550 lines
20 KiB
RPMSpec
550 lines
20 KiB
RPMSpec
#
|
|
# BastionGuard™
|
|
# Copyright (C) 2025–2026 Calogero Scarnà
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, version 3.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
# BastionGuard™ is a trademark of Calogero Scarnà.
|
|
# The BastionGuard™ name and branding are not licensed under the GPL.
|
|
#
|
|
|
|
|
|
Name: bastionguard
|
|
Version: 2.0.3
|
|
Release: 1
|
|
|
|
%global yara_version 4.5.5
|
|
%global yara_stage %{_builddir}/%{name}-%{version}/.yara-stage
|
|
Summary: BastionGuard Security Platform
|
|
Group: System/Monitoring
|
|
|
|
Provides: bastionguard = %{version}-%{release}
|
|
Provides: bundled(yara) = %{yara_version}
|
|
Obsoletes: bastionguard < %{version}-%{release}
|
|
|
|
License: GPLv3
|
|
URL: https://bastionguard.eu
|
|
Vendor: BastionGuard
|
|
|
|
Source0: %{name}-%{version}.tar.gz
|
|
Source1: https://github.com/VirusTotal/yara/archive/refs/tags/v%{yara_version}.tar.gz#/yara-%{yara_version}.tar.gz
|
|
|
|
# CEF binary bundle and the current packaging layout are 64-bit only.
|
|
ExclusiveArch: x86_64 znver1
|
|
|
|
%global debug_package %{nil}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# OpenMandriva Lx 6.0 Rock build tools
|
|
# OpenMandriva uses RPM/DNF, pkgconf and the LLVM toolchain by default.
|
|
# gcc-c++ is retained because a few bundled/third-party projects still invoke
|
|
# g++ explicitly, while clang/llvm are required by the eBPF component.
|
|
# -----------------------------------------------------------------------------
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: clang
|
|
BuildRequires: llvm
|
|
BuildRequires: lld
|
|
BuildRequires: cmake
|
|
BuildRequires: ninja
|
|
BuildRequires: make
|
|
BuildRequires: pkgconf
|
|
BuildRequires: gettext-devel
|
|
BuildRequires: python
|
|
BuildRequires: rsync
|
|
BuildRequires: git-core
|
|
BuildRequires: systemd
|
|
BuildRequires: bash
|
|
BuildRequires: curl
|
|
BuildRequires: file
|
|
BuildRequires: binutils
|
|
|
|
# YARA is not available in OpenMandriva Rock 6.0. Build the pinned upstream
|
|
# source first, stage it, and use that staged installation to build BastionGuard.
|
|
BuildRequires: autoconf
|
|
BuildRequires: automake
|
|
BuildRequires: libtool
|
|
BuildRequires: flex
|
|
BuildRequires: bison
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Main BastionGuard libraries
|
|
# Use RPM virtual provides so OpenMandriva selects the matching
|
|
# lib64*-devel provider on x86_64/znver1.
|
|
# -----------------------------------------------------------------------------
|
|
BuildRequires: pkgconfig(gtkmm-4.0)
|
|
BuildRequires: pkgconfig(giomm-2.68)
|
|
BuildRequires: pkgconfig(pangomm-2.48)
|
|
BuildRequires: pkgconfig(sigc++-3.0)
|
|
BuildRequires: pkgconfig(libsoup-3.0)
|
|
BuildRequires: pkgconfig(libsecret-1)
|
|
BuildRequires: pkgconfig(libsystemd)
|
|
BuildRequires: pkgconfig(libudev)
|
|
BuildRequires: pkgconfig(libidn2)
|
|
BuildRequires: pkgconfig(sqlite3)
|
|
BuildRequires: pkgconfig(libcurl)
|
|
BuildRequires: pkgconfig(openssl)
