Remove contrib dir

Resolves: rhbz#2389392
Resolves: rhbz#2389390
CVE-2025-54389
CVE-2025-54409

aide.conf

@@ -14,49 +14,20 @@ database_out=file:@@{DBDIR}/aide.db.new.gz
 # Whether to gzip the output to database
 gzip_dbout=yes
 
-# Database attributes to include in report (H = all compiled hashsums, default)
-database_attrs=H
-
-# Add metadata to database (version info, timestamps)
-database_add_metadata=yes
-
-# Warn about unrestricted rules during config check (default: false)
-config_check_warn_unrestricted_rules=false
-
-# Number of workers for parallel processing (default: 1, can use percentage)
-num_workers=1
-
 # Default.
 log_level=warning
 report_level=changed_attributes
 
-# Report format (plain or json)
-report_format=plain
-
-# Group files in report by added/removed/changed
-report_grouped=yes
-
-# Summarize changes in report
-report_summarize_changes=yes
-
-# Don't report if no differences found
-report_quiet=no
-
-# Report encoding (base64 is default, base16 available)
-report_base16=no
-
 report_url=file:@@{LOGDIR}/aide.log
 report_url=stdout
 #report_url=stderr
-#report_url=syslog:LOG_AUTH
+#NOT IMPLEMENTED report_url=mailto:root@foo.com
+#NOT IMPLEMENTED report_url=syslog:LOG_AUTH
 
 # These are the default rules.
 #
-#ftype:  file type
-#fstype: file system type (Linux-only)
 #p:      permissions
-#i:      inode
-#l:      link name (symbolic links only)
+#i:      inode:
 #n:      number of links
 #u:      user
 #g:      group
@@ -65,78 +36,55 @@ report_url=stdout
 #m:      mtime
 #a:      atime
 #c:      ctime
+#S:      check for growing size
 #acl:           Access Control Lists
 #selinux        SELinux security context
 #xattrs:        Extended file attributes
-#e2fsattrs:     file attributes on Linux file system
-#caps:          file capabilities (Linux-only)
-
-# Hashsums attributes (regular files only)
+#md5:    md5 checksum
+#sha1:   sha1 checksum
 #sha256:        sha256 checksum
 #sha512:        sha512 checksum
-#sha512_256:    SHA-512 checksum truncated to 256 output bits
-#sha3_256:      SHA3-256 checksum (modern)
-#sha3_512:      SHA3-512 checksum (modern)
-#stribog256:    GOST R 34.11-2012, 256 bit
-#stribog512:    GOST R 34.11-2012, 512 bit
+#rmd160: rmd160 checksum
+#tiger:  tiger checksum
 
-# DEPRECATED (will be removed in future versions):
-#md5:    md5 checksum (deprecated since v0.19)
-#sha1:   sha1 checksum (deprecated since v0.19)
-#rmd160: rmd160 checksum (deprecated since v0.19)
-#gost:   gost checksum (deprecated since v0.19)
+#haval:  haval checksum (MHASH only)
+#gost:   gost checksum (MHASH only)
+#crc32:  crc32 checksum (MHASH only)
+#whirlpool:     whirlpool checksum (MHASH only)
 
-# REMOVED in AIDE v0.19:
-#S:      check for growing size (use 'growing+s' instead)
-#tiger:  tiger checksum (removed)
-#haval:  haval checksum (removed)
-#crc32:  crc32 checksum (removed)
-#crc32b: crc32b checksum (removed)
-#whirlpool: whirlpool checksum (removed)
+FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
 
-# Special attributes for advanced use cases:
-#I:      ignore changed filename - detects moved files by inode
-#growing: ignore growing file size/timestamps for logs
-#compressed: ignore compression - compares uncompressed content
-#ANF:    allow new files - new files ignored in report
-#ARF:    allow removed files - missing files ignored in report
-
-# Default groups in AIDE v0.19:
-# R = p+ftype+i+l+n+u+g+s+m+c+sha3_256+X
-# L = p+ftype+i+l+n+u+g+X  
-# > = Growing file p+ftype+l+u+g+i+n+s+growing+X
-# H = all compiled in (and not deprecated) hashsums
-# X = acl+selinux+xattrs+e2fsattrs+caps (if compiled in)
-# E = Empty group
-# Use 'aide --version' to list the default compound groups.
+#R:             p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
+#L:             p+i+n+u+g+acl+selinux+xattrs
+#E:             Empty group
+#>:             Growing logfile p+u+g+i+n+S+acl+selinux+xattrs
 
