-%define certsvc_feature_ocsp_crl 0
-%define certsvc_test_build 0
+%define certsvc_test_build 0
Name: cert-svc
Summary: Certification service
-Version: 1.0.1
-Release: 45
-Group: Security/Libraries
-License: Apache-2.0
+Version: 2.1.6
+Release: 0
+Group: Security/Certificate Management
+License: Apache-2.0 and OpenSSL
Source0: %{name}-%{version}.tar.gz
-Source1001: %{name}.manifest
-Requires(post): findutils
BuildRequires: cmake
+BuildRequires: coreutils
+BuildRequires: findutils
+BuildRequires: openssl
BuildRequires: pkgconfig(dlog)
BuildRequires: pkgconfig(openssl)
BuildRequires: pkgconfig(libpcrecpp)
BuildRequires: pkgconfig(xmlsec1)
-BuildRequires: pkgconfig(glib-2.0)
BuildRequires: pkgconfig(libxml-2.0)
BuildRequires: pkgconfig(libxslt)
-BuildRequires: pkgconfig(icu-i18n)
-BuildRequires: pkgconfig(libsoup-2.4)
BuildRequires: pkgconfig(db-util)
BuildRequires: pkgconfig(libsystemd-daemon)
BuildRequires: pkgconfig(key-manager)
-BuildRequires: pkgconfig(secure-storage)
BuildRequires: pkgconfig(libtzplatform-config)
BuildRequires: pkgconfig(libsystemd-journal)
-BuildRequires: boost-devel
-%if 0%{?certsvc_feature_ocsp_crl}
-BuildRequires: pkgconfig(vconf)
BuildRequires: pkgconfig(sqlite3)
-%endif
-Requires: pkgconfig(libtzplatform-config)
-Requires: ca-certificates-tizen
-Requires: ca-certificates-mozilla
+BuildRequires: ca-certificates
+BuildRequires: ca-certificates-devel
+BuildRequires: ca-certificates-tizen-devel
Requires: ca-certificates
+Requires: ca-certificates-tizen
+Requires: security-config
Requires: openssl
+%if "%{?profile}" == "mobile"
+BuildRequires: pkgconfig(cert-checker)
+%endif
+
+%global user_name security_fw
+%global group_name security_fw
+%global server_stream /tmp/.cert-server.socket
+%global smack_domain_name System
+
+%global bin_dir %{?TZ_SYS_BIN:%TZ_SYS_BIN}%{!?TZ_SYS_BIN:%_bindir}
+%global etc_dir %{?TZ_SYS_ETC:%TZ_SYS_ETC}%{!?TZ_SYS_ETC:/opt/etc}
+%global rw_data_dir %{?TZ_SYS_SHARE:%TZ_SYS_SHARE}%{!?TZ_SYS_SHARE:/opt/share}
+%global ro_data_dir %{?TZ_SYS_RO_SHARE:%TZ_SYS_RO_SHARE}%{!?TZ_SYS_RO_SHARE:%_datadir}
+%global rw_app_dir %{?TZ_SYS_RW_APP:%TZ_SYS_RW_APP}%{!?TZ_SYS_RW_APP:/opt/usr/apps}
+
+%global cert_svc_path %rw_data_dir/cert-svc
+%global cert_svc_ro_path %ro_data_dir/cert-svc
+%global cert_svc_db_path %cert_svc_path/dbspace
+%global cert_svc_pkcs12 %cert_svc_path/pkcs12
+%global cert_svc_ca_bundle %cert_svc_path/ca-certificate.crt
+%global cert_svc_tests %rw_app_dir/cert-svc-tests
+
+%global cert_svc_old_db_path /opt/share/cert-svc/dbspace
+%global upgrade_script_path %ro_data_dir/upgrade/scripts
+%global upgrade_data_path %ro_data_dir/upgrade/data
%description
Certification service
%package test
Summary: Certification service (tests)
Group: Security/Testing
-BuildRequires: pkgconfig(dpl-test-efl)
-Requires: boost-devel
Requires: ca-certificates-tizen
Requires: %{name} = %{version}-%{release}
%prep
%setup -q
-cp -a %{SOURCE1001} .
