Name:           pinpam
Version:        0.0.5
Release:        2%{?dist}
Summary:        TPM2 backed PAM module and utility for pin-based authentication

License:        GPL-3.0-or-later
URL:            https://github.com/RazeLighter777/pinpam
Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
Source1:        pinpam-policy.conf

BuildRequires:  cargo
BuildRequires:  clang-devel
BuildRequires:  pkgconf-pkg-config
BuildRequires:  openssl-devel
BuildRequires:  tpm2-tss-devel
BuildRequires:  pam-devel
# For udev rules and tss group management
BuildRequires:  systemd-devel

# Ensure TPM2 TSS libraries are available at runtime
Requires:       tpm2-tss
# PAM is required
Requires:       pam

%description
TPM2 backed PAM module and utility for pin-based authentication.
It uses TPM2 to store and verify PINs, providing a secure way
to authenticate users.

%prep
%autosetup -n %{name}-%{version}

%build
export CARGO_HOME=$(pwd)/.cargo
cargo build --release --locked

%install
# Install the utility
install -Dpm 0755 target/release/pinutil %{buildroot}%{_bindir}/pinutil

# Install the PAM module
install -Dpm 0755 target/release/libpinpam.so %{buildroot}%{_libdir}/security/libpinpam.so

# Install the optional master-key PAM module for keyring integration
install -Dpm 0755 target/release/libpinpam_master_key.so %{buildroot}%{_libdir}/security/libpinpam_master_key.so

# Install the policy configuration (NOTE: filename must be 'policy' not 'policy.conf')
install -Dpm 0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pinpam/policy

# Install udev rules for TPM access (Setgid method support)
mkdir -p %{buildroot}%{_udevrulesdir}
cat > %{buildroot}%{_udevrulesdir}/70-pinpam-tpm.rules <<EOF
# TPM device access for tss group (required for pinpam)
KERNEL=="tpm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
KERNEL=="tpmrm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
EOF

%check
export CARGO_HOME=$(pwd)/.cargo
cargo test --release --locked

%post
# Reload udev rules and trigger for TPM devices specifically
udevadm control --reload-rules >/dev/null 2>&1 || :
udevadm trigger --subsystem-match=tpm >/dev/null 2>&1 || :

%postun
# Reload udev rules when the package is removed
udevadm control --reload-rules >/dev/null 2>&1 || :

%files
%license LICENSE.txt
%doc README.md
# Setgid tss allows regular users to interact with the TPM via pinutil
%attr(2755, root, tss) %{_bindir}/pinutil
%{_libdir}/security/libpinpam.so
%{_libdir}/security/libpinpam_master_key.so
%dir %{_sysconfdir}/pinpam
%config(noreplace) %{_sysconfdir}/pinpam/policy
%{_udevrulesdir}/70-pinpam-tpm.rules

%changelog
* Sat Aug 29 2026 Herwig Koeck <herwig.koeck@gmail.com> - 0.0.5-2
- Package the optional master-key PAM module
- Enable downstream integration with userspace keyrings

* Sat Aug 29 2026 Herwig Koeck <herwig.koeck@gmail.com> - 0.0.5-1
- Update to pinpam 0.0.5
- Add explicit clang and pkg-config build dependencies

* Sat Mar 28 2026 Bernhard Friedreich <friesoft@gmail.com> - 0.0.4-1
- Fix policy filename to match code expectations
- Add setuid bit to pinutil for TPM access