diff --git a/.gitignore b/.gitignore index e6788c2..105f0cf 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,12 @@ /opendnssec-1.4.14.tar.gz /opendnssec-2.1.6.tar.gz /opendnssec-2.1.7.tar.gz +/opendnssec-2.1.8.tar.gz +/opendnssec-2.1.9.tar.gz +/opendnssec-2.1.9.tar.gz.sig +/opendnssec-2.1.10.tar.gz.sig +/opendnssec-2.1.10.tar.gz +/opendnssec-2.1.14rc1.tar.gz +/opendnssec-2.1.14rc1.tar.gz.sig +/opendnssec-2.1.14.tar.gz +/opendnssec-2.1.14.tar.gz.sig diff --git a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch new file mode 100644 index 0000000..68f46c5 --- /dev/null +++ b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch @@ -0,0 +1,35 @@ +From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 30 Jan 2023 11:44:49 +0200 +Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle + string fortification + +When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc +will cut few bytes off the string buffer for prevention of buffer +overruns. As a result, hsm_hex_unparse() will call into snprintf() with +a buffer length bigger than the size of the buffer as seen by the +GCC/glibc pair. + +See also: https://pagure.io/freeipa/issue/9312 + +Signed-off-by: Alexander Bokovoy +--- + libhsm/src/lib/libhsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c +index 88dc79e31..8f1e0c3bc 100644 +--- a/libhsm/src/lib/libhsm.c ++++ b/libhsm/src/lib/libhsm.c +@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len) + size_t i; + + for (i = 0; i < len; i++) { +- snprintf(dst + (2*i), dst_len, "%02x", src[i]); ++ snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]); + } + dst[len*2] = '\0'; + } +-- +2.39.0 + diff --git a/opendnssec-2.1.14rc1-gcc14.patch b/opendnssec-2.1.14rc1-gcc14.patch new file mode 100644 index 0000000..51b8095 --- /dev/null +++ b/opendnssec-2.1.14rc1-gcc14.patch @@ -0,0 +1,34 @@ +From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Thu, 8 Feb 2024 13:10:53 +0200 +Subject: [PATCH] Fix missing include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +scheduler/task.c: In function ‘task_perform’: +scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration] + 137 | task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF); + | ^~~~~ +make[2]: *** [Makefile:600: scheduler/task.o] Error 1 + +Signed-off-by: Alexander Bokovoy +--- + common/scheduler/task.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/common/scheduler/task.c b/common/scheduler/task.c +index 4dcf9e900..0dfa496a2 100644 +--- a/common/scheduler/task.c ++++ b/common/scheduler/task.c +@@ -40,6 +40,7 @@ + #include "duration.h" + #include "file.h" + #include "log.h" ++#include "utilities.h" + + static const char* task_str = "task"; + static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER; +-- +2.43.0 + diff --git a/opendnssec-c99-2.patch b/opendnssec-c99-2.patch new file mode 100644 index 0000000..db04f2b --- /dev/null +++ b/opendnssec-c99-2.patch @@ -0,0 +1,20 @@ +commit 5422819c17c02e6069328b2f5e4bef6fe5c179df +Author: Mathieu Mirmont +Date: Sun Dec 1 17:57:36 2019 +0100 + + enforcer: remove remove strptime build warning + +diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c +index f1ee21b87529c136..5baef1b6ff7c4cc2 100644 +--- a/enforcer/src/daemon/time_leap_cmd.c ++++ b/enforcer/src/daemon/time_leap_cmd.c +@@ -26,8 +26,8 @@ + * + */ + +-#include + #include "config.h" ++#include + + #include "file.h" + #include "duration.h" diff --git a/opendnssec-configure-c99.patch b/opendnssec-configure-c99.patch new file mode 100644 index 0000000..509462f --- /dev/null +++ b/opendnssec-configure-c99.patch @@ -0,0 +1,45 @@ +Include for the setresuid and setresgid functions, +to avoid an implicit function declaration. + +Submitted upstream: + +diff --git a/configure b/configure +index bf515cde3d4fab71..52d2885d6a6ef546 100755 +--- a/configure ++++ b/configure +@@ -21101,6 +21101,7 @@ else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#include + #include + #include + int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} +@@ -21143,6 +21144,7 @@ else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#include + #include + #include + int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} +diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4 +index 374cee0b0b8ef196..467db9170a319170 100644 +--- a/m4/acx_broken_setres.m4 ++++ b/m4/acx_broken_setres.m4 +@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[ + AC_MSG_CHECKING(if setresuid seems to work) + AC_RUN_IFELSE( + [AC_LANG_SOURCE([[ ++#include + #include + #include + int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} +@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} + AC_MSG_CHECKING(if setresgid seems to work) + AC_RUN_IFELSE( + [AC_LANG_SOURCE([[ ++#include + #include + #include + int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} diff --git a/opendnssec-implicit-declarations.patch b/opendnssec-implicit-declarations.patch new file mode 100644 index 0000000..c2a6aed --- /dev/null +++ b/opendnssec-implicit-declarations.patch @@ -0,0 +1,48 @@ +From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001 +From: Yaakov Selkowitz +Date: Tue, 26 Dec 2023 14:09:12 -0500 +Subject: [PATCH] Fix implicit function declarations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’ +utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’ +utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’ +utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’ +utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’ +utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’ +utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’ +utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’ +--- + enforcer/src/utils/kaspcheck.c | 1 + + enforcer/src/utils/kc_helper.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c +index 9bac3b796..b3b808598 100644 +--- a/enforcer/src/utils/kaspcheck.c ++++ b/enforcer/src/utils/kaspcheck.c +@@ -26,6 +26,7 @@ + #define _GNU_SOURCE + #include + #include ++#include + #include + #include + +diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c +index 89e56c61e..e1704f6f9 100644 +--- a/enforcer/src/utils/kc_helper.c ++++ b/enforcer/src/utils/kc_helper.