c597dc0
%global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d)
c597dc0
d6e5c96
Summary: Signing utility for UEFI binaries
d6e5c96
Name: pesign
aaccfd9
Version: 0.112
8bee723
Release: 5%{?dist}
d6e5c96
Group: Development/System
d6e5c96
License: GPLv2
d6e5c96
URL: https://github.com/vathpela/pesign
2e5e237
Obsoletes: pesign-rh-test-certs <= 0.111-7
c88197a
BuildRequires: git nspr nss nss-util popt-devel
8bee723
BuildRequires: nss-tools
575fc2a
BuildRequires: nspr-devel >= 4.9.2-1
575fc2a
BuildRequires: nss-devel >= 3.13.6-1
aaccfd9
BuildRequires: efivar-devel >= 26-1
0302103
BuildRequires: libuuid-devel
15ed9eb
BuildRequires: tar xz
e0d1414
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
e0d1414
BuildRequires: systemd
e0d1414
%endif
8bee723
Requires: nspr nss nss-util popt rpm
e7f0d02
Requires(pre): shadow-utils
aaccfd9
ExclusiveArch: %{ix86} x86_64 ia64 aarch64 arm
7d6ce00
%if 0%{?rhel} >= 7
7d6ce00
BuildRequires: rh-signing-tools >= 1.20-2
7d6ce00
%endif
b252c93
1b5f35e
Source0: https://github.com/vathpela/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2
15ed9eb
Source1: certs.tar.xz
aaccfd9
aaccfd9
Patch0001: 0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch
aaccfd9
Patch0002: 0002-Fix-command-line-parsing.patch
d6e5c96
d6e5c96
%description
d6e5c96
This package contains the pesign utility for signing UEFI binaries as
d6e5c96
well as other associated tools.
d6e5c96
d6e5c96
%prep
aaccfd9
%setup -q -T -b 0
aaccfd9
%setup -q -T -D -c -n pesign-%{version}/ -a 1
d6e5c96
git init
d6e5c96
git config user.email "pesign-owner@fedoraproject.org"
d6e5c96
git config user.name "Fedora Ninjas"
d6e5c96
git add .
d6e5c96
git commit -a -q -m "%{version} baseline."
