%global custodiaipa_version 0.1.0

Name:           custodia

Version:        0.3.1

Release:        4%{?dist}

Summary:        A service to manage, retrieve and store secrets for other processes

License:        GPLv3+

URL:            https://github.com/latchset/%{name}

Source0:        https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.gz

Source1:        https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.gz.sha512sum.txt

Source2:        custodia.conf

Source5:        custodia.tmpfiles.conf

Patch1:         0001-Vendor-configparser-3.5.0.patch

Patch2:         0002-Patch-and-integrate-vendored-configparser.patch

Patch3:         0003-Remove-etcd-store.patch

Patch4:         0004-Vendor-custodia.ipa.patch

Patch5:         0005-Add-workaround-for-missing-kra_server_server.patch

BuildArch:      noarch

BuildRequires:      python-devel

BuildRequires:      python-jwcrypto

BuildRequires:      python-requests

BuildRequires:      python-setuptools

BuildRequires:      python-coverage

BuildRequires:      pytest

BuildRequires:      python-docutils

BuildRequires:      systemd-python

BuildRequires:      python-ipalib

Requires:           python-custodia = %{version}-%{release}

Requires(preun):    systemd-units

Requires(postun):   systemd-units

Requires(post):     systemd-units

%global overview                                                           \

Custodia is a Secrets Service Provider, it stores or proxies access to     \

keys, password, and secret material in general. Custodia is built to       \

use the HTTP protocol and a RESTful API as an IPC mechanism over a local   \

Unix Socket. It can also be exposed to a network via a Reverse Proxy       \

service assuming proper authentication and header validation is            \

implemented in the Proxy.                                                  \

                                                                           \

Custodia is modular, the configuration file controls how authentication,   \

authorization, storage and API plugins are combined and exposed.

%description

A service to manage, retrieve and store secrets for other processes

%{overview}

%package -n python-custodia

Summary:    Sub-package with python2 custodia modules

Provides:   python2-custodia = %{version}-%{release}

Requires:   python-jwcrypto

Requires:   python-requests

Requires:   python-setuptools

Requires:   systemd-python

%description -n python-custodia

Sub-package with python2 custodia modules

%{overview}

%package -n python-custodia-ipa

Summary:    Sub-package with python2 custodia.ipa vault module

Requires:   python-custodia = %{version}-%{release}

Requires:   python-ipalib

Requires:   ipa-client

%description -n python-custodia-ipa

Sub-package with python2 custodia.ipa vault module

%{overview}

%prep

grep `sha512sum %{SOURCE0}` %{SOURCE1} || (echo "Checksum invalid!" && exit 1)

%setup

%patch1 -p1

%patch2 -p1

%patch3 -p1

%patch4 -p1

%patch5 -p1

%build

%{__python2} setup.py egg_info build

%check

export PYTHONPATH="%{buildroot}/%{python2_sitelib}"

py.test --skip-servertest --ignore=tests/test_ipa.py --ignore=tests/test_cli.py

%install

mkdir -p %{buildroot}/%{_sbindir}

mkdir -p %{buildroot}/%{_mandir}/man7

mkdir -p %{buildroot}/%{_defaultdocdir}/custodia

mkdir -p %{buildroot}/%{_defaultdocdir}/custodia/examples

mkdir -p %{buildroot}/%{_sysconfdir}/custodia

mkdir -p %{buildroot}/%{_unitdir}

mkdir -p %{buildroot}/%{_tmpfilesdir}

mkdir -p %{buildroot}/%{_localstatedir}/lib/custodia

mkdir -p %{buildroot}/%{_localstatedir}/log/custodia

%{__python2} setup.py install --skip-build --root %{buildroot}

mv %{buildroot}/%{_bindir}/custodia %{buildroot}/%{_sbindir}/custodia

install -m 644 -t "%{buildroot}/%{_mandir}/man7" man/custodia.7

install -m 644 -t "%{buildroot}/%{_defaultdocdir}/custodia" README README.custodia.ipa API.md

install -m 644 -t "%{buildroot}/%{_defaultdocdir}/custodia/examples" custodia.conf

install -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/custodia

install -m 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/custodia.conf

# Recently setuptools stopped installing namespace __init__.py

install -m 644 -t "%{buildroot}/%{python2_sitelib}/custodia" custodia/__init__.py

