# The daemon's gRPC code is generated from proto/ui.proto at build time, and
# Fedora no longer ships protoc-gen-go-grpc. This is the release upstream CI
# generates with (.github/workflows/go.yml at v1.8.0); its output needs
# grpc-go >= 1.32, which is what the daemon vendors.
%global grpcgen_version 1.3.0
# Not using %%gometa, which would define this.
%global gobuilddir %{_builddir}/_gobuild

Name:           opensnitch
Version:        1.8.0
Release:        1%{?dist}
Summary:        Interactive application firewall for GNU/Linux

# The daemon is GPL-3.0-or-later and statically links the vendored Go modules
# below (go_vendor_license report, Fedora 44, 2026-10-29):
#   Apache-2.0:   google/nftables, varlink/go, vishvananda/netlink,
#                 vishvananda/netns, google.golang.org/genproto, grpc
#   BSD-3-Clause: fsnotify, golang/protobuf, go-cmp, gopacket, google/uuid,
#                 golang.org/x/{net,sync,sys,text}, google.golang.org/protobuf
#   MIT:          cilium/ebpf, josharian/native, mdlayher/{netlink,socket}
# The eBPF objects are built from GPL-3.0-or-later sources, libbpf's helper
# headers (LGPL-2.1 OR BSD-2-Clause) and the kernel's own headers
# (GPL-2.0-only, with inline code). They declare "GPL" to the kernel.
# FIXME for review: GPL-3.0-or-later code compiled together with
# GPL-2.0-only inline kernel code is a known incompatibility; ask upstream
# whether the eBPF sources can be GPL-2.0-or-later.
%global ebpf_license GPL-3.0-or-later AND GPL-2.0-only AND (LGPL-2.1-only OR BSD-2-Clause)
License:        GPL-3.0-or-later AND Apache-2.0 AND BSD-3-Clause AND MIT AND %{ebpf_license}
URL:            https://github.com/evilsocket/opensnitch
Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
# go_vendor_archive create --config go-vendor-tools.toml \
#     -O opensnitch-%%{version}-vendor.tar.bz2 opensnitch-%%{version}/daemon
Source1:        %{name}-%{version}-vendor.tar.bz2
Source2:        go-vendor-tools.toml
# Build-time tool only; nothing from it is installed.
Source3:        https://github.com/grpc/grpc-go/archive/refs/tags/cmd/protoc-gen-go-grpc/v%{grpcgen_version}.tar.gz#/grpc-go-protoc-gen-go-grpc-%{grpcgen_version}.tar.gz

ExclusiveArch:  %{golang_arches}

BuildRequires:  golang
BuildRequires:  go-rpm-macros
BuildRequires:  go-vendor-tools
BuildRequires:  gcc
BuildRequires:  make
BuildRequires:  pkgconfig(libnetfilter_queue)
BuildRequires:  systemd-rpm-macros
# Protocol generation, Go and Python
BuildRequires:  protobuf-compiler
BuildRequires:  golang-google-protobuf
BuildRequires:  golang-google-protobuf-devel
BuildRequires:  python3-grpcio-tools
# eBPF
BuildRequires:  clang
BuildRequires:  llvm
BuildRequires:  kernel-devel
# UI
BuildRequires:  python3-devel
BuildRequires:  qt6-linguist
BuildRequires:  desktop-file-utils
BuildRequires:  appstream

Requires:       logrotate
Suggests:       %{name}-ui = %{version}-%{release}

# Linked statically, as Go does; listed so security tooling can find them.
Provides:       bundled(golang(github.com/cilium/ebpf)) = 0.19.0
Provides:       bundled(golang(github.com/fsnotify/fsnotify)) = 1.4.7
Provides:       bundled(golang(github.com/golang/protobuf)) = 1.5.0
Provides:       bundled(golang(github.com/google/go-cmp)) = 0.6.0
Provides:       bundled(golang(github.com/google/gopacket)) = 1.1.19
Provides:       bundled(golang(github.com/google/nftables)) = 0.2.0
Provides:       bundled(golang(github.com/google/uuid)) = 1.3.0
Provides:       bundled(golang(github.com/josharian/native)) = 1.1.0
Provides:       bundled(golang(github.com/mdlayher/netlink)) = 1.7.2
Provides:       bundled(golang(github.com/mdlayher/socket)) = 0.5.0
Provides:       bundled(golang(github.com/varlink/go)) = 0.4.0
Provides:       bundled(golang(github.com/vishvananda/netlink)) = 1.3.0
Provides:       bundled(golang(github.com/vishvananda/netns)) = 0.0.4
Provides:       bundled(golang(golang.org/x/net)) = 0.38.0
Provides:       bundled(golang(golang.org/x/sync)) = 0.12.0
Provides:       bundled(golang(golang.org/x/sys)) = 0.31.0
Provides:       bundled(golang(golang.org/x/text)) = 0.23.0
Provides:       bundled(golang(google.golang.org/genproto)) = 0^20190819git24fa4b2
Provides:       bundled(golang(google.golang.org/grpc)) = 1.32.0
Provides:       bundled(golang(google.golang.org/protobuf)) = 1.26.0

%global _description %{expand:
OpenSnitch is an interactive application firewall. Whenever a program opens
a network connection, the daemon asks the user whether to allow or deny it.
Rules can match on the executable, its arguments, user, destination host,
IP, port, or a combination of these, and last once, until restart, or
forever. Process attribution uses eBPF where the kernel supports it, with
a /proc fallback.}

%description %{_description}

This package contains the opensnitchd daemon, its systemd service and the
eBPF programs it loads.