d6e5c96
git am %{patches} 
1b5f35e
git config --unset user.email
1b5f35e
git config --unset user.name
d6e5c96
d6e5c96
%build
7640155
make PREFIX=%{_prefix} LIBDIR=%{_libdir}
d6e5c96
d6e5c96
%install
d6e5c96
rm -rf %{buildroot}
d6e5c96
mkdir -p %{buildroot}/%{_libdir}
48279a4
make PREFIX=%{_prefix} LIBDIR=%{_libdir} INSTALLROOT=%{buildroot} \
d11dc19
	install
d11dc19
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
d11dc19
make PREFIX=%{_prefix} LIBDIR=%{_libdir} INSTALLROOT=%{buildroot} \
d11dc19
	install_systemd
d11dc19
%endif
d6e5c96
d6e5c96
# there's some stuff that's not really meant to be shipped yet
27eb839
rm -rf %{buildroot}/boot %{buildroot}/usr/include
27eb839
rm -rf %{buildroot}%{_libdir}/libdpe*
15ed9eb
mkdir -p %{buildroot}%{_sysconfdir}/pki/pesign/
6765b54
mkdir -p %{buildroot}%{_sysconfdir}/pki/pesign-rh-test/
15ed9eb
cp -a etc/pki/pesign/* %{buildroot}%{_sysconfdir}/pki/pesign/
6765b54
cp -a etc/pki/pesign-rh-test/* %{buildroot}%{_sysconfdir}/pki/pesign-rh-test/
b5d702b
c597dc0
if [ %{macrosdir} != %{_sysconfdir}/rpm ]; then
c597dc0
	mkdir -p %{buildroot}%{macrosdir}
c597dc0
	mv %{buildroot}%{_sysconfdir}/rpm/macros.pesign \
c597dc0
		%{buildroot}%{macrosdir}
c597dc0
	rmdir %{buildroot}%{_sysconfdir}/rpm
c597dc0
fi
aaccfd9
rm -vf %{buildroot}/usr/share/doc/pesign-%{version}/COPYING
aaccfd9
aaccfd9
# and find-debuginfo.sh has some pretty awful deficencies too...
aaccfd9
cp -av libdpe/*.[ch] src/
c597dc0
e7f0d02
%pre
e7f0d02
getent group pesign >/dev/null || groupadd -r pesign
e7f0d02
getent passwd pesign >/dev/null || \
e7f0d02
	useradd -r -g pesign -d /var/run/pesign -s /sbin/nologin \
e7f0d02
		-c "Group for the pesign signing daemon" pesign
e7f0d02
exit 0
e7f0d02
d11dc19
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
e7f0d02
%post
e7f0d02
%systemd_post pesign.service
8bee723
e7f0d02
%preun
e7f0d02
%systemd_preun pesign.service
e7f0d02
e7f0d02
%postun
e7f0d02
%systemd_postun_with_restart pesign.service
d11dc19
%endif
e7f0d02
d6e5c96
%files
d6e5c96
%defattr(-,root,root,-)
15ed9eb
%{!?_licensedir:%global license %%doc}
15ed9eb
%license COPYING
15ed9eb
%doc README TODO
1b5f35e
%{_bindir}/authvar
1b5f35e
%{_bindir}/efikeygen
1b5f35e
%{_bindir}/efisiglist
1b5f35e
%{_bindir}/pesigcheck
d6e5c96
%{_bindir}/pesign
e7f0d02
%{_bindir}/pesign-client
15ed9eb
%dir %{_libexecdir}/pesign/
6765b54
%dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign/
6765b54
%attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
6765b54
%dir %attr(0775,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/
6765b54
%attr(0664,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/*
15ed9eb
%{_libexecdir}/pesign/pesign-authorize-users
15ed9eb
%{_libexecdir}/pesign/pesign-authorize-groups
15ed9eb
%config(noreplace)/%{_sysconfdir}/pesign/users
15ed9eb
%config(noreplace)/%{_sysconfdir}/pesign/groups
d6e5c96
%{_sysconfdir}/popt.d/pesign.popt
c597dc0
%{macrosdir}/macros.pesign
b252c93
%{_mandir}/man*/*
15ed9eb
%dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign
15ed9eb
%attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
e7f0d02
%dir %attr(0770, pesign, pesign) %{_localstatedir}/run/%{name}
e7f0d02
%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/socket
e7f0d02
%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/pesign.pid
d11dc19
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
15ed9eb
%{_tmpfilesdir}/pesign.conf
d11dc19
%{_unitdir}/pesign.service
d11dc19
%endif
d6e5c96
d6e5c96
%changelog
8bee723
* Fri Jan 06 2017 Peter Jones <pjones@redhat.com> - 0.112-5
8bee723
- Don't Req: or BuildReq: coolkey or opensc; those belong in system deploy
8bee723
  scripts.
8bee723
  Related: rhbz#1349073
8bee723
8bee723
* Wed Aug 17 2016 Peter Jones <pjones@redhat.com> - 0.112-4
8bee723
- Build as -4 to make bodhi happy.
8bee723
8bee723
* Fri Aug 12 2016 Adam Williamson <awilliam@redhat.com> - 0.112-3
8bee723
- backport fix for command line parsing from upstream master
8bee723
8bee723
* Wed Aug 10 2016 Peter Jones <pjones@redhat.com> - 0.112-2
8bee723
- Build with newer efivar.
8bee723
8bee723
* Wed Apr 20 2016 Peter Jones <pjones@redhat.com> - 0.112-1
8bee723
- Update to 0.112
8bee723
- Also fix up some spec file woes:
8bee723
  - dumb things in %%setup
8bee723
  - find-debuginfo.sh not working right for some source files...
3c8bdc1
3fceb7a
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.111-8
3fceb7a
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
3fceb7a
2e5e237
* Thu Dec 10 2015 Peter Jones <pjones@redhat.com> - 0.111-7
2e5e237
- Obsolete pesign-rh-test-certs, it was in -1's update.
2e5e237
  Resolves: rhbz#1283475
2e5e237
fb1e596
* Wed Dec 02 2015 Peter Jones <pjones@redhat.com> - 0.111-6
fb1e596
- *Don't* use --certdir if we're using the socket.
fb1e596
  Related: rhbz#1283475
fb1e596
  Related: rhbz#1284063
fb1e596
  Related: rhbz#1284561
fb1e596
b24daea
* Tue Dec 01 2015 Peter Jones <pjones@redhat.com> - 0.111-5
b24daea
- Actually do a better job of choosing which cert to use when, so people will
b24daea
  stop seeing any of this problem.  (Thanks for the thought, jforbes.)
d983376
  Resolves: rhbz#1283475
d983376
  Resolves: rhbz#1284063
d983376
  Resolves: rhbz#1284561
d983376
b24daea
* Mon Nov 30 2015 Peter Jones <pjones@redhat.com> - 0.111-5
b24daea
- setfacl even harder.
b24daea
  Related: rhbz#1283475
b24daea
  Related: rhbz#1284063
b24daea
  Related: rhbz#1284561
b24daea
49c6a13
* Fri Nov 20 2015 Peter Jones <pjones@redhat.com> - 0.111-3
49c6a13
- Better ACL setting code.
d983376
  Related: rhbz#1283475
49c6a13
d7b39bc
* Thu Nov 19 2015 Peter Jones <pjones@redhat.com> - 0.111-2
d7b39bc
- Allow the mockbuild user to read the nss database if the account exists.
d7b39bc
15ed9eb
* Wed Oct 28 2015 Peter Jones <pjones@redhat.com> - 0.111-1
15ed9eb
- Rebase to 0.111
15ed9eb
- Split test certs out into a "Recommends" subpackage.
