Skip to content

Commit 6782ba9

Browse files
ladycfuladycfu
authored
Standalone Build Mechanism for KRATool (pki-kratool rpm): (#5319)
Added build-kratool.sh script and associated spec/pom.xml files to generate a standalone kratool RPM package. This allows administrators to install or update KRATool independently without overwriting existing PKI RPMs that may contain critical hotfixes. Build: ./base/tools/build-kratool.sh rpm Output: ~/build/kratool/ Assisted-by: Claude IDM-5245
1 parent bca8499 commit 6782ba9

3 files changed

Lines changed: 303 additions & 0 deletions

File tree

‎base/tools/build-kratool.sh‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/bin/bash
2+
#
3+
# Build script for standalone KRATool package
4+
#
5+
6+
set -e
7+
8+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
9+
PKG_NAME="pki-kratool"
10+
11+
# Extract version from spec file (single source of truth)
12+
PKG_VERSION=$(awk '$1=="Version:"{print $2; exit}' "${SCRIPT_DIR}/pki-kratool.spec")
13+
14+
if [ -z "$PKG_VERSION" ]; then
15+
echo "ERROR: Could not extract version from pki-kratool.spec"
16+
exit 1
17+
fi
18+
19+
BUILD_DIR="${HOME}/build/${PKG_NAME}"
20+
21+
echo "=== Building Standalone KRATool Package ==="
22+
echo "Package: ${PKG_NAME}-${PKG_VERSION}"
23+
echo "Build directory: ${BUILD_DIR}"
24+
echo
25+
26+
# Validate required files exist
27+
validate_file() {
28+
if [ ! -f "$1" ]; then
29+
echo "ERROR: $2 not found at $3"
30+
exit 1
31+
fi
32+
}
33+
34+
echo "Validating required files..."
35+
validate_file "${SCRIPT_DIR}/src/main/java/com/netscape/cmstools/KRATool.java" "KRATool.java" "${SCRIPT_DIR}/src/main/java/com/netscape/cmstools/"
36+
validate_file "${SCRIPT_DIR}/kratool-pom.xml" "kratool-pom.xml" "${SCRIPT_DIR}/"
37+
validate_file "${SCRIPT_DIR}/pki-kratool.spec" "pki-kratool.spec" "${SCRIPT_DIR}/"
38+
39+
# Create build directory structure
40+
echo "Creating build directories..."
41+
if [ -n "${BUILD_DIR}" ] && [ "${BUILD_DIR}" != "/" ]; then
42+
rm -rf "${BUILD_DIR}"
43+
fi
44+
mkdir -p "${BUILD_DIR}/"{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
45+
46+
# Create source tarball
47+
echo "Creating source tarball..."
48+
TARBALL_DIR="${BUILD_DIR}/SOURCES/${PKG_NAME}-${PKG_VERSION}"
49+
mkdir -p "${TARBALL_DIR}/src/main/java/com/netscape/cmstools"
50+
51+
# Copy KRATool source file
52+
cp "${SCRIPT_DIR}/src/main/java/com/netscape/cmstools/KRATool.java" \
53+
"${TARBALL_DIR}/src/main/java/com/netscape/cmstools/"
54+
55+
# Copy pom.xml and sync version from spec file (spec is single source of truth)
56+
cp "${SCRIPT_DIR}/kratool-pom.xml" "${TARBALL_DIR}/pom.xml"
57+
sed -i "/<artifactId>pki-kratool<\/artifactId>/,/<\/version>/ s|<version>.*</version>|<version>${PKG_VERSION}</version>|" "${TARBALL_DIR}/pom.xml"
58+
59+
# Copy license file
60+
cp "${SCRIPT_DIR}/../../LICENSE" "${TARBALL_DIR}/"
61+
62+
# Create tarball
63+
cd "${BUILD_DIR}/SOURCES"
64+
tar czf "${PKG_NAME}-${PKG_VERSION}.tar.gz" "${PKG_NAME}-${PKG_VERSION}"
65+
rm -rf "${PKG_NAME}-${PKG_VERSION}"
66+
67+
# Copy spec file
68+
echo "Copying spec file..."
69+
cp "${SCRIPT_DIR}/pki-kratool.spec" "${BUILD_DIR}/SPECS/"
70+
71+
# Build RPM
72+
echo "Building RPM..."
73+
cd "${BUILD_DIR}"
74+
rpmbuild --define "_topdir ${BUILD_DIR}" \
75+
-ba SPECS/pki-kratool.spec
76+
77+
echo
78+
echo "=== Build Complete ==="
79+
echo "RPMs in: ${BUILD_DIR}/RPMS/noarch/"
80+
ls -lh "${BUILD_DIR}/RPMS/noarch/"
81+
echo
82+
echo "To install:"
83+
echo " sudo rpm -ivh ${BUILD_DIR}/RPMS/noarch/${PKG_NAME}-${PKG_VERSION}-*.rpm"
84+
echo " # Or to upgrade existing:"
85+
echo " sudo rpm -Uvh ${BUILD_DIR}/RPMS/noarch/${PKG_NAME}-${PKG_VERSION}-*.rpm"
86+
echo

