Skip to content

Commit 321ba2b

Browse files
reubenmillerreubenmiller
authored
Merge pull request #3514 from reubenmiller/feat-tedge-p11-server-packaging
feat: tedge-p11-server packaging
2 parents f177acc + a2ad761 commit 321ba2b

File tree

27 files changed

+647
-6
lines changed

27 files changed

+647
-6
lines changed

‎ci/build_scripts/package.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,11 @@ cmd_build() {
280280

281281
if [[ "$PACKAGE_TYPES" =~ tarball ]]; then
282282
build_tarball "tedge" "$TARGET" "tedge"
283+
284+
# Optionally build tedge-p11-server to allow users to package it
285+
if [[ " ${PACKAGES[*]} " =~ [[:space:]]tedge-p11-server[[:space:]] ]]; then
286+
build_tarball "tedge-p11-server" "$TARGET" "tedge-p11-server"
287+
fi
283288
fi
284289
}
285290

‎ci/package_list.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,13 @@ RELEASE_PACKAGES=(
99
tedge-apt-plugin
1010
c8y-remote-access-plugin
1111
c8y-firmware-plugin
12+
tedge-p11-server
1213
)
1314
export RELEASE_PACKAGES
1415

1516
# List of binaries which should be built
1617
BINARIES=(
1718
tedge
19+
tedge-p11-server
1820
)
1921
export BINARIES

‎configuration/contrib/tedge-p11-server/tedge-p11-server.conf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
TEDGE_DEVICE_CRYPTOKI_MODULE_PATH=
2+
TEDGE_DEVICE_CRYPTOKI_PIN=
3+
4+
#
5+
# Examples
6+
#
7+
# Yubikiey / Nitrokey
8+
# You will need to change the exact path to the opensc-pkcs11 file depending on your devices CPU architecture
9+
#TEDGE_DEVICE_CRYPTOKI_MODULE_PATH=/usr/lib/aarch64-linux-gnu/opensc-pkcs11.so
10+
#TEDGE_DEVICE_CRYPTOKI_PIN=123456
11+
12+
# TPM 2.0
13+
#TEDGE_DEVICE_CRYPTOKI_MODULE_PATH=/usr/lib/aarch64-linux-gnu/pkcs11/libtpm2_pkcs11.so
14+
#TPM2_PKCS11_STORE="/etc/tedge/tpm2"

‎configuration/init/systemd/75-tedge.preset

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,6 @@ disable tedge-mapper-collectd.service
1818

1919
# Misc
2020
disable tedge-watchdog.service
21+
22+
# pkcs11 server for HSM support
23+
disable tedge-p11-server.socket

‎configuration/init/systemd/tedge-p11-server.service

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=tedge-p11-server
3+
Requires=tedge-p11-server.socket
4+
5+
[Service]
6+
Type=simple
7+
StandardError=journal
8+
EnvironmentFile=-/etc/tedge/plugins/tedge-p11-server.conf
9+
ExecStart=/usr/bin/tedge-p11-server --module-path "${TEDGE_DEVICE_CRYPTOKI_MODULE_PATH}" --pin "${TEDGE_DEVICE_CRYPTOKI_PIN}"
10+
Restart=on-failure
11+
12+
[Install]
13+
Also=tedge-p11-server.socket
14+
WantedBy=default.target

‎configuration/init/systemd/tedge-p11-server.socket

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[Unit]
2+
Description=tedge-p11-server socket
3+
4+
[Socket]
5+
Priority=6
6+
Backlog=5
7+
ListenStream=%t/tedge-p11-server/tedge-p11-server.sock
8+
SocketUser=tedge
9+
SocketGroup=tedge
10+
SocketMode=0660
11+
12+
[Install]
13+
WantedBy=sockets.target

