configure.ac - third_party/github.com/stefanberger/swtpm - Git at Google

 dnl
 dnl configure.ac
 dnl
 dnl       The Initial Developer of the Original Code is International
 dnl       Business Machines Corporation. Portions created by IBM
 dnl       Corporation are Copyright (C) 2014 International Business
 dnl       Machines Corporation. All Rights Reserved.
 dnl
 dnl       This program is free software; you can redistribute it and/or modify
 dnl       it under the terms of the Common Public License as published by
 dnl       IBM Corporation; either version 1 of the License, or (at your option)
 dnl       any later version.
 dnl
 dnl       This program is distributed in the hope that it will be useful,
 dnl       but WITHOUT ANY WARRANTY; without even the implied warranty of
 dnl       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 dnl       Common Public License for more details.
 dnl
 dnl       You should have received a copy of the Common Public License
 dnl       along with this program; if not, a copy can be viewed at
 dnl       http://www.opensource.org/licenses/cpl1.0.php.
 dnl
 dnl       This file is derived from tpm-tool's configure.in.
 dnl

 AC_INIT([swtpm],[0.11.0])
 AC_PREREQ([2.69])
 AC_CONFIG_SRCDIR(Makefile.am)
 AC_CONFIG_HEADERS([config.h])

 SWTPM_VER_MAJOR=`echo $PACKAGE_VERSION | cut -d "." -f1`
 SWTPM_VER_MINOR=`echo $PACKAGE_VERSION | cut -d "." -f2`
 SWTPM_VER_MICRO=`echo $PACKAGE_VERSION | cut -d "." -f3`

 AC_SUBST([SWTPM_VER_MAJOR])
 AC_SUBST([SWTPM_VER_MINOR])
 AC_SUBST([SWTPM_VER_MICRO])

 dnl Check for programs
 AC_PROG_CC
 AC_PROG_INSTALL
 AC_PROG_LN_S
 LT_INIT

 AC_CONFIG_MACRO_DIR([m4])
 AC_CANONICAL_TARGET
 AC_CANONICAL_HOST
 AM_INIT_AUTOMAKE([foreign 1.6])
 AM_SILENT_RULES([yes])

 dnl Allow 64-bit file API on 32-bit systems. Without the change even small
 dnl files will fail to stat any files on filesystems with 64-bit inodes.
 AC_SYS_LARGEFILE

 AC_C_CONST
 AC_C_INLINE

 AC_TYPE_SIZE_T

 AC_PROG_CC
 AC_PROG_INSTALL
 AC_PROG_MKDIR_P

 AC_ARG_WITH([selinux],
     [AS_HELP_STRING([--with-selinux],
        [add SELinux policy extensions @<:@default=check@:>@])],
     [],
     [with_selinux="check"]
 )

 dnl Check for SELinux policy support

 AS_IF([test "x$with_selinux" != "xno"],
     [AC_PATH_PROG([SEMODULE], semodule)
     AS_IF([test -f /usr/share/selinux/devel/Makefile && test "x$SEMODULE" != "x"],
         [with_selinux="yes"],
         [test "x$with_selinux" = "xyes"],
         [AC_MSG_ERROR(["Is selinux-policy-devel installed?"])]
     )
     ]
 )

 AM_CONDITIONAL([WITH_SELINUX], [test "x$with_selinux" = "xyes"])

 AS_IF([test "$prefix" = "/usr" && test "$sysconfdir" = '${prefix}/etc'],
     [sysconfdir="/etc"]
 )
 AS_IF([test "$prefix" = "" && test "$datarootdir" = '${prefix}/share'],
     [datarootdir="/usr/share"]
 )
 AS_IF([test "$prefix" = "/usr" && test "$localstatedir" = '${prefix}/var'],
     [localstatedir="/var"]
 )
 AS_IF([test "x$prefix" = "xNONE"],
     [prefix="/usr/local"]
 )
 AS_IF([test "x$exec_prefix" = "xNONE"],
     [exec_prefix=$prefix]
 )
 SYSCONFDIR=`eval echo $sysconfdir`
 DATAROOTDIR=`eval echo $datarootdir`
 LOCALSTATEDIR=`eval echo $localstatedir`
 BINDIR=`eval echo $bindir`
 AC_SUBST([SYSCONFDIR])
 AC_SUBST([DATAROOTDIR])
 AC_SUBST([LOCALSTATEDIR])
 AC_SUBST([BINDIR])

 cryptolib=openssl

 AC_ARG_WITH([openssl],
             [AS_HELP_STRING([--with-openssl],
                            [build with openssl library])],
             [],
             [])

 AS_CASE([$cryptolib],[openssl],
     [PKG_CHECK_MODULES([LIBCRYPTO],[libcrypto >= 3.5])
     AC_CHECK_HEADERS([openssl/obj_mac.h],[],
         AC_MSG_ERROR(Is openssl-devel/libssl-dev installed?))
     AC_MSG_RESULT([Building with openssl crypto library])

     AC_CHECK_HEADERS([openssl/fips.h],
         [AC_DEFINE_UNQUOTED([HAVE_OPENSSL_FIPS_H], 1,
             [whether openssl/fips.h is available])]
     )
     AC_CHECK_LIB(crypto,
         [FIPS_mode_set],
         [AC_DEFINE_UNQUOTED([HAVE_OPENSSL_FIPS_MODE_SET_API], 1,
             [whether FIPS_mode_set API is available])]
     )
     ],
 )

