packaging/key-manager.spec

   1 Name:       key-manager
   2 Summary:    Central Key Manager and utilities
   3 Version:    0.1.18
   4 Release:    1
   5 Group:      System/Security
   6 License:    Apache-2.0 and BSL-1.0
   7 Source0:    %{name}-%{version}.tar.gz
   8 Source1001: key-manager-pam-plugin.manifest
   9 Source1002: libkey-manager-client.manifest
  10 Source1003: libkey-manager-client-devel.manifest
  11 Source1004: libkey-manager-common.manifest
  12 Source1005: key-manager-tests.manifest
  13 BuildRequires: cmake
  14 BuildRequires: zip
  15 BuildRequires: pkgconfig(dlog)
  16 BuildRequires: pkgconfig(openssl)
  17 BuildRequires: libattr-devel
  18 BuildRequires: pkgconfig(libsmack)
  19 BuildRequires: pkgconfig(libsystemd-daemon)
  20 BuildRequires: pkgconfig(libsystemd-journal)
  21 BuildRequires: pkgconfig(libxml-2.0)
  22 BuildRequires: pkgconfig(capi-system-info)
  23 BuildRequires: pkgconfig(security-manager)
  24 BuildRequires: pkgconfig(cynara-client-async)
  25 BuildRequires: pkgconfig(cynara-creds-socket)
  26 BuildRequires: pkgconfig(libtzplatform-config)
  27 BuildRequires: pkgconfig(glib-2.0)
  28 BuildRequires: pkgconfig(capi-appfw-package-manager)
  29 BuildRequires: boost-devel
  30 Requires(pre): pwdutils
  31 Requires(pre): tizen-platform-config-tools
  32 Requires(postun): pwdutils
  33 Requires: libkey-manager-common = %{version}-%{release}
  34 %{?systemd_requires}
  35
  36 %global user_name key-manager
  37 %global group_name key-manager
  38 %global service_name key-manager
  39 %global _rundir /run
  40 %global smack_domain_name System
  41 %global rw_data_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm/}%{!?TZ_SYS_DATA:/opt/data/ckm/}
  42 %global ro_data_dir %{?TZ_SYS_SHARE:%TZ_SYS_SHARE/ckm/}%{!?TZ_SYS_SHARE:/usr/share/ckm/}
  43 %global db_test_dir %{?TZ_SYS_SHARE:%TZ_SYS_SHARE/ckm-db-test/}%{!?TZ_SYS_SHARE:/usr/share/ckm-db-test/}
  44 %global initial_values_dir %{rw_data_dir}initial_values/
  45
  46 %description
  47 Central Key Manager daemon could be used as secure storage
  48 for certificate and private/public keys. It gives API for
  49 application to sign and verify (DSA/RSA/ECDSA) signatures.
  50
  51 %package -n libkey-manager-common
  52 Summary:    Central Key Manager (common libraries)
  53 Group:      Development/Libraries
  54 Requires(post): /sbin/ldconfig
  55 Requires(postun): /sbin/ldconfig
  56
  57 %description -n libkey-manager-common
  58 Central Key Manager package (common library)
  59
  60 %package -n libkey-manager-client
  61 Summary:    Central Key Manager (client)
  62 Group:      Development/Libraries
  63 Requires:   key-manager = %{version}-%{release}
  64 Requires:   libkey-manager-common = %{version}-%{release}
  65 Requires(post): /sbin/ldconfig
  66 Requires(postun): /sbin/ldconfig
  67
  68 %description -n libkey-manager-client
  69 Central Key Manager package (client)
  70
  71 %package -n libkey-manager-client-devel
  72 Summary:    Central Key Manager (client-devel)
  73 Group:      Development/Libraries
  74 BuildRequires: pkgconfig(capi-base-common)
  75 Requires:   pkgconfig(capi-base-common)
  76 Requires:   libkey-manager-client = %{version}-%{release}
  77
  78 %description -n libkey-manager-client-devel
  79 Central Key Manager package (client-devel)
  80
  81 %package -n key-manager-tests
  82 Summary:    Internal test for key-manager
  83 Group:      Development
  84 BuildRequires: pkgconfig(libxml-2.0)
  85 Requires:   boost-test
  86 Requires:   key-manager = %{version}-%{release}
  87
  88 %description -n key-manager-tests
  89 Internal test for key-manager implementation.
  90
  91 %package -n key-manager-pam-plugin
  92 Summary:    CKM login/password module to PAM
  93 Group:      Development/Libraries
  94 BuildRequires: pam-devel
  95 Requires:   key-manager = %{version}-%{release}
  96 Requires(post): /sbin/ldconfig
  97 Requires(postun): /sbin/ldconfig
  98
  99 %description -n key-manager-pam-plugin
 100 CKM login/password module to PAM. Used to monitor user login/logout
 101 and password change events from PAM
 102
 103
 104 %prep
 105 %setup -q
 106 cp -a %{SOURCE1001} .
