File vault.spec of Package vault

#
# spec file for package vault
#
# Copyright (c) 2023 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via https://bugs.opensuse.org/
#


%define __arch_install_post export NO_BRP_STRIP_DEBUG=true

%define server_service_name vault.service
%define agent_service_name vault-agent.service
%define configdir_name vault.d
%define statedir_name vault

Name:           vault
Version:        1.16.0
Release:        0
Summary:        Secrets management, encryption as a service, and privileged access management
License:        BSL-1.1
URL:            https://github.com/hashicorp/vault
Group:          Productivity/Security
Source:         %{name}-%{version}.tar.gz
Source1:        vendor.tar.gz
Source2:        ui-%{version}.tar.gz
Source3:        %{name}-agent.service
Source4:        %{name}-agent.hcl.sample
BuildRequires:  go >= 1.20
BuildRequires:  user(vault)

%description
Vault is a tool for securely accessing secrets. A secret is anything that you
want to tightly control access to, such as API keys, passwords, certificates,
and more. Vault provides a unified interface to any secret, while providing
tight access control and recording a detailed audit log.

A modern system requires access to a multitude of secrets: database
credentials, API keys for external services, credentials for service-oriented
architecture communication, etc. Understanding who is accessing what secrets is
already very difficult and platform-specific. Adding on key rolling, secure
storage, and detailed audit logs is almost impossible without a custom
solution. This is where Vault steps in.

The key features of Vault are:
- Secure Secret Storage: Arbitrary key/value secrets can be stored in Vault.
  Vault encrypts these secrets prior to writing them to persistent storage, so
  gaining access to the raw storage isn't enough to access your secrets. Vault
  can write to disk, Consul, and more.
- Dynamic Secrets: Vault can generate secrets on-demand for some systems, such
  as AWS or SQL databases. For example, when an application needs to access an
  S3 bucket, it asks Vault for credentials, and Vault will generate an AWS
  keypair with valid permissions on demand. After creating these dynamic secrets,
  Vault will also automatically revoke them after the lease is up.
- Data Encryption: Vault can encrypt and decrypt data without storing it. This
  allows security teams to define encryption parameters and developers to store
  encrypted data in a location such as a SQL database without having to design
  their own encryption methods.
- Leasing and Renewal: All secrets in Vault have a lease associated with them.
  At the end of the lease, Vault will automatically revoke that secret. Clients
  are able to renew leases via built-in renew APIs.
- Revocation: Vault has built-in support for secret revocation. Vault can
  revoke not only single secrets, but a tree of secrets, for example, all
  secrets read by a specific user, or all secrets of a particular type.
  Revocation assists in key rolling as well as locking down systems in the case
  of an intrusion.

%package -n %{name}-server
Summary:        Hashicorp Vault Server
BuildArch:      noarch
Requires:       %{name} = %{version}
# Require the system user and group
Requires(pre):  user(vault)
Requires(pre):  group(vault)
# agent and server conflict
Conflicts:      %{name}-agent

%description -n %{name}-server
Files required to run a Hashicorp Vault server

%package -n %{name}-agent
Summary:        Hashicorp Vault Agent
BuildArch:      noarch
Requires:       %{name} = %{version}
# Require the system user and group
Requires(pre):  user(vault)
Requires(pre):  group(vault)
# agent and server conflict
Conflicts:      %{name}-server

%description -n %{name}-agent
Files required to run a Hashicorp Vault agent

%package -n %{name}-mysql-database-plugin
Summary:        The %{name} database plugin for MySQL

%description -n %{name}-mysql-database-plugin
Vault database plugin for MySQL

%package -n %{name}-mysql-legacy-database-plugin
Summary:        The %{name} database plugin for MySQL Legacy

%description -n %{name}-mysql-legacy-database-plugin
Vault database plugin for MySQL Legacy

%package -n %{name}-cassandra-database-plugin
Summary:        The %{name} database plugin for Cassandra

%description -n %{name}-cassandra-database-plugin
Vault database plugin for Cassandra

%package -n %{name}-influxdb-database-plugin
Summary:        The %{name} database plugin for InfluxDB

%description -n %{name}-influxdb-database-plugin
Vault database plugin for InfluxDB

%package -n %{name}-postgresql-database-plugin
Summary:        The %{name} database plugin for PostgreSQL

%description -n %{name}-postgresql-database-plugin
Vault database plugin for PostgreSQL

%package -n %{name}-mssql-database-plugin
Summary:        The %{name} database plugin for MS SQL

%description -n %{name}-mssql-database-plugin
Vault database plugin for MS SQL

%package -n %{name}-hana-database-plugin
Summary:        The %{name} database plugin for HANA

%description -n %{name}-hana-database-plugin
Vault database plugin for HANA

%package -n %{name}-mongodb-database-plugin
Summary:        The %{name} database plugin for MongoDB

%description -n %{name}-mongodb-database-plugin
Vault database plugin for MongoDB

%prep
%autosetup -p 1 -a 1
%setup -T -D -q -a 2

# make target static-assets-dir:
mkdir -p ./http/web_ui

%build

cd api
API_PACKAGES="$(go list ./... | grep -v vendor/)"
go generate $API_PACKAGES
cd ../sdk
SDK_PACKAGES="$(go list ./... | grep -v vendor/)"
go generate $SDK_PACKAGES
cd ..

