Enable SELinux flag for JIT usage

Resolves: #2427017 Signed-off-by: Antonio Torres <antorres@redhat.com>
Update to 3.2.8
2026-01-07 11:21:33 +01:00 · 2025-11-10 10:07:43 +01:00 · 2025-07-23 20:47:53 +00:00 · 2025-07-08 14:25:54 +02:00 · 2025-06-16 07:04:30 +00:00 · 2025-06-11 10:02:40 +02:00
27 changed files with 704 additions and 1060 deletions
--- a/.gitignore
+++ b/.gitignore
@ -33,3 +33,16 @@ freeradius-*.src.rpm
 /freeradius-server-3.0.18.tar.bz2
 /freeradius-server-3.0.19.tar.bz2
 /freeradius-server-3.0.20.tar.bz2
+/freeradius-server-3.0.21.tar.bz2
+/freeradius-server-3.0.22.tar.bz2
+/freeradius-server-3.0.23.tar.bz2
+/freeradius-server-3.0.24.tar.bz2
+/freeradius-server-3.0.25.tar.bz2
+/freeradius-server-3.2.0.tar.bz2
+/freeradius-server-3.2.1.tar.bz2
+/freeradius-server-3.2.2.tar.bz2
+/freeradius-server-3.2.3.tar.bz2
+/freeradius-server-3.2.4.tar.bz2
+/freeradius-server-3.2.5.tar.bz2
+/freeradius-server-3.2.7.tar.bz2
+/freeradius-server-3.2.8.tar.bz2
--- a/385
+++ b/385
@ -1,385 +0,0 @@
-#!/usr/bin/env python
-
-import exceptions
-import getopt
-import os
-import re
-import rpm
-import select
-import subprocess
-import sys
-
-#------------------------------------------------------------------------------
-
-def get_rlms(root):
-    rlm_re = re.compile(r'^rlm_')
-    version_re = re.compile(r'-[0-9.]+\.so$')
-    names = os.listdir(root)
-    names = [x for x in names if rlm_re.search(x)]
-    names = [x for x in names if not version_re.search(x)]
-    names.sort()
-    return names
-
-#------------------------------------------------------------------------------
-
-debug = False
-verbose = False
-
-exclude_rpms = ['glibc']
-
-build = '2.0.2-1.fc8'
-root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius'
-libdirs = ['/lib','/usr/lib']
-
-#------------------------------------------------------------------------------
-
-def get_rpm_nvr_from_header(hdr):
-    'Given an RPM header return the package NVR as a string'
-    name    = hdr['name']
-    version = hdr['version']
-    release = hdr['release']
-
-    return "%s-%s-%s" % (name, version, release)
-
-def get_rpm_hdr_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = None
-    try:
-        ts = rpm.ts()
-        mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path)
-        for hdr in mi: break
-    except Exception, e:
-        print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e)
-        hdr = None
-    return hdr
-
-def get_rpm_nvr_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = get_rpm_hdr_by_file_path(path)
-    if not hdr:
-        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
-    nvr = get_rpm_nvr_from_header(hdr)
-    return nvr
-
-def get_rpm_name_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = get_rpm_hdr_by_file_path(path)
-    if not hdr:
-        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
-    name = hdr['name']
-    return name
-
-#------------------------------------------------------------------------------
-
-class CmdError(exceptions.Exception):
-    def __init__(self, errno, msg):
-        self.errno = errno
-        self.msg = msg
-
-
-class Command:
-    def __init__(self, cmd):
-        self.cmd = cmd
-        self.sub_process = None
-        self.bufsize = 1024
-        self.stdout_buf = ''
-        self.stderr_buf = ''
-        self.stdout_lines = []
-        self.stderr_lines = []
-
-    def run(self, stdout_callback=None, stderr_callback=None):
-        self.sub_process = subprocess.Popen(self.cmd, \
-            stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \
-            close_fds=True, shell=True)
-        self.stdout = self.sub_process.stdout
-        self.stderr = self.sub_process.stderr
-
-        read_watch = [self.stdout, self.stderr]
-        while read_watch:
-            readable = select.select(read_watch, [], [])[0]
-            for fd in readable:
-                if fd == self.stdout:
-                    data = os.read(fd.fileno(), self.bufsize)
-                    if not data:
-                        read_watch.remove(fd)
-                    else:
-                        self.stdout_buf += data
-                    for line in self.burst_lines('stdout_buf'):
-                        if stdout_callback: stdout_callback(line)
-                        self.stdout_lines.append(line)
-                if fd == self.stderr:
-                    data = os.read(fd.fileno(), self.bufsize)
-                    if not data:
-                        read_watch.remove(fd)
-                    else:
-                        self.stderr_buf += data
-                    for line in self.burst_lines('stderr_buf'):
-                        if stdout_callback: stderr_callback(line)
-                        self.stderr_lines.append(line)
-
-        self.returncode = self.sub_process.wait()
-        if self.returncode:
-            raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines)))
-
-        return self.returncode
-
-    def burst_lines(self, what):
-        buf = getattr(self, what)
-        start = 0
-        end = buf.find('\n', start)
-        while end >= 0:
-            end += 1                # include newline
-            line = buf[start:end]
-            yield line
-            start = end
-            end = buf.find('\n', start)
-        buf = buf[start:]
-        setattr(self, what, buf)
-
-
-#------------------------------------------------------------------------------
-
-def get_so_requires(path):
-    requires = {}
-    cmd = 'ldd %s' % (path)
-    so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)')
-
-    c = Command(cmd)
-    status = c.run()
-
-    for line in c.stdout_lines:
-        line = line.strip()
-        match = so_re.search(line)
-        if match:
-            so_name = match.group(1)
-            if match.group(2).startswith('/'):
-                so_path = match.group(2)
-            else:
-                so_path = None
-
-            requires[so_name] = so_path
-    return requires
-
-def get_so_needed(path):
-    needed = []
-    cmd = 'readelf -d %s' % (path)
-    so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]')
-
-    c = Command(cmd)
-    status = c.run()
-
-    for line in c.stdout_lines:
-        line = line.strip()
-        match = so_re.search(line)
-        if match:
-            so_name = match.group(1)
-            needed.append(so_name)
-    return needed
-
-def format_size(size):
-    if size > 1000000000:
-        return '%.1f GB' % (size/1000000000.0)
-    if size > 1000000:
-        return '%.1f MB' % (size/1000000.0)
-    if size > 1000:
-        return '%.1f KB' % (size/1000.0)
-    return '%d' % (size)
-#------------------------------------------------------------------------------
-
-class RPM_Prop:
-    def __init__(self, path=None, name=None):
-        self.name = name
-        self.paths = {}
-        self.rpm_hdr = None
-        self.used_by = {}
-        if path:
-            self.register_path(path)
-            if not self.rpm_hdr:
-                self.rpm_hdr = get_rpm_hdr_by_file_path(path)
-            if self.rpm_hdr:
-                if not self.name:
-                    self.name = self.rpm_hdr[rpm.RPMTAG_NAME]
-                self.size = self.rpm_hdr[rpm.RPMTAG_SIZE]
-
-    def __str__(self):
-        return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys()))
-
-    def register_path(self, path, name=None):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        return self.paths.setdefault(path, path)
-
-class RPM_Collection:
-    def __init__(self):
-        self.names = {}
-        self.paths = {}
-
-    def __str__(self):
-        text = ''
-        names = self.get_names()
-        for name in names:
-            text += "%s: %s\n" % (name, self.names[name])
-        return text
-
-    def register_path(self, path):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        rpm_prop = self.paths.get(path)
-        if not rpm_prop:
-            rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path))
-        self.names.setdefault(rpm_prop.name, rpm_prop)
-        return rpm_prop
-
-    def get_names(self):
-        names = self.names.keys()
-        names.sort()
-        return names
-
-    def get_name(self, name):
-        return self.names.get(name)
-
-class SO_File:
-    def __init__(self, name=None, path=None):
-        self.name = name
-        self.path = path
-        self.rpm = None
-
-    def __str__(self):
-        if self.rpm:
-            rpm_name = self.rpm.name
-        else:
-            rpm_name = None
-        return "name=%s rpm=%s" % (self.name, rpm_name)
-
-class SO_Collection:
-    def __init__(self):
-        self.names = {}
-        self.paths = {}
-
-    def __str__(self):
-        text = ''
-        names = self.get_names()
-        for name in names:
-            text += "%s: %s\n" % (name, self.names[name])
-        return text
-
-    def register_path(self, path, name=None):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        so_prop = self.paths.get(path)
-        if not so_prop:
-            so_prop = self.paths.setdefault(path, SO_File(name, path=path))
-        self.names.setdefault(name, so_prop)
-        return so_prop
-
-    def get_names(self):
-        names = self.names.keys()
-        names.sort()
-        return names
-
-class LoadableModule:
-    def __init__(self, path, name=None):
-        if name is None:
-            name = os.path.basename(path)
-        self.name = name
-        self.path = path
-        self.rpm_names = {}
-        self.sos = SO_Collection()
-        self.get_so_requires()
-
-    def __str__(self):
-        text = '%s\n' % (self.name)
-        text += "    RPM's: %s\n" % (','.join(self.get_rpm_names()))
-        text += "    SO's: %s\n" % (','.join(self.sos.get_names()))
-        return text
-
-    def get_so_requires(self):
-        requires = get_so_requires(self.path)
-        needed = get_so_needed(self.path)
-        #print "%s requires=%s" % (self.name, requires)
-        #print "%s needed=%s" % (self.name, needed)
-
-        for so_name, so_path in requires.items():
-            if so_name not in needed: continue
-            if so_path:
-                so_prop = self.sos.register_path(so_path, so_name)
-                rpm_prop = rpms.register_path(so_prop.path)
-                rpm_prop.used_by[self.name] = 1
-                self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name)
-                so_prop.rpm = rpm_prop
-            else:
-                so_prop = None
-            if verbose: print "found so='%s' %s" % (so_name, so_prop)
-
-    def register_so(self, so):
-        if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so)
-        self.sos.setdefault(so, so)
-        self.names.setdefault(so.name, so)
-        return so
-
-    def get_rpm_names(self):
-        rpm_names = self.rpm_names.keys()
-        rpm_names.sort()
-        return rpm_names
-
-    def get_sos(self):
-        sos = self.sos.keys()
-        sos.sort(lambda a,b: cmp(a.name, b.name))
-        return sos
-
-#------------------------------------------------------------------------------
-
-#------------------------------------------------------------------------------
-
-opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose'])
-for o, a in opts:
-    if o in ['-b', '--build']:
-        build = a
-    elif o in ['-v', '--verbose']:
-        verbose = True
-    else:
-        print >> sys.stderr, "Unknown arg: %s" % o
-        sys.exit(1)
-
-root = root_template % build
-modules = get_rlms(root)
-module_paths = [os.path.join(root,x) for x in modules]
-rpms = RPM_Collection()
-
-lms = []
-for module_path in module_paths[:]:
-    lm = LoadableModule(module_path)
-    lms.append(lm)
-
-
-print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules))
-
-for lm in lms:
-    rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms]
-    if rpm_names:
-        print lm.name
-        print '    %s' % (','.join(rpm_names))
-
-print "--------------"
-
-rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms]
-rpm_props.sort(lambda a,b: cmp(a.name, b.name))
-for rpm_prop in rpm_props:
-    used_by = rpm_prop.used_by.keys()
-    used_by.sort()
-    print "%s: %s" % (rpm_prop.name, ','.join(used_by))
-
-print "--------------"
-
-rpm_props.sort(lambda a,b: cmp(a.size, b.size))
-for rpm_prop in rpm_props:
-    print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name)
-
-
-print "--------------"
-
-for lm in lms:
-    print lm
--- a/freeradius-Add-missing-option-descriptions.patch
+++ b/freeradius-Add-missing-option-descriptions.patch
@ -1,97 +0,0 @@
-From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001
-From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
-Date: Fri, 14 Sep 2018 12:20:11 +0300
-Subject: [PATCH] man: Add missing option descriptions
-
---
- man/man8/raddebug.8 | 4 ++++
- man/man8/radiusd.8  | 7 +++++++
- man/man8/radmin.8   | 4 ++++
- 3 files changed, 15 insertions(+)
-
-diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8
-index 66e80e64fa..6e27e2453c 100644
--- a/man/man8/raddebug.8
-+++ b/man/man8/raddebug.8
-@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server.
- .IR condition ]
- .RB [ \-d
- .IR config_directory ]
-+.RB [ \-D
-+.IR dictionary_directory ]
- .RB [ \-n
- .IR name ]
- .RB [ \-i
-@@ -73,6 +75,8 @@ option is equivalent to using:
- .IP "\-d \fIconfig directory\fP"
- The radius configuration directory, usually /etc/raddb.  See the
- \fIradmin\fP manual page for more description of this option.
-+.IP "\-D \fIdictionary directory\fP"
-+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
- .IP "\-n \fImname\fP"
- Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP.
- .IP \-I\ \fIipv6-address\fP
-diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8
-index c825f22d0d..98aef5e1be 100644
--- a/man/man8/radiusd.8
-+++ b/man/man8/radiusd.8
-@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server
- .RB [ \-C ]
- .RB [ \-d
- .IR config_directory ]
-+.RB [ \-D
-+.IR dictionary_directory ]
- .RB [ \-f ]
- .RB [ \-h ]
- .RB [ \-i
-@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server
- .IR name ]
- .RB [ \-p
- .IR port ]
-+.RB [ \-P ]
- .RB [ \-s ]
- .RB [ \-t ]
- .RB [ \-v ]
-@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked.
- .IP "\-d \fIconfig directory\fP"
- Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration
- files such as the \fIdictionary\fP and the \fIusers\fP files.
-+.IP "\-D \fIdictionary directory\fP"
-+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
- .IP \-f
- Do not fork, stay running as a foreground process.
- .IP \-h
-@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in
- \fIradiusd.conf\fP are ignored.
- 
- This option MUST be used in conjunction with "-i".
-+.IP "\-P
-+Always write out PID, even with -f.
- .IP \-s
- Run in "single server" mode.  The server normally runs with multiple
- threads and/or processes, which can lower its response time to
-diff --git a/man/man8/radmin.8 b/man/man8/radmin.8
-index 5ecc963d81..5bf661fa71 100644
--- a/man/man8/radmin.8
-+++ b/man/man8/radmin.8
-@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool
- .B radmin
- .RB [ \-d
- .IR config_directory ]
-+.RB [ \-D
-+.IR dictionary_directory ]
- .RB [ \-e
- .IR command ]
- .RB [ \-E ]
-@@ -34,6 +36,8 @@ The following command-line options are accepted by the program.
- Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server
- configuration files to find the "listen" section that defines the
- control socket filename.
-+.IP "\-D \fIdictionary directory\fP"
-+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
- .IP "\-e \fIcommand\fP"
- Run \fIcommand\fP and exit.
- .IP \-E
-- 
-2.18.0
-
--- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
+++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
@ -3,25 +3,27 @@ From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Mon, 8 Sep 2014 12:32:13 +0300
 Subject: [PATCH] Adjust configuration to fit Red Hat specifics

