2009-07-28 10:27:44 +00:00
|
|
|
Name: opencryptoki
|
|
|
|
Summary: Implementation of the PKCS#11 (Cryptoki) specification v2.11
|
2012-02-27 12:14:18 +00:00
|
|
|
Version: 2.4.1
|
2011-07-07 12:44:04 +00:00
|
|
|
Release: 1%{?dist}
|
2009-07-28 10:27:44 +00:00
|
|
|
License: CPL
|
|
|
|
Group: System Environment/Base
|
|
|
|
URL: http://sourceforge.net/projects/opencryptoki
|
2009-08-07 14:16:03 +00:00
|
|
|
Source: http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz
|
2010-09-14 09:49:20 +00:00
|
|
|
# the pkcs11 group is created and populated in scriptlet
|
|
|
|
Patch0: %{name}-2.3.2-do-not-create-group-in-pkcs11_startup.patch
|
2012-02-27 12:14:18 +00:00
|
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=732756
|
|
|
|
Patch1: %{name}-2.4-group.patch
|
|
|
|
# convert from initscript to systemd unit
|
|
|
|
Patch2: %{name}-2.4.1-systemd.patch
|
2009-07-28 10:27:44 +00:00
|
|
|
Requires(pre): shadow-utils coreutils sed
|
2010-09-14 09:49:20 +00:00
|
|
|
BuildRequires: openssl-devel
|
|
|
|
BuildRequires: trousers-devel
|
2009-07-28 10:27:44 +00:00
|
|
|
BuildRequires: autoconf automake libtool
|
2012-02-27 12:14:18 +00:00
|
|
|
BuildRequires: systemd-units
|
2009-07-28 10:27:44 +00:00
|
|
|
%ifarch s390 s390x
|
2009-08-16 08:54:07 +00:00
|
|
|
BuildRequires: libica-devel >= 2.0
|
2009-07-28 10:27:44 +00:00
|
|
|
%endif
|
|
|
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
2012-02-27 12:14:18 +00:00
|
|
|
Requires(post): systemd-units
|
|
|
|
Requires(preun): systemd-units
|
|
|
|
Requires(postun): systemd-units
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%description
|
2010-09-14 09:49:20 +00:00
|
|
|
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
|
|
|
|
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
|
|
|
|
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
|
|
|
|
token implementation that can be used without any cryptographic
|
|
|
|
hardware.
|
|
|
|
This package contains the Slot Daemon (pkcsslotd) and general utilities.
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%package libs
|
|
|
|
Group: System Environment/Libraries
|
2010-09-14 09:49:20 +00:00
|
|
|
Summary: The run-time libraries for opencryptoki package
|
2010-11-09 08:58:22 +00:00
|
|
|
Obsoletes: %{name}-libs < 2.3.2
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%description libs
|
2010-09-14 09:49:20 +00:00
|
|
|
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
|
|
|
|
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
|
|
|
|
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
|
|
|
|
token implementation that can be used without any cryptographic
|
|
|
|
hardware.
|
|
|
|
This package contains the PKCS#11 library implementation, and requires
|
|
|
|
at least one token implementation (packaged separately) to be fully
|
|
|
|
functional.
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%package devel
|
|
|
|
Group: Development/Libraries
|
|
|
|
Summary: Development files for openCryptoki
|
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
|
|
|
|
|
%description devel
|
2010-09-14 09:49:20 +00:00
|
|
|
This package contains the development header files for building
|
|
|
|
opencryptoki and PKCS#11 based applications
|
|
|
|
|
|
|
|
|
|
|
|
%package swtok
|
|
|
|
Group: System Environment/Libraries
|
|
|
|
Summary: The software token implementation for opencryptoki
|
|
|
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
2010-11-09 08:58:22 +00:00
|
|
|
Obsoletes: %{name}-libs < 2.3.2
|
2010-09-14 09:49:20 +00:00
|
|
|
|
|
|
|
%description swtok
|
|
|
|
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
|
|
|
|
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
|
|
|
|
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
|
|
|
|
token implementation that can be used without any cryptographic
|
|
|
|
hardware.
