diff --git a/.gitignore b/.gitignore index 105f0cf..e6788c2 100644 --- a/.gitignore +++ b/.gitignore @@ -17,12 +17,3 @@ /opendnssec-1.4.14.tar.gz /opendnssec-2.1.6.tar.gz /opendnssec-2.1.7.tar.gz -/opendnssec-2.1.8.tar.gz -/opendnssec-2.1.9.tar.gz -/opendnssec-2.1.9.tar.gz.sig -/opendnssec-2.1.10.tar.gz.sig -/opendnssec-2.1.10.tar.gz -/opendnssec-2.1.14rc1.tar.gz -/opendnssec-2.1.14rc1.tar.gz.sig -/opendnssec-2.1.14.tar.gz -/opendnssec-2.1.14.tar.gz.sig diff --git a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch deleted file mode 100644 index 68f46c5..0000000 --- a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Mon, 30 Jan 2023 11:44:49 +0200 -Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle - string fortification - -When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc -will cut few bytes off the string buffer for prevention of buffer -overruns. As a result, hsm_hex_unparse() will call into snprintf() with -a buffer length bigger than the size of the buffer as seen by the -GCC/glibc pair. - -See also: https://pagure.io/freeipa/issue/9312 - -Signed-off-by: Alexander Bokovoy ---- - libhsm/src/lib/libhsm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c -index 88dc79e31..8f1e0c3bc 100644 ---- a/libhsm/src/lib/libhsm.c -+++ b/libhsm/src/lib/libhsm.c -@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len) - size_t i; - - for (i = 0; i < len; i++) { -- snprintf(dst + (2*i), dst_len, "%02x", src[i]); -+ snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]); - } - dst[len*2] = '\0'; - } --- -2.39.0 - diff --git a/opendnssec-2.1.14rc1-gcc14.patch b/opendnssec-2.1.14rc1-gcc14.patch deleted file mode 100644 index 51b8095..0000000 --- a/opendnssec-2.1.14rc1-gcc14.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Thu, 8 Feb 2024 13:10:53 +0200 -Subject: [PATCH] Fix missing include -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -scheduler/task.c: In function ‘task_perform’: -scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration] - 137 | task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF); - | ^~~~~ -make[2]: *** [Makefile:600: scheduler/task.o] Error 1 - -Signed-off-by: Alexander Bokovoy ---- - common/scheduler/task.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/common/scheduler/task.c b/common/scheduler/task.c -index 4dcf9e900..0dfa496a2 100644 ---- a/common/scheduler/task.c -+++ b/common/scheduler/task.c -@@ -40,6 +40,7 @@ - #include "duration.h" - #include "file.h" - #include "log.h" -+#include "utilities.h" - - static const char* task_str = "task"; - static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER; --- -2.43.0 - diff --git a/opendnssec-c99-2.patch b/opendnssec-c99-2.patch deleted file mode 100644 index db04f2b..0000000 --- a/opendnssec-c99-2.patch +++ /dev/null @@ -1,20 +0,0 @@ -commit 5422819c17c02e6069328b2f5e4bef6fe5c179df -Author: Mathieu Mirmont -Date: Sun Dec 1 17:57:36 2019 +0100 - - enforcer: remove remove strptime build warning - -diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c -index f1ee21b87529c136..5baef1b6ff7c4cc2 100644 ---- a/enforcer/src/daemon/time_leap_cmd.c -+++ b/enforcer/src/daemon/time_leap_cmd.c -@@ -26,8 +26,8 @@ - * - */ - --#include - #include "config.h" -+#include - - #include "file.h" - #include "duration.h" diff --git a/opendnssec-configure-c99.patch b/opendnssec-configure-c99.patch deleted file mode 100644 index 509462f..0000000 --- a/opendnssec-configure-c99.patch +++ /dev/null @@ -1,45 +0,0 @@ -Include for the setresuid and setresgid functions, -to avoid an implicit function declaration. - -Submitted upstream: - -diff --git a/configure b/configure -index bf515cde3d4fab71..52d2885d6a6ef546 100755 ---- a/configure -+++ b/configure -@@ -21101,6 +21101,7 @@ else - cat confdefs.h - <<_ACEOF >conftest.$ac_ext - /* end confdefs.h. */ - -+#include - #include - #include - int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} -@@ -21143,6 +21144,7 @@ else - cat confdefs.h - <<_ACEOF >conftest.