+[antorres@redhat.com]: update patch to match 3.2.7 release
+
 ---
 raddb/mods-available/eap | 4 ++--
 raddb/radiusd.conf.in    | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 2621e183c..94494b2c6 100644
+index 84660d7c1e..ffcef4b406 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -533,7 +533,7 @@
- 			#  You should also delete all of the files
- 			#  in the directory when the server starts.
+@@ -696,7 +696,7 @@ eap {
+ 			#  and create the temporary directory with the
+ 			#  systemd `RuntimeDirectory` unit option.
 			#
 -		#	tmpdir = /tmp/radiusd
 +		#	tmpdir = /var/run/radiusd/tmp
 
 			#  The command used to verify the client cert.
 			#  We recommend using the OpenSSL command-line
-@@ -548,7 +548,7 @@
+@@ -711,7 +711,7 @@ eap {
 			#  deleted by the server when the command
 			#  returns.
 			#
@ -30,6 +32,7 @@ index 2621e183c..94494b2c6 100644
 		}
 
 		#  OCSP Configuration
+
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in
--- a/freeradius-OpenSSL-HMAC-MD5.patch
+++ b/freeradius-OpenSSL-HMAC-MD5.patch
@ -1,68 +0,0 @@
-From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Fri, 28 Sep 2018 09:54:46 -0400
-Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's
-
-If OpenSSL EVP is not found, fallback to internal implementation of
-HMAC-MD5.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
---
- src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++-
- 1 file changed, 33 insertions(+), 1 deletion(-)
-
-diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c
-index 2c662ff368..1cca00fa2a 100644
--- a/src/lib/hmacmd5.c
-+++ b/src/lib/hmacmd5.c
-@@ -27,10 +27,41 @@
-
- RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $")
-
-+#ifdef HAVE_OPENSSL_EVP_H
-+#include <openssl/hmac.h>
-+#include <openssl/evp.h>
-+#endif
-+
- #include <freeradius-devel/libradius.h>
- #include <freeradius-devel/md5.h>
-
-/** Calculate HMAC using MD5
-+#ifdef HAVE_OPENSSL_EVP_H
-+/** Calculate HMAC using OpenSSL's MD5 implementation
-+ *
-+ * @param digest Caller digest to be filled in.
-+ * @param text Pointer to data stream.
-+ * @param text_len length of data stream.
-+ * @param key Pointer to authentication key.
-+ * @param key_len Length of authentication key.
-+ *
-+ */
-+void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
-+		 uint8_t const *key, size_t key_len)
-+{
-+	HMAC_CTX *ctx  = HMAC_CTX_new();
-+
-+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
-+	/* Since MD5 is not allowed by FIPS, explicitly allow it. */
-+	HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-+#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */
-+
-+	HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL);
-+	HMAC_Update(ctx, text, text_len);
-+	HMAC_Final(ctx, digest, NULL);
-+	HMAC_CTX_free(ctx);
-+}
-+#else
-+/** Calculate HMAC using internal MD5 implementation
-  *
-  * @param digest Caller digest to be filled in.
-  * @param text Pointer to data stream.
-@@ -101,6 +132,7 @@
- 					      * hash */
- 	fr_md5_final(digest, &context);	  /* finish up 2nd pass */
- }
-+#endif /* HAVE_OPENSSL_EVP_H */
-
- /*
- Test Vectors (Trailing '\0' of a character string not included in test):
--- a/freeradius-OpenSSL-HMAC-SHA1.patch
+++ b/freeradius-OpenSSL-HMAC-SHA1.patch
@ -1,73 +0,0 @@
-From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Fri, 28 Sep 2018 11:03:52 -0400
-Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's
-
-If OpenSSL EVP is not found, fallback to internal implementation of
-HMAC-SHA1.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
---
- src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++-
- 1 file changed, 28 insertions(+), 1 deletion(-)
-
-diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c
-index c3cbd87a2c..211470ea35 100644
--- a/src/lib/hmacsha1.c
-+++ b/src/lib/hmacsha1.c
-@@ -10,13 +10,19 @@
-
- RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $")
-
-+#ifdef HAVE_OPENSSL_EVP_H
-+#include <openssl/hmac.h>
-+#include <openssl/evp.h>
-+#endif
-+
- #include <freeradius-devel/libradius.h>
-
- #ifdef HMAC_SHA1_DATA_PROBLEMS
- unsigned int sha1_data_problems = 0;
- #endif
-
-/** Calculate HMAC using SHA1
-+#ifdef HAVE_OPENSSL_EVP_H
-+/** Calculate HMAC using OpenSSL's SHA1 implementation
-  *
-  * @param digest Caller digest to be filled in.
-  * @param text Pointer to data stream.
-@@ -28,6 +34,26 @@
- void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
- 		  uint8_t const *key, size_t key_len)
- {
-+	HMAC_CTX *ctx  = HMAC_CTX_new();
-+	HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL);
-+	HMAC_Update(ctx, text, text_len);
-+	HMAC_Final(ctx, digest, NULL);
-+	HMAC_CTX_free(ctx);
-+}
-+
-+#else
-+
-+/** Calculate HMAC using internal SHA1 implementation
-+ *
-+ * @param digest Caller digest to be filled in.
-+ * @param text Pointer to data stream.
-+ * @param text_len length of data stream.
-+ * @param key Pointer to authentication key.
-+ * @param key_len Length of authentication key.
-+ */
-+void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
-+		  uint8_t const *key, size_t key_len)
-+{
- 	fr_sha1_ctx context;
- 	uint8_t k_ipad[65];    /* inner padding - key XORd with ipad */
- 	uint8_t k_opad[65];    /* outer padding - key XORd with opad */
-@@ -142,6 +168,7 @@
- 	}
- #endif
- }
-+#endif /* HAVE_OPENSSL_EVP_H */
-
- /*
- Test Vectors (Trailing '\0' of a character string not included in test):
--- a/freeradius-Use-system-crypto-policy-by-default.patch
+++ b/freeradius-Use-system-crypto-policy-by-default.patch
@ -4,6 +4,7 @@ Date: Wed, 8 May 2019 10:16:31 -0400
 Subject: [PATCH] Use system-provided crypto-policies by default

