packaging/key-manager.spec

   1 %global watchdog_enabled 1
   2 %global watchdog_timeout_sec 60
   3 %global watchdog_notify_sec  20
   4 %global tz_backend_enabled %{?tz_backend:%tz_backend}%{!?tz_backend:OFF}
   5 %{!?build_type:%global build_type RELEASE}
   6 %global coverage_only 0
   7 %if %{build_type} == COVERAGE_ONLY
   8     %global build_type COVERAGE
   9     %global coverage_only 1
  10 %endif
  11
  12 Name:       key-manager
  13 Summary:    Central Key Manager and utilities
  14 Version:    0.1.45
  15 Release:    1
  16 Group:      Security/Secure Storage
  17 License:    Apache-2.0 and BSD-3-Clause
  18 Source0:    %{name}-%{version}.tar.gz
  19 Source1001: key-manager-pam-plugin.manifest
  20 Source1002: libkey-manager-client.manifest
  21 Source1003: libkey-manager-client-devel.manifest
  22 Source1004: libkey-manager-common.manifest
  23 BuildRequires: cmake
  24 BuildRequires: zip
  25 BuildRequires: pkgconfig(dlog)
  26 BuildRequires: pkgconfig(openssl1.1)
  27 BuildRequires: libattr-devel
  28 BuildRequires: pkgconfig(libsmack)
  29 BuildRequires: pkgconfig(libsystemd)
  30 BuildRequires: pkgconfig(libxml-2.0)
  31 BuildRequires: pkgconfig(capi-system-info)
  32 BuildRequires: pkgconfig(security-manager)
  33 BuildRequires: pkgconfig(cynara-client-async)
  34 BuildRequires: pkgconfig(cynara-creds-socket)
  35 BuildRequires: pkgconfig(libtzplatform-config)
  36 BuildRequires: pkgconfig(glib-2.0)
  37 BuildRequires: pkgconfig(pkgmgr)
  38 BuildRequires: pkgconfig(vconf)
  39 BuildRequires: pkgconfig(sqlcipher)
  40 %if 0%{?watchdog_enabled}
  41 BuildRequires: pkgconfig(argos_watchdog)
  42 %endif
  43 BuildRequires: boost-devel
  44 BuildRequires: ca-certificates-devel
  45 %if %{tz_backend_enabled} == ON
  46 BuildRequires: key-manager-ta-devel
  47 BuildRequires: key-manager-ta-serialization-devel
  48 BuildRequires: pkgconfig(tef-libteec)
  49 %endif
  50 Requires: libkey-manager-common = %{version}-%{release}
  51 %if "%{build_type}" == "COVERAGE"
  52 BuildRequires: lcov
  53 %endif
  54
  55 %{?systemd_requires}
  56
  57 %global user_name key-manager
  58 %global group_name security_fw
  59 %global supplementary_group_names key-manager
  60 %global service_name key-manager
  61 %global smack_domain_name System
  62 %global old_rw_data_dir /opt/data/ckm
  63 %global rw_data_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm}%{!?TZ_SYS_DATA:%old_rw_data_dir}
  64 %global ro_data_dir %{?TZ_SYS_RO_SHARE:%TZ_SYS_RO_SHARE/ckm}%{!?TZ_SYS_RO_SHARE:%_datadir/ckm}
  65 %global unit_tests_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm-unit-tests}%{!?TZ_SYS_DATA:%/opt/data/ckm-unit-tests}
  66 %global misc_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm-misc}%{!?TZ_SYS_DATA:%/opt/data/ckm-misc}
  67 %global coverage_dir %{?TZ_SYS_DATA:%TZ_SYS_DATA/ckm-coverage}%{!?TZ_SYS_DATA:%/opt/data/ckm-coverage}
  68 %global bin_dir %{?TZ_SYS_BIN:%TZ_SYS_BIN}%{!?TZ_SYS_BIN:%_bindir}
  69 %global ro_etc_dir %{?TZ_SYS_RO_ETC:%TZ_SYS_RO_ETC}%{!?TZ_SYS_RO_ETC:/etc}
  70 %global run_dir %{?TZ_SYS_RUN:%TZ_SYS_RUN}%{!?TZ_SYS_RUN:/var/run}
  71 %global initial_values_dir_ro %{ro_data_dir}/initial_values
  72 %global initial_values_dir_rw %{rw_data_dir}/initial_values
  73 %global ca_certs_dir %{?TZ_SYS_CA_CERTS:%TZ_SYS_CA_CERTS}%{!?TZ_SYS_CA_CERTS:%ro_etc_dir/ssl/certs}
  74 %global dump_legacy_db_libname key-manager-dump-legacy-database
  75
  76 %description
  77 Central Key Manager daemon could be used as secure storage
  78 for certificate and private/public keys. It gives API for
  79 application to sign and verify (DSA/RSA/ECDSA) signatures.
