packaging/key-manager.spec

   1 Name:       key-manager
   2 Summary:    Central Key Manager and utilities
   3 Version:    0.1.22
   4 Release:    1
   5 Group:      System/Security
   6 License:    Apache-2.0 and BSL-1.0 and BSD-2.0
   7 Source0:    %{name}-%{version}.tar.gz
   8 Source1001: key-manager-pam-plugin.manifest
   9 Source1002: libkey-manager-client.manifest
  10 Source1003: libkey-manager-client-devel.manifest
  11 Source1004: libkey-manager-common.manifest
  12 BuildRequires: cmake
  13 BuildRequires: zip
  14 BuildRequires: pkgconfig(dlog)
  15 BuildRequires: pkgconfig(openssl)
  16 BuildRequires: libattr-devel
  17 BuildRequires: pkgconfig(libsmack)
  18 BuildRequires: pkgconfig(libsystemd-daemon)
  19 BuildRequires: pkgconfig(libsystemd-journal)
  20 BuildRequires: pkgconfig(libxml-2.0)
  21 BuildRequires: pkgconfig(capi-system-info)
  22 BuildRequires: pkgconfig(security-manager)
  23 BuildRequires: pkgconfig(cynara-client-async)
  24 BuildRequires: pkgconfig(cynara-creds-socket)
  25 BuildRequires: pkgconfig(libtzplatform-config)
  26 BuildRequires: pkgconfig(glib-2.0)
  27 BuildRequires: pkgconfig(pkgmgr)
  28 BuildRequires: boost-devel
  29 BuildRequires: ca-certificates-devel
  30 #Requires(pre): tizen-platform-config-tools
  31 Requires: libkey-manager-common = %{version}-%{release}
  32 %{?systemd_requires}
  33
  34 %global user_name key-manager
  35 %global group_name key-manager
  36 %global service_name key-manager
  37 %global smack_domain_name System
  38 %global old_rw_data_dir /opt/data/ckm
  39 %global rw_data_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm}%{!?TZ_SYS_DATA:%old_rw_data_dir}
  40 %global ro_data_dir %{?TZ_SYS_RO_SHARE:%TZ_SYS_RO_SHARE/ckm}%{!?TZ_SYS_RO_SHARE:%_datadir/ckm}
  41 %global db_test_dir %{?TZ_SYS_RO_SHARE:%TZ_SYS_RO_SHARE/ckm-db-test}%{!?TZ_SYS_RO_SHARE:%_datadir/ckm-db-test}
  42 %global bin_dir %{?TZ_SYS_BIN:%TZ_SYS_BIN}%{!?TZ_SYS_BIN:%_bindir}
  43 # image creation error occured if /usr/sbin used for ldconfig
  44 #%global sbin_dir %{?TZ_SYS_SBIN:%TZ_SYS_SBIN}%{!?TZ_SYS_SBIN:%_sbindir}
  45 %global sbin_dir /sbin
  46 %global ro_etc_dir %{?TZ_SYS_RO_ETC:%TZ_SYS_RO_ETC}%{!?TZ_SYS_RO_ETC:/etc}
  47 %global run_dir %{?TZ_SYS_RUN:%TZ_SYS_RUN}%{!?TZ_SYS_RUN:/var/run}
  48 %global initial_values_dir %{rw_data_dir}/initial_values
  49 %global ca_certs_dir %{?TZ_SYS_CA_CERTS:%TZ_SYS_CA_CERTS}%{!?TZ_SYS_CA_CERTS:%ro_etc_dir/ssl/certs}
  50
  51 %description
  52 Central Key Manager daemon could be used as secure storage
  53 for certificate and private/public keys. It gives API for
  54 application to sign and verify (DSA/RSA/ECDSA) signatures.
