|
 |
5a6577 |
%bcond_without gnutls
|
|
|
5a6577 |
|
|
|
5a6577 |
%global gitdate 20211109
|
|
|
5a6577 |
%global gitcommit b79fd91c4b4a74c9c5027b517c5036952c5525db
|
|
|
5a6577 |
%global gitshortcommit %(c=%{gitcommit}; echo ${c:0:7})
|
|
|
5a6577 |
|
|
|
5a6577 |
# Macros needed by SELinux
|
|
|
5a6577 |
%global selinuxtype targeted
|
|
|
5a6577 |
%global moduletype contrib
|
|
|
5a6577 |
%global modulename swtpm
|
|
|
5a6577 |
|
|
|
5a6577 |
Summary: TPM Emulator
|
|
|
5a6577 |
Name: swtpm
|
|
|
5a6577 |
Version: 0.7.0
|
|
|
df853b |
Release: 4.%{gitdate}git%{gitshortcommit}%{?dist}
|
|
|
5a6577 |
License: BSD
|
|
|
5a6577 |
Url: http://github.com/stefanberger/swtpm
|
|
|
5a6577 |
Source0: %{url}/archive/%{gitcommit}/%{name}-%{gitshortcommit}.tar.gz
|
|
|
5a6577 |
ExcludeArch: i686
|
|
|
df853b |
Patch0001: 0001-swtpm-Check-header-size-indicator-against-expected-s.patch
|
|
|
df853b |
Patch0002: 0001-swtpm-Disable-OpenSSL-FIPS-mode-to-avoid-libtpms-fai.patch
|
|
|
df853b |
Patch0003: 0001-swtpm_localca-Test-for-available-issuercert-before-c.patch
|
|
|
5a6577 |
|
|
|
5a6577 |
BuildRequires: make
|
|
|
5a6577 |
BuildRequires: git-core
|
|
|
5a6577 |
BuildRequires: automake
|
|
|
5a6577 |
BuildRequires: autoconf
|
|
|
5a6577 |
BuildRequires: libtool
|
|
|
5a6577 |
BuildRequires: libtpms-devel >= 0.6.0
|
|
|
5a6577 |
BuildRequires: expect
|
|
|
5a6577 |
BuildRequires: net-tools
|
|
|
5a6577 |
BuildRequires: openssl-devel
|
|
|
5a6577 |
BuildRequires: socat
|
|
|
5a6577 |
BuildRequires: softhsm
|
|
|
5a6577 |
BuildRequires: json-glib-devel
|
|
|
5a6577 |
%if %{with gnutls}
|
|
|
5a6577 |
BuildRequires: gnutls >= 3.4.0
|
|
|
5a6577 |
BuildRequires: gnutls-devel
|
|
|
5a6577 |
BuildRequires: gnutls-utils
|
|
|
5a6577 |
BuildRequires: libtasn1-devel
|
|
|
5a6577 |
BuildRequires: libtasn1
|
|
|
5a6577 |
%endif
|
|
|
5a6577 |
BuildRequires: selinux-policy-devel
|
|
|
5a6577 |
BuildRequires: gcc
|
|
|
5a6577 |
BuildRequires: libseccomp-devel
|
|
|
5a6577 |
BuildRequires: tpm2-tools tpm2-abrmd
|
|
|
5a6577 |
BuildRequires: python3-devel
|
|
|
5a6577 |
|
|
|
5a6577 |
Requires: %{name}-libs = %{version}-%{release}
|
|
|
5a6577 |
Requires: libtpms >= 0.6.0
|
|
|
5a6577 |
%{?selinux_requires}
|
|
|
5a6577 |
|
|
|
5a6577 |
%description
|
|
|
5a6577 |
TPM emulator built on libtpms providing TPM functionality for QEMU VMs
|
|
|
5a6577 |
|
|
|
5a6577 |
%package libs
|
|
|
5a6577 |
Summary: Private libraries for swtpm TPM emulators
|
|
|
5a6577 |
License: BSD
|
|
|
5a6577 |
|
|
|
5a6577 |
%description libs
|
|
|
5a6577 |
A private library with callback functions for libtpms based swtpm TPM emulator
|
|
|
5a6577 |
|
|
|
5a6577 |
%package devel
|
|
|
5a6577 |
Summary: Include files for the TPM emulator's CUSE interface for usage by clients
|
|
|
5a6577 |
License: BSD
|
|
|
5a6577 |
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
|
|
5a6577 |
|
|
|
5a6577 |
%description devel
|
|
|
5a6577 |
Include files for the TPM emulator's CUSE interface.
