Skip to content

Commit 9a77b84

Browse files
ansasakiansasaki
committed
rpm: Add subpackage for push-attestation agent
Add a subpackage that install the push-attestation agent to the RPMs built on Copr. Install the service for push-attestation agent in `make install`. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>
1 parent b0a796f commit 9a77b84

File tree

6 files changed

+281
-25
lines changed

6 files changed

+281
-25
lines changed

‎GNUmakefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ install: all
3939
install -D -t ${DESTDIR}/usr/bin "$$f"; \
4040
done
4141
install -D -m 644 -t ${DESTDIR}$(systemdsystemunitdir) dist/systemd/system/keylime_agent.service
42+
install -D -m 644 -t ${DESTDIR}$(systemdsystemunitdir) dist/systemd/system/keylime_push_model_agent.service
4243
install -D -m 644 -t ${DESTDIR}$(systemdsystemunitdir) dist/systemd/system/var-lib-keylime-secure.mount
4344
# Remove when https://github.com/keylime/rust-keylime/issues/325 is fixed
4445
install -D -t ${DESTDIR}/usr/libexec/keylime keylime-agent/tests/actions/shim.py

‎dist/systemd/system/keylime_push_model_agent.service‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
[Unit]
2+
Description=The Keylime push model agent
3+
StartLimitInterval=10s
4+
StartLimitBurst=5
5+
After=network-online.target
6+
Wants=network-online.target
7+
Wants=tpm2-abrmd.service
8+
After=tpm2-abrmd.service
9+
# If the service should start only when hardware TPMs are available, uncomment the below lines
10+
#ConditionPathExistsGlob=/dev/tpm[0-9]*
11+
#ConditionPathExistsGlob=/dev/tpmrm[0-9]*
12+
13+
[Service]
14+
ExecStart=/usr/bin/keylime_push_model_agent
15+
TimeoutSec=60s
16+
Restart=on-failure
17+
RestartSec=120s
18+
Environment="RUST_LOG=keylime_push_model_agent=info,keylime=info"
19+
# If using swtpm with tpm2-abrmd service, uncomment the line below to set TCTI
20+
# variable on the service environment
21+
#Environment="TCTI=tabrmd:"
22+
23+
[Install]
24+
WantedBy=default.target

‎rpm/centos/keylime-agent-rust.spec‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Summary: Rust agent for Keylime
3030
# Unlicense or MIT
3131
# zlib or ASL 2.0 or MIT
3232
#
33-
License: ASL 2.0 and BSD and MIT
33+
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
3434
URL: https://github.com/keylime/rust-keylime/
3535
Source0: rust-keylime-v%{version}.tar.gz
3636
# The vendor tarball is created using cargo-vendor-filterer to remove Windows
@@ -45,6 +45,8 @@ Source0: rust-keylime-v%{version}.tar.gz
4545
# --exclude-crate-path "libloading#tests"
4646
# tar jcf rust-keylime-%%{version}-vendor.tar.xz vendor
4747
Source1: rust-keylime-vendor.tar.xz
48+
# Drop deprecated features and workaround unavailable components
49+
Patch0: rust-keylime-metadata.patch
4850

4951
ExclusiveArch: %{rust_arches}
5052

@@ -63,16 +65,34 @@ BuildRequires: tpm2-tss-devel
6365
BuildRequires: clang
6466
BuildRequires: rust-toolset
6567

66-
# Virtual Provides to support swapping between Python and Rust implementation
68+
# Virtual Provides to support swapping between different agent implementations
6769
Provides: keylime-agent
6870
Conflicts: keylime-agent
6971

7072
%description
7173
Rust agent for Keylime
7274

75+
%package push
76+
Summary: Rust push-model agent for Keylime
77+
Requires: tpm2-tss
78+
Requires: util-linux-core
79+
80+
# The keylime-base package provides the keylime user creation. It is available
81+
# from Fedora 36
82+
%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
83+
Requires: keylime-base
84+
%endif
85+
86+
# Virtual Provides to support swapping between pull and push model agents
87+
Provides: keylime-agent
88+
Conflicts: keylime-agent
89+
90+
%description push
91+
Rust push-model agent for Keylime
92+
7393
%prep
7494
%autosetup -n rust-keylime-%{version} -N
75-
%autopatch -m 100 -p1
95+
%autopatch -p1
7696
# Source1 is vendored dependencies
7797
%cargo_prep -V 1
7898