‎configuration/package_manifests/nfpm.tedge-p11-server.yaml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# yaml-language-server: $schema=https://nfpm.goreleaser.com/static/schema.json
2+
---
3+
name: tedge-p11-server
4+
description: |
5+
thin-edge.io service to interface with PKCS11 cryptoki modules
6+
arch: "${PKG_ARCH}"
7+
platform: "linux"
8+
version: "${GIT_SEMVER}"
9+
release: "${RELEASE}"
10+
section: misc
11+
priority: "optional"
12+
maintainer: "thin-edge.io team <info@thin-edge.io>"
13+
vendor: "thin-edge.io"
14+
homepage: "https://thin-edge.io"
15+
license: "Apache-2.0"
16+
17+
deb:
18+
fields:
19+
Vcs-Browser: ${CI_PROJECT_URL}
20+
Vcs-Git: ${CI_PROJECT_URL}
21+
compression: xz
22+
23+
contents:
24+
# binary
25+
- src: .build/tedge-p11-server
26+
dst: /usr/bin/
27+
28+
# service definitions
29+
- src: ./configuration/init/systemd/tedge-p11-server.socket
30+
dst: /lib/systemd/system/tedge-p11-server.socket
31+
file_info:
32+
mode: 0644
33+
packager: deb
34+
35+
- src: ./configuration/init/systemd/tedge-p11-server.socket
36+
dst: /lib/systemd/system/tedge-p11-server.socket
37+
file_info:
38+
mode: 0644
39+
packager: rpm
40+
41+
- src: ./configuration/init/systemd/tedge-p11-server.service
42+
dst: /lib/systemd/system/tedge-p11-server.service
43+
file_info:
44+
mode: 0644
45+
packager: deb
46+
47+
- src: ./configuration/init/systemd/tedge-p11-server.service
48+
dst: /lib/systemd/system/tedge-p11-server.service
49+
file_info:
50+
mode: 0644
51+
packager: rpm
52+
53+
# Config
54+
- src: ./configuration/contrib/tedge-p11-server/tedge-p11-server.conf
55+
dst: /etc/tedge/plugins/tedge-p11-server.conf
56+
type: config
57+
file_info:
58+
mode: 0644
59+
60+
overrides:
61+
apk:
62+
scripts:
63+
preinstall: configuration/package_scripts/_generated/tedge-p11-server/apk/preinst
64+
postinstall: configuration/package_scripts/_generated/tedge-p11-server/apk/postinst
65+
preremove: configuration/package_scripts/_generated/tedge-p11-server/apk/prerm
66+
postremove: configuration/package_scripts/_generated/tedge-p11-server/apk/postrm
67+
68+
rpm:
69+
scripts:
70+
preinstall: configuration/package_scripts/_generated/tedge-p11-server/rpm/preinst
71+
postinstall: configuration/package_scripts/_generated/tedge-p11-server/rpm/postinst
72+
preremove: configuration/package_scripts/_generated/tedge-p11-server/rpm/prerm
73+
postremove: configuration/package_scripts/_generated/tedge-p11-server/rpm/postrm
74+
75+
deb:
76+
scripts:
77+
preinstall: configuration/package_scripts/_generated/tedge-p11-server/deb/preinst
78+
postinstall: configuration/package_scripts/_generated/tedge-p11-server/deb/postinst
79+
preremove: configuration/package_scripts/_generated/tedge-p11-server/deb/prerm
80+
postremove: configuration/package_scripts/_generated/tedge-p11-server/deb/postrm

‎configuration/package_scripts/_generated/tedge-p11-server/apk/postinst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/sh
2+
set -e

‎configuration/package_scripts/_generated/tedge-p11-server/apk/postrm

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/sh
2+
set -e

‎configuration/package_scripts/_generated/tedge-p11-server/apk/preinst

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/bin/sh
2+
set -e
3+
4+
command_exists() {
5+
command -V "$1" >/dev/null 2>&1
6+
}
7+
8+
group_exists() {
9+
name="$1"
10+
if command_exists id; then
11+
id -g "$name" >/dev/null 2>&1
12+
elif command_exists getent; then
13+
getent group "$name" >/dev/null 2>&1
14+
else
15+
# Fallback to plain grep, as busybox does not have getent
16+
grep -q "^${name}:" /etc/group
17+
fi
18+
}
19+
20+
user_exists() {
21+
name="$1"
22+
if command_exists id; then
23+
id -u "$name" >/dev/null 2>&1
24+
elif command_exists getent; then
25+
getent passwd "$name" >/dev/null 2>&1
26+
else
27+
# Fallback to plain grep, as busybox does not have getent
28+
grep -q "^${name}:" /etc/passwd
29+
fi
30+
}
31+
32+
### Create groups
33+
if ! group_exists tedge; then
34+
if command_exists groupadd; then
35+
groupadd --system tedge
36+
elif command_exists addgroup; then
37+
addgroup -S tedge
38+
else
39+
echo "WARNING: Could not create group: tedge" >&2
40+
fi
41+
fi
42+
43+
### Create users
44+
# Create user tedge with no home(--no-create-home), no login(--shell) and in group tedge(--gid)
45+
if ! user_exists tedge; then
46+
if command_exists useradd; then
47+
useradd --system --no-create-home --shell /sbin/nologin --gid tedge tedge
48+
elif command_exists adduser; then
49+
adduser -g "" -H -D tedge -G tedge
50+
else
51+
echo "WARNING: Could not create user: tedge" >&2
52+
fi
53+
fi
54+
55+

0 commit comments

Comments
 (0)