|
|
BuildRequires: boost-devel
|
|
# Optional acceleration libraries. The project has std::regex fallbacks,
|
|
# therefore Rock builds must not fail when these are absent from the fixed repo.
|
|
%bcond_with re2
|
|
%bcond_with hyperscan
|
|
%if %{with re2}
|
|
BuildRequires: pkgconfig(re2)
|
|
%endif
|
|
%if %{with hyperscan}
|
|
BuildRequires: pkgconfig(libhs)
|
|
%endif
|
|
BuildRequires: nlohmann_json-devel
|
|
BuildRequires: pkgconfig(polkit-gobject-1)
|
|
BuildRequires: pkgconfig(libffi)
|
|
BuildRequires: pkgconfig(zlib)
|
|
BuildRequires: pkgconfig(libpcre2-8)
|
|
BuildRequires: pkgconfig(libpng)
|
|
BuildRequires: pkgconfig(libjpeg)
|
|
BuildRequires: pkgconfig(libtiff-4)
|
|
BuildRequires: pkgconfig(libwebp)
|
|
BuildRequires: pkgconfig(nss)
|
|
BuildRequires: pkgconfig(nspr)
|
|
BuildRequires: pkgconfig(fribidi)
|
|
BuildRequires: pkgconfig(x11)
|
|
BuildRequires: pkgconfig(xcursor)
|
|
BuildRequires: pkgconfig(xrandr)
|
|
BuildRequires: pkgconfig(xi)
|
|
BuildRequires: pkgconfig(xinerama)
|
|
BuildRequires: pkgconfig(xdamage)
|
|
BuildRequires: pkgconfig(xcomposite)
|
|
BuildRequires: pkgconfig(xkbcommon)
|
|
BuildRequires: pkgconfig(wayland-client)
|
|
BuildRequires: pkgconfig(alsa)
|
|
BuildRequires: pkgconfig(libpipewire-0.3)
|
|
BuildRequires: pkgconfig(smbclient)
|
|
BuildRequires: pkgconfig(libzstd)
|
|
BuildRequires: pkgconfig(lzo2)
|
|
# CMake checks these executables during configuration.
|
|
BuildRequires: nginx
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# bastionguard-backup (Meson + Vala)
|
|
# The current source checks GTK 3/VTE 2.91 directly from pkg-config.
|
|
# -----------------------------------------------------------------------------
|
|
BuildRequires: meson
|
|
BuildRequires: ninja
|
|
BuildRequires: vala
|
|
BuildRequires: pkgconfig(gtk+-3.0)
|
|
BuildRequires: pkgconfig(vte-2.91)
|
|
BuildRequires: pkgconfig(glib-2.0)
|
|
BuildRequires: pkgconfig(gobject-2.0)
|
|
BuildRequires: pkgconfig(gtk4)
|
|
BuildRequires: pkgconfig(gio-2.0)
|
|
BuildRequires: pkgconfig(gio-unix-2.0)
|
|
BuildRequires: pkgconfig(json-glib-1.0)
|
|
BuildRequires: pkgconfig(vte-2.91-gtk4)
|
|
BuildRequires: pkgconfig(gee-0.8)
|
|
BuildRequires: help2man
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# bastionguard-secure-connection (Meson + Go + protobuf/gRPC + eBPF)
|
|
# -----------------------------------------------------------------------------
|
|
BuildRequires: golang
|
|
BuildRequires: protobuf-compiler
|
|
BuildRequires: pkgconfig(protobuf)
|
|
BuildRequires: grpc-plugins
|
|
BuildRequires: pkgconfig(grpc)
|
|
BuildRequires: pkgconfig(grpc++)
|
|
BuildRequires: pkgconfig(shumate-1.0)
|
|
BuildRequires: pkgconfig(libnetfilter_queue)
|
|
BuildRequires: pkgconfig(libnfnetlink)
|
|
BuildRequires: pkgconfig(libmnl)
|
|
BuildRequires: pkgconfig(libelf)
|
|
BuildRequires: pkgconfig(libbpf)
|
|
BuildRequires: bpftool
|
|
BuildRequires: patchelf
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Runtime requirements for OpenMandriva Lx 6.0 Rock
|
|
# -----------------------------------------------------------------------------
|
|
Requires: systemd
|
|
Requires: nginx
|
|
Requires: php-fpm
|
|
Requires: dnsmasq
|
|
Requires: polkit
|
|
Requires: rsync
|
|
Requires: bubblewrap
|
|
Requires: clamav
|
|
Requires: clamav-db
|
|
Requires: clamd
|
|
Requires: curl
|
|
Requires: nss
|
|
Requires: nss-tools
|
|
Requires: sudo
|
|
|
|
%description
|
|
Transparent security control plane for Linux desktops.
|
|
BastionGuard is not a "trust us" security product.
|
|
It is a security control plane for Linux desktops where every protection
|
|
mechanism is explicit, deterministic, and observable.
