pool/rust-keylime
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
rust-keylime/rust-keylime.spec

124 lines
4.1 KiB
RPMSpec
Raw Normal View History

Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
#
# spec file for package rust-keylime
#
Accepting request 959504 from home:aplanas:branches:security - Add work_dir directory in /var/lib/keylime - Add subpackage rust-keylime-python to execute revocation payload in Python OBS-URL: https://build.opensuse.org/request/show/959504 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=11
2022-03-04 17:16:17 +00:00
# Copyright (c) 2022 SUSE LLC
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%global rustflags '-Clink-arg=-Wl,-z,relro,-z,now'
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
# Consolidate _distconfdir and _sysconfdir
%if 0%{?_distconfdir:1}
%define _config_norepl %{nil}
%else
%define _distconfdir %{_sysconfdir}
%define _config_norepl %config(noreplace)
%endif
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
Name: rust-keylime
Accepting request 994355 from home:aplanas:branches:security - Update to version 0.1.0+git.1659977521.0186093: * Fix display of mb measurement file path * Add more helpful error when config file is not found * Fix small comment about implementing TPM ownership * main: die when cannot drop privileges * keylime.conf: add run_as section * Use Rust agent-specific config in Makefile * Fix typo in listen_notifications option in keylime.conf * tpm: Support pre-existing EK * Set swtpm context which is later used for test filtering * Add GitLeaks configuration to ignore RSA key used for testing * Handle whitespace in keylime.conf - Rename keylime.conf to keylime-agent.conf - Drop 0001-main-die-when-cannot-drop-privileges.patch, as is already merged upstream - Add bindgen.patch to add more architectures OBS-URL: https://build.opensuse.org/request/show/994355 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=23
2022-08-10 15:04:54 +00:00
Version: 0.1.0+git.1659977521.0186093
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
Release: 0
Summary: Rust implementation of the keylime agent
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
License: Apache-2.0 AND MIT
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
URL: https://github.com/keylime/rust-keylime
Source: rust-keylime-%{version}.tar.xz
Source1: vendor.tar.xz
Source2: cargo_config
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
Source3: keylime.xml
Source4: keylime-user.conf
Source5: tmpfiles.keylime
Accepting request 994355 from home:aplanas:branches:security - Update to version 0.1.0+git.1659977521.0186093: * Fix display of mb measurement file path * Add more helpful error when config file is not found * Fix small comment about implementing TPM ownership * main: die when cannot drop privileges * keylime.conf: add run_as section * Use Rust agent-specific config in Makefile * Fix typo in listen_notifications option in keylime.conf * tpm: Support pre-existing EK * Set swtpm context which is later used for test filtering * Add GitLeaks configuration to ignore RSA key used for testing * Handle whitespace in keylime.conf - Rename keylime.conf to keylime-agent.conf - Drop 0001-main-die-when-cannot-drop-privileges.patch, as is already merged upstream - Add bindgen.patch to add more architectures OBS-URL: https://build.opensuse.org/request/show/994355 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=23
2022-08-10 15:04:54 +00:00
# PATCH-FIX-OPENSUSE keylime-agent.conf.diff
Patch1: keylime-agent.conf.diff
# PATCH-FIX-OPENSUSE bindgen.patch
Patch2: bindgen.patch
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
BuildRequires: cargo