  80
  81 %package -n libkey-manager-common
  82 Summary:    Central Key Manager (common libraries)
  83 Group:      Security/Libraries
  84 License:    Apache-2.0
  85 Requires(post): /sbin/ldconfig
  86 Requires(postun): /sbin/ldconfig
  87
  88 %description -n libkey-manager-common
  89 Central Key Manager package (common library)
  90
  91 %package -n libkey-manager-client
  92 Summary:    Central Key Manager (client)
  93 Group:      Security/Libraries
  94 License:    Apache-2.0
  95 Requires:   key-manager = %{version}-%{release}
  96 Requires:   libkey-manager-common = %{version}-%{release}
  97 Requires(post): /sbin/ldconfig
  98 Requires(postun): /sbin/ldconfig
  99
 100 %description -n libkey-manager-client
 101 Central Key Manager package (client)
 102
 103 %package -n libkey-manager-client-devel
 104 Summary:    Central Key Manager (client-devel)
 105 Group:      Security/Development
 106 License:    Apache-2.0
 107 BuildRequires: pkgconfig(capi-base-common)
 108 Requires:   pkgconfig(capi-base-common)
 109 Requires:   libkey-manager-client = %{version}-%{release}
 110
 111 %description -n libkey-manager-client-devel
 112 Central Key Manager package (client-devel)
 113
 114 %package -n key-manager-unit-tests
 115 Summary:    Unit tests for key-manager
 116 Group:      Security/Testing
 117 License:    Apache-2.0 and BSL-1.0
 118 BuildRequires: pkgconfig(libxml-2.0)
 119 Requires:   boost-test
 120
 121 %description -n key-manager-unit-tests
 122 Unit tests for key-manager.
 123
 124 %package -n key-manager-misc
 125 Summary:    Miscellaneous tools and tests for key-manager
 126 Group:      Security/Testing
 127 License:    Apache-2.0 and BSL-1.0
 128 Requires:   boost-test
 129 Requires:   key-manager = %{version}-%{release}
 130
 131 %description -n key-manager-misc
 132 Miscellaneous tools and tests for key-manager.
 133
 134 %package -n key-manager-pam-plugin
 135 Summary:    CKM login/password module to PAM
 136 Group:      Security/Libraries
 137 License:    Apache-2.0
 138 BuildRequires: pam-devel
 139 Requires:   key-manager = %{version}-%{release}
 140 Requires(post): /sbin/ldconfig
 141 Requires(postun): /sbin/ldconfig
 142
 143 %description -n key-manager-pam-plugin
 144 CKM login/password module to PAM. Used to monitor user login/logout
 145 and password change events from PAM
 146
 147 %package -n key-manager-initial-values
 148 Summary:    CKM initial values tool
 149 Group:      Security/Libraries
 150 License:    Apache-2.0
 151 BuildRequires: cmake
 152 BuildRequires: pkgconfig(openssl1.1)
 153 BuildRequires: pkgconfig(libxml-2.0)
 154 Requires(post): /sbin/ldconfig
 155 Requires(postun): /sbin/ldconfig
 156
 157 %description -n key-manager-initial-values
 158 Includes ckm_initial_values tool for initial values XML generation
 159
 160 %if "%{build_type}" == "COVERAGE"
 161
 162 %package -n key-manager-coverage
 163 Summary:    Central Key Manager code coverage data
 164 Group:      Security/Testing
 165 License:    Apache-2.0
 166 Requires:   key-manager-unit-tests = %{version}-%{release}
 167 Requires:   key-manager-debugsource = %{version}-%{release}
 168 Requires:   lcov
 169 Requires:   gcc
 170
 171 %description -n key-manager-coverage