 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+[antorres@redhat.com]: update patch to 3.2.1 state
 ---
 raddb/mods-available/eap        | 4 ++--
 raddb/mods-available/inner-eap  | 2 +-
@ -12,21 +13,21 @@ Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 4 files changed, 6 insertions(+), 6 deletions(-)

 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 36849e10f2..b28c0f19c6 100644
+index 62152a6dfc..9f64963034 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -368,7 +368,7 @@ eap {
- 		#
- 		#  For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
+@@ -400,7 +400,7 @@ eap {
+ 		#  TLS cipher suites.  The format is listed
+ 		#  in "man 1 ciphers".
 		#
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
 
- 		#  If enabled, OpenSSL will use server cipher list
- 		#  (possibly defined by cipher_list option above)
-@@ -912,7 +912,7 @@ eap {
- 		#  Note - for OpenSSL 1.1.0 and above you may need
- 		#  to add ":@SECLEVEL=0"
+ 		#  Set this option to specify the allowed
+ 		#  TLS signature algorithms for OpenSSL 1.1.1 and above.
+@@ -1082,7 +1082,7 @@ eap {
+ 		#  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+ 		#  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
 		#
 -	#	cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
 +	#	cipher_list = "PROFILE=SYSTEM"
@ -47,23 +48,23 @@ index 576eb7739e..ffa07188e2 100644
 		#  You may want to set a very small fragment size.
 		#  The TLS data here needs to go inside of the
 diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
-index 92f1d6330e..cd69b3905a 100644
+index b8d0626bbe..073b2933c2 100644
 --- a/raddb/sites-available/abfab-tls
 +++ b/raddb/sites-available/abfab-tls
-@@ -19,7 +19,7 @@ listen {
+@@ -20,7 +20,7 @@ listen {
 		dh_file = ${certdir}/dh
 		fragment_size = 8192
 		ca_path = ${cadir}
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
- 
 		cache {
 			enable = no
+ 			lifetime = 24 # hours
 diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
-index bbc761b1c5..83cd35b851 100644
+index 137fcbc6cc..a65f8a8711 100644
 --- a/raddb/sites-available/tls
 +++ b/raddb/sites-available/tls
-@@ -215,7 +215,7 @@ listen {
+@@ -292,7 +292,7 @@ listen {
 		# Set this option to specify the allowed
 		# TLS cipher suites.  The format is listed
 		# in "man 1 ciphers".
@ -72,15 +73,15 @@ index bbc761b1c5..83cd35b851 100644
 
 		# If enabled, OpenSSL will use server cipher list
 		# (possibly defined by cipher_list option above)
-@@ -517,7 +517,7 @@ home_server tls {
+@@ -676,7 +676,7 @@ home_server tls {
 		# Set this option to specify the allowed
 		# TLS cipher suites.  The format is listed
 		# in "man 1 ciphers".
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
- 	}
 
- }
+ 		#
+ 		#  Connection timeout for outgoing TLS connections.
 -- 
 2.21.0

--- a/freeradius-autogen.sh
+++ b/freeradius-autogen.sh
@ -1,21 +0,0 @@
-#!/bin/sh -e
-
-parentdir=`dirname $0`
-
-cd $parentdir
-parentdir=`pwd`
-
-libtoolize -f -c
-#aclocal
-autoheader
-autoconf
-
-mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`"
-mysubdirs=`echo $mysubdirs`
-
-for F in $mysubdirs
-do
-	echo "Configuring in $F..."
-	(cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir)
-	(cd $F && autoconf -I$parentdir)
-done
--- a/freeradius-bootstrap-create-only.patch
+++ b/freeradius-bootstrap-create-only.patch
@ -1,36 +1,18 @@
-From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
+From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
-Date: Wed, 8 May 2019 10:29:08 -0400
+Date: Wed, 13 May 2020 10:01:47 -0400
 Subject: [PATCH] Don't clobber existing files on bootstrap

 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
- raddb/certs/bootstrap | 39 ++++++++++++---------------------------
- 1 file changed, 12 insertions(+), 27 deletions(-)
+ raddb/certs/bootstrap | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)

 diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
-index 0f719aafd4..be81a2d697 100755
+index ede09bc..e555491 100755
 --- a/raddb/certs/bootstrap
 +++ b/raddb/certs/bootstrap
-@@ -13,17 +13,6 @@
- umask 027
- cd `dirname $0`
-
-make -h > /dev/null 2>&1
-
-#
-#  If we have a working "make", then use it.  Otherwise, run the commands
-#  manually.
-#
-if [ "$?" = "0" ]; then
-  make all
-  exit $?
-fi
-
- #
- #  The following commands were created by running "make -n", and edited
- #  to remove the trailing backslash, and to add "exit 1" after the commands.
-@@ -31,52 +20,51 @@ fi
+@@ -20,56 +20,55 @@ cd `dirname $0`
 #  Don't edit the following text.  Instead, edit the Makefile, and
 #  re-generate these commands.
 #
@ -44,60 +26,64 @@ index 0f719aafd4..be81a2d697 100755
 -  fi
 +  ln -sf /dev/urandom random
 fi
-
+ 
 -if [ ! -f server.key ]; then
 +if [ ! -e server.key ]; then
   openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+   chmod g+r server.key
 fi
-
+ 
 -if [ ! -f ca.key ]; then
 +if [ ! -e ca.key ]; then
   openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
 fi
-
+ 
 -if [ ! -f index.txt ]; then
 +if [ ! -e index.txt ]; then
   touch index.txt
 fi
-
+ 
 -if [ ! -f serial ]; then
 +if [ ! -e serial ]; then
   echo '01' > serial
 fi
-
+ 
 -if [ ! -f server.crt ]; then
 +if [ ! -e server.crt ]; then
   openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
 fi
-
+ 
 -if [ ! -f server.p12 ]; then
 +if [ ! -e server.p12 ]; then
   openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   chmod g+r server.p12
 fi
-
+ 
 -if [ ! -f server.pem ]; then
 +if [ ! -e server.pem ]; then
   openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
   openssl verify -CAfile ca.pem server.pem || exit 1
+   chmod g+r server.pem
 fi
-
+ 
 -if [ ! -f ca.der ]; then
 +if [ ! -e ca.der ]; then
   openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
 fi
-
+ 
 -if [ ! -f client.key ]; then
 +if [ ! -e client.key ]; then
   openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+   chmod g+r client.key
 fi
-
+ 
 -if [ ! -f client.crt ]; then
 +if [ ! -e client.crt ]; then
   openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
 fi
 +
 +chown root:radiusd dh ca.* client.* server.*
-+chmod 644 dh ca.* client.* server.*
--
-2.21.0
+chmod 640 dh ca.* client.* server.*
+-- 
+2.26.2

--- a/freeradius-bootstrap-make-permissions.patch
+++ b/freeradius-bootstrap-make-permissions.patch
@ -0,0 +1,29 @@
+From ea164ceafa05f96079204a3f0ae379e46e64a455 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Tue, 4 Aug 2020 10:08:15 -0400
+Subject: [PATCH] Fix permissions after generating certificates with make
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ raddb/certs/bootstrap | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
+index 336a2bd..9920ecf 100755
+--- a/raddb/certs/bootstrap
+++ b/raddb/certs/bootstrap
+@@ -21,7 +21,10 @@ make -h > /dev/null 2>&1
+ #
+ if [ "$?" = "0" ]; then
+   make all
+-  exit $?
+  ret=$?
+  chown root:radiusd dh ca.* client.* server.*
+  chmod 640 dh ca.* client.* server.*
+  exit $ret
+ fi
+ 
+ #
+-- 
+2.26.2
+
--- a/freeradius-configure-c99.patch
+++ b/freeradius-configure-c99.patch
@ -0,0 +1,35 @@
+The backtrace_symbols function expects a pointer to an array of void *
+values, not a pointer to an array of a single element. Removing the
+address operator ensures that the right type is used.
+
+This avoids an unconditional failure of this probe with compilers that
+treat incompatible pointer types as a compilation error.
+
+Submitted upstream: <https://github.com/FreeRADIUS/freeradius-server/pull/5246>
+
+diff --git a/configure b/configure
+index ed01ee2bdd912f63..1e6d2284779cdd58 100755
+--- a/configure
+++ b/configure
+@@ -13390,7 +13390,7 @@ main (void)
+ {
+ 
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym))
+        backtrace_symbols(sym, sizeof(sym))
+   ;
+   return 0;
+ }
+diff --git a/configure.ac b/configure.ac
+index 76320213b51d7bb4..6a689711d6c90483 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
+         #include <execinfo.h>
+       ]], [[
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym)) ]])],[
+        backtrace_symbols(sym, sizeof(sym)) ]])],[
+         AC_MSG_RESULT(yes)
+         ac_cv_lib_execinfo_backtrace_symbols="yes"
+       ],[
--- a/freeradius-ease-openssl-version-check.patch
+++ b/freeradius-ease-openssl-version-check.patch
@ -0,0 +1,35 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Tue, 12 Sep 2023
+Subject: Ease OpenSSL version check requirement
+
+FreeRADIUS includes an OpenSSL version check that compares built vs linked version,
+and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as 
+ABI changes are tracked and soname is changed accordingly, as discussed in previous 
+Bugzilla for this issue [1].
+
+[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/main/version.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/main/version.c b/src/main/version.c
+index c190337c1d..fee2150eb2 100644
+--- a/src/main/version.c
+++ b/src/main/version.c
+@@ -79,11 +79,11 @@ int ssl_check_consistency(void)
+ 	 */
+ 	if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) {
+ 	mismatch:
+-		ERROR("libssl version mismatch.  built: %lx linked: %lx",
+		DEBUG2("libssl version mismatch.  built: %lx linked: %lx",
+ 		      (unsigned long) ssl_built,
+ 		      (unsigned long) ssl_linked);
+ 
+-		return -1;
+		return 0;
+ 	}
+ 
+ 	/*
--- a/freeradius-ldap-infinite-timeout-on-starttls.patch
+++ b/freeradius-ldap-infinite-timeout-on-starttls.patch
@ -0,0 +1,31 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Fri, 28 Jan 2022
+Subject: Use infinite timeout when using LDAP+start-TLS
+
+This will ensure that the TLS connection to the LDAP server will complete
+before starting FreeRADIUS, as it forces libldap to use a blocking socket during 
+the process. Infinite timeout is the OpenLDAP default.
+Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/modules/rlm_ldap/ldap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index cf7a84e069..841bf888a1 100644
+--- a/src/modules/rlm_ldap/ldap.c
+++ b/src/modules/rlm_ldap/ldap.c
+@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ #ifdef LDAP_OPT_NETWORK_TIMEOUT
+-	if (inst->net_timeout) {
+	bool using_tls = inst->start_tls ||
+					 inst->port == 636 ||
+					 strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0;
+	if (inst->net_timeout && !using_tls) {
+ 		memset(&tv, 0, sizeof(tv));
+ 		tv.tv_sec = inst->net_timeout;
+ 
--- a/2
+++ b/2
@ -34,7 +34,7 @@
 	compress
 	su radiusd radiusd
 	postrotate
-		/usr/bin/systemctl reload-or-try-restart radiusd
+		/usr/bin/systemctl try-reload-or-restart radiusd
 	endscript
 }