|
|
|
|
This package brings the software token implementation to use opencryptoki
|
|
|
|
without any specific cryptographic hardware.
|
|
|
|
|
|
|
|
|
|
|
|
%package tpmtok
|
|
|
|
Group: System Environment/Libraries
|
|
|
|
Summary: Trusted Platform Module (TPM) device support for opencryptoki
|
|
|
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
2010-11-09 08:58:22 +00:00
|
|
|
Obsoletes: %{name}-libs < 2.3.2
|
2010-09-14 09:49:20 +00:00
|
|
|
|
|
|
|
%description tpmtok
|
|
|
|
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
|
|
|
|
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
|
|
|
|
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
|
|
|
|
token implementation that can be used without any cryptographic
|
|
|
|
hardware.
|
|
|
|
This package brings the necessary libraries and files to support
|
|
|
|
Trusted Platform Module (TPM) devices in the opencryptoki stack.
|
|
|
|
|
|
|
|
|
|
|
|
%ifarch s390 s390x
|
|
|
|
%package icatok
|
|
|
|
Group: System Environment/Libraries
|
|
|
|
Summary: ICA cryptographic devices (clear-key) support for opencryptoki
|
|
|
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
2010-11-09 08:58:22 +00:00
|
|
|
Obsoletes: %{name}-libs < 2.3.2
|
2010-09-14 09:49:20 +00:00
|
|
|
|
|
|
|
%description icatok
|
|
|
|
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
|
|
|
|
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
|
|
|
|
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
|
|
|
|
token implementation that can be used without any cryptographic
|
|
|
|
hardware.
|
|
|
|
This package brings the necessary libraries and files to support ICA
|
|
|
|
devices in the opencryptoki stack. ICA is an interface to IBM
|
|
|
|
cryptographic hardware such as IBM 4764 or 4765 that uses the
|
|
|
|
"accelerator" or "clear-key" path.
|
|
|
|
|
|
|
|
%package ccatok
|
|
|
|
Group: System Environment/Libraries
|
|
|
|
Summary: CCA cryptographic devices (secure-key) support for opencryptoki
|
|
|
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
2010-11-09 08:58:22 +00:00
|
|
|
Obsoletes: %{name}-libs < 2.3.2
|
2010-09-14 09:49:20 +00:00
|
|
|
|
|
|
|
%description ccatok
|
|
|
|
Opencryptoki implements the PKCS#11 specification v2.11 for a set of
|
|
|
|
cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
|
|
|
|
Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
|
|
|
|
token implementation that can be used without any cryptographic
|
|
|
|
hardware.
|
|
|
|
This package brings the necessary libraries and files to support CCA
|
|
|
|
devices in the opencryptoki stack. CCA is an interface to IBM
|
|
|
|
cryptographic hardware such as IBM 4764 or 4765 that uses the
|
|
|
|
"co-processor" or "secure-key" path.
