Accepting request 1325165 from security:chipcard

OBS-URL: https://build.opensuse.org/request/show/1325165
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/pcsc-lite?expand=0&rev=108

harden_pcscd.service.patch

@@ -1,22 +0,0 @@
-Index: pcsc-lite-1.9.4/etc/pcscd.service.in
-===================================================================
---- pcsc-lite-1.9.4.orig/etc/pcscd.service.in
-+++ pcsc-lite-1.9.4/etc/pcscd.service.in
-@@ -4,6 +4,17 @@ Requires=pcscd.socket
- Documentation=man:pcscd(8)
- 
- [Service]
-+# added automatically, for details please see
-+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
-+ProtectSystem=full
-+ProtectHome=true
-+ProtectHostname=true
-+ProtectKernelTunables=true
-+ProtectKernelModules=true
-+ProtectKernelLogs=true
-+ProtectControlGroups=true
-+RestrictRealtime=true
-+# end of automatic additions 
- Environment="PCSCD_OPTIONS="
- EnvironmentFile=-/etc/sysconfig/pcscd
- ExecStart=@sbindir_exp@/pcscd --foreground $PCSCD_OPTIONS

pcsc-lite-2.0.1.tar.bz2.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEE9eEbn/6REUb0HZU9eKG03+j5xX4FAmVg0D8ACgkQeKG03+j5
-xX7HkA//RPkUPl61xQ/XO499z4yGoIv0rbL4nRPbj/Ta1nSF8WCA5SwPcYWZWZRh
-eerKwciTzkrHn2hC04eJn344ISrEXoTHOnz3oYJz6YO0RCgxPiIdToN/6ykiKze1
-Usti5HVan//hHim6/UMd+O3Io8iOq27rKPSLDaQjP67D1b6MvrC6s5tIyT92KeWa
-sFM/eB8VbGl2sdVzAhoVYPrvvWSFwws2xMvamjUSDXCbJs/61K2kYM+LMcLvqubg
-NpVDHwz4zQ9O+tGD8KbuSfQ2nbjWjL2VGn1nf/xBa2+OkwRfIWRg3/tQF3af0wdJ
-qsTMxIZmuM63xfdPalyHrCysqyx0ceEX6gYbzGOgSEZnHu4cokNFsAepXEiBCWWF
-PnZzQYxkiIzgsUkrqLKMP92+fvI0vtUqwOlVQv187p7qvkGebyYr0cTHVd121TOP
-JdFlU+VqTGj+fD0Nu4cpKPw7OxSAMRAhSuSq0DfXjAUkYrIDWWReBENvOlVw0n9W
-uMZLaBABmT26Q+f3kP9pif5qQ1YGOt6m+bs7qDvogHhju0MPg8hyuSQT79k2axyY
-D9JJW1gotvRa7BqEParyGQhP9tLDphTNG7RLqcFAe1volMGQEcn+q4enuWr+L3lC
-cldYphIrQG9fvC1NSvDAIo5D6Lo7EiVvJYGkvccY0xfNWKLPDSQ=
-=s+PA
------END PGP SIGNATURE-----

pcsc-lite-2.3.3.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:cdff7d7153a0b37aa74e26dfec89ec7dc5c5286aa21b91b903e38739d227e8e7
+size 210592

pcsc-lite-2.3.3.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEE9eEbn/6REUb0HZU9eKG03+j5xX4FAmftXGEACgkQeKG03+j5
+xX7Cjg/+NdnJX841ymM9d4SMwusXEGYDEAaHyy7uNW2YBRUhSVw2P7/4WiOryL0i
+3jrTbLWvkEK/nIjPg4IO4/F9JEiBphCEcwjskJEBCs5R0v3lQZR9w6UrWrvuUpMV
+55XFZYcmk5oVUOs0Q1JlCG4H75yasDjDGeBoRpKKHR+dENnU3weS8KwvCfVZE6+j
+Ern3CkyQPavZbZntsxwdlAxDeUeUJCuF61psz6AiVmyX5ptsAhDOBO/3qFMxfUdD
+A9YB+UF4MQKqDif4PrdDLN47ikOymNfOxteTSqwXhVK7sQLeC2Xx7uZLMc6nkDmm
+oNhGB1cyfkLW5rKOoGp2V8KXUj5HYID4mztiqD/JaRBSNsRbkVP6Ir5pwPXmhGg/
+y6AU1R35PvFA6jDqu+iq3Latcke/I72GR+ta00jhWicC3zW9jjYSgvaV1fj4a+qu
+U6ZUAp+oFKPVOm1x60IDXzGKP5PALm5R7IGQAc3MJ9AVKGyqyXcmMiJ0UegPt50z
+wrOXHsy93NAaeykicjLy+c0wcO791/jZM2I2w3sT///5wrbMUMzgHeUmkzoGyx2T
+cEoh1el5zdMJVWHN+qfSNGfR2yZGfeyCcwN3Hpky+V4z7ni5soZez0lotVJht4aw
+iV+hB6IqtyjwMtbzYdrJpEM8QjASQQTvsHsdiHdS0sMWgP9xMjU=
+=UijW
+-----END PGP SIGNATURE-----