Accepting request 994355 from home:aplanas:branches:security - Update to version 0.1.0+git.1659977521.0186093: * Fix display of mb measurement file path * Add more helpful error when config file is not found * Fix small comment about implementing TPM ownership * main: die when cannot drop privileges * keylime.conf: add run_as section * Use Rust agent-specific config in Makefile * Fix typo in listen_notifications option in keylime.conf * tpm: Support pre-existing EK * Set swtpm context which is later used for test filtering * Add GitLeaks configuration to ignore RSA key used for testing * Handle whitespace in keylime.conf - Rename keylime.conf to keylime-agent.conf - Drop 0001-main-die-when-cannot-drop-privileges.patch, as is already merged upstream - Add bindgen.patch to add more architectures OBS-URL: https://build.opensuse.org/request/show/994355 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=23
2022-08-10 15:04:54 +00:00
BuildRequires: clang
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
BuildRequires: firewall-macros
BuildRequires: libarchive-devel
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
BuildRequires: rust
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
BuildRequires: sysuser-tools
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
BuildRequires: tpm2-0-tss-devel
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
BuildRequires: zeromq-devel
Accepting request 984413 from home:aplanas:branches:security - Update to version 0.1.0+git.1655384301.b834667: * Update fmf plans to run test with IMA policy * .github/dependabot.yml: prevent updates that require manifest change - Add logrotate configuration for the agent service - Requires libtss2-tcti-device0 to interact with the real device - Drop legacy Python subpackage and feature - Move conflicts into the Python version - Drop CFSSL port from the keylime.xml firewalld rules OBS-URL: https://build.opensuse.org/request/show/984413 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=15
2022-06-22 09:04:26 +00:00
Requires: libtss2-tcti-device0
Requires: logrotate
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
Requires: tpm2.0-abrmd
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
%description
Rust implementation of keylime agent. Keylime is system integrity
monitoring system.
%prep
Accepting request 933782 from home:aplanas:branches:security - Conflict with keylime-agent, keylime-config and keylime-firewalld - Add keylime_ima_emulator tool - Add patch add_property_tag_variant_for_maxcapbuffer.patch OBS-URL: https://build.opensuse.org/request/show/933782 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=6
2021-11-25 15:22:45 +00:00
%autosetup -a1 -p1
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
mkdir .cargo
cp %{SOURCE2} .cargo/config
%build
Accepting request 984413 from home:aplanas:branches:security - Update to version 0.1.0+git.1655384301.b834667: * Update fmf plans to run test with IMA policy * .github/dependabot.yml: prevent updates that require manifest change - Add logrotate configuration for the agent service - Requires libtss2-tcti-device0 to interact with the real device - Drop legacy Python subpackage and feature - Move conflicts into the Python version - Drop CFSSL port from the keylime.xml firewalld rules OBS-URL: https://build.opensuse.org/request/show/984413 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=15
2022-06-22 09:04:26 +00:00
RUSTFLAGS=%{rustflags} cargo build --release --no-default-features --features "with-zmq"
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%sysusers_generate_pre %{SOURCE4} keylime keylime-user.conf
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
%install
Accepting request 984453 from home:aplanas:branches:security Installation with the same build features OBS-URL: https://build.opensuse.org/request/show/984453 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=16
2022-06-22 11:05:42 +00:00
RUSTFLAGS=%{rustflags} cargo install --frozen --no-default-features --features "with-zmq" --root=%{buildroot}%{_prefix} --path .
