Update to 1.4.0 upstream release

- Resolves: rhbz#2427015

Upstream tag: 1.4.0
Upstream commit: 5f5ac6fe

Commit authored by Packit automation (https://packit.dev/)

ocserv-genkey

@@ -1,9 +1,25 @@
 #!/bin/sh
+#default key type:rsa
+KEY_TYPE="rsa"
+
+#check key type 'rsa', 'rsa-pss', 'dsa', 'ecdsa', 'ed25519, 'ed448', 'x25519', and 'x448'
+if [ $# -gt 0 ]; then
+    case "$1" in
+        rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448)
+            KEY_TYPE="$1"
+            ;;
+        *)
+            echo "Usage: $0 [rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448]"
+            echo "Default key type: rsa"
+            exit 1
+            ;;
+    esac
+fi
 
 #generate CA certificate/key
 if test ! -f /etc/pki/ocserv/private/ca.key;then
 mkdir -p /etc/pki/ocserv/private
-certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1
+certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1
 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl
 echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl
 echo "serial=1" >>/etc/pki/ocserv/ca.tmpl
@@ -17,7 +33,7 @@ fi
 
 #generate server certificate/key
 if test ! -f /etc/pki/ocserv/private/server.key;then
-certtool --generate-privkey --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1
+certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1
 echo "cn=`hostname -f`" >/etc/pki/ocserv/server.tmpl
 echo "serial=2" >>/etc/pki/ocserv/server.tmpl
 echo "expiration_days=-1" >>/etc/pki/ocserv/server.tmpl

ocserv.spec

@@ -25,8 +25,8 @@ Summary:	OpenConnect SSL VPN server
 
 # For a breakdown of the licensing, see PACKAGE-LICENSING 
 # To simplify licenses LGPLv2+ files have been promoted to GPLv2+.
-License:	GPLv2+ and BSD and MIT and CC0
-URL:		https://gui.openconnect-vpn.net
+License:	GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0
+URL:		https://ocserv.openconnect-vpn.net/
 Source0:	https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz
 Source1:	https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig
 Source2:	gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
@@ -43,6 +43,7 @@ Source11:	ocserv.init
 # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09
 
 BuildRequires: make
+BuildRequires: libxcrypt-devel
 BuildRequires:	gcc
 %if 0%{?rhel} && 0%{?rhel} <= 6
 BuildRequires:	gnutls30-devel
@@ -100,7 +101,6 @@ BuildRequires:	rubygem-ronn-ng
 Recommends:		gnutls-utils
 Recommends:		iproute
 Recommends:		pam
-Requires(pre):		shadow-utils
 %if %{use_systemd}
 Requires(post):		systemd
 Requires(preun):	systemd
@@ -141,6 +141,11 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config
 echo "int main() { return 77; }" > tests/valid-hostname.c
 %endif
 
+# Create a sysusers.d config file
+cat >ocserv.sysusers.conf <<EOF
+u ocserv - 'ocserv' %{_localstatedir}/lib/ocserv -
+EOF
+
 %build
 
 %if 0%{?rhel} && 0%{?rhel} <= 6
@@ -171,10 +176,6 @@ autoreconf -fvi
 make %{?_smp_mflags}
 
 %pre
-getent group ocserv &>/dev/null || groupadd -r ocserv
-getent passwd ocserv &>/dev/null || \
-	/usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \
-		-d %{_localstatedir}/lib/ocserv ocserv
 mkdir -p %{_sysconfdir}/pki/ocserv/public
 mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private
 mkdir -p %{_sysconfdir}/pki/ocserv/cacerts
@@ -225,6 +226,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name}
 
 %make_install
 
+install -m0644 -D ocserv.sysusers.conf %{buildroot}%{_sysusersdir}/ocserv.conf
+
 %files
 %defattr(-,root,root,-)
 
@@ -255,6 +258,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name}
 %else
 %{_initrddir}/%{name}
 %endif
+%{_sysusersdir}/ocserv.conf
 
 %changelog
 %autochangelog