libkcapi/libkcapi.spec

520 lines
15 KiB
RPMSpec
Raw Normal View History

2018-01-16 17:47:27 +00:00
# Shared object version of libkcapi.
%global vmajor 1
%global vminor 4
%global vpatch 0
2018-01-16 17:47:27 +00:00
# Do we build the replacements packages?
%bcond_with replace_coreutils
# Replace fipscheck by default in Fedora 33+:
%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
%bcond_without replace_fipscheck
%else
%bcond_with replace_fipscheck
%endif
# Replace hmaccalc by default in Fedora 28+:
%if 0%{?fedora} >= 28 || 0%{?rhel} >= 8
%bcond_without replace_hmaccalc
%else
%bcond_with replace_hmaccalc
%endif
%if 0%{?fedora} >= 29 || 0%{?rhel} >= 8
%bcond_without test_package
%else
%bcond_with test_package
%endif
# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518
%if 0%{?rhel}
%bcond_with cppcheck
%else
%bcond_without cppcheck
%endif
# Use `--without test` to build without running the tests
%bcond_without test
# Use `--without fuzz_test` to skip the fuzz test during build
%bcond_without fuzz_test
# Use `--without doc` to build without the -doc subpackage
%bcond_without doc
# Use `--without clang_sa` to skip clang static analysis during build
%bcond_without clang_sa
# This package needs at least Linux Kernel v4.10.0.
%global min_kernel_ver 4.10.0
# Do we need to tweak sysctl.d? In newer versions of the Linux
# Kernel the default ancillary buffer size is set high enough.
# TODO: Adapt this when the patch for net/core/sock.c is merged.
%if %{lua:print(rpm.vercmp('99.0.0', posix.uname('%r')));} >= 0
%global with_sysctl_tweak 1
%else
%global with_sysctl_tweak 0
%endif
%if %{with_sysctl_tweak}
2018-01-16 17:47:27 +00:00
# Priority for the sysctl.d preset.
%global sysctl_prio 50
# Value used for the sysctl.d preset.
2018-02-26 09:22:36 +00:00
%global sysctl_optmem_max 81920
# Extension for the README.distro file.
%global distroname_ext %{?fedora:fedora}%{?rhel:redhat}
%endif
2018-01-16 17:47:27 +00:00
# Lowest limit to run the testsuite. If we cannot obtain this
# value, we asume the testsuite cannot be run.
%global test_optmem_max %(%{__cat} /proc/sys/net/core/optmem_max || echo 0)
