%bcond check 1

Name:           pqconnect-rs
Version:        0.3.0
Release:        1%{?dist}
Summary:        PQConnect client (Rust implementation)
# pqconnect-linux: GPL-3.0-or-later; the shared crates: MIT OR Apache-2.0; the rest: the vendored
# crates linked into the binaries on Linux (cargo tree -p pqconnect-linux -e normal --target
# <arch>-unknown-linux-gnu, without proc-macro crates). %%build prints cargo-to-rpm's summary,
# which also lists crates only other platforms link.
License:        GPL-3.0-or-later AND (MIT OR Apache-2.0) AND MIT AND Unicode-3.0 AND Unlicense AND WTFPL AND (Unlicense OR MIT) AND (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND (BSD-2-Clause OR Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib)
URL:            https://pqconnect.net
# Built by make-orig-tarball (from the Debian packaging): the pqconnect-rs source at a git ref,
# with the crate dependencies vendored for the Linux architectures.
Source0:        pqconnect-rust_%{version}.orig.tar.xz
Source1:        pqconnect.service
Source2:        pqconnect-server.service
Source3:        pqconnect.sysusers

ExclusiveArch:  x86_64 aarch64 ppc64le s390x riscv64

BuildRequires:  cargo-rpm-macros >= 26
BuildRequires:  gcc
BuildRequires:  pkgconfig(libsodium)
BuildRequires:  lib25519-devel
BuildRequires:  libmceliece-devel
BuildRequires:  libntruprime-devel
BuildRequires:  systemd-rpm-macros

%global _description %{expand:
PQConnect is a new easy-to-install layer of Internet security. PQConnect lets
you take action right now on your computer to address the threat of quantum
attacks, without waiting for upgrades in the applications that you are using.

PQConnect automatically applies post-quantum cryptography from end to end
between computers running PQConnect.}

# The client runs nft to set up its DNS filter and exits without it.
Requires:       nftables

%description %_description

This package contains the pqconnect client daemon and CLI binary.

%package server
Summary:        PQConnect server (Rust implementation)
Requires:       %{name}-keygen = %{version}-%{release}
# The unit reads the host IP from the default route with ip, grep and cut.
Requires:       iproute
Requires:       grep
Requires:       coreutils

%description server %_description

This package contains the PQConnect server daemon and CLI binary.

%package keygen
Summary:        Static key generator for the PQConnect server (Rust implementation)

%description keygen %_description

This package contains the pqconnect keygen CLI binary.

%prep
%autosetup -n pqconnect-rust-%{version}
# The tarball's cargo configuration also redirects the git dependencies to vendor/, which
# %%cargo_prep's own configuration does not; keep those tables.
awk '/^\[source\."git\+/,/^$/' .cargo/config.toml > git-sources.toml
%cargo_prep -v vendor
cat git-sources.toml >> .cargo/config.toml

%build
# Link the system libsodium; the tarball drops the copy bundled with libsodium-sys.
export SODIUM_USE_PKG_CONFIG=1
# Only the Linux crate: the workspace also holds the other platforms' crates.
%{__cargo} build %{__cargo_common_opts} --profile rpm --locked -p pqconnect-linux
%{__cargo_to_rpm} --path pqconnect-linux/Cargo.toml license-summary
%{__cargo_to_rpm} --path pqconnect-linux/Cargo.toml license-breakdown > LICENSE.dependencies
%{cargo_vendor_manifest}

%install
install -Dpm 0755 target/rpm/pqconnect-client %{buildroot}%{_bindir}/pqconnect
install -Dpm 0755 target/rpm/pqconnect-server %{buildroot}%{_bindir}/pqconnect-server
install -Dpm 0755 target/rpm/pqconnect-keygen %{buildroot}%{_bindir}/pqconnect-keygen
install -Dpm 0644 %{SOURCE1} %{buildroot}%{_unitdir}/pqconnect.service
install -Dpm 0644 %{SOURCE2} %{buildroot}%{_unitdir}/pqconnect-server.service
install -Dpm 0644 %{SOURCE3} %{buildroot}%{_sysusersdir}/pqconnect.conf
# The client reads /etc/pqconnect/client.
install -Dpm 0644 pqconnect-linux/examples/client.conf %{buildroot}%{_sysconfdir}/pqconnect/client

%if %{with check}
%check
export SODIUM_USE_PKG_CONFIG=1
%{__cargo} test %{__cargo_common_opts} --profile rpm --locked --no-fail-fast \
    -p pqconnect-crypto -p pqconnect-protocol -p pqconnect-core -p pqconnect-linux
%endif

%post
%systemd_post pqconnect.service

%preun
%systemd_preun pqconnect.service

%postun
%systemd_postun_with_restart pqconnect.service

%post server
%systemd_post pqconnect-server.service
umask 077
if [ ! -d %{_sysconfdir}/pqconnect/config ]; then
    mkdir -p %{_sysconfdir}/pqconnect/config
    echo 42424 > %{_sysconfdir}/pqconnect/config/pqcport
    echo 42425 > %{_sysconfdir}/pqconnect/config/keyport
fi
# Check for the key itself, not the directory: a failed run must not block the next one.
if [ ! -f %{_sysconfdir}/pqconnect/keys/mceliece_sk ]; then
    mkdir -p %{_sysconfdir}/pqconnect/keys
    %{_bindir}/pqconnect-keygen -c %{_sysconfdir}/pqconnect/config \
        -d %{_sysconfdir}/pqconnect/keys < /dev/null || :
fi

%preun server
%systemd_preun pqconnect-server.service

%postun server
%systemd_postun_with_restart pqconnect-server.service

%files
%license LICENSE-MIT LICENSE-APACHE pqconnect-linux/LICENSE LICENSE.dependencies cargo-vendor.txt
%doc pqconnect-linux/README.md pqconnect-linux/CHANGELOG.md
%{_bindir}/pqconnect
%{_unitdir}/pqconnect.service
%{_sysusersdir}/pqconnect.conf
%dir %{_sysconfdir}/pqconnect
%config(noreplace) %{_sysconfdir}/pqconnect/client

%files server
%license LICENSE-MIT LICENSE-APACHE pqconnect-linux/LICENSE LICENSE.dependencies cargo-vendor.txt
%doc pqconnect-linux/README.md pqconnect-linux/CHANGELOG.md
%{_bindir}/pqconnect-server
%{_unitdir}/pqconnect-server.service
%{_sysusersdir}/pqconnect.conf
%dir %{_sysconfdir}/pqconnect

%files keygen
%license LICENSE-MIT LICENSE-APACHE pqconnect-linux/LICENSE LICENSE.dependencies cargo-vendor.txt
%doc pqconnect-linux/README.md pqconnect-linux/CHANGELOG.md
%{_bindir}/pqconnect-keygen

%changelog
* Wed Oct 07 2026 Sheldon Knuth <sheldon@citi.sinica.edu.tw> - 0.3.0-1
- Update to 0.3.0: pq1 names decode as in the Python implementation, so servers whose key
  hash ends in a zero byte are reachable and a crafted DNS answer cannot crash the client's
  DNS thread; the code is reorganized with no change to the wire format, settings or paths
- The vendored source no longer carries the liboqs bindings, bindgen's toolchain or
  crossbeam-channel; the licenses of the crates linked on Linux are unchanged
- Ship upstream's README.md and CHANGELOG.md

* Sat Oct 03 2026 Sheldon Knuth <sheldon@citi.sinica.edu.tw> - 0.2.0-1
- First Fedora package of the 0.2.0 workspace, from the same vendored source as the Ubuntu
  package; named after the upstream project, pqconnect-rs