From f5b170191a143193ecfd8b7dba7478406338a06f Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 24 Jun 2026 10:49:55 -0700 Subject: [PATCH 1/5] Some initial packages for the spire-identity-exchange Signed-off-by: Kevin Fox --- examples/rpms/Dockerfile | 6 ++ ...-credentialcomposer-identity-exchange.spec | 53 ++++++++++++++++ .../rpms/spire-identity-exchange-server.spec | 61 +++++++++++++++++++ ...e-server-attestor-spiffe-workload-api.spec | 57 +++++++++++++++++ 4 files changed, 177 insertions(+) create mode 100644 examples/rpms/spire-credentialcomposer-identity-exchange.spec create mode 100644 examples/rpms/spire-identity-exchange-server.spec create mode 100644 examples/rpms/spire-server-attestor-spiffe-workload-api.spec diff --git a/examples/rpms/Dockerfile b/examples/rpms/Dockerfile index ff6d35e..3815cf4 100644 --- a/examples/rpms/Dockerfile +++ b/examples/rpms/Dockerfile @@ -21,6 +21,12 @@ RUN --mount=type=secret,id=gpg \ rpmbuild -ba spire.spec && \ spectool -g -R spire-controller-manager.spec && \ rpmbuild -ba spire-controller-manager.spec && \ + spectool -g -R spire-credentialcomposer-identity-exchange.spec && \ + rpmbuild -ba spire-credentialcomposer-identity-exchange.spec && \ + spectool -g -R spire-identity-exchange-server.spec && \ + rpmbuild -ba spire-identity-exchange-server.spec && \ + spectool -g -R spire-server-attestor-spiffe-workload-api.spec && \ + rpmbuild -ba spire-server-attestor-spiffe-workload-api.spec && \ spectool -g -R spiffe-helper.spec && \ rpmbuild -ba spiffe-helper.spec && \ spectool -g -R spiffe-step-ssh.spec && \ diff --git a/examples/rpms/spire-credentialcomposer-identity-exchange.spec b/examples/rpms/spire-credentialcomposer-identity-exchange.spec new file mode 100644 index 0000000..9f13cbf --- /dev/null +++ b/examples/rpms/spire-credentialcomposer-identity-exchange.spec @@ -0,0 +1,53 @@ +############################################################################## +# +# To you, dear reader: +# +# If you are a normal user, we recommend not reading further. Its probably not +# the file your looking for. +# +# If you are looking at using this file as a base for your own work, please +# don't. It is a horrible example. Please look elsewhere. +# +# If you are a package maintainer, please read on. We recognize this spec file +# is blasphemous, a terrible abomination, a crime against nature, and more. We +# regret needing to produce it, but had to in order to attract enough users to +# find you. We beseech thee, kind and generous package maintainer, please help +# us mend our wicked ways by joining us and help us produce proper packaging. +# You are our only hope. +# +############################################################################## + +%define ARCH %(echo %{_arch} | sed s/aarch64/arm64/) + +Summary: SPIRE Credential Composer Identity Exchange +Name: spire-credentialcomposer-identity-exchange +Version: 0.1.0 +Release: 1 +Group: Applications/Internet +License: Apache-2.0 +URL: https://spiffe.io +Source0: https://github.com/spiffe/spire-identity-exchange/releases/download/v%{version}/spire-credentialcomposer-identity-exchange_Linux_%{ARCH}.tar.gz + +%global __strip /bin/true + +%description +SPIRE Credential Composer Identity Exchange + +%global _missing_build_ids_terminate_build 0 +%global debug_package %{nil} + +%prep + +%setup -c + +%build + +%install +mkdir -p "%{buildroot}/usr/libexec/spire/plugins" +cp -a spire-credentialcomposer-identity-exchange %{buildroot}/usr/libexec/spire/plugins/credentialcomposer-identity-exchange + +%clean +rm -rf %{buildroot} + +%files +/usr/libexec/spire/plugins/credentialcomposer-identity-exchange diff --git a/examples/rpms/spire-identity-exchange-server.spec b/examples/rpms/spire-identity-exchange-server.spec new file mode 100644 index 0000000..5f102e9 --- /dev/null +++ b/examples/rpms/spire-identity-exchange-server.spec @@ -0,0 +1,61 @@ +############################################################################## +# +# To you, dear reader: +# +# If you are a normal user, we recommend not reading further. Its