Blame SPECS/pesign.spec

fe5aa1
Summary: Signing utility for UEFI binaries
fe5aa1
Name: pesign
fe5aa1
Version: 0.109
fe5aa1
Release: 10%{?dist}
fe5aa1
Group: Development/System
fe5aa1
License: GPLv2
fe5aa1
URL: https://github.com/vathpela/pesign
fe5aa1
BuildRequires: git gnu-efi gnu-efi-devel nspr nss nss-util popt-devel
fe5aa1
BuildRequires: coolkey opensc nss-tools
fe5aa1
BuildRequires: nspr-devel >= 4.9.2-1
fe5aa1
BuildRequires: nss-devel >= 3.13.6-1
fe5aa1
Requires: nspr nss nss-util nss-tools popt rpm coolkey opensc
fe5aa1
Requires(pre): shadow-utils
fe5aa1
ExclusiveArch: x86_64 aarch64
fe5aa1
fe5aa1
# there is no tarball at github, of course.  To get this version do:
fe5aa1
# git clone https://github.com/vathpela/pesign.git
fe5aa1
# git checkout %%{version}
fe5aa1
Source0: pesign-%{version}.tar.bz2
fe5aa1
Source1: rh-test-certs.tar.bz2
fe5aa1
Patch0001: 0001-Use-the-right-signing-method-on-the-RHEL-signing-mac.patch
fe5aa1
Patch0002: 0002-Fix-error-detected-by-coverity.patch
fe5aa1
Patch0003: 0003-One-more-tweak-for-RHEL-signing-rules.patch
fe5aa1
Patch0004: 0004-Changes-to-make-sure-we-inherit-CFLAGS-properly-from.patch
fe5aa1
Patch0005: 0005-Allow-aarch64-in-the-rhel-build-macros.patch
fe5aa1
Patch0006: 0006-Build-as-PIE-RELRO-binaries.patch
fe5aa1
Patch0007: 0007-Fix-some-man-page-errors.patch
fe5aa1
Patch0008: 0008-A-more-plugable-way-of-setting-ACLs-for-pesign.patch
fe5aa1
Patch0009: 0009-Add-install-targets-for-3c2374b-and-make-the-filenam.patch
fe5aa1
Patch0010: 0010-setfacl-the-nss-DBs-to-our-authorized-users-not-just.patch
fe5aa1
Patch0011: 0011-Don-t-setfacl-when-the-socket-or-dir-aren-t-there.patch
fe5aa1
Patch0012: 0012-setfacl-the-db-as-well.patch
fe5aa1
Patch0013: 0013-Improve-our-setfacl-scripts-for-database-and-socket-.patch
fe5aa1
Patch0014: 0014-Make-pesign-authorize-users-groups-not-be-in-sbin.patch
fe5aa1
Patch0015: 0015-Actually-setfacl-each-directory-of-our-key-storage.patch
fe5aa1
fe5aa1
%description
fe5aa1
This package contains the pesign utility for signing UEFI binaries as
fe5aa1
well as other associated tools.
fe5aa1
fe5aa1
%prep
fe5aa1
%setup -q -a 1
fe5aa1
git init
fe5aa1
git config user.email "pesign-owner@fedoraproject.org"
fe5aa1
git config user.name "Fedora Ninjas"
fe5aa1
git add .
fe5aa1
git commit -a -q -m "%{version} baseline."
