355 lines
11 KiB
RPMSpec
355 lines
11 KiB
RPMSpec
#
|
|
#
|
|
# BastionGuard™
|
|
# Copyright (C) 2025–2026 Calogero Scarnà
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, version 3.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
# BastionGuard™ is a trademark of Calogero Scarnà.
|
|
# The BastionGuard™ name and branding are not licensed under the GPL.
|
|
#
|
|
#
|
|
# Spec file for BastionGuard (openSUSE Leap 16.0)
|
|
#
|
|
|
|
Name: bastionguard
|
|
Version: 2.0.3
|
|
Release: 1leap
|
|
Summary: BastionGuard Security Platform
|
|
License: GPLv3
|
|
URL: https://bastionguard.eu
|
|
Vendor: BastionGuard
|
|
Source0: %{name}-%{version}.tar.gz
|
|
|
|
# Disable debuginfo / debugsource packages.
|
|
%global debug_package %{nil}
|
|
|
|
# Hyperscan is disabled by default because it is not part of the standard
|
|
# Leap 16.0 repositories. Enable it only when a trusted repository providing
|
|
# pkgconfig(hyperscan) has been configured in the build environment.
|
|
%bcond_with hyperscan
|
|
|
|
# Core build tools
|
|
BuildRequires: binutils
|
|
BuildRequires: cmake
|
|
BuildRequires: file
|
|
BuildRequires: findutils
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: gettext-tools
|
|
BuildRequires: git
|
|
BuildRequires: gzip
|
|
BuildRequires: make
|
|
BuildRequires: ninja
|
|
BuildRequires: patch
|
|
BuildRequires: pkgconf-pkg-config
|
|
BuildRequires: rsync
|
|
BuildRequires: tar
|
|
BuildRequires: which
|
|
|
|
# Leap 16 uses the distribution Python selected by /usr/bin/python3.
|
|
BuildRequires: python3
|
|
BuildRequires: python3-devel
|
|
|
|
# Main GTK/C++ application
|
|
BuildRequires: pkgconfig(gtk4)
|
|
BuildRequires: pkgconfig(gtkmm-4.0)
|
|
BuildRequires: pkgconfig(glib-2.0)
|
|
BuildRequires: pkgconfig(glibmm-2.68)
|
|
BuildRequires: pkgconfig(giomm-2.68)
|
|
BuildRequires: pkgconfig(pangomm-2.48)
|
|
BuildRequires: pkgconfig(sigc++-3.0)
|
|
BuildRequires: pkgconfig(libudev)
|
|
|
|
BuildRequires: pkgconfig(libsoup-3.0)
|
|
BuildRequires: pkgconfig(libsecret-1)
|
|
BuildRequires: pkgconfig(libsystemd)
|
|
BuildRequires: pkgconfig(libidn2)
|
|
BuildRequires: pkgconfig(sqlite3)
|
|
BuildRequires: pkgconfig(libcurl)
|
|
BuildRequires: pkgconfig(openssl)
|
|
BuildRequires: pkgconfig(polkit-gobject-1)
|
|
BuildRequires: pkgconfig(yara)
|
|
BuildRequires: pkgconfig(re2)
|
|
BuildRequires: nlohmann_json-devel
|
|
BuildRequires: boost-devel
|
|
BuildRequires: libboost_atomic-devel
|
|
BuildRequires: libboost_system-devel
|
|
BuildRequires: libboost_thread-devel
|
|
|
|
%if %{with hyperscan}
|
|
BuildRequires: pkgconfig(hyperscan)
|
|
%endif
|
|
|
|
BuildRequires: pkgconfig(libpng)
|
|
BuildRequires: pkgconfig(libjpeg)
|
|
BuildRequires: pkgconfig(libtiff-4)
|
|
BuildRequires: pkgconfig(libwebp)
|
|
BuildRequires: pkgconfig(fribidi)
|
|
|
|
BuildRequires: pkgconfig(nspr)
|
|
BuildRequires: pkgconfig(nss)
|
|
|
|
BuildRequires: pkgconfig(x11)
|
|
BuildRequires: pkgconfig(xcursor)
|
|
BuildRequires: pkgconfig(xrandr)
|
|
BuildRequires: pkgconfig(xi)
|
|
BuildRequires: pkgconfig(xinerama)
|
|
BuildRequires: pkgconfig(xdamage)
|
|
BuildRequires: pkgconfig(xcomposite)
|
|
BuildRequires: pkgconfig(xfixes)
|
|