--- a/freeradius-man-Fix-some-typos.patch
+++ b/freeradius-man-Fix-some-typos.patch
@ -1,94 +0,0 @@
-From 285f6f1891e8e8acfeb7281136efdae50dbfbe78 Mon Sep 17 00:00:00 2001
-From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
-Date: Fri, 14 Sep 2018 11:53:28 +0300
-Subject: [PATCH] man: Fix some typos
-
---
- man/man5/radrelay.conf.5 | 2 +-
- man/man5/rlm_files.5     | 2 +-
- man/man5/unlang.5        | 8 ++++----
- man/man8/radrelay.8      | 2 +-
- 4 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/man/man5/radrelay.conf.5 b/man/man5/radrelay.conf.5
-index 5fb38bfc4e..e3e665024b 100644
--- a/man/man5/radrelay.conf.5
-+++ b/man/man5/radrelay.conf.5
-@@ -26,7 +26,7 @@ Many sites run multiple radius servers; at least one primary and one
- backup server. When the primary goes down, most NASes detect that and
- switch to the backup server.
- 
-That will cause your accounting packets to go the the backup server -
-+That will cause your accounting packets to go to the backup server -
- and some NASes don't even switch back to the primary server when it
- comes back up.
- 
-diff --git a/man/man5/rlm_files.5 b/man/man5/rlm_files.5
-index bfee5030ff..52f4734ae3 100644
--- a/man/man5/rlm_files.5
-+++ b/man/man5/rlm_files.5
-@@ -48,7 +48,7 @@ This configuration entry enables you to have configurations that
- perform per-group checks, and return per-group attributes, where the
- group membership is dynamically defined by a previous module.  It also
- lets you do things like key off of attributes in the reply, and
-express policies like like "when I send replies containing attribute
-+express policies like "when I send replies containing attribute
- FOO with value BAR, do more checks, and maybe send additional
- attributes".
- .SH CONFIGURATION
-diff --git a/man/man5/unlang.5 b/man/man5/unlang.5
-index 76db8f2d1c..12fe7855b2 100644
--- a/man/man5/unlang.5
-+++ b/man/man5/unlang.5
-@@ -36,7 +36,7 @@ the pre-defined keywords here.
- 
- Subject to a few limitations described below, any keyword can appear
- in any context.  The language consists of a series of entries, each
-one one line.  Each entry begins with a keyword.  Entries are
-+one line.  Each entry begins with a keyword.  Entries are
- organized into lists.  Processing of the language is line by line,
- from the start of the list to the end.  Actions are executed
- per-keyword.
-@@ -131,7 +131,7 @@ expanded as described in the DATA TYPES section, below.  The match is
- then performed on the string returned from the expansion.  If the
- argument is an attribute reference (e.g. &User-Name), then the match
- is performed on the value of that attribute.  Otherwise, the argument
-is taken to be a literal string, and and matching is done via simple
-+is taken to be a literal string, and matching is done via simple
- comparison.
- 
- No statement other than "case" can appear in a "switch" block.
-@@ -155,7 +155,7 @@ expanded as described in the DATA TYPES section, below.  The match is
- then performed on the string returned from the expansion.  If the
- argument is an attribute reference (e.g. &User-Name), then the match
- is performed on the value of that attribute.  Otherwise, the argument
-is taken to be a literal string, and and matching is done via simple
-+is taken to be a literal string, and matching is done via simple
- comparison.
- 
- .DS
-@@ -799,7 +799,7 @@ regular expression.  If no attribute matches, nothing else is done.
- The value can be an attribute reference, or an attribute-specific
- string.
- 
-When the value is an an attribute reference, it must take the form of
-+When the value is an attribute reference, it must take the form of
- "&Attribute-Name".  The leading "&" signifies that the value is a
- reference.  The "Attribute-Name" is an attribute name, such as
- "User-Name" or "request:User-Name".  When an attribute reference is
-diff --git a/man/man8/radrelay.8 b/man/man8/radrelay.8
-index fdba6995d5..99e65732a2 100644
--- a/man/man8/radrelay.8
-+++ b/man/man8/radrelay.8
-@@ -13,7 +13,7 @@ Many sites run multiple radius servers; at least one primary and one
- backup server. When the primary goes down, most NASes detect that and
- switch to the backup server.
- 
-That will cause your accounting packets to go the the backup server -
-+That will cause your accounting packets to go to the backup server -
- and some NASes don't even switch back to the primary server when it
- comes back up.
- 
-- 
-2.18.0
-
--- a/freeradius-no-buildtime-cert-gen.patch
+++ b/freeradius-no-buildtime-cert-gen.patch
@ -3,48 +3,52 @@ From: Alexander Scheel <ascheel@redhat.com>
 Date: Wed, 8 May 2019 12:58:02 -0400
 Subject: [PATCH] Don't generate certificates in reproducible builds

+[antorres@redhat.com]: updated to match upstream release 3.2.7
+
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 Make.inc.in  | 5 +++++
- configure    | 4 ++++
+ configure    | 3 +++
 configure.ac | 3 +++
 raddb/all.mk | 4 ++++
- 4 files changed, 16 insertions(+)
+ 4 files changed, 15 insertions(+)

 diff --git a/Make.inc.in b/Make.inc.in
 index 0b2cd74de8..8c623cf95c 100644
 --- a/Make.inc.in
 +++ b/Make.inc.in
-@@ -173,3 +173,8 @@ else
- 	TESTBINDIR = ./$(BUILD_DIR)/bin
+@@ -174,6 +174,10 @@ else
 	TESTBIN    = ./$(BUILD_DIR)/bin
 endif
-+
+ 
 +#
 +#  With reproducible builds, do not generate certificates during installation
 +#
 +ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@
+ 
+ #
+ #  For creating documentation via doc/all.mk
 diff --git a/configure b/configure
-index c2c599c92b..3d4403a844 100755
+index f1dfa97c44..ba5c53768d 100755
 --- a/configure
 +++ b/configure
-@@ -655,6 +655,7 @@ RUSERS
+@@ -681,6 +681,7 @@ ACLOCAL
+ LAST
+ RUSERS
 SNMPWALK
- SNMPGET
- PERL
 +ENABLE_REPRODUCIBLE_BUILDS
+ SNMPGET
 openssl_version_check_config
- WITH_DHCP
- modconfdir
-@@ -5586,6 +5587,7 @@ else
- fi
+ WITH_RADLAST
+@@ -7001,6 +7002,7 @@ fi
 
 
-+ENABLE_REPRODUCIBLE_BUILDS=yes
 # Check whether --enable-reproducible-builds was given.
- if test "${enable_reproducible_builds+set}" = set; then :
+ENABLE_REPRODUCIBLE_BUILDS=yes
+ if test ${enable_reproducible_builds+y}
+ then :
   enableval=$enable_reproducible_builds;  case "$enableval" in
-@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
     ;;
   *)
     reproducible_builds=no
@ -52,19 +56,12 @@ index c2c599c92b..3d4403a844 100755
   esac
 
 fi
-@@ -5604,6 +5607,7 @@ fi
- 
- 
- 
-+
- CHECKRAD=checkrad
- # Extract the first word of "perl", so it can be a program name with args.
- set dummy perl; ac_word=$2
+
 diff --git a/configure.ac b/configure.ac
-index a7abf0025a..35b013f4af 100644
+index ce4d9b0ae5..790cbf02a0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config])
+@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config])
 dnl #
 dnl #  extra argument: --enable-reproducible-builds
 dnl #
@ -72,7 +69,7 @@ index a7abf0025a..35b013f4af 100644
 AC_ARG_ENABLE(reproducible-builds,
 [AS_HELP_STRING([--enable-reproducible-builds],
                 [ensure the build does not change each time])],
-@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds,
+@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds,
     ;;
   *)
     reproducible_builds=no
@ -81,6 +78,10 @@ index a7abf0025a..35b013f4af 100644
 )
 +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS)
 