@@ -100,6 +120,9 @@ install -Dpm 644 ./dist/systemd/system/keylime_agent.service \
100120
install -Dpm 644 ./dist/systemd/system/var-lib-keylime-secure.mount \
101121
%{buildroot}%{_unitdir}/var-lib-keylime-secure.mount
102122

123+
install -Dpm 644 ./dist/systemd/system/keylime_push_model_agent.service \
124+
%{buildroot}%{_unitdir}/keylime_push_model_agent.service
125+
103126
# Setting up the agent to use keylime:keylime user/group after dropping privileges.
104127
cat > %{buildroot}/%{_sysconfdir}/keylime/agent.conf.d/001-run_as.conf << EOF
105128
[agent]
@@ -112,6 +135,9 @@ install -Dpm 0755 \
112135
install -Dpm 0755 \
113136
-t %{buildroot}%{_bindir} \
114137
./target/release/keylime_ima_emulator
138+
install -Dpm 0755 \
139+
-t %{buildroot}%{_bindir} \
140+
./target/release/keylime_push_model_agent
115141

116142
%posttrans
117143
chmod 500 %{_sysconfdir}/keylime/agent.conf.d
@@ -142,6 +168,12 @@ chown -R keylime:keylime %{_sysconfdir}/keylime
142168
%{_bindir}/keylime_agent
143169
%{_bindir}/keylime_ima_emulator
144170

171+
%files push
172+
%license LICENSE
173+
%doc README.md
174+
%{_bindir}/keylime_push_model_agent
175+
%{_unitdir}/keylime_push_model_agent.service
176+
145177
%if %{with check}
146178
%check
147179
%cargo_test