‎base/tools/kratool-pom.xml‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>org.dogtagpki.pki</groupId>
9+
<artifactId>pki-kratool</artifactId>
10+
<!-- IMPORTANT: Keep this version in sync with pki-kratool.spec -->
11+
<version>11.10.0</version>
12+
<packaging>jar</packaging>
13+
14+
<name>PKI KRATool</name>
15+
<description>Standalone tool for KRA archived keys migration with cross-scheme support</description>
16+
17+
<properties>
18+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
19+
<maven.compiler.source>17</maven.compiler.source>
20+
<maven.compiler.target>17</maven.compiler.target>
21+
</properties>
22+
23+
<!--
24+
Note on dependency management approach:
25+
26+
This POM uses <scope>system</scope> with <systemPath> for several dependencies,
27+
which is intentional for KRATool's specific use case:
28+
29+
1. STANDALONE MIGRATION TOOL: KRATool runs on production PKI systems where these
30+
libraries are already installed by the OS package manager at known locations.
31+
32+
2. VERSION CONSISTENCY: Using the exact same JARs as the deployed PKI system
33+
ensures cryptographic compatibility and avoids version conflicts during
34+
security-sensitive key migration operations.
35+
36+
3. SECURITY & AUDITABILITY: OS-packaged libraries receive security updates through
37+
standard system update mechanisms and are tracked by package management.
38+
39+
4. BUILD SUPPORT: Corresponding BuildRequires in pki-kratool.spec ensure these
40+
packages are installed during RPM build in clean environments.
41+
42+
While <scope>provided</scope> would be cleaner from a Maven perspective, system
43+
scope provides explicit path guarantees needed for a tool targeting specific
44+
RHEL versions with known filesystem layouts.
45+
-->
46+
47+
<dependencies>
48+
<!-- JSS -->
49+
<dependency>
50+
<groupId>org.dogtagpki.jss</groupId>
51+
<artifactId>jss-base</artifactId>
52+
<version>5.5.0</version>
53+
<scope>system</scope>
54+
<systemPath>/usr/lib/java/jss/jss-base.jar</systemPath>
55+
</dependency>
56+
57+
<!-- PKI Common -->
58+
<dependency>
59+
<groupId>org.dogtagpki.pki</groupId>
60+
<artifactId>pki-common</artifactId>
61+
<version>11.10.0</version>
62+
<scope>system</scope>
63+
<systemPath>/usr/share/java/pki/pki-common.jar</systemPath>
64+
</dependency>
65+
66+
<!-- SLF4J -->
67+
<dependency>
68+
<groupId>org.slf4j</groupId>
69+
<artifactId>slf4j-api</artifactId>
70+
<version>1.7.36</version>
71+
<scope>system</scope>
72+
<systemPath>/usr/share/java/slf4j/slf4j-api.jar</systemPath>
73+
</dependency>
74+
75+
<dependency>
76+
<groupId>org.slf4j</groupId>
77+
<artifactId>slf4j-jdk14</artifactId>
78+
<version>1.7.36</version>
79+
<scope>system</scope>
80+
<systemPath>/usr/share/java/slf4j/slf4j-jdk14.jar</systemPath>
81+
</dependency>
82+
83+
<!-- LDAP SDK -->
84+
<dependency>
85+
<groupId>org.mozilla</groupId>
86+
<artifactId>ldapjdk</artifactId>
87+
<version>5.5.0</version>
88+
<scope>system</scope>
89+
<systemPath>/usr/share/java/ldapjdk.jar</systemPath>
90+
</dependency>
91+
92+
<!-- Apache Commons CLI -->
93+
<dependency>
94+
<groupId>commons-cli</groupId>
95+
<artifactId>commons-cli</artifactId>
96+
<version>1.9.0</version>
97+
<scope>system</scope>
98+
<systemPath>/usr/share/java/apache-commons-cli.jar</systemPath>
99+
</dependency>
100+
101+
<!-- Apache Commons Lang3 -->
102+
<dependency>
103+
<groupId>org.apache.commons</groupId>
104+
<artifactId>commons-lang3</artifactId>
105+
<version>3.17.0</version>
106+
<scope>system</scope>
107+
<systemPath>/usr/share/java/apache-commons-lang3.jar</systemPath>
108+
</dependency>
109+
</dependencies>
110+
111+
<build>
112+
<sourceDirectory>src/main/java</sourceDirectory>
113+
<plugins>
114+
<plugin>
115+
<groupId>org.apache.maven.plugins</groupId>
116+
<artifactId>maven-compiler-plugin</artifactId>
117+
<version>3.12.1</version>
118+
<configuration>
119+
<source>17</source>
120+
<target>17</target>
121+
<includes>
122+
<include>com/netscape/cmstools/KRATool.java</include>
123+
</includes>
124+
</configuration>
125+
</plugin>
126+
<plugin>
127+
<groupId>org.apache.maven.plugins</groupId>
128+
<artifactId>maven-jar-plugin</artifactId>
129+
<version>3.3.0</version>
130+
<configuration>
131+
<archive>
132+
<manifest>
133+
<mainClass>com.netscape.cmstools.KRATool</mainClass>
134+
</manifest>
135+
</archive>
136+
</configuration>
137+
</plugin>
138+
</plugins>
139+
</build>
140+
141+
</project>