%package        ui
Summary:        Graphical prompt and rules manager for OpenSnitch
License:        GPL-3.0-or-later
BuildArch:      noarch
Requires:       %{name} = %{version}-%{release}
Requires:       hicolor-icon-theme
Requires:       python3-grpcio
Requires:       python3-protobuf
Requires:       python3-pyqt6
Requires:       python3-slugify
Requires:       python3-packaging
Requires:       qt6-qtbase
# Optional at runtime: desktop notifications. Upstream also suggests
# pyinotify (live .desktop file updates) and qt-material (themes), neither
# of which Fedora ships; the UI runs without them.
Recommends:     python3-notify2

%description    ui %{_description}

This package contains opensnitch-ui, which shows the connection prompts,
live connections, statistics and the rules editor. It talks to the daemon
over a local gRPC socket.

%prep
%autosetup -p1
tar -C daemon -xf %{SOURCE1}
tar -xf %{SOURCE3}
# The main module's licence lives one directory up; go_vendor_license looks
# for it next to go.mod.
cp -p LICENSE daemon/

# The daemon is installed to /usr/bin, not /usr/local/bin.
sed -i 's|/usr/local/bin/opensnitchd|%{_bindir}/opensnitchd|' \
    daemon/data/init/opensnitchd.service

pushd ui
# Desktop files, icons and metainfo are installed in %%install; the absolute
# data_files paths would land under /usr/usr in a wheel. The KDE 5
# kservices entry is not shipped.
sed -i '/data_files=\[/,/\],$/d' setup.py
# Upstream's tests target PyQt5 and a module layout that no longer exists,
# and find_packages() would install them as a top-level "tests" package.
rm -r tests
# A library module, not a script.
sed -i '1{/^#!/d}' opensnitch/utils/duration/duration.py
# Generated with protobuf < 3.20; regenerated below with Fedora's grpc_tools.
rm -f opensnitch/proto/pre3200/ui_pb2.py opensnitch/proto/pre3200/ui_pb2_grpc.py
popd

%generate_buildrequires
cd daemon
%go_vendor_license_buildrequires -c %{SOURCE2}
cd ../ui
%pyproject_buildrequires

%build
# protoc-gen-go-grpc, from source, against Fedora's google.golang.org/protobuf
mkdir -p _gopath/src/google.golang.org _bin
ln -s $PWD/grpc-go-cmd-protoc-gen-go-grpc-v%{grpcgen_version} \
    _gopath/src/google.golang.org/grpc
GO111MODULE=off GOPATH=$PWD/_gopath:%{gopath} \
    go build -o _bin/protoc-gen-go-grpc google.golang.org/grpc/cmd/protoc-gen-go-grpc

# Go protocol for the daemon
protoc --plugin=protoc-gen-go-grpc=$PWD/_bin/protoc-gen-go-grpc \
    -I proto proto/ui.proto \
    --go_out=daemon/ui/protocol --go_opt=paths=source_relative \
    --go-grpc_out=daemon/ui/protocol --go-grpc_opt=paths=source_relative

# Python protocol for the UI. Fedora's python3-protobuf decides which copy
# opensnitch/proto/__init__.py loads: pre3200/ below 3.20, the shipped
# top-level copy from 3.20 on.
%{python3} -m grpc_tools.protoc -I proto \
    --python_out=ui/opensnitch/proto/pre3200 \
    --grpc_python_out=ui/opensnitch/proto/pre3200 proto/ui.proto
sed -i 's/^import ui_pb2/from . import ui_pb2/' \
    ui/opensnitch/proto/ui_pb2_grpc.py ui/opensnitch/proto/pre3200/ui_pb2_grpc.py

# Daemon
pushd daemon
%global gomodulesmode GO111MODULE=on
%gobuild -o %{gobuilddir}/bin/opensnitchd .
popd

# eBPF programs, against the buildroot's kernel-devel tree. These use
# kernel-internal structures (not CO-RE), as upstream's do. Upstream builds
# against 6.0; the kernel's own build adds these flags, and 7.x headers need
# them: anonymous tagged struct members (-fms-extensions; without it
# struct filename and socket_lock_t lose members) and, on x86, fentry.
kdir=$(ls -d /usr/src/kernels/* | sort -V | tail -1)
ebpf_flags="-fms-extensions -Wno-microsoft-anon-tag"
%ifarch x86_64
ebpf_flags="$ebpf_flags -DCC_USING_FENTRY"
%endif
%make_build -C ebpf_prog KERNEL_DIR=$kdir KERNEL_HEADERS=$kdir EXTRA_FLAGS="$ebpf_flags"
llvm-strip -g ebpf_prog/opensnitch*.o