  55
  56 %package -n libkey-manager-common
  57 Summary:    Central Key Manager (common libraries)
  58 Group:      Development/Libraries
  59 Requires(post): %{sbin_dir}/ldconfig
  60 Requires(postun): %{sbin_dir}/ldconfig
  61
  62 %description -n libkey-manager-common
  63 Central Key Manager package (common library)
  64
  65 %package -n libkey-manager-client
  66 Summary:    Central Key Manager (client)
  67 Group:      Development/Libraries
  68 Requires:   key-manager = %{version}-%{release}
  69 Requires:   libkey-manager-common = %{version}-%{release}
  70 Requires(post): %{sbin_dir}/ldconfig
  71 Requires(postun): %{sbin_dir}/ldconfig
  72
  73 %description -n libkey-manager-client
  74 Central Key Manager package (client)
  75
  76 %package -n libkey-manager-client-devel
  77 Summary:    Central Key Manager (client-devel)
  78 Group:      Development/Libraries
  79 BuildRequires: pkgconfig(capi-base-common)
  80 Requires:   pkgconfig(capi-base-common)
  81 Requires:   libkey-manager-client = %{version}-%{release}
  82
  83 %description -n libkey-manager-client-devel
  84 Central Key Manager package (client-devel)
  85
  86 %package -n key-manager-tests
  87 Summary:    Internal test for key-manager
  88 Group:      Development
  89 BuildRequires: pkgconfig(libxml-2.0)
  90 Requires:   boost-test
  91 Requires:   key-manager = %{version}-%{release}
  92
  93 %description -n key-manager-tests
  94 Internal test for key-manager implementation.
  95
  96 %package -n key-manager-pam-plugin
  97 Summary:    CKM login/password module to PAM
  98 Group:      Development/Libraries
  99 BuildRequires: pam-devel
 100 Requires:   key-manager = %{version}-%{release}
 101 Requires(post): %{sbin_dir}/ldconfig
 102 Requires(postun): %{sbin_dir}/ldconfig
 103
 104 %description -n key-manager-pam-plugin
 105 CKM login/password module to PAM. Used to monitor user login/logout
 106 and password change events from PAM
 107
 108
 109 %prep
 110 %setup -q
 111 cp -a %{SOURCE1001} .
 112 cp -a %{SOURCE1002} .
 113 cp -a %{SOURCE1003} .
 114 cp -a %{SOURCE1004} .
 115
 116 %build
 117 %if 0%{?sec_build_binary_debug_enable}
 118     export CFLAGS="$CFLAGS -DTIZEN_DEBUG_ENABLE"
 119     export CXXFLAGS="$CXXFLAGS -DTIZEN_DEBUG_ENABLE"
 120     export FFLAGS="$FFLAGS -DTIZEN_DEBUG_ENABLE"
 121 %endif
 122
 123
 124 export LDFLAGS+="-Wl,--rpath=%{_libdir},-Bsymbolic-functions "
 125
 126 %cmake . -DVERSION=%{version} \
 127         -DCMAKE_BUILD_TYPE=%{?build_type:%build_type}%{!?build_type:RELEASE} \
 128         -DCMAKE_VERBOSE_MAKEFILE=ON \
 129         -DSYSTEMD_UNIT_DIR=%{_unitdir} \
 130         -DSYSTEMD_ENV_FILE=%{ro_etc_dir}"/sysconfig/central-key-manager" \
 131         -DRUN_DIR:PATH=%{run_dir} \
 132         -DSERVICE_NAME=%{service_name} \
 133         -DUSER_NAME=%{user_name} \
 134         -DGROUP_NAME=%{group_name} \
 135         -DSMACK_DOMAIN_NAME=%{smack_domain_name} \
