#
#
# BastionGuard™
# Copyright (C) 2025–2026 Calogero Scarnà
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.
#
# BastionGuard™ is a trademark of Calogero Scarnà.
# The BastionGuard™ name and branding are not licensed under the GPL.
#
#
# Spec file for BastionGuard (openSUSE Leap 16.0)
#

Name:           bastionguard
Version:        2.0.3
Release:        1leap
Summary:        BastionGuard Security Platform
License:        GPLv3
URL:            https://bastionguard.eu
Vendor:         BastionGuard
Source0:        %{name}-%{version}.tar.gz

# Disable debuginfo / debugsource packages.
%global debug_package %{nil}

# Hyperscan is disabled by default because it is not part of the standard
# Leap 16.0 repositories. Enable it only when a trusted repository providing
# pkgconfig(hyperscan) has been configured in the build environment.
%bcond_with hyperscan

# Core build tools
BuildRequires:  binutils
BuildRequires:  cmake
BuildRequires:  file
BuildRequires:  findutils
BuildRequires:  gcc-c++
BuildRequires:  gettext-tools
BuildRequires:  git
BuildRequires:  gzip
BuildRequires:  make
BuildRequires:  ninja
BuildRequires:  patch
BuildRequires:  pkgconf-pkg-config
BuildRequires:  rsync
BuildRequires:  tar
BuildRequires:  which

# Leap 16 uses the distribution Python selected by /usr/bin/python3.
BuildRequires:  python3
BuildRequires:  python3-devel

# Main GTK/C++ application
BuildRequires:  pkgconfig(gtk4)
BuildRequires:  pkgconfig(gtkmm-4.0)
BuildRequires:  pkgconfig(glib-2.0)
BuildRequires:  pkgconfig(glibmm-2.68)
BuildRequires:  pkgconfig(giomm-2.68)
BuildRequires:  pkgconfig(pangomm-2.48)
BuildRequires:  pkgconfig(sigc++-3.0)
BuildRequires:  pkgconfig(libudev)

BuildRequires:  pkgconfig(libsoup-3.0)
BuildRequires:  pkgconfig(libsecret-1)
BuildRequires:  pkgconfig(libsystemd)
BuildRequires:  pkgconfig(libidn2)
BuildRequires:  pkgconfig(sqlite3)
BuildRequires:  pkgconfig(libcurl)
BuildRequires:  pkgconfig(openssl)
BuildRequires:  pkgconfig(polkit-gobject-1)
BuildRequires:  pkgconfig(yara)
BuildRequires:  pkgconfig(re2)
BuildRequires:  nlohmann_json-devel
BuildRequires:  boost-devel
BuildRequires:  libboost_atomic-devel
BuildRequires:  libboost_system-devel
BuildRequires:  libboost_thread-devel

%if %{with hyperscan}
BuildRequires:  pkgconfig(hyperscan)
%endif

BuildRequires:  pkgconfig(libpng)
BuildRequires:  pkgconfig(libjpeg)
BuildRequires:  pkgconfig(libtiff-4)
BuildRequires:  pkgconfig(libwebp)
BuildRequires:  pkgconfig(fribidi)

BuildRequires:  pkgconfig(nspr)
BuildRequires:  pkgconfig(nss)

BuildRequires:  pkgconfig(x11)
BuildRequires:  pkgconfig(xcursor)
BuildRequires:  pkgconfig(xrandr)
BuildRequires:  pkgconfig(xi)
BuildRequires:  pkgconfig(xinerama)
BuildRequires:  pkgconfig(xdamage)
BuildRequires:  pkgconfig(xcomposite)
BuildRequires:  pkgconfig(xfixes)
BuildRequires:  pkgconfig(xkbcommon)
BuildRequires:  pkgconfig(wayland-client)
BuildRequires:  pkgconfig(wayland-protocols)

BuildRequires:  pkgconfig(alsa)
BuildRequires:  pkgconfig(libpipewire-0.3)
BuildRequires:  samba-devel

# bastionguard-backup (GTK4/Vala, Meson)
BuildRequires:  meson
BuildRequires:  vala
BuildRequires:  pkgconfig(gio-unix-2.0)
BuildRequires:  pkgconfig(json-glib-1.0)
BuildRequires:  pkgconfig(vte-2.91-gtk4)
BuildRequires:  pkgconfig(gee-0.8)
BuildRequires:  help2man

# bastionguard-secure-connection (Meson + Go)
BuildRequires:  go
BuildRequires:  protobuf-devel
BuildRequires:  grpc-devel

# Secure Connection GUI, map and eBPF daemon
BuildRequires:  pkgconfig(shumate-1.0)
BuildRequires:  libnetfilter_queue-devel
BuildRequires:  clang
BuildRequires:  libbpf-devel
BuildRequires:  bpftool
BuildRequires:  pkgconfig(libzstd)
BuildRequires:  lzo-devel
BuildRequires:  bubblewrap
BuildRequires:  clamav
BuildRequires:  curl
BuildRequires:  dnsmasq
BuildRequires:  mozilla-nss
BuildRequires:  mozilla-nss-tools
BuildRequires:  nginx
BuildRequires:  polkit
BuildRequires:  rsync
BuildRequires:  sudo
BuildRequires:  yara
BuildRequires:  libyara-devel

# Packaging/build helpers used by the project
BuildRequires:  bubblewrap
BuildRequires:  patchelf
BuildRequires:  system-user-wwwrun

# vmlinux.h must already be present in Source0.
# bpftool and libbpf-tools are deliberately not BuildRequires because they are
# not guaranteed by the standard Leap 16.0 repositories. The Leap CI workflow
# generates vmlinux.h before creating the source archive.