|
|
|
|
%endif
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%prep
|
|
|
|
%setup -q
|
|
|
|
%patch0 -p1
|
2012-02-27 12:14:18 +00:00
|
|
|
%patch1 -p1 -b .group
|
|
|
|
%patch2 -p1 -b .systemd
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
# Upstream tarball has unnecessary executable perms set on the sources
|
|
|
|
find . -name '*.[ch]' -print0 | xargs -0 chmod -x
|
|
|
|
|
2010-09-14 09:49:20 +00:00
|
|
|
|
|
|
|
%build
|
2009-07-28 10:27:44 +00:00
|
|
|
./bootstrap.sh
|
2010-09-14 09:49:20 +00:00
|
|
|
|
2012-02-27 12:14:18 +00:00
|
|
|
%configure --with-systemdsystemunitdir=%{_unitdir} \
|
2010-06-29 08:19:03 +00:00
|
|
|
%ifarch s390 s390x
|
2010-09-14 09:49:20 +00:00
|
|
|
--enable-icatok --enable-ccatok
|
|
|
|
%else
|
|
|
|
--disable-icatok --disable-ccatok
|
2010-06-29 08:19:03 +00:00
|
|
|
%endif
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
make %{?_smp_mflags}
|
|
|
|
|
2010-09-14 09:49:20 +00:00
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
%install
|
|
|
|
make install DESTDIR=$RPM_BUILD_ROOT
|
|
|
|
|
|
|
|
# Remove unwanted cruft
|
|
|
|
rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/*.la
|
|
|
|
rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la
|
2010-09-14 09:49:20 +00:00
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%post libs -p /sbin/ldconfig
|
2010-09-14 09:49:20 +00:00
|
|
|
%post swtok -p /sbin/ldconfig
|
|
|
|
%post tpmtok -p /sbin/ldconfig
|
|
|
|
%ifarch s390 s390x
|
|
|
|
%post icatok -p /sbin/ldconfig
|
|
|
|
%post ccatok -p /sbin/ldconfig
|
|
|
|
%endif
|
|
|
|
|
|
|
|
%postun libs -p /sbin/ldconfig
|
|
|
|
%postun swtok -p /sbin/ldconfig
|
|
|
|
%postun tpmtok -p /sbin/ldconfig
|
|
|
|
%ifarch s390 s390x
|
|
|
|
%postun icatok -p /sbin/ldconfig
|
|
|
|
%postun ccatok -p /sbin/ldconfig
|
|
|
|
%endif
|
|
|
|
|
|
|
|
%pre
|
|
|
|
# Create pkcs11 group
|
|
|
|
getent group pkcs11 >/dev/null || groupadd -r pkcs11
|
|
|
|
# Add root to the pkcs11 group
|
|
|
|
gpasswd -a root pkcs11
|
2009-07-28 10:27:44 +00:00
|
|
|
exit 0
|
|
|
|
|
2012-02-27 12:14:18 +00:00
|
|
|
%post
|
|
|
|
if [ $1 -eq 1 ] ; then
|
|
|
|
# Initial installation
|
|
|
|
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
|
|
|
|
fi
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
%preun
|
2012-02-27 12:14:18 +00:00
|
|
|
if [ $1 -eq 0 ] ; then
|
|
|
|
# Package removal, not upgrade
|
|
|
|
/bin/systemctl --no-reload disable pkcsslotd.service > /dev/null 2>&1 || :
|
|
|
|
/bin/systemctl stop pkcsslotd.service > /dev/null 2>&1 || :
|
|
|
|
fi
|
|
|
|
|
|
|
|
%postun
|
|
|
|
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
|
|
|
|
if [ $1 -ge 1 ] ; then
|
|
|
|
# Package upgrade, not uninstall
|
|
|
|
/bin/systemctl try-restart pkcsslotd.service >/dev/null 2>&1 || :