 136         -DMOCKUP_SM=%{?mockup_sm:%mockup_sm}%{!?mockup_sm:OFF} \
 137         -DOLD_RW_DATA_DIR=%{old_rw_data_dir} \
 138         -DRW_DATA_DIR=%{rw_data_dir} \
 139         -DRO_DATA_DIR=%{ro_data_dir} \
 140         -DRW_ETC_DIR=%{rw_etc_dir} \
 141         -DRO_ETC_DIR=%{ro_etc_dir} \
 142         -DBIN_DIR=%{bin_dir} \
 143         -DINITIAL_VALUES_DIR=%{initial_values_dir} \
 144         -DDB_TEST_DIR=%{db_test_dir} \
 145         -DCA_CERTS_DIR=%{ca_certs_dir}
 146
 147 make %{?jobs:-j%jobs}
 148
 149 %install
 150 %make_install
 151 %install_service multi-user.target.wants central-key-manager.service
 152 %install_service sockets.target.wants central-key-manager-api-control.socket
 153 %install_service sockets.target.wants central-key-manager-api-storage.socket
 154 %install_service sockets.target.wants central-key-manager-api-ocsp.socket
 155 %install_service sockets.target.wants central-key-manager-api-encryption.socket
 156
 157 %pre
 158 # tzplatform-get sync breaked because of on-development situation. comment out just for temporary
 159 # fail if runtime dir variable is different than compilation time variable
 160 #if [ `tzplatform-get TZ_SYS_DATA | cut -d'=' -f2` != %{TZ_SYS_DATA} ]
 161 #then
 162 #    echo "Runtime value of TZ_SYS_DATA is different than the compilation time value. Aborting"
 163 #    exit 1
 164 #fi
 165 #if [ `tzplatform-get TZ_SYS_RO_SHARE | cut -d'=' -f2` != %{TZ_SYS_RO_SHARE} ]
 166 #then
 167 #    echo "Runtime value of TZ_SYS_RO_SHARE is different than the compilation time value. Aborting"
 168 #    exit 1
 169 #fi
 170
 171 ## backup plan for manage key-manager user/group is deprecated b/c pwdutils package
 172 ## would be excluded from binary
 173 # User/group (key-manager/key-manager) should be already added in passwd package.
 174 # This is our backup plan if passwd package will not be configured correctly.
 175 #id -g %{group_name} > /dev/null 2>&1
 176 #if [ $? -eq 1 ]; then
 177 #    groupadd %{group_name} -r > /dev/null 2>&1
 178 #fi
 179 #
 180 #id -u %{user_name} > /dev/null 2>&1
 181 #if [ $? -eq 1 ]; then
 182 #    useradd -d /var/lib/empty -s %{sbin_dir}/nologin -r -g %{group_name} %{user_name} > /dev/null 2>&1
 183 #fi
 184
 185 %post
 186 # move data from old path to new one
 187 # we have to assume that in case of TZ_SYS_DATA change some upgrade script will move all the data
 188 if [ -d "%{old_rw_data_dir}" ] && [ "%{rw_data_dir}" != "%{old_rw_data_dir}" ]
 189 then
 190     echo "Migrating old rw data to new rw data dir"
 191     cp -a %{old_rw_data_dir}/. %{rw_data_dir}/ && rm -rf %{old_rw_data_dir}
 192 fi
 193
 194 systemctl daemon-reload
 195 if [ $1 = 1 ]; then
 196     # installation
 197     systemctl start central-key-manager.service
 198 fi
 199
 200 if [ $1 = 2 ]; then
 201     # update
 202
 203     # In ckm version <= 0.1.18 all files were owned by root.