+ dnl #
+ dnl #  Enable the -fsanitize=fuzzer and link in the address sanitizer
+
+ 
 
 dnl #############################################################
 diff --git a/raddb/all.mk b/raddb/all.mk
--- a/freeradius-no-sqlippool-tool.patch
+++ b/freeradius-no-sqlippool-tool.patch
@ -0,0 +1,28 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Wed, 5 Mar 2025
+Subject: Remove sqlippool tool
+
+This script relies on a Perl package, perl-Net-IP, that won't be available.
+Remove it from build script and let the user pull it manually instead, as it's
+just a helper script for SQL module users.
+
+---
+diff --git a/scripts/all.mk b/scripts/all.mk
+index a6e90aa3eb..517adb8590 100644
+--- a/scripts/all.mk
+++ b/scripts/all.mk
+@@ -1,5 +1,5 @@
+ install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \
+-	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool
+	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt
+ 
+ $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd
+ 	@mkdir -p $(dir $@)
+@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay
+ $(R)$(bindir)/radcrypt: scripts/cryptpasswd
+ 	@mkdir -p $(dir $@)
+ 	@$(INSTALL) -m 755 $< $@
+-
+-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool
+-	@mkdir -p $(dir $@)
+-	@$(INSTALL) -m 755 $< $@
--- a/freeradius-openssl-no-engine.patch
+++ b/freeradius-openssl-no-engine.patch
@ -0,0 +1,54 @@
+diff --git a/configure b/configure
+index 1e6d228..40a26f5 100755
+--- a/configure
+++ b/configure
+@@ -10518,7 +10518,7 @@ smart_prefix=
+ printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
+ 
+ 
+-           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h
+           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h
+ do :
+   as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
+ ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+diff --git a/configure.ac b/configure.ac
+index 6a68971..4a95148 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then
+       openssl/rand.h \
+       openssl/sha.h \
+       openssl/ssl.h \
+-      openssl/ocsp.h \
+-      openssl/engine.h,
+      openssl/ocsp.h,
+       [ OPENSSL_CPPFLAGS="$smart_include" ],
+       [
+         AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
+diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
+index 4774482..21d5cea 100644
+--- a/src/include/autoconf.h.in
+++ b/src/include/autoconf.h.in
+@@ -285,9 +285,6 @@
+ /* Define to 1 if you have the <openssl/crypto.h> header file. */
+ #undef HAVE_OPENSSL_CRYPTO_H
+ 
+-/* Define to 1 if you have the <openssl/engine.h> header file. */
+-#undef HAVE_OPENSSL_ENGINE_H
+-
+ /* Define to 1 if you have the <openssl/err.h> header file. */
+ #undef HAVE_OPENSSL_ERR_H
+ 
+diff --git a/src/include/tls-h b/src/include/tls-h
+index 506fb19..514e03a 100644
+--- a/src/include/tls-h
+++ b/src/include/tls-h
+@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$")
+ #  define OPENSSL_NO_KRB5
+ #endif
+ #include <openssl/err.h>
+-#ifdef HAVE_OPENSSL_ENGINE_H
+#ifndef OPENSSL_NO_ENGINE
+ #  include <openssl/engine.h>
+ #endif
+ #include <openssl/ssl.h>
--- a/freeradius-python2-shebangs.patch
+++ b/freeradius-python2-shebangs.patch
@ -1,64 +0,0 @@
-From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Thu, 18 Oct 2018 12:40:53 -0400
-Subject: [PATCH] Clarify shebangs to be python2
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
---
- scripts/radtee                         | 2 +-
- src/modules/rlm_python/example.py      | 2 +-
- src/modules/rlm_python/prepaid.py      | 2 +-
- src/modules/rlm_python/radiusd.py      | 2 +-
- src/modules/rlm_python/radiusd_test.py | 2 +-
- 5 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/scripts/radtee b/scripts/radtee
-index 123769d244..78b4bcbe0b 100755
--- a/scripts/radtee
-+++ b/scripts/radtee
-@@ -1,4 +1,4 @@
-#!/usr/bin/env python
-+#!/usr/bin/env python2
- from __future__ import with_statement 
- 
- # RADIUS comparison tee v1.0
-diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py
-index 5950a07678..eaf456e349 100644
--- a/src/modules/rlm_python/example.py
-+++ b/src/modules/rlm_python/example.py
-@@ -1,4 +1,4 @@
-#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Python module example file
- # Miguel A.L. Paraz <mparaz@mparaz.com>
-diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py
-index c3cbf57b8f..3b1dc2e2e8 100644
--- a/src/modules/rlm_python/prepaid.py
-+++ b/src/modules/rlm_python/prepaid.py
-@@ -1,4 +1,4 @@
-#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Example Python module for prepaid usage using MySQL
- 
-diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py
-index c535bb3caf..7129923994 100644
--- a/src/modules/rlm_python/radiusd.py
-+++ b/src/modules/rlm_python/radiusd.py
-@@ -1,4 +1,4 @@
-#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Definitions for RADIUS programs
- #
-diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py
-index 13b7128b29..97b5b64f08 100644
--- a/src/modules/rlm_python/radiusd_test.py
-+++ b/src/modules/rlm_python/radiusd_test.py
-@@ -1,4 +1,4 @@
-#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Python module test
- # Miguel A.L. Paraz <mparaz@mparaz.com>
--- a/113
+++ b/113
@ -1,113 +0,0 @@
-#!/bin/sh
-#
-# radiusd Start/Stop the FreeRADIUS daemon
-#
-# chkconfig: - 88 10
-# description: Extensible, configurable, high performance RADIUS server.
-
-### BEGIN INIT INFO
-# Provides: radiusd
-# Required-Start: $network
-# Required-Stop:
-# Default-Start:
-# Default-Stop:
-# Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc
-# Should-Stop:
-# Short-Description: FreeRADIUS server
-# Description: Extensible, configurable, high performance RADIUS server.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-prog=radiusd
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-exec=${exec:=/usr/sbin/$prog}
-config_dir=${config_dir:=/etc/raddb}
-config=${config:=$config_dir/radiusd.conf}
-pidfile=${pidfile:=/var/run/$prog/$prog.pid}
-lockfile=${lockfile:=/var/lock/subsys/radiusd}
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting $prog: "
-    daemon --pidfile $pidfile $exec -d $config_dir
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    killproc -p $pidfile $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    # radiusd may not be capable of a 100% configuration reload depending
-    # on which loadable modules are in use, if sending the server a
-    # HUP is not sufficient then use restart here instead. However, we
-    # prefer by default to use HUP since it's what is usually desired.
-    #    
-    # restart
-
-    kill -HUP `pidofproc -p $pidfile $prog`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile $prog
-}
-
-rh_status_q() {
-    rh_status >/dev/null 2>&1
-}
-
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload)
-        rh_status_q || exit 7
-        $1
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?
--- a/freeradius.spec
+++ b/freeradius.spec
@ -1,8 +1,8 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.0.20
+Version: 3.2.8
 Release: 2%{?dist}
-License: GPLv2+ and LGPLv2+
+License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: http://www.freeradius.org/

 # Is elliptic curve cryptography supported?
@ -14,16 +14,23 @@ URL: http://www.freeradius.org/

 %global dist_base freeradius-server-%{version}

-Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2
+Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2
 Source100: radiusd.service
 Source102: freeradius-logrotate
 Source103: freeradius-pam-conf
 Source104: freeradius-tmpfiles.conf
+Source105: freeradius.sysusers

 Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
 Patch2: freeradius-Use-system-crypto-policy-by-default.patch
 Patch3: freeradius-bootstrap-create-only.patch
 Patch4: freeradius-no-buildtime-cert-gen.patch
+Patch5: freeradius-bootstrap-make-permissions.patch
+Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch
+Patch7: freeradius-ease-openssl-version-check.patch
+Patch8: freeradius-configure-c99.patch
+Patch9: freeradius-openssl-no-engine.patch
+Patch10: freeradius-no-sqlippool-tool.patch

 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}

@ -41,7 +48,9 @@ BuildRequires: readline-devel
 BuildRequires: libpcap-devel
 BuildRequires: systemd-units
 BuildRequires: libtalloc-devel
-BuildRequires: pcre-devel
+BuildRequires: chrpath
+BuildRequires: systemd-rpm-macros
+BuildRequires: libxcrypt-devel

 %if ! 0%{?rhel}
 BuildRequires: libyubikey-devel
@ -51,11 +60,12 @@ BuildRequires: ykclient-devel
 # Require OpenSSL version we built with, or newer, to avoid startup failures
 # due to runtime OpenSSL version checks.
 Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl)
-Requires(pre): shadow-utils glibc-common
+Requires(pre): glibc-common
 Requires(post): systemd-sysv
 Requires(post): systemd-units
-# Needed for certificate generation
-Requires(post): make
+# Needed for certificate generation as upstream bootstrap script isn't
+# compatible with Makefile equivalent.
+Requires: make
 Requires(preun): systemd-units
 Requires(postun): systemd-units

@ -121,7 +131,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project.
 %package perl
 Summary: Perl support for freeradius
 Requires: %{name} = %{version}-%{release}
-Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 %{?fedora:BuildRequires: perl-devel}
 BuildRequires: perl-devel
 BuildRequires: perl-generators
@ -130,7 +139,7 @@ BuildRequires: perl(ExtUtils::Embed)
 %description perl
 This plugin provides the Perl support for the FreeRADIUS server project.

-%if 0%{?fedora} <= 30
+%if 0%{?fedora} <= 30 && 0%{?rhel} < 8
 %package -n python2-freeradius
 Summary: Python 2 support for freeradius
 Requires: %{name} = %{version}-%{release}
@ -195,36 +204,39 @@ BuildRequires: json-c-devel
 %description rest
 This plugin provides the REST support for the FreeRADIUS server project.

+
+%package kafka
+Summary: Kafka producer support for FreeRADIUS
+Requires: %{name} = %{version}-%{release}
+Requires: librdkafka
+BuildRequires: librdkafka-devel
+
+%description kafka
+This plugin provides Kafka producer support for the FreeRADIUS server project.
+
 %prep
 %setup -q -n %{dist_base}
 # Note: We explicitly do not make patch backup files because 'make install'
 # mistakenly includes the backup files, especially problematic for raddb config files.
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1

 %build
 # Force compile/link options, extra security for network facing daemon
 %global _hardened_build 1

-# Hack: rlm_python3 as stable; prevents building other unstable modules.
-sed 's/rlm_python/rlm_python3/g' src/modules/stable -i
-
-# python3-config is broken:
-# https://bugzilla.redhat.com/show_bug.cgi?id=1772988
-export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')"
+%global build_ldflags %{build_ldflags} $(python3-config --embed --libs)
+export PY3_LIB_DIR="$(python3-config --configdir)"
 export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')"

-# Hack: rlm_python3 configure.ac script is broken because it doesn't
-# respect --with-rlm-python3-include-dir.
-sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try_dir=$PY_INC_DIR#g' src/modules/rlm_python3/configure.ac
-
-# In order for the above hack to stick, do a fake configure so
-# we can run reconfig before cleaning up after ourselves and running
-# configure for real.
-./configure && make reconfig && (make clean distclean || true)
-
 %configure \
        --libdir=%{_libdir}/freeradius \
        --enable-reproducible-builds \
@ -243,6 +255,7 @@ sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try
        --with-rlm_python3 \
        --with-rlm-python3-lib-dir=$PY3_LIB_DIR \
        --with-rlm-python3-include-dir=$PY3_INC_DIR \
+        --without-rlm_python \
        --without-rlm_eap_ikev2 \
        --without-rlm_eap_tnc \
        --without-rlm_sql_iodbc \
@ -254,7 +267,8 @@ sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try
        --without-rlm_rediswho \
        --without-rlm_cache_memcached

-make
+# Build fast, but get better errors if we fail
+make %{?_smp_mflags} || make -j1

 %install
 mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/lib/radiusd
@ -273,13 +287,24 @@ mkdir -p %{buildroot}%{_localstatedir}/run/
 install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/
 install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp
 install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf
+install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf

 # install SNMP MIB files
 mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/
 install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/

+# remove rpath where needed
+chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so
+for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done
+for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done
+
+# update ld with freeradius libs
+mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d
+echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
+
 # remove unneeded stuff
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt
+rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.csr
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.der
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.key
@ -298,6 +323,7 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/freeradius/*.la
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/mssql

 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/oracle
+rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/mssql
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool-dhcp/oracle
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/oracle
 rm -r $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/moonshot-targeted-ids
@ -342,23 +368,23 @@ All documentation is in the freeradius-doc sub-package.