|
2009-07-28 10:27:44 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
|
|
%files
|
2010-09-14 09:49:20 +00:00
|
|
|
%doc ChangeLog FAQ README
|
|
|
|
%doc doc/openCryptoki-HOWTO.pdf
|
2012-02-27 12:14:18 +00:00
|
|
|
%{_unitdir}/pkcsslotd.service
|
2009-07-28 10:27:44 +00:00
|
|
|
%{_sbindir}/*
|
|
|
|
%{_mandir}/man*/*
|
2010-09-14 09:49:20 +00:00
|
|
|
%{_libdir}/opencryptoki/methods
|
|
|
|
%{_libdir}/pkcs11/methods
|
2009-07-28 10:27:44 +00:00
|
|
|
%dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name}
|
|
|
|
|
|
|
|
%files libs
|
2010-07-08 11:31:05 +00:00
|
|
|
%doc LICENSE
|
2009-07-28 10:27:44 +00:00
|
|
|
%{_sysconfdir}/ld.so.conf.d/*
|
|
|
|
# Unversioned .so symlinks usually belong to -devel packages, but opencryptoki
|
|
|
|
# needs them in the main package, because:
|
|
|
|
# pkcs11_startup looks for opencryptoki/stdll/*.so, and
|
|
|
|
# documentation suggests that programs should dlopen "PKCS11_API.so".
|
2010-09-14 09:49:20 +00:00
|
|
|
%dir %{_libdir}/opencryptoki
|
|
|
|
%{_libdir}/opencryptoki/libopencryptoki.*
|
|
|
|
%{_libdir}/opencryptoki/PKCS11_API.so
|
|
|
|
%dir %{_libdir}/opencryptoki/stdll
|
|
|
|
%dir %{_libdir}/pkcs11
|
|
|
|
%{_libdir}/pkcs11/libopencryptoki.so
|
|
|
|
%{_libdir}/pkcs11/PKCS11_API.so
|
|
|
|
%{_libdir}/pkcs11/stdll
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%files devel
|
|
|
|
%{_includedir}/*
|
|
|
|
|
2010-09-14 09:49:20 +00:00
|
|
|
%files swtok
|
|
|
|
%{_libdir}/opencryptoki/stdll/libpkcs11_sw.*
|
|
|
|
%{_libdir}/opencryptoki/stdll/PKCS11_SW.so
|
|
|
|
|
|
|
|
%files tpmtok
|
|
|
|
%doc doc/README.tpm_stdll
|
|
|
|
%{_libdir}/opencryptoki/stdll/libpkcs11_tpm.*
|
|
|
|
%{_libdir}/opencryptoki/stdll/PKCS11_TPM.so
|
|
|
|
|
|
|
|
%ifarch s390 s390x
|
|
|
|
%files icatok
|
|
|
|
%{_libdir}/opencryptoki/stdll/libpkcs11_ica.*
|
|
|
|
%{_libdir}/opencryptoki/stdll/PKCS11_ICA.so
|
|
|
|
|
|
|
|
%files ccatok
|
|
|
|
%doc doc/README-IBM_CCA_users
|
|
|
|
%doc doc/README.cca_stdll
|
|
|
|
%{_libdir}/opencryptoki/stdll/libpkcs11_cca.*
|
|
|
|
%{_libdir}/opencryptoki/stdll/PKCS11_CCA.so
|
|
|
|
%endif
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
|
|
|
|
%changelog
|
2012-02-27 12:14:18 +00:00
|
|
|
* Sat Feb 25 2012 Dan Horák <dan[at]danny.cz> - 2.4.1-1
|
|
|
|
- new upstream release 2.4.1
|
|
|
|
- convert from initscript to systemd unit
|
|
|
|
- import fixes from RHEL-6 about root's group membership (#732756, #730903)
|
|
|
|
|
2011-07-07 12:44:04 +00:00
|
|
|
* Thu Jul 07 2011 Dan Horák <dan[at]danny.cz> - 2.4-1
|
|
|
|
- new upstream release 2.4
|
|
|
|
|
2011-02-09 03:06:11 +00:00
|
|
|
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3.3-2
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
|
|
|
|
|
2011-01-19 13:38:10 +00:00
|
|
|
* Mon Jan 17 2011 Dan Horák <dan[at]danny.cz> 2.3.3-1
|
|
|
|
- new upstream release 2.3.3
|
|
|
|
|
2010-11-09 08:58:22 +00:00
|
|
|
* Tue Nov 09 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.2-2
|
|
|
|
- Apply Obsoletes to package names, not provides.
|
|
|
|
|
2010-09-14 09:49:20 +00:00
|
|
|
* Tue Sep 14 2010 Dan Horák <dan[at]danny.cz> 2.3.2-1
|
|
|
|
- new upstream release 2.3.2
|
|
|
|
- put STDLLs in separate packages to match upstream package design
|
|
|
|
|
2010-07-08 11:31:05 +00:00
|
|
|
* Thu Jul 08 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-7
|
|
|
|
- Move the LICENSE file to the -libs subpackage.
