forked from pool/rust-keylime
Alberto Planas Dominguez
bb63965416
* dist: Enable logging for keylime library in the service
* Bump version to 0.2.7
* scripts: Download coverage data from Testing Farm directly
* main: Remove unnecessary lifetime
* cargo: Bump pretty_env_logger to version 0.5.0
* scripts: Fix regex in download_packit_coverage.sh
* cargo: Bump clap crate to version 4.5.23
* cargo: Bump base64 crate to version 0.22.1
* build(deps): bump log from 0.4.22 to 0.4.25
* build(deps): bump serde_json from 1.0.133 to 1.0.135
* cargo: Bump tokio crate to version 1.42.0
* packit: Fix RPM builds on copr
* cargo: Bump thiserror crate to version 0.2.9
* cargo: Update reqwest to version 0.12.12
* build(deps): bump libc from 0.2.168 to 0.2.169
* build(deps): bump glob from 0.3.1 to 0.3.2
* version: Implement API version validation and ordering
* main: Support using multiple API versions for registration
* keylime: Introduce the registrar_client module
* Provide endpoints under multiple API versions
* Move 'serialization' module to the keylime library
* Drop unnecessary dependency on common::API_VERSION
* keylime-agent.conf: Bump version to 2.3
* build(deps): bump serde from 1.0.210 to 1.0.217
* build(deps): bump pest_derive from 2.7.14 to 2.7.15
* build(deps): bump pest from 2.7.14 to 2.7.15
* build(deps): bump libc from 0.2.167 to 0.2.168
* config: Make IAK and IDevID certificates optional
* Fix warnings reported by clippy
* workflows: Run job in the CI container directly
* tests: Add unit test for device ID builder
* main: Move IAK/IDevID related code to dedicated module
* tests: Add script to generate IAK and IDevID certificates
* build(deps): bump openssl from 0.10.66 to 0.10.68
* build(deps): bump uuid from 1.10.0 to 1.11.0
* build(deps): bump serde_json from 1.0.128 to 1.0.133
* build(deps): bump actix-web from 4.5.1 to 4.9.0
* build(deps): bump reqwest from 0.12.7 to 0.12.9
* tests/setup_swtpm.sh: Add script to setup temporary TPM
* Use a single TPM context and avoid race conditions during tests
* config: Enable passing a hostname instead of IP
* build(deps): bump clap from 4.3.11 to 4.5.21
* build(deps): bump tempfile from 3.10.1 to 3.14.0
* build(deps): bump pest_derive from 2.7.6 to 2.7.14
* build(deps): bump pest from 2.7.6 to 2.7.14
* build(deps): bump codecov/codecov-action from 4 to 5
* workflows: Submit the coverage for merged PR from Fedora 41
* tests: Use Fedora 41 to generate code coverage
* api: Make API configuration modular
* agent_handler: Move the /agent scope configuration
* notifications_handler: Move the /notifications scope configuration
* quotes_handler: Move the /quotes scope configuration to quotes_handler
* keys_handler: Move /keys scope configuration to keys_handler
* Use ${DESTDIR} for config
* Fix showing wrong UUID
* build(deps): bump actix-rt from 2.9.0 to 2.10.0
* config: Refactor AgentConfig Source trait implementation
* build(deps): bump log from 0.4.21 to 0.4.22
* build(deps): bump serde_json from 1.0.120 to 1.0.128
* tpm: check if EK certificate has valid ASN.1 DER encoding
* build(deps): bump futures from 0.3.27 to 0.3.31
* cargo: Bump reqwest to version 0.12.7
* build(deps): bump serde from 1.0.203 to 1.0.210
* tests: Add more tests to Packit CI
* build(deps): bump docker/build-push-action from 5 to 6
* tests: apply workarounds to known bugs
OBS-URL: https://build.opensuse.org/package/show/security/rust-keylime?expand=0&rev=76
153 lines
5.6 KiB
RPMSpec
153 lines
5.6 KiB
RPMSpec
#
|
|
# spec file for package rust-keylime
|
|
#
|
|
# Copyright (c) 2025 SUSE LLC
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
%global rustflags '-Clink-arg=-Wl,-z,relro,-z,now'
|
|
# Consolidate _distconfdir and _sysconfdir
|
|
%if 0%{?_distconfdir:1}
|
|
%define _config_norepl %{nil}
|
|
%else
|
|
%define _distconfdir %{_sysconfdir}
|
|
%define _config_norepl %config(noreplace)
|
|
%endif
|
|
Name: rust-keylime
|
|
Version: 0.2.7+1
|
|
Release: 0
|
|
Summary: Rust implementation of the keylime agent
|
|
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (Apache-2.0 OR MIT) AND Unicode-DFS-2016 AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND (MIT OR Unlicense) AND (Apache-2.0 OR Zlib OR MIT) AND Apache-2.0 AND Apache-2.0 WITH LLVM-exception AND BSD-3-Clause AND ISC AND MIT
|
|
URL: https://github.com/keylime/rust-keylime
|
|
Source: rust-keylime-%{version}.tar.zst
|
|
Source1: vendor.tar.xz
|
|
Source2: cargo_config
|
|
Source3: keylime.xml
|
|
Source4: keylime-user.conf
|
|
Source5: tmpfiles.keylime
|
|
Source6: ima-policy
|
|
Source7: ima-policy.service
|
|
Source8: README.suse
|
|
# PATCH-FIX-OPENSUSE keylime-agent.conf.diff
|
|
Patch1: keylime-agent.conf.diff
|
|
BuildRequires: cargo-packaging
|
|
BuildRequires: clang
|
|
BuildRequires: firewall-macros
|
|
BuildRequires: libarchive-devel
|
|
BuildRequires: rust
|
|
BuildRequires: sysuser-tools
|
|
BuildRequires: tpm2-0-tss-devel
|
|
Requires: libtss2-tcti-device0
|
|
Requires: logrotate
|
|
Requires: tpm2.0-abrmd
|
|
Recommends: (keylime-ima-policy if selinux-policy-targeted)
|
|
Provides: user(keylime)
|
|
%sysusers_requires
|
|
# Disable this line if you wish to support all platforms. In most
|
|
# situations, you will likely only target tier1 arches for user facing
|
|
# components.
|
|
# ExclusiveArch: %_{rust_tier1_arches}
|
|
|
|
%description
|
|
Rust implementation of keylime agent. Keylime is system integrity
|
|
monitoring system.