|
|
|
|
%prep
|
|
%autosetup -n %{name}-%{version} -a 1
|
|
cp -p yara-%{yara_version}/COPYING YARA-COPYING
|
|
|
|
# Clang rejects capturing a static local variable. Accept whitespace variants
|
|
# and verify that the source really changed.
|
|
sed -E -i \
|
|
's/\[this,[[:space:]]*&[[:space:]]*kPageOrder[[:space:]]*\]/[this]/g' \
|
|
src/MainWindow.cpp
|
|
|
|
if grep -Eq '\[this,[[:space:]]*&[[:space:]]*kPageOrder[[:space:]]*\]' \
|
|
src/MainWindow.cpp; then
|
|
echo "ERROR: kPageOrder capture patch was not applied."
|
|
grep -n -C 3 'kPageOrder\|navigate_to' src/MainWindow.cpp || :
|
|
exit 1
|
|
fi
|
|
|
|
# The project previously consumed only ${YARA_LIBRARIES}, which expands to
|
|
# "-lyara". In BG_PACKAGING mode bg_link_directories() is deliberately a no-op,
|
|
# so the private staged libdir was lost. Consume the complete pkg-config target
|
|
# instead; it propagates include flags, -L and libraries to every target.
|
|
if grep -Fq 'pkg_check_modules(YARA REQUIRED yara)' CMakeLists.txt; then
|
|
sed -i \
|
|
's/pkg_check_modules(YARA REQUIRED yara)/pkg_check_modules(YARA REQUIRED IMPORTED_TARGET GLOBAL yara)/' \
|
|
CMakeLists.txt
|
|
fi
|
|
|
|
grep -Fq 'pkg_check_modules(YARA REQUIRED IMPORTED_TARGET GLOBAL yara)' \
|
|
CMakeLists.txt
|
|
|
|
sed -i 's/${YARA_LIBRARIES}/PkgConfig::YARA/g' CMakeLists.txt
|
|
|
|
if grep -Fq '${YARA_LIBRARIES}' CMakeLists.txt; then
|
|
echo "ERROR: legacy YARA library references remain in CMakeLists.txt."
|
|
grep -n -F '${YARA_LIBRARIES}' CMakeLists.txt || :
|
|
exit 1
|
|
fi
|
|
|
|
grep -n -E 'pkg_check_modules\(YARA|PkgConfig::YARA' CMakeLists.txt
|
|
|
|
%build
|
|
# Do not inherit paths from the machine that generated the SRPM.
|
|
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH PKG_CONFIG_SYSROOT_DIR
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Build YARA first. It is installed into a staging root only for the
|
|
# BastionGuard compilation. The final installation is performed in %install.
|
|
# -----------------------------------------------------------------------------
|
|
rm -rf %{yara_stage}
|
|
mkdir -p %{yara_stage}
|
|
|
|
pushd yara-%{yara_version}
|
|
./bootstrap.sh
|
|
|
|
YARA_CFLAGS="${CFLAGS:-%{optflags}} -fno-lto"
|
|
YARA_LDFLAGS="${LDFLAGS:-} -fno-lto"