 AC_CHECK_PROG([OPENSSL_CLITOOL], [openssl], [yes], [no])
 AS_IF([test "$OPENSSL_CLITOOL" != "yes"],
     [AC_MSG_ERROR("Could not find openssl tool. Is openssl installed?")]
 )

 PKG_CHECK_MODULES([LIBTASN1],[libtasn1])

 PKG_CHECK_MODULES([LIBTPMS],[libtpms >= 0.11])


 AC_CHECK_LIB(c, clock_gettime, LIBRT_LIBS="", LIBRT_LIBS="-lrt")
 AC_SUBST([LIBRT_LIBS])

 AC_ARG_WITH([cuse],
             AS_HELP_STRING([--with-cuse],[build with CUSE interface]),
             [],
             [with_cuse=check]
 )

 AS_IF([test "x$with_cuse" != "xno"],
     [PKG_CHECK_MODULES([LIBFUSE],
         [fuse3],
         [with_cuse=yes],
         [PKG_CHECK_MODULES([LIBFUSE],
             [fuse],
             [LIBFUSE_CFLAGS="$LIBFUSE_CFLAGS -DWITH_FUSE2"],
             [AS_IF([test "x$with_cuse" = "xyes"],
                 [AC_MSG_ERROR("Is fuse3-devel or fuse-devel installed? -- could not found libfuse3 or libfuse")],
                 [with_cuse=no]
             )]
         )]
     )
     AS_IF([test "x$with_cuse" = "xyes"],
         [AC_DEFINE_UNQUOTED([WITH_CUSE], 1,
             [whether to build with CUSE interface])
         PKG_CHECK_MODULES([GTHREAD], gthread-2.0)])
     ]
 )

 AM_CONDITIONAL([WITH_CUSE],[test "$with_cuse" = "yes"])
 AC_MSG_CHECKING([for whether to build with CUSE interface])
 AC_MSG_RESULT([$with_cuse])

 PKG_CHECK_MODULES([JSON_GLIB], [json-glib-1.0])

 PKG_CHECK_MODULES([GLIB], [glib-2.0])

 PKG_CHECK_MODULES([GMP], [gmp])

 AC_MSG_CHECKING([for whether to build with chardev interface])

 AS_CASE([$host_os],
     [linux-*],
     [with_chardev=yes
     AC_DEFINE_UNQUOTED([WITH_CHARDEV], 1,
         [whether to build with chardev interface])
     ],
     [with_chardev=no]
 )

 AM_CONDITIONAL([WITH_CHARDEV],[test "$with_chardev" = "yes"])
 AC_MSG_RESULT($with_chardev)

 DEFAULT_PCR_BANKS="sha256"
 AC_ARG_ENABLE([default-pcr-banks],
               AS_HELP_STRING(
                   [--enable-default-pcr-banks=list of PCR banks],
                   [Have swtpm_setup activate the given PCR banks by default;
                   default is sha256]
               ),
               [],
               []
 )

 AC_DEFUN([pcr_bank_checks], [
     AC_CHECK_PROG([bash], [bash], [yes], [no])
     AS_IF([test "x$bash" != "xyes"],
       [AC_MSG_ERROR([PCR bank verification requires bash, but executable not found.])])

     AC_MSG_CHECKING([which PCR banks to activate by default])
     REGEX="^(sha1|sha256|sha384|sha512)(,(sha1|sha256|sha384|sha512)){0,3}\$"
     AS_IF([bash -c "[[[ $DEFAULT_PCR_BANKS =~ $REGEX ]]] && exit 0 || exit 1"],
         [AC_MSG_RESULT([$DEFAULT_PCR_BANKS])],
         [AC_MSG_ERROR([$DEFAULT_PCR_BANKS is an invalid list of PCR banks])])
 ])

 AS_IF([test "x$enable_default_pcr_banks" != "x"],[
      DEFAULT_PCR_BANKS="$enable_default_pcr_banks"
 ])
 pcr_bank_checks
 AC_SUBST([DEFAULT_PCR_BANKS])

 dnl tests and tools needed for tests
 AC_ARG_ENABLE([tests],
     [AS_HELP_STRING([--disable-tests], [Disable test; tools only needed for tests need not be installed])],
     [AS_CASE([$enableval],
         [yes],
         [enable_tests=yes],
         [no],
         [enable_tests=no],
         [AC_MSG_ERROR([bad value ${enableval} for --disable-tests])]
     )],
     [enable_tests=yes]
 )
 AM_CONDITIONAL(ENABLE_TESTS, [test x$enable_tests = xyes])

 AS_IF([test "x$enable_tests" = "xyes"],[
     dnl We either need netstat (more common across systems) or 'ss' for test cases
     AC_PATH_PROG([NETSTAT], [netstat])

     AS_IF([test "x$NETSTAT" = "x"],
         [AC_PATH_PROG([SS], [ss])
         AS_IF([test "x$SS" = "x"],
             [AC_MSG_ERROR(['netstat' and 'ss' tools are missing for tests: net-tools OR iproute/iproute2 package])]
         )
         ]
     )

     AC_PATH_PROG([GAWK], gawk)
     AS_IF([test "x$GAWK" = "x"],
         AC_MSG_ERROR([gawk is required: gawk package])
     )

