#
# BastionGuard™
# Copyright (C) 2025–2026 Calogero Scarnà
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#
# BastionGuard™ is a trademark of Calogero Scarnà.
# The BastionGuard™ name and branding are not licensed under the GPL.
#

Name:           bastionguard
Version:        2.0.3
Release:        %mkrel 1
%global yara_version 4.5.5
%global yara_stage %{_builddir}/%{name}-%{version}/.yara-stage

Summary:        BastionGuard Security Platform
Group:          System/Monitoring

Provides:       bastionguard = %{version}-%{release}
Provides:       bundled(yara) = %{yara_version}
Obsoletes:      bastionguard < %{version}-%{release}

License:        GPLv3
URL:            https://bastionguard.eu
Vendor:         BastionGuard
Source0:        %{name}-%{version}.tar.gz
Source1:        https://github.com/VirusTotal/yara/archive/refs/tags/v%{yara_version}.tar.gz#/yara-%{yara_version}.tar.gz

%global debug_package %{nil}

# -----------------------------------------------------------------------------
# Mageia 10 build tools
# -----------------------------------------------------------------------------
BuildRequires:  gcc-c++
BuildRequires:  cmake
BuildRequires:  make
BuildRequires:  pkgconf-pkg-config
BuildRequires:  gettext
BuildRequires:  python3
BuildRequires:  rsync
BuildRequires:  git
BuildRequires:  systemd
BuildRequires:  bash
BuildRequires:  curl
BuildRequires:  file
BuildRequires:  binutils

# Mageia 10 does not provide yara-devel in the enabled repositories.
# Build the pinned upstream YARA source and stage it for BastionGuard.
BuildRequires:  autoconf
BuildRequires:  automake
BuildRequires:  libtool
BuildRequires:  flex
BuildRequires:  bison

# -----------------------------------------------------------------------------
# Main BastionGuard libraries
# Use Mageia RPM virtual provides so the correct lib64*-devel provider is
# selected automatically on x86_64 and the corresponding provider on i686.
# -----------------------------------------------------------------------------
BuildRequires:  pkgconfig(gtkmm-4.0)
BuildRequires:  pkgconfig(giomm-2.68)
BuildRequires:  pkgconfig(pangomm-2.48)
BuildRequires:  pkgconfig(sigc++-3.0)
BuildRequires:  pkgconfig(libsoup-3.0)
BuildRequires:  pkgconfig(libsecret-1)
BuildRequires:  pkgconfig(libsystemd)
BuildRequires:  pkgconfig(libudev)
BuildRequires:  pkgconfig(libidn2)
BuildRequires:  pkgconfig(sqlite3)
BuildRequires:  pkgconfig(libcurl)
BuildRequires:  pkgconfig(openssl)
BuildRequires:  boost-devel
BuildRequires:  pkgconfig(re2)
BuildRequires:  pkgconfig(libhs)
BuildRequires:  json-devel
BuildRequires:  pkgconfig(polkit-gobject-1)
BuildRequires:  pkgconfig(libffi)
BuildRequires:  pkgconfig(zlib)
BuildRequires:  pkgconfig(libpcre2-8)
BuildRequires:  pkgconfig(libpng)
BuildRequires:  pkgconfig(libjpeg)
BuildRequires:  pkgconfig(libtiff-4)
BuildRequires:  pkgconfig(libwebp)
BuildRequires:  pkgconfig(nss)
BuildRequires:  pkgconfig(nspr)
BuildRequires:  pkgconfig(fribidi)
BuildRequires:  pkgconfig(x11)
BuildRequires:  pkgconfig(xcursor)
BuildRequires:  pkgconfig(xrandr)
BuildRequires:  pkgconfig(xi)
BuildRequires:  pkgconfig(xinerama)
BuildRequires:  pkgconfig(xdamage)
BuildRequires:  pkgconfig(xcomposite)
BuildRequires:  pkgconfig(xkbcommon)
BuildRequires:  pkgconfig(wayland-client)
BuildRequires:  pkgconfig(alsa)
BuildRequires:  pkgconfig(libpipewire-0.3)
BuildRequires:  pkgconfig(smbclient)
BuildRequires:  pkgconfig(libzstd)
BuildRequires:  pkgconfig(lzo2)