 107 cp -a %{SOURCE1002} .
 108 cp -a %{SOURCE1003} .
 109 cp -a %{SOURCE1004} .
 110 cp -a %{SOURCE1005} .
 111
 112 %build
 113 %if 0%{?sec_build_binary_debug_enable}
 114     export CFLAGS="$CFLAGS -DTIZEN_DEBUG_ENABLE"
 115     export CXXFLAGS="$CXXFLAGS -DTIZEN_DEBUG_ENABLE"
 116     export FFLAGS="$FFLAGS -DTIZEN_DEBUG_ENABLE"
 117 %endif
 118
 119
 120 export LDFLAGS+="-Wl,--rpath=%{_libdir},-Bsymbolic-functions "
 121
 122 %cmake . -DVERSION=%{version} \
 123         -DCMAKE_BUILD_TYPE=%{?build_type:%build_type}%{!?build_type:RELEASE} \
 124         -DCMAKE_VERBOSE_MAKEFILE=ON \
 125         -DSYSTEMD_UNIT_DIR=%{_unitdir} \
 126         -DSYSTEMD_ENV_FILE="/etc/sysconfig/central-key-manager" \
 127         -DRUN_DIR:PATH=%{_rundir} \
 128         -DSERVICE_NAME=%{service_name} \
 129         -DUSER_NAME=%{user_name} \
 130         -DGROUP_NAME=%{group_name} \
 131         -DSMACK_DOMAIN_NAME=%{smack_domain_name} \
 132         -DMOCKUP_SM=%{?mockup_sm:%mockup_sm}%{!?mockup_sm:OFF} \
 133         -DRW_DATA_DIR=%{rw_data_dir} \
 134         -DRO_DATA_DIR=%{ro_data_dir} \
 135         -DINITIAL_VALUES_DIR=%{initial_values_dir} \
 136         -DDB_TEST_DIR=%{db_test_dir}
 137
 138 make %{?jobs:-j%jobs}
 139
 140 %install
 141 rm -rf %{buildroot}
 142 mkdir -p %{buildroot}%{initial_values_dir}
 143 mkdir -p %{buildroot}/etc/security/
 144 mkdir -p %{buildroot}%{ro_data_dir}/scripts
 145 mkdir -p %{buildroot}/etc/gumd/userdel.d/
 146 cp data/scripts/*.sql %{buildroot}%{ro_data_dir}/scripts
 147 cp doc/initial_values.xsd %{buildroot}%{ro_data_dir}
 148 cp doc/sw_key.xsd %{buildroot}%{ro_data_dir}
 149 cp data/gumd/10_key-manager.post %{buildroot}/etc/gumd/userdel.d/
 150
 151 mkdir -p %{buildroot}%{db_test_dir}
 152 cp tests/testme_ver1.db %{buildroot}%{db_test_dir}
 153 cp tests/testme_ver2.db %{buildroot}%{db_test_dir}
 154 cp tests/testme_ver3.db %{buildroot}%{db_test_dir}
 155 cp tests/XML_1_okay.xml %{buildroot}%{db_test_dir}
 156 cp tests/XML_1_okay.xsd %{buildroot}%{db_test_dir}
 157 cp tests/XML_1_wrong.xml %{buildroot}%{db_test_dir}
 158 cp tests/XML_1_wrong.xsd %{buildroot}%{db_test_dir}
 159 cp tests/XML_2_structure.xml %{buildroot}%{db_test_dir}
 160 cp tests/XML_3_encrypted.xml %{buildroot}%{db_test_dir}
 161 cp tests/XML_3_encrypted.xsd %{buildroot}%{db_test_dir}
 162 cp tests/XML_4_device_key.xml %{buildroot}%{db_test_dir}
 163 cp tests/XML_4_device_key.xsd %{buildroot}%{db_test_dir}
 164 cp tests/encryption-scheme/db/db-7654 %{buildroot}%{db_test_dir}/db-7654
 165 cp tests/encryption-scheme/db/db-key-7654 %{buildroot}%{db_test_dir}/db-key-7654
 166 cp tests/encryption-scheme/db/key-7654 %{buildroot}%{db_test_dir}/key-7654
 167
 168 %make_install
 169 %install_service multi-user.target.wants central-key-manager.service
 170 %install_service sockets.target.wants central-key-manager-api-control.socket
 171 %install_service sockets.target.wants central-key-manager-api-storage.socket
 172 %install_service sockets.target.wants central-key-manager-api-ocsp.socket