pcsc-lite.changes

@@ -1,3 +1,107 @@
+-------------------------------------------------------------------
+Fri Jan  2 13:12:49 UTC 2026 - Bernhard Wiedemann <bwiedemann@suse.com>
+
+- Add Provides for pcscd to increase Debian compatibility
+
+-------------------------------------------------------------------
+Wed Apr  2 16:52:44 UTC 2025 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.3.3
+  * Make polkit rules work again (bug introduced in 2.3.2)
+  * harden_pcscd.service.patch removed (went to upstream)
+  
+-------------------------------------------------------------------
+Wed Mar 26 16:38:17 UTC 2025 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.3.2
+  * Hardening systemd pcscd.service file
+  * pcscd.service: add missing Requires=polkit.service
+  * pcsc-spy: add missing PCSCv2_PART10_PROPERTY_* definitions
+  * Support udev PCSCLITE_IGNORE property to filter readers
+  * debuglog: force use of colors when --color is used
+  * Some other minor improvements
+
+-------------------------------------------------------------------
+Wed Jan 22 16:06:25 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Drop rcFOO symlinks for CODE16 (PED-266).
+
+-------------------------------------------------------------------
+Thu Dec 26 09:13:55 UTC 2024 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.3.1
+  * Install a default /etc/default/pcscd file
+  * auth.c: implement polkit support for FreeBSD
+  * meson:
+    . also build static version of libpcsclite
+    . add options to disable polkit and libsystemd
+    . add "filter_names" in features when needed
+  * Doxygen: document dwCurrentState use for "\\?PnP?\Notification"
+  * Some other minor improvements
+
+-------------------------------------------------------------------
+Sun Aug  4 05:00:35 UTC 2024 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.3.0
+  - SCardGetStatusChange(): add the number of reader events
+  - Add Appstream metainfo announcing HW support
+  - meson: specify minimum meson version to use
+  - fix formats under musl libc
+  - Send libpcsclite.so logs to stderr instead of stdout
+  - Some other minor improvements
+
+-------------------------------------------------------------------
+Fri Jun  7 10:15:11 UTC 2024 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.2.3
+  * switch to meson build system
+    . Fix build on Slackware 15
+    . fail if both libusb and libudev are used
+  - Fix memory leak on exit
+  - libpcscspy: dump an output buffer only if the call succeeded
+  - Some code cleanup
+  - Serial support is ENABLED by default
+  - fix meson related issues
+  - Some code cleanup
+  - provide files for meson build tool (replaces autoconf/auoomake)
+  - fix a missing symbol in libpcscspy (bug introduced by the previous version)
+  - fix shutdown issues with hotplug_libusb
+  - update pcsc-spy manpage
+  - update copyright date
+  - Some other minor improvements
+
+-------------------------------------------------------------------
+Tue Apr 23 08:15:56 UTC 2024 - Stephan Hemeier <Sauerlandlinux@gmx.de>
+
+- Update the spec for building with version 2.1.0
+
+-------------------------------------------------------------------
+Mon Apr 22 12:14:47 UTC 2024 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.1.0
+  * LIBPCSCLITE_DELEGATE is used to redirect to another libpcsclite library
+  * setup_spy.sh displays the LIBPCSCLITE_DELEGATE value to use for spying
+  * provides libfake.c as a sample source code
+  * Some other minor improvements- 
+
+-------------------------------------------------------------------
+Wed Mar 13 14:52:38 UTC 2024 - pgajdos@suse.com
+
+- remove dependency on /usr/bin/python3 using                            
+  %python3_fix_shebang macro, [bsc#1212476]
+
+-------------------------------------------------------------------
+Mon Mar  4 08:56:11 UTC 2024 - Axel Braun <axel.braun@gmx.de>
+
+- version 2.0.3
+  * add SCARD_E_UNKNOWN_RES_MNG back
+  * SCardConnect() & SCardReconnect(): restrict the protocol used
+  * negotiate PTS also for the backup protocol
+  * pcscd.8:
+   . document --disable-polkit
+   . add "CONFIGURATION FILE" section
+  * Some other minor improvements
+
 -------------------------------------------------------------------
 Thu Feb 29 15:01:39 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
 

