Blame SPECS/opencryptoki.spec

bf32a6
%global _hardened_build 1
bf32a6
bf32a6
Name:			opencryptoki
bf32a6
Summary:		Implementation of the PKCS#11 (Cryptoki) specification v2.11
bf32a6
Version:		3.0
bf32a6
Release:		4%{?dist}
bf32a6
License:		CPL
bf32a6
Group:			System Environment/Base
bf32a6
URL:			http://sourceforge.net/projects/opencryptoki
bf32a6
Source0:		http://downloads.sourceforge.net/%{name}/%{name}-v%{version}.tar.gz
bf32a6
Source1:		%{name}-tmpfiles.conf
bf32a6
# https://bugzilla.redhat.com/show_bug.cgi?id=732756
bf32a6
Patch0:			%{name}-2.4-group.patch
bf32a6
# https://bugzilla.redhat.com/show_bug.cgi?id=948460
bf32a6
# http://sourceforge.net/mailarchive/message.php?msg_id=31202168
bf32a6
Patch1:			%{name}-3.0-pkcsconf-man.patch
bf32a6
# https://bugzilla.redhat.com/show_bug.cgi?id=995002
bf32a6
# http://sourceforge.net/mailarchive/message.php?msg_id=31321105
bf32a6
Patch2:			%{name}-3.0-unit.patch
bf32a6
Requires(pre):		shadow-utils coreutils sed
bf32a6
BuildRequires:		openssl-devel
bf32a6
BuildRequires:		trousers-devel
bf32a6
BuildRequires:		openldap-devel
bf32a6
BuildRequires:		autoconf automake libtool
bf32a6
BuildRequires:		bison flex
bf32a6
BuildRequires:		systemd
bf32a6
%ifarch s390 s390x
bf32a6
BuildRequires:		libica-devel >= 2.0
bf32a6
%endif
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
Requires:		%{name}(token)
bf32a6
Requires(post):		systemd
bf32a6
Requires(preun):	systemd
bf32a6
Requires(postun):	systemd
bf32a6
bf32a6
bf32a6
%description
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package contains the Slot Daemon (pkcsslotd) and general utilities.
bf32a6
bf32a6
bf32a6
%package libs
bf32a6
Group:			System Environment/Libraries
bf32a6
Summary:		The run-time libraries for opencryptoki package
bf32a6
Requires:		%{name}%{?_isa} = %{version}-%{release}
bf32a6
bf32a6
%description libs
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package contains the PKCS#11 library implementation, and requires
bf32a6
at least one token implementation (packaged separately) to be fully
bf32a6
functional.
bf32a6
bf32a6
bf32a6
%package devel
bf32a6
Group:			Development/Libraries
bf32a6
Summary:		Development files for openCryptoki
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
bf32a6
%description devel
bf32a6
This package contains the development header files for building
bf32a6
opencryptoki and PKCS#11 based applications
bf32a6
bf32a6
bf32a6
%package swtok
bf32a6
Group:			System Environment/Libraries
bf32a6
Summary:		The software token implementation for opencryptoki
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
Provides:		%{name}(token)
bf32a6
bf32a6
%description swtok
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package brings the software token implementation to use opencryptoki
bf32a6
without any specific cryptographic hardware.
bf32a6
bf32a6
bf32a6
%package tpmtok
bf32a6
Group:			System Environment/Libraries
bf32a6
Summary:		Trusted Platform Module (TPM) device support for opencryptoki
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
Provides:		%{name}(token)
bf32a6
bf32a6
%description tpmtok
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package brings the necessary libraries and files to support
bf32a6
Trusted Platform Module (TPM) devices in the opencryptoki stack.
bf32a6
bf32a6
bf32a6
%package icsftok
bf32a6
Group:			System Environment/Libraries
bf32a6
Summary:		ICSF token support for opencryptoki
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
Provides:		%{name}(token)
bf32a6
bf32a6
%description icsftok
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package brings the necessary libraries and files to support
bf32a6
ICSF token in the opencryptoki stack.
bf32a6
bf32a6
bf32a6
%ifarch s390 s390x
bf32a6
%package icatok
bf32a6
Group:			System Environment/Libraries
bf32a6
Summary:		ICA cryptographic devices (clear-key) support for opencryptoki
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
Provides:		%{name}(token)
bf32a6
bf32a6
%description icatok
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package brings the necessary libraries and files to support ICA
bf32a6
devices in the opencryptoki stack. ICA is an interface to IBM
bf32a6
cryptographic hardware such as IBM 4764 or 4765 that uses the
bf32a6
"accelerator" or "clear-key" path.