# For picking patches from upstream commits or pull requests.
%global giturl https://github.com/smuellerDD/%{name}
# Do we replace some coreutils?
%if %{with replace_coreutils}
# TODO: Adapt this when replacing some coreutils initially.
%global coreutils_evr 8.29-1%{?dist}
2018-01-16 17:47:27 +00:00
%endif
# Do we replace fipscheck?
%if %{with replace_fipscheck}
%global fipscheck_evr 1.5.0-9
2018-01-16 17:47:27 +00:00
%endif
# Do we replace hmaccalc?
%if %{with replace_hmaccalc}
%global hmaccalc_evr 0.9.14-10%{?dist}
2018-01-16 17:47:27 +00:00
%endif
%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac
%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum fipscheck fipshmac
# On old kernels use mock hashers implemented via openssl
%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0
%global sha512hmac bin/kcapi-hasher -n sha512hmac
%global fipshmac bin/kcapi-hasher -n fipshmac
%else
%global sha512hmac bash %{SOURCE2}
%global fipshmac bash %{SOURCE3}
%endif
2018-01-16 17:47:27 +00:00
# Add generation of HMAC checksums of the final stripped
# binaries. %%define with lazy globbing is used here
# intentionally, because using %%global does not work.
%define __spec_install_post \
%{?__debug_package:%{__debug_install_post}} \
%{__arch_install_post} \
%{__os_install_post} \
bin_path=%{buildroot}%{_bindir} \
lib_path=%{buildroot}/%{_lib} \
for app in %{apps_hmaccalc}; do \
test -e "$bin_path"/$app || continue \
{ %sha512hmac "$bin_path"/$app || exit 1; } \\\
| cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac \
done \
for app in %{apps_fipscheck}; do \
test -e "$bin_path"/$app || continue \
%fipshmac -d "$lib_path"/fipscheck "$bin_path"/$app || exit 1 \
done \
%{_bindir}/hardlink -cfv %{buildroot}%{_bindir} \
%fipshmac -d "$lib_path"/fipscheck \\\
"$lib_path"/libkcapi.so.%{version} || exit 1 \
%{__ln_s} libkcapi.so.%{version}.hmac \\\
"$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \
2018-01-16 17:47:27 +00:00
%{nil}
Name: libkcapi
Version: %{vmajor}.%{vminor}.%{vpatch}
2022-08-13 21:34:12 +00:00
Release: %autorelease
2018-01-16 17:47:27 +00:00
Summary: User space interface to the Linux Kernel Crypto API
License: BSD or GPLv2
2021-01-13 01:47:40 +00:00
URL: https://www.chronox.de/%{name}.html
Source0: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz
Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc
Source2: sha512hmac-openssl.sh
Source3: fipshmac-openssl.sh
2018-01-16 17:47:27 +00:00
Patch: %{giturl}/commit/c2af62dcc7a2.patch#/001-tests-kernel-version.patch
BuildRequires: bash
2018-01-16 17:47:27 +00:00
BuildRequires: coreutils
BuildRequires: gcc
BuildRequires: git-core
2018-01-16 17:47:27 +00:00
BuildRequires: hardlink
BuildRequires: kernel-headers >= %{min_kernel_ver}
2018-01-16 17:47:27 +00:00
BuildRequires: libtool
BuildRequires: make
2018-01-16 17:47:27 +00:00
BuildRequires: openssl
BuildRequires: perl-interpreter
2018-01-16 17:47:27 +00:00
BuildRequires: systemd
BuildRequires: xmlto
%if %{with doc}
BuildRequires: docbook-utils-pdf
%endif
%if %{with clang_sa}
BuildRequires: clang
%endif
%if %{with cppcheck}
BuildRequires: cppcheck >= 2.4
%endif
2018-01-16 17:47:27 +00:00
# For ownership of %%{_sysctldir}.
Requires: systemd
Obsoletes: %{name}-replacements <= %{version}-%{release}
2018-01-16 17:47:27 +00:00
%description
libkcapi allows user-space to access the Linux kernel crypto API.
This library uses the netlink interface and exports easy to use APIs
so that a developer does not need to consider the low-level netlink
interface handling.
The library does not implement any cipher algorithms. All consumer
requests are sent to the kernel for processing. Results from the
kernel crypto API are returned to the consumer via the library API.
The kernel interface and therefore this library can be used by
unprivileged processes.
%package devel
Summary: Development files for the %{name} package
Requires: %{name}%{?_isa} == %{version}-%{release}
%description devel
Header files for applications that use %{name}.
%if %{with doc}
2018-01-16 17:47:27 +00:00
%package doc
Summary: User documentation for the %{name} package
BuildArch: noarch
# Depend on one of the base packages because they have the license files
# We cannot just bundle them into doc because they might conflict with an
# older or newer version of the base package.
Requires: %{name} == %{version}-%{release}
2018-01-16 17:47:27 +00:00
%description doc
User documentation for %{name}.
%endif
2018-01-16 17:47:27 +00:00
%if %{with replace_coreutils}
%package checksum
Summary: Drop-in replacement for *sum utils provided by the %{name} package
Requires: %{name}%{?_isa} == %{version}-%{release}
Requires: coreutils%{?_isa} >= %{coreutils_evr}
2018-01-16 17:47:27 +00:00
Conflicts: coreutils < %{coreutils_evr}
Conflicts: coreutils-single
%description checksum
2018-05-02 07:36:46 +00:00
Provides drop-in replacements for sha*sum tools (from package
coreutils) using %{name}.
