#
# BastionGuard™
# Copyright (C) 2025–2026 Calogero Scarnà
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#
# BastionGuard™ is a trademark of Calogero Scarnà.
# The BastionGuard™ name and branding are not licensed under the GPL.
#

Name:           bastionguard
Version:        2.0
Release:        1%{?dist}
Summary:        BastionGuard Security Platform

Provides:       bastionguard = %{version}-%{release}
Obsoletes:      bastionguard < %{version}-%{release}

License:        GPLv3
URL:            https://git.bastionguard.eu/specialworld83/BastionGuard
Source0:        %{name}-%{version}.tar.gz
%global debug_package %{nil}

BuildRequires:  gcc-c++
BuildRequires:  cmake
BuildRequires:  make
BuildRequires:  pkgconf-pkg-config
BuildRequires:  gettext
BuildRequires:  python3
BuildRequires:  rsync
BuildRequires:  git
BuildRequires:  systemd-rpm-macros

BuildRequires:  gtkmm4.0-devel
BuildRequires:  glibmm2.68-devel
BuildRequires:  pangomm2.48-devel
BuildRequires:  libsigc++30-devel
BuildRequires:  libsoup3-devel
BuildRequires:  libsecret-devel
BuildRequires:  systemd-devel
BuildRequires:  libidn2-devel
BuildRequires:  sqlite-devel
BuildRequires:  libcurl-devel
BuildRequires:  openssl-devel
BuildRequires:  boost-devel
BuildRequires:  re2-devel
BuildRequires:  vectorscan-devel
BuildRequires:  nlohmann-json-devel
BuildRequires:  yara-devel
BuildRequires:  polkit-devel
BuildRequires:  libffi-devel
BuildRequires:  zlib-devel
BuildRequires:  pcre2-devel
BuildRequires:  libpng-devel
BuildRequires:  libjpeg-turbo-devel
BuildRequires:  libtiff-devel
BuildRequires:  libwebp-devel
BuildRequires:  nss-devel
BuildRequires:  nspr-devel
BuildRequires:  fribidi-devel
BuildRequires:  libX11-devel
BuildRequires:  libXcursor-devel
BuildRequires:  libXrandr-devel
BuildRequires:  libXi-devel
BuildRequires:  libXinerama-devel
BuildRequires:  libXdamage-devel
BuildRequires:  libXcomposite-devel
BuildRequires:  libxkbcommon-devel
BuildRequires:  wayland-devel
BuildRequires:  alsa-lib-devel
BuildRequires:  pipewire-jack-audio-connection-kit-devel
BuildRequires:  libsmbclient-devel
BuildRequires:  libzstd-devel
BuildRequires:  lzo-devel
BuildRequires:  nginx
BuildRequires:  php-fpm
BuildRequires:  dnsmasq
BuildRequires:  polkit
BuildRequires:  rsync
BuildRequires:  yara
BuildRequires:  bubblewrap
BuildRequires:  clamav
BuildRequires:  clamav-freshclam
BuildRequires:  clamd
BuildRequires:  curl
BuildRequires:  nss
BuildRequires:  nss-tools
BuildRequires:  sudo

# bastionguard-backup (fork GTK4 in Vala, build Meson)
BuildRequires:  meson
BuildRequires:  ninja-build
BuildRequires:  vala
BuildRequires:  gtk4-devel
BuildRequires:  glib2-devel
BuildRequires:  json-glib-devel
BuildRequires:  vte291-gtk4-devel
BuildRequires:  libgee-devel
BuildRequires:  help2man
BuildRequires:  vte291
BuildRequires:  vte291-devel

# bastionguard-secure-connection (Meson + Go)
BuildRequires:  golang
BuildRequires:  protobuf-compiler
BuildRequires:  protobuf-devel
BuildRequires:  grpc-plugins
BuildRequires:  grpc-devel
# SC GUI (mappa) + daemon eBPF
BuildRequires:  libshumate-devel
BuildRequires:  libnetfilter_queue-devel
BuildRequires:  libbpf
BuildRequires:  libbpf-devel
BuildRequires:  libbpf-tools
BuildRequires:  bpftool
BuildRequires:  clang
BuildRequires:  patchelf

Requires:       nginx
Requires:       php-fpm
Requires:       dnsmasq
Requires:       polkit
Requires:       rsync
Requires:       yara
Requires:       bubblewrap
Requires:       clamav
Requires:       clamav-freshclam
Requires:       clamd
Requires:       curl
Requires:       nss
Requires:       nss-tools
Requires:       sudo


%{?systemd_requires}

%description
Transparent security control plane for Linux desktops.
BastionGuard is not a "trust us" security product.
It is a security control plane for Linux desktops where every protection
mechanism is explicit, deterministic, and observable.

