Jeff Mahoney
9b25021947
- Update to upstream 0.6.4-2: * Reset nanny when client connection failed. (#1780) * Fix artifacts that use yara parameters to specify yara type (#1779) * Update release for bugfixes 0.6.4-2 * Add update to ADSHunter for better output on complete system hunts (#28) (#1765) * SysmonInstall artifact now skips install if not needed (#1777) * Initial implementation of client side process tracker. (#1768) * Invalidate transformed cache when the base table changes. (#1742) * GUI Table widgets now can apply transformations on the table. (#1740) * Suppress warning message for offline collector (#1776) * Bug fix (#1774) * Avoid bash process lingering around while server is running (#1775) * oidc: Fix typo: Genric -> Generic (#1773) * Make MaxWait for event table settable. (#1772) * Fixed bug in Windows.Detection.Yara.Process (#1771) * fix: upgrade react-scripts from 5.0.0 to 5.0.1 (#1770) * Bugfix: Client did not update list of query columns (#1767) * Merge bugfixes from master branch. (#1769) - Revendored dependencies. - Update to version 0.6.4~git31.4298eab0: * Add artifact for chattrsnoop plugin * bpflib: ensure it's built only on linux and when requesting bpf * Add chattrsnoop plugin * tcpsnoop: Properly close module in case of attach error * Elastic.Events.Client: Update to use new artifactset type * Kafka.Events.Client: Update to use new artifactset type * artifacts: add artifactset parameter type * api: add type and description fields to v1/GetArtifacts endpoint * Add artifacts for dns/tcp snoop plugins OBS-URL: https://build.opensuse.org/request/show/976934 OBS-URL: https://build.opensuse.org/package/show/security:sensor/velociraptor?expand=0&rev=17
112 lines
3.6 KiB
RPMSpec
112 lines
3.6 KiB
RPMSpec
#
|
|
# spec file for package velociraptor
|
|
#
|
|
# Copyright (c) 2021 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
%define projname velociraptor
|
|
%define vendor_version 0.6.4.2~git31.e1b7fc0e
|
|
|
|
Name: velociraptor-client
|
|
Version: 0.6.4.2~git31.e1b7fc0e
|
|
Release: 0
|
|
Summary: Endpoint visibility and collection tool (endpoint only)
|
|
|
|
# FIXME: Select a correct license from https://github.com/openSUSE/spec-cleaner#spdx-licenses
|
|
License: AGPL-3.0-only
|
|
URL: https://github.com/Velocidex/velociraptor
|
|
Source: %{projname}-%{version}.tar.xz
|
|
Source1: vendor-golang-%{vendor_version}.tar.xz
|
|
Source2: %{name}.service
|
|
Source3: %{name}.config.placeholder
|
|
Patch1: velociraptor-golang-mage-vendoring.diff
|
|
Patch2: velociraptor-skip-git-submodule-import-for-OBS-build.patch
|
|
Patch3: velociraptor-makefile-add-bpf-rules-to-linux_bare.patch
|
|
Patch4: make-libbpfgo-vendorable.patch
|
|
BuildRequires: golang-packaging
|
|
BuildRequires: systemd-rpm-macros
|
|
BuildRequires: systemd-devel
|
|
BuildRequires: golang(API) >= 1.14
|
|
BuildRequires: fileb0x
|
|
BuildRequires: mage
|
|
BuildRequires: libtsan0
|
|
BuildRequires: clang13
|
|
BuildRequires: llvm13
|
|
BuildRequires: bpftool
|
|
BuildRequires: libelf-devel
|
|
Conflicts: velociraptor
|
|
|
|
%description
|
|
Velociraptor is a tool for collecting host based state information
|
|
using The Velociraptor Query Language (VQL) queries.
|
|
|
|
To learn more about Velociraptor, read the documentation on:
|
|
|
|
https://docs.velociraptor.app/
|
|
|
|
This package contains only the endpoint agent. For the full console, please
|
|
install the 'velociraptor' package.
|
|
|
|
|
|
%prep
|
|
%setup -q -a 1 -n %{projname}-%{version}
|
|
%autopatch -p1
|
|
|
|
# Without this, the libbpfgo tests want to vendor the external version
|
|
rm -rf third_party/libbpfgo/selftest third_party/libbpfgo/helpers/example_tracelisten_test.go
|
|
|
|
# Set the version to something more specific than <next-tag>-dev
|
|
sed -ie "s/\(VERSION *= \).*/\1 \"%{version}\"/" constants/constants.go
|
|
|
|
# These just clutter the GUI and we don't have Windows clients
|
|
# Note: There are dependencies on these that need to be resolved before
|
|
# removing them outright.
|
|
# rm -rf artifacts/definitions/Windows
|
|
|
|
%build
|
|
PATH=$PATH:/usr/sbin make linux_bare
|
|
|
|
%install
|
|
mkdir -p %buildroot/%{_bindir}
|
|
mkdir -p %buildroot/%{_sysconfdir}/velociraptor
|
|
mkdir -p %buildroot/%{_unitdir}
|
|
mkdir -p %buildroot/%{_sharedstatedir}/velociraptor-client
|
|
install -m 0755 output/velociraptor-v%{version}-linux-* %buildroot/%{_bindir}/velociraptor
|
|
install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/%{name}.service
|
|
install -m 0600 %{SOURCE3} %{buildroot}%{_sysconfdir}/velociraptor/client.config
|
|
|
|
%files
|
|
%defattr(-,root,root)
|
|
%license LICENSE
|
|
%doc README.md
|
|
%dir %{_sysconfdir}/velociraptor
|
|
%{_bindir}/velociraptor
|
|
%config(noreplace) %{_sysconfdir}/velociraptor/client.config
|
|
%{_unitdir}/%{name}.service
|
|
%dir %{_sharedstatedir}/velociraptor-client
|
|
|
|
%pre
|
|
%service_add_pre %{name}.service
|
|
|
|
%post
|
|
%service_add_post %{name}.service
|
|
|
|
%preun
|
|
%service_del_preun %{name}.service
|
|
|
|
%postun
|
|
%service_del_postun %{name}.service
|
|
|
|
%changelog
|