OpenPKG Specs: gnupg/gnupg.spec@0ba300bdf30a (annotated)

gnupg/gnupg.spec@0ba300bdf30a (annotated)

gnupg/gnupg.spec

Mon, 20 Apr 2009 19:22:00 +0200

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Mon, 20 Apr 2009 19:22:00 +0200
changeset 178: 0ba300bdf30a
parent 119: 0c4aca8434e1
child 286: 552d1939222f
permissions: -rw-r--r--

Change unfortunate but partly useful overreaching security tradeoff.
The principle of allocating each running process an individual system
user and group can have security benefits, however maintining a plethora
of users, groups, processes, file modes, file permissions, and even
nonportable file ACLs on a host serving from a hundred processes has
some security disadvantages. This tradeoff is even worse for systems
like OpenPKG which benefit from administration transparency through the
use of minimal system intrusion and only three usage privilege levels.

 ##
 ##  gnupg.spec -- OpenPKG RPM Package Specification
 ##  Copyright (c) 2000-2008 OpenPKG Foundation e.V. <http://openpkg.net/>
 ##
 ##  Permission to use, copy, modify, and distribute this software for
 ##  any purpose with or without fee is hereby granted, provided that
 ##  the above copyright notice and this permission notice appear in all
 ##  copies.
 ##
 ##  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 ##  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 ##  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 ##  IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR
 ##  CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 ##  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 ##  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 ##  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 ##  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 ##  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 ##  OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 ##  SUCH DAMAGE.
 ##
 #   package information
 Name:         gnupg
 Summary:      GNU Privacy Guard
 URL:          http://www.gnupg.org/
 Vendor:       Werner Koch
 Packager:     OpenPKG Foundation e.V.
 Distribution: OpenPKG Community
 Class:        PLUS
 Group:        PGP
 License:      GPL
 Version:      2.0.11
 Release:      20090408
 #   package options
 %option       with_curl  yes
 %option       with_ldap  no
 %option       with_idea  no
 #   list of sources
 Source0:      ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-%{version}.tar.bz2
 Patch0:       gnupg.patch
 #   build information
 Prefix:       %{l_prefix}
 BuildRoot:    %{l_buildroot}
 BuildPreReq:  OpenPKG, openpkg >= 20040130, make
 PreReq:       OpenPKG, openpkg >= 20040130, pinentry
 BuildPreReq:  gcrypt >= 1.2.3, libksba >= 1.0.2, libassuan >= 1.0.2, gpg-error >= 1.4
 PreReq:       gcrypt >= 1.2.3, libksba >= 1.0.2, libassuan >= 1.0.2, gpg-error >= 1.4
 BuildPreReq:  zlib, bzip2, readline, pth, libiconv
 PreReq:       zlib, bzip2, readline, pth, libiconv
 %if "%{with_curl}" == "yes"
 BuildPreReq:  curl, openssl
 PreReq:       curl, openssl
 %endif
 %if "%{with_ldap}" == "yes"
 BuildPreReq:  openldap, openssl
 PreReq:       openldap, openssl
 %endif
 %if "%{with_idea}" == "yes"
 BuildPreReq:  gcrypt::with_idea
 PreReq:       gcrypt::with_idea
 %endif
 AutoReq:      no
 AutoReqProv:  no
 %description
     GnuPG (GNU Privacy Guard) is a GNU utility for encrypting data and
     creating digital signatures. GnuPG has advanced key management
     capabilities and is compliant with the proposed OpenPGP Internet
     standard described in RFC2440. Since GnuPG doesn't use any patented
     algorithm, it is not compatible with any version of PGP2 (PGP2.x
     uses only IDEA, patented worldwide).
 %track
     prog gnupg = {
         version   = %{version}
         url       = ftp://ftp.gnupg.org/gcrypt/gnupg/
         regex     = gnupg-(2\.__VER__)\.tar\.(gz|bz2)
     }
 %prep
     %setup -q -n gnupg-%{version}
