diff --git a/.opencryptoki.metadata b/.opencryptoki.metadata new file mode 100644 index 0000000..131c70d --- /dev/null +++ b/.opencryptoki.metadata @@ -0,0 +1 @@ +6244e8c3960384ec022c9a6652296388079f31b3 SOURCES/opencryptoki-v3.0.tar.gz diff --git a/README.md b/README.md deleted file mode 100644 index 0e7897f..0000000 --- a/README.md +++ /dev/null @@ -1,5 +0,0 @@ -The master branch has no content - -Look at the c7 branch if you are working with CentOS-7, or the c4/c5/c6 branch for CentOS-4, 5 or 6 - -If you find this file in a distro specific branch, it means that no content has been checked in yet diff --git a/SOURCES/opencryptoki-2.4-group.patch b/SOURCES/opencryptoki-2.4-group.patch new file mode 100644 index 0000000..abaa592 --- /dev/null +++ b/SOURCES/opencryptoki-2.4-group.patch @@ -0,0 +1,47 @@ +diff -urp opencryptoki-2.4.orig/usr/lib/pkcs11/api/shrd_mem.c opencryptoki-2.4/usr/lib/pkcs11/api/shrd_mem.c +--- opencryptoki-2.4.orig/usr/lib/pkcs11/api/shrd_mem.c.in 2011-08-15 08:17:14.000000000 -0400 ++++ opencryptoki-2.4/usr/lib/pkcs11/api/shrd_mem.c.in 2011-08-15 10:22:49.000000000 -0400 +@@ -351,43 +351,6 @@ attach_shared_memory() { + return NULL; + } + +- +- // SAB check for the group id here and membership here as well +- grp = getgrnam("pkcs11"); +- if ( grp ) { +- int i=0; +- char member=0; +- +- pw = getpwuid(getuid()); +- +- epw = getpwuid(geteuid()); +- +- while( grp->gr_mem[i] ) { +- if (pw) { +- if ( strncmp(pw->pw_name, grp->gr_mem[i],strlen(pw->pw_name)) == 0 ){ +- member = 1; +- break; +- } +- } +- if (epw) { +- if ( strncmp(epw->pw_name, grp->gr_mem[i],strlen(epw->pw_name)) == 0 ){ +- member = 1; +- break; +- } +- } +- i++; +- } +- if ( ! member ) { +- return NULL; // SAB don't bother even attaching... +- } +- +- +- } else { +- return NULL; +- } +- +- +- + Anchor->shm_tok = ftok(TOK_PATH,'b'); + + // Get the shared memory id. diff --git a/SOURCES/opencryptoki-3.0-pkcsconf-man.patch b/SOURCES/opencryptoki-3.0-pkcsconf-man.patch new file mode 100644 index 0000000..cf547ab --- /dev/null +++ b/SOURCES/opencryptoki-3.0-pkcsconf-man.patch @@ -0,0 +1,35 @@ +From 48e9a2fdcae6d373f56aefcb85507758803be7df Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Dan=20Hor=C3=A1k?= +Date: Mon, 22 Jul 2013 18:49:43 +0200 +Subject: [PATCH] update options in the pkcsconf man page to match the pkcsconf + binary + +--- + man/man1/pkcsconf.1.in | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/man/man1/pkcsconf.1.in b/man/man1/pkcsconf.1.in +index 1b95651..76293ae 100644 +--- a/man/man1/pkcsconf.1.in ++++ b/man/man1/pkcsconf.1.in +@@ -4,7 +4,7 @@ pkcsconf \- configuration utility for the pkcsslotd daemon + + .SH SYNOPSIS + \fBpkcsconf\fP +-[\fB-itsmMIupPh\fP] ++[\fB-itsmlIupPh\fP] + [\fB-c\fP \fIslotnumber\fP \fB-U\fP \fIuserPIN\fP + \fB-S\fP \fISOPin\fP \fB-n\fP \fInewpin\fP] + +@@ -21,6 +21,8 @@ display token info + display slot info + .IP "\fB-m\fP" 10 + display mechanism list ++.IP "\fB-l\fP" 10 ++display slot description + .IP "\fB-I\fP" 10 + initialize token + .IP "\fB-u\fP" 10 +-- +1.8.1.4 + diff --git a/SOURCES/opencryptoki-3.0-unit.patch b/SOURCES/opencryptoki-3.0-unit.patch new file mode 100644 index 0000000..95eb8d4 --- /dev/null +++ b/SOURCES/opencryptoki-3.0-unit.patch @@ -0,0 +1,24 @@ +From a8870725de46b8c5716e1539a0d01256b319940b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Dan=20Hor=C3=A1k?