302 lines
9.5 KiB
RPMSpec
302 lines
9.5 KiB
RPMSpec
#
|
|
#
|
|
# BastionGuard™
|
|
# Copyright (C) 2025–2026 Calogero Scarnà
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, version 3.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
# BastionGuard™ is a trademark of Calogero Scarnà.
|
|
# The BastionGuard™ name and branding are not licensed under the GPL.
|
|
#
|
|
#
|
|
# Spec file for BastionGuard (openSUSE Tumbleweed)
|
|
#
|
|
|
|
Name: bastionguard
|
|
Version: 2.0
|
|
Release: 1
|
|
Summary: BastionGuard Security Platform
|
|
License: GPL-3.0-or-later
|
|
URL: https://git.bastionguard.eu/specialworld83/BastionGuard
|
|
Source0: %{name}-%{version}.tar.gz
|
|
|
|
Provides: bastionguard = %{version}-%{release}
|
|
Obsoletes: bastionguard < %{version}-%{release}
|
|
|
|
|
|
|
|
# Disable debuginfo / debugsource packages
|
|
%global debug_package %{nil}
|
|
|
|
%bcond_with hyperscan
|
|
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: cmake
|
|
BuildRequires: make
|
|
BuildRequires: ninja
|
|
BuildRequires: pkgconf-pkg-config
|
|
BuildRequires: git
|
|
BuildRequires: rsync
|
|
BuildRequires: tar
|
|
BuildRequires: gzip
|
|
BuildRequires: patch
|
|
BuildRequires: findutils
|
|
BuildRequires: which
|
|
BuildRequires: gettext-tools
|
|
BuildRequires: python311
|
|
|
|
BuildRequires: pkgconfig(gtk4)
|
|
BuildRequires: pkgconfig(gtkmm-4.0)
|
|
BuildRequires: pkgconfig(glib-2.0)
|
|
BuildRequires: pkgconfig(glibmm-2.68)
|
|
BuildRequires: pkgconfig(giomm-2.68)
|
|
BuildRequires: pkgconfig(pangomm-2.48)
|
|
BuildRequires: pkgconfig(sigc++-3.0)
|
|
BuildRequires: pkgconfig(libudev)
|
|
|
|
BuildRequires: pkgconfig(libsoup-3.0)
|
|
BuildRequires: pkgconfig(libsecret-1)
|
|
BuildRequires: pkgconfig(libsystemd)
|
|
BuildRequires: pkgconfig(libidn2)
|
|
BuildRequires: pkgconfig(sqlite3)
|
|
BuildRequires: pkgconfig(libcurl)
|
|
BuildRequires: pkgconfig(openssl)
|
|
BuildRequires: pkgconfig(polkit-gobject-1)
|
|
BuildRequires: pkgconfig(yara)
|
|
BuildRequires: pkgconfig(re2)
|
|
BuildRequires: nlohmann_json-devel
|
|
BuildRequires: boost-devel
|
|
BuildRequires: libboost_thread-devel
|
|
|
|
%if %{with hyperscan}
|
|
BuildRequires: pkgconfig(hyperscan)
|
|
%endif
|
|
|
|
BuildRequires: pkgconfig(libpng)
|
|
BuildRequires: pkgconfig(libjpeg)
|
|
BuildRequires: pkgconfig(libtiff-4)
|
|
BuildRequires: pkgconfig(libwebp)
|
|
BuildRequires: pkgconfig(fribidi)
|
|
|
|
BuildRequires: pkgconfig(nspr)
|
|
BuildRequires: pkgconfig(nss)
|
|
|
|
BuildRequires: pkgconfig(x11)
|
|
BuildRequires: pkgconfig(xcursor)
|
|
BuildRequires: pkgconfig(xrandr)
|
|
BuildRequires: pkgconfig(xi)
|
|
BuildRequires: pkgconfig(xinerama)
|
|
BuildRequires: pkgconfig(xdamage)
|
|
BuildRequires: pkgconfig(xcomposite)
|
|
BuildRequires: pkgconfig(xfixes)
|
|
BuildRequires: pkgconfig(xkbcommon)
|
|
BuildRequires: pkgconfig(wayland-client)
|
|
BuildRequires: pkgconfig(wayland-protocols)
|
|
|
|
BuildRequires: pkgconfig(alsa)
|
|
BuildRequires: pkgconfig(libpipewire-0.3)
|
|
|
|
BuildRequires: samba-devel
|
|
BuildRequires: boost-devel
|
|
|
|
# bastionguard-backup (fork GTK4 in Vala, build Meson)
|
|
BuildRequires: meson
|
|
BuildRequires: vala
|
|
BuildRequires: pkgconfig(gtk4)
|
|
BuildRequires: pkgconfig(gio-unix-2.0)
|
|