2018-01-16 17:47:27 +00:00
%endif
2018-01-16 17:47:27 +00:00
%if %{with replace_fipscheck}
%package fipscheck
Summary: Drop-in replacements for fipscheck/fipshmac provided by the %{name} package
Requires: %{name}%{?_isa} == %{version}-%{release}
2018-01-16 17:47:27 +00:00
Obsoletes: fipscheck <= %{fipscheck_evr}
Provides: fipscheck == %{fipscheck_evr}.1
Provides: fipscheck%{?_isa} == %{fipscheck_evr}.1
%description fipscheck
2018-05-02 07:36:46 +00:00
Provides drop-in replacements for fipscheck and fipshmac tools (from
package fipscheck) using %{name}.
2018-01-16 17:47:27 +00:00
%endif
2018-01-16 17:47:27 +00:00
%if %{with replace_hmaccalc}
%package hmaccalc
Summary: Drop-in replacements for hmaccalc provided by the %{name} package
Requires: %{name}%{?_isa} == %{version}-%{release}
2018-01-16 17:47:27 +00:00
Obsoletes: hmaccalc <= %{hmaccalc_evr}
Provides: hmaccalc == %{hmaccalc_evr}.1
Provides: hmaccalc%{?_isa} == %{hmaccalc_evr}.1
%description hmaccalc
2018-05-02 07:36:46 +00:00
Provides drop-in replacements for sha*hmac tools (from package
hmaccalc) using %{name}.
2018-01-16 17:47:27 +00:00
%endif
%package static
Summary: Static library for -static linking with %{name}
Requires: %{name}-devel%{?_isa} == %{version}-%{release}
%description static
This package contains the %{name} static libraries for -static
linking. You don't need this, unless you link statically, which
is highly discouraged.
%package tools
Summary: Utility applications for the %{name} package
Requires: %{name}%{?_isa} == %{version}-%{release}
%description tools
Utility applications that are provided with %{name}. This includes
tools to use message digests, symmetric ciphers and random number
generators implemented in the Linux kernel from command line.
%if %{with test_package}
2018-08-07 15:38:32 +00:00
%package tests
Summary: Testing scripts for the %{name} package
Requires: %{name}%{?_isa} == %{version}-%{release}
2018-08-07 15:38:32 +00:00
Requires: %{name}-tools%{?_isa} == %{version}-%{release}
%if %{with replace_hmaccalc}
Requires: %{name}-hmaccalc%{?_isa} == %{version}-%{release}
%endif
%if %{with replace_coreutils}
Requires: %{name}-checksum%{?_isa} == %{version}-%{release}
%endif
Requires: coreutils
Requires: openssl
Requires: perl-interpreter
2018-08-07 15:38:32 +00:00
%description tests
Auxiliary scripts for testing %{name}.
%endif
2018-08-07 15:38:32 +00:00
2018-01-16 17:47:27 +00:00
%prep
%autosetup -p 1 -S git
2018-01-16 17:47:27 +00:00
%if %{with_sysctl_tweak}
%{__cat} << EOF > README.%{distroname_ext}
2018-01-16 17:47:27 +00:00
This package increases the default limit of the ancillary buffer size
per kernel socket defined in \`net.core.optmem_max\` to %{sysctl_optmem_max} bytes.
For this preset to become active it requires a reboot after the
installation of this package. You can also manually increase this
limit by invocing \`sysctl net.core.optmem_max=%{sysctl_optmem_max}\` as the
super-user, e.g. using \`su\` or \`sudo\` on the terminal.
This is done to provide consumers of the new Linux Kernel Crypto API
User Space Interface a well sufficient and reasonable maximum limit
by default, especially when using AIO with a larger amount of IOVECs.
For further information about the AF_ALG kernel socket and AIO, see
the discussion at the kernel-crypto mailing-list:
https://www.mail-archive.com/linux-crypto@vger.kernel.org/msg30417.html
See the instructions given in '%{_sysctldir}/50-default.conf',
if you need or want to override the preset made by this package.
