Remove tpm-tools from runtime dependencies. Keep trousers for the
creation of the 'tss' user for now. Add python related dependencies.
Adjust the directory ownership for /var/lib/swtpm-localca to tss:root and
the mode flags to 0750. The new CA now may still be created as tss:tss but
users in the tss group will not have access to it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use SoftHSM to create a pkcs11 URI and then use the pkcs11 URI
to sign the certificate of a TPM 2.0 with this key using swtpm-localca.
This test case works with softhsm >= 2.3.0 on Fedora and should work
with a recent version of Ubuntu. If an error is encountered setting
up the softhsm2 environment, we just skip the test.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_setup.sh does not need to be owned by tss:tss and in the
Fedora package it's not even allowed. So remove the install hook
that was changing the ownership.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
We seem to be missing a dependency on selinux-policy-devel, so add it.
The name of the source tar has to be set to what 'make dist' produces.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Tie swtpm-tools updating to swtpm updating and vice versa by requiring
swtpm-tools the swtpm package to have the same version.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Install the private libswtpm_libtpms into $(libdir)/swtpm
rather than into the shared libaries directory.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The meaning of %bcond_without is that it enables a feature by default.
We want to buld with gnutls, so enable it.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Point the source URL in the rpm spec to github.com where in the future
the tar should be located.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement support for TPM2. Some of the capabilities are not supported yet in
this patch.
Extend the man pages with description for --tpm2.
Missing: configure should probe for needed API calls in libtpms
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Remove FreeBL support for swtpm since there will not be support
for FreeBL with TPM 2 in libtpms.
Since a lot of documentation shows --with-openssl, we leave that for
now.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Rather than sending two separate messages with the bare python 2
API, use the python twisted package to send the control and data
in one sendmsg() call. This avoids occasional test failures in
the ctrlchannel test case that is currently sending the data and
control part of the message in 2 steps, which can lead to the
recpient not seeing the whole message.
Add python-twisted as a build dependency to the rpm and Debian
builds and the .travis.yml.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use 'rpmbuild -ba --define "crypto_subsystem openssl" dist/swtpm.spec'
to build swtpm with openssl.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Replace the CUSE TPM with the new BSD implementation.
Update the license references and the license itself.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement a control channel for the 'chardev' swtpm that implements
a minimal set of control messages for now.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Remove the hardcodes tss user and group and to configure with
--with-tss-user=tss --with-tss-group=tss to set the tss user
and group to be used.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add a current spec file for usage with yum-builddep for installing
all the necessary build dependencies.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