%prep
%autosetup -n %{name}-%{version}

%build
rm -rf build
mkdir -p build
cd build

unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH
export LDFLAGS="%{build_ldflags}"
export CFLAGS="%{build_cflags}"
export CXXFLAGS="%{build_cxxflags}"

cmake .. \
  -DCMAKE_INSTALL_PREFIX=%{_prefix} \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
  -DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
  -DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
  -DENABLE_SYSTEMD_SERVICES=OFF \
  -DENABLE_USER_AGENT_AUTO=OFF \
  -DINSTALL_NGINX_DEFAULTS=OFF \
  -DBG_PACKAGING=ON \
  -DBG_DEBIAN_NO_INSTALL_CODE=ON \
  -DENABLE_CEF=ON \
  -DENABLE_CEF_DAEMON=OFF \
  -DENABLE_SYSTEM_CA_INSTALL=OFF \
  -DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
  -DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
  -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF


make

%install
rm -rf %{buildroot}
cd build
export DESTDIR=%{buildroot}
make install

# Fedora/RHEL family: il runtime CEF incorporato e le GUI Secure Browser
# devono essere presenti; daemon CEF, servizio, installazione CA e attivazione
# devono invece essere esclusi direttamente dal CMake.
for _forbidden in \
  "%{buildroot}%{_bindir}/bastionguard-cef" \
  "%{buildroot}%{_bindir}/bastionguard-activation-helper" \
  "%{buildroot}%{_datadir}/polkit-1/actions/eu.bastionguard.install-ca.policy" \
  "%{buildroot}%{_datadir}/polkit-1/actions/org.bastionguard.activation.policy" \
  "%{buildroot}%{_datadir}/BastionGuard/data/scripts/install-ca-system.sh" \
  "%{buildroot}%{_userunitdir}/BastionGuard-cef.service" \
  "%{buildroot}%{_datadir}/BastionGuard/data/service/BastionGuard-cef.service" \
  "%{buildroot}%{_unitdir}/bastionguard-cef.service"; do
  test ! -e "$_forbidden"
done

# Le GUI e i launcher Secure Browser devono rimanere nel pacchetto.
for _required in \
  "%{buildroot}%{_bindir}/BastionGuard-bankopener" \
  "%{buildroot}%{_bindir}/BastionGuard-bankgui" \
  "%{buildroot}%{_bindir}/BastionGuard-secure" \
  "%{buildroot}%{_bindir}/BastionGuard-secure-gui" \
  "%{buildroot}%{_datadir}/applications/BastionGuard-bankgui.desktop" \
  "%{buildroot}%{_datadir}/applications/BastionGuard-secure.desktop" \
  "%{buildroot}%{_datadir}/applications/bastionguard-bankopener.desktop"; do
  test -e "$_required"
done

# Runtime CEF incorporato richiesto da BankOpener e Secure Browser.
test -d "%{buildroot}%{_datadir}/BastionGuard/cef"

install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui

test -x %{buildroot}%{_bindir}/BastionGuard
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF 64-bit"
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED

%postun
if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || :
fi
:

%files
%{_bindir}/*

%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/bastionguard-sc.desktop
%{_datadir}/applications/bastionguard-backup-gtk.desktop
%{_datadir}/applications/BastionGuard-bankgui.desktop
%{_datadir}/applications/BastionGuard-secure.desktop
%{_datadir}/applications/bastionguard-bankopener.desktop

%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop

%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf

%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_unitdir}/*
%{_userunitdir}/*

/usr/share/locale/*
/usr/share/icons/*
/usr/share/plymouth/*
/etc/bastionguard-backup/*
/usr/lib/bastionguard-sc/*
/usr/share/metainfo/*
/usr/share/man/*
/usr/share/icons/hicolor/*/apps/*


%dir %{_libexecdir}/bastionguard
%{_libexecdir}/bastionguard/archive_worker
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank

%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/cache
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/quarantine
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/sessions
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/tmp
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui

# ── BastionGuard Recovery Data ──────────────────────────────
%{_datadir}/bastionguard-recovery-data
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy
%{_datadir}/locale/*/LC_MESSAGES/bastionguard-recovery-data.mo

# ── Plymouth theme ──────────────────────────────────────────
%{_datadir}/plymouth/themes/bastionguard
%{_datadir}/pixmaps/*
# ── BastionGuard Secure Connection: config daemon ───────────
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*

%changelog
* Fri Jun 12 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0
- Update package