     AC_PATH_PROG([SOCAT], socat)
     AS_IF([test "x$SOCAT" = "x"],
         AC_MSG_ERROR([socat is required: socat package])
     )

     AC_PATH_PROG([BASE64], base64)
     AS_IF([test "x$BASE64" = "x"],
         AC_MSG_ERROR([base64 is required: base64 package])
     )

     AC_PATH_PROG([CP], cp)
     AS_IF([test "x$CP" = "x"],
 	AC_MSG_ERROR([cp is required])
     )
 ])

 AM_PATH_PYTHON([3.3])

 AC_ARG_ENABLE([hardening],
   AS_HELP_STRING([--disable-hardening], [Disable hardening flags]))

 AS_IF([test "x$enable_hardening" != "xno"],
 dnl Some versions of gcc fail with -Wstack-protector,
 dnl some with -Wstack-protector-strong enabled
     [AS_IF([! $CC -fstack-protector-strong -Wstack-protector $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null],
         [AS_IF([ $CC -fstack-protector -Wstack-protector $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null],
             [HARDENING_CFLAGS="-fstack-protector -Wstack-protector"])],
         [HARDENING_CFLAGS="-fstack-protector-strong -Wstack-protector"])
 dnl Only support -D_FORTIFY_SOURCE=2 and have higher levels passed in by user
 dnl since they may create more overhead
     AS_IF([$CC $CFLAGS -Werror -D_FORTIFY_SOURCE=2 $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null],
         [HARDENING_CFLAGS="$HARDENING_CFLAGS -D_FORTIFY_SOURCE=2"])
 dnl Check linker for 'relro' and 'now'
     save_CFLAGS="$CFLAGS"
     CFLAGS="-Wl,-z,relro -Werror"
     AC_MSG_CHECKING([whether linker supports -Wl,-z,relro])
     AC_LINK_IFELSE(
         [AC_LANG_SOURCE([[int main() { return 0; }]])],
         [HARDENING_LDFLAGS="$HARDENING_LDFLAGS -Wl,-z,relro"
         AC_MSG_RESULT(yes)
         ],
         [AC_MSG_RESULT(no)]
     )
     CFLAGS="-Wl,-z,now -Werror"
     AC_MSG_CHECKING([whether linker supports -Wl,-z,now])
     AC_LINK_IFELSE(
         [AC_LANG_SOURCE([[int main() { return 0; }]])],
         [HARDENING_LDFLAGS="$HARDENING_LDFLAGS -Wl,-z,now"
         AC_MSG_RESULT(yes)],
         [AC_MSG_RESULT(no)]
     )
     CFLAGS="$save_CFLAGS"
     AC_SUBST([HARDENING_CFLAGS])
     AC_SUBST([HARDENING_LDFLAGS])
     ]
 )

 AC_ARG_ENABLE([test-coverage],
     AS_HELP_STRING([--enable-test-coverage], [Enable test coverage flags]))

 AS_IF([test "x$enable_test_coverage" = "xyes"],
     [COVERAGE_CFLAGS="-fprofile-arcs -ftest-coverage"
     COVERAGE_LDFLAGS="-fprofile-arcs"
     ]
 )

 AC_ARG_ENABLE([sanitizers],
     AS_HELP_STRING([--enable-sanitizers], [Enable address/undefined sanitizers]))

 AS_IF([test "x$enable_sanitizers" = "xyes"],
     [save_CFLAGS="$CFLAGS"
     CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
     AC_MSG_CHECKING([whether linker supports sanitizer])
     AC_LINK_IFELSE(
         [AC_LANG_SOURCE([[int main() { return 0; }]])],
         [SANITIZER_CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
         SANITIZER_LDFLAGS="-fsanitize=address,undefined"
         AC_MSG_RESULT(yes)
         ],
         [AC_MSG_RESULT(no)]
     )
     CFLAGS="$save_CFLAGS"
     ]
 )

 AC_ARG_WITH([tss-user],
             AS_HELP_STRING([--with-tss-user=TSS_USER],[The tss user to use]),
             [TSS_USER="$withval"],
             [TSS_USER="tss"]
 )

 AC_ARG_WITH([tss-group],
             AS_HELP_STRING([--with-tss-group=TSS_GROUP],[The tss group to use]),
             [TSS_GROUP="$withval"],
             [TSS_GROUP="tss"]
 )

 AC_SUBST([TSS_USER])
 AC_SUBST([TSS_GROUP])

 CFLAGS="$CFLAGS -Wreturn-type -Wsign-compare -Wswitch-enum"
 CFLAGS="$CFLAGS -Wmissing-prototypes -Wall -Werror"
 CFLAGS="$CFLAGS -Wformat -Wformat-security -Wshadow"
 CFLAGS="$CFLAGS $COVERAGE_CFLAGS $SANITIZER_CFLAGS"

 LDFLAGS="$LDFLAGS $COVERAGE_LDFLAGS $SANITIZER_LDFLAGS"

 dnl Simulate the following for systems with pkg-config < 0.28:
 dnl PKG_CHECK_VAR([libtpms_cryptolib], [libtpms], [cryptolib],
 dnl  [], AC_MSG_ERROR([Could not determine libtpms crypto library.]))
 PKG_PROG_PKG_CONFIG

