postPatch = (drv.postPatch or "") + ''
      sed -i -e '
        /import.*(/,/)/ { s!"crypto/rand"!"math/rand"!g; s/"math"// }
        /rand.Int(/ {
          :l; N; /}/!bl
          c var serial = big.NewInt(123456789)
          b
        }
        s/rand\.Reader/rand.New(rand.NewSource(123456789))/g
        s/time\.Now()/time.Unix(1602785939, 0)/g
      ' main.go
    '';
  }));
} ''
  mkdir "$out"
  cd "$out"
  for domain in $(seq 100 | sed -e 's/.*/domain&.test/'); do
    minica --ca-key ca-key.pem --ca-cert ca-cert.pem --domains "$domain"
  done
''