From 6898d0823ad912b107a42164723cf0e721968bce Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Sat, 19 Dec 2020 10:14:09 -0800 Subject: [PATCH 01/26] Rebuild for libldns soname bump --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index ebe1724..8caab5f 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.7 -Release: 2%{?prever}%{?dist} +Release: 3%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -177,6 +177,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3 +- Rebuild for libldns soname bump + * Tue Dec 8 21:09:23 EST 2020 Paul Wouters - 2.1.7-2 - Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready From 0f5fe5758a392760491e97564417683318db11db Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Thu, 7 Jan 2021 06:30:35 +0000 Subject: [PATCH 02/26] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- opendnssec.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/opendnssec.spec b/opendnssec.spec index 8caab5f..2b603e8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -19,6 +19,7 @@ Source8: opendnssec-2.1.sqlite_rpmversion.sql Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units Requires: libxml2, libxslt sqlite +BuildRequires: make BuildRequires: gcc BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen From 937d85e9009d51ed8fb9fc8f3bdd5d0847f96798 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 22:29:32 +0000 Subject: [PATCH 03/26] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 2b603e8..5605d70 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.7 -Release: 3%{?prever}%{?dist} +Release: 4%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 2.1.7-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3 - Rebuild for libldns soname bump From 33b7514afca8c2cd43d9a4fa5fa05519027c6e2f Mon Sep 17 00:00:00 2001 From: Fedora Release Monitoring Date: Sat, 20 Feb 2021 21:52:14 +0000 Subject: [PATCH 04/26] Update to 2.1.8 (#1931143) --- .gitignore | 1 + opendnssec.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index e6788c2..8249a75 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ /opendnssec-1.4.14.tar.gz /opendnssec-2.1.6.tar.gz /opendnssec-2.1.7.tar.gz +/opendnssec-2.1.8.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 5605d70..2cbe50b 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,8 +3,8 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.7 -Release: 4%{?prever}%{?dist} +Version: 2.1.8 +Release: 1%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Sat Feb 20 2021 Fedora Release Monitoring - 2.1.8-1 +- Update to 2.1.8 (#1931143) + * Tue Jan 26 2021 Fedora Release Engineering - 2.1.7-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 4310ec1..e8c6324 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (opendnssec-2.1.7.tar.gz) = 6f2ca2115195fd2fcd0b22186c41c9e64ec24d98b34a10a8a75d64b4671b5afe3a655f32bbd241a0df84affda1f6cecd4daac0e6fa7081e4c9fa02d1bb4ed1eb +SHA512 (opendnssec-2.1.8.tar.gz) = 48fa9e1efe54d00bba1c97d42d8680a7b33d90360cbb12e333835384447a9d42ffc6508ee6b455bfa4522907b371d4703068e4fd184fd72ea6d950427029cc1c From 85d740ed46e49bf6ddd07a75c57d9743af737f66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:10 +0100 Subject: [PATCH 05/26] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- opendnssec.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 2cbe50b..25a5866 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.8 -Release: 1%{?dist} +Release: 2%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,10 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.1.8-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Sat Feb 20 2021 Fedora Release Monitoring - 2.1.8-1 - Update to 2.1.8 (#1931143) From a7fe6a09abcd70e31d49ddc64e8fd9dc0671f41f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= Date: Tue, 6 Jul 2021 16:47:58 +0200 Subject: [PATCH 06/26] Update to 2.1.9 Issues solved: - OPENDNSSEC-955: Prevent concurrency between certain valid PKCS#11 HSM operations to avoid some keys to be (transiently) unavailable. - OPENDNSSEC-956: Harden signing procedure to still sign zones for which there are