# Runtime requirements available in the standard Leap repositories
Requires:       bubblewrap
Requires:       clamav
Requires:       curl
Requires:       dnsmasq
Requires:       mozilla-nss
Requires:       mozilla-nss-tools
Requires:       nginx
Requires:       polkit
Requires:       rsync
Requires:       sudo
Requires:       yara

# Provides the openSUSE web-service account used by the writable Web UI dirs.
Requires(pre):  system-user-wwwrun

# Optional integrations. These remain weak dependencies so the RPM can be
# installed from the standard Leap repositories even when they are unavailable.
Recommends:     bpftool
Recommends:     python3
Recommends:     php8-fpm

%description
Transparent security control plane for Linux desktops.

BastionGuard is not a "trust us" security product. It is a security control
plane for Linux desktops where every protection mechanism is explicit,
deterministic, and observable.

Unlike most desktop security tools, which hide decisions behind opaque
engines, cloud scoring, or silent automation, BastionGuard exposes what is
happening, why it is happening, and how protections are applied. Users and
administrators can see, control, and reason about every security decision.

%prep
%autosetup -n %{name}-%{version}

%build
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH

export CFLAGS="%{optflags}"
export CXXFLAGS="%{optflags}"
unset LDFLAGS

%if %{with hyperscan}
%global hyperscan_flag -DENABLE_HYPERSCAN=ON
%else
%global hyperscan_flag -DENABLE_HYPERSCAN=OFF
%endif

# Use an explicit, deterministic out-of-source build. This does not depend
# on distribution-specific CMake helper macro definitions.
rm -rf build

cmake -S . -B build -G Ninja \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_INSTALL_PREFIX=%{_prefix} \
  -DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
  -DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
  -DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
  -DBoost_NO_BOOST_CMAKE=ON \
  -DCMAKE_POLICY_DEFAULT_CMP0167=OLD \
  -DENABLE_SYSTEMD_SERVICES=ON \
  -DENABLE_USER_AGENT_AUTO=OFF \
  -DINSTALL_NGINX_DEFAULTS=OFF \
  -DBG_PACKAGING=ON \
  -DBG_DEBIAN_NO_INSTALL_CODE=ON \
  -DENABLE_CEF=OFF \
  -DENABLE_EMBEDDED_CEF=ON \
  -DENABLE_CEF_DAEMON=OFF \
  -DENABLE_SYSTEM_CA_INSTALL=OFF \
  -DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
  -DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
  -DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
  -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \
  %{hyperscan_flag}

test -f build/CMakeCache.txt
test -f build/build.ninja
grep '^CMAKE_GENERATOR:' build/CMakeCache.txt || true

cmake --build build --parallel 1 --verbose

%install
rm -rf %{buildroot}
test -f build/CMakeCache.txt
DESTDIR=%{buildroot} cmake --install build

# icon-theme.cache is generated metadata and must not be packaged.
find "%{buildroot}%{_datadir}/icons" \
    -type f -name 'icon-theme.cache' -delete

install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui

# Sanity checks
test -x %{buildroot}%{_bindir}/BastionGuard
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF"
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED

%post
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || :
fi
:

%postun
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
    systemctl daemon-reload >/dev/null 2>&1 || :
fi
:

%files
%{_bindir}/*

%{_datadir}/BastionGuard
%{_datadir}/bastionguard-backup
%{_datadir}/bastionguard-sc
%{_datadir}/bastionguard-rootguard

%{_datadir}/applications/BastionGuard.desktop
%{_datadir}/applications/BastionGuard-bankgui.desktop
%{_datadir}/applications/BastionGuard-secure.desktop
%{_datadir}/applications/bastionguard-bankopener.desktop
%{_datadir}/applications/bastionguard-sc.desktop
%{_datadir}/applications/bastionguard-backup-gtk.desktop

%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop

%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf

%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy

%{_unitdir}/*
%{_userunitdir}/*
%{_datadir}/locale/*/LC_MESSAGES/*.mo
%{_datadir}/icons/hicolor/*/*/*
%{_datadir}/metainfo/*
%{_mandir}/man*/*
%{_datadir}/pixmaps/*

%dir %{_sysconfdir}/bastionguard-backup
%config(noreplace) %{_sysconfdir}/bastionguard-backup/*

%{_prefix}/lib/bastionguard-sc/*

%dir %{_libexecdir}/bastionguard
%{_libexecdir}/bastionguard/*

%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing

%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/cache
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/quarantine
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/sessions
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/tmp
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui

# BastionGuard Recovery Data
%{_datadir}/bastionguard-recovery-data
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy

# Plymouth theme
%{_datadir}/plymouth/themes/bastionguard

# BastionGuard Secure Connection daemon configuration
%dir %{_sysconfdir}/bastionguard-secure-connectiond
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*

# ROOTGUARD
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default

%{_includedir}/rootguard/
%{_libdir}/libbastionguard-rootguard-gtk.a

%{_datadir}/doc/bastionguard-rootguard/

%changelog
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
- Update package