pcsc-lite.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package pcsc-lite
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -26,35 +26,40 @@
 %define PKG_USER	scard
 %define PKG_GROUP	scard
 Name:           pcsc-lite
-Version:        2.0.1
+Version:        2.3.3
 Release:        0
 Summary:        PC/SC Smart Cards Library
 License:        BSD-3-Clause AND GPL-3.0-or-later
 Group:          Productivity/Security
 URL:            https://pcsclite.apdu.fr/
-Source:         https://pcsclite.apdu.fr/files/%{name}-%{version}.tar.bz2
+Source:         https://pcsclite.apdu.fr/files/%{name}-%{version}.tar.xz
 Source1:        %{name}.sysconfig
 Source2:        README.SUSE
 Source4:        baselibs.conf
 Source6:        pcsc-lite-reader-conf
-Source7:        https://pcsclite.apdu.fr/files/%{name}-%{version}.tar.bz2.asc
+Source7:        https://pcsclite.apdu.fr/files/%{name}-%{version}.tar.xz.asc
 Source8:        %{name}.keyring
 Source9:        %{name}.sysusers
 Patch0:         systemd-service.patch
-Patch1:         harden_pcscd.service.patch
+BuildRequires:  cmake
 BuildRequires:  flex
 BuildRequires:  gcc
 BuildRequires:  libtool
+BuildRequires:  meson
 BuildRequires:  pkgconfig
 BuildRequires:  readline-devel
 BuildRequires:  sysuser-tools
+## BuildRequires:  systemd-devel
+BuildRequires:  xz
 BuildRequires:  pkgconfig(libsystemd)
+BuildRequires:  pkgconfig(systemd)
 Requires:       libpcsclite1 = %{version}
 Requires(post): %fillup_prereq
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  polkit-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  pkgconfig(libudev)
+Provides:       pcscd
 %{?systemd_requires}
 %sysusers_requires
 
@@ -110,36 +115,40 @@ This package contains the development files for pcsc-lite. It allows to
 compile plugins for the pcsc-lite package.
 
 %prep
-%setup -q
-%patch -P 0 -p1
+%autosetup -p1
+#%%patch -P 0 -p1
 cp -a %{SOURCE1} %{SOURCE2} %{SOURCE6} .
-%patch -P 1 -p1
 
 %build
 %sysusers_generate_pre %{SOURCE9} %{PKG_USER} %{PKG_USER}.conf
-%configure \
-	--disable-silent-rules \
-	--docdir=%{_docdir}/%{name} \
-	--enable-usbdropdir=%{ifddir} \
-	--with-systemdsystemunitdir=%{_unitdir} \
-	--enable-polkit \
-	--enable-filter \
-	--disable-static
-	make %{?_smp_mflags}
+%meson \
+       -D usbdropdir=%{ifddir} \
+       -D polkit=TRUE \
+       -D libsystemd=TRUE \
+       -D systemdunit=system
+
+%meson_build %{?_smp_mflags}
 