 204     find %{rw_data_dir} -exec chsmack -a %{smack_domain_name} {} \;
 205     chown %{user_name}:%{group_name} -R %{rw_data_dir}
 206     systemctl restart central-key-manager.service
 207 fi
 208
 209
 210 %preun
 211 if [ $1 = 0 ]; then
 212     # unistall
 213     systemctl stop central-key-manager.service
 214 fi
 215
 216 %postun
 217 if [ $1 = 0 ]; then
 218     # unistall
 219     systemctl daemon-reload
 220 fi
 221
 222 %post -n libkey-manager-common -p %{sbin_dir}/ldconfig
 223 %post -n libkey-manager-client -p %{sbin_dir}/ldconfig
 224 %postun -n libkey-manager-common -p %{sbin_dir}/ldconfig
 225 %postun -n libkey-manager-client -p %{sbin_dir}/ldconfig
 226
 227 %files -n key-manager
 228 %manifest key-manager.manifest
 229 %license LICENSE
 230 %license LICENSE.BSL-1.0
 231 %license LICENSE.BSD-2.0
 232 %{bin_dir}/key-manager
 233 %{_unitdir}/multi-user.target.wants/central-key-manager.service
 234 %{_unitdir}/central-key-manager.service
 235 %{_unitdir}/central-key-manager.target
 236 %{_unitdir}/sockets.target.wants/central-key-manager-api-control.socket
 237 %{_unitdir}/central-key-manager-api-control.socket
 238 %{_unitdir}/sockets.target.wants/central-key-manager-api-storage.socket
 239 %{_unitdir}/central-key-manager-api-storage.socket
 240 %{_unitdir}/sockets.target.wants/central-key-manager-api-ocsp.socket
 241 %{_unitdir}/central-key-manager-api-ocsp.socket
 242 %{_unitdir}/sockets.target.wants/central-key-manager-api-encryption.socket
 243 %{_unitdir}/central-key-manager-api-encryption.socket
 244 %dir %{ro_data_dir}
 245 %{ro_data_dir}/*
 246 %dir %attr(770, %{user_name}, %{group_name}) %{rw_data_dir}
 247 %dir %attr(770, %{user_name}, %{group_name}) %{initial_values_dir}
 248 %{ro_etc_dir}/opt/upgrade/230.key-manager-change-data-dir.patch.sh
 249 %{ro_etc_dir}/opt/upgrade/231.key-manager-migrate-dkek.patch.sh
 250 %{ro_etc_dir}/opt/upgrade/232.key-manager-change-user.patch.sh
 251 %{ro_etc_dir}/gumd/userdel.d/10_key-manager.post
 252 %{bin_dir}/ckm_tool
 253
 254 %files -n key-manager-pam-plugin
 255 %manifest key-manager-pam-plugin.manifest
 256 %{_libdir}/security/pam_key_manager_plugin.so*
 257
 258 %files -n libkey-manager-common
 259 %manifest libkey-manager-common.manifest
 260 %{_libdir}/libkey-manager-common.so.*
 261
 262 %files -n libkey-manager-client
 263 %manifest libkey-manager-client.manifest
 264 %license LICENSE
 265 %{_libdir}/libkey-manager-client.so.*
 266 %{_libdir}/libkey-manager-control-client.so.*
 267
 268 %files -n libkey-manager-client-devel
 269 %manifest libkey-manager-client-devel.manifest
 270 %{_libdir}/libkey-manager-client.so
 271 %{_libdir}/libkey-manager-control-client.so
 272 %{_libdir}/libkey-manager-common.so
 273 %{_includedir}/ckm/ckm/ckm-manager.h
 274 %{_includedir}/ckm/ckm/ckm-manager-async.h
 275 %{_includedir}/ckm/ckm/ckm-certificate.h
 276 %{_includedir}/ckm/ckm/ckm-control.h
 277 %{_includedir}/ckm/ckm/ckm-error.h
 278 %{_includedir}/ckm/ckm/ckm-key.h
 279 %{_includedir}/ckm/ckm/ckm-password.h
 280 %{_includedir}/ckm/ckm/ckm-pkcs12.h
 281 %{_includedir}/ckm/ckm/ckm-raw-buffer.h
 282 %{_includedir}/ckm/ckm/ckm-type.h
 283 %{_includedir}/ckm/ckmc/ckmc-manager.h
 284 %{_includedir}/ckm/ckmc/ckmc-control.h
 285 %{_includedir}/ckm/ckmc/ckmc-error.h
 286 %{_includedir}/ckm/ckmc/ckmc-type.h
 287 %{_libdir}/pkgconfig/*.pc
 288
 289 %files -n key-manager-tests
 290 %manifest key-manager-tests.manifest
 291 %{bin_dir}/ckm-tests-internal
 292 %{bin_dir}/ckm_so_loader
 293 %{bin_dir}/ckm_db_tool
 294 %{bin_dir}/ckm_generate_db
 295 %db_test_dir