%build
export CFLAGS="$CFLAGS -DTIZEN_DEBUG_ENABLE"
%endif
%{!?build_type:%define build_type "Release"}
-cmake . -DPREFIX=%{_prefix} \
- -DEXEC_PREFIX=%{_exec_prefix} \
- -DLIBDIR=%{_libdir} \
- -DBINDIR=%{_bindir} \
- -DINCLUDEDIR=%{_includedir} \
- -DTZ_SYS_SHARE=%TZ_SYS_SHARE \
- -DTZ_SYS_BIN=%TZ_SYS_BIN \
- -DTZ_SYS_ETC=%TZ_SYS_ETC \
- -DTZ_SYS_RO_WRT_ENGINE=%TZ_SYS_RO_WRT_ENGINE \
- -DTZ_SYS_DB=%TZ_SYS_DB \
-%if 0%{?certsvc_feature_ocsp_crl}
- -DTIZEN_FEAT_CERTSVC_OCSP_CRL=1 \
+%cmake . -DVERSION=%version \
+ -DINCLUDEDIR=%_includedir \
+ -DUSER_NAME=%user_name \
+ -DGROUP_NAME=%group_name \
+ -DSERVER_STREAM=%server_stream \
+ -DSMACK_DOMAIN_NAME=%smack_domain_name \
+ -DRO_DATA_DIR=%ro_data_dir \
+ -DBIN_DIR=%bin_dir \
+ -DTZ_SYS_CA_CERTS=%TZ_SYS_CA_CERTS \
+ -DTZ_SYS_CA_CERTS_ORIG=%TZ_SYS_CA_CERTS_ORIG \
+ -DTZ_SYS_CA_BUNDLE=%TZ_SYS_CA_BUNDLE \
+ -DCERT_SVC_CA_BUNDLE=%cert_svc_ca_bundle \
+ -DFINGERPRINT_LIST_RW_PATH=%TZ_SYS_REVOKED_CERTS_FINGERPRINTS_RUNTIME \
+ -DCERT_SVC_PATH=%cert_svc_path \
+ -DCERT_SVC_RO_PATH=%cert_svc_ro_path \
+ -DCERT_SVC_PKCS12=%cert_svc_pkcs12 \
+ -DCERT_SVC_DB_PATH=%cert_svc_db_path \
+ -DCERT_SVC_OLD_DB_PATH=%cert_svc_old_db_path \
+ -DUPGRADE_SCRIPT_PATH=%upgrade_script_path \
+ -DUPGRADE_DATA_PATH=%upgrade_data_path \
+%if "%{?profile}" == "mobile"
+ -DTIZEN_PROFILE_MOBILE:BOOL=ON \
+%else
+ -DTIZEN_PROFILE_MOBILE:BOOL=OFF \
%endif
%if 0%{?certsvc_test_build}
- -DCERTSVC_TEST_BUILD=1 \
- -DTZ_SYS_RO_APP=%TZ_SYS_RO_APP \
+ -DCERTSVC_TEST_BUILD=1 \
+ -DCERT_SVC_TESTS=%cert_svc_tests \
%endif
- -DCMAKE_BUILD_TYPE=%{build_type} \
- -DSYSTEMD_UNIT_DIR=%{_unitdir}
+ -DCMAKE_BUILD_TYPE=%build_type \
+ -DSYSTEMD_UNIT_DIR=%_unitdir
-make %{?jobs:-j%jobs}
+make %{?_smp_mflags}
%install
-rm -rf %{buildroot}
-mkdir -p %{buildroot}%{TZ_SYS_SHARE}/license
-cp LICENSE %{buildroot}%{TZ_SYS_SHARE}/license/%{name}
-
-mkdir -p %{buildroot}%{TZ_SYS_SHARE}/cert-svc/certs/user
-mkdir -p %{buildroot}%{TZ_SYS_SHARE}/cert-svc/certs/trusteduser
-mkdir -p %{buildroot}%{TZ_SYS_SHARE}/cert-svc/pkcs12
-mkdir -p %{buildroot}%{TZ_SYS_SHARE}/cert-svc/dbspace
-
%make_install
-mkdir -p %{buildroot}%{_unitdir}/multi-user.target.wants
-mkdir -p %{buildroot}%{_unitdir}/sockets.target.wants
-ln -s ../cert-server.service %{buildroot}%{_unitdir}/multi-user.target.wants/
-ln -s ../cert-server.socket %{buildroot}%{_unitdir}/sockets.target.wants/
+%install_service sockets.target.wants cert-server.socket
-ln -sf %{TZ_SYS_ETC}/ssl/certs %{buildroot}%{TZ_SYS_SHARE}/cert-svc/certs/ssl
+mkdir -p %buildroot%cert_svc_pkcs12
-%clean
-rm -rf %{buildroot}
+touch %buildroot%cert_svc_db_path/certs-meta.db-journal
+
+ln -sf %TZ_SYS_CA_BUNDLE %buildroot%cert_svc_ca_bundle
%preun
-if [ $1 == 0 ]; then
+# erase
+if [ $1 = 0 ]; then
systemctl stop cert-server.service
fi
%post
/sbin/ldconfig
systemctl daemon-reload
-if [ $1 == 1 ]; then
- systemctl restart cert-server.service
+# install
