Fix requires and add group openstack-heat transition

changed require from python-paste to python-paste-deploy (rhbz#963207)

changed UID/GID back again to heat instead of openstack-heat
added group/user rename for old installs
changed systemd scripts to match heat user

Resolves: rhbz#963207

Conflicts:
	heat.spec

.gitignore

@@ -0,0 +1,4 @@
+/heat-4.tar.gz
+/heat-5.tar.gz
+/heat-6.tar.gz
+/heat-7.tar.gz

dead.package

@@ -1 +0,0 @@
-2014-06-04 - This package was already retired in pkgdb/blocked in koji, but no dead.package file existed. The original retirement reason is unclear.

heat-api-cfn.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=The Heat API provides an AWS CloudFormation-compatible API to the Heat Engine for starting AWS CloudFormation templates on OpenStack.
+After=syslog.target network.target heat-engine.service
+Requires=syslog.target network.target heat-engine.service
+
+[Service]
+ExecStart=/usr/bin/heat-api-cfn
+Restart=on-failure
+User=heat
+
+[Install]
+WantedBy=multi-user.target

heat-api-cloudwatch.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=The Heat CloudWatch API provides an AWS CloudWatch-compatible API to the Heat Engine
+After=syslog.target network.target heat-engine.service
+Requires=syslog.target network.target heat-engine.service
+
+[Service]
+ExecStart=/usr/bin/heat-api-cloudwatch
+Restart=on-failure
+User=heat
+
+[Install]
+WantedBy=multi-user.target

heat-api.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=The Heat API provides an OpenStack-native ReST API to the Heat Engine for starting AWS CloudFormation templates on OpenStack.
+After=syslog.target network.target heat-engine.service
+Requires=syslog.target network.target heat-engine.service
+
+[Service]
+ExecStart=/usr/bin/heat-api
+Restart=on-failure
+User=heat
+
+[Install]
+WantedBy=multi-user.target

heat-engine.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=The Heat Engine provides an OpenStack API for starting AWS CloudFormation templates on OpenStack.
+After=syslog.target network.target qpidd.service mysqld.service openstack-keystone.service tgtd.service openstack-glance-api.service openstack-glance-registry.service openstack-nova-api.service openstack-nova-objectstore.service openstack-nova.compute.service openstack-nova-network.service openstack-nova-volume.service openstack-nova-scheduler.service openstack-nova-cert.service
+Requires=syslog.target network.target qpidd.service mysqld.service openstack-keystone.service tgtd.service openstack-glance-api.service openstack-glance-registry.service openstack-nova-api.service openstack-nova-objectstore.service openstack-nova-compute.service openstack-nova-network.service openstack-nova-volume.service openstack-nova-scheduler.service openstack-nova-cert.service
+
+[Service]
+ExecStart=/usr/bin/heat-engine
+Restart=on-failure
+User=heat
+
+[Install]
+WantedBy=multi-user.target

heat-metadata.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=The Heat Metadata server provides an OpenStack API for Nova instances to communicate metadata to and from the Heat Engine.
+After=syslog.target network.target heat-engine.service
+Requires=syslog.target network.target heat-engine.service
+
+[Service]
+ExecStart=/usr/bin/heat-metadata
+Restart=on-failure
+User=heat
+
+[Install]
+WantedBy=multi-user.target

heat.logrotate

@@ -0,0 +1,7 @@
+/var/log/heat/*.log {
+    weekly
+    rotate 4
+    missingok
+    compress
+    minsize 100k
+}