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + #include +-- +2.43.0 + diff --git a/opendnssec-sysusers.conf b/opendnssec-sysusers.conf new file mode 100644 index 0000000..b47c25f --- /dev/null +++ b/opendnssec-sysusers.conf @@ -0,0 +1 @@ +u ods - "opendnssec daemon account" diff --git a/opendnssec.spec b/opendnssec.spec index ebe1724..f11d67a 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,13 +1,13 @@ -#global prever rcX %global _hardened_build 1 Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.7 -Release: 2%{?prever}%{?dist} -License: BSD +Version: 2.1.14 +Release: 2%{?dist} +License: BSD-2-Clause Url: http://www.opendnssec.org/ -Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz +Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz +Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig Source1: ods-enforcerd.service Source2: ods-signerd.service Source3: ods.sysconfig @@ -16,9 +16,16 @@ Source5: tmpfiles-opendnssec.conf Source6: opendnssec.cron Source7: opendnssec-2.1.sqlite_convert.sql Source8: opendnssec-2.1.sqlite_rpmversion.sql +Source9: %{name}-sysusers.conf +Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch +Patch2: opendnssec-configure-c99.patch +Patch3: opendnssec-2.1.14rc1-gcc14.patch +Patch4: opendnssec-c99-2.patch +Patch5: opendnssec-implicit-declarations.patch Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units Requires: libxml2, libxslt sqlite +BuildRequires: make BuildRequires: gcc BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen @@ -34,7 +41,10 @@ Requires(preun): systemd-units Requires(postun): systemd-units %if 0%{?prever:1} # For building development snapshots -Buildrequires: autoconf, automake, libtool, java +Buildrequires: autoconf, automake, libtool +%ifarch %{java_arches} +Buildrequires: java +%endif %endif %description @@ -44,6 +54,15 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} +%patch -P1 -p1 +%patch -P2 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 + +# Prevent re-running autoconf. +touch -r aclocal.m4 configure* m4/* + # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in @@ -53,7 +72,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -W export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security" %if 0%{?prever:1} # for development snapshots -sh ./autogen.sh +autoreconf %endif %configure --with-ldns=%{_libdir} %make_build @@ -75,6 +94,7 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ +install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf mkdir -p %{buildroot}%{_tmpfilesdir}/ install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec @@ -112,13 +132,11 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert %{_bindir}/* %attr(0755,root,root) %dir %{_datadir}/opendnssec %{_datadir}/opendnssec/* +%{_sysusersdir}/%{name}.conf %pre -getent group ods >/dev/null || groupadd -r ods -getent passwd ods >/dev/null || \ -useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ --c "opendnssec daemon account" ods -exit 0 + +%sysusers_create_package %{name} %{SOURCE9} %post # Initialise a slot on the softhsm on first install @@ -177,6 +195,79 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 2.1.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jan 21 2025 Rafel Jeffman - 2.1.14-1 +- Upstream release 2.1.14 +- Use systemd-sysusers + +* Fri Jan 17 2025 Fedora Release Engineering - 2.1.14-0.4rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Oct 22 2024 Richard W.M. Jones - 2.1.14-0.3rc1 +- Rebuild for Jansson 2.14 + (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) + +* Thu Jul 18 2024 Fedora Release Engineering - 2.1.14-0.2rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Thu Feb 08 2024 Alexander Bokovoy - 2.1.14-0.1rc1 +- Upstream release 2.1.14RC1 +- Fix build with gcc 14 +- Resolves: rhbz#2261421 + +* Thu Jan 25 2024 Fedora Release Engineering - 2.1.10-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2.1.10-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jul 20 2023 Fedora Release Engineering - 2.1.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Fri Feb 24 2023 Florian Weimer - 2.1.10-6 +- Port to C99 + +* Mon Jan 30 2023 Alexander Bokovoy - 2.1.10-5 +- Fix fortification issues leading to crash in FreeIPA setup + Upstream PR: https://github.com/opendnssec/opendnssec/pull/842 + +* Thu Jan 19 2023 Fedora Release Engineering - 2.1.10-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Fri Jul 22 2022 Fedora Release Engineering - 2.1.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 2.1.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Mon Oct 18 2021 François Cami - 2.1.10-1 +- Update to 2.1.10 (rhbz#2003250). + +* Tue Sep 14 2021 Sahana Prasad - 2.1.9-3 +- Rebuilt with OpenSSL 3.0.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 2.1.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jul 06 2021 François Cami - 2.1.9-1 +- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956. +- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured. + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.1.8-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Sat Feb 20 2021 Fedora Release Monitoring - 2.1.8-1 +- Update to 2.1.8 (#1931143) + +* Tue Jan 26 2021 Fedora Release Engineering - 2.1.7-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3 +- Rebuild for libldns soname bump + * Tue Dec 8 21:09:23 EST 2020 Paul Wouters - 2.1.7-2 - Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready diff --git a/sources b/sources index 4310ec1..1f2ad74 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (opendnssec-2.1.7.tar.gz) = 6f2ca2115195fd2fcd0b22186c41c9e64ec24d98b34a10a8a75d64b4671b5afe3a655f32bbd241a0df84affda1f6cecd4daac0e6fa7081e4c9fa02d1bb4ed1eb +SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620 +SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f