Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v2.11 Version: 2.4.1 Release: 1%{?dist} License: CPL Group: System Environment/Base URL: http://sourceforge.net/projects/opencryptoki Source: http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz # the pkcs11 group is created and populated in scriptlet Patch0: %{name}-2.3.2-do-not-create-group-in-pkcs11_startup.patch # https://bugzilla.redhat.com/show_bug.cgi?id=732756 Patch1: %{name}-2.4-group.patch # convert from initscript to systemd unit Patch2: %{name}-2.4.1-systemd.patch Requires(pre): shadow-utils coreutils sed BuildRequires: openssl-devel BuildRequires: trousers-devel BuildRequires: autoconf automake libtool BuildRequires: systemd-units %ifarch s390 s390x BuildRequires: libica-devel >= 2.0 %endif Requires: %{name}-libs%{?_isa} = %{version}-%{release} Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units %description Opencryptoki implements the PKCS#11 specification v2.11 for a set of cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also brings a software token implementation that can be used without any cryptographic hardware. This package contains the Slot Daemon (pkcsslotd) and general utilities. %package libs Group: System Environment/Libraries Summary: The run-time libraries for opencryptoki package Obsoletes: %{name}-libs < 2.3.2 %description libs Opencryptoki implements the PKCS#11 specification v2.11 for a set of cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also brings a software token implementation that can be used without any cryptographic hardware. This package contains the PKCS#11 library implementation, and requires at least one token implementation (packaged separately) to be fully functional. %package devel Group: Development/Libraries Summary: Development files for openCryptoki Requires: %{name}-libs = %{version}-%{release} %description devel This package contains the development header files for building opencryptoki and PKCS#11 based applications %package swtok Group: System Environment/Libraries Summary: The software token implementation for opencryptoki Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name}-libs < 2.3.2 %description swtok Opencryptoki implements the PKCS#11 specification v2.11 for a set of cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also brings a software token implementation that can be used without any cryptographic hardware. This package brings the software token implementation to use opencryptoki without any specific cryptographic hardware. %package tpmtok Group: System Environment/Libraries Summary: Trusted Platform Module (TPM) device support for opencryptoki Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name}-libs < 2.3.2 %description tpmtok Opencryptoki implements the PKCS#11 specification v2.11 for a set of cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also brings a software token implementation that can be used without any cryptographic hardware. This package brings the necessary libraries and files to support Trusted Platform Module (TPM) devices in the opencryptoki stack. %ifarch s390 s390x %package icatok Group: System Environment/Libraries Summary: ICA cryptographic devices (clear-key) support for opencryptoki Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name}-libs < 2.3.2 %description icatok Opencryptoki implements the PKCS#11 specification v2.11 for a set of cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also brings a software token implementation that can be used without any cryptographic hardware. This package brings the necessary libraries and files to support ICA devices in the opencryptoki stack. ICA is an interface to IBM cryptographic hardware such as IBM 4764 or 4765 that uses the "accelerator" or "clear-key" path. %package ccatok Group: System Environment/Libraries Summary: CCA cryptographic devices (secure-key) support for opencryptoki Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: %{name}-libs < 2.3.2 %description ccatok Opencryptoki implements the PKCS#11 specification v2.11 for a set of cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also brings a software token implementation that can be used without any cryptographic hardware. This package brings the necessary libraries and files to support CCA devices in the opencryptoki stack. CCA is an interface to IBM cryptographic hardware such as IBM 4764 or 4765 that uses the "co-processor" or "secure-key" path. %endif %prep %setup -q %patch0 -p1 %patch1 -p1 -b .group %patch2 -p1 -b .systemd # Upstream tarball has unnecessary executable perms set on the sources find . -name '*.[ch]' -print0 | xargs -0 chmod -x %build ./bootstrap.sh %configure --with-systemdsystemunitdir=%{_unitdir} \ %ifarch s390 s390x --enable-icatok --enable-ccatok %else --disable-icatok --disable-ccatok %endif make %{?