#
#
# BastionGuard™
# Copyright (C) 2025–2026 Calogero Scarnà
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#
# BastionGuard™ is a trademark of Calogero Scarnà.
# The BastionGuard™ name and branding are not licensed under the GPL.
#
#
# Spec file for BastionGuard (openSUSE Tumbleweed)
#

Name:           bastionguard
Version:        2.0.3
Release:        1
Summary:        BastionGuard Security Platform
License:        GPLv3
URL:            https://bastionguard.eu
Vendor:         BastionGuard
Source0:        %{name}-%{version}.tar.gz

Provides:       bastionguard = %{version}-%{release}
Obsoletes:      bastionguard < %{version}-%{release}



# Disable debuginfo / debugsource packages
%global debug_package %{nil}

%bcond_with hyperscan

BuildRequires:  gcc-c++
BuildRequires:  cmake
BuildRequires:  make
BuildRequires:  ninja
BuildRequires:  pkgconf-pkg-config
BuildRequires:  git
BuildRequires:  rsync
BuildRequires:  tar
BuildRequires:  gzip
BuildRequires:  patch
BuildRequires:  findutils
BuildRequires:  which
BuildRequires:  gettext-tools
BuildRequires:  python311

BuildRequires:  pkgconfig(gtk4)
BuildRequires:  pkgconfig(gtkmm-4.0)
BuildRequires:  pkgconfig(glib-2.0)
BuildRequires:  pkgconfig(glibmm-2.68)
BuildRequires:  pkgconfig(giomm-2.68)
BuildRequires:  pkgconfig(pangomm-2.48)
BuildRequires:  pkgconfig(sigc++-3.0)
BuildRequires:  pkgconfig(libudev)

BuildRequires:  pkgconfig(libsoup-3.0)
BuildRequires:  pkgconfig(libsecret-1)
BuildRequires:  pkgconfig(libsystemd)
BuildRequires:  pkgconfig(libidn2)
BuildRequires:  pkgconfig(sqlite3)
BuildRequires:  pkgconfig(libcurl)
BuildRequires:  pkgconfig(openssl)
BuildRequires:  pkgconfig(polkit-gobject-1)
BuildRequires:  pkgconfig(yara)
BuildRequires:  pkgconfig(re2)
BuildRequires:  nlohmann_json-devel
BuildRequires:  boost-devel
BuildRequires:  libboost_thread-devel

%if %{with hyperscan}
BuildRequires:  pkgconfig(hyperscan)
%endif

BuildRequires:  pkgconfig(libpng)
BuildRequires:  pkgconfig(libjpeg)
BuildRequires:  pkgconfig(libtiff-4)
BuildRequires:  pkgconfig(libwebp)
BuildRequires:  pkgconfig(fribidi)

BuildRequires:  pkgconfig(nspr)
BuildRequires:  pkgconfig(nss)

BuildRequires:  pkgconfig(x11)
BuildRequires:  pkgconfig(xcursor)
BuildRequires:  pkgconfig(xrandr)
BuildRequires:  pkgconfig(xi)
BuildRequires:  pkgconfig(xinerama)
BuildRequires:  pkgconfig(xdamage)
BuildRequires:  pkgconfig(xcomposite)
BuildRequires:  pkgconfig(xfixes)
BuildRequires:  pkgconfig(xkbcommon)
BuildRequires:  pkgconfig(wayland-client)
BuildRequires:  pkgconfig(wayland-protocols)

BuildRequires:  pkgconfig(alsa)
BuildRequires:  pkgconfig(libpipewire-0.3)

BuildRequires:  samba-devel
BuildRequires:  boost-devel

# bastionguard-backup (fork GTK4 in Vala, build Meson)
BuildRequires:  meson
BuildRequires:  vala
BuildRequires:  pkgconfig(gtk4)
BuildRequires:  pkgconfig(gio-unix-2.0)
BuildRequires:  pkgconfig(json-glib-1.0)
BuildRequires:  pkgconfig(vte-2.91-gtk4)
BuildRequires:  pkgconfig(gee-0.8)
BuildRequires:  help2man
# bastionguard-secure-connection (Meson + Go)
BuildRequires:  go
BuildRequires:  protobuf-devel
BuildRequires:  grpc-devel
# SC GUI (mappa) + daemon eBPF
BuildRequires:  pkgconfig(shumate-1.0)
BuildRequires:  libnetfilter_queue-devel
BuildRequires:  clang
BuildRequires:  libvte-2_91-0
BuildRequires:  vte-devel
BuildRequires:  typelib-1_0-Vte-2_91
BuildRequires:  bubblewrap
BuildRequires:  polkit
BuildRequires:  nginx
BuildRequires:  php8-fpm
BuildRequires:  dnsmasq
BuildRequires:  clamav
BuildRequires:  rsync
BuildRequires:  yara
BuildRequires:  curl
BuildRequires:  mozilla-nss
BuildRequires:  mozilla-nss-tools
BuildRequires:  sudo
BuildRequires:  patchelf