|
|
|
|
|
2010-06-29 08:19:03 +00:00
|
|
|
* Tue Jun 29 2010 Dan Horák <dan[at]danny.cz> 2.3.1-6
|
|
|
|
- rebuilt with CCA enabled (#604287)
|
|
|
|
- fixed issues from #546274
|
|
|
|
|
2010-04-30 09:57:36 +00:00
|
|
|
* Fri Apr 30 2010 Dan Horák <dan[at]danny.cz> 2.3.1-5
|
|
|
|
- fixed one more issue in the initscript (#547324)
|
|
|
|
|
2010-04-27 08:05:17 +00:00
|
|
|
* Mon Apr 26 2010 Dan Horák <dan[at]danny.cz> 2.3.1-4
|
|
|
|
- fixed pidfile creating and usage (#547324)
|
|
|
|
|
2010-02-08 10:14:26 +00:00
|
|
|
* Mon Feb 08 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-3
|
|
|
|
- Also list 'reload' and 'force-reload' in "Usage: ...".
|
|
|
|
|
2010-02-08 09:12:29 +00:00
|
|
|
* Mon Feb 08 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-2
|
|
|
|
- Support 'force-reload' in the initscript.
|
|
|
|
|
2010-01-27 15:07:54 +00:00
|
|
|
* Wed Jan 27 2010 Michal Schmidt <mschmidt@redhat.com> 2.3.1-1
|
|
|
|
- New upstream release 2.3.1.
|
|
|
|
- opencryptoki-2.3.0-fix-nss-breakage.patch was merged.
|
|
|
|
|
2010-01-22 15:29:25 +00:00
|
|
|
* Fri Jan 22 2010 Dan Horák <dan[at]danny.cz> 2.3.0-5
|
|
|
|
- made pkcsslotd initscript LSB compliant (#522149)
|
|
|
|
|
2009-09-07 12:53:02 +00:00
|
|
|
* Mon Sep 07 2009 Michal Schmidt <mschmidt@redhat.com> 2.3.0-4
|
|
|
|
- Added opencryptoki-2.3.0-fix-nss-breakage.patch on upstream request.
|
|
|
|
|
2009-08-21 14:51:25 +00:00
|
|
|
* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 2.3.0-3
|
|
|
|
- rebuilt with new openssl
|
|
|
|
|
2009-08-16 08:54:07 +00:00
|
|
|
* Sun Aug 16 2009 Michal Schmidt <mschmidt@redhat.com> 2.3.0-2
|
|
|
|
- Require libica-2.0.
|
|
|
|
|
2009-08-07 14:16:03 +00:00
|
|
|
* Fri Aug 07 2009 Michal Schmidt <mschmidt@redhat.com> 2.3.0-1
|
|
|
|
- New upstream release 2.3.0:
|
|
|
|
- adds support for RSA 4096 bit keys in the ICA token.
|
|
|
|
|
2009-07-28 10:27:44 +00:00
|
|
|
* Tue Jul 21 2009 Michal Schmidt <mschmidt@redhat.com> - 2.2.8-5
|
|
|
|
- Require arch-specific dependency on -libs.
|
|
|
|
|
|
|
|
* Tue Jul 21 2009 Michal Schmidt <mschmidt@redhat.com> - 2.2.8-4
|
|
|
|
- Return support for crypto hw on s390.
|
|
|
|
- Renamed to opencryptoki.
|
|
|
|
- Simplified multilib by putting libs in subpackage as suggested by Dan Horák.
|
|
|
|
|
|
|
|
* Tue Jul 21 2009 Michal Schmidt <mschmidt@redhat.com> - 2.2.8-2
|
|
|
|
- Fedora package based on RHEL-5 package.
|