packaging/key-manager.spec

   1 %global watchdog_enabled 1
   2 %global watchdog_timeout_sec 60
   3 %global watchdog_notify_sec  20
   4 %global tz_backend_enabled %{?tz_backend:%tz_backend}%{!?tz_backend:OFF}
   5 %{!?build_type:%global build_type RELEASE}
   6 %global coverage_only 0
   7 %if %{build_type} == COVERAGE_ONLY
   8     %global build_type COVERAGE
   9     %global coverage_only 1
  10 %endif
  11
  12 Name:       key-manager
  13 Summary:    Central Key Manager and utilities
  14 Version:    0.1.42
  15 Release:    1
  16 Group:      Security/Secure Storage
  17 License:    Apache-2.0 and BSD-3-Clause
  18 Source0:    %{name}-%{version}.tar.gz
  19 Source1001: key-manager-pam-plugin.manifest
  20 Source1002: libkey-manager-client.manifest
  21 Source1003: libkey-manager-client-devel.manifest
  22 Source1004: libkey-manager-common.manifest
  23 BuildRequires: cmake
  24 BuildRequires: zip
  25 BuildRequires: pkgconfig(dlog)
  26 BuildRequires: pkgconfig(openssl1.1)
  27 BuildRequires: libattr-devel
  28 BuildRequires: pkgconfig(libsmack)
  29 BuildRequires: pkgconfig(libsystemd)
  30 BuildRequires: pkgconfig(libxml-2.0)
  31 BuildRequires: pkgconfig(capi-system-info)
  32 BuildRequires: pkgconfig(security-manager)
  33 BuildRequires: pkgconfig(cynara-client-async)
  34 BuildRequires: pkgconfig(cynara-creds-socket)
  35 BuildRequires: pkgconfig(libtzplatform-config)
  36 BuildRequires: pkgconfig(glib-2.0)
  37 BuildRequires: pkgconfig(pkgmgr)
  38 BuildRequires: pkgconfig(vconf)
  39 BuildRequires: pkgconfig(sqlcipher)
  40 %if 0%{?watchdog_enabled}
  41 BuildRequires: pkgconfig(argos_watchdog)
  42 %endif
  43 BuildRequires: boost-devel
  44 BuildRequires: ca-certificates-devel
  45 %if %{tz_backend_enabled} == ON
  46 BuildRequires: key-manager-ta-devel
  47 BuildRequires: key-manager-ta-serialization-devel
  48 BuildRequires: pkgconfig(tef-libteec)
  49 %endif
  50 Requires: libkey-manager-common = %{version}-%{release}
  51 %if "%{build_type}" == "COVERAGE"
  52 BuildRequires: lcov
  53 %endif
  54
  55 %{?systemd_requires}
  56
  57 %global user_name key-manager
  58 %global group_name security_fw
  59 %global supplementary_group_names key-manager
  60 %global service_name key-manager
  61 %global smack_domain_name System
  62 %global old_rw_data_dir /opt/data/ckm
  63 %global rw_data_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm}%{!?TZ_SYS_DATA:%old_rw_data_dir}
  64 %global ro_data_dir %{?TZ_SYS_RO_SHARE:%TZ_SYS_RO_SHARE/ckm}%{!?TZ_SYS_RO_SHARE:%_datadir/ckm}
  65 %global unit_tests_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm-unit-tests}%{!?TZ_SYS_DATA:%/opt/data/ckm-unit-tests}
  66 %global misc_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm-misc}%{!?TZ_SYS_DATA:%/opt/data/ckm-misc}
  67 %global coverage_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm-coverage}%{!?TZ_SYS_DATA:%/opt/data/ckm-coverage}
  68 %global bin_dir %{?TZ_SYS_BIN:%TZ_SYS_BIN}%{!?TZ_SYS_BIN:%_bindir}
  69 %global ro_etc_dir %{?TZ_SYS_RO_ETC:%TZ_SYS_RO_ETC}%{!?TZ_SYS_RO_ETC:/etc}
  70 %global run_dir %{?TZ_SYS_RUN:%TZ_SYS_RUN}%{!?TZ_SYS_RUN:/var/run}
  71 %global initial_values_dir_ro %{ro_data_dir}/initial_values
  72 %global initial_values_dir_rw %{rw_data_dir}/initial_values
  73 %global ca_certs_dir %{?TZ_SYS_CA_CERTS:%TZ_SYS_CA_CERTS}%{!?TZ_SYS_CA_CERTS:%ro_etc_dir/ssl/certs}
  74 %global dump_legacy_db_libname key-manager-dump-legacy-database
  75
  76 %description
  77 Central Key Manager daemon could be used as secure storage
  78 for certificate and private/public keys. It gives API for
  79 application to sign and verify (DSA/RSA/ECDSA) signatures.