 172 Central Key Manager code coverage data
 173
 174 %endif
 175
 176 %prep
 177 %setup -q
 178
 179 %build
 180 export LDFLAGS+="-Wl,--rpath=%{_libdir},-Bsymbolic-functions"
 181
 182 %cmake . -DVERSION=%{version} \
 183         -DCMAKE_BUILD_TYPE=%{build_type} \
 184         -DCMAKE_VERBOSE_MAKEFILE=ON \
 185         -DSYSTEMD_UNIT_DIR=%{_unitdir} \
 186         -DSYSTEMD_ENV_FILE=%{ro_etc_dir}"/sysconfig/central-key-manager" \
 187         -DRUN_DIR:PATH=%{run_dir} \
 188         -DSERVICE_NAME=%{service_name} \
 189         -DUSER_NAME=%{user_name} \
 190         -DGROUP_NAME=%{group_name} \
 191         -DSUPPLEMENTARY_GROUP_NAMES="%{supplementary_group_names}" \
 192         -DSMACK_DOMAIN_NAME=%{smack_domain_name} \
 193         -DOLD_RW_DATA_DIR=%{old_rw_data_dir} \
 194         -DRW_DATA_DIR=%{rw_data_dir} \
 195         -DRO_DATA_DIR=%{ro_data_dir} \
 196         -DRW_ETC_DIR=%{rw_etc_dir} \
 197         -DRO_ETC_DIR=%{ro_etc_dir} \
 198         -DBIN_DIR=%{bin_dir} \
 199         -DINITIAL_VALUES_DIR_RW=%{initial_values_dir_rw} \
 200         -DINITIAL_VALUES_DIR_RO=%{initial_values_dir_ro} \
 201         -DCA_CERTS_DIR=%{ca_certs_dir} \
 202 %if 0%{?watchdog_enabled}
 203         -DWATCHDOG_ENABLED=%{watchdog_enabled} \
 204         -DWATCHDOG_TIMEOUT_SEC=%{watchdog_timeout_sec} \
 205         -DWATCHDOG_NOTIFY_SEC=%{watchdog_notify_sec} \
 206 %endif
 207 %if %{tz_backend_enabled} == ON
 208         -DTZ_BACKEND_ENABLED=ON \
 209 %else
 210         -DTZ_BACKEND_ENABLED=OFF \
 211 %endif
 212         -DUNIT_TESTS_DIR=%{unit_tests_dir} \
 213         -DMISC_DIR=%{misc_dir} \
 214         -DCOVERAGE_DIR=%{coverage_dir} \
 215 %if %{coverage_only}
 216         -DCOVERAGE_ONLY=ON \
 217 %endif
 218         -DDUMP_LEGACY_DB_LIBNAME=%{dump_legacy_db_libname}
 219
 220 make %{?jobs:-j%jobs}
 221
 222 %install
 223 %make_install
 224
 225 %if ! %{coverage_only}
 226
 227 %install_service multi-user.target.wants central-key-manager.service
 228 %install_service sockets.target.wants central-key-manager-api-control.socket
 229 %install_service sockets.target.wants central-key-manager-api-storage.socket
 230 %install_service sockets.target.wants central-key-manager-api-ocsp.socket
 231 %install_service sockets.target.wants central-key-manager-api-encryption.socket
 232 cp -a %{SOURCE1001} %{SOURCE1002} %{SOURCE1003} %{SOURCE1004} %{buildroot}%{_datadir}/
 233
 234 %endif
 235
 236 %pre
 237 # tzplatform-get sync breaked because of on-development situation. comment out just for temporary
 238 # fail if runtime dir variable is different than compilation time variable
 239 #if [ `tzplatform-get TZ_SYS_DATA | cut -d'=' -f2` != %{TZ_SYS_DATA} ]
 240 #then
 241 #    echo "Runtime value of TZ_SYS_DATA is different than the compilation time value. Aborting"
 242 #    exit 1
 243 #fi
 244 #if [ `tzplatform-get TZ_SYS_RO_SHARE | cut -d'=' -f2` != %{TZ_SYS_RO_SHARE} ]
 245 #then
 246 #    echo "Runtime value of TZ_SYS_RO_SHARE is different than the compilation time value. Aborting"
 247 #    exit 1
 248 #fi
 249
 250 ## backup plan for manage key-manager user/group is deprecated b/c pwdutils package
 251 ## would be excluded from binary
 252 # User/group (key-manager/key-manager) should be already added in passwd package.