# CMake checks these executables during configuration.
BuildRequires:  nginx

# -----------------------------------------------------------------------------
# bastionguard-backup (Meson + Vala)
# The current source checks GTK 3/VTE 2.91 directly from pkg-config.
# -----------------------------------------------------------------------------
BuildRequires:  meson
BuildRequires:  ninja
BuildRequires:  vala
BuildRequires:  pkgconfig(gtk+-3.0)
BuildRequires:  pkgconfig(gio-2.0)
BuildRequires:  pkgconfig(vte-2.91-gtk4)
BuildRequires:  pkgconfig(gtk4)
BuildRequires:  pkgconfig(gio-unix-2.0)
BuildRequires:  pkgconfig(json-glib-1.0)
BuildRequires:  pkgconfig(vte-2.91)
BuildRequires:  pkgconfig(gee-0.8)
BuildRequires:  help2man

# -----------------------------------------------------------------------------
# bastionguard-secure-connection (Meson + Go + protobuf/gRPC + eBPF)
# -----------------------------------------------------------------------------
BuildRequires:  golang
BuildRequires:  protobuf-compiler
BuildRequires:  pkgconfig(protobuf)
BuildRequires:  grpc-plugins
BuildRequires:  pkgconfig(grpc)
BuildRequires:  pkgconfig(grpc++)
BuildRequires:  pkgconfig(shumate-1.0)
BuildRequires:  pkgconfig(libnetfilter_queue)
BuildRequires:  pkgconfig(libnfnetlink)
BuildRequires:  pkgconfig(libmnl)
BuildRequires:  pkgconfig(libelf)
BuildRequires:  lib64bpf-devel
BuildRequires:  bpftool
BuildRequires:  clang
BuildRequires:  llvm
BuildRequires:  patchelf

# -----------------------------------------------------------------------------
# Runtime requirements for Mageia 10
# -----------------------------------------------------------------------------
Requires:       systemd
Requires:       nginx
Requires:       php-fpm
Requires:       dnsmasq
Requires:       polkit
Requires:       rsync
Requires:       bubblewrap
Requires:       clamav
Requires:       clamav-db
Requires:       clamd
Requires:       curl
Requires:       nss
Requires:       nss-tools
Requires:       sudo

%description
Transparent security control plane for Linux desktops.
BastionGuard is not a "trust us" security product.
It is a security control plane for Linux desktops where every protection
mechanism is explicit, deterministic, and observable.

%prep
%autosetup -n %{name}-%{version} -a 1
cp -p yara-%{yara_version}/COPYING YARA-COPYING

# Consume the staged YARA installation through an imported pkg-config target.
# This propagates its include directory, private -L path and -lyara to every
# BastionGuard target, including packaging builds that suppress link_directories.
if grep -Fq 'pkg_check_modules(YARA REQUIRED yara)' CMakeLists.txt; then
    sed -i \
      's/pkg_check_modules(YARA REQUIRED yara)/pkg_check_modules(YARA REQUIRED IMPORTED_TARGET GLOBAL yara)/' \
      CMakeLists.txt
fi

grep -Fq 'pkg_check_modules(YARA REQUIRED IMPORTED_TARGET GLOBAL yara)' \
  CMakeLists.txt

sed -i 's/${YARA_LIBRARIES}/PkgConfig::YARA/g' CMakeLists.txt

if grep -Fq '${YARA_LIBRARIES}' CMakeLists.txt; then
    echo "ERROR: legacy YARA link references remain in CMakeLists.txt"
    grep -n -F '${YARA_LIBRARIES}' CMakeLists.txt || :
    exit 1
fi

%build
# Do not inherit paths from the machine that generated the SRPM.
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH PKG_CONFIG_SYSROOT_DIR

# ---------------------------------------------------------------------------
# Build YARA first and install it into a private staging root. The same build
# is installed into %{buildroot} later, so BastionGuard links against exactly
# the YARA runtime shipped by the resulting RPM.
# ---------------------------------------------------------------------------
rm -rf %{yara_stage}
mkdir -p %{yara_stage}

pushd yara-%{yara_version}
./bootstrap.sh

YARA_CFLAGS="${CFLAGS:-%{optflags}}"
YARA_LDFLAGS="${LDFLAGS:-}"

CFLAGS="$YARA_CFLAGS" \
LDFLAGS="$YARA_LDFLAGS" \
./configure \
  --prefix=%{_prefix} \
  --bindir=%{_bindir} \
  --libdir=%{_libdir} \
  --includedir=%{_includedir} \
  --mandir=%{_mandir} \
  --disable-static \
  --enable-shared \
  --with-crypto