  80
  81 %package -n libkey-manager-common
  82 Summary:    Central Key Manager (common libraries)
  83 Group:      Security/Libraries
  84 License:    Apache-2.0
  85 Requires(post): /sbin/ldconfig
  86 Requires(postun): /sbin/ldconfig
  87
  88 %description -n libkey-manager-common
  89 Central Key Manager package (common library)
  90
  91 %package -n libkey-manager-client
  92 Summary:    Central Key Manager (client)
  93 Group:      Security/Libraries
  94 License:    Apache-2.0
  95 Requires:   key-manager = %{version}-%{release}
  96 Requires:   libkey-manager-common = %{version}-%{release}
  97 Requires(post): /sbin/ldconfig
  98 Requires(postun): /sbin/ldconfig
  99
 100 %description -n libkey-manager-client
 101 Central Key Manager package (client)
 102
 103 %package -n libkey-manager-client-devel
 104 Summary:    Central Key Manager (client-devel)
 105 Group:      Security/Development
 106 License:    Apache-2.0
 107 BuildRequires: pkgconfig(capi-base-common)
 108 Requires:   pkgconfig(capi-base-common)
 109 Requires:   libkey-manager-client = %{version}-%{release}
 110
 111 %description -n libkey-manager-client-devel
 112 Central Key Manager package (client-devel)
 113
 114 %package -n key-manager-unit-tests
 115 Summary:    Unit tests for key-manager
 116 Group:      Security/Testing
 117 License:    Apache-2.0 and BSL-1.0
 118 BuildRequires: pkgconfig(libxml-2.0)
 119 Requires:   boost-test
 120
 121 %description -n key-manager-unit-tests
 122 Unit tests for key-manager.
 123
 124 %package -n key-manager-misc
 125 Summary:    Miscellaneous tools and tests for key-manager
 126 Group:      Security/Testing
 127 License:    Apache-2.0 and BSL-1.0
 128 Requires:   boost-test
 129 Requires:   key-manager = %{version}-%{release}
 130
 131 %description -n key-manager-misc
 132 Miscellaneous tools and tests for key-manager.
 133
 134 %package -n key-manager-pam-plugin
 135 Summary:    CKM login/password module to PAM
 136 Group:      Security/Libraries
 137 License:    Apache-2.0
 138 BuildRequires: pam-devel
 139 Requires:   key-manager = %{version}-%{release}
 140 Requires(post): /sbin/ldconfig
 141 Requires(postun): /sbin/ldconfig
 142
 143 %description -n key-manager-pam-plugin
 144 CKM login/password module to PAM. Used to monitor user login/logout
 145 and password change events from PAM
 146
 147 %package -n key-manager-initial-values
 148 Summary:    CKM initial values tool
 149 Group:      Security/Libraries
 150 License:    Apache-2.0
 151 BuildRequires: cmake
 152 BuildRequires: pkgconfig(openssl1.1)
 153 BuildRequires: pkgconfig(libxml-2.0)
 154 Requires(post): /sbin/ldconfig
 155 Requires(postun): /sbin/ldconfig
 156
 157 %description -n key-manager-initial-values
 158 Includes ckm_initial_values tool for initial values XML generation
 159
 160 %if "%{build_type}" == "COVERAGE"
 161
 162 %package -n key-manager-coverage
 163 Summary:    Central Key Manager code coverage data
 164 Group:      Security/Testing
 165 License:    Apache-2.0
 166 Requires:   key-manager-unit-tests = %{version}-%{release}
 167 Requires:   key-manager-debugsource = %{version}-%{release}
 168 Requires:   lcov
 169 Requires:   gcc
 170
 171 %description -n key-manager-coverage
 172 Central Key Manager code coverage data
 173
 174 %endif
 175
 176 %prep
 177 %setup -q
 178
 179 %build