 # You can create custom rules like this.
-# Note: Removed deprecated/removed hashsums (tiger, haval, crc32, crc32b, whirlpool, md5, sha1, rmd160, gost)
-ALLXTRAHASHES = sha256+sha512+sha512_256+sha3_256+sha3_512+stribog256+stribog512
-# Everything but access time (Ie. all changes) - updated with modern hashsums
+# With MHASH...
+# ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
+ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
+# Everything but access time (Ie. all changes)
 EVERYTHING = R+ALLXTRAHASHES
 
-# Base + sha512 (strong)
-NORMAL = R+sha512-m-c
+# Sane, with multiple hashes
+# NORMAL = R+rmd160+sha256+whirlpool
+NORMAL = FIPSR+sha512
 
-# Content only - added file type and strong hash
-CONTENT = ftype+sha512
+# For directories, don't bother doing hashes
+DIR = p+i+n+u+g+acl+selinux+xattrs
 
-# For directories, don't bother doing hashes - added file type and link name
-DIR = ftype+p+i+l+n+u+g+acl+selinux+xattrs
+# Access control only
+PERMS = p+i+u+g+acl+selinux
 
-# Access control only - added file type and link name
-PERMS = ftype+p+u+g+acl+selinux+xattrs
+# Logfile are special, in that they often change
+LOG = >
 
-# Logfiles are special, in that they often change due to log rotation
-# Track only: permissions, file type, user, group, number of links, SELinux context, extended attributes
-# Allow new files (ANF) and allow removed files (ARF) due to log rotation techniques
-# Don't track: size, inodes, timestamps, checksums and some special attributes (these change frequently with log rotation)
-LOG = p+ftype+u+g+n+ANF+ARF+selinux+xattrs
+# Just do sha256 and sha512 hashes
+LSPP = FIPSR+sha512
 
 # Some files get updated automatically, so the inode/ctime/mtime change
-# but we want to know when the data inside them changes - updated with modern hash
-DATAONLY = ftype+p+l+n+u+g+s+acl+selinux+xattrs+sha256
+# but we want to know when the data inside them changes
+DATAONLY =  p+n+u+g+s+acl+selinux+xattrs+sha256
 
 # Next decide what directories/files you want in the database.
 
@@ -145,220 +93,124 @@ DATAONLY = ftype+p+l+n+u+g+s+acl+selinux+xattrs+sha256
 /sbin   NORMAL
 /lib    NORMAL
 /lib64  NORMAL
-# Monitor /opt selectively to avoid noise from auto-updating applications
-/opt    CONTENT
+/opt    NORMAL
 /usr    NORMAL
+/root   NORMAL
 # These are too volatile
 !/usr/src
 !/usr/tmp
 
-# Admins dot files constantly change, just check perms
-/root/\..* PERMS
-!/root/.xauth*
-/root   NORMAL
-
 # Check only permissions, inode, user and group for /etc, but
 # cover some important files closely.
+/etc    PERMS
 !/etc/mtab
 # Ignore backup files
 !/etc/.*~
+/etc/exports  NORMAL
+/etc/fstab    NORMAL
+/etc/passwd   NORMAL
+/etc/group    NORMAL
+/etc/gshadow  NORMAL
+/etc/shadow   NORMAL
+/etc/security/opasswd   NORMAL
 