     %patch -p0
     chmod a+rx scripts/install-sh
     %{l_shtool} subst \
         -e 's;PRINTABLE_OS_NAME;"%{l_openpkg_release}";g' \
         g10/armor.c
 %build
     #   configure program
     export LIBS=""
     case "%{l_platform -t}" in
         *-sunos* ) LIBS="$LIBS -lsocket -lnsl" ;;
     esac
     echo "int main(int argc, char *argv[]) { return 0; }" >dummy.c
     for lib in termcap termlib curses ncurses; do
         rc=0; %{l_cc} -o dummy dummy.c -l$lib >/dev/null 2>&1 || rc=1
         if [ $rc -eq 0 ]; then LIBS="$LIBS -l$lib"; break; fi
     done
 %if "%{with_curl}" == "yes" || "%{with_ldap}" == "yes"
     LIBS="$LIBS -lssl -lcrypto"
 %endif
 %if "%{with_curl}" == "yes"
     LIBS="$LIBS -lz"
 %endif
     LIBS="$LIBS -liconv"
     export CC="%{l_cc}"
     export CFLAGS="%{l_cflags -O}"
     export CPPFLAGS="%{l_cppflags}"
 %if "%{with_idea}" == "yes"
     export CPPFLAGS="-DUSE_IDEA $CPPFLAGS"
 %endif
     export LDFLAGS="%{l_ldflags}"
     ./configure \
         --prefix=%{l_prefix} \
         --libexecdir=%{l_prefix}/libexec/gnupg \
         --mandir=%{l_prefix}/man \
         --infodir=%{l_prefix}/info \
         --with-zlib=%{l_prefix} \
         --with-bzip2=%{l_prefix} \
         --with-readline=%{l_prefix} \
         --with-libiconv-prefix=%{l_prefix} \
         --with-gpg-error-prefix=%{l_prefix} \
         --with-libgcrypt-prefix=%{l_prefix} \
         --with-libassuan-prefix=%{l_prefix} \
         --with-ksba-prefix=%{l_prefix} \
         --with-pth-prefix=%{l_prefix} \
         --with-agent-pgm=%{l_prefix}/bin/gpg-agent \
         --with-pinentry-pgm=%{l_prefix}/bin/pinentry \
         --with-dirmngr-pgm=%{l_prefix}/bin/dirmngr \
         --with-included-regex \
 %if "%{with_curl}" == "yes"
         --with-libcurl=%{l_prefix} \
 %else
         --without-libcurl \
 %endif
         --without-included-gettext \
         --without-libintl-prefix \
         --disable-nls \
         --disable-scdaemon \
         --enable-generic \
         --enable-finger \
         --enable-hkp \
 %if "%{with_ldap}" == "yes"
         --enable-ldap \
 %else
         --disable-ldap \
 %endif
 %if "%{with_curl}" == "yes"
         --with-libcurl=%{l_prefix} \
 %else
         --without-libcurl \
 %endif
         --enable-exec \
         --enable-keyserver-helpers \
         --with-mailprog="%{l_prefix}/sbin/sendmail" \
         --disable-mailto
     #   build program
     %{l_make} %{l_mflags}
 %install
     #   install program
     rm -rf $RPM_BUILD_ROOT
     %{l_make} %{l_mflags} install AM_MAKEFLAGS="DESTDIR=$RPM_BUILD_ROOT"
     #   provide unversioned names
     ln  $RPM_BUILD_ROOT%{l_prefix}/bin/gpg2 \
         $RPM_BUILD_ROOT%{l_prefix}/bin/gpg
     ln  $RPM_BUILD_ROOT%{l_prefix}/bin/gpgv2 \
         $RPM_BUILD_ROOT%{l_prefix}/bin/gpgv
     ln  $RPM_BUILD_ROOT%{l_prefix}/man/man1/gpg2.1 \
         $RPM_BUILD_ROOT%{l_prefix}/man/man1/gpg.1
     ln  $RPM_BUILD_ROOT%{l_prefix}/man/man1/gpgv2.1 \
         $RPM_BUILD_ROOT%{l_prefix}/man/man1/gpgv.1
     #   strip down and post-adjust installation files
     strip $RPM_BUILD_ROOT%{l_prefix}/bin/* 2>/dev/null || true
     strip $RPM_BUILD_ROOT%{l_prefix}/libexec/gnupg/* 2>/dev/null || true
     rm -f $RPM_BUILD_ROOT%{l_prefix}/info/dir
     rm -f $RPM_BUILD_ROOT%{l_prefix}/man/man1/scdaemon.1
     mv $RPM_BUILD_ROOT%{l_prefix}/bin/gpgsm-gencert.sh \
        $RPM_BUILD_ROOT%{l_prefix}/bin/gpgsm-gencert
     mv $RPM_BUILD_ROOT%{l_prefix}/man/man1/gpgsm-gencert.sh.1 \
        $RPM_BUILD_ROOT%{l_prefix}/man/man1/gpgsm-gencert.1
     #   determine installation files
     %{l_rpmtool} files -v -ofiles -r$RPM_BUILD_ROOT \
         %{l_files_std} \
         '%attr(4755,%{l_susr},%{l_mgrp}) %{l_prefix}/bin/gpg' \
         '%attr(4755,%{l_susr},%{l_mgrp}) %{l_prefix}/bin/gpg2'
 %files -f files
 %clean
     rm -rf $RPM_BUILD_ROOT

OpenPKG Specs / annotate

gnupg/gnupg.spec@0ba300bdf30a (annotated)

gnupg/gnupg.spec