 180 %if 0%{?sec_build_binary_debug_enable}
 181     export CFLAGS="$CFLAGS -DTIZEN_DEBUG_ENABLE"
 182     export CXXFLAGS="$CXXFLAGS -DTIZEN_DEBUG_ENABLE"
 183 %endif
 184
 185 export LDFLAGS+="-Wl,--rpath=%{_libdir},-Bsymbolic-functions"
 186
 187 %cmake . -DVERSION=%{version} \
 188         -DCMAKE_BUILD_TYPE=%{build_type} \
 189         -DCMAKE_VERBOSE_MAKEFILE=ON \
 190         -DSYSTEMD_UNIT_DIR=%{_unitdir} \
 191         -DSYSTEMD_ENV_FILE=%{ro_etc_dir}"/sysconfig/central-key-manager" \
 192         -DRUN_DIR:PATH=%{run_dir} \
 193         -DSERVICE_NAME=%{service_name} \
 194         -DUSER_NAME=%{user_name} \
 195         -DGROUP_NAME=%{group_name} \
 196         -DSUPPLEMENTARY_GROUP_NAMES="%{supplementary_group_names}" \
 197         -DSMACK_DOMAIN_NAME=%{smack_domain_name} \
 198         -DOLD_RW_DATA_DIR=%{old_rw_data_dir} \
 199         -DRW_DATA_DIR=%{rw_data_dir} \
 200         -DRO_DATA_DIR=%{ro_data_dir} \
 201         -DRW_ETC_DIR=%{rw_etc_dir} \
 202         -DRO_ETC_DIR=%{ro_etc_dir} \
 203         -DBIN_DIR=%{bin_dir} \
 204         -DINITIAL_VALUES_DIR_RW=%{initial_values_dir_rw} \
 205         -DINITIAL_VALUES_DIR_RO=%{initial_values_dir_ro} \
 206         -DCA_CERTS_DIR=%{ca_certs_dir} \
 207 %if 0%{?watchdog_enabled}
 208         -DWATCHDOG_ENABLED=%{watchdog_enabled} \
 209         -DWATCHDOG_TIMEOUT_SEC=%{watchdog_timeout_sec} \
 210         -DWATCHDOG_NOTIFY_SEC=%{watchdog_notify_sec} \
 211 %endif
 212 %if %{tz_backend_enabled} == ON
 213         -DTZ_BACKEND_ENABLED=ON \
 214 %else
 215         -DTZ_BACKEND_ENABLED=OFF \
 216 %endif
 217         -DUNIT_TESTS_DIR=%{unit_tests_dir} \
 218         -DMISC_DIR=%{misc_dir} \
 219         -DCOVERAGE_DIR=%{coverage_dir} \
 220 %if %{coverage_only}
 221         -DCOVERAGE_ONLY=ON \
 222 %endif
 223         -DDUMP_LEGACY_DB_LIBNAME=%{dump_legacy_db_libname}
 224
 225 make %{?jobs:-j%jobs}
 226
 227 %install
 228 %make_install
 229
 230 %if ! %{coverage_only}
 231
 232 %install_service multi-user.target.wants central-key-manager.service
 233 %install_service sockets.target.wants central-key-manager-api-control.socket
 234 %install_service sockets.target.wants central-key-manager-api-storage.socket
 235 %install_service sockets.target.wants central-key-manager-api-ocsp.socket
 236 %install_service sockets.target.wants central-key-manager-api-encryption.socket
 237 cp -a %{SOURCE1001} %{SOURCE1002} %{SOURCE1003} %{SOURCE1004} %{buildroot}%{_datadir}/
 238
 239 %endif
 240
 241 %pre
 242 # tzplatform-get sync breaked because of on-development situation. comment out just for temporary
 243 # fail if runtime dir variable is different than compilation time variable
 244 #if [ `tzplatform-get TZ_SYS_DATA | cut -d'=' -f2` != %{TZ_SYS_DATA} ]
 245 #then
 246 #    echo "Runtime value of TZ_SYS_DATA is different than the compilation time value. Aborting"
 247 #    exit 1
 248 #fi
 249 #if [ `tzplatform-get TZ_SYS_RO_SHARE | cut -d'=' -f2` != %{TZ_SYS_RO_SHARE} ]
 250 #then
 251 #    echo "Runtime value of TZ_SYS_RO_SHARE is different than the compilation time value. Aborting"
 252 #    exit 1
 253 #fi
 254
 255 ## backup plan for manage key-manager user/group is deprecated b/c pwdutils package
 256 ## would be excluded from binary
 257 # User/group (key-manager/key-manager) should be already added in passwd package.
