%global _hardened_build 1 Name: clevis Version: 11 Release: 9%{?dist} Summary: Automated decryption framework License: GPLv3+ URL: https://github.com/latchset/%{name} Source0: https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz Patch01: Delete-remaining-references-to-the-removed-http-pin.patch Patch02: Install-cryptsetup-and-tpm2_pcrlist-in-the-initramfs.patch Patch03: Add-device-TCTI-library-to-the-initramfs.patch Patch04: Check-key-derivation-key-is-available.patch Patch05: Adjust-pin-tang-test-to-account-for-newer-tang-witho.patch Patch06: Add-clevis-luks-report-regen.patch Patch07: Improve-error-message-when-bind-is-given-an-invalid-.patch Patch08: Add-support-for-listing-existing-PBD-policies-in-pla.patch Patch09: Add-the-option-to-extract-luks-passphrase-used-for-b.patch Patch10: Add-rd.neednet-1-to-cmdline-only-if-there-are-device.patch Patch11: Improve-tests-speed.patch Patch12: Use-one-clevis-luks-askpass-per-device.patch Patch13: Improve-clevis-luks-regen-no-unbind-in-every-case.patch BuildRequires: gcc BuildRequires: meson BuildRequires: asciidoc BuildRequires: ninja-build BuildRequires: bash-completion BuildRequires: libjose-devel >= 8 BuildRequires: libluksmeta-devel >= 8 BuildRequires: audit-libs-devel BuildRequires: libudisks2-devel BuildRequires: openssl-devel BuildRequires: tpm2-tools >= 3.0.0 BuildRequires: desktop-file-utils BuildRequires: pkgconfig BuildRequires: systemd BuildRequires: dracut BuildRequires: tang >= 6 BuildRequires: curl BuildRequires: luksmeta BuildRequires: cracklib-dicts Buildrequires: jq BuildRequires: diffutils BuildRequires: expect Requires: tpm2-tools >= 3.0.0 Requires: coreutils Requires: jose >= 8 Requires: curl Requires(pre): shadow-utils %description Clevis is a framework for automated decryption. It allows you to encrypt data using sophisticated unlocking policies which enable decryption to occur automatically. The clevis package provides basic encryption/decryption policy support. Users can use this directly; but most commonly, it will be used as a building block for other packages. For example, see the clevis-luks and clevis-dracut packages for automatic root volume unlocking of LUKSv1 volumes during early boot. %package luks Summary: LUKSv1 integration for clevis Requires: %{name}%{?_isa} = %{version}-%{release} Requires: cryptsetup Requires: luksmeta >= 8 %description luks LUKSv1 integration for clevis. This package allows you to bind a LUKSv1 volume to a clevis unlocking policy. For automated unlocking, an unlocker will also be required. See, for example, clevis-dracut and clevis-udisks2. %package systemd Summary: systemd integration for clevis Requires: %{name}-luks%{?_isa} = %{version}-%{release} %if 0%{?fedora} > 27 Requires: systemd%{?_isa} >= 235-3 %else %if 0%{?fedora} == 27 Requires: systemd%{?_isa} >= 234-9 %else %if 0%{?fedora} == 26 Requires: systemd%{?_isa} >= 233-7 %else Requires: systemd%{?_isa} >= 236 %endif %endif %endif Requires: nc %description systemd Automatically unlocks LUKSv1 _netdev block devices from /etc/crypttab. %package dracut Summary: Dracut integration for clevis Requires: %{name}-systemd%{?_isa} = %{version}-%{release} Requires: dracut-network %description dracut Automatically unlocks LUKSv1 block devices in early boot. %package udisks2 Summary: UDisks2/Storaged integration for clevis Requires: %{name}-luks%{?_isa} = %{version}-%{release} %description udisks2 Automatically unlocks LUKSv1 block devices in desktop environments that use UDisks2 or storaged (like GNOME). %prep %autosetup -p1 %build %meson -Duser=clevis -Dgroup=clevis %meson_build %install %meson_install %check desktop-file-validate \ %{buildroot}/%{_sysconfdir}/xdg/autostart/%{name}-luks-udisks2.desktop %meson_test %pre getent group %{name} >/dev/null || groupadd -r %{name} getent passwd %{name} >/dev/null || \ useradd -r -g %{name} -d %{_localstatedir}/cache/%{name} -s /sbin/nologin \ -c "Clevis Decryption Framework unprivileged user" %{name} exit 0 %pre systemd if [ $1 -ge 0 ]; then # clevis-systemd < 11-8 shipped with clevis-luks-askpass.path unit. # Make sure it's gone. [ -e /usr/lib/systemd/system/clevis-luks-askpass.path ] && \ systemctl disable clevis-luks-askpass.path fi exit 0 %files %license COPYING %{_datadir}/bash-completion/ %{_bindir}/%{name}-decrypt-tang %{_bindir}/%{name}-decrypt-tpm2 %{_bindir}/%{name}-decrypt-sss %{_bindir}/%{name}-decrypt %{_bindir}/%{name}-encrypt-tang %{_bindir}/%{name}-encrypt-tpm2 %{_bindir}/%{name}-encrypt-sss %{_bindir}/%{name} %{_mandir}/man1/%{name}-encrypt-tang.1* %{_mandir}/man1/%{name}-encrypt-tpm2.1* %{_mandir}/man1/%{name}-encrypt-sss.1* %{_mandir}/man1/%{name}-decrypt.1* %{_mandir}/man1/%{name}.1* %files luks %{_mandir}/man7/%{name}-luks-unlockers.7* %{_mandir}/man1/%{name}-luks-unlock.1* %{_mandir}/man1/%{name}-luks-unbind.1* %{_mandir}/man1/%{name}-luks-bind.1* %{_mandir}/man1/%{name}-luks-regen.1* %{_mandir}/man1/%{name}-luks-report.1* %{_mandir}/man1/%{name}-luks-list.1* %{_mandir}/man1/%{name}-luks-pass.1.* %{_bindir}/%{name}-luks-unlock %{_bindir}/%{name}-luks-unbind %{_bindir}/%{name}-luks-bind %{_bindir}/%{name}-luks-common-functions %{_bindir}/%{name}-luks-regen %{_bindir}/%{name}-luks-report %{_bindir}/%{name}-luks-report-compare %{_bindir}/%{name}-luks-report-decode %{_bindir}/%{name}-luks-report-sss %{_bindir}/%{name}-luks-report-tang %{_bindir}/%{name}-luks-list %{_bindir}/%{name}-luks-pass %files systemd %{_libexecdir}/%{name}-luks-askpass %{_unitdir}/%{name}-luks-askpass@.path %{_unitdir}/%{name}-luks-askpass@.service %files dracut %{_prefix}/lib/dracut/modules.d/60%{name} %files udisks2 %{_sysconfdir}/xdg/autostart/%{name}-luks-udisks2.desktop %attr(4755, root, root) %{_libexecdir}/%{name}-luks-udisks2 %changelog * Wed Feb 02 2020 Sergio Correia - 11-9 - Improve clevis luks regen not to unbind+bind in every case Resolves: rhbz#1795675 * Mon Jan 13 2020 Sergio Correia - 11-8 - Use one clevis-luks-askpass per device Resolves: rhbz#1784524 * Sat Nov 30 2019 Sergio Correia - 11-7 - Add rd.neednet=1 to cmdline only if there are devices bound to tang Resolves: rhbz#1762028 * Sat Nov 30 2019 Sergio Correia - 11-6 - Add option to extract luks passphrase used for binding Resolves: rhbz#1436780 * Thu Nov 28 2019 Sergio Correia - 11-5 - Add support for listing existing PBD policies in place Resolves: rhbz#1766526 * Fri Oct 18 2019 Sergio Correia - 11-4 - Improve error message when bind is given an invalid PIN Resolves: rhbz#1543380 * Wed Oct 16 2019 Sergio Correia - 11-3 - Add clevis luks report and regen Resolves: rhbz#1564566 Resolves: rhbz#1564559 * Fri Jan 04 2019 Daniel Kopecek - 11-2 - Check that key derivation key is available - Delete remaining references to the removed http pin - Install cryptsetup and tpm2_pcrlist in the initramfs - Add device TCTI library to the initramfs Resolves: rhbz#1648004 Resolves: rhbz#1650246 * Tue Aug 14 2018 Nathaniel McCallum - 11-1 - Update to v11 * Thu Jul 12 2018 Fedora Release Engineering - 10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Wed Mar 21 2018 Nathaniel McCallum - 10-1 - Update to v10 * Tue Feb 13 2018 Nathaniel McCallum - 9-1 - Update to v9 * Wed Feb 07 2018 Fedora Release Engineering - 8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Mon Nov 13 2017 Nathaniel McCallum - 8-1 - Update to v8 * Wed Nov 08 2017 Zbigniew Jędrzejewski-Szmek - 7-2 - Rebuild for cryptsetup-2.0.0 * Fri Oct 27 2017 Nathaniel McCallum - 7-1 - Update to v7 * Wed Aug 02 2017 Fedora Release Engineering - 6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Wed Jul 26 2017 Fedora Release Engineering - 6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Tue Jun 27 2017 Nathaniel McCallum - 6-1 - New upstream release - Specify unprivileged user/group during configuration - Move clevis user/group creation to base clevis package * Mon Jun 26 2017 Nathaniel McCallum - 5-1 - New upstream release - Run clevis decryption from udisks2 under an unprivileged user * Wed Jun 14 2017 Nathaniel McCallum - 4-1 - New upstream release * Wed Jun 14 2017 Nathaniel McCallum - 3-1 - New upstream release * Fri Feb 10 2017 Fedora Release Engineering - 2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Fri Nov 18 2016 Nathaniel McCallum - 2-1 - New upstream release * Mon Nov 14 2016 Nathaniel McCallum - 1-1 - First release