{ config, stdenv, fetchurl, fetchpatch, callPackage, lib, acpica-tools, dev86, pam, libxslt, libxml2, wrapQtAppsHook , libX11, xorgproto, libXext, libXcursor, libXmu, libIDL, SDL2, libcap, libGL, libGLU , libpng, glib, lvm2, libXrandr, libXinerama, libopus, libtpms, qtbase, qtx11extras , qttools, qtsvg, qtwayland, pkg-config, which, docbook_xsl, docbook_xml_dtd_43 , alsa-lib, curl, libvpx, nettools, dbus, substituteAll, gsoap, zlib, xz , yasm, glslang , linuxPackages , nixosTests # If open-watcom-bin is not passed, VirtualBox will fall back to use # the shipped alternative sources (assembly). , open-watcom-bin , makeself, perl , javaBindings ? true, jdk # Almost doesn't affect closure size , pythonBindings ? false, python3 , extensionPack ? null, fakeroot , pulseSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio , enableHardening ? false , headless ? false , enable32bitGuests ? true , enableWebService ? false , enableKvm ? false , extraConfigureFlags ? "" }: # See https://github.com/cyberus-technology/virtualbox-kvm/issues/12 assert enableKvm -> !enableHardening; # The web services use Java infrastructure. assert enableWebService -> javaBindings; with lib; let buildType = "release"; # Use maintainers/scripts/update.nix to update the version and all related hashes or # change the hashes in extpack.nix and guest-additions/default.nix as well manually. version = "7.0.14"; # The KVM build is not compatible to VirtualBox's kernel modules. So don't export # modsrc at all. withModsrc = !enableKvm; virtualboxGuestAdditionsIso = callPackage guest-additions-iso/default.nix { }; in stdenv.mkDerivation { pname = "virtualbox"; inherit version; src = fetchurl { url = "https://download.virtualbox.org/virtualbox/${version}/VirtualBox-${version}.tar.bz2"; sha256 = "45860d834804a24a163c1bb264a6b1cb802a5bc7ce7e01128072f8d6a4617ca9"; }; outputs = [ "out" ] ++ optional withModsrc "modsrc"; nativeBuildInputs = [ pkg-config which docbook_xsl docbook_xml_dtd_43 yasm glslang ] ++ optional (!headless) wrapQtAppsHook; # Wrap manually because we wrap just a small number of executables. dontWrapQtApps = true; buildInputs = [ acpica-tools dev86 libxslt libxml2 xorgproto libX11 libXext libXcursor libIDL libcap glib lvm2 alsa-lib curl libvpx pam makeself perl libXmu libXrandr libpng libopus libtpms python3 xz ] ++ optional javaBindings jdk ++ optional pythonBindings python3 # Python is needed even when not building bindings ++ optional pulseSupport libpulseaudio ++ optionals headless [ libGL ] ++ optionals (!headless) [ qtbase qtx11extras libXinerama SDL2 libGLU ] ++ optionals enableWebService [ gsoap zlib ]; hardeningDisable = [ "format" "fortify" "pic" "stackprotector" ]; prePatch = '' set -x sed -e 's@MKISOFS --version@MKISOFS -version@' \ -e 's@PYTHONDIR=.*@PYTHONDIR=${lib.optionalString pythonBindings python3}@' \ -e 's@CXX_FLAGS="\(.*\)"@CXX_FLAGS="-std=c++11 \1"@' \ ${optionalString (!headless) '' -e 's@TOOLQT5BIN=.*@TOOLQT5BIN="${getDev qtbase}/bin"@' \ ''} -i configure ls kBuild/bin/linux.x86/k* tools/linux.x86/bin/* | xargs -n 1 patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux.so.2 ls kBuild/bin/linux.amd64/k* tools/linux.amd64/bin/* | xargs -n 1 patchelf --set-interpreter ${stdenv.cc.libc}/lib/ld-linux-x86-64.so.2 grep 'libpulse\.so\.0' src include -rI --files-with-match | xargs sed -i -e ' ${optionalString pulseSupport ''s@"libpulse\.so\.0"@"${libpulseaudio.out}/lib/libpulse.so.0"@g''}' grep 'libdbus-1\.so\.3' src include -rI --files-with-match | xargs sed -i -e ' s@"libdbus-1\.so\.3"@"${dbus.lib}/lib/libdbus-1.so.3"@g' grep 'libasound\.so\.2' src include -rI --files-with-match | xargs sed -i -e ' s@"libasound\.so\.2"@"${alsa-lib.out}/lib/libasound.so.2"@g' export USER=nix set +x ''; patches = optional enableHardening ./hardened.patch # Since VirtualBox 7.0.8, VBoxSDL requires SDL2, but the build framework uses SDL1 ++ optionals (!headless) [ ./fix-sdl.patch # No update patch disables check for update function # https://bugs.launchpad.net/ubuntu/+source/virtualbox-ose/+bug/272212 (fetchpatch { url = "https://salsa.debian.org/pkg-virtualbox-team/virtualbox/-/raw/debian/${version}-dfsg-1/debian/patches/16-no-update.patch"; hash = "sha256-UJHpuB6QB/BbxJorlqZXUF12lgq8gbLMRHRMsbyqRpY="; })] ++ [ ./extra_symbols.patch ] # When hardening is enabled, we cannot use wrapQtApp to ensure that VirtualBoxVM sees # the correct environment variables needed for Qt to work, specifically QT_PLUGIN_PATH. # This is because VirtualBoxVM would detect that it is wrapped that and refuse to run, # and also because it would unset QT_PLUGIN_PATH for security reasons. We work around # these issues by patching the code to set QT_PLUGIN_PATH to the necessary paths, # after the code that unsets it. Note that qtsvg is included so that SVG icons from # the user's icon theme can be loaded. ++ optional (!headless && enableHardening) (substituteAll { src = ./qt-env-vars.patch; qtPluginPath = "${qtbase.bin}/${qtbase.qtPluginPrefix}:${qtsvg.bin}/${qtbase.qtPluginPrefix}:${qtwayland.bin}/${qtbase.qtPluginPrefix}"; }) # While the KVM patch should not break any other behavior if --with-kvm is not specified, # we don't take any chances and only apply it if people actually want to use KVM support. ++ optional enableKvm (fetchpatch (let patchVersion = "20240502"; in { name = "virtualbox-${version}-kvm-dev-${patchVersion}.patch"; url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/kvm-backend-${version}-dev-${patchVersion}.patch"; hash = "sha256-KokIrrAoJutHzPg6e5YAJgDGs+nQoVjapmyn9kG5tV0="; })) ++ [ ./qt-dependency-paths.patch # https://github.com/NixOS/nixpkgs/issues/123851 ./fix-audio-driver-loading.patch ./libxml-2.12.patch ./gcc-13.patch ]; postPatch = '' sed -i -e 's|/sbin/ifconfig|${nettools}/bin/ifconfig|' \ src/VBox/HostDrivers/adpctl/VBoxNetAdpCtl.cpp '' + optionalString headless '' # Fix compile error in version 6.1.6 substituteInPlace src/VBox/HostServices/SharedClipboard/VBoxSharedClipboardSvc-x11-stubs.cpp \ --replace PSHCLFORMATDATA PSHCLFORMATS ''; # first line: ugly hack, and it isn't yet clear why it's a problem configurePhase = '' NIX_CFLAGS_COMPILE=$(echo "$NIX_CFLAGS_COMPILE" | sed 's,\-isystem ${lib.getDev stdenv.cc.libc}/include,,g') cat >> LocalConfig.kmk <