 258 # This is our backup plan if passwd package will not be configured correctly.
 259 #id -g %{group_name} > /dev/null 2>&1
 260 #if [ $? -eq 1 ]; then
 261 #    groupadd %{group_name} -r > /dev/null 2>&1
 262 #fi
 263 #
 264 #id -u %{user_name} > /dev/null 2>&1
 265 #if [ $? -eq 1 ]; then
 266 #    useradd -d /var/lib/empty -s /sbin/nologin -r -g %{group_name} %{user_name} > /dev/null 2>&1
 267 #fi
 268
 269 %post
 270 # move data from old path to new one
 271 # we have to assume that in case of TZ_SYS_DATA change some upgrade script will move all the data
 272 if [ -d "%{old_rw_data_dir}" ] && [ "%{rw_data_dir}" != "%{old_rw_data_dir}" ]
 273 then
 274     echo "Migrating old rw data to new rw data dir"
 275     cp -a %{old_rw_data_dir}/. %{rw_data_dir}/ && rm -rf %{old_rw_data_dir}
 276 fi
 277
 278 systemctl daemon-reload
 279 if [ $1 = 1 ]; then
 280     # installation
 281     systemctl start central-key-manager.service
 282 fi
 283
 284 if [ $1 = 2 ]; then
 285     # update
 286
 287     # In ckm version <= 0.1.18 all files were owned by root.
 288     find %{rw_data_dir} -exec chsmack -a %{smack_domain_name} {} \;
 289     chown %{user_name}:%{group_name} -R %{rw_data_dir}
 290     systemctl restart central-key-manager.service
 291 fi
 292
 293
 294 %preun
 295 if [ $1 = 0 ]; then
 296     # unistall
 297     systemctl stop central-key-manager.service
 298 fi
 299
 300 %postun
 301 if [ $1 = 0 ]; then
 302     # unistall
 303     systemctl daemon-reload
 304 fi
 305
 306 %post -n libkey-manager-common -p /sbin/ldconfig
 307 %post -n libkey-manager-client -p /sbin/ldconfig
 308 %postun -n libkey-manager-common -p /sbin/ldconfig
 309 %postun -n libkey-manager-client -p /sbin/ldconfig
 310
 311 %if ! %{coverage_only}
 312
 313 %files -n key-manager
 314 %manifest key-manager.manifest
 315 %license LICENSE
 316 %license LICENSE.BSD-3-Clause
 317 %{bin_dir}/key-manager
 318 %{_libdir}/lib%{dump_legacy_db_libname}.so
 319 %{_unitdir}/multi-user.target.wants/central-key-manager.service
 320 %{_unitdir}/central-key-manager.service
 321 %{_unitdir}/sockets.target.wants/central-key-manager-api-control.socket
 322 %{_unitdir}/central-key-manager-api-control.socket
 323 %{_unitdir}/sockets.target.wants/central-key-manager-api-storage.socket
 324 %{_unitdir}/central-key-manager-api-storage.socket
 325 %{_unitdir}/sockets.target.wants/central-key-manager-api-ocsp.socket
 326 %{_unitdir}/central-key-manager-api-ocsp.socket
 327 %{_unitdir}/sockets.target.wants/central-key-manager-api-encryption.socket
 328 %{_unitdir}/central-key-manager-api-encryption.socket
 329 %dir %{ro_data_dir}
 330 %{ro_data_dir}/*
