199 lines
6.4 KiB
RPMSpec
199 lines
6.4 KiB
RPMSpec
# keylime-agent-rust.spec
|
|
# Generated by rust2rpm 20
|
|
|
|
%bcond_without check
|
|
|
|
%global crate keylime_agent
|
|
|
|
%if 0%{?rhel}
|
|
# RHEL: Use bundled deps as it doesn't ship Rust libraries
|
|
%global bundled_rust_deps 1
|
|
%global __brp_mangle_shebangs_exclude_from ^/usr/src/debug/.*$
|
|
%else
|
|
# Fedora: Use only system Rust libraries
|
|
%global bundled_rust_deps 0
|
|
%endif
|
|
|
|
Name: keylime-agent-rust
|
|
Version: 0.2.7
|
|
Release: %{?autorelease}%{!?autorelease:1%{?dist}}
|
|
Summary: Rust agent for Keylime
|
|
|
|
# Upstream license specification: Apache-2.0
|
|
#
|
|
# The build dependencies have the following licenses:
|
|
#
|
|
# 0BSD or MIT or ASL 2.0
|
|
# ASL 2.0
|
|
# ASL 2.0 or Boost
|
|
# ASL 2.0 or MIT
|
|
# ASL 2.0 with exceptions
|
|
# BSD
|
|
# MIT
|
|
# MIT or ASL 2.0
|
|
# MIT or ASL 2.0 or zlib
|
|
# MIT or zlib or ASL 2.0
|
|
# Unlicense or MIT
|
|
# zlib or ASL 2.0 or MIT
|
|
#
|
|
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
|
|
URL: https://github.com/keylime/rust-keylime/
|
|
# The source tarball is downloaded using the following commands:
|
|
# spectool -g keylime-agent-rust.spec
|
|
Source0: %{url}/archive/refs/tags/v%{version}.tar.gz
|
|
# The vendor tarball is created using cargo-vendor-filterer to remove Windows
|
|
# related files (https://github.com/cgwalters/cargo-vendor-filterer)
|
|
# tar xf rust-keylime-%%{version}.tar.zstd
|
|
# cd rust-keylime-%%{version}
|
|
# cargo vendor-filterer --platform x86_64-unknown-linux-gnu \
|
|
# --platform powerpc64le-unknown-linux-gnu \
|
|
# --platform aarch64-unknown-linux-gnu \
|
|
# --platform i686-unknown-linux-gnu \
|
|
# --platform s390x-unknown-linux-gnu \
|
|
# --exclude-crate-path "libloading#tests" \
|
|
# --prefix=vendor --format=tar.zstd
|
|
# Rename the vendor.tar.zstd tarball to rust-keylime-%%{version}-vendor.tar.zstd
|
|
Source1: rust-keylime-%{version}-vendor.tar.zstd
|
|
## (0-99) General patches
|
|
# Enable logging for the keylime library
|
|
# Patch from https://github.com/keylime/rust-keylime/pull/922
|
|
Patch0: rust-keylime-enable-logging-keylime-lib.patch
|
|
# Drop completely the legacy-python-actions feature
|
|
Patch1: rust-keylime-metadata.patch
|
|
# Update to openssl 0.10.70 to fix CVE-2025-24898
|
|
# Patch from https://github.com/keylime/rust-keylime/pull/926
|
|
Patch2: rust-keylime-openssl-0.10.70.patch
|
|
# Backport of https://github.com/keylime/rust-keylime/pull/846
|
|
# to enable different key sizes and curves for EK and AK.
|
|
Patch3: 0003-Enable-non-standard-key-sizes-and-curves-for-EK-and-.patch
|
|
Patch4: 0004-Clippy-fixes.patch
|
|
Patch5: 0005-tpm-add-policy-auth-for-EK-to-activate-crendential.patch
|
|
Patch6: 0006-keylime-agent.conf-add-all-accepted-TPM-encryption-a.patch
|
|
Patch7: 0007-Fix-ECC-RSA-algorithm-selection-and-reporting-for-ke.patch
|
|
|
|
## (100-199) Patches for building from system Rust libraries (Fedora)
|
|
## (200+) Patches for building from vendored Rust libraries (RHEL)
|
|
|
|
ExclusiveArch: %{rust_arches}
|
|
|
|
Requires: tpm2-tss
|
|
Requires: util-linux-core
|
|
|
|
# The keylime-base package provides the keylime user creation. It is available
|
|
# from Fedora 36
|
|
%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
|
|
Requires: keylime-base
|
|
%endif
|
|
|
|
BuildRequires: git-core
|
|
BuildRequires: systemd
|
|