fe5aa1
git am %{patches} 
fe5aa1
fe5aa1
%build
fe5aa1
make CFLAGS="%{optflags}" PREFIX=%{_prefix} LIBDIR=%{_libdir}
fe5aa1
fe5aa1
%install
fe5aa1
rm -rf %{buildroot}
fe5aa1
mkdir -p %{buildroot}/%{_libdir}
fe5aa1
make PREFIX=%{_prefix} LIBDIR=%{_libdir} INSTALLROOT=%{buildroot} \
fe5aa1
	install
fe5aa1
rm -f %{buildroot}/usr/share/doc/pesign/COPYING
fe5aa1
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
fe5aa1
make PREFIX=%{_prefix} LIBDIR=%{_libdir} INSTALLROOT=%{buildroot} \
fe5aa1
	install_systemd
fe5aa1
%endif
fe5aa1
fe5aa1
# there's some stuff that's not really meant to be shipped yet
fe5aa1
rm -rf %{buildroot}/boot %{buildroot}/usr/include
fe5aa1
rm -rf %{buildroot}%{_libdir}/libdpe*
fe5aa1
mv rh-test-certs/etc/pki/pesign/* %{buildroot}/etc/pki/pesign/
fe5aa1
fe5aa1
#modutil -force -dbdir %{buildroot}/etc/pki/pesign -add coolkey \
fe5aa1
#	-libfile %{_libdir}/pkcs11/libcoolkeypk11.so
fe5aa1
#modutil -force -dbdir %{buildroot}/etc/pki/pesign -add opensc \
fe5aa1
#	-libfile %{_libdir}/pkcs11/opensc-pkcs11.so
fe5aa1
fe5aa1
%clean
fe5aa1
rm -rf %{buildroot}
fe5aa1
fe5aa1
%pre
fe5aa1
getent group pesign >/dev/null || groupadd -r pesign
fe5aa1
getent passwd pesign >/dev/null || \
fe5aa1
	useradd -r -g pesign -d /var/run/pesign -s /sbin/nologin \
fe5aa1
		-c "Group for the pesign signing daemon" pesign
fe5aa1
exit 0
fe5aa1
fe5aa1
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
fe5aa1
%post
fe5aa1
%systemd_post pesign.service
fe5aa1
fe5aa1
%preun
fe5aa1
%systemd_preun pesign.service
fe5aa1
fe5aa1
%postun
fe5aa1
%systemd_postun_with_restart pesign.service
fe5aa1
%endif
fe5aa1
fe5aa1
%files
fe5aa1
%defattr(-,root,root,-)
fe5aa1
%doc README TODO COPYING
fe5aa1
%{_bindir}/pesign
fe5aa1
%{_bindir}/pesign-client
fe5aa1
%{_bindir}/efikeygen
fe5aa1
%{_sysconfdir}/popt.d/pesign.popt
fe5aa1
%{_sysconfdir}/rpm/macros.pesign
fe5aa1
%{_libexecdir}/pesign/pesign-authorize-users
fe5aa1
%{_libexecdir}/pesign/pesign-authorize-groups
fe5aa1
%config(noreplace)/%{_sysconfdir}/pesign/users
fe5aa1
%config(noreplace)/%{_sysconfdir}/pesign/groups
fe5aa1
%{_mandir}/man*/*
fe5aa1
%dir %attr(0775,pesign,pesign) /etc/pki/pesign
fe5aa1
%attr(0664,pesign,pesign) /etc/pki/pesign/*
fe5aa1
%dir %attr(0770, pesign, pesign) %{_localstatedir}/run/%{name}
fe5aa1
%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/socket
fe5aa1
%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/pesign.pid
fe5aa1
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
fe5aa1
%{_prefix}/lib/tmpfiles.d/pesign.conf
fe5aa1
%{_unitdir}/pesign.service
fe5aa1
%endif
fe5aa1
fe5aa1
%changelog
fe5aa1
* Mon May 16 2016 Peter Jones <pjones@redhat.com> - - 0.109-10
fe5aa1
- Add support for /etc/pesign/users and /etc/pesign/groups
fe5aa1
  Resolves: rhbz#1141263
fe5aa1
fe5aa1
* Tue Sep 02 2014 Peter Jones <pjones@redhat.com> - 0.109-9
fe5aa1
- Fix man page errors.
fe5aa1
  Resolves: rhbz#948850
fe5aa1
fe5aa1
* Tue Sep 02 2014 Peter Jones <pjones@redhat.com> - 0.109-9
fe5aa1
- Build as PIE+RELRO binaries.
fe5aa1
  Resolves: rhbz#1092542
fe5aa1
fe5aa1
* Wed Aug 27 2014 Peter Jones <pjones@redhat.com> - 0.109-8
fe5aa1
- Include aarch64 in the rpm macro
fe5aa1
  Related: rhbz#1100042
fe5aa1
fe5aa1
* Wed Aug 27 2014 Peter Jones <pjones@redhat.com> - 0.109-7
fe5aa1
- Add aarch64.
fe5aa1
  Resolves: rhbz#1100042
fe5aa1
fe5aa1
* Thu Mar 20 2014 Peter Jones <pjones@redhat.com> - 0.109-6
fe5aa1
- Make sure CFLAGS is inherited properly for -fstack-protector-strong.
fe5aa1
  Resolves: rhbz#1070782
fe5aa1
fe5aa1
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 0.109-5
fe5aa1
- Mass rebuild 2013-12-27
fe5aa1
fe5aa1
* Tue Oct 29 2013 Peter Jones <pjones@redhat.com> - 0.109-4
fe5aa1
- Tweak the signing rules just a bit more.
fe5aa1
  Related: rhbz1017857
fe5aa1
fe5aa1
* Fri Oct 25 2013 Peter Jones <pjones@redhat.com> - 0.109-3
fe5aa1
- Update to fix a bug coverity found.