BuildRequires: pkgconfig(json-glib-1.0)
|
|
BuildRequires: pkgconfig(vte-2.91-gtk4)
|
|
BuildRequires: pkgconfig(gee-0.8)
|
|
BuildRequires: help2man
|
|
# bastionguard-secure-connection (Meson + Go)
|
|
BuildRequires: go
|
|
BuildRequires: protobuf-devel
|
|
BuildRequires: grpc-devel
|
|
# SC GUI (mappa) + daemon eBPF
|
|
BuildRequires: pkgconfig(shumate-1.0)
|
|
BuildRequires: libnetfilter_queue-devel
|
|
BuildRequires: clang
|
|
BuildRequires: libvte-2_91-0
|
|
BuildRequires: vte-devel
|
|
BuildRequires: typelib-1_0-Vte-2_91
|
|
BuildRequires: bubblewrap
|
|
BuildRequires: polkit
|
|
BuildRequires: nginx
|
|
BuildRequires: php8-fpm
|
|
BuildRequires: dnsmasq
|
|
BuildRequires: clamav
|
|
BuildRequires: rsync
|
|
BuildRequires: yara
|
|
BuildRequires: curl
|
|
BuildRequires: mozilla-nss
|
|
BuildRequires: mozilla-nss-tools
|
|
BuildRequires: sudo
|
|
BuildRequires: patchelf
|
|
|
|
BuildRequires: pkgconfig(libzstd)
|
|
BuildRequires: lzo-devel
|
|
|
|
#BPF Module
|
|
BuildRequires: libbpf1
|
|
BuildRequires: libbpf-devel
|
|
BuildRequires: libbpf-tools
|
|
BuildRequires: bpftool
|
|
|
|
|
|
Requires: bubblewrap
|
|
Requires: polkit
|
|
Requires: nginx
|
|
Requires: php8-fpm
|
|
Requires: dnsmasq
|
|
Requires: clamav
|
|
Requires: rsync
|
|
Requires: yara
|
|
Requires: curl
|
|
Requires: mozilla-nss
|
|
Requires: mozilla-nss-tools
|
|
Requires: sudo
|
|
|
|
|
|
|
|
%description
|
|
Transparent security control plane for Linux desktops
|
|
BastionGuard is not a "trust us" security product.
|
|
It is a security control plane for Linux desktops where every protection
|
|
mechanism is explicit, deterministic, and observable.
|
|
.
|
|
Unlike most desktop security tools, which hide decisions behind opaque
|
|
engines, cloud scoring, or silent automation, BastionGuard exposes
|
|
what is happening, why it is happening, and how protections are applied.
|
|
Users and administrators can see, control, and reason about every
|
|
security decision.
|
|
|
|
%prep
|
|
%autosetup -n %{name}-%{version}
|
|
|
|
%build
|
|
unset LD_LIBRARY_PATH LIBRARY_PATH CMAKE_PREFIX_PATH PKG_CONFIG_PATH
|
|
export CFLAGS="%{optflags}"
|
|
export CXXFLAGS="%{optflags}"
|
|
unset LDFLAGS
|
|
|
|
%if %{with hyperscan}
|
|
%global hyperscan_flag -DENABLE_HYPERSCAN=ON
|
|
%else
|
|
%global hyperscan_flag -DENABLE_HYPERSCAN=OFF
|
|
%endif
|
|
|
|
%cmake \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DCMAKE_INSTALL_PREFIX=%{_prefix} \
|
|
-DCMAKE_INSTALL_SYSCONFDIR=%{_sysconfdir} \
|
|
-DCMAKE_INSTALL_LOCALSTATEDIR=%{_localstatedir} \
|
|
-DCMAKE_INSTALL_DATAROOTDIR=%{_datadir} \
|
|
-DBoost_NO_BOOST_CMAKE=ON \
|
|
-DCMAKE_POLICY_DEFAULT_CMP0167=OLD \
|
|
-DENABLE_SYSTEMD_SERVICES=ON \
|
|
-DENABLE_USER_AGENT_AUTO=OFF \
|
|
-DINSTALL_NGINX_DEFAULTS=OFF \
|
|
-DBG_PACKAGING=ON \
|
|
-DBG_DEBIAN_NO_INSTALL_CODE=ON \
|
|
-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
|
|
-DCMAKE_INSTALL_RPATH='$ORIGIN/../share/BastionGuard/lib;$ORIGIN/../share/BastionGuard/cef' \
|
|
-DCMAKE_INSTALL_RPATH_USE_LINK_PATH=OFF \
|
|
%{hyperscan_flag}
|
|
|
|
%cmake_build
|
|
|
|
%install
|
|
%cmake_install
|
|
|
|
install -dm750 %{buildroot}%{_sharedstatedir}/bastionguard-webui/{cache,quarantine,sessions,tmp}
|
|
install -dm755 %{buildroot}%{_localstatedir}/log/bastionguard-webui