BuildRequires: openssl-devel
|
|
BuildRequires: libarchive-devel
|
|
BuildRequires: tpm2-tss-devel
|
|
BuildRequires: clang
|
|
%if 0%{?bundled_rust_deps}
|
|
BuildRequires: rust-toolset
|
|
%else
|
|
BuildRequires: rust-packaging >= 21-2
|
|
%endif
|
|
|
|
# Virtual Provides to support swapping between Python and Rust implementation
|
|
Provides: keylime-agent
|
|
Conflicts: keylime-agent
|
|
|
|
%description
|
|
Rust agent for Keylime
|
|
|
|
%prep
|
|
%autosetup -S git -n rust-keylime-%{version} -N %{?bundled_rust_deps:-a1}
|
|
%autopatch -M 99 -p1
|
|
%if 0%{?bundled_rust_deps}
|
|
# Source1 is vendored dependencies
|
|
%cargo_prep -v vendor
|
|
%autopatch -m 200 -p1
|
|
%else
|
|
%autopatch -m 100 -M 199 -p1
|
|
%cargo_prep
|
|
%generate_buildrequires
|
|
%cargo_generate_buildrequires
|
|
%endif
|
|
|
|
%build
|
|
%cargo_build
|
|
%cargo_license_summary
|
|
%{cargo_license} > LICENSE.dependencies
|
|
%if 0%{?bundled_rust_deps}
|
|
%cargo_vendor_manifest
|
|
%endif
|
|
|
|
%install
|
|
|
|
mkdir -p %{buildroot}/%{_sharedstatedir}/keylime
|
|
mkdir -p --mode=0700 %{buildroot}/%{_rundir}/keylime
|
|
mkdir -p --mode=0700 %{buildroot}/%{_libexecdir}/keylime
|
|
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/keylime
|
|
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/keylime/agent.conf.d
|
|
|
|
install -Dpm 400 keylime-agent.conf \
|
|
%{buildroot}%{_sysconfdir}/keylime/agent.conf
|
|
|
|
install -Dpm 644 ./dist/systemd/system/keylime_agent.service \
|
|
%{buildroot}%{_unitdir}/keylime_agent.service
|
|
|
|
install -Dpm 644 ./dist/systemd/system/var-lib-keylime-secure.mount \
|
|
%{buildroot}%{_unitdir}/var-lib-keylime-secure.mount
|
|
|
|
# Setting up the agent to use keylime:keylime user/group after dropping privileges.
|
|
cat > %{buildroot}/%{_sysconfdir}/keylime/agent.conf.d/001-run_as.conf << EOF
|
|
[agent]
|
|
run_as = "keylime:keylime"
|
|
EOF
|
|
|
|
install -Dpm 0755 \
|
|
-t %{buildroot}%{_bindir} \
|
|
./target/release/keylime_agent
|
|
install -Dpm 0755 \
|
|
-t %{buildroot}%{_bindir} \
|
|
./target/release/keylime_ima_emulator
|
|
|
|
%posttrans
|
|
chmod 500 %{_sysconfdir}/keylime/agent.conf.d
|
|
chmod 400 %{_sysconfdir}/keylime/agent.conf.d/*.conf
|
|
chmod 500 %{_sysconfdir}/keylime
|
|
chown -R keylime:keylime %{_sysconfdir}/keylime
|
|
|
|
%preun
|
|
%systemd_preun keylime_agent.service
|
|
%systemd_preun var-lib-keylime-secure.mount
|
|
|
|
%postun
|
|
%systemd_postun_with_restart keylime_agent.service
|
|
%systemd_postun_with_restart var-lib-keylime-secure.mount
|
|
|
|
%files
|
|
%license LICENSE
|
|
%license LICENSE.dependencies
|
|
%if 0%{?bundled_rust_deps}
|
|
%license cargo-vendor.txt
|
|
%endif
|
|
%doc README.md
|
|
%attr(500,keylime,keylime) %dir %{_sysconfdir}/keylime
|
|
%attr(500,keylime,keylime) %dir %{_sysconfdir}/keylime/agent.conf.d
|
|
%config(noreplace) %attr(400,keylime,keylime) %{_sysconfdir}/keylime/agent.conf.d/001-run_as.conf
|
|
%config(noreplace) %attr(400,keylime,keylime) %{_sysconfdir}/keylime/agent.conf
|
|
%{_unitdir}/keylime_agent.service
|
|
%{_unitdir}/var-lib-keylime-secure.mount
|
|
%attr(700,keylime,keylime) %dir %{_rundir}/keylime
|
|
%attr(700,keylime,keylime) %{_sharedstatedir}/keylime
|
|
%attr(700,keylime,keylime) %{_libexecdir}/keylime
|
|
%{_bindir}/keylime_agent
|
|
%{_bindir}/keylime_ima_emulator
|
|
|
|
%if %{with check}
|
|
%check
|
|
%cargo_test
|
|
%endif
|
|
|
|
%changelog
|
|
%autochangelog
|