#global prever rc1

Summary: Software version of a PKCS#11 Hardware Security Module

Name: softhsm

Version: 2.1.0

Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}

License: BSD

Url: http://www.opendnssec.org/

Source: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}.tar.gz

Source1: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}.tar.gz.sig

Source2: softhsm.module

# taken from coolkey which is not build on all arches we build on

Source3: softhsm2-pk11install.c

Group: Applications/System

# which version of openssl contains backport of aes wrapping support?

BuildRequires: openssl-devel >= 1.0.1e-42.el7_1.2, sqlite-devel >= 3.4.2, cppunit-devel

BuildRequires: gcc-c++, pkgconfig, p11-kit-devel, nss-devel

Requires(pre): shadow-utils

Requires: p11-kit, nss-tools

Requires: openssl-libs >= 1.0.1e-42.el7_1.2

%global _hardened_build 1

%global softhsm_module "SoftHSM PKCS #11 Module"

%global nssdb %{_sysconfdir}/pki/nssdb

%description

NOTE: This package is only suported for use with Identity Management.

OpenDNSSEC is providing a software implementation of a generic

cryptographic device with a PKCS#11 interface, the SoftHSM. SoftHSM is

designed to meet the requirements of OpenDNSSEC, but can also work together

with other cryptographic products because of the PKCS#11 interface.

%package devel

Summary: Development package of softhsm that includes the header files

Group: Development/Libraries

Requires: %{name} = %{version}-%{release}, openssl-devel, sqlite-devel

%if 0%{?prever:1}

BuildRequires: autoconf, libtool, automake

%endif

%description devel

The devel package contains the libsofthsm include files

%prep

%setup -q -n %{name}-%{version}%{?prever}

%if 0%{?prever:1}

autoreconf -fiv

%endif

# remove softhsm/ subdir auto-added to --libdir

sed -i "s:full_libdir/softhsm:full_libdir:g" configure

%if 0%{?prever:1}

sed -i 's:^full_libdir=":#full_libdir=":g' configure.ac

%endif

sed -i "s:libdir)/@PACKAGE@:libdir):" Makefile.in

%build

%configure --libdir=%{_libdir}/pkcs11 --with-openssl=%{_prefix} --enable-ecc --disable-gost \

           --with-migrate --enable-visibility

make %{?_smp_mflags}

# install our copy of pk11install taken from coolkey package

cp %{SOURCE3} .

gcc $(pkg-config --cflags nss) %{optflags} -c softhsm2-pk11install.c

gcc $(pkg-config --libs nss) -lpthread  -lsoftokn3 -ldl -lz %{optflags} softhsm2-pk11install.o -o softhsm2-pk11install

%check

make check

%install

rm -rf %{buildroot}

make DESTDIR=%{buildroot} install

install -D %{SOURCE2} %{buildroot}/%{_datadir}/p11-kit/modules/softhsm.module

rm %{buildroot}/%{_sysconfdir}/softhsm2.conf.sample

rm -f %{buildroot}/%{_libdir}/pkcs11/*a

mkdir -p %{buildroot}%{_includedir}/softhsm

cp src/lib/*.h %{buildroot}%{_includedir}/softhsm

mkdir -p %{buildroot}/%{_sharedstatedir}/softhsm/tokens

install -m0755 -D softhsm2-pk11install %{buildroot}/%{_bindir}/softhsm2-pk11install

# rhbz#1272423 NSS needs it to be in the search path too

( cd  %{buildroot}/%{_libdir} ; ln -s pkcs11/libsofthsm2.so)

%files

%config(noreplace) %{_sysconfdir}/softhsm2.conf

%{_bindir}/*

%{_libdir}/pkcs11/libsofthsm2.so

%{_libdir}/libsofthsm2.so

%attr(0664,root,root) %{_datadir}/p11-kit/modules/softhsm.module

%attr(0770,ods,ods) %dir %{_sharedstatedir}/softhsm

%attr(0770,ods,ods) %dir %{_sharedstatedir}/softhsm/tokens

%doc LICENSE README.md NEWS

%{_mandir}/*/*

%files devel

%attr(0755,root,root) %dir %{_includedir}/softhsm

%{_includedir}/softhsm/*.h

%pre

getent group ods >/dev/null || groupadd -r ods

getent passwd ods >/dev/null || \

    useradd -r -g ods -d %{_sharedstatedir}/softhsm -s /sbin/nologin \

    -c "softhsm private keys owner" ods

exit 0

%post

isThere=`modutil -rawlist -dbdir %{nssdb} | grep %{softhsm_module} || echo NO`

if [ "$isThere" == "NO" ]; then

      softhsm2-pk11install -p %{nssdb} 'name=%{softhsm_module} library=libsofthsm2.so'

fi

if [ $1 -eq 0 ]; then

   modutil -delete %{softhsm_module} -dbdir %{nssdb} -force || :

fi

%changelog

* Thu Jun 23 2016 Paul Wouters <pwouters@redhat.com> - 2.1.0-2

- Re-add note this package is only supported for IdM

* Wed Jun 22 2016 Paul Wouters <pwouters@redhat.com> - 2.1.0-1

- Resolves: rhbz#1281704 Rebase to softhsm 2.1.0, fix search path, fix writing trusted/CA certs

* Fri Jun 26 2015 Petr Spacek <pspacek@redhat.com> - 2.0.0rc1-3

- Dependency on OpenSSL libraries with fix for bug #1193942 was added.

* Mon Jun 01 2015 Petr Spacek <pspacek@redhat.com> - 2.0.0rc1-1

- Resolves: rhbz#1193892 Rebase to latest upstream version

- i686/ppc/s390 architectures are now included in the build

* Tue Nov 11 2014 Paul Wouters <pwouters@redhat.com> - 2.0.0b1-4

- Resolves: rhbz#1117157 Add warning to package description

* Tue Sep 30 2014 Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3

- Fix softhsm2-pk11install buid and post call

- Do not use --with-objectstore-backend-db (causes issues on i686)

* Tue Sep 23 2014 Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2

- Change install directory to /usr/lib*/pkcs11/

- Install pkcs11 module file

- Use official upstream tar ball

- Create ods user to own softhsm/token files

- Enable migration tools (for epel6 softhsm-v1 installs)

- Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file

- Copy pk11install.c from coolkey package which is not built on all arches

- Enable hardened build

- Add upstream official source url

- Add devel package

- Excluding i686/ppc (make check fails and we are a leave package)

- (thanks to Petr for jumping in for the initial build while I was too busy)

* Thu Sep 11 2014 Petr Spacek <pspacek@redhat.com> - 2.0.0b1-1

- Initial package for RHEL