= +Date: Fri, 23 Aug 2013 16:57:52 +0200 +Subject: [PATCH] update unit file for 3.0 + +--- + misc/pkcsslotd.service.in | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/misc/pkcsslotd.service.in b/misc/pkcsslotd.service.in +index bfd9934..461be60 100644 +--- a/misc/pkcsslotd.service.in ++++ b/misc/pkcsslotd.service.in +@@ -5,7 +5,6 @@ After=syslog.target + [Service] + Type=forking + PIDFile=/var/run/pkcsslotd.pid +-ExecStartPre=@sbindir@/pkcs11_startup + ExecStart=@sbindir@/pkcsslotd + + [Install] +-- +1.8.1.4 + diff --git a/SOURCES/opencryptoki-tmpfiles.conf b/SOURCES/opencryptoki-tmpfiles.conf new file mode 100644 index 0000000..87332a8 --- /dev/null +++ b/SOURCES/opencryptoki-tmpfiles.conf @@ -0,0 +1 @@ +D /var/lock/opencryptoki 0770 root pkcs11 - diff --git a/SPECS/opencryptoki.spec b/SPECS/opencryptoki.spec new file mode 100644 index 0000000..3289f82 --- /dev/null +++ b/SPECS/opencryptoki.spec @@ -0,0 +1,398 @@ +%global _hardened_build 1 + +Name: opencryptoki +Summary: Implementation of the PKCS#11 (Cryptoki) specification v2.11 +Version: 3.0 +Release: 4%{?dist} +License: CPL +Group: System Environment/Base +URL: http://sourceforge.net/projects/opencryptoki +Source0: http://downloads.sourceforge.net/%{name}/%{name}-v%{version}.tar.gz +Source1: %{name}-tmpfiles.conf +# https://bugzilla.redhat.com/show_bug.cgi?id=732756 +Patch0: %{name}-2.4-group.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=948460 +# http://sourceforge.net/mailarchive/message.php?msg_id=31202168 +Patch1: %{name}-3.0-pkcsconf-man.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=995002 +# http://sourceforge.net/mailarchive/message.php?msg_id=31321105 +Patch2: %{name}-3.0-unit.patch +Requires(pre): shadow-utils coreutils sed +BuildRequires: openssl-devel +BuildRequires: trousers-devel +BuildRequires: openldap-devel +BuildRequires: autoconf automake libtool +BuildRequires: bison flex +BuildRequires: systemd +%ifarch s390 s390x +BuildRequires: libica-devel >= 2.0 +%endif +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Requires: %{name}(token) +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd + + +%description +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package contains the Slot Daemon (pkcsslotd) and general utilities. + + +%package libs +Group: System Environment/Libraries +Summary: The run-time libraries for opencryptoki package +Requires: %{name}%{?_isa} = %{version}-%{release} + +%description libs +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package contains the PKCS#11 library implementation, and requires +at least one token implementation (packaged separately) to be fully +functional. + + +%package devel +Group: Development/Libraries +Summary: Development files for openCryptoki +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description devel +This package contains the development header files for building +opencryptoki and PKCS#11 based applications + + +%package swtok +Group: System Environment/Libraries +Summary: The software token implementation for opencryptoki +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Provides: %{name}(token) + +%description swtok +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package brings the software token implementation to use opencryptoki +without any specific cryptographic hardware. + + +%package tpmtok +Group: System Environment/Libraries +Summary: Trusted Platform Module (TPM) device support for opencryptoki +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Provides: %{name}(token) + +%description tpmtok +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package brings the necessary libraries and files to support +Trusted Platform Module (TPM) devices in the opencryptoki stack. + + +%package icsftok +Group: System Environment/Libraries +Summary: ICSF token support for opencryptoki +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Provides: %{name}(token) + +%description icsftok +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package brings the necessary libraries and files to support +ICSF token in the opencryptoki stack. + + +%ifarch s390 s390x +%package icatok +Group: System Environment/Libraries +Summary: ICA cryptographic devices (clear-key) support for opencryptoki +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Provides: %{name}(token) + +%description icatok +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package