citrix_receiver: allow custom certs and hooks for the installation #44522

Ma27 · 2018-08-05T21:03:09Z

Motivation for this change

Sometimes it's required to modify some parts of the Citrix build on
their own which is why {pre,post}Install hooks can be quite helpful.

Additionally some corporate clients use their own certificates that
aren't stored as trusted ones in the cacert package with all of the
trusted certs by Mozilla.

Now it's possible to add custom certs like this:

with import <nixpkgs> { config.allowUnfree = true; };

let path = ../../Downloads/custom-corporate-cert.pem; in
citrix_receiver.override {
  extraCerts = [ path ];
}

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Determined the impact on package closure size (by running nix path-info -S before and after)
Fits CONTRIBUTING.md.

Ma27 · 2018-08-05T21:03:37Z

Note: I'm currently testing against older Citrix versions, it currently works with 13.10 though.

GrahamcOfBorg · 2018-08-05T21:16:45Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: citrix_receiver

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-08-05T21:17:06Z

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: citrix_receiver

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.

Ma27 · 2018-08-05T21:51:54Z

just tested my patch with the oldest citrix version available in nixpkgs (13.4.0) and it works fine as well

GrahamcOfBorg · 2018-08-05T22:50:47Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: citrix_receiver

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-08-05T22:52:02Z

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: citrix_receiver

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.

Mic92 · 2018-08-06T10:14:36Z

pkgs/applications/networking/remote/citrix-receiver/default.nix

@@ -156,7 +156,7 @@ let
        '';
      };

-      phases = [ "unpackPhase" "installPhase" ];
+      phases = [ "unpackPhase" "installPhase" "fixupPhase" ];


dontBuild = true; seems more economical here.

Mic92 · 2018-08-06T10:19:05Z

pkgs/top-level/all-packages.nix

+  citrix_receiver_unwrapped_13_7_0  = citrix_receiver_unwrapped.override { version = "13.7.0";  };
+  citrix_receiver_unwrapped_13_6_0  = citrix_receiver_unwrapped.override { version = "13.6.0";  };
+  citrix_receiver_unwrapped_13_5_0  = citrix_receiver_unwrapped.override { version = "13.5.0";  };
+  citrix_receiver_unwrapped_13_4_0  = citrix_receiver_unwrapped.override { version = "13.4.0";  };


For the next release we should drop versions older then 13.8, since their support will be dropped before 19.03: https://www.citrix.co.uk/support/product-lifecycle/milestones/receiver.html

Sometimes it's required to modify some parts of the Citrix build on their own which is why `{pre,post}Install` hooks can be quite helpful. Additionally some corporate clients use their own certificates that aren't stored as trusted ones in the `cacert` package with all of the trusted certs by Mozilla. Now it's possible to add custom certs like this: ``` nix with import <nixpkgs> { config.allowUnfree = true; }; let path = ../../Downloads/custom-corporate-cert.pem; in citrix_receiver.override { extraCerts = [ path ]; } ```

All Citrix versions until 13.7 will be EOLed during the lifetime of 18.09: https://www.citrix.co.uk/support/product-lifecycle/milestones/receiver.html

Ma27 · 2018-08-06T13:20:28Z

thanks for pointing out the obsoleteness of citrix 13.4-7, pushed a second commit which references the Citrix support/lifetime page and drops the affected versions from the package set.

GrahamcOfBorg · 2018-08-06T13:30:55Z

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: citrix_receiver

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-08-06T13:31:50Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: citrix_receiver

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnfree = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnfree = true; }
to ~/.config/nixpkgs/config.nix.

Since NixOS#44522 it's possible to specify custom certificates for the Citrix receiver. As it took me some time to create a proper setup Citrix can behave fairly unexpected. I mostly covered two aspects: * Don't install Citrix with `nix run`: when `citrix.desktop` is linked to $XDG_CONFIG_DIRS, it's possible to start a session directly from the browser when loading `.ica` files which makes the usage *way* easier. * It's possible to add custom certificates using the Citrix wrapper. A new store path with the original derivation and the certificates will be created and therefore no rebuild of the package is needed when adding new certs.

…OS#44635) Since NixOS#44522 it's possible to specify custom certificates for the Citrix receiver. As it took me some time to create a proper setup Citrix can behave fairly unexpected. I mostly covered two aspects: * Don't install Citrix with `nix run`: when `citrix.desktop` is linked to $XDG_CONFIG_DIRS, it's possible to start a session directly from the browser when loading `.ica` files which makes the usage *way* easier. * It's possible to add custom certificates using the Citrix wrapper. A new store path with the original derivation and the certificates will be created and therefore no rebuild of the package is needed when adding new certs.

GrahamcOfBorg added 8.has: package (new) 10.rebuild-darwin: 0 10.rebuild-linux: 11-100 labels Aug 5, 2018

Ma27 force-pushed the allow-citrix-custom-certs branch from e7e81a0 to 1b02958 Compare August 5, 2018 22:36

Mic92 reviewed Aug 6, 2018

View reviewed changes

Ma27 added 2 commits August 6, 2018 15:16

citrix_receiver: drop all packages below 13.8

3d7b147

All Citrix versions until 13.7 will be EOLed during the lifetime of 18.09: https://www.citrix.co.uk/support/product-lifecycle/milestones/receiver.html

Ma27 force-pushed the allow-citrix-custom-certs branch from 1b02958 to 3d7b147 Compare August 6, 2018 13:19

GrahamcOfBorg added 8.has: clean-up 10.rebuild-linux: 1-10 and removed 10.rebuild-linux: 11-100 labels Aug 6, 2018

Mic92 merged commit 893b080 into NixOS:master Aug 7, 2018

Ma27 deleted the allow-citrix-custom-certs branch August 7, 2018 09:22

Ma27 mentioned this pull request Aug 7, 2018

citrix_receiver: document installation pitfalls and extraCerts #44635

Merged

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

citrix_receiver: allow custom certs and hooks for the installation #44522

citrix_receiver: allow custom certs and hooks for the installation #44522

Ma27 commented Aug 5, 2018 •

edited

Ma27 commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

Ma27 commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

Mic92 Aug 6, 2018

Mic92 Aug 6, 2018 •

edited

Ma27 commented Aug 6, 2018

GrahamcOfBorg commented Aug 6, 2018

GrahamcOfBorg commented Aug 6, 2018

citrix_receiver: allow custom certs and hooks for the installation #44522

citrix_receiver: allow custom certs and hooks for the installation #44522

Conversation

Ma27 commented Aug 5, 2018 • edited

Motivation for this change

Things done

Ma27 commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

Ma27 commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

GrahamcOfBorg commented Aug 5, 2018

Mic92 Aug 6, 2018

Choose a reason for hiding this comment

Mic92 Aug 6, 2018 • edited

Choose a reason for hiding this comment

Ma27 commented Aug 6, 2018

GrahamcOfBorg commented Aug 6, 2018

GrahamcOfBorg commented Aug 6, 2018

Ma27 commented Aug 5, 2018 •

edited

Mic92 Aug 6, 2018 •

edited