‎rpm/centos/rust-keylime-metadata.patch‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
--- a/keylime/Cargo.toml 2025-08-06 10:04:19.246120602 +0200
2+
+++ b/keylime/Cargo.toml 2025-08-06 10:12:12.694471716 +0200
3+
@@ -40,14 +40,11 @@
4+
tokio.workspace = true
5+
uuid.workspace = true
6+
zip.workspace = true
7+
-zmq = {version = "0.9.2", optional = true}
8+
9+
[dev-dependencies]
10+
tempfile.workspace = true
11+
actix-rt.workspace = true
12+
-wiremock = {version = "0.6"}
13+
14+
[features]
15+
+default = []
16+
testing = []
17+
-# This feature is deprecated and will be removed on next major release
18+
-with-zmq = ["zmq"]
19+
--- a/keylime-agent/Cargo.toml 2025-08-06 10:08:23.650703421 +0200
20+
+++ b/keylime-agent/Cargo.toml 2025-08-06 10:09:30.080590640 +0200
21+
@@ -32,7 +32,6 @@
22+
thiserror.workspace = true
23+
uuid.workspace = true
24+
zip.workspace = true
25+
-zmq = {version = "0.9.2", optional = true}
26+
27+
[dev-dependencies]
28+
actix-rt.workspace = true
29+
@@ -41,18 +40,6 @@
30+
# The features enabled by default
31+
default = []
32+
testing = []
33+
-# Whether the agent should be compiled with support to listen for notification
34+
-# messages on ZeroMQ
35+
-#
36+
-# This feature is deprecated and will be removed on next major release
37+
-with-zmq = ["zmq"]
38+
-# Whether the agent should be compiled with support for python revocation
39+
-# actions loaded as modules, which is the only kind supported by the python
40+
-# agent (unless the enhancement-55 is implemented). See:
41+
-# https://github.com/keylime/enhancements/blob/master/55_revocation_actions_without_python.md
42+
-#
43+
-# This feature is deprecated and will be removed on next major release
44+
-legacy-python-actions = []
45+
46+
[package.metadata.deb]
47+
section = "net"
48+
--- a/keylime-push-model-agent/Cargo.toml 2025-08-06 10:13:43.759016863 +0200
49+
+++ b/keylime-push-model-agent/Cargo.toml 2025-08-06 10:14:02.665288860 +0200
50+
@@ -28,14 +28,12 @@
51+
[dev-dependencies]
52+
actix-rt.workspace = true
53+
tempfile.workspace = true
54+
-wiremock = {version = "0.6"}
55+
56+
57+
[features]
58+
# The features enabled by default
59+
default = []
60+
testing = []
61+
-legacy-python-actions = []
62+
63+
[package.metadata.deb]
64+
section = "net"
65+
--- a/keylime-push-model-agent/src/state_machine.rs 2025-08-06 10:16:06.677153521 +0200
66+
+++ b/keylime-push-model-agent/src/state_machine.rs 2025-08-06 10:18:49.944060220 +0200
67+
@@ -229,6 +229,7 @@
68+
69+
#[cfg(test)]
70+
#[cfg(feature = "testing")]
71+
+#[cfg(feature = "with-wiremock")]
72+
mod tpm_tests {
73+
use super::*;
74+
use crate::attestation::{AttestationClient, NegotiationConfig};
75+
--- a/keylime-push-model-agent/src/attestation.rs 2025-08-06 10:21:35.514185935 +0200
76+
+++ b/keylime-push-model-agent/src/attestation.rs 2025-08-06 10:22:19.399032540 +0200
77+
@@ -210,6 +210,7 @@
78+
}
79+
80+
#[cfg(test)]
81+
+#[cfg(feature = "with-wiremock")]
82+
mod tests {
83+
use super::*;
84+
use std::fs::File;
85+
--- a/keylime/src/resilient_client.rs 2025-08-06 11:11:57.994406294 +0200
86+
+++ b/keylime/src/resilient_client.rs 2025-08-06 11:12:25.077633103 +0200
87+
@@ -137,6 +137,7 @@
88+
}
89+
90+
#[cfg(test)]
91+
+#[cfg(feature = "with-wiremock")]
92+
mod tests {
93+
use super::*;
94+
use reqwest::header;

‎rpm/fedora/keylime-agent-rust.spec‎

Lines changed: 48 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,7 @@
44

55
%global crate keylime_agent
66

7-
# On Fedora-38 and current Rawhide, it is not possible to build due to missing
8-
# dependency base64 version 0.13 (required by rust-tss-esapi)
9-
# Also due to https://github.com/tpm2-software/tpm2-tools/issues/3210,
10-
# tpm2-tools is currently broken.
11-
# Use vendored dependencies for all Fedora versions.
7+
# Use vendored dependencies for all Fedora versions when building in Copr.
128
%global bundled_rust_deps 1
139

1410
%global __brp_mangle_shebangs_exclude_from ^/usr/src/debug/.*$
@@ -35,7 +31,7 @@ Summary: Rust agent for Keylime
3531
# Unlicense or MIT
3632
# zlib or ASL 2.0 or MIT
3733
#
38-
License: ASL 2.0 and BSD and MIT
34+
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
3935
URL: https://github.com/keylime/rust-keylime/
4036
Source0: rust-keylime-v%{version}.tar.gz
4137
# The vendor tarball is created using cargo-vendor-filterer to remove Windows
@@ -50,10 +46,11 @@ Source0: rust-keylime-v%{version}.tar.gz
5046
# --exclude-crate-path "libloading#tests"
5147
# tar jcf rust-keylime-%%{version}-vendor.tar.xz vendor
5248
Source1: rust-keylime-vendor.tar.xz
53-
## Patches for building from system Rust libraries (Fedora)
54-
# Fix picky-asn1-der and picky-asn1-x509 to use available versions
55-
# Drop completely the legacy-python-actions feature
56-
Patch1: rust-keylime-metadata.patch
49+
## (0-99) General patches
50+
# Drop deprecated features and workaround unavailable components
51+
Patch0: rust-keylime-metadata.patch
52+
## (100-199) Patches for building from system Rust libraries (Fedora)
53+
## (200+) Patches for building from vendored Rust libraries (RHEL)
5754