 PKG_CHECK_VAR([libtpms_cryptolib],
     [libtpms],
     [cryptolib],
     [],
     [AC_MSG_ERROR([Could not determine libtpms crypto library.])]
 )

 AS_IF([test x"$libtpms_cryptolib" != x"$cryptolib"],
     [AC_MSG_NOTICE([libtpms is using $libtpms_cryptolib; we have to use the same])
     AS_IF([test "$cryptolib" = "openssl"],
         [AC_MSG_ERROR([do not use --with-openssl])],
         [AC_MSG_ERROR([use --with-openssl])]
     )
     ]
 )

 with_vtpm_proxy=no
 AS_CASE([$host_os],
     [linux-*],
     [with_vtpm_proxy=yes
     AC_DEFINE_UNQUOTED([WITH_VTPM_PROXY], 1,
                      [whether to build in vTPM proxy support (Linux only)])
     ]
 )

 dnl Seccomp profile using -lseccomp (Linux only)
 AS_CASE([$host_os],
     [linux-*],
     [with_seccomp_default=yes],
     [with_seccomp_default=no]
 )

 AC_MSG_CHECKING([for whether to build with seccomp profile])
 AC_ARG_WITH([seccomp],
   AS_HELP_STRING([--with-seccomp],[build with seccomp profile]),
   AC_MSG_RESULT([$with_seccomp]),
   [with_seccomp=$with_seccomp_default]
   AC_MSG_RESULT([$with_seccomp])
 )

 AS_IF([test "x$with_seccomp" != "xno"],
     [PKG_CHECK_MODULES([LIBSECCOMP],[libseccomp])
     AC_DEFINE_UNQUOTED([WITH_SECCOMP], 1,
         [whether to build in seccomp profile (Linux only)])
     ]
 )

 MY_CFLAGS="$CFLAGS"
 MY_LDFLAGS="$LDFLAGS"
 AC_SUBST([MY_CFLAGS])
 AC_SUBST([MY_LDFLAGS])

 AC_CONFIG_FILES([Makefile                   \
 		swtpm.spec                  \
 		samples/Makefile            \
 		samples/swtpm-localca.conf  \
 		samples/swtpm-create-user-config-files \
 		samples/swtpm_setup.conf    \
 		include/Makefile            \
 		include/swtpm/Makefile      \
 		include/swtpm.h             \
 		src/Makefile                \
 		src/selinux/Makefile        \
 		src/selinux/swtpm.fc        \
 		src/selinux/swtpmcuse.fc    \
 		src/swtpm/Makefile          \
 		src/swtpm_bios/Makefile     \
 		src/swtpm_cert/Makefile     \
 		src/swtpm_ioctl/Makefile    \
 		src/swtpm_localca/Makefile  \
 		src/swtpm_setup/Makefile    \
 		src/swtpm-sysusers.conf     \
 		src/swtpm-tmpfiles.conf     \
 		src/utils/Makefile          \
 		src/utils/swtpm_conf.h      \
 		man/Makefile                \
 		man/man3/Makefile           \
 		man/man5/Makefile           \
 		man/man8/Makefile           \
 		tests/Makefile              \
 		tests/test_config           \
 		])
 AC_CONFIG_FILES([samples/swtpm-localca],
                 [chmod 755 samples/swtpm-localca])
 AC_OUTPUT

 echo
 printf "with_gnutls     : %5s  (no = swtpm_cert will NOT be built)\n" $with_gnutls
 printf "with_selinux    : %5s  (no = SELinux policy extensions will NOT be built)\n" $with_selinux
 printf "with_cuse       : %5s  (no = no CUSE interface)\n" $with_cuse
 printf "with_chardev    : %5s  (no = no chardev interface)\n" $with_chardev
 printf "with_vtpm_proxy : %5s  (no = no vtpm proxy support; Linux only)\n" $with_vtpm_proxy
 printf "with_seccomp    : %5s  (no = no seccomp profile; Linux only)\n" $with_seccomp
 printf "enable_tests    : %5s  (no = no tests will run)\n" $enable_tests
 printf "\n"
 printf "active PCR banks      : %s\n" $DEFAULT_PCR_BANKS
 printf "TPM 2 profile support : yes\n"
 echo
 echo "Version to build  : $PACKAGE_VERSION"
 echo "Crypto library    : $cryptolib"
 echo
 echo "        MY_CFLAGS = $MY_CFLAGS"
 echo " HARDENING_CFLAGS = $HARDENING_CFLAGS"
 echo "HARDENING_LDFLAGS = $HARDENING_LDFLAGS"
 echo "       MY_LDFLAGS = $MY_LDFLAGS"
 echo "  LIBSECCOMP_LIBS = $LIBSECCOMP_LIBS"
 echo " JSON_GLIB_CFLAGS = $JSON_GLIB_CFLAGS"
 echo "   JSON_GLIB_LIBS = $JSON_GLIB_LIBS"
 echo "      GLIB_CFLAGS = $GLIB_CFLAGS"
 echo "        GLIB_LIBS = $GLIB_LIBS"
 echo "         GMP_LIBS = $GMP_LIBS"
 echo "       GMP_CFLAGS = $GMP_CFLAGS"
 echo "   LIBFUSE_CFLAGS = $LIBFUSE_CFLAGS"
 echo "     LIBFUSE_LIBS = $LIBFUSE_LIBS"
 echo
 echo "TSS_USER=$TSS_USER"
 echo "TSS_GROUP=$TSS_GROUP"
 echo
	dnl
	dnl configure.ac
	dnl
	dnl The Initial Developer of the Original Code is International
	dnl Business Machines Corporation. Portions created by IBM
	dnl Corporation are Copyright (C) 2014 International Business
	dnl Machines Corporation. All Rights Reserved.
	dnl
	dnl This program is free software; you can redistribute it and/or modify
	dnl it under the terms of the Common Public License as published by
	dnl IBM Corporation; either version 1 of the License, or (at your option)
	dnl any later version.
	dnl
	dnl This program is distributed in the hope that it will be useful,
	dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
	dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	dnl Common Public License for more details.
	dnl
	dnl You should have received a copy of the Common Public License
	dnl along with this program; if not, a copy can be viewed at
	dnl http://www.opensource.org/licenses/cpl1.0.php.
	dnl
	dnl This file is derived from tpm-tool's configure.in.
	dnl