unused keys specified in the zone which are unavailable. Known issue: - OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured. --- .gitignore | 2 ++ opendnssec.spec | 8 ++++++-- sources | 3 ++- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 8249a75..7dc1c43 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,5 @@ /opendnssec-2.1.6.tar.gz /opendnssec-2.1.7.tar.gz /opendnssec-2.1.8.tar.gz +/opendnssec-2.1.9.tar.gz +/opendnssec-2.1.9.tar.gz.sig diff --git a/opendnssec.spec b/opendnssec.spec index 25a5866..af49b70 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,8 +3,8 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.8 -Release: 2%{?dist} +Version: 2.1.9 +Release: 1%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,10 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Tue Jul 06 2021 François Cami - 2.1.9-1 +- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956. +- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured. + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.1.8-2 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/sources b/sources index e8c6324..6d1eac2 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (opendnssec-2.1.8.tar.gz) = 48fa9e1efe54d00bba1c97d42d8680a7b33d90360cbb12e333835384447a9d42ffc6508ee6b455bfa4522907b371d4703068e4fd184fd72ea6d950427029cc1c +SHA512 (opendnssec-2.1.9.tar.gz) = 011a50606559651db1787949dcedbbc8727b8ec5c71e95425bfdae94b6db6b731e662ce4cb9f05b34d4ec3512067227869a72a2b2c8a6c14eb547036e4b6e02e +SHA512 (opendnssec-2.1.9.tar.gz.sig) = a3e60e231dfe2a3bdcc0756a4cc601d6b4aef7e98b8a60b19b0e51a8ab2efb5b75c1a72f87a1b95378d0f5d586dd6952ffd13b8c13aaac7bcb3dae637df9b909 From 11a2c18037c077e905f227d988a582e3b5c5dd9c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 17:12:55 +0000 Subject: [PATCH 07/26] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index af49b70..9c2cb6e 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.9 -Release: 1%{?dist} +Release: 2%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 2.1.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Jul 06 2021 François Cami - 2.1.9-1 - Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956. - Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured. From c199a0094f3e78c8959b6c62895cc4eb9e98d496 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:09:42 +0200 Subject: [PATCH 08/26] Rebuilt with OpenSSL 3.0.0 --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 9c2cb6e..4d42498 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.9 -Release: 2%{?dist} +Release: 3%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Tue Sep 14 2021 Sahana Prasad - 2.1.9-3 +- Rebuilt with OpenSSL 3.0.0 + * Thu Jul 22 2021 Fedora Release Engineering - 2.1.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From e09e7a26806e3c985c2e30728329146d00cbb110 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= Date: Mon, 18 Oct 2021 20:42:54 +0200 Subject: [PATCH 09/26] Update to 2.1.10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Issues reported fixed by upstream (same as 2.1.9): - OPENDNSSEC-955: Prevent concurrency between certain valid PKCS#11 HSM operations to avoid some keys to be (transiently) unavailable. - OPENDNSSEC-956: Harden signing procedure to still sign zones for which there are unused keys specified in the zone which are unavailable. Issues newly reported fixed: - OPENDNSSEC-957: Fix exit code signer daemon to not always report failure. - OPENDNSSEC-958: Fix immediate resalting after migration from 1.4. - OPENDNSSEC-959: Emit warning on ods-kaspcheck for NSEC iteration count that is deemed too high. - SUPPORT-265: Resolve conflict when deleting keys from HSM whilst also performing step in key roll process. Typically a message “key_data_update failed” is present in logs. --- .gitignore | 2 ++ opendnssec.