-# trusted databases
-/etc/hosts$      NORMAL
-/etc/host.conf$  NORMAL
-/etc/hostname$   NORMAL
-/etc/issue$      NORMAL
-/etc/issue.net$  NORMAL
-/etc/protocols$  NORMAL
-/etc/services$   NORMAL
-/etc/localtime$  NORMAL
-/etc/alternatives NORMAL
-/etc/mime.types$ NORMAL
-/etc/terminfo    NORMAL
-/etc/exports$    NORMAL
-/etc/fstab$      NORMAL
-/etc/passwd$     NORMAL
-/etc/group$      NORMAL
-/etc/gshadow$    NORMAL
-/etc/shadow$     NORMAL
-/etc/subgid$     NORMAL
-/etc/subuid$     NORMAL
-/etc/skel        NORMAL
-/etc/sssd        NORMAL
-/etc/swid        NORMAL
-/etc/system-release-cpe$ NORMAL
-/etc/tmux.conf$  NORMAL
-/etc/xattr.conf$ NORMAL
+/etc/hosts.allow   NORMAL
+/etc/hosts.deny    NORMAL
 
-# networking
-/etc/firewalld      NORMAL
-!/etc/NetworkManager/system-connections
-/etc/NetworkManager NORMAL
-/etc/networks$ NORMAL
-/etc/dhcp NORMAL
-/etc/wpa_supplicant NORMAL
-/etc/resolv.conf$ DATAONLY
+/etc/sudoers NORMAL
+/etc/skel NORMAL
 
-# logins and accounts
-/etc/login.defs$ NORMAL
-/etc/libuser.conf$ NORMAL
-/var/log/faillog$ PERMS
-/var/log/lastlog$ PERMS
-/var/run/faillock PERMS
-/etc/pam.d NORMAL
-/etc/security NORMAL
-/etc/securetty$ NORMAL
-/etc/polkit-1 NORMAL
-/etc/sudo.conf$ NORMAL
-/etc/sudoers$ NORMAL
-/etc/sudoers.d NORMAL
+/etc/logrotate.d NORMAL
+
+/etc/resolv.conf DATAONLY
+
+/etc/nscd.conf NORMAL
+/etc/securetty NORMAL
 
 # Shell/X starting files
-/etc/profile$ NORMAL
-/etc/profile.d NORMAL
-/etc/bashrc$ NORMAL
-/etc/bash_completion.d NORMAL
-/etc/zprofile$ NORMAL
-/etc/zshrc$ NORMAL
-/etc/zlogin$ NORMAL
-/etc/zlogout$ NORMAL
-/etc/X11 NORMAL
-/etc/shells$ NORMAL
+/etc/profile NORMAL
+/etc/bashrc NORMAL
+/etc/bash_completion.d/ NORMAL
+/etc/login.defs NORMAL
+/etc/zprofile NORMAL
+/etc/zshrc NORMAL
+/etc/zlogin NORMAL
+/etc/zlogout NORMAL
+/etc/profile.d/ NORMAL
+/etc/X11/ NORMAL
 
 # Pkg manager
-/etc/dnf NORMAL
-/etc/yum.repos.d NORMAL
-
-# auditing
-# AIDE produces an audit record, so this becomes perpetual motion.
-/var/log/audit PERMS
-/etc/audit NORMAL
-/etc/libaudit.conf$ NORMAL
-/etc/aide.conf$  NORMAL
-
-# System logs with proper logrotate handling
-/etc/rsyslog.conf$ NORMAL
-/etc/rsyslog.d NORMAL
-/etc/logrotate.conf$ NORMAL
-/etc/logrotate.d NORMAL
-/etc/systemd/journald.conf$ NORMAL
-
-# Log directory
-/var/log LOG
-# Journal files - exclude xattrs and link count due to systemd journal's user.crtime_usec extended attribute changes and new directory creation
-/var/log/journal LOG-xattrs-n
-
+/etc/yum.conf NORMAL
+/etc/yumex.conf NORMAL
+/etc/yumex.profiles.conf NORMAL
+/etc/yum/ NORMAL
+/etc/yum.repos.d/ NORMAL
 