|
|
|
5a6577 |
|
|
|
5a6577 |
%package tools
|
|
|
5a6577 |
Summary: Tools for the TPM emulator
|
|
|
5a6577 |
License: BSD
|
|
|
5a6577 |
Requires: swtpm = %{version}-%{release}
|
|
|
5a6577 |
Requires: bash gnutls-utils
|
|
|
5a6577 |
|
|
|
5a6577 |
%description tools
|
|
|
5a6577 |
Tools for the TPM emulator from the swtpm package
|
|
|
5a6577 |
|
|
|
5a6577 |
%package tools-pkcs11
|
|
|
5a6577 |
Summary: Tools for creating a local CA based on a TPM pkcs11 device
|
|
|
5a6577 |
License: BSD
|
|
|
5a6577 |
Requires: swtpm-tools = %{version}-%{release}
|
|
|
5a6577 |
Requires: tpm2-tools tpm2-abrmd
|
|
|
5a6577 |
Requires: expect gnutls-utils
|
|
|
5a6577 |
|
|
|
5a6577 |
%description tools-pkcs11
|
|
|
5a6577 |
Tools for creating a local CA based on a pkcs11 device
|
|
|
5a6577 |
|
|
|
5a6577 |
%prep
|
|
|
5a6577 |
%autosetup -S git -n %{name}-%{gitcommit} -p1
|
|
|
5a6577 |
|
|
|
5a6577 |
%build
|
|
|
5a6577 |
|
|
|
5a6577 |
NOCONFIGURE=1 ./autogen.sh
|
|
|
5a6577 |
%configure \
|
|
|
5a6577 |
%if %{with gnutls}
|
|
|
5a6577 |
--with-gnutls \
|
|
|
5a6577 |
%endif
|
|
|
5a6577 |
--without-cuse \
|
|
|
5a6577 |
--without-tpm1
|
|
|
5a6577 |
|
|
|
5a6577 |
%make_build V=1
|
|
|
5a6577 |
|
|
|
5a6577 |
%check
|
|
|
5a6577 |
make %{?_smp_mflags} check VERBOSE=1
|
|
|
5a6577 |
|
|
|
5a6577 |
%install
|
|
|
5a6577 |
|
|
|
5a6577 |
%make_install
|
|
|
5a6577 |
rm -f $RPM_BUILD_ROOT%{_libdir}/%{name}/*.{a,la,so}
|
|
|
5a6577 |
|
|
|
5a6577 |
%post
|
|
|
5a6577 |
for pp in /usr/share/selinux/packages/swtpm.pp \
|
|
|
5a6577 |
/usr/share/selinux/packages/swtpm_svirt.pp; do
|
|
|
5a6577 |
%selinux_modules_install -s %{selinuxtype} ${pp}
|
|
|
5a6577 |
done
|
|
|
5a6577 |
restorecon %{_bindir}/swtpm
|
|
|
5a6577 |
|
|
|
5a6577 |
%postun
|
|
|
5a6577 |
if [ $1 -eq 0 ]; then
|
|
|
5a6577 |
for p in swtpm swtpm_svirt; do
|
|
|
5a6577 |
%selinux_modules_uninstall -s %{selinuxtype} $p
|
|
|
5a6577 |
done
|
|
|
5a6577 |
fi
|
|
|
5a6577 |
|
|
|
5a6577 |
%posttrans
|
|
|
5a6577 |
%selinux_relabel_post -s %{selinuxtype}
|
|
|
5a6577 |
|
|
|
5a6577 |
%ldconfig_post libs
|
|
|
5a6577 |
%ldconfig_postun libs
|
|
|
5a6577 |
|
|
|
5a6577 |
%files
|
|
|
5a6577 |
%license LICENSE
|
|
|
5a6577 |
%doc README
|
|
|
5a6577 |
%{_bindir}/swtpm
|
|
|
5a6577 |
%{_mandir}/man8/swtpm.8*
|
|
|
5a6577 |
%{_datadir}/selinux/packages/swtpm.pp
|
|
|
5a6577 |
%{_datadir}/selinux/packages/swtpm_svirt.pp
|
|
|
5a6577 |
|
|
|
5a6577 |
%files libs
|
|
|
5a6577 |
%license LICENSE
|
|
|
5a6577 |
%doc README
|
|
|
5a6577 |
|
|
|
5a6577 |
%dir %{_libdir}/%{name}
|
|
|
5a6577 |
%{_libdir}/%{name}/libswtpm_libtpms.so.0
|
|
|
5a6577 |
%{_libdir}/%{name}/libswtpm_libtpms.so.0.0.0
|
|
|
5a6577 |
|
|
|
5a6577 |
%files devel
|
|
|
5a6577 |
%dir %{_includedir}/%{name}
|
|
|