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7dc1c43..ecd9c4f 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,5 @@ /opendnssec-2.1.8.tar.gz /opendnssec-2.1.9.tar.gz /opendnssec-2.1.9.tar.gz.sig +/opendnssec-2.1.10.tar.gz.sig +/opendnssec-2.1.10.tar.gz diff --git a/opendnssec.spec b/opendnssec.spec index 4d42498..5b3e6b8 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,8 +3,8 @@ Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.9 -Release: 3%{?dist} +Version: 2.1.10 +Release: 1%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Mon Oct 18 2021 François Cami - 2.1.10-1 +- Update to 2.1.10 (rhbz#2003250). + * Tue Sep 14 2021 Sahana Prasad - 2.1.9-3 - Rebuilt with OpenSSL 3.0.0 diff --git a/sources b/sources index 6d1eac2..51ddc35 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (opendnssec-2.1.9.tar.gz) = 011a50606559651db1787949dcedbbc8727b8ec5c71e95425bfdae94b6db6b731e662ce4cb9f05b34d4ec3512067227869a72a2b2c8a6c14eb547036e4b6e02e -SHA512 (opendnssec-2.1.9.tar.gz.sig) = a3e60e231dfe2a3bdcc0756a4cc601d6b4aef7e98b8a60b19b0e51a8ab2efb5b75c1a72f87a1b95378d0f5d586dd6952ffd13b8c13aaac7bcb3dae637df9b909 +SHA512 (opendnssec-2.1.10.tar.gz.sig) = edae30f551465a70a8c9476dc91e079d36a0fa2cf84e1973cbcce6ee2c6a2eba4a773deb9f18fe6787189ce7d3ae7a2c948dee0a6f6cf2f59b745d5cbe68d7b8 +SHA512 (opendnssec-2.1.10.tar.gz) = c7fdbf1c3867d7b53ac11ab5cb5e636af4595dbee8d704429c7fb84cc3a6b2082ed490c33aad7747d4ee1a2c580afcf24a260bc3ed29eaf5e9d337004045b82d From 30b5213ccdc7b929bc828d935eedde3b27d033f3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 22:21:03 +0000 Subject: [PATCH 10/26] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 5b3e6b8..538fd5e 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 1%{?dist} +Release: 2%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 2.1.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Mon Oct 18 2021 François Cami - 2.1.10-1 - Update to 2.1.10 (rhbz#2003250). From 6874e7b9362a1dbca0af7294974c613b9d611d07 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 02:04:15 +0000 Subject: [PATCH 11/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 538fd5e..8fb9c8f 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 2%{?dist} +Release: 3%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 2.1.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Jan 20 2022 Fedora Release Engineering - 2.1.10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 4dd7781f5f496c1b9334072e44b74c7c05383876 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 22:48:11 +0000 Subject: [PATCH 12/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 8fb9c8f..2df6722 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 3%{?dist} +Release: 4%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -178,6 +178,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 2.1.10-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Jul 22 2022 Fedora Release Engineering - 2.1.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From ca78a1bdbf11c823948d053ca49a693a96fb645d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 30 Jan 2023 12:00:33 +0200 Subject: [PATCH 13/26] Fix fortification issues Signed-off-by: Alexander Bokovoy --- ...ning-buffer-size-in-hsm_hex_unparse-.patch | 35 +++++++++++++++++++ opendnssec.spec | 9 ++++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch diff --git a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch new file mode 100644 index 0000000..68f46c5 --- /dev/null +++ b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch @@ -0,0 +1,35 @@ +From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 30 Jan 2023 11:44:49 +0200 +Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle + string fortification + +When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc +will cut few bytes off the string buffer for prevention of buffer +overruns. As a result, hsm_hex_unparse() will call into snprintf() with +a buffer length bigger than the size of the buffer as seen by the +GCC/glibc pair. + +See also: https://pagure.io/freeipa/issue/9312 + +Signed-off-by: Alexander Bokovoy +--- + libhsm/src/lib/libhsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c +index 88dc79e31..8f1e0c3bc 100644 +--- a/libhsm/src/lib/libhsm.c ++++ b/libhsm/src/lib/libhsm.c +@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len) + size_t