bf32a6
bf32a6
%package ccatok
bf32a6
Group:			System Environment/Libraries
bf32a6
Summary:		CCA cryptographic devices (secure-key) support for opencryptoki
bf32a6
Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
bf32a6
Provides:		%{name}(token)
bf32a6
bf32a6
%description ccatok
bf32a6
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
bf32a6
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
bf32a6
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
bf32a6
token implementation that can be used without any cryptographic
bf32a6
hardware.
bf32a6
This package brings the necessary libraries and files to support CCA
bf32a6
devices in the opencryptoki stack. CCA is an interface to IBM
bf32a6
cryptographic hardware such as IBM 4764 or 4765 that uses the
bf32a6
"co-processor" or "secure-key" path.
bf32a6
%endif
bf32a6
bf32a6
bf32a6
%prep
bf32a6
%setup -q -n %{name}
bf32a6
%patch0 -p1 -b .group
bf32a6
%patch1 -p1 -b .pkcsconf-man
bf32a6
%patch2 -p1 -b .unit
bf32a6
bf32a6
# Upstream tarball has unnecessary executable perms set on the sources
bf32a6
find . -name '*.[ch]' -print0 | xargs -0 chmod -x
bf32a6
bf32a6
bf32a6
%build
bf32a6
./bootstrap.sh
bf32a6
bf32a6
%configure --with-systemd=%{_unitdir}	\
bf32a6
%ifarch s390 s390x
bf32a6
    --enable-icatok --enable-ccatok
bf32a6
%else
bf32a6
    --disable-icatok --disable-ccatok
bf32a6
%endif
bf32a6
bf32a6
make %{?_smp_mflags} CHGRP=/bin/true
bf32a6
bf32a6
bf32a6
%install
bf32a6
make install DESTDIR=$RPM_BUILD_ROOT CHGRP=/bin/true
bf32a6
bf32a6
# Remove unwanted cruft
bf32a6
rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/*.la
bf32a6
rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la
bf32a6
bf32a6
# systemd must create /var/lock/opencryptoki
bf32a6
mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d
bf32a6
install -m 0644 %{SOURCE1} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/%{name}.conf