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
# TODO: move the configuration file into _distconfdir
Accepting request 994355 from home:aplanas:branches:security - Update to version 0.1.0+git.1659977521.0186093: * Fix display of mb measurement file path * Add more helpful error when config file is not found * Fix small comment about implementing TPM ownership * main: die when cannot drop privileges * keylime.conf: add run_as section * Use Rust agent-specific config in Makefile * Fix typo in listen_notifications option in keylime.conf * tpm: Support pre-existing EK * Set swtpm context which is later used for test filtering * Add GitLeaks configuration to ignore RSA key used for testing * Handle whitespace in keylime.conf - Rename keylime.conf to keylime-agent.conf - Drop 0001-main-die-when-cannot-drop-privileges.patch, as is already merged upstream - Add bindgen.patch to add more architectures OBS-URL: https://build.opensuse.org/request/show/994355 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=23
2022-08-10 15:04:54 +00:00
install -Dpm 0600 keylime-agent.conf %{buildroot}%{_sysconfdir}/keylime-agent.conf
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
install -Dpm 0644 ./dist/systemd/system/keylime_agent.service %{buildroot}%{_unitdir}/keylime_agent.service
install -Dpm 0644 ./dist/systemd/system/var-lib-keylime-secure.mount %{buildroot}%{_unitdir}/var-lib-keylime-secure.mount
install -Dpm 0644 %{SOURCE3} %{buildroot}%{_prefix}/lib/firewalld/services/keylime.xml
install -Dpm 0644 %{SOURCE4} %{buildroot}%{_sysusersdir}/keylime-user.conf
install -Dpm 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/keylime.conf
Accepting request 984413 from home:aplanas:branches:security - Update to version 0.1.0+git.1655384301.b834667: * Update fmf plans to run test with IMA policy * .github/dependabot.yml: prevent updates that require manifest change - Add logrotate configuration for the agent service - Requires libtss2-tcti-device0 to interact with the real device - Drop legacy Python subpackage and feature - Move conflicts into the Python version - Drop CFSSL port from the keylime.xml firewalld rules OBS-URL: https://build.opensuse.org/request/show/984413 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=15
2022-06-22 09:04:26 +00:00
install -d %{buildroot}%{_localstatedir}/log/keylime
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
install -d %{buildroot}%{_libexecdir}/keylime
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
Accepting request 959504 from home:aplanas:branches:security - Add work_dir directory in /var/lib/keylime - Add subpackage rust-keylime-python to execute revocation payload in Python OBS-URL: https://build.opensuse.org/request/show/959504 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=11
2022-03-04 17:16:17 +00:00
# Create work directory
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
mkdir -p %{buildroot}%{_sharedstatedir}/keylime
Accepting request 959504 from home:aplanas:branches:security - Add work_dir directory in /var/lib/keylime - Add subpackage rust-keylime-python to execute revocation payload in Python OBS-URL: https://build.opensuse.org/request/show/959504 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=11
2022-03-04 17:16:17 +00:00
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
rm %{buildroot}%{_prefix}/.crates.toml
rm %{buildroot}%{_prefix}/.crates2.json
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%pre
%service_add_pre keylime_agent.service
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%service_add_pre var-lib-keylime-secure.mount
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%post
%firewalld_reload
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%tmpfiles_create keylime.conf
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%service_add_post keylime_agent.service
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%service_add_post var-lib-keylime-secure.mount
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%preun
%service_del_preun keylime_agent.service
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%service_del_preun var-lib-keylime-secure.mount
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%postun
%service_del_postun keylime_agent.service
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%service_del_postun var-lib-keylime-secure.mount
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
%files
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%doc README.md
%license LICENSE
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
%{_bindir}/keylime_agent
Accepting request 933782 from home:aplanas:branches:security - Conflict with keylime-agent, keylime-config and keylime-firewalld - Add keylime_ima_emulator tool - Add patch add_property_tag_variant_for_maxcapbuffer.patch OBS-URL: https://build.opensuse.org/request/show/933782 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=6
2021-11-25 15:22:45 +00:00
%{_bindir}/keylime_ima_emulator