 173 %install_service sockets.target.wants central-key-manager-api-encryption.socket
 174
 175 %pre
 176 # fail if runtime dir variable is different than compilation time variable
 177 if [ `tzplatform-get TZ_SYS_DATA | cut -d'=' -f2` != %{TZ_SYS_DATA} ]
 178 then
 179     echo "Runtime value of TZ_SYS_DATA is different than the compilation time value. Aborting"
 180     exit 1
 181 fi
 182 if [ `tzplatform-get TZ_SYS_SHARE | cut -d'=' -f2` != %{TZ_SYS_SHARE} ]
 183 then
 184     echo "Runtime value of TZ_SYS_SHARE is different than the compilation time value. Aborting"
 185     exit 1
 186 fi
 187
 188 # User/group (key-manager/key-manager) should be already added in passwd package.
 189 # This is our backup plan if passwd package will not be configured correctly.
 190 id -g %{group_name} > /dev/null 2>&1
 191 if [ $? -eq 1 ]; then
 192     groupadd %{group_name} -r > /dev/null 2>&1
 193 fi
 194
 195 id -u %{user_name} > /dev/null 2>&1
 196 if [ $? -eq 1 ]; then
 197     useradd -d /var/lib/empty -s /sbin/nologin -r -g %{group_name} %{user_name} > /dev/null 2>&1
 198 fi
 199
 200 %clean
 201 rm -rf %{buildroot}
 202
 203 %post
 204 # move data from old path to new one
 205 # we have to assume that in case of TZ_SYS_DATA change some upgrade script will move all the data
 206 if [ -d "/opt/data/ckm" ]
 207 then
 208     cp -a /opt/data/ckm/. %{rw_data_dir} && rm -rf /opt/data/ckm
 209 fi
 210
 211 systemctl daemon-reload
 212 if [ $1 = 1 ]; then
 213     # installation
 214     systemctl start central-key-manager.service
 215 fi
 216
 217 if [ $1 = 2 ]; then
 218     # update
 219
 220     # In ckm version <= 0.1.18 all files were owned by root.
 221     find %{rw_data_dir} -exec chsmack -a %{smack_domain_name} {} \;
 222     chown %{user_name}:%{group_name} -R %{rw_data_dir}
 223     systemctl restart central-key-manager.service
 224 fi
 225
 226
 227 %preun
 228 if [ $1 = 0 ]; then
 229     # unistall
 230     systemctl stop central-key-manager.service
 231 fi
 232
 233 %postun
 234 if [ $1 = 0 ]; then
 235     # unistall
 236     systemctl daemon-reload
 237 fi
 238
 239 %post -n libkey-manager-common -p /sbin/ldconfig
 240 %post -n libkey-manager-client -p /sbin/ldconfig
 241 %postun -n libkey-manager-common -p /sbin/ldconfig
 242 %postun -n libkey-manager-client -p /sbin/ldconfig
 243
 244 %files -n key-manager
 245 %manifest key-manager.manifest
 246 %license LICENSE
 247 %license LICENSE.BSL-1.0
 248 %{_bindir}/key-manager
 249 %{_unitdir}/multi-user.target.wants/central-key-manager.service
 250 %{_unitdir}/central-key-manager.service
 251 %{_unitdir}/central-key-manager.target
 252 %{_unitdir}/sockets.target.wants/central-key-manager-api-control.socket
 253 %{_unitdir}/central-key-manager-api-control.socket
 254 %{_unitdir}/sockets.target.wants/central-key-manager-api-storage.socket
 255 %{_unitdir}/central-key-manager-api-storage.socket
 256 %{_unitdir}/sockets.target.wants/central-key-manager-api-ocsp.socket