	AC_INIT([swtpm],[0.11.0])
	AC_PREREQ([2.69])
	AC_CONFIG_SRCDIR(Makefile.am)
	AC_CONFIG_HEADERS([config.h])

	SWTPM_VER_MAJOR=`echo $PACKAGE_VERSION \| cut -d "." -f1`
	SWTPM_VER_MINOR=`echo $PACKAGE_VERSION \| cut -d "." -f2`
	SWTPM_VER_MICRO=`echo $PACKAGE_VERSION \| cut -d "." -f3`

	AC_SUBST([SWTPM_VER_MAJOR])
	AC_SUBST([SWTPM_VER_MINOR])
	AC_SUBST([SWTPM_VER_MICRO])

	dnl Check for programs
	AC_PROG_CC
	AC_PROG_INSTALL
	AC_PROG_LN_S
	LT_INIT

	AC_CONFIG_MACRO_DIR([m4])
	AC_CANONICAL_TARGET
	AC_CANONICAL_HOST
	AM_INIT_AUTOMAKE([foreign 1.6])
	AM_SILENT_RULES([yes])

	dnl Allow 64-bit file API on 32-bit systems. Without the change even small
	dnl files will fail to stat any files on filesystems with 64-bit inodes.
	AC_SYS_LARGEFILE

	AC_C_CONST
	AC_C_INLINE

	AC_TYPE_SIZE_T

	AC_PROG_CC
	AC_PROG_INSTALL
	AC_PROG_MKDIR_P

	AC_ARG_WITH([selinux],
	[AS_HELP_STRING([--with-selinux],
	[add SELinux policy extensions @<:@default=check@:>@])],
	[],
	[with_selinux="check"]
	)

	dnl Check for SELinux policy support

	AS_IF([test "x$with_selinux" != "xno"],
	[AC_PATH_PROG([SEMODULE], semodule)
	AS_IF([test -f /usr/share/selinux/devel/Makefile && test "x$SEMODULE" != "x"],
	[with_selinux="yes"],
	[test "x$with_selinux" = "xyes"],
	[AC_MSG_ERROR(["Is selinux-policy-devel installed?"])]
	)
	]
	)

	AM_CONDITIONAL([WITH_SELINUX], [test "x$with_selinux" = "xyes"])

	AS_IF([test "$prefix" = "/usr" && test "$sysconfdir" = '${prefix}/etc'],
	[sysconfdir="/etc"]
	)
	AS_IF([test "$prefix" = "" && test "$datarootdir" = '${prefix}/share'],
	[datarootdir="/usr/share"]
	)
	AS_IF([test "$prefix" = "/usr" && test "$localstatedir" = '${prefix}/var'],
	[localstatedir="/var"]
	)
	AS_IF([test "x$prefix" = "xNONE"],
	[prefix="/usr/local"]
	)
	AS_IF([test "x$exec_prefix" = "xNONE"],
	[exec_prefix=$prefix]
	)
	SYSCONFDIR=`eval echo $sysconfdir`
	DATAROOTDIR=`eval echo $datarootdir`
	LOCALSTATEDIR=`eval echo $localstatedir`
	BINDIR=`eval echo $bindir`
	AC_SUBST([SYSCONFDIR])
	AC_SUBST([DATAROOTDIR])
	AC_SUBST([LOCALSTATEDIR])
	AC_SUBST([BINDIR])

	cryptolib=openssl

	AC_ARG_WITH([openssl],
	[AS_HELP_STRING([--with-openssl],
	[build with openssl library])],
	[],
	[])

	AS_CASE([$cryptolib],[openssl],
	[PKG_CHECK_MODULES([LIBCRYPTO],[libcrypto >= 3.5])
	AC_CHECK_HEADERS([openssl/obj_mac.h],[],
	AC_MSG_ERROR(Is openssl-devel/libssl-dev installed?))
	AC_MSG_RESULT([Building with openssl crypto library])

	AC_CHECK_HEADERS([openssl/fips.h],
	[AC_DEFINE_UNQUOTED([HAVE_OPENSSL_FIPS_H], 1,
	[whether openssl/fips.h is available])]
	)
	AC_CHECK_LIB(crypto,
	[FIPS_mode_set],
	[AC_DEFINE_UNQUOTED([HAVE_OPENSSL_FIPS_MODE_SET_API], 1,
	[whether FIPS_mode_set API is available])]
	)
	],
	)