+if [ $1 = 1 ]; then
+ systemctl start cert-server.socket
fi
-
-echo "make ca-certificate.crt"
-%{TZ_SYS_BIN}/make-ca-certificate.sh
-rm %{TZ_SYS_BIN}/make-ca-certificate.sh
-
-echo "create .cert_svc_vcore.db"
-%if 0%{?certsvc_feature_ocsp_crl}
-if [ -z ${2} ]; then
- echo "This is new install of cert-svc"
- %{TZ_SYS_BIN}/cert_svc_create_clean_db.sh
-else
- echo "Find out old and new version of databases"
- VCORE_OLD_DB_VERSION=`sqlite3 %{TZ_SYS_DB}/.cert_svc_vcore.db ".tables" | grep "DB_VERSION_"`
- VCORE_NEW_DB_VERSION=`cat %{TZ_SYS_SHARE}/cert-svc/cert_svc_vcore_db.sql | tr '[:blank:]' '\n' | grep DB_VERSION_`
- echo "OLD vcore database version ${VCORE_OLD_DB_VERSION}"
- echo "NEW vcore database version ${VCORE_NEW_DB_VERSION}"
-
- if [ ${VCORE_OLD_DB_VERSION} -a ${VCORE_NEW_DB_VERSION} ]; then
- if [ ${VCORE_OLD_DB_VERSION} = ${VCORE_NEW_DB_VERSION} ]; then
- echo "Equal database detected so db installation ignored"
- else
- echo "Calling /usr/bin/cert_svc_create_clean_db.sh"
- %{TZ_SYS_BIN}/cert_svc_create_clean_db.sh
- fi
- else
- echo "Calling /usr/bin/cert_svc_create_clean_db.sh"
- %{TZ_SYS_BIN}/cert_svc_create_clean_db.sh
- fi
+# upgrade / reinstall
+if [ $1 = 2 ]; then
+ systemctl restart cert-server.socket
fi
-rm %{TZ_SYS_SHARE}/cert-svc/cert_svc_vcore_db.sql
-rm %{TZ_SYS_BIN}/cert_svc_create_clean_db.sh
-%endif
-echo "create certs-meta.db"
-rm -rf %{TZ_SYS_SHARE}/cert-svc/dbspace/certs-meta.db
-%{TZ_SYS_BIN}/cert_svc_create_clean_store_db.sh %{TZ_SYS_SHARE}/cert-svc/cert_svc_store_db.sql
-%{TZ_SYS_BIN}/initialize_store_db.sh
-if [[ -e %{TZ_SYS_SHARE}/cert-svc/dbspace/certs-meta.db ]]; then
- cat %{TZ_SYS_SHARE}/cert-svc/root-cert.sql | sqlite3 %{TZ_SYS_SHARE}/cert-svc/dbspace/certs-meta.db
-fi
-rm %{TZ_SYS_SHARE}/cert-svc/cert_svc_store_db.sql
-rm %{TZ_SYS_SHARE}/cert-svc/root-cert.sql
-rm %{TZ_SYS_BIN}/cert_svc_create_clean_store_db.sh
-rm %{TZ_SYS_BIN}/initialize_store_db.sh
-
-%postun
-/sbin/ldconfig
+%postun -p /sbin/ldconfig
%files
-%defattr(644,system,system,755)
-%manifest %{name}.manifest
-# Read only files install as root
-%attr(755,root,root) %{TZ_SYS_BIN}/cert-server
-%attr(644,root,root) %{_unitdir}/cert-server.service
-%attr(644,root,root) %{_unitdir}/cert-server.socket
-%attr(777,root,root) %{_unitdir}/multi-user.target.wants/cert-server.service
-%attr(777,root,root) %{_unitdir}/sockets.target.wants/cert-server.socket
-%attr(755,root,root) %{_libdir}/libcert-svc.so.*
-%attr(755,root,root) %{_libdir}/libcert-svc-vcore.so.*
-%attr(644,root,root) %{TZ_SYS_SHARE}/license/%{name}
-%attr(644,root,root) %{TZ_SYS_RO_WRT_ENGINE}/schema.xsd
-%attr(644,root,root) %{TZ_SYS_SHARE}/cert-svc/cert_svc_store_db.sql
-%attr(755,root,root) %{TZ_SYS_BIN}/cert_svc_create_clean_store_db.sh
-%attr(755,root,root) %{TZ_SYS_BIN}/make-ca-certificate.sh
-%attr(755,root,root) %{TZ_SYS_BIN}/initialize_store_db.sh
-
-%if 0%{?certsvc_feature_ocsp_crl}