 253 # This is our backup plan if passwd package will not be configured correctly.
 254 #id -g %{group_name} > /dev/null 2>&1
 255 #if [ $? -eq 1 ]; then
 256 #    groupadd %{group_name} -r > /dev/null 2>&1
 257 #fi
 258 #
 259 #id -u %{user_name} > /dev/null 2>&1
 260 #if [ $? -eq 1 ]; then
 261 #    useradd -d /var/lib/empty -s /sbin/nologin -r -g %{group_name} %{user_name} > /dev/null 2>&1
 262 #fi
 263
 264 %post
 265 # move data from old path to new one
 266 # we have to assume that in case of TZ_SYS_DATA change some upgrade script will move all the data
 267 if [ -d "%{old_rw_data_dir}" ] && [ "%{rw_data_dir}" != "%{old_rw_data_dir}" ]
 268 then
 269     echo "Migrating old rw data to new rw data dir"
 270     cp -a %{old_rw_data_dir}/. %{rw_data_dir}/ && rm -rf %{old_rw_data_dir}
 271 fi
 272
 273 systemctl daemon-reload
 274 if [ $1 = 1 ]; then
 275     # installation
 276     systemctl start central-key-manager.service
 277 fi
 278
 279 if [ $1 = 2 ]; then
 280     # update
 281
 282     # In ckm version <= 0.1.18 all files were owned by root.
 283     find %{rw_data_dir} -exec chsmack -a %{smack_domain_name} {} \;
 284     chown %{user_name}:%{group_name} -R %{rw_data_dir}
 285     systemctl restart central-key-manager.service
 286 fi
 287
 288
 289 %preun
 290 if [ $1 = 0 ]; then
 291     # unistall
 292     systemctl stop central-key-manager.service
 293 fi
 294
 295 %postun
 296 if [ $1 = 0 ]; then
 297     # unistall
 298     systemctl daemon-reload
 299 fi
 300
 301 %post -n libkey-manager-common -p /sbin/ldconfig
 302 %post -n libkey-manager-client -p /sbin/ldconfig
 303 %postun -n libkey-manager-common -p /sbin/ldconfig
 304 %postun -n libkey-manager-client -p /sbin/ldconfig
 305
 306 %if ! %{coverage_only}
 307
 308 %files -n key-manager
 309 %manifest key-manager.manifest
 310 %license LICENSE
 311 %license LICENSE.BSD-3-Clause
 312 %{bin_dir}/key-manager
 313 %{_libdir}/lib%{dump_legacy_db_libname}.so
 314 %{_unitdir}/multi-user.target.wants/central-key-manager.service
 315 %{_unitdir}/central-key-manager.service
 316 %{_unitdir}/sockets.target.wants/central-key-manager-api-control.socket
 317 %{_unitdir}/central-key-manager-api-control.socket
 318 %{_unitdir}/sockets.target.wants/central-key-manager-api-storage.socket
 319 %{_unitdir}/central-key-manager-api-storage.socket
 320 %{_unitdir}/sockets.target.wants/central-key-manager-api-ocsp.socket
 321 %{_unitdir}/central-key-manager-api-ocsp.socket
 322 %{_unitdir}/sockets.target.wants/central-key-manager-api-encryption.socket
 323 %{_unitdir}/central-key-manager-api-encryption.socket
 324 %dir %{ro_data_dir}
 325 %{ro_data_dir}/*