brings the necessary libraries and files to support ICA +devices in the opencryptoki stack. ICA is an interface to IBM +cryptographic hardware such as IBM 4764 or 4765 that uses the +"accelerator" or "clear-key" path. + +%package ccatok +Group: System Environment/Libraries +Summary: CCA cryptographic devices (secure-key) support for opencryptoki +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Provides: %{name}(token) + +%description ccatok +Opencryptoki implements the PKCS#11 specification v2.11 for a set of +cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the +Trusted Platform Module (TPM) chip. Opencryptoki also brings a software +token implementation that can be used without any cryptographic +hardware. +This package brings the necessary libraries and files to support CCA +devices in the opencryptoki stack. CCA is an interface to IBM +cryptographic hardware such as IBM 4764 or 4765 that uses the +"co-processor" or "secure-key" path. +%endif + + +%prep +%setup -q -n %{name} +%patch0 -p1 -b .group +%patch1 -p1 -b .pkcsconf-man +%patch2 -p1 -b .unit + +# Upstream tarball has unnecessary executable perms set on the sources +find . -name '*.[ch]' -print0 | xargs -0 chmod -x + + +%build +./bootstrap.sh + +%configure --with-systemd=%{_unitdir} \ +%ifarch s390 s390x + --enable-icatok --enable-ccatok +%else + --disable-icatok --disable-ccatok +%endif + +make %{?_smp_mflags} CHGRP=/bin/true + + +%install +make install DESTDIR=$RPM_BUILD_ROOT CHGRP=/bin/true + +# Remove unwanted cruft +rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/*.la +rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la + +# systemd must create /var/lock/opencryptoki +mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d +install -m 0644 %{SOURCE1} $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/%{name}.conf + + +%post libs -p /sbin/ldconfig +%post swtok -p /sbin/ldconfig +%post tpmtok -p /sbin/ldconfig +%post icsftok -p /sbin/ldconfig +%ifarch s390 s390x +%post icatok -p /sbin/ldconfig +%post ccatok -p /sbin/ldconfig +%endif + +%postun libs -p /sbin/ldconfig +%postun swtok -p /sbin/ldconfig +%postun tpmtok -p /sbin/ldconfig +%postun icsftok -p /sbin/ldconfig +%ifarch s390 s390x +%postun icatok -p /sbin/ldconfig +%postun ccatok -p /sbin/ldconfig +%endif + +%pre +getent group pkcs11 >/dev/null || groupadd -r pkcs11 +exit 0 + +%post +%systemd_post pkcsslotd.service + +%preun +%systemd_preun pkcsslotd.service + +%postun +%systemd_postun_with_restart pkcsslotd.service + + +%files +%doc ChangeLog FAQ README +%doc doc/openCryptoki-HOWTO.pdf +%doc doc/README.token_data +%dir %{_sysconfdir}/%{name} +%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf +%{_prefix}/lib/tmpfiles.d/%{name}.conf +%{_unitdir}/pkcsslotd.service +%{_sbindir}/pkcsconf +%{_sbindir}/pkcsslotd +%{_mandir}/man1/pkcsconf.1* +%{_mandir}/man5/%{name}.conf.5* +%{_mandir}/man7/%{name}.7* +%{_mandir}/man8/pkcsslotd.8* +%{_libdir}/opencryptoki/methods +%{_libdir}/pkcs11/methods +%dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name} +%dir %attr(770,root,pkcs11) %{_localstatedir}/lock/%{name} + +%files libs +%doc LICENSE +%{_sysconfdir}/ld.so.conf.d/* +# Unversioned .so symlinks usually belong to -devel packages, but opencryptoki +# needs them in the main package, because: +# pkcs11_startup looks for opencryptoki/stdll/*.so, and +# documentation suggests that programs should dlopen "PKCS11_API.so". +%dir %{_libdir}/opencryptoki +%{_libdir}/opencryptoki/libopencryptoki.* +%{_libdir}/opencryptoki/PKCS11_API.so +%dir %{_libdir}/opencryptoki/stdll +%dir %{_libdir}/pkcs11 +%{_libdir}/pkcs11/libopencryptoki.so +%{_libdir}/pkcs11/PKCS11_API.so +%{_libdir}/pkcs11/stdll + +%files devel +%{_includedir}/%{name}/ + +%files swtok +%{_libdir}/opencryptoki/stdll/libpkcs11_sw.* +%{_libdir}/opencryptoki/stdll/PKCS11_SW.so + +%files tpmtok +%doc doc/README.tpm_stdll +%{_libdir}/opencryptoki/stdll/libpkcs11_tpm.