BuildRequires: pkgconfig(xkbcommon)
|
|
BuildRequires: pkgconfig(wayland-client)
|
|
BuildRequires: pkgconfig(wayland-protocols)
|
|
|
|
BuildRequires: pkgconfig(alsa)
|
|
BuildRequires: pkgconfig(libpipewire-0.3)
|
|
BuildRequires: samba-devel
|
|
|
|
# bastionguard-backup (GTK4/Vala, Meson)
|
|
BuildRequires: meson
|
|
BuildRequires: vala
|
|
BuildRequires: pkgconfig(gio-unix-2.0)
|
|
BuildRequires: pkgconfig(json-glib-1.0)
|
|
BuildRequires: pkgconfig(vte-2.91-gtk4)
|
|
BuildRequires: pkgconfig(gee-0.8)
|
|
BuildRequires: help2man
|
|
|
|
# bastionguard-secure-connection (Meson + Go)
|
|
BuildRequires: go
|
|
BuildRequires: protobuf-devel
|
|
BuildRequires: grpc-devel
|
|
|
|
# Secure Connection GUI, map and eBPF daemon
|
|
BuildRequires: pkgconfig(shumate-1.0)
|
|
BuildRequires: libnetfilter_queue-devel
|
|
BuildRequires: clang
|
|
BuildRequires: libbpf-devel
|
|
BuildRequires: bpftool
|
|
BuildRequires: pkgconfig(libzstd)
|
|
BuildRequires: lzo-devel
|
|
BuildRequires: bubblewrap
|
|
BuildRequires: clamav
|
|
BuildRequires: curl
|
|
BuildRequires: dnsmasq
|
|
BuildRequires: mozilla-nss
|
|
BuildRequires: mozilla-nss-tools
|
|
BuildRequires: nginx
|
|
BuildRequires: polkit
|
|
BuildRequires: rsync
|
|
BuildRequires: sudo
|
|
BuildRequires: yara
|
|
BuildRequires: libyara-devel
|
|
|
|
# Packaging/build helpers used by the project
|
|
BuildRequires: bubblewrap
|
|
BuildRequires: patchelf
|
|
BuildRequires: system-user-wwwrun
|
|
|
|
# vmlinux.h must already be present in Source0.
|
|
# bpftool and libbpf-tools are deliberately not BuildRequires because they are
|
|
# not guaranteed by the standard Leap 16.0 repositories. The Leap CI workflow
|
|
# generates vmlinux.h before creating the source archive.
|
|
|
|
# Runtime requirements available in the standard Leap repositories
|
|
Requires: bubblewrap
|
|
Requires: clamav
|
|
Requires: curl
|
|
Requires: dnsmasq
|
|
Requires: mozilla-nss
|
|
Requires: mozilla-nss-tools
|
|
Requires: nginx
|
|
Requires: polkit
|
|
Requires: rsync
|
|
Requires: sudo
|
|
Requires: yara
|
|
|
|
# Provides the openSUSE web-service account used by the writable Web UI dirs.
|
|
Requires(pre): system-user-wwwrun
|
|
|
|
# Optional integrations. These remain weak dependencies so the RPM can be
|
|
# installed from the standard Leap repositories even when they are unavailable.
|
|
Recommends: bpftool
|
|
Recommends: python3
|
|
Recommends: php8-fpm
|
|
|
|
%description
|
|
Transparent security control plane for Linux desktops.
|
|
|
|
BastionGuard is not a "trust us" security product. It is a security control
|
|
plane for Linux desktops where every protection mechanism is explicit,
|
|
deterministic, and observable.
|
|
|
|
Unlike most desktop security tools, which hide decisions behind opaque
|
|
engines, cloud scoring, or silent automation, BastionGuard exposes what is
|
|
happening, why it is happening, and how protections are applied. Users and
|
|
administrators can see, control, and reason about every security decision.
|
|
|
|
%prep
|
|
%autosetup -n %{name}-%{version}
|
|
|
|
%build
|
|
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH
|
|
|
|
export CFLAGS="%{optflags}"
|
|
export CXXFLAGS="%{optflags}"