$ac_ext - /* end confdefs.h. */ - -+#include - #include - #include - int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} -diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4 -index 374cee0b0b8ef196..467db9170a319170 100644 ---- a/m4/acx_broken_setres.m4 -+++ b/m4/acx_broken_setres.m4 -@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[ - AC_MSG_CHECKING(if setresuid seems to work) - AC_RUN_IFELSE( - [AC_LANG_SOURCE([[ -+#include - #include - #include - int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} -@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} - AC_MSG_CHECKING(if setresgid seems to work) - AC_RUN_IFELSE( - [AC_LANG_SOURCE([[ -+#include - #include - #include - int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} diff --git a/opendnssec-implicit-declarations.patch b/opendnssec-implicit-declarations.patch deleted file mode 100644 index c2a6aed..0000000 --- a/opendnssec-implicit-declarations.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001 -From: Yaakov Selkowitz -Date: Tue, 26 Dec 2023 14:09:12 -0500 -Subject: [PATCH] Fix implicit function declarations -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’ -utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’ -utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’ -utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’ -utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’ -utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’ -utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’ -utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’ ---- - enforcer/src/utils/kaspcheck.c | 1 + - enforcer/src/utils/kc_helper.c | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c -index 9bac3b796..b3b808598 100644 ---- a/enforcer/src/utils/kaspcheck.c -+++ b/enforcer/src/utils/kaspcheck.c -@@ -26,6 +26,7 @@ - #define _GNU_SOURCE - #include - #include -+#include - #include - #include - -diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c -index 89e56c61e..e1704f6f9 100644 ---- a/enforcer/src/utils/kc_helper.c -+++ b/enforcer/src/utils/kc_helper.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - #include - #include - #include --- -2.43.0 - diff --git a/opendnssec-sysusers.conf b/opendnssec-sysusers.conf deleted file mode 100644 index b47c25f..0000000 --- a/opendnssec-sysusers.conf +++ /dev/null @@ -1 +0,0 @@ -u ods - "opendnssec daemon account" diff --git a/opendnssec.spec b/opendnssec.spec index f11d67a..6a48325 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,13 +1,13 @@ +#global prever rcX %global _hardened_build 1 Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.14 -Release: 2%{?dist} -License: BSD-2-Clause +Version: 2.1.7 +Release: 3%{?prever}%{?dist} +License: BSD Url: http://www.opendnssec.org/ -Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz -Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig +Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz Source1: ods-enforcerd.service Source2: ods-signerd.service Source3: ods.sysconfig @@ -16,16 +16,9 @@ Source5: tmpfiles-opendnssec.conf Source6: opendnssec.cron Source7: opendnssec-2.1.sqlite_convert.sql Source8: opendnssec-2.1.sqlite_rpmversion.sql -Source9: %{name}-sysusers.conf -Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch -Patch2: opendnssec-configure-c99.patch -Patch3: opendnssec-2.1.14rc1-gcc14.patch -Patch4: opendnssec-c99-2.patch -Patch5: opendnssec-implicit-declarations.patch Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units Requires: libxml2, libxslt sqlite -BuildRequires: make BuildRequires: gcc BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen @@ -41,10 +34,7 @@ Requires(preun): systemd-units Requires(postun): systemd-units %if 0%{?prever:1} # For building development snapshots -Buildrequires: autoconf, automake, libtool -%ifarch %{java_arches} -Buildrequires: java -%endif +Buildrequires: autoconf, automake, libtool, java %endif %description @@ -54,15 +44,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} -%patch -P1 -p1 -%patch -P2 -p1 -%patch -P3 -p1 -%patch -P4 -p1 -%patch -P5 -p1 - -# Prevent re-running autoconf. -touch -r aclocal.m4 configure* m4/* - # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in @@ -72,7 +53,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -W export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security" %if 0%{?prever:1} # for development snapshots -autoreconf +sh ./autogen.sh %endif %configure --with-ldns=%{_libdir} %make_build @@ -94,7 +75,6 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ -install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf mkdir -p %{buildroot}%{_tmpfilesdir}/ install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec @@ -132,11 +112,13 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert %{_bindir}/* %attr(0755,root,root) %dir %{_datadir}/opendnssec %{_datadir}/opendnssec/* -%{_sysusersdir}/%{name}.conf %pre - -%sysusers_create_package %{name} %{SOURCE9} +getent group ods >/dev/null || groupadd -r ods +getent passwd ods >/dev/null || \ +useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ +-c "opendnssec daemon account" ods +exit 0 %post # Initialise a slot on the softhsm on first install @@ -195,78 +177,8 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog -* Thu Jul 24 2025 Fedora Release Engineering - 2.1.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jan 21 2025 Rafel Jeffman - 2.1.14-1 -- Upstream release 2.1.14 -- Use systemd-sysusers - -* Fri Jan 17 2025 Fedora Release Engineering - 2.1.14-0.4rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Tue Oct 22 2024 Richard W.M. Jones - 2.1.14-0.3rc1 -- Rebuild for Jansson 2.14 - (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) - -* Thu Jul 18 2024 Fedora Release Engineering - 2.1.14-0.2rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Thu Feb 08 2024 Alexander Bokovoy - 2.1.14-0.1rc1 -- Upstream release 2.1.14RC1 -- Fix build with gcc 14 -- Resolves: rhbz#2261421 - -* Thu Jan 25 2024 Fedora Release Engineering - 2.1.10-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 2.1.10-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Jul 20 2023 Fedora Release Engineering - 2.1.10-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Fri Feb 24 2023 Florian Weimer - 2.1.10-6 -- Port to C99 - -* Mon Jan 30 2023 Alexander Bokovoy - 2.1.10-5 -- Fix fortification issues leading to crash in FreeIPA setup - Upstream PR: https://github.com/opendnssec/opendnssec/pull/842 - -* Thu Jan 19 2023 Fedora Release Engineering - 2.1.10-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Fri Jul 22 2022 Fedora Release Engineering - 2.1.10-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Jan 20 2022 Fedora Release Engineering - 2.1.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Mon Oct 18 2021 François Cami - 2.1.10-1 -- Update to 2.1.10 (rhbz#2003250). - -* Tue Sep 14 2021 Sahana Prasad - 2.1.9-3 -- Rebuilt with OpenSSL 3.0.0 - -* Thu Jul 22 2021 Fedora Release Engineering - 2.1.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Tue Jul 06 2021 François Cami - 2.1.9-1 -- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956. -- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured. - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.1.8-2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Sat Feb 20 2021 Fedora Release Monitoring - 2.1.8-1 -- Update to 2.1.8 (#1931143) - -* Tue Jan 26 2021 Fedora Release Engineering - 2.1.7-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3 -- Rebuild for libldns soname bump +* Mon May 31 2021 Paul Wouters - 2.1.7-3 +- Bump for ldns update that changed so version * Tue Dec 8 21:09:23 EST 2020 Paul Wouters - 2.1.7-2 - Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready diff --git a/sources b/sources index 1f2ad74..4310ec1 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620 -SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f +SHA512 (opendnssec-2.1.7.tar.gz) = 6f2ca2115195fd2fcd0b22186c41c9e64ec24d98b34a10a8a75d64b4671b5afe3a655f32bbd241a0df84affda1f6cecd4daac0e6fa7081e4c9fa02d1bb4ed1eb