heat.spec

@@ -0,0 +1,231 @@
+Name: heat
+Summary: This software provides AWS CloudFormation functionality for OpenStack Essex
+Version: 7
+Release: 2%{?dist}
+License: ASL 2.0
+Group: System Environment/Base
+URL: http://heat-api.org
+Source0: https://github.com/downloads/heat-api/heat/heat-%{version}.tar.gz
+Source1: heat.logrotate
+Source2: heat-api.service
+Source3: heat-api-cfn.service
+Source4: heat-engine.service
+Source5: heat-metadata.service
+Source6: heat-api-cloudwatch.service
+
+Patch0: switch-to-using-m2crypto.patch
+
+BuildArch: noarch
+BuildRequires: python2-devel
+BuildRequires: python-setuptools
+BuildRequires: systemd-units
+
+Requires: python-eventlet
+Requires: python-glanceclient
+Requires: python-greenlet
+Requires: python-httplib2
+Requires: python-iso8601
+Requires: python-keystoneclient
+Requires: python-kombu
+Requires: python-lxml
+Requires: python-memcached
+Requires: python-migrate
+Requires: python-novaclient
+Requires: python-paste-deploy
+Requires: python-qpid
+Requires: python-routes
+Requires: pysendfile
+Requires: python-sqlalchemy
+Requires: python-webob
+Requires: m2crypto
+
+Requires(post): systemd-units
+Requires(preun): systemd-units
+Requires(postun): systemd-units
+Requires(pre): shadow-utils
+
+%prep
+%setup -q
+%patch0 -p1
+
+%build
+%{__python} setup.py build
+
+%install
+%{__python} setup.py install -O1 --skip-build --root=%{buildroot}
+sed -i -e '/^#!/,1 d' %{buildroot}/%{python_sitelib}/heat/db/sqlalchemy/manage.py
+sed -i -e '/^#!/,1 d' %{buildroot}/%{python_sitelib}/heat/db/sqlalchemy/migrate_repo/manage.py
+sed -i -e '/^#!/,1 d' %{buildroot}/%{python_sitelib}/heat/testing/runner.py
+mkdir -p %{buildroot}/var/log/heat/
+install -p -D -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/logrotate.d/heat
+
+# install systemd unit files
+install -p -D -m 644 %{SOURCE2} %{buildroot}%{_unitdir}/heat-api.service
+install -p -D -m 644 %{SOURCE2} %{buildroot}%{_unitdir}/heat-api-cfn.service
+install -p -D -m 644 %{SOURCE3} %{buildroot}%{_unitdir}/heat-engine.service
+install -p -D -m 644 %{SOURCE4} %{buildroot}%{_unitdir}/heat-metadata.service
+install -p -D -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/heat-api-cloudwatch.service
+
+mkdir -p %{buildroot}/var/lib/heat/
+mkdir -p %{buildroot}/etc/heat/
+mkdir -p %{buildroot}/%{_mandir}/man1/
+cp -v docs/man/man1/* %{buildroot}/%{_mandir}/man1/
+rm -rf %{buildroot}/var/lib/heat/.dummy
+
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-api.conf %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-api-paste.ini %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-api-cfn.conf %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-api-cfn-paste.ini %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-api-cloudwatch.conf %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-api-cloudwatch-paste.ini %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-engine.conf %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-metadata.conf %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/heat/heat-metadata-paste.ini %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/boto.cfg %{buildroot}/%{_sysconfdir}/heat
+install -p -D -m 644 %{_builddir}/%{name}-%{version}/etc/bash_completion.d/heat %{buildroot}/%{_sysconfdir}/bash_completion.d/heat
+
+%description
+Heat provides AWS CloudFormation and CloudWatch functionality for OpenStack.
+
+%files
+%doc README.rst LICENSE
+%{_mandir}/man1/*.gz
+%{_bindir}/*
+%{python_sitelib}/heat*
+%dir %attr(0755,heat,root) %{_localstatedir}/log/heat
+%dir %attr(0755,heat,root) %{_localstatedir}/lib/heat
+%{_unitdir}/heat*.service
+%dir %{_sysconfdir}/heat
+%config(noreplace) %{_sysconfdir}/logrotate.d/heat
+%config(noreplace) %{_sysconfdir}/bash_completion.d/heat
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-api.conf
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-api-paste.ini
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-api-cfn.conf
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-api-cfn-paste.ini
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-api-cloudwatch.conf
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-api-cloudwatch-paste.ini
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-engine.conf
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-metadata.conf
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/heat-metadata-paste.ini