Accepting request 994355 from home:aplanas:branches:security - Update to version 0.1.0+git.1659977521.0186093: * Fix display of mb measurement file path * Add more helpful error when config file is not found * Fix small comment about implementing TPM ownership * main: die when cannot drop privileges * keylime.conf: add run_as section * Use Rust agent-specific config in Makefile * Fix typo in listen_notifications option in keylime.conf * tpm: Support pre-existing EK * Set swtpm context which is later used for test filtering * Add GitLeaks configuration to ignore RSA key used for testing * Handle whitespace in keylime.conf - Rename keylime.conf to keylime-agent.conf - Drop 0001-main-die-when-cannot-drop-privileges.patch, as is already merged upstream - Add bindgen.patch to add more architectures OBS-URL: https://build.opensuse.org/request/show/994355 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=23
2022-08-10 15:04:54 +00:00
%config(noreplace) %attr (0600,keylime,tss) %{_sysconfdir}/keylime-agent.conf
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%{_unitdir}/keylime_agent.service
%{_unitdir}/var-lib-keylime-secure.mount
Accepting request 908894 from home:aplanas:branches:security - Add generate-cargo-lock-file.patch to fix the build system in OBS - Add keylime.conf.diff to adjust the default config file - Adjust build requirements - Add firewalld XML rules - Add systemd keylime_agent.service - Fix license tag - Update to version 0.0.1+git.1626706730.a009476: * libarchive-devel is needed to build on Fedora * Accept sets of U and V keys; use new Key types * Output mask info * Fix for race condition bug * Do not resend pubkey to CV after attestation * Run payload script from a shell * Write out data and run payload * Decrypt payload after key handlers find symm key * Add handler for U and V keys * Add helper functions for handling U and V keys * Some TPM fixes for IMA PCR validation * Do not flush AK context as this causes an error * Fix bug in revocation service * Drop references to vmask * Better documentation of consts * Do not fail if EK cert is not present in TPM NV * Add more verbose logging to better match Python agent * Remove verify stub as we are not using it * tests: Don't pass --allow-signing to swtpm_setup * Fix typos * Add dependency for libzmq3-dev / zeromq-devel * Fix new clippy lints * Add handling for Identity and Integrity quotes * Add Quote functionality * Add marshaling functions for TPM structs OBS-URL: https://build.opensuse.org/request/show/908894 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=3
2021-07-28 13:39:06 +00:00
%dir %{_prefix}/lib/firewalld
%dir %{_prefix}/lib/firewalld/services
%{_prefix}/lib/firewalld/services/keylime.xml
Accepting request 989445 from home:aplanas:branches:security - Update to version 0.1.0+git.1657303637.5b9072a: * keys_handler: Use scopes to drop mutexes before await * Enable usage of Rust IMA emulator in E2E tests. * ima_emulator: Support PCR hash algorithms other than SHA-1 * ima_entry: add IMA entry parser ported from Python Keylime * algorithms: Add conversion between our hash algorithms and OpenSSL's * Remove unused functions revocation_ip_get and revocation_port_get. Change String to &str. * Adjust function usage comments to account for new parameters. * Load config file less at startup in src/common.rs * GNUmakefile: Make target dependencies explicit * permissions: Set supplementary groups when dropping privileges * main: Use more descriptive message for missing files error * Show path when fail to load the certificate * tpm: Add serialization functions for structures in quotes - Requires tpm2.0-abrmd dependency, as the kernel resource manager could be not enough - Downgrade /var/run/keylime permissions - Set "run_as" parameter to "keylime:tss" - Create the keylime user via systemd - Fix keylime service home directory OBS-URL: https://build.opensuse.org/request/show/989445 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=20
2022-07-15 13:19:45 +00:00
%{_sysusersdir}/keylime-user.conf
%{_tmpfilesdir}/keylime.conf
%dir %attr(0750,keylime,tss) %{_localstatedir}/log/keylime
%dir %attr(0750,keylime,tss) %{_libexecdir}/keylime
%dir %attr(0700,keylime,tss) %{_sharedstatedir}/keylime
Accepting request 959504 from home:aplanas:branches:security - Add work_dir directory in /var/lib/keylime - Add subpackage rust-keylime-python to execute revocation payload in Python OBS-URL: https://build.opensuse.org/request/show/959504 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=11
2022-03-04 17:16:17 +00:00
Accepting request 890792 from home:aplanas:keylime Alternative keylime-agent written in Rust. This is a WIP software fetched from git (see _service). Seems that this will replace the keylime agent written in Python in some future. If accepted, I would like to be co-maintainer, as this will change for a long time until it reach a stable release. OBS-URL: https://build.opensuse.org/request/show/890792 OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=1
2021-05-06 15:06:32 +00:00
%changelog
Reference in New Issue Copy Permalink