 EOF

-
-# Make sure our user/group is present prior to any package or subpackage installation
-%pre
-getent group  radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1
-getent passwd radiusd >/dev/null || /usr/sbin/useradd  -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1
-exit 0
-
 %preun
 %systemd_preun radiusd.service

-%postun
-%systemd_postun_with_restart radiusd.service
-if [ $1 -eq 0 ]; then           # uninstall
-  getent passwd radiusd >/dev/null && /usr/sbin/userdel  radiusd > /dev/null 2>&1
-  getent group  radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1
+%post
+# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017
+# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96
+if [ -x /usr/sbin/setsebool ]; then
+    /usr/sbin/setsebool -P radius_use_jit on || :
 fi
-exit 0
+
+%postun
+if [ $1 -eq 0 ]; then
+    if [ -x /usr/sbin/setsebool ]; then
+        /usr/sbin/setsebool -P radius_use_jit off || :
+    fi
+fi
+%systemd_postun_with_restart radiusd.service

 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || :

@ -374,8 +400,10 @@ exit 0
 # system
 %config(noreplace) %{_sysconfdir}/pam.d/radiusd
 %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd
+%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 %{_unitdir}/radiusd.service
 %{_tmpfilesdir}/radiusd.conf
+%{_sysusersdir}/freeradius.conf
 %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd
 %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp
 %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd
@ -408,7 +436,8 @@ exit 0
 %dir %attr(770,root,radiusd) /etc/raddb/certs
 %config(noreplace) /etc/raddb/certs/Makefile
 %config(noreplace) /etc/raddb/certs/passwords.mk
-/etc/raddb/certs/README
+/etc/raddb/certs/README.md
+/etc/raddb/certs/realms/README.md
 %config(noreplace) /etc/raddb/certs/xpextensions
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf
 %attr(750,root,radiusd) /etc/raddb/certs/bootstrap
@ -422,6 +451,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/*
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/*
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter
@ -433,6 +463,8 @@ exit 0
 # sites-available
 %dir %attr(750,root,radiusd) /etc/raddb/sites-available
 /etc/raddb/sites-available/README
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting
@ -454,8 +486,11 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache

 # sites-enabled
 # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx
@ -469,7 +504,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui
@ -478,6 +513,9 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients
@ -491,6 +529,8 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip
@ -498,7 +538,6 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd
@ -515,21 +554,24 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit

 # mods-enabled
 # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx
 %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled
 %config(missingok) /etc/raddb/mods-enabled/always
 %config(missingok) /etc/raddb/mods-enabled/attr_filter
-%config(missingok) /etc/raddb/mods-enabled/cache_eap
 %config(missingok) /etc/raddb/mods-enabled/chap
 %config(missingok) /etc/raddb/mods-enabled/date
 %config(missingok) /etc/raddb/mods-enabled/detail
@ -554,9 +596,11 @@ exit 0
 %config(missingok) /etc/raddb/mods-enabled/replicate
 %config(missingok) /etc/raddb/mods-enabled/soh
 %config(missingok) /etc/raddb/mods-enabled/sradutmp
+%config(missingok) /etc/raddb/mods-enabled/totp
 %config(missingok) /etc/raddb/mods-enabled/unix
 %config(missingok) /etc/raddb/mods-enabled/unpack
 %config(missingok) /etc/raddb/mods-enabled/utf8
+%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit

 # policy
 %dir %attr(750,root,radiusd) /etc/raddb/policy.d
@ -574,10 +618,10 @@ exit 0

 # binaries
 %defattr(-,root,root)
-/usr/sbin/checkrad
-/usr/sbin/raddebug
-/usr/sbin/radiusd
-/usr/sbin/radmin
+%{_bindir}/checkrad
+%{_bindir}/raddebug
+%{_bindir}/radiusd
+%{_bindir}/radmin

 # dictionaries
 %dir %attr(755,root,root) /usr/share/freeradius
@ -602,7 +646,6 @@ exit 0
 %{_libdir}/freeradius/rlm_cache_rbtree.so
 %{_libdir}/freeradius/rlm_chap.so
 %{_libdir}/freeradius/rlm_counter.so
-%{_libdir}/freeradius/rlm_cram.so
 %{_libdir}/freeradius/rlm_date.so
 %{_libdir}/freeradius/rlm_detail.so
 %{_libdir}/freeradius/rlm_dhcp.so
@ -611,7 +654,6 @@ exit 0
 %{_libdir}/freeradius/rlm_eap.so
 %{_libdir}/freeradius/rlm_eap_fast.so
 %{_libdir}/freeradius/rlm_eap_gtc.so
-%{_libdir}/freeradius/rlm_eap_leap.so
 %{_libdir}/freeradius/rlm_eap_md5.so
 %{_libdir}/freeradius/rlm_eap_mschapv2.so
 %{_libdir}/freeradius/rlm_eap_peap.so
@ -626,10 +668,10 @@ exit 0
 %{_libdir}/freeradius/rlm_expr.so
 %{_libdir}/freeradius/rlm_files.so
 %{_libdir}/freeradius/rlm_ippool.so
+%{_libdir}/freeradius/rlm_json.so
 %{_libdir}/freeradius/rlm_linelog.so
 %{_libdir}/freeradius/rlm_logintime.so
 %{_libdir}/freeradius/rlm_mschap.so
-%{_libdir}/freeradius/rlm_otp.so
 %{_libdir}/freeradius/rlm_pam.so
 %{_libdir}/freeradius/rlm_pap.so
 %{_libdir}/freeradius/rlm_passwd.so
@ -642,12 +684,17 @@ exit 0
 %{_libdir}/freeradius/rlm_sql.so
 %{_libdir}/freeradius/rlm_sqlcounter.so
 %{_libdir}/freeradius/rlm_sqlippool.so
+%{_libdir}/freeradius/rlm_sql_map.so
 %{_libdir}/freeradius/rlm_sql_null.so
+%{_libdir}/freeradius/rlm_totp.so
 %{_libdir}/freeradius/rlm_unix.so
 %{_libdir}/freeradius/rlm_unpack.so
 %{_libdir}/freeradius/rlm_utf8.so
 %{_libdir}/freeradius/rlm_wimax.so
 %{_libdir}/freeradius/rlm_yubikey.so
+%{_libdir}/freeradius/rlm_dpsk.so
+%{_libdir}/freeradius/rlm_eap_teap.so
+%{_libdir}/freeradius/rlm_proxy_rate_limit.so

 # main man pages
 %doc %{_mandir}/man5/clients.conf.5.gz
@ -668,6 +715,7 @@ exit 0
 %doc %{_mandir}/man5/rlm_passwd.5.gz
 %doc %{_mandir}/man5/rlm_realm.5.gz
 %doc %{_mandir}/man5/rlm_sql.5.gz
+%doc %{_mandir}/man5/rlm_unbound.5.gz
 %doc %{_mandir}/man5/rlm_unix.5.gz
 %doc %{_mandir}/man5/unlang.5.gz
 %doc %{_mandir}/man5/users.5.gz
@ -675,6 +723,7 @@ exit 0
 %doc %{_mandir}/man8/radiusd.8.gz
 %doc %{_mandir}/man8/radmin.8.gz
 %doc %{_mandir}/man8/radrelay.8.gz
+%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz

 # MIB files
 %{_datadir}/snmp/mibs/*RADIUS*.mib
@ -718,7 +767,7 @@ exit 0

 %{_libdir}/freeradius/rlm_perl.so

-%if 0%{?fedora} <= 30
+%if 0%{?fedora} <= 30 && 0%{?rhel} < 8
 %files -n python2-freeradius
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python
 /etc/raddb/mods-config/python/example.py*
@ -736,6 +785,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf

@ -743,19 +793,55 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql

+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql
+
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/process-radacct.sql

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras/wimax
@ -773,6 +859,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf

@ -789,6 +876,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/process-radacct.sql

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf
@ -800,6 +888,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf

@ -818,6 +907,9 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh

 %{_libdir}/freeradius/rlm_sql_sqlite.so

@ -832,7 +924,234 @@ exit 0
 %{_libdir}/freeradius/rlm_rest.so
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest

+%files kafka
+%{_libdir}/freeradius/rlm_kafka.so
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf
+
 %changelog
+* Mon Jan 05 2026 Antonio Torres <antorres@redhat.com> - 3.2.8-2
+- Enable selinux flag for JIT usage
+  Resolves: #2427017
+
+* Mon Nov 10 2025 Antonio Torres <antorres@redhat.com> - 3.2.8-1
+- Update to upstream release 3.2.8
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.7-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jul 08 2025 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.7-5
+- Perl 5.42 rebuild
+
+* Wed Jun 11 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-4
+- Update logrotate postrotate script with `systemctl try-reload-or-restart`
+  Resolves: rhbz#2371329
+
+* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 3.2.7-3
+- Rebuilt for Python 3.14
+
+* Wed Mar 5 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-1
+- Update to upstream release 3.2.7
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.5-7
+- Drop call to %sysusers_create_compat
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.2.5-6
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Antonio Torres <antorres@redhat.com> - 3.2.5-5
+- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Nov 06 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 3.2.5-3
+- Drop openssl-devel-engine dependency
+
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Antonio Torres <antorres@redhat.com> - 3.2.5-1
+- Update to upstream release 3.2.5
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.4-3
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 3.2.4-2
+- Rebuilt for Python 3.13
+
+* Fri May 31 2024 Antonio Torres <antorres@redhat.com> - 3.2.4-1
+- Update to upstream release 3.2.4
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Dec 19 2023 Florian Weimer <fweimer@redhat.com> - 3.2.3-2
+- Fix C compatibility issue in configure script
+
+* Tue Oct 24 2023 Antonio Torres <antorres@redhat.com> - 3.2.3-1
+- Update to upstream release 3.2.3
+
+* Tue Sep 12 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-5
+- Ease OpenSSL version check requirement
+  Resolves #2238511
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.2-3
+- Perl 5.38 rebuild
+
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.2.2-2
+- Rebuilt for Python 3.12
+
+* Tue Mar 21 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-1
+- Update to upstream release 3.2.2
+
+* Wed Mar 15 2023 Antonio Torres <antorres@redhat.com> - 3.2.1-4
+- Migrate to SPDX license
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Mon Oct 17 2022 Antonio Torres <antorres@redhat.com> - 3.2.1-2
+- Remove hack for Python3 support from specfile
+
+* Mon Oct 17 2022 Antonio Torres <antorres@redhat.com> - 3.2.1-1
+- Update to 3.2.1 upstream release
+  Resolves #2131850
+
+* Tue Sep 20 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-4
+- Remove deprecated pcre-devel dependency
+  Resolves #2128292
+
+* Mon Sep 5 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-3
+- configure: allow building with runstatedir option
+  Resolves: #2123374
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue Jul 19 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-1
+- Rebase to 3.2.0 upstream release
+  Related: #2077687
+
+* Wed Jun 29 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-8
+- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107)
+  Related: #2095741
+
+* Fri Jun 24 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-7
+- Dynamically allocate users using sysusers.d format
+  Related: #2095741
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 3.0.25-6
+- Rebuilt for Python 3.11
+
+* Tue May 31 2022 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.25-5
+- Perl 5.36 rebuild
+
+* Fri Apr 22 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-4
+- Use infinite timeout when using LDAP+start-TLS
+  Related: #1983063
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.25-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Oct 14 2021 Antonio Torres <antorres@redhat.com> - 3.0.25-2
+- Fix file conflict in SQL files
+  Resolves: bz#2014014 
+
+* Fri Oct 08 2021 Antonio Torres <antorres@redhat.com> - 3.0.25-1
+- Update to 3.0.25.
+  Resolves: bz#2011984
+
+* Thu Sep 30 2021 Antonio Torres <antorres@redhat.com> - 3.0.24-1
+- Update to 3.0.24.
+  Resolves: bz#2009036
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 3.0.23-7
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.23-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jul 15 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-5
+- Fix coredump not being able to be enabled
+
+* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 3.0.23-4
+- Rebuild for versioned symbols in json-c
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-2
+- Fix rpath not being removed correctly
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-2
+- Remove RPATH usage from additional binaries
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-1
+- Rebase to 3.0.23
+  Fixes: bz#1970528
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-5
+- Fix binaries not being correctly linked after RPATH removal
+
+* Fri Jun 25 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-4
+- Fix python3 not being correctly linked
+
+* Mon Jun 07 2021 Python Maint <python-maint@redhat.com> - 3.0.22-2
+- Rebuilt for Python 3.10
+
+* Fri Jun 4 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-1
+- Rebased to 3.0.22
+  Resolves: bz#1961190
+
+* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.21-12
+- Perl 5.34 rebuild
+
+* Wed Mar 10 2021 Robbie Harwood <rharwood@redhat.com> - 3.0.21-11
+- Disable automatic bootstrap
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.21-10
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 3.0.21-9
+- rebuild for libpq ABI fix rhbz#1908268
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.21-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Aug 04 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-7
+- Fix certificate permissions after make-based generation
+  Resolves: bz#1835249
+
+* Tue Aug 04 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-6
+- Fix certificate permissions after make-based generation
+  Resolves: bz#1835249
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.21-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.21-4
+- Perl 5.32 rebuild
+
+* Wed May 13 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-3
+- Fix certificate generation
+  Resolves: bz#1835249
+
+* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 3.0.21-2
+- Rebuild (json-c)
+
+* Wed Apr 01 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-1
+- Rebased to 3.0.21
+  Resolves: bz#1816745
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.20-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Sat Jan 11 2020 Paul Wouters <pwouters@redhat.com> - 3.0.20-2
 - fixup tmpfile to use /run instead of /var/run

--- a/freeradius.sysusers
+++ b/freeradius.sysusers
@ -0,0 +1,3 @@
+#Type Name     ID  GECOS           Home directory        Shell
+u     radiusd  95  "radiusd user"  /var/lib/radiusd      /sbin/nologin
+g     radiusd  95  -               -                     -
--- a/radiusd.service
+++ b/radiusd.service
@ -5,8 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
-ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
-ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap
+ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -0,0 +1,3 @@
+---
+inspections:
+    badfuncs: off
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (freeradius-server-3.0.20.tar.bz2) = d5e0732a75268480092b46822a0e0fffb683adb93be13932eb170d2dc783a46d0daff4cadd0de69fd5ce4578083c9f69a9cccc485ea9c0c2eecf82c772f54b8e
+SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae
--- a/tests/auth-tests/freeradius-tests.py
+++ b/tests/auth-tests/freeradius-tests.py
@ -15,7 +15,6 @@ import unittest
 import subprocess
 import signal
 import shutil
-import psutil
 import socket

 RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid'
--- a/tests/auth-tests/runtest.sh
+++ b/tests/auth-tests/runtest.sh
@ -16,6 +16,25 @@ PACKAGE="freeradius"
 RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
 RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"

+generate_cert(){
+    pushd /etc/raddb/certs/
+    #remove certificates if exists;generate new certificates
+    if [[ -f /etc/raddb/certs/bootstrap ]]; then
+        rlLog "Destroy and create new default certificates via bootstrap script"
+        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
+        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
+    else
+        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
+        rlLog "Destroy and create new default certificates via make scripts"
+        make destroycerts -C /etc/raddb/certs/
+        #create new certificates
+        make -C /etc/raddb/certs/
+        chown root:radiusd dh ca.* client.* server.*
+        chmod 640 dh ca.* client.* server.*
+    fi
+    popd
+}
+
 rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm $PACKAGE
@ -29,6 +48,7 @@ rlJournalStart
        rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
        rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
        rlRun "systemctl daemon-reload"
+        generate_cert
    rlPhaseEnd