DATE_FMT="+%%Y-%%m-%%dT%%H:%%M:%%SZ"
BUILD_DATE=$(date -u -d "@${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u -r "${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u "${DATE_FMT}")
go build \
   -mod=vendor \
   -buildmode=pie \
   -ldflags=" \
    -X github.com/hashicorp/vault/version.GitCommit=v%{version} \
    -X github.com/hashicorp/vault/version.BuildDate=${BUILD_DATE}" \
   -tags="vault ui" \
   -o bin/%{name} .

#
# database plugins
#

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/mysql-database-plugin ./plugins/database/mysql/mysql-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/mysql-legacy-database-plugin ./plugins/database/mysql/mysql-legacy-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/cassandra-database-plugin ./plugins/database/cassandra/cassandra-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/influxdb-database-plugin ./plugins/database/influxdb/influxdb-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/postgresql-database-plugin ./plugins/database/postgresql/postgresql-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/mssql-database-plugin ./plugins/database/mssql/mssql-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/hana-database-plugin ./plugins/database/hana/hana-database-plugin

CGO_ENABLED=0 go build \
   -mod=vendor \
   -buildmode=pie \
   -o bin/mongodb-database-plugin ./plugins/database/mongodb/mongodb-database-plugin

%install
# Install the binary.
install -D -m 0755 bin/%{name} %{buildroot}/%{_bindir}/%{name}

# server systemd unit file
install -D -m 0644 .release/linux/package/usr/lib/systemd/system/%{server_service_name} %{buildroot}%{_unitdir}/%{server_service_name}

# agent systemd unit file
install -D -m 0644 %{SOURCE3} %{buildroot}%{_unitdir}/%{agent_service_name}

# configuration in /etc/vault.d/
install -d -m 0755 %{buildroot}%{_sysconfdir}/%{configdir_name}/
install -D -m 0644 .release/linux/package/etc/%{configdir_name}/%{name}.env %{buildroot}%{_sysconfdir}/%{configdir_name}/%{name}.env
install -D -m 0644 .release/linux/package/etc/%{configdir_name}/%{name}.env %{buildroot}%{_sysconfdir}/%{configdir_name}/%{name}-agent.env

# agent configuration example
cp %{SOURCE4} .

# fix path in sample configuration
cp .release/linux/package/etc/%{configdir_name}/%{name}.hcl %{name}.hcl.sample
sed -i 's|/opt/%{name}|/var/lib/%{name}|g' %{name}.hcl.sample

# directory in /var/lib/
install -d -m 0755 %{buildroot}%{_sharedstatedir}/%{statedir_name}

# database plugins
for plugin in \
        mysql-database-plugin \
        mysql-legacy-database-plugin \
        cassandra-database-plugin \
        influxdb-database-plugin \
        postgresql-database-plugin \
        mssql-database-plugin \
        hana-database-plugin \
        mongodb-database-plugin
do
        install -D -m 0755 bin/${plugin} %{buildroot}/%{_bindir}/%{name}-${plugin}
done

%pre -n %{name}-server
%service_add_pre %{server_service_name}

%pre -n %{name}-agent
%service_add_pre %{agent_service_name}

%post -n %{name}-server
%service_add_post %{server_service_name}

%post -n %{name}-agent
%service_add_post %{agent_service_name}

%preun -n %{name}-server
%service_del_preun %{server_service_name}

%preun -n %{name}-agent
%service_del_preun %{agent_service_name}

%postun -n %{name}-server
%service_del_postun %{server_service_name}

%postun -n %{name}-agent
%service_del_postun %{agent_service_name}

%check

%files
%doc README.md
%license LICENSE
%{_bindir}/%{name}

%files -n %{name}-server
%{_unitdir}/%{server_service_name}
%dir %attr(755,%{name}, %{name}) %{_sysconfdir}/%{configdir_name}/
%defattr(0644, %{name}, %{name})
%config(noreplace) %{_sysconfdir}/%{configdir_name}/%{name}.env
%doc %{name}.hcl.sample

%files -n %{name}-agent
%{_unitdir}/%{agent_service_name}
%dir %attr(755,%{name}, %{name}) %{_sysconfdir}/%{configdir_name}/
%defattr(0644, %{name}, %{name})
%config(noreplace) %{_sysconfdir}/%{configdir_name}/%{name}-agent.env
%doc %{name}-agent.hcl.sample

%files -n %{name}-mysql-database-plugin
%{_bindir}/%{name}-mysql-database-plugin

%files -n %{name}-mysql-legacy-database-plugin
%{_bindir}/%{name}-mysql-legacy-database-plugin

%files -n %{name}-cassandra-database-plugin
%{_bindir}/%{name}-cassandra-database-plugin

%files -n %{name}-influxdb-database-plugin
%{_bindir}/%{name}-influxdb-database-plugin

%files -n %{name}-postgresql-database-plugin
%{_bindir}/%{name}-postgresql-database-plugin

%files -n %{name}-mssql-database-plugin
%{_bindir}/%{name}-mssql-database-plugin

%files -n %{name}-hana-database-plugin
%{_bindir}/%{name}-hana-database-plugin

%files -n %{name}-mongodb-database-plugin
%{_bindir}/%{name}-mongodb-database-plugin

%changelog