* +%{_libdir}/opencryptoki/stdll/PKCS11_TPM.so + +%files icsftok +%doc doc/README.icsf_stdll +%{_sbindir}/pkcsicsf +%{_mandir}/man1/pkcsicsf.1* +%{_libdir}/opencryptoki/stdll/libpkcs11_icsf.* +%{_libdir}/opencryptoki/stdll/PKCS11_ICSF.so + +%ifarch s390 s390x +%files icatok +%{_libdir}/opencryptoki/stdll/libpkcs11_ica.* +%{_libdir}/opencryptoki/stdll/PKCS11_ICA.so + +%files ccatok +%doc doc/README-IBM_CCA_users +%doc doc/README.cca_stdll +%{_libdir}/opencryptoki/stdll/libpkcs11_cca.* +%{_libdir}/opencryptoki/stdll/PKCS11_CCA.so +%endif + + +%changelog +* Fri Aug 23 2013 Dan Horák - 3.0-4 +- update unit file (#995002) + +* Tue Jul 23 2013 Dan Horák - 3.0-2 +- update pkcsconf man page (#948460) + +* Mon Jul 22 2013 Dan Horák - 3.0-1 +- new upstream release 3.0 + +* Tue Jun 25 2013 Dan Horák - 2.4.3.1-1 +- new upstream release 2.4.3.1 + +* Fri May 03 2013 Dan Horák - 2.4.3-1 +- new upstream release 2.4.3 + +* Thu Apr 04 2013 Dan Horák - 2.4.2-4 +- enable hardened build +- switch to systemd macros in scriptlets (#850240) + +* Mon Jan 28 2013 Dan Horák - 2.4.2-3 +- add virtual opencryptoki(token) Provides to token modules and as Requires + to main package (#904986) + +* Fri Jul 20 2012 Fedora Release Engineering - 2.4.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Thu Jun 21 2012 Dan Horák - 2.4.2-1 +- new upstream release 2.4.2 +- add pkcs_slot man page +- don't add root to the pkcs11 group + +* Mon Jun 11 2012 Dan Horák - 2.4.1-2 +- fix unresolved symbols in TPM module (#830129) + +* Sat Feb 25 2012 Dan Horák - 2.4.1-1 +- new upstream release 2.4.1 +- convert from initscript to systemd unit +- import fixes from RHEL-6 about root's group membership (#732756, #730903) + +* Fri Jan 13 2012 Fedora Release Engineering - 2.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Thu Jul 07 2011 Dan Horák - 2.4-1 +- new upstream release 2.4 + +* Tue Feb 08 2011 Fedora Release Engineering - 2.3.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Mon Jan 17 2011 Dan Horák 2.3.3-1 +- new upstream release 2.3.3 + +* Tue Nov 09 2010 Michal Schmidt 2.3.2-2 +- Apply Obsoletes to package names, not provides. + +* Tue Sep 14 2010 Dan Horák 2.3.2-1 +- new upstream release 2.3.2 +- put STDLLs in separate packages to match upstream package design + +* Thu Jul 08 2010 Michal Schmidt 2.3.1-7 +- Move the LICENSE file to the -libs subpackage. + +* Tue Jun 29 2010 Dan Horák 2.3.1-6 +- rebuilt with CCA enabled (#604287) +- fixed issues from #546274 + +* Fri Apr 30 2010 Dan Horák 2.3.1-5 +- fixed one more issue in the initscript (#547324) + +* Mon Apr 26 2010 Dan Horák 2.3.1-4 +- fixed pidfile creating and usage (#547324) + +* Mon Feb 08 2010 Michal Schmidt 2.3.1-3 +- Also list 'reload' and 'force-reload' in "Usage: ...". + +* Mon Feb 08 2010 Michal Schmidt 2.3.1-2 +- Support 'force-reload' in the initscript. + +* Wed Jan 27 2010 Michal Schmidt 2.3.1-1 +- New upstream release 2.3.1. +- opencryptoki-2.3.0-fix-nss-breakage.patch was merged. + +* Fri Jan 22 2010 Dan Horák 2.3.0-5 +- made pkcsslotd initscript LSB compliant (#522149) + +* Mon Sep 07 2009 Michal Schmidt 2.3.0-4 +- Added opencryptoki-2.3.0-fix-nss-breakage.patch on upstream request. + +* Fri Aug 21 2009 Tomas Mraz - 2.3.0-3 +- rebuilt with new openssl + +* Sun Aug 16 2009 Michal Schmidt 2.3.0-2 +- Require libica-2.0. + +* Fri Aug 07 2009 Michal Schmidt 2.3.0-1 +- New upstream release 2.3.0: + - adds support for RSA 4096 bit keys in the ICA token. + +* Tue Jul 21 2009 Michal Schmidt - 2.2.8-5 +- Require arch-specific dependency on -libs. + +* Tue Jul 21 2009 Michal Schmidt - 2.2.8-4 +- Return support for crypto hw on s390. +- Renamed to opencryptoki. +- Simplified multilib by putting libs in subpackage as suggested by Dan Horák. + +* Tue Jul 21 2009 Michal Schmidt - 2.2.8-2 +- Fedora package based on RHEL-5 package.