+%config(noreplace) %attr(-,root,heat) %{_sysconfdir}/heat/boto.cfg
+
+%pre
+# handle rename from old installs
+getent passwd 187 | cut -f1 -d: | grep -qx "openstack-heat"
+if [ $? -eq 0 ]; then
+    usermod -l heat openstack-heat
+    groupmod -n heat openstack-heat
+fi
+
+getent group heat >/dev/null || groupadd -r heat --gid 187
+getent passwd heat >/dev/null || \
+useradd -u 187 -r -g heat -d %{_localstatedir}/lib/heat -s /sbin/nologin \
+    -c "OpenStack Heat Daemon" heat
+exit 0
+
+%post
+%systemd_post heat-api.service
+%systemd_post heat-api-cfn.service
+%systemd_post heat-engine.service
+%systemd_post heat-metadata.service
+%systemd_post heat-api-cloudwatch.service
+
+%preun
+%systemd_preun heat-api.service
+%systemd_preun heat-api-cfn.service
+%systemd_preun heat-engine.service
+%systemd_preun heat-engine.service
+%systemd_preun heat-api-cloudwatch.service
+
+%postun
+%systemd_postun_with_restart heat-api.service
+%systemd_postun_with_restart heat-api-cfn.service
+%systemd_postun_with_restart heat-engine-cfn.service
+%systemd_postun_with_restart heat-metadata.service
+%systemd_postun_with_restart heat-api-cloudwatch.service
+
+%changelog
+* Wed May 29 2013 Jeff Peeler <jpeeler@redhat.com> 7-2
+- changed require from python-paste to python-paste-deploy (rhbz#963207)
+- changed UID/GID back again to heat instead of openstack-heat (rhbz#920348)
+  added group/user rename for old installs
+- changed systemd scripts to match heat user
+
+* Fri Oct 26 2012 Zane Bitter <zbitter@redhat.com> 7-1
+- rebase to v7
+- add heat-api daemon (OpenStack-native API)
+
+* Wed Sep 26 2012 Steven Dake <sdake@redhat.com> 6-6
+- Merge upstream commit 5208008db047d8cda231100db817c6f0e1c190a5
+- Resolves: RHBZ#860105
+- fix "heat-keystone-setup not available in heat rpm"
+
+* Wed Sep 26 2012 Steven Dake <sdake@redhat.com> 6-5
+- Merge upstream commit d9f63269f1a0205811cd84487787c8c1291a952b
+- Resolves: RHBZ#860726
+- fix "heat cli prints warning on each operation"
+
+* Wed Sep 26 2012 Jeff Peeler <jpeeler@redhat.com> 6-4
+- switch requires to python-glanceclient
+
+* Tue Sep 25 2012 Jeff Peeler <jpeeler@redhat.com> 6-3
+- change systemd scripts to use openstack-heat user
+
+* Fri Sep 21 2012 Jeff Peeler <jpeeler@redhat.com> 6-2
+- update m2crypto patch (Fedora)
+- fix user/group install permissions
+
+* Tue Sep 18 2012 Steven Dake <sdake@redhat.com> 6-1
+- update to new v6 binary names in heat
+
+* Tue Aug 21 2012 Jeff Peeler <jpeeler@redhat.com> 5-5
+- updated systemd scriptlets
+
+* Tue Aug  7 2012 Jeff Peeler <jpeeler@redhat.com> 5-4
+- make UID/GID more specific as openstack-heat
+
+* Tue Aug  7 2012 Jeff Peeler <jpeeler@redhat.com> 5-3
+- assign specific UID/GID for use with Heat account (845078)
+
+* Wed Aug 2 2012 Jeff Peeler <jpeeler@redhat.com> 5-2
+- create heat user and change file permissions
+- set systemd scripts to run as heat user
+
+* Fri Jul 27 2012 Ian Main <imain@redhat.com> - 5-1
+- added m2crypto patch.
+- bumped version for new release.
+- added boto.cfg to sysconfigdir
+
+* Tue Jul 24 2012 Jeff Peeler <jpeeler@redhat.com> - 4-5
+- added LICENSE to docs
+- added dist tag
+- added heat directory to files section
+- removed unnecessary defattr 
+
+* Tue Jul 24 2012 Jeff Peeler <jpeeler@redhat.com> - 4-4
+- remove pycrypto requires
+
+* Fri Jul 20 2012 Jeff Peeler <jpeeler@redhat.com> - 4-3
+- change python-devel to python2-devel
+
+* Wed Jul 11 2012 Jeff Peeler <jpeeler@redhat.com> - 4-2
+- add necessary requires
+- removed shebang line for scripts not requiring executable permissions
+- add logrotate, removes all rpmlint warnings except for python-httplib2
+- remove buildroot tag since everything since F10 has a default buildroot
+- remove clean section as it is not required as of F13
+- add systemd unit files
+- change source URL to download location which doesn't require a SHA
+
+* Fri Jun 8 2012 Steven Dake <sdake@redhat.com> - 4-1
+- removed jeos from packaging since that comes from another repository
+- compressed all separate packages into one package
+- removed setup options which were producing incorrect results
+- replaced python with {__python}
+- added a br on python-devel
+- added a --skip-build to the install step
+- added percent-dir for directories
+- fixed most rpmlint warnings/errors
+
+* Mon Apr 16 2012 Chris Alfonso <calfonso@redhat.com> - 3-1
+- initial openstack package log