5a6577 |
%{_includedir}/%{name}/*.h
|
|
|
5a6577 |
%{_mandir}/man3/swtpm_ioctls.3*
|
|
|
5a6577 |
|
|
|
5a6577 |
%files tools
|
|
|
5a6577 |
%doc README
|
|
|
5a6577 |
%{_bindir}/swtpm_bios
|
|
|
5a6577 |
%if %{with gnutls}
|
|
|
5a6577 |
%{_bindir}/swtpm_cert
|
|
|
5a6577 |
%endif
|
|
|
5a6577 |
%{_bindir}/swtpm_setup
|
|
|
5a6577 |
%{_bindir}/swtpm_ioctl
|
|
|
5a6577 |
%{_bindir}/swtpm_localca
|
|
|
5a6577 |
%{_mandir}/man8/swtpm_bios.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm_cert.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm_ioctl.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm-localca.conf.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm-localca.options.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm-localca.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm_localca.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm_setup.8*
|
|
|
5a6577 |
%{_mandir}/man8/swtpm_setup.conf.8*
|
|
|
5a6577 |
%config(noreplace) %{_sysconfdir}/swtpm_setup.conf
|
|
|
5a6577 |
%config(noreplace) %{_sysconfdir}/swtpm-localca.options
|
|
|
5a6577 |
%config(noreplace) %{_sysconfdir}/swtpm-localca.conf
|
|
|
5a6577 |
%dir %{_datadir}/swtpm
|
|
|
5a6577 |
%{_datadir}/swtpm/swtpm-localca
|
|
|
5a6577 |
%{_datadir}/swtpm/swtpm-create-user-config-files
|
|
|
5a6577 |
%attr( 750, tss, root) %{_localstatedir}/lib/swtpm-localca
|
|
|
5a6577 |
|
|
|
5a6577 |
%files tools-pkcs11
|
|
|
5a6577 |
%{_mandir}/man8/swtpm-create-tpmca.8*
|
|
|
5a6577 |
%{_datadir}/swtpm/swtpm-create-tpmca
|
|
|
5a6577 |
|
|
|
5a6577 |
%changelog
|
|
|
df853b |
* Mon Jul 18 2022 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.0-4.20211109gitb79fd91
|
|
|
df853b |
- swtpm_localca: Test for available issuercert before creating CA
|
|
|
df853b |
Resolves: rhbz#2100508
|
|
|
df853b |
|
|
|
df853b |
* Mon Jun 20 2022 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.0-3.20211109gitb79fd91
|
|
|
df853b |
- Disable OpenSSL FIPS mode to avoid libtpms failures
|
|
|
df853b |
Resolves: rhbz#2097947
|
|
|
df853b |
|
|
|
df853b |
* Mon Feb 21 2022 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.0-2.20211109gitb79fd91
|
|
|
df853b |
- Add fix for CVE-2022-23645.
|
|
|
df853b |
Resolves: rhbz#2056517
|
|
|
df853b |
|
|
|
5a6577 |
* Tue Jan 04 2022 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.0-1.20211109gitb79fd91
|
|
|
5a6577 |
- Rebase to 0.7.0, disable TPM 1.2.
|
|
|
5a6577 |
Resovles: rhbz#2029612
|
|
|
5a6577 |
|
|
|
5a6577 |
* Thu Sep 16 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.6.0-2.20210607gitea627b3
|
|
|
5a6577 |
- rebuilt with missing CFLAGS fix.
|
|
|
5a6577 |
|
|
|
5a6577 |
* Mon Jun 28 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.6.0-1.20210607gitea627b3
|
|
|
5a6577 |
- Update to 0.6.0.