EOF
%{__cat} << EOF > %{sysctl_prio}-%{name}-optmem_max.conf
# See the 'README.%{distroname_ext}' file shipped in %%doc
2018-01-16 17:47:27 +00:00
# with the %{name} package.
#
# See '%{_sysctldir}/50-default.conf',
# if you need or want to override this preset.
# Increase the ancillary buffer size per socket.
net.core.optmem_max = %{sysctl_optmem_max}
EOF
%endif
2018-01-16 17:47:27 +00:00
%{_bindir}/autoreconf -fiv
%build
%configure \
--libdir=/%{_lib} \
--disable-silent-rules \
--enable-kcapi-encapp \
--enable-kcapi-dgstapp \
--enable-kcapi-hasher \
--enable-kcapi-rngapp \
--enable-kcapi-speed \
--enable-kcapi-test \
--enable-shared \
--enable-static \
2018-08-23 13:38:18 +00:00
--enable-sum-prefix= \
--enable-sum-dir=/%{_lib} \
2018-01-16 17:47:27 +00:00
--with-pkgconfigdir=%{_libdir}/pkgconfig
%if %{with doc}
2018-01-16 17:47:27 +00:00
%make_build all doc
%else
%make_build all man
%endif
2018-01-16 17:47:27 +00:00
%install
%make_install
# Install sysctl.d preset.
%{__mkdir_p} %{buildroot}%{_sysctldir}
2018-01-16 17:47:27 +00:00
%{__install} -Dpm 0644 -t %{buildroot}%{_sysctldir} \
%{sysctl_prio}-%{name}-optmem_max.conf
# Install into proper location for inclusion by %%doc.
%{__mkdir_p} %{buildroot}%{_pkgdocdir}
2018-01-16 17:47:27 +00:00
%{__install} -Dpm 0644 -t %{buildroot}%{_pkgdocdir} \
%if %{with_sysctl_tweak}
README.%{distroname_ext} \
%endif
%if %{with doc}
doc/%{name}.p{df,s} \
%endif
README.md CHANGES.md TODO
%if %{with doc}
2018-01-16 17:47:27 +00:00
%{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir}
%endif
2018-01-16 17:47:27 +00:00
2018-03-31 10:35:32 +00:00
# Install replacement tools, if enabled.
%if !%{with replace_coreutils}
2018-01-16 17:47:27 +00:00
%{__rm} -f \
%{buildroot}%{_bindir}/md5sum \
%{buildroot}%{_bindir}/sha*sum \
%{buildroot}%{_bindir}/sm*sum
2018-01-16 17:47:27 +00:00
%endif
%if !%{with replace_fipscheck}
%{__rm} -f %{buildroot}%{_bindir}/fips*
%endif
%if !%{with replace_hmaccalc}
%{__rm} -f %{buildroot}%{_bindir}/sha*hmac
%{__rm} -f %{buildroot}%{_bindir}/sm*hmac
%endif
2018-01-16 17:47:27 +00:00
# We don't ship autocrap dumplings.
%{_bindir}/find %{buildroot} -type f -name '*.la' -print -delete
# HMAC checksums are generated during __spec_install_post.
%{_bindir}/find %{buildroot} -type f -name '*.hmac' -print -delete
# Remove 0-size files.
%{_bindir}/find %{buildroot} -type f -size 0 -print -delete
%if %{with doc}
2018-01-16 17:47:27 +00:00
# Make sure all docs have non-exec permissions, except for the dirs.
%{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \
%{_bindir}/xargs %{__chmod} -c 0644
%{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \
%{_bindir}/xargs %{__chmod} -c 0755
%endif
2018-01-16 17:47:27 +00:00