bf32a6
bf32a6
bf32a6
%post libs -p /sbin/ldconfig
bf32a6
%post swtok -p /sbin/ldconfig
bf32a6
%post tpmtok -p /sbin/ldconfig
bf32a6
%post icsftok -p /sbin/ldconfig
bf32a6
%ifarch s390 s390x
bf32a6
%post icatok -p /sbin/ldconfig
bf32a6
%post ccatok -p /sbin/ldconfig
bf32a6
%endif
bf32a6
bf32a6
%postun libs -p /sbin/ldconfig
bf32a6
%postun swtok -p /sbin/ldconfig
bf32a6
%postun tpmtok -p /sbin/ldconfig
bf32a6
%postun icsftok -p /sbin/ldconfig
bf32a6
%ifarch s390 s390x
bf32a6
%postun icatok -p /sbin/ldconfig
bf32a6
%postun ccatok -p /sbin/ldconfig
bf32a6
%endif
bf32a6
bf32a6
%pre
bf32a6
getent group pkcs11 >/dev/null || groupadd -r pkcs11
bf32a6
exit 0
bf32a6
bf32a6
%post
bf32a6
%systemd_post pkcsslotd.service
bf32a6
bf32a6
%preun
bf32a6
%systemd_preun pkcsslotd.service
bf32a6
bf32a6
%postun
bf32a6
%systemd_postun_with_restart pkcsslotd.service
bf32a6
bf32a6
bf32a6
%files
bf32a6
%doc ChangeLog FAQ README
bf32a6
%doc doc/openCryptoki-HOWTO.pdf
bf32a6
%doc doc/README.token_data
bf32a6
%dir %{_sysconfdir}/%{name}
bf32a6
%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
bf32a6
%{_prefix}/lib/tmpfiles.d/%{name}.conf
bf32a6
%{_unitdir}/pkcsslotd.service
bf32a6
%{_sbindir}/pkcsconf
bf32a6
%{_sbindir}/pkcsslotd
bf32a6
%{_mandir}/man1/pkcsconf.1*
bf32a6
%{_mandir}/man5/%{name}.conf.5*
bf32a6
%{_mandir}/man7/%{name}.7*
bf32a6
%{_mandir}/man8/pkcsslotd.8*
bf32a6
%{_libdir}/opencryptoki/methods
bf32a6
%{_libdir}/pkcs11/methods
bf32a6
%dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name}
bf32a6
%dir %attr(770,root,pkcs11) %{_localstatedir}/lock/%{name}
bf32a6
bf32a6
%files libs
bf32a6
%doc LICENSE
bf32a6
%{_sysconfdir}/ld.so.conf.d/*
bf32a6
# Unversioned .so symlinks usually belong to -devel packages, but opencryptoki
bf32a6
# needs them in the main package, because:
bf32a6
#   pkcs11_startup looks for opencryptoki/stdll/*.so, and
bf32a6
#   documentation suggests that programs should dlopen "PKCS11_API.so".
bf32a6
%dir %{_libdir}/opencryptoki
bf32a6
%{_libdir}/opencryptoki/libopencryptoki.*
bf32a6
%{_libdir}/opencryptoki/PKCS11_API.so
bf32a6
%dir %{_libdir}/opencryptoki/stdll
bf32a6
%dir %{_libdir}/pkcs11
bf32a6
%{_libdir}/pkcs11/libopencryptoki.so
bf32a6
%{_libdir}/pkcs11/PKCS11_API.so
bf32a6
%{_libdir}/pkcs11/stdll
bf32a6
bf32a6
%files devel
bf32a6
%{_includedir}/%{name}/
bf32a6
bf32a6
%files swtok
bf32a6
%{_libdir}/opencryptoki/stdll/libpkcs11_sw.*
bf32a6
%{_libdir}/opencryptoki/stdll/PKCS11_SW.so
bf32a6
bf32a6
%files tpmtok
bf32a6
%doc doc/README.tpm_stdll
bf32a6
%{_libdir}/opencryptoki/stdll/libpkcs11_tpm.*
bf32a6
%{_libdir}/opencryptoki/stdll/PKCS11_TPM.so
bf32a6
bf32a6
%files icsftok
bf32a6
%doc doc/README.icsf_stdll
bf32a6
%{_sbindir}/pkcsicsf
bf32a6
%{_mandir}/man1/pkcsicsf.1*
bf32a6
%{_libdir}/opencryptoki/stdll/libpkcs11_icsf.*
bf32a6
%{_libdir}/opencryptoki/stdll/PKCS11_ICSF.so
bf32a6
bf32a6
%ifarch s390 s390x
bf32a6
%files icatok
bf32a6
%{_libdir}/opencryptoki/stdll/libpkcs11_ica.*
bf32a6
%{_libdir}/opencryptoki/stdll/PKCS11_ICA.so
bf32a6
bf32a6
%files ccatok
bf32a6
%doc doc/README-IBM_CCA_users
bf32a6
%doc doc/README.cca_stdll
bf32a6
%{_libdir}/opencryptoki/stdll/libpkcs11_cca.*
bf32a6
%{_libdir}/opencryptoki/stdll/PKCS11_CCA.so
bf32a6
%endif
bf32a6
bf32a6
bf32a6
%changelog
bf32a6
* Fri Aug 23 2013 Dan Horák <dan[at]danny.cz> - 3.0-4
bf32a6
- update unit file (#995002)
bf32a6
bf32a6
* Tue Jul 23 2013 Dan Horák <dan[at]danny.cz> - 3.0-2
bf32a6
- update pkcsconf man page (#948460)
bf32a6
bf32a6
* Mon Jul 22 2013 Dan Horák <dan[at]danny.cz> - 3.0-1
bf32a6
- new upstream release 3.0
bf32a6
bf32a6
* Tue Jun 25 2013 Dan Horák <dan[at]danny.cz> - 2.4.3.1-1
bf32a6
- new upstream release 2.4.3.1
bf32a6
bf32a6
* Fri May 03 2013 Dan Horák <dan[at]danny.cz> - 2.4.3-1
bf32a6
- new upstream release 2.4.3
bf32a6
bf32a6
* Thu Apr 04 2013 Dan Horák <dan[at]danny.cz> - 2.4.2-4
bf32a6
- enable hardened build
bf32a6
- switch to systemd macros in scriptlets (#850240)
bf32a6
bf32a6
* Mon Jan 28 2013 Dan Horák <dan[at]danny.cz> - 2.4.2-3
bf32a6
- add virtual opencryptoki(token) Provides to token modules and as Requires
bf32a6
  to main package (#904986)
bf32a6
bf32a6
* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4.2-2
bf32a6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
bf32a6
bf32a6
* Thu Jun 21 2012 Dan Horák <dan[at]danny.cz> - 2.4.2-1
bf32a6
- new upstream release 2.4.2
bf32a6
- add pkcs_slot man page
bf32a6
- don't add root to the pkcs11 group
bf32a6
bf32a6
* Mon Jun 11 2012 Dan Horák <dan[at]danny.cz> - 2.4.1-2
bf32a6
- fix unresolved symbols in TPM module (#830129)
bf32a6
bf32a6
* Sat Feb 25 2012 Dan Horák <dan[at]danny.cz> - 2.4.1-1
bf32a6
- new upstream release 2.4.1
bf32a6
- convert from initscript to systemd unit
bf32a6
- import fixes from RHEL-6 about root's group membership (#732756, #730903)
bf32a6
bf32a6
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4-2
bf32a6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
bf32a6
bf32a6
* Thu Jul 07 2011 Dan Horák <dan[at]danny.cz> - 2.4-1
bf32a6
- new upstream release 2.4
bf32a6
bf32a6
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.3-2
bf32a6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
bf32a6
bf32a6
* Mon Jan 17 2011 Dan Horák <dan[at]danny.cz> 2.3.3-1
bf32a6
- new upstream release 2.3.3
bf32a6
bf32a6
* Tue Nov 09 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.2-2
bf32a6
- Apply Obsoletes to package names, not provides.