%make_build
make DESTDIR=%{yara_stage} install
popd

# Rewrite only the staged yara.pc paths. Do not set PKG_CONFIG_SYSROOT_DIR:
# that would also redirect unrelated system dependencies such as libsoup.
YARA_PC="%{yara_stage}%{_libdir}/pkgconfig/yara.pc"
test -f "$YARA_PC"

sed -i \
  -e 's|^prefix=.*|prefix=%{yara_stage}%{_prefix}|' \
  -e 's|^exec_prefix=.*|exec_prefix=%{yara_stage}%{_prefix}|' \
  -e 's|^libdir=.*|libdir=%{yara_stage}%{_libdir}|' \
  -e 's|^includedir=.*|includedir=%{yara_stage}%{_includedir}|' \
  "$YARA_PC"

export PKG_CONFIG_PATH="%{yara_stage}%{_libdir}/pkgconfig"
unset PKG_CONFIG_SYSROOT_DIR
export PATH="%{yara_stage}%{_bindir}:$PATH"

test -x "%{yara_stage}%{_bindir}/yara"
test "$(pkg-config --modversion yara)" = "%{yara_version}"

YARA_LIBDIR="$(pkg-config --variable=libdir yara)"
YARA_INCLUDEDIR="$(pkg-config --variable=includedir yara)"

test -d "$YARA_LIBDIR"
test -d "$YARA_INCLUDEDIR"
test -e "$YARA_LIBDIR/libyara.so"

echo "YARA version:    $(pkg-config --modversion yara)"
echo "YARA libdir:     $YARA_LIBDIR"
echo "YARA includedir: $YARA_INCLUDEDIR"
pkg-config --cflags --libs yara
ls -la "$YARA_LIBDIR"/libyara.so*

# Extra fallback for any legacy target that still emits a plain -lyara.
export LDFLAGS="${LDFLAGS:-} -L$YARA_LIBDIR"

# Mageia build:
# - the legacy standalone CEF switch is disabled;
# - the embedded runtime required by Secure Browser/Bank GUI remains enabled;
# - the standalone proxy daemon and system CA installer are disabled.
%cmake \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
  -DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
  -DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
  -DCMAKE_INSTALL_SBINDIR=sbin \
  -DENABLE_SYSTEMD_SERVICES=OFF \
  -DENABLE_USER_AGENT_AUTO=OFF \
  -DINSTALL_NGINX_DEFAULTS=OFF \
  -DBG_PACKAGING=ON \
  -DBG_DEBIAN_NO_INSTALL_CODE=ON \
  -DENABLE_CEF=OFF \
  -DENABLE_EMBEDDED_CEF=ON \
  -DENABLE_CEF_DAEMON=OFF \
  -DENABLE_SYSTEM_CA_INSTALL=OFF \
  -DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
  -DBASTIONGUARD_ROOTGUARD_INIT_SYSTEM=systemd \
  -DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
  -DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
  -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF

%cmake_build

%install
rm -rf %{buildroot}

# Install the same pinned YARA build used by BastionGuard.
pushd yara-%{yara_version}
make DESTDIR=%{buildroot} install
popd

# The bundled YARA command-line tools must not retain libtool's temporary
# build-tree RUNPATH. libyara is installed in the standard %{_libdir}, so no
# private runtime search path is required.
for _tool in yara yarac; do
    _elf="%{buildroot}%{_bindir}/${_tool}"
    test -x "$_elf"
    patchelf --remove-rpath "$_elf"

    if readelf -d "$_elf" | grep -Eq '\((RPATH|RUNPATH)\)'; then
        echo "ERROR: $_elf still contains RPATH/RUNPATH"
        readelf -d "$_elf" | grep -E '\((RPATH|RUNPATH)\)' || :
        exit 1
    fi
done

# Keep only runtime files. Development headers, metadata and the unversioned
# linker symlink are used during the build but are not shipped.
rm -rf %{buildroot}%{_includedir}/yara
rm -f %{buildroot}%{_includedir}/yara.h
rm -f %{buildroot}%{_libdir}/pkgconfig/yara.pc
rm -f %{buildroot}%{_libdir}/libyara.la
rm -f %{buildroot}%{_libdir}/libyara.a
rm -f %{buildroot}%{_libdir}/libyara.so