%post

%systemd_post custodia.socket

%systemd_post custodia.service

%preun

%systemd_preun custodia.socket

%systemd_preun custodia.service

%postun

%systemd_postun custodia.socket

%systemd_postun custodia.service

%files

%doc %{_defaultdocdir}/custodia/README

%doc %{_defaultdocdir}/custodia/API.md

%doc %{_defaultdocdir}/custodia/examples/custodia.conf

%license LICENSE

%{_mandir}/man7/custodia*

%{_sbindir}/custodia

%{_bindir}/custodia-cli

%dir %attr(0700,root,root) %{_sysconfdir}/custodia

%config(noreplace) %attr(600,root,root) %{_sysconfdir}/custodia/custodia.conf

%dir %attr(0700,root,root) %{_localstatedir}/lib/custodia

%dir %attr(0700,root,root) %{_localstatedir}/log/custodia

%{_tmpfilesdir}/custodia.conf

%files -n python-custodia

%license LICENSE

%exclude %{python2_sitelib}/custodia/ipa

%{python2_sitelib}/*

%files -n python-custodia-ipa

%doc %{_defaultdocdir}/custodia/README.custodia.ipa

%{python2_sitelib}/custodia/ipa/*

%changelog

* Tue Jun 20 2017 Christian Heimes <cheimes@redhat.com> - 0.3.1-4

- Add workaround for missing kra_server_server key, resolves #1462403

* Mon Jun 12 2017 Christian Heimes <cheimes@redhat.com> - 0.3.1-3

- Remove custodia user from tmpfiles.d, resolves #1460735

- Add missing systemd hooks for service and socket files

- Drop dependency on python-mock and skip mock tests in check block,

  resolves #1447426

* Fri Mar 31 2017 Christian Heimes <cheimes@redhat.com> - 0.3.1-2

- Exclude empty directory custodia/ipa from python-custodia

* Fri Mar 31 2017 Christian Heimes <cheimes@redhat.com> - 0.3.1-1

- Rebase to Custodia 0.3.1

- Vendor custodia.ipa 0.1.0

- Vendor backports.configparser 3.5.0 final

- related: #1403214

* Tue Mar 28 2017 Christian Heimes <cheimes@redhat.com> - 0.3.0-4

- Fix whitespace handling in URLs

- Use upstream patches to replace patches for setuptools and configparser

- resolves: #1436763

* Fri Mar 17 2017 Christian Heimes <cheimes@redhat.com> - 0.3.0-3

- custodia depends on python-custodia

* Fri Mar 17 2017 Christian Heimes <cheimes@redhat.com> - 0.3.0-2

- Fix package dependencies and package names to use python prefix

* Wed Mar 15 2017 Christian Heimes <cheimes@redhat.com> - 0.3.0-1

- Update to custodia 0.3.0

- Vendor backports.configparser 3.5.0b2

- Fix compatibility issues with old setuptools

- Add tmpfiles.d config for /run/custodia

* Wed Sep 07 2016 Christian Heimes <cheimes@redhat.com> - 0.1.0-4

- Disable tests (broken on build machines)

- related: #1371902

* Wed Sep 07 2016 Simo Sorce <simo@redhat.com> - 0.1.0-3

- Change default to use RSA OAEP padding

- resolves: #1371902

* Mon Apr 04 2016 Christian Heimes <cheimes@redhat.com> - 0.2.1-2

- Correct download link

* Thu Mar 31 2016 Christian Heimes <cheimes@redhat.com> - 0.1.0-1

- Initial packaging