	AC_CHECK_PROG([OPENSSL_CLITOOL], [openssl], [yes], [no])
	AS_IF([test "$OPENSSL_CLITOOL" != "yes"],
	[AC_MSG_ERROR("Could not find openssl tool. Is openssl installed?")]
	)

	PKG_CHECK_MODULES([LIBTASN1],[libtasn1])

	PKG_CHECK_MODULES([LIBTPMS],[libtpms >= 0.11])


	AC_CHECK_LIB(c, clock_gettime, LIBRT_LIBS="", LIBRT_LIBS="-lrt")
	AC_SUBST([LIBRT_LIBS])

	AC_ARG_WITH([cuse],
	AS_HELP_STRING([--with-cuse],[build with CUSE interface]),
	[],
	[with_cuse=check]
	)

	AS_IF([test "x$with_cuse" != "xno"],
	[PKG_CHECK_MODULES([LIBFUSE],
	[fuse3],
	[with_cuse=yes],
	[PKG_CHECK_MODULES([LIBFUSE],
	[fuse],
	[LIBFUSE_CFLAGS="$LIBFUSE_CFLAGS -DWITH_FUSE2"],
	[AS_IF([test "x$with_cuse" = "xyes"],
	[AC_MSG_ERROR("Is fuse3-devel or fuse-devel installed? -- could not found libfuse3 or libfuse")],
	[with_cuse=no]
	)]
	)]
	)
	AS_IF([test "x$with_cuse" = "xyes"],
	[AC_DEFINE_UNQUOTED([WITH_CUSE], 1,
	[whether to build with CUSE interface])
	PKG_CHECK_MODULES([GTHREAD], gthread-2.0)])
	]
	)

	AM_CONDITIONAL([WITH_CUSE],[test "$with_cuse" = "yes"])
	AC_MSG_CHECKING([for whether to build with CUSE interface])
	AC_MSG_RESULT([$with_cuse])

	PKG_CHECK_MODULES([JSON_GLIB], [json-glib-1.0])

	PKG_CHECK_MODULES([GLIB], [glib-2.0])

	PKG_CHECK_MODULES([GMP], [gmp])

	AC_MSG_CHECKING([for whether to build with chardev interface])

	AS_CASE([$host_os],
	[linux-*],
	[with_chardev=yes
	AC_DEFINE_UNQUOTED([WITH_CHARDEV], 1,
	[whether to build with chardev interface])
	],
	[with_chardev=no]
	)

	AM_CONDITIONAL([WITH_CHARDEV],[test "$with_chardev" = "yes"])
	AC_MSG_RESULT($with_chardev)

	DEFAULT_PCR_BANKS="sha256"
	AC_ARG_ENABLE([default-pcr-banks],
	AS_HELP_STRING(
	[--enable-default-pcr-banks=list of PCR banks],
	[Have swtpm_setup activate the given PCR banks by default;
	default is sha256]
	),
	[],
	[]
	)

	AC_DEFUN([pcr_bank_checks], [
	AC_CHECK_PROG([bash], [bash], [yes], [no])
	AS_IF([test "x$bash" != "xyes"],
	[AC_MSG_ERROR([PCR bank verification requires bash, but executable not found.])])

	AC_MSG_CHECKING([which PCR banks to activate by default])
	REGEX="^(sha1\|sha256\|sha384\|sha512)(,(sha1\|sha256\|sha384\|sha512)){0,3}\$"
	AS_IF([bash -c "[[[ $DEFAULT_PCR_BANKS =~ $REGEX ]]] && exit 0 \|\| exit 1"],
	[AC_MSG_RESULT([$DEFAULT_PCR_BANKS])],
	[AC_MSG_ERROR([$DEFAULT_PCR_BANKS is an invalid list of PCR banks])])
	])

	AS_IF([test "x$enable_default_pcr_banks" != "x"],[
	DEFAULT_PCR_BANKS="$enable_default_pcr_banks"
	])
	pcr_bank_checks
	AC_SUBST([DEFAULT_PCR_BANKS])

	dnl tests and tools needed for tests
	AC_ARG_ENABLE([tests],
	[AS_HELP_STRING([--disable-tests], [Disable test; tools only needed for tests need not be installed])],
	[AS_CASE([$enableval],
	[yes],
	[enable_tests=yes],
	[no],
	[enable_tests=no],
	[AC_MSG_ERROR([bad value ${enableval} for --disable-tests])]
	)],
	[enable_tests=yes]
	)
	AM_CONDITIONAL(ENABLE_TESTS, [test x$enable_tests = xyes])

	AS_IF([test "x$enable_tests" = "xyes"],[
	dnl We either need netstat (more common across systems) or 'ss' for test cases
	AC_PATH_PROG([NETSTAT], [netstat])

	AS_IF([test "x$NETSTAT" = "x"],
	[AC_PATH_PROG([SS], [ss])
	AS_IF([test "x$SS" = "x"],
	[AC_MSG_ERROR(['netstat' and 'ss' tools are missing for tests: net-tools OR iproute/iproute2 package])]
	)
	]
	)