5855
ExclusiveArch: %{rust_arches}
5956

@@ -62,7 +59,7 @@ Requires: util-linux-core
6259

6360
# The keylime-base package provides the keylime user creation. It is available
6461
# from Fedora 36
65-
%if 0%{?fedora} >= 36
62+
%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
6663
Requires: keylime-base
6764
%endif
6865

@@ -72,23 +69,44 @@ BuildRequires: tpm2-tss-devel
7269
BuildRequires: clang
7370
BuildRequires: rust-packaging >= 21-2
7471

75-
# Virtual Provides to support swapping between Python and Rust implementation
72+
# Virtual Provides to support swapping between different agent implementations
7673
Provides: keylime-agent
7774
Conflicts: keylime-agent
7875

7976
%description
8077
Rust agent for Keylime
8178

79+
%package push
80+
Summary: Rust push-model agent for Keylime
81+
Requires: tpm2-tss
82+
Requires: util-linux-core
83+
84+
# The keylime-base package provides the keylime user creation. It is available
85+
# from Fedora 36
86+
%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
87+
Requires: keylime-base
88+
%endif
89+
90+
# Virtual Provides to support swapping between pull and push model agents
91+
Provides: keylime-agent
92+
Conflicts: keylime-agent
93+
94+
%description push
95+
Rust push-model agent for Keylime
96+
8297
%prep
8398
%autosetup -n rust-keylime-%{version} -N %{?bundled_rust_deps:-a1}
99+
%autopatch -M 99 -p1
84100
%if 0%{?bundled_rust_deps}
85-
%autopatch -m 100 -p1
86-
# Source1 contains vendored dependencies
101+
# Source1 is vendored dependencies
87102
%cargo_prep -v vendor
88-
%cargo_generate_buildrequires
103+
# Add back if any patch added to the range, do not forget the %
104+
# autopatch -m 200 -p1
89105
%else
90-
%autopatch -M 99 -p1
106+
# Add back if any patch added to the range, do not forget the %
107+
# autopatch -m 100 -M 199 -p1
91108
%cargo_prep
109+
%generate_buildrequires
92110
%cargo_generate_buildrequires
93111
%endif
94112

@@ -117,6 +135,9 @@ install -Dpm 644 ./dist/systemd/system/keylime_agent.service \
117135
install -Dpm 644 ./dist/systemd/system/var-lib-keylime-secure.mount \
118136
%{buildroot}%{_unitdir}/var-lib-keylime-secure.mount
119137

138+
install -Dpm 644 ./dist/systemd/system/keylime_push_model_agent.service \
139+
%{buildroot}%{_unitdir}/keylime_push_model_agent.service
140+
120141
# Setting up the agent to use keylime:keylime user/group after dropping privileges.
121142
cat > %{buildroot}/%{_sysconfdir}/keylime/agent.conf.d/001-run_as.conf << EOF
122143
[agent]
@@ -129,6 +150,9 @@ install -Dpm 0755 \
129150
install -Dpm 0755 \
130151
-t %{buildroot}%{_bindir} \
131152
./target/release/keylime_ima_emulator
153+
install -Dpm 0755 \
154+
-t %{buildroot}%{_bindir} \
155+
./target/release/keylime_push_model_agent
132156

133157
%posttrans
134158
chmod 500 %{_sysconfdir}/keylime/agent.conf.d
@@ -161,6 +185,14 @@ chown -R keylime:keylime %{_sysconfdir}/keylime
161185
%{_bindir}/keylime_agent
162186
%{_bindir}/keylime_ima_emulator
163187

188+
%files push
189+
%license LICENSE
190+
%license LICENSE.dependencies
191+
%license cargo-vendor.txt
192+
%doc README.md
193+
%{_bindir}/keylime_push_model_agent
194+
%{_unitdir}/keylime_push_model_agent.service
195+
164196
%if %{with check}
165197
%check
166198
%cargo_test

0 commit comments

Comments
 (0)