BuildRequires:  pkgconfig(libzstd)
BuildRequires:  lzo-devel

#BPF Module
BuildRequires: libbpf1
BuildRequires: libbpf-devel
BuildRequires: libbpf-tools
BuildRequires: bpftool


Requires:       bubblewrap
Requires:       polkit
Requires:       nginx
Requires:       php8-fpm
Requires:       dnsmasq
Requires:       clamav
Requires:       rsync
Requires:       yara
Requires:       curl
Requires:       mozilla-nss
Requires:       mozilla-nss-tools
Requires:       sudo



%description
Transparent security control plane for Linux desktops
BastionGuard is not a "trust us" security product.
It is a security control plane for Linux desktops where every protection
mechanism is explicit, deterministic, and observable.
.
Unlike most desktop security tools, which hide decisions behind opaque
engines, cloud scoring, or silent automation, BastionGuard exposes
what is happening, why it is happening, and how protections are applied.
Users and administrators can see, control, and reason about every
security decision.

%prep
%autosetup -n %{name}-%{version}

%build
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH
export CFLAGS="%{optflags}"
export CXXFLAGS="%{optflags}"
unset LDFLAGS

%if %{with hyperscan}
%global hyperscan_flag -DENABLE_HYPERSCAN=ON
%else
%global hyperscan_flag -DENABLE_HYPERSCAN=OFF
%endif

%cmake \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_INSTALL_PREFIX=%{_prefix} \
  -DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
  -DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
  -DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
  -DBoost_NO_BOOST_CMAKE=ON \
  -DCMAKE_POLICY_DEFAULT_CMP0167=OLD \
  -DENABLE_SYSTEMD_SERVICES=ON \
  -DENABLE_USER_AGENT_AUTO=OFF \
  -DINSTALL_NGINX_DEFAULTS=OFF \
  -DBG_PACKAGING=ON \
  -DENABLE_CEF=OFF \
  -DENABLE_EMBEDDED_CEF=ON \
  -DENABLE_CEF_DAEMON=OFF \
  -DENABLE_SYSTEM_CA_INSTALL=OFF \
  -DBG_DEBIAN_NO_INSTALL_CODE=ON \
  -DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
  -DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
  -DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
  -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \
  %{hyperscan_flag}

%cmake_build

%install
%cmake_install

install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui

# Sanity checks
test -x %{buildroot}%{_bindir}/BastionGuard
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF"
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED

%postun
if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || :
fi
:

%files
%{_bindir}/*

%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/BastionGuard-bankgui.desktop
%{_datadir}/applications/BastionGuard-secure.desktop
%{_datadir}/applications/bastionguard-bankopener.desktop
%{_datadir}/applications/bastionguard-sc.desktop
%{_datadir}/applications/bastionguard-backup-gtk.desktop

%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop

%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf

%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
%{_unitdir}/*
%{_userunitdir}/*

/usr/share/locale/*
/usr/share/icons/*
/usr/share/plymouth/*
/etc/bastionguard-backup/*
/usr/lib/bastionguard-sc/*
/usr/share/metainfo/*
/usr/share/man/*
/usr/share/icons/hicolor/*/apps/*
%dir %{_libexecdir}/bastionguard
%{_libexecdir}/bastionguard/*
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing

%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/cache
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/quarantine
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/sessions
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/tmp
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui

# ── BastionGuard Recovery Data ──────────────────────────────
%{_datadir}/bastionguard-recovery-data
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy
%{_datadir}/locale/*/LC_MESSAGES/bastionguard-recovery-data.mo

# ── Plymouth theme ──────────────────────────────────────────
%{_datadir}/plymouth/themes/bastionguard
%{_datadir}/pixmaps/*
# ── BastionGuard Secure Connection: config daemon ───────────
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*

# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default

%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a

%{_datadir}/doc/bastionguard-rootguard/

%changelog
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package