sources

@@ -0,0 +1 @@
+85337c5b5c7e66561c8f1faf404310d6  heat-7.tar.gz

switch-to-using-m2crypto.patch

@@ -0,0 +1,74 @@
+From 38c97efe5c3e8e2d732f82dcf83cc74ea55dbe4e Mon Sep 17 00:00:00 2001
+From: Ian Main <imain@redhat.com>
+Date: Fri, 27 Jul 2012 08:43:10 -0700
+Subject: [PATCH] Switch to using M2Crypto
+
+This patch uses M2Crypto instead of PyCrypto to perform encryption
+and decryption of user authentication information.
+
+Change-Id: Ib40492d4d40a92bf0167c249b15458c89af4716e
+Signed-off-by: Ian Main <imain@redhat.com>
+---
+ heat/engine/auth.py | 22 ++++++++++++----------
+ tools/pip-requires  |  2 +-
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/heat/engine/auth.py b/heat/engine/auth.py
+index 1b1a11c..a90c6b7 100644
+--- a/heat/engine/auth.py
++++ b/heat/engine/auth.py
+@@ -24,8 +24,8 @@ from novaclient.exceptions import AuthorizationFailure
+ from heat.common import context
+ from heat.openstack.common import log as logging
+ 
+-from Crypto.Cipher import AES
+-from Crypto import Random
++import M2Crypto
++import os
+ 
+ from heat.openstack.common import cfg
+ from heat.openstack.common import importutils
+@@ -45,17 +45,19 @@ logger = logging.getLogger('heat.engine.auth')
+ def encrypt(auth_info):
+     if auth_info is None:
+         return None
+-    iv = Random.new().read(AES.block_size)
+-    cipher = AES.new(cfg.CONF.auth_encryption_key[:32], AES.MODE_CFB, iv)
+-    res = base64.b64encode(iv + cipher.encrypt(auth_info))
+-    return res
++    iv = os.urandom(16)
++    cipher = M2Crypto.EVP.Cipher(alg='aes_128_cbc',
++                                 key=cfg.CONF.auth_encryption_key, iv=iv,
++                                 op=1) # 1 is encode
++    return base64.b64encode(iv + cipher.update(auth_info) + cipher.final())
+ 
+ 
+ def decrypt(auth_info):
+     if auth_info is None:
+         return None
+     auth = base64.b64decode(auth_info)
+-    iv = auth[:AES.block_size]
+-    cipher = AES.new(cfg.CONF.auth_encryption_key[:32], AES.MODE_CFB, iv)
+-    res = cipher.decrypt(auth[AES.block_size:])
+-    return res
++    iv = auth[:16]
++    cipher = M2Crypto.EVP.Cipher(alg='aes_128_cbc',
++                                 key=cfg.CONF.auth_encryption_key, iv=iv,
++                                 op=0) # 0 is decode
++    return cipher.update(auth[16:]) + cipher.final()
+diff --git a/tools/pip-requires b/tools/pip-requires
+index 092419d..085567e 100644
+--- a/tools/pip-requires
++++ b/tools/pip-requires
+@@ -9,7 +9,7 @@
+ # installed using pip, therefore you will need to install the
+ # libxml2-dev(el) and libxslt-dev(el) packages.
+ 
+-PyCrypto
++M2Crypto
+ eventlet
+ greenlet
+ httplib2
+-- 
+1.7.11.7
+