+/var/log   LOG
 /var/run/utmp LOG
 
-
-# secrets
-/etc/pkcs11 NORMAL
-/etc/pki NORMAL
-/etc/ssl NORMAL
-/etc/certmonger NORMAL
-/var/lib/systemd/random-seed$ PERMS
-
-# init system
-/etc/systemd NORMAL
-/etc/sysconfig NORMAL
-/etc/rc.d NORMAL
-/etc/tmpfiles.d NORMAL
-/etc/machine-id$ NORMAL
-
-# boot config
-/etc/default NORMAL
-/etc/grub.d NORMAL
-/etc/grub2.cfg$ NORMAL
-/etc/dracut.conf$ NORMAL
-/etc/dracut.conf.d NORMAL
-
-# glibc linker
-/etc/ld.so.cache$ NORMAL
-/etc/ld.so.conf$ NORMAL
-/etc/ld.so.conf.d NORMAL
-/etc/ld.so.preload$ NORMAL
-
-# kernel config
-/etc/sysctl.conf$ NORMAL
-/etc/sysctl.d NORMAL
-/etc/modprobe.d NORMAL
-/etc/modules-load.d NORMAL
-/etc/depmod.d NORMAL
-/etc/udev NORMAL
-/etc/crypttab$ NORMAL
-
-#### Daemons ####
-
-# cron jobs
-/var/spool/at CONTENT
-/etc/at.allow$ CONTENT
-/etc/at.deny$ CONTENT
-/etc/anacrontab$ NORMAL
-/etc/cron.allow$ NORMAL
-/etc/cron.deny$ NORMAL
-/etc/cron.d NORMAL
-/etc/cron.daily NORMAL
-/etc/cron.hourly NORMAL
-/etc/cron.monthly NORMAL
-/etc/cron.weekly NORMAL
-/etc/crontab$ NORMAL
-/var/spool/cron/root CONTENT
-
-# time keeping
-/etc/chrony.conf$ NORMAL
-/etc/chrony.keys$ NORMAL
-
-# mail
-/etc/aliases$ NORMAL
-/etc/aliases.db$ NORMAL
-/etc/postfix NORMAL
-
-# ssh
-/etc/ssh/sshd_config$ NORMAL
-/etc/ssh/ssh_config$ NORMAL
-
-# stunnel
-/etc/stunnel NORMAL
-
-# ftp
-/etc/vsftpd CONTENT
-
-# printing
-/etc/cups NORMAL
-/etc/cupshelpers NORMAL
-/etc/avahi NORMAL
-
-# web server
-/etc/httpd NORMAL
-
-# dns
-/etc/named NORMAL
-/etc/named.conf$ NORMAL
-/etc/named.iscdlv.key$ NORMAL
-/etc/named.rfc1912.zones$ NORMAL
-/etc/named.root.key$ NORMAL
-
-# xinetd
-/etc/xinetd.conf$ NORMAL
-/etc/xinetd.d NORMAL
-
-# IPsec
-/etc/ipsec.conf$ NORMAL
-/etc/ipsec.secrets$ NORMAL
-/etc/ipsec.d NORMAL
-
-# USBGuard
-/etc/usbguard NORMAL
-
-# Now everything else
-/etc    PERMS
-
 # This gets new/removes-old filenames daily
 !/var/log/sa
 # As we are checking it, we've truncated yesterdays size to zero.
 !/var/log/aide.log
 
+# LSPP rules...
+# AIDE produces an audit record, so this becomes perpetual motion.
+# /var/log/audit/ LSPP
+/etc/audit/ LSPP
+/etc/libaudit.conf LSPP
+/usr/sbin/stunnel LSPP
+/var/spool/at LSPP
+/etc/at.allow LSPP
+/etc/at.deny LSPP
+/etc/cron.allow LSPP
+/etc/cron.deny LSPP
+/etc/cron.d/ LSPP
+/etc/cron.daily/ LSPP
+/etc/cron.hourly/ LSPP
+/etc/cron.monthly/ LSPP
+/etc/cron.weekly/ LSPP
+/etc/crontab LSPP
+/var/spool/cron/root LSPP
+
+/etc/login.defs LSPP
+/etc/securetty LSPP
+/var/log/faillog LSPP
+/var/log/lastlog LSPP
+
+/etc/hosts LSPP
+/etc/sysconfig LSPP
+
+/etc/inittab LSPP
+/etc/grub/ LSPP
+/etc/rc.d LSPP
+
+/etc/ld.so.conf LSPP
+
+/etc/localtime LSPP
+
+/etc/sysctl.conf LSPP
+
+/etc/modprobe.conf LSPP
+
+/etc/pam.d LSPP
+/etc/security LSPP
+/etc/aliases LSPP
+/etc/postfix LSPP
+
+/etc/ssh/sshd_config LSPP
+/etc/ssh/ssh_config LSPP
+
+/etc/stunnel LSPP
+
+/etc/vsftpd.ftpusers LSPP
+/etc/vsftpd LSPP
+
+/etc/issue LSPP
+/etc/issue.net LSPP
+
+/etc/cups LSPP
+
 # With AIDE's default verbosity level of 5, these would give lots of
 # warnings upon tree traversal. It might change with future version.
 #
@@ -366,7 +218,7 @@ DATAONLY = ftype+p+l+n+u+g+s+acl+selinux+xattrs+sha256
 #=/home           DIR
 