_smp_mflags} %install make install DESTDIR=$RPM_BUILD_ROOT # Remove unwanted cruft rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/*.la rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la %post libs -p /sbin/ldconfig %post swtok -p /sbin/ldconfig %post tpmtok -p /sbin/ldconfig %ifarch s390 s390x %post icatok -p /sbin/ldconfig %post ccatok -p /sbin/ldconfig %endif %postun libs -p /sbin/ldconfig %postun swtok -p /sbin/ldconfig %postun tpmtok -p /sbin/ldconfig %ifarch s390 s390x %postun icatok -p /sbin/ldconfig %postun ccatok -p /sbin/ldconfig %endif %pre # Create pkcs11 group getent group pkcs11 >/dev/null || groupadd -r pkcs11 # Add root to the pkcs11 group gpasswd -a root pkcs11 exit 0 %post if [ $1 -eq 1 ] ; then # Initial installation /bin/systemctl daemon-reload >/dev/null 2>&1 || : fi %preun if [ $1 -eq 0 ] ; then # Package removal, not upgrade /bin/systemctl --no-reload disable pkcsslotd.service > /dev/null 2>&1 || : /bin/systemctl stop pkcsslotd.service > /dev/null 2>&1 || : fi %postun /bin/systemctl daemon-reload >/dev/null 2>&1 || : if [ $1 -ge 1 ] ; then # Package upgrade, not uninstall /bin/systemctl try-restart pkcsslotd.service >/dev/null 2>&1 || : fi %files %doc ChangeLog FAQ README %doc doc/openCryptoki-HOWTO.pdf %{_unitdir}/pkcsslotd.service %{_sbindir}/* %{_mandir}/man*/* %{_libdir}/opencryptoki/methods %{_libdir}/pkcs11/methods %dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name} %files libs %doc LICENSE %{_sysconfdir}/ld.so.conf.d/* # Unversioned .so symlinks usually belong to -devel packages, but opencryptoki # needs them in the main package, because: # pkcs11_startup looks for opencryptoki/stdll/*.so, and # documentation suggests that programs should dlopen "PKCS11_API.so". %dir %{_libdir}/opencryptoki %{_libdir}/opencryptoki/libopencryptoki.* %{_libdir}/opencryptoki/PKCS11_API.so %dir %{_libdir}/opencryptoki/stdll %dir %{_libdir}/pkcs11 %{_libdir}/pkcs11/libopencryptoki.so %{_libdir}/pkcs11/PKCS11_API.so %{_libdir}/pkcs11/stdll %files devel %{_includedir}/* %files swtok %{_libdir}/opencryptoki/stdll/libpkcs11_sw.* %{_libdir}/opencryptoki/stdll/PKCS11_SW.so %files tpmtok %doc doc/README.tpm_stdll %{_libdir}/opencryptoki/stdll/libpkcs11_tpm.* %{_libdir}/opencryptoki/stdll/PKCS11_TPM.so %ifarch s390 s390x %files icatok %{_libdir}/opencryptoki/stdll/libpkcs11_ica.* %{_libdir}/opencryptoki/stdll/PKCS11_ICA.so %files ccatok %doc doc/README-IBM_CCA_users %doc doc/README.cca_stdll %{_libdir}/opencryptoki/stdll/libpkcs11_cca.* %{_libdir}/opencryptoki/stdll/PKCS11_CCA.so %endif %changelog * Sat Feb 25 2012 Dan Horák - 2.4.1-1 - new upstream release 2.4.1 - convert from initscript to systemd unit - import fixes from RHEL-6 about root's group membership (#732756, #730903) * Fri Jan 13 2012 Fedora Release Engineering - 2.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild * Thu Jul 07 2011 Dan Horák - 2.4-1 - new upstream release 2.4 * Tue Feb 08 2011 Fedora Release Engineering - 2.3.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild * Mon Jan 17 2011 Dan Horák 2.3.3-1 - new upstream release 2.3.3 * Tue Nov 09 2010 Michal Schmidt 2.3.2-2 - Apply Obsoletes to package names, not provides. * Tue Sep 14 2010 Dan Horák 2.3.2-1 - new upstream release 2.3.2 - put STDLLs in separate packages to match upstream package design * Thu Jul 08 2010 Michal Schmidt 2.3.1-7 - Move the LICENSE file to the -libs subpackage. * Tue Jun 29 2010 Dan Horák 2.3.1-6 - rebuilt with CCA enabled (#604287) - fixed issues from #546274 * Fri Apr 30 2010 Dan Horák 2.3.1-5 - fixed one more issue in the initscript (#547324) * Mon Apr 26 2010 Dan Horák 2.3.1-4 - fixed pidfile creating and usage (#547324) * Mon Feb 08 2010 Michal Schmidt 2.3.1-3 - Also list 'reload' and 'force-reload' in "Usage: ...". * Mon Feb 08 2010 Michal Schmidt 2.3.1-2 - Support 'force-reload' in the initscript. * Wed Jan 27 2010 Michal Schmidt 2.3.1-1 - New upstream release 2.3.1. - opencryptoki-2.3.0-fix-nss-breakage.patch was merged. * Fri Jan 22 2010 Dan Horák 2.3.0-5 - made pkcsslotd initscript LSB compliant (#522149) * Mon Sep 07 2009 Michal Schmidt 2.3.0-4 - Added opencryptoki-2.3.0-fix-nss-breakage.patch on upstream request. * Fri Aug 21 2009 Tomas Mraz - 2.3.0-3 - rebuilt with new openssl * Sun Aug 16 2009 Michal Schmidt 2.3.0-2 - Require libica-2.0. * Fri Aug 07 2009 Michal Schmidt 2.3.0-1 - New upstream release 2.3.0: - adds support for RSA 4096 bit keys in the ICA token. * Tue Jul 21 2009 Michal Schmidt - 2.2.8-5 - Require arch-specific dependency on -libs. * Tue Jul 21 2009 Michal Schmidt - 2.2.8-4 - Return support for crypto hw on s390. - Renamed to opencryptoki. - Simplified multilib by putting libs in subpackage as suggested by Dan Horák. * Tue Jul 21 2009 Michal Schmidt - 2.2.8-2 - Fedora package based on RHEL-5 package.