|
|
|
5a6577 |
Resolves: rhbz#1972783
|
|
|
5a6577 |
|
|
|
5a6577 |
* Tue Dec 1 20:40:07 +04 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
|
|
|
5a6577 |
- Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
|
|
|
5a6577 |
Resolves: rhbz#1906043
|
|
|
5a6577 |
|
|
|
5a6577 |
* Thu Sep 24 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-3.20200828git0c238a2
|
|
|
5a6577 |
- swtpm_setup: Add missing .config path when using ${HOME}. Resolves: rhbz#1881418
|
|
|
5a6577 |
|
|
|
5a6577 |
* Thu Sep 17 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
|
|
|
5a6577 |
- Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
|
|
|
5a6577 |
(fixes usage of swtpm-localca with passwords when signing keys)
|
|
|
5a6577 |
|
|
|
5a6577 |
* Sat Sep 12 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-1.20200828git0c238a2
|
|
|
5a6577 |
- Update to v0.4.0. Resolves: rhbz#1868375
|
|
|
5a6577 |
|
|
|
5a6577 |
* Thu May 28 2020 Marc-André Lureau <marcandre.lureau@gmail.com> - 0.3.0-1.20200218git74ae43b
|
|
|
5a6577 |
- Update to v0.3.0. Fixes rhbz#1809778
|
|
|
5a6577 |
- exclude i686 build
|
|
|
5a6577 |
|
|
|
5a6577 |
* Mon Jan 27 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.2.0-2.20200127gitff5a83b
|
|
|
5a6577 |
- Update to latest 0.2-stable branch, fix random test failure. rhbz#1782451
|
|
|
5a6577 |
|
|
|
5a6577 |
* Fri Oct 18 2019 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.2.0-1.20191018git9227cf4
|
|
|
5a6577 |
- rebuilt
|
|
|
5a6577 |
|
|
|
5a6577 |
* Tue Aug 13 2019 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.1.0-1.20190425gitca85606.1
|
|
|
5a6577 |
- Fix SELinux labels on /usr/bin/swtpm installation rhbz#1739994
|
|
|
5a6577 |
|
|
|
5a6577 |
* Thu Apr 25 2019 Stefan Berger <stefanb@linux.ibm.com> - 0.1.0-0.20190425gitca85606
|
|
|
5a6577 |
- pick up bug fixes
|
|
|
5a6577 |
|
|
|
5a6577 |
* Mon Feb 04 2019 Stefan Berger <stefanb@linux.ibm.com> - 0.1.0-0.20190204git2c25d13.1
|
|
|
5a6577 |
- v0.1.0 release of swtpm
|
|
|
5a6577 |
|
|
|
5a6577 |
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.0-0.20181212git8b9484a.1
|
|
|
5a6577 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
|
|
5a6577 |
|
|
|
5a6577 |
* Wed Dec 12 2018 Stefan Berger <stefanb@linux.ibm.com> - 0.1.0-0.20181212git8b9484a
|
|
|
5a6577 |
- Follow improvements in swtpm repo primarily related to fixes for 'ubsan'
|
|
|
5a6577 |
|
|
|
5a6577 |
* Tue Nov 06 2018 Stefan Berger <stefanb@linux.ibm.com> - 0.1.0-0.20181106git05d8160
|
|
|
5a6577 |
- Follow improvements in swtpm repo
|
|
|
5a6577 |
- Remove ownership change of swtpm_setup.sh; have root own the file as required
|
|
|
5a6577 |
|
|
|
5a6577 |
* Wed Oct 31 2018 Stefan Berger <stefanb@linux.ibm.com> - 0.1.0-0.20181031gitc782a85
|
|
|
5a6577 |
- Follow improvements and fixes in swtpm
|
|
|
5a6577 |
|
|
|
5a6577 |
* Tue Oct 02 2018 Stefan Berger <stefanb@linux.vnet.ibm.com> - 0.1.0-0.20181002git0143c41
|
|
|
5a6577 |
- Fixes to SELinux policy
|
|
|
5a6577 |
- Improvements on various other parts
|
|
|
5a6577 |
* Tue Sep 25 2018 Stefan Berger <stefanb@linux.vnet.ibm.com> - 0.1.0-0.20180924gitce13edf
|
|
|
5a6577 |
- Initial Fedora build
|
|
|
5a6577 |
* Mon Sep 17 2018 Stefan Berger <stefanb@linux.vnet.ibm.com> - 0.1.0-0.20180918git67d7ea3
|
|
|
5a6577 |
- Created initial version of rpm spec files
|
|
|
5a6577 |
- Version is now 0.1.0
|
|
|
5a6577 |
- Bugzilla for this spec: https://bugzilla.redhat.com/show_bug.cgi?id=1611829
|