‎base/tools/pki-kratool.spec‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
Name: pki-kratool
2+
Version: 11.10.0
3+
Release: 1%{?dist}
4+
Summary: KRATool - PKI KRA LDIF Migration Tool
5+
6+
License: GPLv2
7+
URL: https://www.dogtagpki.org
8+
Source0: %{name}-%{version}.tar.gz
9+
10+
BuildArch: noarch
11+
12+
BuildRequires: maven
13+
BuildRequires: java-17-openjdk-devel
14+
BuildRequires: jss >= 5.5.0
15+
BuildRequires: pki-base >= 11.6.0
16+
BuildRequires: slf4j
17+
BuildRequires: apache-commons-cli
18+
BuildRequires: apache-commons-lang3
19+
BuildRequires: ldapjdk
20+
21+
# Runtime dependencies - use file paths instead of package names to avoid forcing upgrades
22+
Requires: java-17-openjdk-headless
23+
#Requires: jss >= 5.5.0
24+
#Requires: pki-base >= 11.6.0
25+
#Requires: slf4j
26+
#Requires: apache-commons-cli
27+
#Requires: apache-commons-lang3
28+
#Requires: ldapjdk
29+
Requires: /usr/lib/java/jss/jss-base.jar
30+
Requires: /usr/share/java/pki/pki-common.jar
31+
Requires: /usr/share/java/ldapjdk.jar
32+
Requires: /usr/share/java/slf4j/slf4j-api.jar
33+
Requires: /usr/share/java/slf4j/slf4j-jdk14.jar
34+
Requires: /usr/share/java/apache-commons-cli.jar
35+
Requires: /usr/share/java/apache-commons-lang3.jar
36+
37+
%description
38+
KRATool is a utility for migrating archived private keys between
39+
PKI Key Recovery Authority (KRA) instances, including support for
40+
cross-scheme cryptographic migration.
41+
42+
Key features:
43+
- Separate control of source and target wrapping algorithms
44+
- Order-independent LDIF field parsing
45+
- Algorithm auto-detection and session key regeneration
46+
- Optional software token fallback for unsupported algorithms
47+
- Backward compatible with legacy KRATool usage
48+
49+
%prep
50+
%setup -q
51+
52+
%build
53+
mvn clean package
54+
55+
%install
56+
install -d -m 755 %{buildroot}%{_javadir}
57+
install -m 644 target/%{name}-%{version}.jar %{buildroot}%{_javadir}/
58+
59+
install -d -m 755 %{buildroot}%{_bindir}
60+
cat > %{buildroot}%{_bindir}/KRATool << EOF
61+
#!/bin/bash
62+
exec java -cp %{_javadir}/%{name}-%{version}.jar:/usr/share/java/pki/pki-common.jar:/usr/lib/java/jss/jss-base.jar:/usr/share/java/slf4j/slf4j-api.jar:/usr/share/java/slf4j/slf4j-jdk14.jar:/usr/share/java/ldapjdk.jar:/usr/share/java/apache-commons-cli.jar:/usr/share/java/apache-commons-lang3.jar com.netscape.cmstools.KRATool "\$@"
63+
EOF
64+
chmod 755 %{buildroot}%{_bindir}/KRATool
65+
66+
install -d -m 755 %{buildroot}%{_defaultlicensedir}/%{name}
67+
install -m 644 LICENSE %{buildroot}%{_defaultlicensedir}/%{name}/
68+
69+
%files
70+
%license LICENSE
71+
%{_javadir}/%{name}-%{version}.jar
72+
%{_bindir}/KRATool
73+
74+
%changelog
75+
* Fri Mar 20 2026 Christina Fu <cfu@redhat.com> - 11.10.0-1
76+
- Make KRATool an independent RPM package

0 commit comments

Comments
 (0)