15ed9eb
79e3b6a
* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.110-3
79e3b6a
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
79e3b6a
c597dc0
* Wed Mar  4 2015 Ville Skyttä <ville.skytta@iki.fi> - 0.110-2
c597dc0
- Install macros in %%{_rpmconfigdir}/macros.d where available (#1074281)
c597dc0
1b5f35e
* Fri Oct 24 2014 Peter Jones <pjones@redhat.com> - 0.110-1
1b5f35e
- Update to pesign-0.110
1b5f35e
0a12908
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.108-4
0a12908
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
0a12908
d241d61
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.108-3
d241d61
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
d241d61
c88197a
* Thu May 29 2014 Peter Jones <pjones@redhat.com> - 0.108-2
c88197a
- Fix a networking problem nirik observed when reinstalling builders.
c88197a
e83259c
* Sat Aug 10 2013 Peter Jones <pjones@redhat.com> - 0.108-1
7d6ce00
- Remove errant result files and raise an error from %%pesign 
7d6ce00
7d6ce00
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.106-3
7d6ce00
- Add code for signing in RHEL 7
7d6ce00
2915fd2
* Mon Aug 05 2013 Peter Jones <pjones@redhat.com> - 0.106-2
2915fd2
- Fix for new %%doc rules.
2915fd2
ba80920
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.106-2
ba80920
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
ba80920
a26d3b3
* Tue May 21 2013 Peter Jones <pjones@redhat.com> - 0.106-1
a26d3b3
- Update to 0.106
a26d3b3
- Hopefully fix the segfault dgilmore was seeing.
a26d3b3
e937c15
* Mon May 20 2013 Peter Jones <pjones@redhat.com> - 0.105-1
e937c15
- Various bug fixes.
e937c15
aae58a2
* Wed May 15 2013 Peter Jones <pjones@redhat.com> - 0.104-1
aae58a2
- Make sure alignment is correct on signature list entries
aae58a2
  Resolves: rhbz#963361
aae58a2
- Make sure section alignment is correct if we have to extend the file
aae58a2
d11dc19
* Wed Feb 06 2013 Peter Jones <pjones@redhat.com> - 0.103-2
d11dc19
- Conditionalize systemd bits so they don't show up in RHEL 6 builds
d11dc19
e7eeaa7
* Tue Feb 05 2013 Peter Jones <pjones@redhat.com> - 0.103-1
e7eeaa7
- One more compiler problem.  Let's expect a few more, shall we?
e7eeaa7
3c30b65
* Tue Feb 05 2013 Peter Jones <pjones@redhat.com> - 0.102-1
3c30b65
- Don't use --std=gnu11 because we have to work on RHEL 6 builders.
3c30b65
870d99b
* Mon Feb 04 2013 Peter Jones <pjones@redhat.com> - 0.101-1
870d99b
- Update to 0.101 to fix more "pesign -E" issues.
870d99b
5aca172
* Fri Nov 30 2012 Peter Jones <pjones@redhat.com> - 0.100-1
5aca172
- Fix insertion of signatures from a file.
5aca172
47e695f
* Mon Nov 26 2012 Matthew Garrett <mjg59@srcf.ucam.org> - 0.99-9
47e695f
- Add a patch needed for new shim builds
47e695f
11a11c6
* Fri Oct 19 2012 Peter Jones <pjones@redhat.com> - 0.99-8
11a11c6
- Get the Fedora signing token name right.
11a11c6
b5d702b
* Fri Oct 19 2012 Peter Jones <pjones@redhat.com>
b5d702b
- Add coolkey and opensc modules to pki database during %%install.
b5d702b
b58922c
* Fri Oct 19 2012 Peter Jones <pjones@redhat.com> - 0.99-7
b58922c
- setfacl u:kojibuilder:rw /var/run/pesign/socket
b58922c
- Fix command line checking in client
b58922c
- Add client stdin pin reading.
b58922c
9e2491c
* Thu Oct 18 2012 Peter Jones <pjones@redhat.com> - 0.99-6
9e2491c
- Automatically select daemon as signer when using rpm macros.
9e2491c
c0e5984
* Thu Oct 18 2012 Peter Jones <pjones@redhat.com> - 0.99-5
c0e5984
- Make it work on the -el6 branch as well.
c0e5984
18bcd8b
* Wed Oct 17 2012 Peter Jones <pjones@redhat.com> - 0.99-4
18bcd8b
- Fix some more bugs found by valgrind and coverity.