|
|
|
|
CC=clang \
|
|
CXX=clang++ \
|
|
CFLAGS="$YARA_CFLAGS" \
|
|
LDFLAGS="$YARA_LDFLAGS" \
|
|
./configure \
|
|
--prefix=%{_prefix} \
|
|
--bindir=%{_bindir} \
|
|
--libdir=%{_libdir} \
|
|
--includedir=%{_includedir} \
|
|
--mandir=%{_mandir} \
|
|
--disable-static \
|
|
--enable-shared \
|
|
--with-crypto
|
|
|
|
%make_build
|
|
make DESTDIR=%{yara_stage} install
|
|
popd
|
|
|
|
# Make the staged YARA headers, library, pkg-config metadata and CLI visible to
|
|
# CMake without applying a fake sysroot to every system pkg-config module.
|
|
#
|
|
# PKG_CONFIG_SYSROOT_DIR must NOT be exported here: it would also rewrite
|
|
# libsoup's /usr/include/libsoup-3.0 path into
|
|
# %{yara_stage}/usr/include/libsoup-3.0, where the header does not exist.
|
|
YARA_PC="%{yara_stage}%{_libdir}/pkgconfig/yara.pc"
|
|
test -f "$YARA_PC"
|
|
|
|
sed -i \
|
|
-e 's|^prefix=.*|prefix=%{yara_stage}%{_prefix}|' \
|
|
-e 's|^exec_prefix=.*|exec_prefix=%{yara_stage}%{_prefix}|' \
|
|
-e 's|^libdir=.*|libdir=%{yara_stage}%{_libdir}|' \
|
|
-e 's|^includedir=.*|includedir=%{yara_stage}%{_includedir}|' \
|
|
"$YARA_PC"
|
|
|
|
export PKG_CONFIG_PATH="%{yara_stage}%{_libdir}/pkgconfig"
|
|
unset PKG_CONFIG_SYSROOT_DIR
|
|
export PATH="%{yara_stage}%{_bindir}:$PATH"
|
|
|
|
# Verify that pkg-config resolves the YARA build staged above.
|
|
test -f "%{yara_stage}%{_libdir}/pkgconfig/yara.pc"
|
|
test -x "%{yara_stage}%{_bindir}/yara"
|
|
|
|
pkg-config --modversion yara
|
|
test "$(pkg-config --modversion yara)" = "%{yara_version}"
|
|
|
|
echo "YARA pkg-config directory:"
|
|
pkg-config --variable=pcfiledir yara
|
|
|
|
echo "YARA compiler and linker flags:"
|
|
pkg-config --cflags --libs yara
|
|
|
|
find "%{yara_stage}%{_libdir}" \
|
|
-maxdepth 1 \
|
|
-type f \
|
|
-name 'libyara.so.*' \
|
|
-print -quit | grep -q .
|
|
|
|
# Keep the staged YARA pkg-config directory, but never apply a sysroot
|
|
# to native OpenMandriva dependencies.
|
|
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_SYSROOT_DIR
|
|
|
|
YARA_LIBDIR="$(pkg-config --variable=libdir yara)"
|
|
YARA_INCLUDEDIR="$(pkg-config --variable=includedir yara)"
|
|
test -d "$YARA_LIBDIR"
|
|
test -d "$YARA_INCLUDEDIR"
|
|
test -e "$YARA_LIBDIR/libyara.so"
|
|
|
|
echo "YARA libdir: $YARA_LIBDIR"
|
|
echo "YARA includedir: $YARA_INCLUDEDIR"
|
|
ls -la "$YARA_LIBDIR"/libyara.so*
|
|
|
|
# PkgConfig::YARA is the primary fix. The explicit -L is an additional
|
|
# packaging safeguard for any legacy target that still links with -lyara.
|
|
export LDFLAGS="%{build_ldflags} -L$YARA_LIBDIR"
|
|
export CFLAGS="%{build_cflags}"
|
|
export CXXFLAGS="%{build_cxxflags}"
|
|
|
|
echo "PKG_CONFIG_PATH=${PKG_CONFIG_PATH}"
|
|
echo "PKG_CONFIG_SYSROOT_DIR=${PKG_CONFIG_SYSROOT_DIR}"
|
|
|
|
# Final verification immediately before CMake configuration.
|
|
test "$(pkg-config --modversion yara)" = "%{yara_version}"
|
|
pkg-config --exists yara
|
|
pkg-config --cflags yara
|
|
pkg-config --libs yara
|
|
|
|
# Verify that libsoup is resolved from the native OpenMandriva installation,
|
|
# not from the private YARA staging directory.
|
|
pkg-config --exists libsoup-3.0
|
|
pkg-config --modversion libsoup-3.0
|
|
SOUP_CFLAGS="$(pkg-config --cflags libsoup-3.0)"
|
|
SOUP_LIBS="$(pkg-config --libs libsoup-3.0)"
|
|
echo "libsoup CFLAGS: $SOUP_CFLAGS"
|
|
echo "libsoup LIBS: $SOUP_LIBS"
|
|
test -f "%{_includedir}/libsoup-3.0/libsoup/soup.h"
|
|
printf '%s\n' "$SOUP_CFLAGS" | grep -q -- "-I%{_includedir}/libsoup-3.0"
|
|
if printf '%s\n' "$SOUP_CFLAGS" | grep -Fq "%{yara_stage}"; then
|
|
echo "ERROR: libsoup paths were incorrectly redirected into the YARA staging root"