-%attr(644,root,root) %{TZ_SYS_SHARE}/cert-svc/cert_svc_vcore_db.sql
-%attr(755,root,root) %{TZ_SYS_BIN}/cert_svc_create_clean_db.sh
-%endif
-
-# Resource files install as system
-%{TZ_SYS_SHARE}/cert-svc/certs/user
-%{TZ_SYS_SHARE}/cert-svc/certs/trusteduser
-%{TZ_SYS_SHARE}/cert-svc/pkcs12
-%{TZ_SYS_SHARE}/cert-svc/dbspace
-%{TZ_SYS_SHARE}/cert-svc/certs/ssl
-
+%manifest %name.manifest
+%license LICENSE
+%license LICENSE.OpenSSL
+%_unitdir/cert-server.service
+%_unitdir/cert-server.socket
+%_unitdir/sockets.target.wants/cert-server.socket
+%_libdir/libcert-svc-vcore.so.*
+%bin_dir/cert-server
+%dir %attr(-, %{user_name}, %{group_name}) %cert_svc_path
+%dir %attr(-, %{user_name}, %{group_name}) %cert_svc_pkcs12
+%dir %attr(-, %{user_name}, %{group_name}) %cert_svc_db_path
+%attr(-, %{user_name}, %{group_name}) %cert_svc_ca_bundle
+%attr(-, %{user_name}, %{group_name}) %cert_svc_db_path/certs-meta.db
+%attr(-, %{user_name}, %{group_name}) %cert_svc_db_path/certs-meta.db-journal
+%attr(-, %{user_name}, %{group_name}) %cert_svc_ro_path
+
+%attr(755, root, root) %upgrade_script_path/202.cert-svc-db-upgrade.sh
+%attr(755, root, root) %upgrade_script_path/203.cert-svc-disabled-certs-upgrade.sh
+%upgrade_data_path/certs-meta.db
%files devel
-%defattr(-,root,root,-)
-%{_includedir}/*
-%{_libdir}/pkgconfig/*
-%{_libdir}/libcert-svc.so
-%{_libdir}/libcert-svc-vcore.so
+%_includedir/*
+%_libdir/pkgconfig/*
+%_libdir/libcert-svc-vcore.so
%if 0%{?certsvc_test_build}
%files test
-%defattr(644,system,system,755)
-%attr(755,root,root) %{TZ_SYS_BIN}/cert-svc-test*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_widget_uncompressed/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_widget_uncompressed_negative_hash/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_widget_uncompressed_negative_signature/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_widget_uncompressed_negative_certificate/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_widget_uncompressed_partner/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_widget_uncompressed_partner_operator/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_keys/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_certs/*
-%{TZ_SYS_RO_APP}/widget/tests/vcore_config/*
-%{TZ_SYS_RO_APP}/widget/tests/pkcs12/*
-%{TZ_SYS_RO_APP}/widget/tests/reference/*
-%{TZ_SYS_ETC}/ssl/certs/8956b9bc.0
-%{TZ_SYS_SHARE}/ca-certificates/wac/root_cacert0.pem
-%{TZ_SYS_SHARE}/cert-svc/pkcs12/*
-%{TZ_SYS_SHARE}/cert-svc/cert-type/*
-%{TZ_SYS_SHARE}/cert-svc/tests/orig_c/data/caflag/*
-%{TZ_SYS_SHARE}/cert-svc/certs/root_ca*.der
-%{TZ_SYS_SHARE}/cert-svc/certs/second_ca*.der
-%{TZ_SYS_SHARE}/cert-svc/tests/*
+%bin_dir/cert-svc-test*
+%cert_svc_tests
+%_libdir/libcert-svc-validator-plugin.so
+%attr(755, root, root) %upgrade_script_path/cert-svc-test-upgrade.sh
+%upgrade_data_path/certs-meta-old.db
%endif
projects / platform / core / security / cert-svc.git / blobdiff