# UI
make -C ui/i18n LRELEASE=lrelease-qt6
cd ui
%pyproject_wheel

%install
install -Dpm 0755 %{gobuilddir}/bin/opensnitchd %{buildroot}%{_bindir}/opensnitchd
install -Dpm 0644 daemon/data/init/opensnitchd.service \
    %{buildroot}%{_unitdir}/opensnitch.service
install -Dpm 0644 utils/packaging/daemon/deb/debian/opensnitch.logrotate \
    %{buildroot}%{_sysconfdir}/logrotate.d/opensnitch

install -d %{buildroot}%{_sysconfdir}/opensnitchd/rules
install -pm 0644 daemon/data/default-config.json daemon/data/system-fw.json \
    daemon/data/network_aliases.json %{buildroot}%{_sysconfdir}/opensnitchd/
install -pm 0600 daemon/data/rules/*.json %{buildroot}%{_sysconfdir}/opensnitchd/rules/
install -Dpm 0600 daemon/data/tasks/tasks.json \
    %{buildroot}%{_sysconfdir}/opensnitchd/tasks/tasks.json

install -d %{buildroot}%{_prefix}/lib/opensnitchd/ebpf
install -pm 0644 ebpf_prog/opensnitch*.o %{buildroot}%{_prefix}/lib/opensnitchd/ebpf/

cd daemon
%go_vendor_license_install -c %{SOURCE2}
cd ../ui
%pyproject_install
%pyproject_save_files -l opensnitch

desktop-file-install --dir=%{buildroot}%{_datadir}/applications \
    resources/opensnitch_ui.desktop
# Upstream starts the UI for every graphical login; the daemon's prompts
# need it running.
desktop-file-install --dir=%{buildroot}%{_sysconfdir}/xdg/autostart \
    resources/opensnitch_ui.desktop
install -Dpm 0644 resources/io.github.evilsocket.opensnitch.appdata.xml \
    %{buildroot}%{_metainfodir}/io.github.evilsocket.opensnitch.appdata.xml
install -Dpm 0644 resources/icons/opensnitch-ui.svg \
    %{buildroot}%{_datadir}/icons/hicolor/scalable/apps/opensnitch-ui.svg
for s in 48 64; do
    install -Dpm 0644 resources/icons/${s}x${s}/opensnitch-ui.png \
        %{buildroot}%{_datadir}/icons/hicolor/${s}x${s}/apps/opensnitch-ui.png
done

%check
cd daemon
%go_vendor_license_check -c %{SOURCE2} GPL-3.0-or-later AND Apache-2.0 AND BSD-3-Clause AND MIT
# The daemon reports its version and exits; proves it links and starts.
%{buildroot}%{_bindir}/opensnitchd -version | grep -Fx '%{version}'
# Each eBPF object must carry the kprobe sections the daemon attaches to.
llvm-objdump -h ../ebpf_prog/opensnitch.o | grep -q 'kprobe/tcp_v4_connect'
cd ../ui
desktop-file-validate %{buildroot}%{_datadir}/applications/opensnitch_ui.desktop
appstreamcli validate --no-net \
    %{buildroot}%{_metainfodir}/io.github.evilsocket.opensnitch.appdata.xml
# No usable upstream tests (see %%prep); import every module instead.
%pyproject_check_import -t

%post
%systemd_post opensnitch.service

%preun
%systemd_preun opensnitch.service

%postun
%systemd_postun_with_restart opensnitch.service

%files -f daemon/%{go_vendor_license_filelist}
%doc README.md
%{_bindir}/opensnitchd
%{_unitdir}/opensnitch.service
%{_prefix}/lib/opensnitchd/
%dir %{_sysconfdir}/opensnitchd
%dir %{_sysconfdir}/opensnitchd/rules
%dir %{_sysconfdir}/opensnitchd/tasks
%config(noreplace) %{_sysconfdir}/opensnitchd/*.json
%config(noreplace) %{_sysconfdir}/opensnitchd/rules/*.json
%config(noreplace) %{_sysconfdir}/opensnitchd/tasks/tasks.json
%config(noreplace) %{_sysconfdir}/logrotate.d/opensnitch

%files ui -f %{pyproject_files}
%{_bindir}/opensnitch-ui
%{_datadir}/applications/opensnitch_ui.desktop
%config(noreplace) %{_sysconfdir}/xdg/autostart/opensnitch_ui.desktop
%{_metainfodir}/io.github.evilsocket.opensnitch.appdata.xml
%{_datadir}/icons/hicolor/*/apps/opensnitch-ui.*

%changelog
* Thu Oct 29 2026 Morgan Hough <morgan.hough@gmail.com> - 1.8.0-1
- Initial package