 # Ditto /var/log/sa reason...
-!/var/log/httpd
-# /boot/grub2/grubenv's timestamp is getting modified continuously due to "boot_success" implementation
-!/boot/grub2/grubenv
+!/var/log/and-httpd
 
+# Admins dot files constantly change, just check perms
+/root/\..* PERMS

aide.rpmlintrc

@@ -1,15 +0,0 @@
-# RPMlint configuration for aide package
-# These warnings are expected and intentional for security reasons
-
-# AIDE log directory has restricted permissions (700) for security
-# Log files may contain sensitive security information
-addFilter("aide.* non-standard-dir-perm /var/log/aide 700")
-
-# AIDE configuration file has restricted permissions (600) for security  
-# Configuration reveals what files/directories are monitored
-addFilter("aide.* non-readable /etc/aide.conf 600")
-
-# FSF address in COPYING file is outdated - this is an upstream issue
-# The license text contains the old FSF address format
-addFilter("aide.* incorrect-fsf-address /usr/share/licenses/aide/COPYING")
-

aide.spec

@@ -1,12 +1,14 @@
+%global forgeurl https://github.com/%{name}/%{name}
+
 Summary:        Intrusion detection environment
 Name:           aide
 Version:        0.19.2
 Release:        %autorelease
-URL:            https://github.com/aide/aide
+URL:            https://aide.github.io/
 License:        GPL-2.0-or-later
 
-Source0:        %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz
-Source1:        %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz.asc
+Source0:        %{forgeurl}/releases/download/v%{version}/%{name}-%{version}.tar.gz
+Source1:        %{forgeurl}/releases/download/v%{version}/%{name}-%{version}.tar.gz.asc
 # gpg2 --recv-keys 2BBBD30FAAB29B3253BCFBA6F6947DAB68E7B931
 # gpg2 --export --export-options export-minimal 2BBBD30FAAB29B3253BCFBA6F6947DAB68E7B931 >gpgkey-aide.gpg
 Source2:        gpgkey-aide.gpg
@@ -18,7 +20,7 @@ BuildRequires:  gcc
 BuildRequires:  make
 BuildRequires:  bison flex
 BuildRequires:  pcre2-devel
-BuildRequires:  libgpg-error-devel nettle-devel
+BuildRequires:  libgpg-error-devel libgcrypt-devel
 BuildRequires:  zlib-devel
 BuildRequires:  libcurl-devel
 BuildRequires:  libacl-devel
@@ -42,15 +44,14 @@ checker and intrusion detection program.
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
-cp -a %{SOURCE4} .
+cp -a %{S:4} .
 
 %build
 #autoreconf -ivf
 %configure  \
   --disable-static \
   --with-config_file=%{_sysconfdir}/aide.conf \
-  --without-gcrypt \
-  --with-nettle \
+  --with-gcrypt \
   --with-zlib \
   --with-curl \
   --with-posix-acl \
@@ -65,8 +66,8 @@ make check
 
 %install
 %make_install bindir=%{_sbindir}
-install -Dpm0644 -t %{buildroot}%{_sysconfdir} %{SOURCE3}
-install -Dpm0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/logrotate.d/aide
+install -Dpm0644 -t %{buildroot}%{_sysconfdir} %{S:3}
+install -Dpm0644 %{S:5} %{buildroot}%{_sysconfdir}/logrotate.d/aide
 mkdir -p %{buildroot}%{_localstatedir}/log/aide
 mkdir -p -m0700 %{buildroot}%{_localstatedir}/lib/aide