|
|
exit 1
|
|
fi
|
|
|
|
# OpenMandriva Rock build:
|
|
# - the legacy standalone CEF switch is disabled;
|
|
# - the embedded runtime required by Secure Browser/Bank GUI remains enabled;
|
|
# - the standalone proxy daemon and system CA installer are disabled.
|
|
rm -rf build
|
|
|
|
cmake -S . -B build \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DCMAKE_C_COMPILER=clang \
|
|
-DCMAKE_CXX_COMPILER=clang++ \
|
|
-DCMAKE_INSTALL_PREFIX=%{_prefix} \
|
|
-DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
|
|
-DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
|
|
-DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
|
|
-DCMAKE_EXE_LINKER_FLAGS="$LDFLAGS" \
|
|
-DCMAKE_SHARED_LINKER_FLAGS="$LDFLAGS" \
|
|
-DENABLE_SYSTEMD_SERVICES=OFF \
|
|
-DENABLE_USER_AGENT_AUTO=OFF \
|
|
-DINSTALL_NGINX_DEFAULTS=OFF \
|
|
-DBG_PACKAGING=ON \
|
|
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
|
|
-DENABLE_CEF=OFF \
|
|
-DENABLE_EMBEDDED_CEF=ON \
|
|
-DENABLE_CEF_DAEMON=OFF \
|
|
-DENABLE_SYSTEM_CA_INSTALL=OFF \
|
|
-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
|
|
-DCMAKE_BUILD_RPATH="$YARA_LIBDIR" \
|
|
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
|
|
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
|
|
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF
|
|
|
|
grep '^CMAKE_GENERATOR:' build/CMakeCache.txt || true
|
|
|
|
# Confirm that CMake retained the staged YARA location before compiling.
|
|
grep -R -F "$YARA_LIBDIR" \
|
|
build/CMakeCache.txt build/CMakeFiles 2>/dev/null | head -n 20 || :
|
|
|
|
cmake --build build --parallel 1 --verbose
|
|
|
|
%install
|
|
rm -rf %{buildroot}
|
|
|
|
# Install the same YARA build used to compile BastionGuard. The runtime CLI and
|
|
# versioned libyara shared object are shipped by this RPM because Rock 6.0 has
|
|
# no YARA package. Development-only files are removed afterwards.
|
|
pushd yara-%{yara_version}
|
|
make DESTDIR=%{buildroot} install
|
|
popd
|
|
|
|
rm -rf %{buildroot}%{_includedir}/yara
|
|
rm -f %{buildroot}%{_includedir}/yara.h
|
|
rm -f %{buildroot}%{_libdir}/pkgconfig/yara.pc
|
|
rm -f %{buildroot}%{_libdir}/libyara.la
|
|
rm -f %{buildroot}%{_libdir}/libyara.a
|
|
rm -f %{buildroot}%{_libdir}/libyara.so
|
|
|
|
DESTDIR=%{buildroot} cmake --install build
|
|
|
|
# OpenMandriva Rock: embedded CEF and the Secure Browser GUIs must be present.
|
|
# The standalone CEF proxy, its service, activation helper and system CA
|
|
# integration must not be installed.
|
|
for _forbidden in \
|
|
"%{buildroot}%{_bindir}/bastionguard-cef" \
|
|
"%{buildroot}%{_bindir}/bastionguard-activation-helper" \
|
|
"%{buildroot}%{_datadir}/polkit-1/actions/eu.bastionguard.install-ca.policy" \
|
|
"%{buildroot}%{_datadir}/polkit-1/actions/org.bastionguard.activation.policy" \
|
|
"%{buildroot}%{_datadir}/BastionGuard/data/scripts/install-ca-system.sh" \
|
|
"%{buildroot}%{_userunitdir}/BastionGuard-cef.service" \
|
|
"%{buildroot}%{_datadir}/BastionGuard/data/service/BastionGuard-cef.service" \
|
|
"%{buildroot}%{_unitdir}/bastionguard-cef.service"; do
|
|
test ! -e "$_forbidden"
|
|
done
|
|
|
|
for _required in \
|
|
"%{buildroot}%{_bindir}/BastionGuard-bankopener" \
|
|
"%{buildroot}%{_bindir}/BastionGuard-bankgui" \
|
|
"%{buildroot}%{_bindir}/BastionGuard-secure" \
|
|
"%{buildroot}%{_bindir}/BastionGuard-secure-gui" \
|
|
"%{buildroot}%{_datadir}/applications/BastionGuard-bankgui.desktop" \
|
|
"%{buildroot}%{_datadir}/applications/BastionGuard-secure.desktop" \
|
|
"%{buildroot}%{_datadir}/applications/bastionguard-bankopener.desktop"; do
|
|
test -e "$_required"