|
|
|
|
%package -n keylime-ima-policy
|
|
Summary: IMA policy for Keylime agent
|
|
|
|
%description -n keylime-ima-policy
|
|
Subpackage of %{name} to provide an suggested IMA policy for Keylime agent
|
|
|
|
%prep
|
|
%autosetup -a1 -p1
|
|
mkdir .cargo
|
|
install -D -m 644 %{SOURCE2} .cargo/config
|
|
|
|
%build
|
|
%{cargo_build} --no-default-features
|
|
%sysusers_generate_pre %{SOURCE4} keylime keylime-user.conf
|
|
|
|
%install
|
|
# If https://github.com/Firstyear/cargo-packaging/pull/3 gets merged,
|
|
# replace it with:
|
|
#
|
|
# #{cargo_install -p keylime-agent} --no-default-features --features "with-zmq"
|
|
# #{cargo_install -p keylime-ima-emulator}
|
|
|
|
install -Dpm 0755 %{_builddir}/%{name}-%{version}/target/release/keylime_agent %{buildroot}%{_bindir}/keylime_agent
|
|
install -Dpm 0755 %{_builddir}/%{name}-%{version}/target/release/keylime_ima_emulator %{buildroot}%{_bindir}/keylime_ima_emulator
|
|
|
|
install -Dpm 0600 keylime-agent.conf %{buildroot}%{_distconfdir}/keylime/agent.conf
|
|
install -Dpm 0644 ./dist/systemd/system/keylime_agent.service %{buildroot}%{_unitdir}/keylime_agent.service
|
|
install -Dpm 0644 ./dist/systemd/system/var-lib-keylime-secure.mount %{buildroot}%{_unitdir}/var-lib-keylime-secure.mount
|
|
|
|
install -Dpm 0644 %{SOURCE3} %{buildroot}%{_prefix}/lib/firewalld/services/keylime.xml
|
|
install -Dpm 0644 %{SOURCE4} %{buildroot}%{_sysusersdir}/keylime-user.conf
|
|
install -Dpm 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/keylime.conf
|
|
install -d %{buildroot}%{_localstatedir}/log/keylime
|
|
install -d %{buildroot}%{_libexecdir}/keylime
|
|
|
|
# Create work directory and the certificate directory
|
|
mkdir -p %{buildroot}%{_sharedstatedir}/keylime/cv_ca
|
|
|
|
install -Dpm 0644 %{SOURCE6} %{buildroot}%{_sysconfdir}/ima/ima-policy
|
|
install -Dpm 0644 %{SOURCE7} %{buildroot}%{_unitdir}/ima-policy.service
|
|
|
|
# %_check
|
|
# %_{cargo_test}
|
|
|
|
%pre -f keylime.pre
|
|
%service_add_pre keylime_agent.service
|
|
%service_add_pre var-lib-keylime-secure.mount
|
|
|
|
%post
|
|
%firewalld_reload
|
|
%tmpfiles_create keylime.conf
|
|
%service_add_post keylime_agent.service
|
|
%service_add_post var-lib-keylime-secure.mount
|
|
|
|
%preun
|
|
%service_del_preun keylime_agent.service
|
|
%service_del_preun var-lib-keylime-secure.mount
|
|
|
|
%postun
|
|
%service_del_postun keylime_agent.service
|
|
%service_del_postun var-lib-keylime-secure.mount
|
|
|
|
%files
|
|
%doc README.md
|
|
%license LICENSE
|
|
%{_bindir}/keylime_agent
|
|
%{_bindir}/keylime_ima_emulator
|
|
%dir %attr(0700,keylime,tss) %{_distconfdir}/keylime
|
|
%_config_norepl %attr(0600,keylime,tss) %{_distconfdir}/keylime/agent.conf
|
|
%{_unitdir}/keylime_agent.service
|
|
%{_unitdir}/var-lib-keylime-secure.mount
|
|
%dir %{_prefix}/lib/firewalld
|
|
%dir %{_prefix}/lib/firewalld/services
|
|
%{_prefix}/lib/firewalld/services/keylime.xml
|
|
%{_sysusersdir}/keylime-user.conf
|
|
%{_tmpfilesdir}/keylime.conf
|
|
%dir %attr(0750,keylime,tss) %{_localstatedir}/log/keylime
|
|
%dir %attr(0750,keylime,tss) %{_libexecdir}/keylime
|
|
%dir %attr(0700,keylime,tss) %{_sharedstatedir}/keylime
|
|
%dir %attr(0700,keylime,tss) %{_sharedstatedir}/keylime/cv_ca
|
|
|
|
%files -n keylime-ima-policy
|
|
%dir %attr(0750,root,root) %{_sysconfdir}/ima
|
|
%config(noreplace) %attr(0644,root,root) %{_sysconfdir}/ima/ima-policy
|
|
%{_unitdir}/ima-policy.service
|
|
|
|
%changelog
|