|
|
unset LDFLAGS
|
|
|
|
%if %{with hyperscan}
|
|
%global hyperscan_flag -DENABLE_HYPERSCAN=ON
|
|
%else
|
|
%global hyperscan_flag -DENABLE_HYPERSCAN=OFF
|
|
%endif
|
|
|
|
# Use an explicit, deterministic out-of-source build. This does not depend
|
|
# on distribution-specific CMake helper macro definitions.
|
|
rm -rf build
|
|
|
|
cmake -S . -B build -G Ninja \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DCMAKE_INSTALL_PREFIX=%{_prefix} \
|
|
-DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
|
|
-DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
|
|
-DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
|
|
-DBoost_NO_BOOST_CMAKE=ON \
|
|
-DCMAKE_POLICY_DEFAULT_CMP0167=OLD \
|
|
-DENABLE_SYSTEMD_SERVICES=ON \
|
|
-DENABLE_USER_AGENT_AUTO=OFF \
|
|
-DINSTALL_NGINX_DEFAULTS=OFF \
|
|
-DBG_PACKAGING=ON \
|
|
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
|
|
-DENABLE_CEF=OFF \
|
|
-DENABLE_EMBEDDED_CEF=ON \
|
|
-DENABLE_CEF_DAEMON=OFF \
|
|
-DENABLE_SYSTEM_CA_INSTALL=OFF \
|
|
-DBASTIONGUARD_INIT_SYSTEM=SYSTEMD \
|
|
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
|
|
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
|
|
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \
|
|
%{hyperscan_flag}
|
|
|
|
test -f build/CMakeCache.txt
|
|
test -f build/build.ninja
|
|
grep '^CMAKE_GENERATOR:' build/CMakeCache.txt || true
|
|
|
|
cmake --build build --parallel 1 --verbose
|
|
|
|
%install
|
|
rm -rf %{buildroot}
|
|
test -f build/CMakeCache.txt
|
|
DESTDIR=%{buildroot} cmake --install build
|
|
|
|
# icon-theme.cache is generated metadata and must not be packaged.
|
|
find "%{buildroot}%{_datadir}/icons" \
|
|
-type f -name 'icon-theme.cache' -delete
|
|
|
|
install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
|
|
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui
|
|
|
|
# Sanity checks
|
|
test -x %{buildroot}%{_bindir}/BastionGuard
|
|
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF"
|
|
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED
|
|
|
|
%post
|
|
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || :
|
|
fi
|
|
:
|
|
|
|
%postun
|
|
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || :
|
|
fi
|
|
:
|
|
|
|
%files
|
|
%{_bindir}/*
|
|
|
|
%{_datadir}/BastionGuard
|
|
%{_datadir}/bastionguard-backup
|
|
%{_datadir}/bastionguard-sc
|
|
%{_datadir}/bastionguard-rootguard
|
|
|
|
%{_datadir}/applications/BastionGuard.desktop
|
|
%{_datadir}/applications/BastionGuard-bankgui.desktop
|
|
%{_datadir}/applications/BastionGuard-secure.desktop
|
|
%{_datadir}/applications/bastionguard-bankopener.desktop
|
|
%{_datadir}/applications/bastionguard-sc.desktop
|
|
%{_datadir}/applications/bastionguard-backup-gtk.desktop
|
|
|
|
%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
|
|
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop
|
|
|
|
%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
|
|
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
|
|
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf
|
|
|
|
%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
|
|
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
|
|
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
|
|
%{_datadir}/polkit-1/actions/org.bastionguard.rootguard.policy
|
|
|
|
%{_unitdir}/*
|
|
%{_userunitdir}/*
|
|
%{_datadir}/locale/*/LC_MESSAGES/*.mo
|
|
%{_datadir}/icons/hicolor/*/*/*
|
|
%{_datadir}/metainfo/*
|
|
%{_mandir}/man*/*
|
|
%{_datadir}/pixmaps/*
|
|
|
|
%dir %{_sysconfdir}/bastionguard-backup
|
|
%config(noreplace) %{_sysconfdir}/bastionguard-backup/*
|
|
|
|
%{_prefix}/lib/bastionguard-sc/*
|
|
|
|
%dir %{_libexecdir}/bastionguard
|
|
%{_libexecdir}/bastionguard/*
|
|
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing
|
|
|
|
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui
|
|
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/cache
|
|
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/quarantine
|
|
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/sessions
|
|
%dir %attr(750,wwwrun,www) %{_sharedstatedir}/bastionguard-webui/tmp
|
|
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui
|
|
|
|
# BastionGuard Recovery Data
|
|
%{_datadir}/bastionguard-recovery-data
|
|
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
|
|
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy
|
|
|
|
# Plymouth theme
|
|
%{_datadir}/plymouth/themes/bastionguard
|
|
|
|
# BastionGuard Secure Connection daemon configuration
|
|
%dir %{_sysconfdir}/bastionguard-secure-connectiond
|
|
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
|
|
|
|
# ROOTGUARD
|
|
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf
|
|
%config(noreplace) %{_sysconfdir}/bastionguard/rootguard.conf.default
|
|
|
|
%{_includedir}/rootguard/
|
|
%{_libdir}/libbastionguard-rootguard-gtk.a
|
|
|
|
%{_datadir}/doc/bastionguard-rootguard/
|
|
|
|
%changelog
|
|
* Fri Aug 27 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0.3
|
|
- Update package
|