fe5aa1
  Related: rhbz1017857
fe5aa1
fe5aa1
* Fri Oct 25 2013 Peter Jones <pjones@redhat.com> - 0.109-2
fe5aa1
- Fix the pesign macro for RHEL packages.
fe5aa1
  Related: rhbz1017857
fe5aa1
fe5aa1
* Wed Oct 09 2013 Peter Jones <pjones@redhat.com> - 0.109-1
fe5aa1
- Update to 0.109
fe5aa1
  Related: rhbz#893260
fe5aa1
fe5aa1
* Tue Oct 08 2013 Peter Jones <pjones@redhat.com> - 0.106-6
fe5aa1
- Don't create a new certificate database when signing on RHEL.
fe5aa1
fe5aa1
* Wed Aug 07 2013 Peter Jones <pjones@redhat.com> - 0.106-5
fe5aa1
- Use --force with sattrs blob from mktemp()
fe5aa1
- Error if we get a zero-sized signed file result
fe5aa1
fe5aa1
* Wed Aug 07 2013 Peter Jones <pjones@redhat.com> - 0.106-4
fe5aa1
- Don't require ascii mode for RHEL CA/signer cert import.
fe5aa1
fe5aa1
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.106-3
fe5aa1
- More work on the RHEL %%pesign macro
fe5aa1
fe5aa1
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.106-2
fe5aa1
- Add rhel %%pesign macro definitions.
fe5aa1
fe5aa1
* Tue May 21 2013 Peter Jones <pjones@redhat.com> - 0.106-1
fe5aa1
- Update to 0.106
fe5aa1
- Hopefully fix the segfault dgilmore was seeing.
fe5aa1
fe5aa1
* Mon May 20 2013 Peter Jones <pjones@redhat.com> - 0.105-1
fe5aa1
- Various bug fixes.
fe5aa1
fe5aa1
* Wed May 15 2013 Peter Jones <pjones@redhat.com> - 0.104-1
fe5aa1
- Make sure alignment is correct on signature list entries
fe5aa1
  Resolves: rhbz#963361
fe5aa1
- Make sure section alignment is correct if we have to extend the file
fe5aa1
fe5aa1
* Wed Feb 06 2013 Peter Jones <pjones@redhat.com> - 0.103-2
fe5aa1
- Conditionalize systemd bits so they don't show up in RHEL 6 builds
fe5aa1
fe5aa1
* Tue Feb 05 2013 Peter Jones <pjones@redhat.com> - 0.103-1
fe5aa1
- One more compiler problem.  Let's expect a few more, shall we?
fe5aa1
fe5aa1
* Tue Feb 05 2013 Peter Jones <pjones@redhat.com> - 0.102-1
fe5aa1
- Don't use --std=gnu11 because we have to work on RHEL 6 builders.
fe5aa1
fe5aa1
* Mon Feb 04 2013 Peter Jones <pjones@redhat.com> - 0.101-1
fe5aa1
- Update to 0.101 to fix more "pesign -E" issues.
fe5aa1
fe5aa1
* Fri Nov 30 2012 Peter Jones <pjones@redhat.com> - 0.100-1
fe5aa1
- Fix insertion of signatures from a file.
fe5aa1
fe5aa1
* Mon Nov 26 2012 Matthew Garrett <mjg59@srcf.ucam.org> - 0.99-9
fe5aa1
- Add a patch needed for new shim builds
fe5aa1
fe5aa1
* Fri Oct 19 2012 Peter Jones <pjones@redhat.com> - 0.99-8
fe5aa1
- Get the Fedora signing token name right.
fe5aa1
fe5aa1
* Fri Oct 19 2012 Peter Jones <pjones@redhat.com>
fe5aa1
- Add coolkey and opensc modules to pki database during %%install.
fe5aa1
fe5aa1
* Fri Oct 19 2012 Peter Jones <pjones@redhat.com> - 0.99-7
fe5aa1
- setfacl u:kojibuilder:rw /var/run/pesign/socket
fe5aa1
- Fix command line checking in client
fe5aa1
- Add client stdin pin reading.
fe5aa1
fe5aa1
* Thu Oct 18 2012 Peter Jones <pjones@redhat.com> - 0.99-6
fe5aa1
- Automatically select daemon as signer when using rpm macros.
fe5aa1
fe5aa1
* Thu Oct 18 2012 Peter Jones <pjones@redhat.com> - 0.99-5
fe5aa1
- Make it work on the -el6 branch as well.
fe5aa1
fe5aa1
* Wed Oct 17 2012 Peter Jones <pjones@redhat.com> - 0.99-4
fe5aa1
- Fix some more bugs found by valgrind and coverity.
fe5aa1
- Don't build utils/ ; we're not using them and they're not ready anyway. 