 331 %dir %attr(770, %{user_name}, %{group_name}) %{rw_data_dir}
 332 %dir %attr(550, %{user_name}, %{group_name}) %{initial_values_dir_ro}
 333 %dir %attr(770, %{user_name}, %{group_name}) %{initial_values_dir_rw}
 334 %attr(755,root,root) /usr/share/upgrade/scripts/295.key-manager_upgrade.sh
 335
 336 %{ro_etc_dir}/gumd/userdel.d/10_key-manager.post
 337 %{bin_dir}/ckm_tool
 338
 339 %files -n key-manager-pam-plugin
 340 %manifest %{_datadir}/key-manager-pam-plugin.manifest
 341 %license LICENSE
 342 %{_libdir}/security/pam_key_manager_plugin.so*
 343
 344 %files -n libkey-manager-common
 345 %manifest %{_datadir}/libkey-manager-common.manifest
 346 %license LICENSE
 347 %{_libdir}/libkey-manager-common.so.*
 348
 349 %files -n libkey-manager-client
 350 %manifest %{_datadir}/libkey-manager-client.manifest
 351 %license LICENSE
 352 %{_libdir}/libkey-manager-client.so.*
 353 %{_libdir}/libkey-manager-control-client.so.*
 354
 355 %files -n libkey-manager-client-devel
 356 %manifest %{_datadir}/libkey-manager-client-devel.manifest
 357 %license LICENSE
 358 %{_libdir}/libkey-manager-client.so
 359 %{_libdir}/libkey-manager-control-client.so
 360 %{_libdir}/libkey-manager-common.so
 361 %{_includedir}/ckm/ckm/ckm-manager.h
 362 %{_includedir}/ckm/ckm/ckm-manager-async.h
 363 %{_includedir}/ckm/ckm/ckm-certificate.h
 364 %{_includedir}/ckm/ckm/ckm-control.h
 365 %{_includedir}/ckm/ckm/ckm-error.h
 366 %{_includedir}/ckm/ckm/ckm-key.h
 367 %{_includedir}/ckm/ckm/ckm-password.h
 368 %{_includedir}/ckm/ckm/ckm-pkcs12.h
 369 %{_includedir}/ckm/ckm/ckm-raw-buffer.h
 370 %{_includedir}/ckm/ckm/ckm-type.h
 371 %{_includedir}/ckm/ckm/ckm-zero-memory.h
 372 %{_includedir}/ckm/ckmc/ckmc-manager.h
 373 %{_includedir}/ckm/ckmc/ckmc-control.h
 374 %{_includedir}/ckm/ckmc/ckmc-error.h
 375 %{_includedir}/ckm/ckmc/ckmc-type.h
 376 %{_libdir}/pkgconfig/*.pc
 377
 378 %files -n key-manager-initial-values
 379 %license LICENSE
 380 %{bin_dir}/ckm_initial_values
 381
 382 %files -n key-manager-misc
 383 %manifest key-manager-misc.manifest
 384 %license LICENSE
 385 %license LICENSE.BSL-1.0
 386 %{bin_dir}/ckm-scheme-test
 387 %{bin_dir}/ckm_so_loader
 388 %{bin_dir}/ckm_db_tool
 389 %{bin_dir}/ckm_db_merge
 390 %{bin_dir}/ckm_generate_db
 391 %{bin_dir}/ckm_db_perf
 392 %misc_dir
 393
 394 %endif
 395
 396 %files -n key-manager-unit-tests
 397 %manifest key-manager-unit-tests.manifest
 398 %license LICENSE
 399 %license LICENSE.BSL-1.0
 400 %{bin_dir}/ckm-unit-tests
 401 %unit_tests_dir
 402
 403 %if "%{build_type}" == "COVERAGE"
 404
 405 %files -n key-manager-coverage
 406 %license LICENSE
 407 %{bin_dir}/key-manager-coverage.sh
 408 %coverage_dir
 409
 410 %endif