bf32a6
bf32a6
* Tue Sep 14 2010 Dan Horák <dan[at]danny.cz> 2.3.2-1
bf32a6
- new upstream release 2.3.2
bf32a6
- put STDLLs in separate packages to match upstream package design
bf32a6
bf32a6
* Thu Jul 08 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-7
bf32a6
- Move the LICENSE file to the -libs subpackage.
bf32a6
bf32a6
* Tue Jun 29 2010 Dan Horák <dan[at]danny.cz> 2.3.1-6
bf32a6
- rebuilt with CCA enabled (#604287)
bf32a6
- fixed issues from #546274
bf32a6
bf32a6
* Fri Apr 30 2010 Dan Horák <dan[at]danny.cz> 2.3.1-5
bf32a6
- fixed one more issue in the initscript (#547324)
bf32a6
bf32a6
* Mon Apr 26 2010 Dan Horák <dan[at]danny.cz> 2.3.1-4
bf32a6
- fixed pidfile creating and usage (#547324)
bf32a6
bf32a6
* Mon Feb 08 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-3
bf32a6
- Also list 'reload' and 'force-reload' in "Usage: ...".
bf32a6
bf32a6
* Mon Feb 08 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-2
bf32a6
- Support 'force-reload' in the initscript.
bf32a6
bf32a6
* Wed Jan 27 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-1
bf32a6
- New upstream release 2.3.1.
bf32a6
- opencryptoki-2.3.0-fix-nss-breakage.patch was merged.
bf32a6
bf32a6
* Fri Jan 22 2010 Dan Horák <dan[at]danny.cz> 2.3.0-5
bf32a6
- made pkcsslotd initscript LSB compliant (#522149)
bf32a6
bf32a6
* Mon Sep 07 2009 Michal Schmidt <mschmidt@redhat.com> 2.3.0-4
bf32a6
- Added opencryptoki-2.3.0-fix-nss-breakage.patch on upstream request.
bf32a6
bf32a6
* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 2.3.0-3
bf32a6
- rebuilt with new openssl
bf32a6
bf32a6
* Sun Aug 16 2009 Michal Schmidt <mschmidt@redhat.com> 2.3.0-2
bf32a6
- Require libica-2.0.
bf32a6
bf32a6
* Fri Aug 07 2009 Michal Schmidt <mschmidt@redhat.com> 2.3.0-1
bf32a6
- New upstream release 2.3.0:
bf32a6
  - adds support for RSA 4096 bit keys in the ICA token.
bf32a6
bf32a6
* Tue Jul 21 2009 Michal Schmidt <mschmidt@redhat.com> - 2.2.8-5
bf32a6
- Require arch-specific dependency on -libs.
bf32a6
bf32a6
* Tue Jul 21 2009 Michal Schmidt <mschmidt@redhat.com> - 2.2.8-4
bf32a6
- Return support for crypto hw on s390.
bf32a6
- Renamed to opencryptoki.
bf32a6
- Simplified multilib by putting libs in subpackage as suggested by Dan Horák.
bf32a6
bf32a6
* Tue Jul 21 2009 Michal Schmidt <mschmidt@redhat.com> - 2.2.8-2
bf32a6
- Fedora package based on RHEL-5 package.