|
|
done
|
|
|
|
# Runtime CEF embedded required by BankOpener and Secure Browser.
|
|
test -d "%{buildroot}%{_datadir}/BastionGuard/cef"
|
|
|
|
install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
|
|
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui
|
|
|
|
test -x %{buildroot}%{_bindir}/BastionGuard
|
|
test -x %{buildroot}%{_bindir}/yara
|
|
test -x %{buildroot}%{_bindir}/yarac
|
|
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF 64-bit"
|
|
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED
|
|
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q 'libyara\.so'
|
|
find %{buildroot}%{_libdir} -maxdepth 1 -type f -name 'libyara.so.*' -print -quit | grep -q .
|
|
|
|
%post
|
|
# Unit activation is intentionally left to BastionGuard's first-run wizard.
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
# OpenMandriva's PHP-FPM packages normally use the apache account. Keep the
|
|
# package installable even on minimal systems where that account is not yet
|
|
# present, and fix ownership once php-fpm has created it.
|
|
if getent passwd apache >/dev/null 2>&1; then
|
|
chown -R apache:apache %{_sharedstatedir}/bastionguard-webui 2>/dev/null || :
|
|
fi
|
|
:
|
|
|
|
%postun
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || :
|
|
fi
|
|
:
|
|
|
|
%files
|
|
%license YARA-COPYING
|
|
%{_bindir}/*
|
|
%{_libdir}/libyara.so.*
|
|
|
|
%{_datadir}/BastionGuard
|
|
%{_datadir}/bastionguard-backup
|
|
%{_datadir}/bastionguard-sc
|
|
%{_datadir}/bastionguard-rootguard
|
|
%{_datadir}/applications/BastionGuard.desktop
|
|
%{_datadir}/applications/bastionguard-sc.desktop
|
|
%{_datadir}/applications/bastionguard-backup-gtk.desktop
|
|
%{_datadir}/applications/BastionGuard-bankgui.desktop
|
|
%{_datadir}/applications/BastionGuard-secure.desktop
|
|
%{_datadir}/applications/bastionguard-bankopener.desktop
|
|
|
|
%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
|
|
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop
|
|
|
|
%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
|
|
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
|
|
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf
|
|
|
|
%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
|
|
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
|
|
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
|
|
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
|
|
|
|
%{_unitdir}/*
|
|
%{_userunitdir}/*
|
|
%{_datadir}/locale/*
|
|
%{_datadir}/icons/*
|
|
%{_datadir}/plymouth/*
|
|
%config(noreplace) %{_sysconfdir}/bastionguard-backup/*
|
|
/usr/lib/bastionguard-sc/*
|
|
%{_datadir}/metainfo/*
|
|
%{_mandir}/*
|
|
|
|
%dir %{_libexecdir}/bastionguard
|
|
%{_libexecdir}/bastionguard/*
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank
|
|
|
|
%dir %attr(750,root,root) %{_sharedstatedir}/bastionguard-webui
|
|
%dir %attr(750,root,root) %{_sharedstatedir}/bastionguard-webui/cache
|
|
%dir %attr(750,root,root) %{_sharedstatedir}/bastionguard-webui/quarantine
|
|
%dir %attr(750,root,root) %{_sharedstatedir}/bastionguard-webui/sessions
|
|
%dir %attr(750,root,root) %{_sharedstatedir}/bastionguard-webui/tmp
|
|
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui
|
|
|
|
# BastionGuard Recovery Data
|
|
%{_datadir}/bastionguard-recovery-data
|
|
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
|
|
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy
|
|
|
|
# Plymouth assets
|
|
%{_datadir}/pixmaps/*
|
|
|
|
# BastionGuard Secure Connection daemon configuration
|
|
%dir %{_sysconfdir}/bastionguard-secure-connectiond
|
|
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
|
|
|
|
# ROOTGUARD
|
|
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
|
|
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default
|
|
|
|
%{_includedir}/rootguard/
|
|
%{_libdir}/libbastionguard-rootguard-gtk.a
|
|
|
|
%{_datadir}/doc/bastionguard-rootguard/
|
|
|
|
%changelog
|
|
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
|
|
- Update package
|