probably not +# the file your looking for. +# +# If you are looking at using this file as a base for your own work, please +# don't. It is a horrible example. Please look elsewhere. +# +# If you are a package maintainer, please read on. We recognize this spec file +# is blasphemous, a terrible abomination, a crime against nature, and more. We +# regret needing to produce it, but had to in order to attract enough users to +# find you. We beseech thee, kind and generous package maintainer, please help +# us mend our wicked ways by joining us and help us produce proper packaging. +# You are our only hope. +# +############################################################################## + +%define ARCH %(echo %{_arch} | sed s/aarch64/arm64/) + +Summary: SPIRE Identity Exchange Server +Name: spire-identity-exchange-server +Version: 0.1.0 +Release: 1 +Group: Applications/Internet +License: Apache-2.0 +URL: https://spiffe.io +Source0: https://github.com/spiffe/spire-identity-exchange/releases/download/v%{version}/spire-identity-exchange-server_Linux_%{ARCH}.tar.gz + +%global __strip /bin/true + +%description +SPIRE Identity Exchange Server + +%global _missing_build_ids_terminate_build 0 +%global debug_package %{nil} + +%prep + +%setup -c + +%build + +%install +mkdir -p "%{buildroot}/usr/bin" +mkdir -p "%{buildroot}/usr/lib" +mkdir -p "%{buildroot}/etc/spire/identity-exchange" +cp -a spire-identity-exchange-server %{buildroot}/usr/bin/spire-identity-exchange-server +cp -a systemd/spire-identity-exchange-server@.service %{buildroot}/usr/lib/systemd/system/spire-identity-exchange-server@.service +cp -a config/* %{buildroot}/etc/spire/identity-exchange/ + +%clean +rm -rf %{buildroot} + +%files +/usr/bin/spire-identity-exchange-server +/usr/lib/systemd/system/spire-server-attestor-spiffe-workload-api@.service +%config(noreplace) /etc/spire/identity-exchange/default.conf +%config(noreplace) /etc/spire/identity-exchange/default.env + diff --git a/examples/rpms/spire-server-attestor-spiffe-workload-api.spec b/examples/rpms/spire-server-attestor-spiffe-workload-api.spec new file mode 100644 index 0000000..5ac5a83 --- /dev/null +++ b/examples/rpms/spire-server-attestor-spiffe-workload-api.spec @@ -0,0 +1,57 @@ +############################################################################## +# +# To you, dear reader: +# +# If you are a normal user, we recommend not reading further. Its probably not +# the file your looking for. +# +# If you are looking at using this file as a base for your own work, please +# don't. It is a horrible example. Please look elsewhere. +# +# If you are a package maintainer, please read on. We recognize this spec file +# is blasphemous, a terrible abomination, a crime against nature, and more. We +# regret needing to produce it, but had to in order to attract enough users to +# find you. We beseech thee, kind and generous package maintainer, please help +# us mend our wicked ways by joining us and help us produce proper packaging. +# You are our only hope. +# +############################################################################## + +%define ARCH %(echo %{_arch} | sed s/aarch64/arm64/) + +Summary: SPIRE Server Attestor SPIFFE Workload API +Name: spire-server-attestor-spiffe-workload-api +Version: 0.1.0 +Release: 1 +Group: Applications/Internet +License: Apache-2.0 +URL: https://spiffe.io +Source0: https://github.com/spiffe/spire-identity-exchange/releases/download/v%{version}/spire-server-attestor-spiffe-workload-api_Linux_%{ARCH}.tar.gz + +%global __strip /bin/true + +%description +SPIRE Server Attestor SPIFFE Workload API + +%global _missing_build_ids_terminate_build 0 +%global debug_package %{nil} + +%prep + +%setup -c + +%build + +%install +mkdir -p "%{buildroot}/usr/bin" +mkdir -p "%{buildroot}/usr/lib" +cp -a spire-server-attestor-spiffe-workload-api %{buildroot}/usr/bin/spire-server-attestor-spiffe-workload-api +cp -a systemd/spire-server-attestor-spiffe-workload-api@.service %{buildroot}/usr/lib/systemd/system/spire-server-attestor-spiffe-workload-api@.service + +%clean +rm -rf %{buildroot} + +%files +/usr/bin/spire-server-attestor-spiffe-workload-api +/usr/lib/systemd/system/spire-server-attestor-spiffe-workload-api@.service + From 4a9282511998b55a23966e3abc12edb4ebd1cfba Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 24 Jun 2026 13:11:49 -0700 Subject: [PATCH 2/5] Fix filename Signed-off-by: Kevin Fox --- examples/rpms/spire-identity-exchange-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/rpms/spire-identity-exchange-server.spec b/examples/rpms/spire-identity-exchange-server.spec index 5f102e9..14a9009 100644 --- a/examples/rpms/spire-identity-exchange-server.spec +++ b/examples/rpms/spire-identity-exchange-server.spec @@ -47,7 +47,7 @@ mkdir -p "%{buildroot}/usr/bin" mkdir -p "%{buildroot}/usr/lib" mkdir -p "%{buildroot}/etc/spire/identity-exchange" cp -a spire-identity-exchange-server %{buildroot}/usr/bin/spire-identity-exchange-server -cp -a systemd/spire-identity-exchange-server@.service %{buildroot}/usr/lib/systemd/system/spire-identity-exchange-server@.service +cp -a systemd/spire-identity-exchange@.service %{buildroot}/usr/lib/systemd/system/spire-identity-exchange-server@.service cp -a config/* %{buildroot}/etc/spire/identity-exchange/ %clean From 53c25dcacaef73a6c1eecadc4d73cbd3394c6971 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 24 Jun 2026 13:32:26 -0700 Subject: [PATCH 3/5] Fix filename Signed-off-by: Kevin Fox --- examples/rpms/spire-identity-exchange-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/rpms/spire-identity-exchange-server.spec b/examples/rpms/spire-identity-exchange-server.spec index 14a9009..f803aea 100644 --- a/examples/rpms/spire-identity-exchange-server.spec +++ b/examples/rpms/spire-identity-exchange-server.spec @@ -44,7 +44,7 @@ SPIRE Identity Exchange Server %install mkdir -p "%{buildroot}/usr/bin" -mkdir -p "%{buildroot}/usr/lib" +mkdir -p "%{buildroot}/usr/lib/systemd/system" mkdir -p "%{buildroot}/etc/spire/identity-exchange" cp -a spire-identity-exchange-server %{buildroot}/usr/bin/spire-identity-exchange-server cp -a systemd/spire-identity-exchange@.service %{buildroot}/usr/lib/systemd/system/spire-identity-exchange-server@.service From 747a008c685bb34c4d49271e97c71522e58eb11d Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 24 Jun 2026 13:36:45 -0700 Subject: [PATCH 4/5] Fix filename Signed-off-by: Kevin Fox --- examples/rpms/spire-identity-exchange-server.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/rpms/spire-identity-exchange-server.spec b/examples/rpms/spire-identity-exchange-server.spec index f803aea..10e1bac 100644 --- a/examples/rpms/spire-identity-exchange-server.spec +++ b/examples/rpms/spire-identity-exchange-server.spec @@ -55,7 +55,7 @@ rm -rf %{buildroot} %files /usr/bin/spire-identity-exchange-server -/usr/lib/systemd/system/spire-server-attestor-spiffe-workload-api@.service +/usr/lib/systemd/system/spire-identity-exchange-server@.service %config(noreplace) /etc/spire/identity-exchange/default.conf %config(noreplace) /etc/spire/identity-exchange/default.env From 9bacb2691f500dc2841c7606f3a1afa825b26086 Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 24 Jun 2026 13:42:02 -0700 Subject: [PATCH 5/5] Fix filename Signed-off-by: Kevin Fox --- examples/rpms/spire-server-attestor-spiffe-workload-api.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/rpms/spire-server-attestor-spiffe-workload-api.spec b/examples/rpms/spire-server-attestor-spiffe-workload-api.spec index 5ac5a83..0db9f1d 100644 --- a/examples/rpms/spire-server-attestor-spiffe-workload-api.spec +++ b/examples/rpms/spire-server-attestor-spiffe-workload-api.spec @@ -44,7 +44,7 @@ SPIRE Server Attestor SPIFFE Workload API %install mkdir -p "%{buildroot}/usr/bin" -mkdir -p "%{buildroot}/usr/lib" +mkdir -p "%{buildroot}/usr/lib/systemd/system" cp -a spire-server-attestor-spiffe-workload-api %{buildroot}/usr/bin/spire-server-attestor-spiffe-workload-api cp -a systemd/spire-server-attestor-spiffe-workload-api@.service %{buildroot}/usr/lib/systemd/system/spire-server-attestor-spiffe-workload-api@.service