%cmake_install

# Mageia desktop-file validation: Exec does not perform shell expansion, and
# unquoted '$' characters are forbidden. The launched processes already inherit
# the desktop session locale, so remove the redundant env assignments.
sed -i \
  -e 's|^Exec=env .* BastionGuard-bankgui$|Exec=BastionGuard-bankgui|' \
  -e 's|^Categories=Network;Security;$|Categories=Network;Security;System;|' \
  "%{buildroot}%{_datadir}/applications/BastionGuard-bankgui.desktop"

sed -i \
  -e 's|^Exec=env .* BastionGuard-secure-gui$|Exec=BastionGuard-secure-gui|' \
  -e 's|^Categories=Network;Security;WebBrowser;$|Categories=Network;Security;System;WebBrowser;|' \
  "%{buildroot}%{_datadir}/applications/BastionGuard-secure.desktop"

# Fail here with a clear message if upstream changes the desktop entries and the
# substitutions no longer match.
grep -qx 'Exec=BastionGuard-bankgui' \
  "%{buildroot}%{_datadir}/applications/BastionGuard-bankgui.desktop"
grep -qx 'Exec=BastionGuard-secure-gui' \
  "%{buildroot}%{_datadir}/applications/BastionGuard-secure.desktop"
! grep -E '^Exec=.*\$' \
  "%{buildroot}%{_datadir}/applications/BastionGuard-bankgui.desktop" \
  "%{buildroot}%{_datadir}/applications/BastionGuard-secure.desktop"

# Mageia 10: embedded CEF and the Secure Browser GUIs must be present.
# The standalone CEF proxy, its service, activation helper and system CA
# integration must not be installed.
for _forbidden in \
  "%{buildroot}%{_bindir}/bastionguard-cef" \
  "%{buildroot}%{_bindir}/bastionguard-activation-helper" \
  "%{buildroot}%{_datadir}/polkit-1/actions/eu.bastionguard.install-ca.policy" \
  "%{buildroot}%{_datadir}/polkit-1/actions/org.bastionguard.activation.policy" \
  "%{buildroot}%{_datadir}/BastionGuard/data/scripts/install-ca-system.sh" \
  "%{buildroot}%{_userunitdir}/BastionGuard-cef.service" \
  "%{buildroot}%{_datadir}/BastionGuard/data/service/BastionGuard-cef.service" \
  "%{buildroot}%{_unitdir}/bastionguard-cef.service"; do
  test ! -e "$_forbidden"
done

for _required in \
  "%{buildroot}%{_bindir}/BastionGuard-bankopener" \
  "%{buildroot}%{_bindir}/BastionGuard-bankgui" \
  "%{buildroot}%{_bindir}/BastionGuard-secure" \
  "%{buildroot}%{_bindir}/BastionGuard-secure-gui" \
  "%{buildroot}%{_datadir}/applications/BastionGuard-bankgui.desktop" \
  "%{buildroot}%{_datadir}/applications/BastionGuard-secure.desktop" \
  "%{buildroot}%{_datadir}/applications/bastionguard-bankopener.desktop"; do
  test -e "$_required"
done

# Runtime CEF embedded required by BankOpener and Secure Browser.
test -d "%{buildroot}%{_datadir}/BastionGuard/cef"

install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui

test -x %{buildroot}%{_bindir}/BastionGuard
test -x %{buildroot}%{_bindir}/yara
test -x %{buildroot}%{_bindir}/yarac
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF 64-bit"
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q 'libyara\.so'
find %{buildroot}%{_libdir} -maxdepth 1 -type f \
  -name 'libyara.so.*' -print -quit | grep -q .

%postun
if command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || :
fi
:

%files
%license YARA-COPYING
%{_bindir}/*
%{_libdir}/libyara.so.*

%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard
%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/bastionguard-sc.desktop
%{_datadir}/applications/bastionguard-backup-gtk.desktop
%{_datadir}/applications/BastionGuard-bankgui.desktop
%{_datadir}/applications/BastionGuard-secure.desktop
%{_datadir}/applications/bastionguard-bankopener.desktop

%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop

%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf

%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy

%{_unitdir}/*
%{_userunitdir}/*
%{_datadir}/locale/*
%{_datadir}/icons/*
%{_datadir}/plymouth/*
%config(noreplace) %{_sysconfdir}/bastionguard-backup/*
/usr/lib/bastionguard-sc/*
%{_datadir}/metainfo/*
%{_mandir}/*

%dir %{_libexecdir}/bastionguard
%{_libexecdir}/bastionguard/*
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank

%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/cache
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/quarantine
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/sessions
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/tmp
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui

# BastionGuard Recovery Data
%{_datadir}/bastionguard-recovery-data
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy

# Plymouth assets
%{_datadir}/pixmaps/*

# BastionGuard Secure Connection daemon configuration
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*

# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default

%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a

%{_datadir}/doc/bastionguard-rootguard/

%changelog
* Thu Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package