	AC_PATH_PROG([GAWK], gawk)
	AS_IF([test "x$GAWK" = "x"],
	AC_MSG_ERROR([gawk is required: gawk package])
	)

	AC_PATH_PROG([SOCAT], socat)
	AS_IF([test "x$SOCAT" = "x"],
	AC_MSG_ERROR([socat is required: socat package])
	)

	AC_PATH_PROG([BASE64], base64)
	AS_IF([test "x$BASE64" = "x"],
	AC_MSG_ERROR([base64 is required: base64 package])
	)

	AC_PATH_PROG([CP], cp)
	AS_IF([test "x$CP" = "x"],
	AC_MSG_ERROR([cp is required])
	)
	])

	AM_PATH_PYTHON([3.3])

	AC_ARG_ENABLE([hardening],
	AS_HELP_STRING([--disable-hardening], [Disable hardening flags]))

	AS_IF([test "x$enable_hardening" != "xno"],
	dnl Some versions of gcc fail with -Wstack-protector,
	dnl some with -Wstack-protector-strong enabled
	[AS_IF([! $CC -fstack-protector-strong -Wstack-protector $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null],
	[AS_IF([ $CC -fstack-protector -Wstack-protector $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null],
	[HARDENING_CFLAGS="-fstack-protector -Wstack-protector"])],
	[HARDENING_CFLAGS="-fstack-protector-strong -Wstack-protector"])
	dnl Only support -D_FORTIFY_SOURCE=2 and have higher levels passed in by user
	dnl since they may create more overhead
	AS_IF([$CC $CFLAGS -Werror -D_FORTIFY_SOURCE=2 $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null],
	[HARDENING_CFLAGS="$HARDENING_CFLAGS -D_FORTIFY_SOURCE=2"])
	dnl Check linker for 'relro' and 'now'
	save_CFLAGS="$CFLAGS"
	CFLAGS="-Wl,-z,relro -Werror"
	AC_MSG_CHECKING([whether linker supports -Wl,-z,relro])
	AC_LINK_IFELSE(
	[AC_LANG_SOURCE([[int main() { return 0; }]])],
	[HARDENING_LDFLAGS="$HARDENING_LDFLAGS -Wl,-z,relro"
	AC_MSG_RESULT(yes)
	],
	[AC_MSG_RESULT(no)]
	)
	CFLAGS="-Wl,-z,now -Werror"
	AC_MSG_CHECKING([whether linker supports -Wl,-z,now])
	AC_LINK_IFELSE(
	[AC_LANG_SOURCE([[int main() { return 0; }]])],
	[HARDENING_LDFLAGS="$HARDENING_LDFLAGS -Wl,-z,now"
	AC_MSG_RESULT(yes)],
	[AC_MSG_RESULT(no)]
	)
	CFLAGS="$save_CFLAGS"
	AC_SUBST([HARDENING_CFLAGS])
	AC_SUBST([HARDENING_LDFLAGS])
	]
	)

	AC_ARG_ENABLE([test-coverage],
	AS_HELP_STRING([--enable-test-coverage], [Enable test coverage flags]))

	AS_IF([test "x$enable_test_coverage" = "xyes"],
	[COVERAGE_CFLAGS="-fprofile-arcs -ftest-coverage"
	COVERAGE_LDFLAGS="-fprofile-arcs"
	]
	)

	AC_ARG_ENABLE([sanitizers],
	AS_HELP_STRING([--enable-sanitizers], [Enable address/undefined sanitizers]))

	AS_IF([test "x$enable_sanitizers" = "xyes"],
	[save_CFLAGS="$CFLAGS"
	CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
	AC_MSG_CHECKING([whether linker supports sanitizer])
	AC_LINK_IFELSE(
	[AC_LANG_SOURCE([[int main() { return 0; }]])],
	[SANITIZER_CFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
	SANITIZER_LDFLAGS="-fsanitize=address,undefined"
	AC_MSG_RESULT(yes)
	],
	[AC_MSG_RESULT(no)]
	)
	CFLAGS="$save_CFLAGS"
	]
	)

	AC_ARG_WITH([tss-user],
	AS_HELP_STRING([--with-tss-user=TSS_USER],[The tss user to use]),
	[TSS_USER="$withval"],
	[TSS_USER="tss"]
	)

	AC_ARG_WITH([tss-group],
	AS_HELP_STRING([--with-tss-group=TSS_GROUP],[The tss group to use]),
	[TSS_GROUP="$withval"],
	[TSS_GROUP="tss"]
	)

	AC_SUBST([TSS_USER])
	AC_SUBST([TSS_GROUP])

	CFLAGS="$CFLAGS -Wreturn-type -Wsign-compare -Wswitch-enum"
	CFLAGS="$CFLAGS -Wmissing-prototypes -Wall -Werror"
	CFLAGS="$CFLAGS -Wformat -Wformat-security -Wshadow"
	CFLAGS="$CFLAGS $COVERAGE_CFLAGS $SANITIZER_CFLAGS"

	LDFLAGS="$LDFLAGS $COVERAGE_LDFLAGS $SANITIZER_LDFLAGS"

	dnl Simulate the following for systems with pkg-config < 0.28:
	dnl PKG_CHECK_VAR([libtpms_cryptolib], [libtpms], [cryptolib],
	dnl [], AC_MSG_ERROR([Could not determine libtpms crypto library.]))
	PKG_PROG_PKG_CONFIG