 257 %{_unitdir}/central-key-manager-api-ocsp.socket
 258 %{_unitdir}/sockets.target.wants/central-key-manager-api-encryption.socket
 259 %{_unitdir}/central-key-manager-api-encryption.socket
 260 %dir %{_datadir}/ckm
 261 %{_datadir}/ckm/initial_values.xsd
 262 %{_datadir}/ckm/sw_key.xsd
 263 %attr(770, %{user_name}, %{group_name}) %{rw_data_dir}
 264 %attr(770, %{user_name}, %{group_name}) %{initial_values_dir}
 265 %{_datadir}/ckm/scripts/*.sql
 266 /etc/opt/upgrade/230.key-manager-change-data-dir.patch.sh
 267 /etc/opt/upgrade/231.key-manager-migrate-dkek.patch.sh
 268 /etc/opt/upgrade/232.key-manager-change-user.patch.sh
 269 /etc/gumd/userdel.d/10_key-manager.post
 270 %{_bindir}/ckm_tool
 271
 272 %files -n key-manager-pam-plugin
 273 %manifest key-manager-pam-plugin.manifest
 274 %{_libdir}/security/pam_key_manager_plugin.so*
 275
 276 %files -n libkey-manager-common
 277 %manifest libkey-manager-common.manifest
 278 %{_libdir}/libkey-manager-common.so.*
 279
 280 %files -n libkey-manager-client
 281 %manifest libkey-manager-client.manifest
 282 %license LICENSE
 283 %{_libdir}/libkey-manager-client.so.*
 284 %{_libdir}/libkey-manager-control-client.so.*
 285
 286 %files -n libkey-manager-client-devel
 287 %manifest libkey-manager-client-devel.manifest
 288 %{_libdir}/libkey-manager-client.so
 289 %{_libdir}/libkey-manager-control-client.so
 290 %{_libdir}/libkey-manager-common.so
 291 %{_includedir}/ckm/ckm/ckm-manager.h
 292 %{_includedir}/ckm/ckm/ckm-manager-async.h
 293 %{_includedir}/ckm/ckm/ckm-certificate.h
 294 %{_includedir}/ckm/ckm/ckm-control.h
 295 %{_includedir}/ckm/ckm/ckm-error.h
 296 %{_includedir}/ckm/ckm/ckm-key.h
 297 %{_includedir}/ckm/ckm/ckm-password.h
 298 %{_includedir}/ckm/ckm/ckm-pkcs12.h
 299 %{_includedir}/ckm/ckm/ckm-raw-buffer.h
 300 %{_includedir}/ckm/ckm/ckm-type.h
 301 %{_includedir}/ckm/ckmc/ckmc-manager.h
 302 %{_includedir}/ckm/ckmc/ckmc-control.h
 303 %{_includedir}/ckm/ckmc/ckmc-error.h
 304 %{_includedir}/ckm/ckmc/ckmc-type.h
 305 %{_libdir}/pkgconfig/*.pc
 306
 307 %files -n key-manager-tests
 308 %manifest key-manager-tests.manifest
 309 %{_bindir}/ckm-tests-internal
 310 %dir %{_datadir}/ckm-db-test
 311 %{_datadir}/ckm-db-test/testme_ver1.db
 312 %{_datadir}/ckm-db-test/testme_ver2.db
 313 %{_datadir}/ckm-db-test/testme_ver3.db
 314 %{_datadir}/ckm-db-test/XML_1_okay.xml
 315 %{_datadir}/ckm-db-test/XML_1_okay.xsd
 316 %{_datadir}/ckm-db-test/XML_1_wrong.xml
 317 %{_datadir}/ckm-db-test/XML_1_wrong.xsd
 318 %{_datadir}/ckm-db-test/XML_2_structure.xml
 319 %{_datadir}/ckm-db-test/XML_3_encrypted.xml
 320 %{_datadir}/ckm-db-test/XML_3_encrypted.xsd
 321 %{_datadir}/ckm-db-test/XML_4_device_key.xml
 322 %{_datadir}/ckm-db-test/XML_4_device_key.xsd
 323 %{_datadir}/ckm-db-test/db-7654
 324 %{_datadir}/ckm-db-test/db-key-7654
 325 %{_datadir}/ckm-db-test/key-7654
 326 %{_datadir}/ckm-db-test/encryption-scheme.p12
 327 %{_bindir}/ckm_so_loader
 328 %{_bindir}/ckm_db_tool
 329 %{_bindir}/ckm_generate_db
 330