18bcd8b
- Don't build utils/ ; we're not using them and they're not ready anyway. 
18bcd8b
0d40135
* Wed Oct 17 2012 Peter Jones <pjones@redhat.com> - 0.99-3
0d40135
- Fix daemon startup bug from 0.99-2
0d40135
70aaeb7
* Wed Oct 17 2012 Peter Jones <pjones@redhat.com> - 0.99-2
70aaeb7
- Fix various bugs from 0.99-1
70aaeb7
- Don't make the database unreadable just yet.
70aaeb7
910a59e
* Mon Oct 15 2012 Peter Jones <pjones@redhat.com> - 0.99-1
910a59e
- Update to 0.99
910a59e
- Add documentation for client/server mode.
910a59e
- Add --pinfd and --pinfile to server mode.
910a59e
e7f0d02
* Fri Oct 12 2012 Peter Jones <pjones@redhat.com> - 0.98-1
e7f0d02
- Update to 0.98
e7f0d02
- Add client/server mode.
e7f0d02
60f1503
* Mon Oct 01 2012 Peter Jones <pjones@redhat.com> - 0.10-5
60f1503
- Fix missing section address fixup.
60f1503
56b5348
* Wed Aug 15 2012 Peter Jones <pjones@redhat.com> - 0.10-4
56b5348
- Make macros.pesign even better (and make it work right for i686 packages)
56b5348
cc70e86
* Tue Aug 14 2012 Peter Jones <pjones@redhat.com> - 0.10-3
cc70e86
- Only sign things on x86_64; all else ignore gracefully.
cc70e86
a28df7d
* Tue Aug 14 2012 Peter Jones <pjones@redhat.com> - 0.10-2
a28df7d
- Make macros.pesign more reliable
a28df7d
aaf8993
* Mon Aug 13 2012 Peter Jones <pjones@redhat.com> - 0.10-1
aaf8993
- Update to 0.10
aaf8993
- Include rpm macros to support easy custom signing of signed packages.
aaf8993
c813a03
* Fri Aug 10 2012 Peter Jones <pjones@redhat.com> - 0.9-1
c813a03
- Update to 0.9
c813a03
- Bug fix from Gary Ching-Pang Lin
c813a03
- Support NSS Token selection for use with smart cards.
c813a03
97454ce
* Wed Aug 08 2012 Peter Jones <pjones@redhat.com> - 0.8-1
97454ce
- Update to 0.8
97454ce
- Don't open the db read-write
97454ce
- Fix permissions on keystore (everybody can sign with test keys)
97454ce
ca4b435
* Wed Aug 08 2012 Peter Jones <pjones@redhat.com> - 0.7-2
ca4b435
- Include test keys.
ca4b435
23bf592
* Mon Jul 30 2012 Peter Jones <pjones@redhat.com> - 0.7-1
23bf592
- Update to 0.7
23bf592
- Better fix for MS compatibility.
23bf592
6ee859b
* Mon Jul 30 2012 Peter Jones <pjones@redhat.com> - 0.6-1
6ee859b
- Update to 0.6
6ee859b
- Bug-for-bug compatibility with signtool.exe .
6ee859b
636910c
* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5-2
636910c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
636910c
74121f1
* Wed Jul 11 2012 Peter Jones <pjones@redhat.com> - 0.5-1
74121f1
- Rebase to 0.5
74121f1
- Do more rigorous bounds checking when hashing a new binary.
74121f1
a056b55
* Tue Jul 10 2012 Peter Jones <pjones@redhat.com> - 0.3-2
a056b55
- Rebase to 0.4
a056b55
b252c93
* Fri Jun 22 2012 Peter Jones <pjones@redhat.com> - 0.3-2
b252c93
- Move man page to a more reasonable place.
b252c93
7640155
* Fri Jun 22 2012 Peter Jones <pjones@redhat.com> - 0.3-1
7640155
- Update to upstream's 0.3 .
7640155
92dbf7e
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-4
92dbf7e
- Do not build with smp flags.
92dbf7e
ed349fc
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-3
ed349fc
- Make it build on i686, though it's unclear it'll ever be necessary.
ed349fc
dccc1c9
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-2
dccc1c9
- Fix compile problem with f18's compiler.
dccc1c9
d6e5c96
* Thu Jun 21 2012 Peter Jones <pjones@redhat.com> - 0.2-1
d6e5c96
- Fix some rpmlint complaints nirik pointed out
d6e5c96
- Add popt-devel build dep
d6e5c96
d6e5c96
* Fri Jun 15 2012 Peter Jones <pjones@redhat.com> - 0.1-1
d6e5c96
- First version of SRPM.