# Maintainer: Jonas Witschel <diabonas@archlinux.org>

pkgname=swtpm
pkgver=0.10.1
pkgrel=2
pkgdesc='Libtpms-based TPM emulator with socket, character device, and Linux CUSE interface'
arch=('x86_64' 'aarch64')
url='https://github.com/stefanberger/swtpm'
license=('BSD-3-Clause')
depends=(
  'fuse2'
  'glib2'
  'glibc'
  'gmp'
  'gnutls'
  'json-glib'
  'libgcc'
  'libseccomp' 'libseccomp.so'
  'libtasn1'
  'libtpms'
  'openssl'
)
makedepends=(
  'expect'
  'git'
  'iproute2'
  'python'
  'socat'
)
checkdepends=('softhsm')
source=(
  "git+$url.git?signed#tag=v$pkgver"
  "$pkgname.sysusers"
  "$pkgname.tmpfiles"
)
b2sums=('b7154c2d23141fc2d4ec4fa5e2d651db894826c74bb7616866ba3b7af9ddc9806c7a6ab076a7e474a51b0cccd191ffa3635e93c30ee49f6626dfb5eee05767a7'
        '273a0b5a7e6dd44a830bed10882fe833f30110d438042f57f134dd8b97d1a298f21e710012d03da76dcfddbda9d182b4fc509b08394b962d4a004bab53456f82'
        'e17927a20ee0612625372a895381094588888d7e9f6d3526388e386ee931905446dd0d0152219ed4315cf8dbacae82fbc0fcd292b3bfa5b52e7628a502b3665b')
validpgpkeys=('B818B9CADF9089C2D5CEC66B75AD65802A0B4211') # Stefan Berger <stefanb@linux.vnet.ibm.com>

prepare() {
  cd "$pkgname"
  # Remove usage of /usr/bin/env to avoid PATH manipulation attacks
  sed --in-place 's/env //' \
    samples/swtpm-create-tpmca \
    samples/swtpm-create-user-config-files.in

  # Fix test_tpm2_avoid_da_lockout with libtpms >= 0.10.2
  git cherry-pick -n 4da66c66f92438443e66b67555673c9cb898b0ae

  autoreconf --install --force
}

build() {
  cd "$pkgname"
  ./configure \
    --prefix=/usr \
    --libexecdir=/usr/lib \
    --with-cuse \
    --with-gnutls \
    --with-seccomp
  make
}

check() {
  cd "$pkgname"
  make check
}

package() {
  cd "$pkgname"
  make DESTDIR="$pkgdir" install
  chmod -v 750 "$pkgdir/var/lib/swtpm-localca"
  install -vDm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
  install -vDm644 "$srcdir/$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
  install -vDm644 "$srcdir/$pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
}