 326 %dir %attr(770, %{user_name}, %{group_name}) %{rw_data_dir}
 327 %dir %attr(550, %{user_name}, %{group_name}) %{initial_values_dir_ro}
 328 %dir %attr(770, %{user_name}, %{group_name}) %{initial_values_dir_rw}
 329 %attr(755,root,root) /usr/share/upgrade/scripts/295.key-manager_upgrade.sh
 330
 331 %{ro_etc_dir}/gumd/userdel.d/10_key-manager.post
 332 %{bin_dir}/ckm_tool
 333
 334 %files -n key-manager-pam-plugin
 335 %manifest %{_datadir}/key-manager-pam-plugin.manifest
 336 %license LICENSE
 337 %{_libdir}/security/pam_key_manager_plugin.so*
 338
 339 %files -n libkey-manager-common
 340 %manifest %{_datadir}/libkey-manager-common.manifest
 341 %license LICENSE
 342 %{_libdir}/libkey-manager-common.so.*
 343
 344 %files -n libkey-manager-client
 345 %manifest %{_datadir}/libkey-manager-client.manifest
 346 %license LICENSE
 347 %{_libdir}/libkey-manager-client.so.*
 348 %{_libdir}/libkey-manager-control-client.so.*
 349
 350 %files -n libkey-manager-client-devel
 351 %manifest %{_datadir}/libkey-manager-client-devel.manifest
 352 %license LICENSE
 353 %{_libdir}/libkey-manager-client.so
 354 %{_libdir}/libkey-manager-control-client.so
 355 %{_libdir}/libkey-manager-common.so
 356 %{_includedir}/ckm/ckm/ckm-manager.h
 357 %{_includedir}/ckm/ckm/ckm-manager-async.h
 358 %{_includedir}/ckm/ckm/ckm-certificate.h
 359 %{_includedir}/ckm/ckm/ckm-control.h
 360 %{_includedir}/ckm/ckm/ckm-error.h
 361 %{_includedir}/ckm/ckm/ckm-key.h
 362 %{_includedir}/ckm/ckm/ckm-password.h
 363 %{_includedir}/ckm/ckm/ckm-pkcs12.h
 364 %{_includedir}/ckm/ckm/ckm-raw-buffer.h
 365 %{_includedir}/ckm/ckm/ckm-type.h
 366 %{_includedir}/ckm/ckm/ckm-zero-memory.h
 367 %{_includedir}/ckm/ckmc/ckmc-manager.h
 368 %{_includedir}/ckm/ckmc/ckmc-control.h
 369 %{_includedir}/ckm/ckmc/ckmc-error.h
 370 %{_includedir}/ckm/ckmc/ckmc-type.h
 371 %{_libdir}/pkgconfig/*.pc
 372
 373 %files -n key-manager-initial-values
 374 %license LICENSE
 375 %{bin_dir}/ckm_initial_values
 376
 377 %files -n key-manager-misc
 378 %manifest key-manager-misc.manifest
 379 %license LICENSE
 380 %license LICENSE.BSL-1.0
 381 %{bin_dir}/ckm-scheme-test
 382 %{bin_dir}/ckm_so_loader
 383 %{bin_dir}/ckm_db_tool
 384 %{bin_dir}/ckm_db_merge
 385 %{bin_dir}/ckm_generate_db
 386 %{bin_dir}/ckm_db_perf
 387 %misc_dir
 388
 389 %endif
 390
 391 %files -n key-manager-unit-tests
 392 %manifest key-manager-unit-tests.manifest
 393 %license LICENSE
 394 %license LICENSE.BSL-1.0
 395 %{bin_dir}/ckm-unit-tests
 396 %unit_tests_dir
 397
 398 %if "%{build_type}" == "COVERAGE"
 399
 400 %files -n key-manager-coverage
 401 %license LICENSE
 402 %{bin_dir}/key-manager-coverage.sh
 403 %coverage_dir
 404
 405 %endif