|
|
|
|
# Sanity checks
|
|
test -x %{buildroot}%{_bindir}/BastionGuard
|
|
file %{buildroot}%{_bindir}/BastionGuard | grep -q "ELF"
|
|
readelf -d %{buildroot}%{_bindir}/BastionGuard | grep -q NEEDED
|
|
|
|
%postun
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || :
|
|
fi
|
|
:
|
|
|
|
%files
|
|
%{_bindir}/*
|
|
|
|
%{_datadir}/BastionGuard
|
|
%{_datadir}/bastionguard-backup
|
|
%{_datadir}/bastionguard-sc
|
|
%{_datadir}/applications/BastionGuard.desktop
|
|
%{_datadir}/applications/BastionGuard-bankgui.desktop
|
|
%{_datadir}/applications/BastionGuard-secure.desktop
|
|
%{_datadir}/applications/bastionguard-bankopener.desktop
|
|
%{_datadir}/applications/bastionguard-sc.desktop
|
|
%{_datadir}/applications/bastionguard-backup-gtk.desktop
|
|
|
|
%config(noreplace) %{_sysconfdir}/xdg/autostart/BastionGuard-autostart.desktop
|
|
%config(noreplace) %{_sysconfdir}/xdg/autostart/bastionguard-sc-autostart.desktop
|
|
|
|
%{_datadir}/dbus-1/services/org.BastionGuard.RansomwareAlert.service
|
|
%{_datadir}/dbus-1/system-services/org.BastionGuard.USBD.service
|
|
%{_datadir}/dbus-1/system.d/org.BastionGuard.USBD.conf
|
|
|
|
%{_datadir}/polkit-1/actions/it.BastionGuard.camera.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.ransomware.policy
|
|
%{_datadir}/polkit-1/actions/org.BastionGuard.USBD.policy
|
|
%{_datadir}/polkit-1/actions/eu.bastionguard.install-ca.policy
|
|
%{_datadir}/polkit-1/actions/eu.bastionguard.sc.policy
|
|
%{_datadir}/polkit-1/actions/org.bastionguard.pkexec.backup.policy
|
|
%{_unitdir}/*
|
|
%{_userunitdir}/*
|
|
|
|
/usr/share/locale/*
|
|
/usr/share/icons/*
|
|
/usr/share/plymouth/*
|
|
/etc/bastionguard-backup/*
|
|
/usr/lib/bastionguard-sc/*
|
|
/usr/share/metainfo/*
|
|
/usr/share/man/*
|
|
/usr/share/icons/hicolor/*/apps/*
|
|
|
|
%dir %{_libexecdir}/bastionguard
|
|
%{_libexecdir}/bastionguard/archive_worker
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-helper
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-bank
|
|
%config(noreplace) %{_sysconfdir}/sudoers.d/bastionguard-phishing
|
|
|
|
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui
|
|
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/cache
|
|
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/quarantine
|
|
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/sessions
|
|
%dir %attr(750,apache,apache) %{_sharedstatedir}/bastionguard-webui/tmp
|
|
%dir %attr(755,root,root) %{_localstatedir}/log/bastionguard-webui
|
|
|
|
# ── BastionGuard Recovery Data ──────────────────────────────
|
|
%{_datadir}/bastionguard-recovery-data
|
|
%{_datadir}/applications/com.bastionguard.RecoveryData.desktop
|
|
%{_datadir}/polkit-1/actions/com.bastionguard.RecoveryData.policy
|
|
%{_datadir}/locale/*/LC_MESSAGES/bastionguard-recovery-data.mo
|
|
|
|
# ── Plymouth theme ──────────────────────────────────────────
|
|
%{_datadir}/plymouth/themes/bastionguard
|
|
%{_datadir}/pixmaps/*
|
|
# ── BastionGuard Secure Connection: config daemon ───────────
|
|
%dir %{_sysconfdir}/bastionguard-secure-connectiond
|
|
%config(noreplace) %{_sysconfdir}/bastionguard-secure-connectiond/*
|
|
|
|
%changelog
|
|
* Fri Jun 12 2026 Calogero Scarnà <info@bastionguard.eu> - 2.0
|
|
- Update package
|