    rlPhaseStartTest
Author	SHA1	Message	Date
Antonio Torres	43ef939726	Enable SELinux flag for JIT usage Resolves: #2427017 Signed-off-by: Antonio Torres <antorres@redhat.com>	2026-01-07 11:21:33 +01:00
Antonio Torres	dda9220390	Update to 3.2.8 Signed-off-by: Antonio Torres <antorres@redhat.com>	2025-11-10 10:07:43 +01:00
Fedora Release Engineering	94437a86b0	Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild	2025-07-23 20:47:53 +00:00
Jitka Plesnikova	7b23cc2e89	Perl 5.42 rebuild	2025-07-08 14:25:54 +02:00
Bruno Vernay	62f35fae14	Fix chown syntax Quoting the man page: "The BSD syntax user[.group] was changed to user[:group] in this volume of POSIX.1‐2017 because the <period> is a valid character in login names (as specified by the Base Definitions volume of POSIX.1‐2017, login names consist of characters in the portable filename character set)."	2025-06-16 07:04:30 +00:00
Antonio Torres	7629f49dac	Update logrotate script with try-reload-or-restart systemd has renamed reload-or-try-restart to try-reload-or-restart. The former is still accepted, but may be removed in the future. Resolves: rhbz#2371329 Signed-off-by: Antonio Torres <antorres@redhat.com>	2025-06-11 10:02:40 +02:00
Python Maint	d2672b8eee	Rebuilt for Python 3.14	2025-06-02 20:20:01 +02:00
Antonio Torres	017f82cf90	Skip building rlm_sqlippool_tool helper script This script relies on a Perl package that is no longer available. Skip building it and let the users clone it manually instead, as it's only a helper script for SQL modules users. Signed-off-by: Antonio Torres <antorres@redhat.com>	2025-03-05 12:47:16 +01:00
Antonio Torres	cc31b38a9e	Update to upstream release 3.2.7 Signed-off-by: Antonio Torres <antorres@redhat.com>	2025-03-05 10:55:22 +01:00
Zbigniew Jędrzejewski-Szmek	8f48670e2a	Drop call to %sysusers_create_compat After https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers, rpm will handle account creation automatically.	2025-02-12 20:49:21 +01:00
Björn Esser	e4d007f467	Add explicit BR: libxcrypt-devel Signed-off-by: Björn Esser <besser82@fedoraproject.org>	2025-02-01 19:54:05 +01:00
Antonio Torres	4e419c7e37	Fix usage of /usr/sbin Point to %_bindir instead, according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin Resolves: #2340178 Signed-off-by: Antonio Torres <antorres@redhat.com>	2025-01-23 10:52:45 +01:00
Fedora Release Engineering	10de3e7243	Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild	2025-01-16 18:49:50 +00:00
Yaakov Selkowitz	d3acc3cf6f	Drop openssl-devel-engine dependency The only use of OpenSSL ENGINE API is already guarded by OPENSSL_NO_ENGINE, which is now automatically defined when openssl-devel-engine is absent. This allows freeradius to be compiled without it. https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine	2024-11-05 19:51:38 -05:00
Fedora Release Engineering	a49c1eef4f	Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild	2024-07-17 23:38:19 +00:00
Antonio Torres	bf421ace12	Include openssl-devel-engine build dependency Signed-off-by: Antonio Torres <antorres@redhat.com>	2024-07-09 16:28:49 +02:00
Antonio Torres	bead332d11	Update to 3.2.5 Signed-off-by: Antonio Torres <antorres@redhat.com>	2024-07-09 14:46:25 +02:00
Antonio Torres	005987d712	Generate certificates in auth test Signed-off-by: Antonio Torres <antorres@redhat.com>	2024-06-26 12:24:50 +02:00
Jitka Plesnikova	2238015f6a	Perl 5.40 rebuild	2024-06-12 12:52:04 +02:00
Python Maint	dbcdacd2d0	Rebuilt for Python 3.13	2024-06-07 08:46:18 +02:00
Antonio Torres	d549c4c107	Update to 3.2.4 upstream release Signed-off-by: Antonio Torres <antorres@redhat.com>	2024-05-31 10:34:15 +02:00
Software Management Team	db785d8a9d	Eliminate use of obsolete %patchN syntax (#2283636 )	2024-05-30 12:46:46 +02:00
Fedora Release Engineering	d68944b4af	Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild	2024-01-24 12:02:29 +00:00
Fedora Release Engineering	bcdc6e99f9	Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild	2024-01-19 19:47:24 +00:00
Florian Weimer	1793f410aa	Fix C compatibility issue in configure script Related to: <https://fedoraproject.org/wiki/Changes/PortingToModernC> <https://fedoraproject.org/wiki/Toolchain/PortingToModernC>	2023-12-19 07:59:23 +01:00
Antonio Torres	ea6ff99048	Update to 3.2.3 upstream release Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-10-24 14:16:56 +02:00
Antonio Torres	edb8438bef	Ease OpenSSL version check requirement FreeRADIUS includes an OpenSSL version check that compares built vs linked version, and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as ABI changes are tracked and soname is changed accordingly, as discussed in previous Bugzilla for this issue [1]. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388 Resolves: #2238511 Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-09-12 14:35:31 +02:00
Fedora Release Engineering	ca09fc02d8	Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2023-07-19 20:14:54 +00:00
Jitka Plesnikova	d1c3541f66	Perl 5.38 rebuild	2023-07-11 15:55:37 +02:00
Python Maint	3f56050138	Rebuilt for Python 3.12	2023-06-14 00:18:40 +02:00
Antonio Torres	e6dba7c680	Add new packaged file to spec Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-03-21 10:08:47 +01:00
Antonio Torres	049df291ea	Update to 3.2.2 upstream release Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-03-21 09:39:33 +01:00
Antonio Torres	d04d68f8de	Migrate to SPDX license Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-03-15 11:50:38 +01:00
Fedora Release Engineering	8b93308d82	Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2023-01-19 03:53:53 +00:00
Jitka Plesnikova	db29b91ffb	Remove perl(MODULE_COMPAT), it will be replaced by generators	2023-01-13 09:34:41 +01:00
Antonio Torres	8b7c576199	Bump release number Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-10-17 17:29:47 +02:00
Antonio Torres	38b3f086ca	Remove Python3 hack from spec file Python 3 module has been marked as stable upstream, so we no longer need this hack, disabling Python 2 support with a configure option is enough. Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-10-17 17:07:42 +02:00
Antonio Torres	d2db6eed8c	Update to upstream release 3.2.1 Resolves: #2131850 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-10-17 13:25:03 +02:00
Antonio Torres	491f4aac7b	Remove deprecated pcre-devel dependency Resolves: #2128292 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-09-20 17:56:48 +02:00
Antonio Torres	d9e143bb12	configure: allow building with runstatedir option In Fedora 38+, redhat-rpm-config adds --runstatedir=/run to %configure macro. Since this is not supported in current FreeRADIUS configure scripts, add the option placeholder so that we can continue building the package. Resolves: #2123374 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-09-05 17:05:18 +02:00
Fedora Release Engineering	3d25326b00	Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-07-21 03:37:41 +00:00
Antonio Torres	39a371f96e	Rebase to 3.2.0 upstream release Resolves: #2077687 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-07-19 16:39:00 +02:00
Antonio Torres	fdb219a9d2	Use 95 GID/UID as it's reserved for FreeRADIUS Since 95 is reserved GID/UID for FreeRADIUS, we can safely use it. `07f8debf03/f/uidgid (_107)` Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-06-29 12:51:37 +02:00
Antonio Torres	a688847dcf	Use sysusers.d format for user and group creation Resolves: 2095741 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-06-24 14:00:48 +02:00
Python Maint	3e1b0c3e5c	Rebuilt for Python 3.11	2022-06-13 15:04:09 +02:00
Jitka Plesnikova	ba8509f831	Perl 5.36 rebuild	2022-05-31 08:35:42 +02:00
Antonio Torres	bb772e884b	Use infinite timeout when using LDAP+start-TLS This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: `87ffc60006/libraries/libldap/tls2.c (L1134)` Related: #1983063 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-04-22 15:39:07 +02:00
Fedora Release Engineering	49e8c0620e	- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-01-20 03:25:40 +00:00
Antonio Torres	afc023e7f1	Fix file conflicts in SQL files Resolves: bz#2014014 Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-10-14 12:53:53 +02:00
Antonio Torres	c241351c7b	Update to 3.0.25 Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-10-08 11:46:20 +02:00
Antonio Torres	d5a8b5f69f	Update to 3.0.24 Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-09-30 12:30:36 +02:00
Sahana Prasad	07d2148621	Rebuilt with OpenSSL 3.0.0	2021-09-14 19:01:54 +02:00
Fedora Release Engineering	1540d6c796	- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2021-07-21 23:21:55 +00:00
Antonio Torres	0815a3326b	Fix coredump not being able to be enabled If resource hard limit is set to zero, then it cannot be raised again, and this causes coredump to not being able to be enabled. Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-07-15 13:00:52 +02:00
Björn Esser	58cf5cccf6	Rebuild for versioned symbols in json-c	2021-07-10 11:52:58 +02:00
Antonio Torres	508c8f0746	Fix rpath not being removed correctly Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-29 16:26:48 +02:00
Antonio Torres	f7c2c07435	Remove RPATH usage from additional binaries Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-29 14:53:31 +02:00
Antonio Torres	c54625805c	Rebase to 3.0.23 Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-29 13:40:12 +02:00
Antonio Torres	1d17d3a57a	Fix binaries not being correctly linked after RPATH removal Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-29 12:19:11 +02:00
Antonio Torres	d2c4303d25	Fix python3 not being correctly linked Since Python 3.8, there is a new way to link against libpython. https://docs.python.org/3/whatsnew/3.8.html#debug-build-uses-the-same-abi-as-release-build Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-25 17:10:33 +02:00
Antonio Torres	3b6878a0e0	Bump release number Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-08 16:27:43 +02:00
Antonio Torres	15d6daaa28	Ignore badfuncs check from rpminspect FreeRADIUS source code contains some legacy code that uses deprecated functions detected by rpminspect's badfuncs check. Since this causes build failures, disable this check until the problem is fixed upstream. Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-08 16:19:12 +02:00
Antonio Torres	63ee79a9ba	Remove unused import from tests Tests imported the psutil module, which is not needed for execution. Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-08 16:18:40 +02:00
Antonio Torres	0bee016e79	Remove broken RPATH usage from all conflicting files Since Fedora 35, broken RPATH usage is detected and causes builds to fail: https://fedoraproject.org/wiki/Changes/Broken_RPATH_will_fail_rpmbuild This commit extends the list of files to remove the RPATH usage from. Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-08 16:14:57 +02:00
Python Maint	a8e0c3d9ed	Rebuilt for Python 3.10	2021-06-07 16:23:20 +02:00
Antonio Torres	c2fdf85d80	Disable broken RPATH usage in binaries Since Fedora 35, broken RPATH usage is detected in packages, causing a build failure: https://fedoraproject.org/wiki/Changes/Broken_RPATH_will_fail_rpmbuild With this changes rpath usage is deleted in conflicting files. Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-07 14:32:44 +02:00
Antonio Torres	eaa7823ffa	Update to 3.0.22 Update to 3.0.22. This includes adaptation of patches and addition of new files present in the release. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1961190 Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-04 17:12:24 +02:00
Jitka Plesnikova	8c954761a5	Perl 5.34 rebuild	2021-05-21 23:11:33 +02:00
Robbie Harwood	cabc34e05a	Disable automatic bootstrap	2021-03-10 22:21:12 +00:00
Robbie Harwood	4e468ec265	General package cleanup; no code changes	2021-03-10 15:40:14 -05:00
Zbigniew Jędrzejewski-Szmek	f4c10d8cdd	Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583.	2021-03-02 16:13:46 +01:00
Pavel Raiskup	8f248db2e6	rebuild for libpq ABI fix Related: rhbz#1908268	2021-02-08 09:25:27 +01:00
Fedora Release Engineering	e2ccd9913f	- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2021-01-26 05:55:34 +00:00
Alexander Scheel	2898c9222b	Again, apply patch Signed-off-by: Alexander Scheel <ascheel@redhat.com>	2020-08-04 11:13:29 -04:00
Alexander Scheel	e260f8f12f	Apply patch this time Signed-off-by: Alexander Scheel <ascheel@redhat.com>	2020-08-04 11:08:13 -04:00
Alexander Scheel	527b1c3a1d	Re-fix permissions issues Since make is present on certain systems (and has the better certificate generation logic), we should Require: make and add the relevant chmod statements to bootstrap after executing make. Signed-off-by: Alexander Scheel <ascheel@redhat.com>	2020-08-04 10:22:02 -04:00
Fedora Release Engineering	1139a33473	- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-07-27 17:49:44 +00:00
Troy Dawson	6b72fc1f50	no python2 for rhel8	2020-07-07 19:17:35 +00:00
Troy Dawson	bbe674aeb2	Minor conditional tweak for ELN Signed-off-by: Troy Dawson tdawson@redhat.com	2020-07-07 16:40:16 +00:00
Jitka Plesnikova	08b8e23397	Perl 5.32 rebuild	2020-06-23 12:11:05 +02:00
Alexander Scheel	c30f7f08df	Fix certificate generation Signed-off-by: Alexander Scheel <ascheel@redhat.com>	2020-05-13 12:16:58 -04:00
Björn Esser	2b4b411c94	Rebuild (json-c)	2020-04-22 00:31:13 +02:00
Alexander Scheel	f9610e3357	Correction: FreeRADIUS v3.0.21! Signed-off-by: Alexander Scheel <ascheel@redhat.com>	2020-04-01 13:34:47 -04:00
Alexander Scheel	c66b001860	Rebase to FreeRADIUS v3.0.31 Signed-off-by: Alexander Scheel <ascheel@redhat.com>	2020-04-01 13:21:27 -04:00
Fedora Release Engineering	6bde0db76c	- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-01-28 18:59:20 +00:00