# SPDX-FileCopyrightText: (c) 2026 Daniel Hast
#
# SPDX-License-Identifier: Apache-2.0 OR MIT

%global with_selinux 1
%global modulename bwrap-restricted
%global selinuxtype targeted

Name:           bwrap-restricted
Version:        0.1.2
Release:        2
Summary:        %{name} exposes a restricted subset of bubblewrap's options.
License:        Apache-2.0 OR MIT
URL:            https://codeberg.org/HastD/%{name}
Source:         %{url}/archive/v%{gsub %{version} ~ -}.tar.gz

BuildArch:      noarch
BuildRequires:  meson >= 1.3.0
BuildRequires:  pandoc
BuildRequires:  python3-devel >= 3.11

Requires:       python3 >= 3.11
Requires:       bubblewrap

%if 0%{?with_selinux}
BuildRequires:  selinux-policy-devel
Recommends:     (%{name}-selinux if selinux-policy-%{selinuxtype})
%endif

%description
%{name} exposes a configurable, restricted subset of the interface to
Linux namespace functionality provided by bubblewrap.

%{name} acts as a wrapper around the `bwrap` executable; it parses the
arguments to `bwrap`, scans them for forbidden options, and executes `bwrap`
with the given arguments only if no forbidden options are present.
Additionally, extra options can be inserted between the options and the
command arguments.

%prep
%autosetup -n %{name}

%build
%if 0%{?with_selinux}
%meson -Dselinux=enabled
%else
%meson -Dselinux=disabled
%endif
%meson_build

%install
%meson_install

%files
%{_bindir}/%{name}
%config(noreplace) %{_sysconfdir}/%{name}
%license %{_defaultlicensedir}/%{name}
%{_mandir}/man1/%{name}.1*

%package shim
Summary:        Shim to use %{name} as a drop-in replacement for bwrap
Requires:       %{name} = %{version}-%{release}
BuildArch:      noarch

%description shim
Shim that makes %{_bindir}/bwrap into a symlink to %{_bindir}/%{name},
allowing %{name} to be used as a drop-in replacement (aside from any
restrictions imposed by the %{name} configuration).

%{name} exposes a configurable, restricted subset of the interface to
Linux namespace functionality provided by bubblewrap.

%files shim

%posttrans shim
mv %{_bindir}/bwrap %{_bindir}/bwrap-original
ln -s %{name} %{_bindir}/bwrap
if [ -e '%{_sysconfdir}/%{name}/config.toml' ]; then
    sed -i -e 's@"%{_bindir}/bwrap"@"%{_bindir}/bwrap-original"@g' %{_sysconfdir}/%{name}/config.toml
else
    echo 'bwrap_path = "%{_bindir}/bwrap-original"' > %{_sysconfdir}/%{name}/config.toml
fi

%postun shim
mv %{_bindir}/bwrap-original %{_bindir}/bwrap
if [ -e '%{_sysconfdir}/%{name}/config.toml' ]; then
    sed -i -e 's@"%{_bindir}/bwrap-original"@"%{_bindir}/bwrap"@g' %{_sysconfdir}/%{name}/config.toml
fi

%if 0%{?with_selinux}
%package selinux
Summary:        SELinux policies for %{name}
License:        GPL-2.0-or-later
Requires:       %{name} = %{version}-%{release}
BuildArch:      noarch

%description selinux
SELinux policy module for %{name}.

%{name} exposes a configurable, restricted subset of the interface to
Linux namespace functionality provided by bubblewrap.

%pre selinux
%selinux_relabel_pre -s %{selinuxtype}

%post selinux
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2

%postun selinux
if [ "$1" -eq 0 ]; then
    %selinux_modules_uninstall -s %{selinuxtype} %{modulename}
    %selinux_relabel_post -s %{selinuxtype}
fi

%posttrans selinux
%selinux_relabel_post -s %{selinuxtype}

%files selinux
%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
%{_datadir}/selinux/devel/include/distributed/%{modulename}.if
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
%endif # with_selinux

%changelog
* Sat Aug 29 2026 Daniel Hast <hast.daniel@protonmail.com> - v0.1.2
- Add SELinux policy and shim subpackages

* Tue Aug 25 2026 Daniel Hast <hast.daniel@protonmail.com> - v0.1.1
- Fix missing options

* Tue Aug 25 2026 Daniel Hast <hast.daniel@protonmail.com> - v0.1.0
- Initial RPM release