# Possibly save some space by hardlinking.
for d in %{_mandir} %{_pkgdocdir}; do
%{_bindir}/hardlink -cfv %{buildroot}$d
2018-01-16 17:47:27 +00:00
done
%check
# Some basic sanity checks.
%if %{with clang_sa}
%make_build scan
%endif
%if %{with cppcheck}
%make_build cppcheck
%endif
2018-01-16 17:47:27 +00:00
%if %{with test}
2018-01-16 17:47:27 +00:00
# On some arches `/proc/sys/net/core/optmem_max` is lower than 20480,
# which is the lowest limit needed to run the testsuite. If that limit
# is not met, we do not run it.
%if %{test_optmem_max} >= 20480
2019-08-13 12:58:56 +00:00
# Skip the testsuite on old kernels.
%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0
2018-01-16 17:47:27 +00:00
# Real testsuite.
pushd test
%if %{with fuzz_test}
2018-01-16 17:47:27 +00:00
ENABLE_FUZZ_TEST=1 \
%endif
2018-01-16 17:47:27 +00:00
NO_32BIT_TEST=1 \
./test-invocation.sh
popd
%endif
2019-08-13 12:58:56 +00:00
%endif
%endif
2018-01-16 17:47:27 +00:00
2018-02-04 12:43:23 +00:00
%ldconfig_scriptlets
2018-01-16 17:47:27 +00:00
%files
%doc %dir %{_pkgdocdir}
%doc %{_pkgdocdir}/README.md
%license COPYING*
/%{_lib}/%{name}.so.%{vmajor}
/%{_lib}/%{name}.so.%{version}
/%{_lib}/fipscheck/%{name}.so.%{vmajor}.hmac
/%{_lib}/fipscheck/%{name}.so.%{version}.hmac
%if %{with_sysctl_tweak}
%doc %{_pkgdocdir}/README.%{distroname_ext}
2018-01-16 17:47:27 +00:00
%{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf
%endif
2018-01-16 17:47:27 +00:00
%files devel
%doc %{_pkgdocdir}/CHANGES.md
2018-01-16 17:47:27 +00:00
%doc %{_pkgdocdir}/TODO
%{_includedir}/kcapi.h
%{_mandir}/man3/kcapi_*.3.*
/%{_lib}/%{name}.so
%{_libdir}/pkgconfig/%{name}.pc
%if %{with doc}
2018-01-16 17:47:27 +00:00
%files doc
%doc %{_pkgdocdir}/html
%doc %{_pkgdocdir}/%{name}.pdf
%doc %{_pkgdocdir}/%{name}.ps
%endif
2018-01-16 17:47:27 +00:00
%if %{with replace_coreutils}
%files checksum
2018-01-16 17:47:27 +00:00
%{_bindir}/md5sum
%{_bindir}/sha*sum
%{_bindir}/sm*sum
/%{_lib}/fipscheck/md5sum.hmac
/%{_lib}/fipscheck/sha*sum.hmac
/%{_lib}/fipscheck/sm*sum.hmac
2018-01-16 17:47:27 +00:00
%endif
2018-01-16 17:47:27 +00:00
%if %{with replace_fipscheck}
%files fipscheck
2018-01-16 17:47:27 +00:00
%{_bindir}/fips*
/%{_lib}/fipscheck/fips*.hmac
2018-01-16 17:47:27 +00:00
%endif
2018-01-16 17:47:27 +00:00
%if %{with replace_hmaccalc}
%files hmaccalc
2018-01-16 17:47:27 +00:00
%{_bindir}/sha*hmac
%{_bindir}/sm*hmac
/%{_lib}/hmaccalc/sha*hmac.hmac
/%{_lib}/hmaccalc/sm*hmac.hmac
2018-01-16 17:47:27 +00:00
%endif
%files static
/%{_lib}/%{name}.a
%files tools
%{_bindir}/kcapi*
%{_mandir}/man1/kcapi*.1.*
%if %{with test_package}
2018-08-07 15:38:32 +00:00
%files tests
%{_libexecdir}/%{name}/*
%endif
2018-08-07 15:38:32 +00:00
2018-01-16 17:47:27 +00:00
%changelog
2022-08-13 21:34:12 +00:00
%autochangelog