	PKG_CHECK_VAR([libtpms_cryptolib],
	[libtpms],
	[cryptolib],
	[],
	[AC_MSG_ERROR([Could not determine libtpms crypto library.])]
	)

	AS_IF([test x"$libtpms_cryptolib" != x"$cryptolib"],
	[AC_MSG_NOTICE([libtpms is using $libtpms_cryptolib; we have to use the same])
	AS_IF([test "$cryptolib" = "openssl"],
	[AC_MSG_ERROR([do not use --with-openssl])],
	[AC_MSG_ERROR([use --with-openssl])]
	)
	]
	)

	with_vtpm_proxy=no
	AS_CASE([$host_os],
	[linux-*],
	[with_vtpm_proxy=yes
	AC_DEFINE_UNQUOTED([WITH_VTPM_PROXY], 1,
	[whether to build in vTPM proxy support (Linux only)])
	]
	)

	dnl Seccomp profile using -lseccomp (Linux only)
	AS_CASE([$host_os],
	[linux-*],
	[with_seccomp_default=yes],
	[with_seccomp_default=no]
	)

	AC_MSG_CHECKING([for whether to build with seccomp profile])
	AC_ARG_WITH([seccomp],
	AS_HELP_STRING([--with-seccomp],[build with seccomp profile]),
	AC_MSG_RESULT([$with_seccomp]),
	[with_seccomp=$with_seccomp_default]
	AC_MSG_RESULT([$with_seccomp])
	)

	AS_IF([test "x$with_seccomp" != "xno"],
	[PKG_CHECK_MODULES([LIBSECCOMP],[libseccomp])
	AC_DEFINE_UNQUOTED([WITH_SECCOMP], 1,
	[whether to build in seccomp profile (Linux only)])
	]
	)

	MY_CFLAGS="$CFLAGS"
	MY_LDFLAGS="$LDFLAGS"
	AC_SUBST([MY_CFLAGS])
	AC_SUBST([MY_LDFLAGS])

	AC_CONFIG_FILES([Makefile \
	swtpm.spec \
	samples/Makefile \
	samples/swtpm-localca.conf \
	samples/swtpm-create-user-config-files \
	samples/swtpm_setup.conf \
	include/Makefile \
	include/swtpm/Makefile \
	include/swtpm.h \
	src/Makefile \
	src/selinux/Makefile \
	src/selinux/swtpm.fc \
	src/selinux/swtpmcuse.fc \
	src/swtpm/Makefile \
	src/swtpm_bios/Makefile \
	src/swtpm_cert/Makefile \
	src/swtpm_ioctl/Makefile \
	src/swtpm_localca/Makefile \
	src/swtpm_setup/Makefile \
	src/swtpm-sysusers.conf \
	src/swtpm-tmpfiles.conf \
	src/utils/Makefile \
	src/utils/swtpm_conf.h \
	man/Makefile \
	man/man3/Makefile \
	man/man5/Makefile \
	man/man8/Makefile \
	tests/Makefile \
	tests/test_config \
	])
	AC_CONFIG_FILES([samples/swtpm-localca],
	[chmod 755 samples/swtpm-localca])
	AC_OUTPUT

	echo
	printf "with_gnutls : %5s (no = swtpm_cert will NOT be built)\n" $with_gnutls
	printf "with_selinux : %5s (no = SELinux policy extensions will NOT be built)\n" $with_selinux
	printf "with_cuse : %5s (no = no CUSE interface)\n" $with_cuse
	printf "with_chardev : %5s (no = no chardev interface)\n" $with_chardev
	printf "with_vtpm_proxy : %5s (no = no vtpm proxy support; Linux only)\n" $with_vtpm_proxy
	printf "with_seccomp : %5s (no = no seccomp profile; Linux only)\n" $with_seccomp
	printf "enable_tests : %5s (no = no tests will run)\n" $enable_tests
	printf "\n"
	printf "active PCR banks : %s\n" $DEFAULT_PCR_BANKS
	printf "TPM 2 profile support : yes\n"
	echo
	echo "Version to build : $PACKAGE_VERSION"
	echo "Crypto library : $cryptolib"
	echo
	echo " MY_CFLAGS = $MY_CFLAGS"
	echo " HARDENING_CFLAGS = $HARDENING_CFLAGS"
	echo "HARDENING_LDFLAGS = $HARDENING_LDFLAGS"
	echo " MY_LDFLAGS = $MY_LDFLAGS"
	echo " LIBSECCOMP_LIBS = $LIBSECCOMP_LIBS"
	echo " JSON_GLIB_CFLAGS = $JSON_GLIB_CFLAGS"
	echo " JSON_GLIB_LIBS = $JSON_GLIB_LIBS"
	echo " GLIB_CFLAGS = $GLIB_CFLAGS"
	echo " GLIB_LIBS = $GLIB_LIBS"
	echo " GMP_LIBS = $GMP_LIBS"
	echo " GMP_CFLAGS = $GMP_CFLAGS"
	echo " LIBFUSE_CFLAGS = $LIBFUSE_CFLAGS"
	echo " LIBFUSE_LIBS = $LIBFUSE_LIBS"
	echo
	echo "TSS_USER=$TSS_USER"
	echo "TSS_GROUP=$TSS_GROUP"
	echo