fe5aa1
fe5aa1
* Wed Oct 17 2012 Peter Jones <pjones@redhat.com> - 0.99-3
fe5aa1
- Fix daemon startup bug from 0.99-2
fe5aa1
fe5aa1
* Wed Oct 17 2012 Peter Jones <pjones@redhat.com> - 0.99-2
fe5aa1
- Fix various bugs from 0.99-1
fe5aa1
- Don't make the database unreadable just yet.
fe5aa1
fe5aa1
* Mon Oct 15 2012 Peter Jones <pjones@redhat.com> - 0.99-1
fe5aa1
- Update to 0.99
fe5aa1
- Add documentation for client/server mode.
fe5aa1
- Add --pinfd and --pinfile to server mode.
fe5aa1
fe5aa1
* Fri Oct 12 2012 Peter Jones <pjones@redhat.com> - 0.98-1
fe5aa1
- Update to 0.98
fe5aa1
- Add client/server mode.
fe5aa1
fe5aa1
* Mon Oct 01 2012 Peter Jones <pjones@redhat.com> - 0.10-5
fe5aa1
- Fix missing section address fixup.
fe5aa1
fe5aa1
* Wed Aug 15 2012 Peter Jones <pjones@redhat.com> - 0.10-4
fe5aa1
- Make macros.pesign even better (and make it work right for i686 packages)
fe5aa1
fe5aa1
* Tue Aug 14 2012 Peter Jones <pjones@redhat.com> - 0.10-3
fe5aa1
- Only sign things on x86_64; all else ignore gracefully.
fe5aa1
fe5aa1
* Tue Aug 14 2012 Peter Jones <pjones@redhat.com> - 0.10-2
fe5aa1
- Make macros.pesign more reliable
fe5aa1
fe5aa1
* Mon Aug 13 2012 Peter Jones <pjones@redhat.com> - 0.10-1
fe5aa1
- Update to 0.10
fe5aa1
- Include rpm macros to support easy custom signing of signed packages.
fe5aa1
fe5aa1
* Fri Aug 10 2012 Peter Jones <pjones@redhat.com> - 0.9-1
fe5aa1
- Update to 0.9
fe5aa1
- Bug fix from Gary Ching-Pang Lin
fe5aa1
- Support NSS Token selection for use with smart cards.
fe5aa1
fe5aa1
* Wed Aug 08 2012 Peter Jones <pjones@redhat.com> - 0.8-1
fe5aa1
- Update to 0.8
fe5aa1
- Don't open the db read-write
fe5aa1
- Fix permissions on keystore (everybody can sign with test keys)
fe5aa1
fe5aa1
* Wed Aug 08 2012 Peter Jones <pjones@redhat.com> - 0.7-2
fe5aa1
- Include test keys.
fe5aa1
fe5aa1
* Mon Jul 30 2012 Peter Jones <pjones@redhat.com> - 0.7-1
fe5aa1
- Update to 0.7
fe5aa1
- Better fix for MS compatibility.
fe5aa1
fe5aa1
* Mon Jul 30 2012 Peter Jones <pjones@redhat.com> - 0.6-1
fe5aa1
- Update to 0.6
fe5aa1
- Bug-for-bug compatibility with signtool.exe .
fe5aa1
fe5aa1
* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5-2
fe5aa1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
fe5aa1
fe5aa1
* Wed Jul 11 2012 Peter Jones <pjones@redhat.com> - 0.5-1
fe5aa1
- Rebase to 0.5
fe5aa1
- Do more rigorous bounds checking when hashing a new binary.
fe5aa1
fe5aa1
* Tue Jul 10 2012 Peter Jones <pjones@redhat.com> - 0.3-2
fe5aa1
- Rebase to 0.4
fe5aa1
fe5aa1
* Fri Jun 22 2012 Peter Jones <pjones@redhat.com> - 0.3-2
fe5aa1
- Move man page to a more reasonable place.
fe5aa1
fe5aa1
* Fri Jun 22 2012 Peter Jones <pjones@redhat.com> - 0.3-1
fe5aa1
- Update to upstream's 0.3 .
fe5aa1
fe5aa1
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-4
fe5aa1
- Do not build with smp flags.
fe5aa1
fe5aa1
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-3
fe5aa1
- Make it build on i686, though it's unclear it'll ever be necessary.
fe5aa1
fe5aa1
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-2
fe5aa1
- Fix compile problem with f18's compiler.
fe5aa1
fe5aa1
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-1
fe5aa1
- Fix some rpmlint complaints nirik pointed out
fe5aa1
- Add popt-devel build dep
fe5aa1
fe5aa1
* Fri Jun 15 2012 Peter Jones <pjones@redhat.com> - 0.1-1
fe5aa1
- First version of SRPM.