 %install
-%make_install
+%meson_install
 mkdir -p %{buildroot}%{ifddir}
 mkdir -p %{buildroot}%{_sysconfdir}/reader.conf.d/
 sed s:@ifddir@:%{ifddir}: <pcsc-lite-reader-conf >%{buildroot}%{_sysconfdir}/reader.conf.d/reader.conf
+%if 0%{?suse_version} < 1600
 ln -s %{_sbindir}/service %{buildroot}%{_sbindir}/rcpcscd
+%endif
 mkdir -p %{buildroot}%{_fillupdir}
 cp %{name}.sysconfig %{buildroot}%{_fillupdir}/sysconfig.pcscd
 mkdir -p %{buildroot}%{_docdir}/%{name}
-cp -a AUTHORS ChangeLog COPYING HELP NEWS README README.SUSE SECURITY TODO %{buildroot}%{_docdir}/%{name}
+cp -a AUTHORS ChangeLog COPYING HELP NEWS README README.SUSE SECURITY %{buildroot}%{_docdir}/%{name}
+mv %{buildroot}/usr/share/doc/%{name}/* %{buildroot}%{_docdir}/%{name}
+rm -d %{buildroot}/usr/share/doc/%{name}
+mkdir -p %{buildroot}%{_sysconfdir}/default
 # Remove useless la files
 find %{buildroot} -type f -name "*.la" -delete -print
+find %{buildroot} -type f -name "*.a" -delete -print
 install -Dm0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/%{PKG_USER}.conf
+%python3_fix_shebang
 
 %pre -f %{PKG_USER}.pre
 %service_add_pre pcscd.service pcscd.socket
@@ -166,32 +175,33 @@ install -Dm0644 %{SOURCE9} %{buildroot}%{_sysusersdir}/%{PKG_USER}.conf
 %defattr(-,root,root)
 %docdir %{_docdir}/%{name}
 %dir %{_docdir}/%{name}
+%{_docdir}/%{name}/setup_spy.sh
 %{_docdir}/%{name}/AUTHORS
 %{_docdir}/%{name}/COPYING
 %{_docdir}/%{name}/HELP
 %{_docdir}/%{name}/NEWS
 %{_docdir}/%{name}/README
 %{_docdir}/%{name}/README.SUSE
-%{_docdir}/%{name}/README.polkit
 %{_docdir}/%{name}/SECURITY
-%{_docdir}/%{name}/TODO
-%{_docdir}/%{name}/install_spy.sh
-%{_docdir}/%{name}/uninstall_spy.sh
 %doc %{_mandir}/man?/*.*
 %{_sbindir}/*
 %dir %{_sysconfdir}/reader.conf.d
 %config(noreplace) %{_sysconfdir}/reader.conf.d/reader.conf
+%{_sysconfdir}/default/pcscd
 %{ifddir}
-%{_unitdir}/*
+%{_unitdir}/pcsc*
 %{_sysusersdir}/%{PKG_USER}.conf
 %{_fillupdir}/sysconfig.pcscd
 # libpcsclite.so should stay in the main package (#732911). Third party packages may need it for dlopen().
 %{_libdir}/libpcsclite.so
+%{_libdir}/libpcsclite_real.so
 %{_datadir}/polkit-1/actions/org.debian.pcsc-lite.policy
+%{_datadir}/metainfo/fr.apdu.pcsclite.metainfo.xml
 
 %files -n libpcsclite1
 %defattr(-,root,root)
 %{_libdir}/libpcsclite.so.*
+%{_libdir}/libpcsclite_real.so.*
 
 %files -n libpcscspy0
 %defattr(-,root,root)

systemd-service.patch

@@ -1,8 +1,7 @@
-diff --git a/etc/pcscd.service.in b/etc/pcscd.service.in
-index 65ad6a6..f0929cd 100644
---- a/etc/pcscd.service.in
-+++ b/etc/pcscd.service.in
-@@ -4,9 +4,10 @@ Requires=pcscd.socket
+diff -rU 3 a/etc/pcscd.service.in b/etc/pcscd.service.in
+--- a/etc/pcscd.service.in	2025-03-26 15:52:29.000000000 +0100
++++ b/etc/pcscd.service.in	2025-03-27 09:55:27.046044040 +0100
+@@ -5,9 +5,10 @@
  Documentation=man:pcscd(8)
  
  [Service]
@@ -13,5 +12,5 @@ index 65ad6a6..f0929cd 100644
  ExecReload=@sbindir_exp@/pcscd --hotplug
 -EnvironmentFile=-@sysconfdir@/default/pcscd
  
- [Install]
- Also=pcscd.socket
+ # Paths
+ ProtectProc=invisible