i; + + for (i = 0; i < len; i++) { +- snprintf(dst + (2*i), dst_len, "%02x", src[i]); ++ snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]); + } + dst[len*2] = '\0'; + } +-- +2.39.0 + diff --git a/opendnssec.spec b/opendnssec.spec index 2df6722..c551111 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 4%{?dist} +Release: 5%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -16,6 +16,7 @@ Source5: tmpfiles-opendnssec.conf Source6: opendnssec.cron Source7: opendnssec-2.1.sqlite_convert.sql Source8: opendnssec-2.1.sqlite_rpmversion.sql +Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units Requires: libxml2, libxslt sqlite @@ -45,6 +46,8 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} +%patch1 -p1 + # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in @@ -178,6 +181,10 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Mon Jan 30 2023 Alexander Bokovoy - 2.1.10-5 +- Fix fortification issues leading to crash in FreeIPA setup + Upstream PR: https://github.com/opendnssec/opendnssec/pull/842 + * Thu Jan 19 2023 Fedora Release Engineering - 2.1.10-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From dd051b0e3c2fb2483f874384139e61b2ae11cf5c Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 24 Feb 2023 18:21:45 +0100 Subject: [PATCH 14/26] Port to C99 Related to: --- opendnssec-c99-1.patch | 18 ++++++++++++++ opendnssec-c99-2.patch | 20 +++++++++++++++ opendnssec-configure-c99.patch | 45 ++++++++++++++++++++++++++++++++++ opendnssec.spec | 13 +++++++++- 4 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 opendnssec-c99-1.patch create mode 100644 opendnssec-c99-2.patch create mode 100644 opendnssec-configure-c99.patch diff --git a/opendnssec-c99-1.patch b/opendnssec-c99-1.patch new file mode 100644 index 0000000..531a73f --- /dev/null +++ b/opendnssec-c99-1.patch @@ -0,0 +1,18 @@ +commit 27290c5fcd065a5a857d37236e7f79121e303d0a +Author: Mathieu Mirmont +Date: Sun Dec 1 18:43:53 2019 +0100 + + common: add missing util.h header + +diff --git a/common/scheduler/task.c b/common/scheduler/task.c +index cfdbd2d101aae795..9c09dc1893363abe 100644 +--- a/common/scheduler/task.c ++++ b/common/scheduler/task.c +@@ -39,6 +39,7 @@ + #include "status.h" + #include "duration.h" + #include "file.h" ++#include "util.h" + #include "log.h" + + static const char* task_str = "task"; diff --git a/opendnssec-c99-2.patch b/opendnssec-c99-2.patch new file mode 100644 index 0000000..db04f2b --- /dev/null +++ b/opendnssec-c99-2.patch @@ -0,0 +1,20 @@ +commit 5422819c17c02e6069328b2f5e4bef6fe5c179df +Author: Mathieu Mirmont +Date: Sun Dec 1 17:57:36 2019 +0100 + + enforcer: remove remove strptime build warning + +diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c +index f1ee21b87529c136..5baef1b6ff7c4cc2 100644 +--- a/enforcer/src/daemon/time_leap_cmd.c ++++ b/enforcer/src/daemon/time_leap_cmd.c +@@ -26,8 +26,8 @@ + * + */ + +-#include + #include "config.h" ++#include + + #include "file.h" + #include "duration.h" diff --git a/opendnssec-configure-c99.patch b/opendnssec-configure-c99.patch new file mode 100644 index 0000000..509462f --- /dev/null +++ b/opendnssec-configure-c99.patch @@ -0,0 +1,45 @@ +Include for the setresuid and setresgid functions, +to avoid an implicit function declaration. + +Submitted upstream: + +diff --git a/configure b/configure +index bf515cde3d4fab71..52d2885d6a6ef546 100755 +--- a/configure ++++ b/configure +@@ -21101,6 +21101,7 @@ else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#include + #include + #include + int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} +@@ -21143,6 +21144,7 @@ else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext + /* end confdefs.h. */ + ++#include + #include + #include + int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} +diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4 +index 374cee0b0b8ef196..467db9170a319170 100644 +--- a/m4/acx_broken_setres.m4 ++++ b/m4/acx_broken_setres.m4 +@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[ + AC_MSG_CHECKING(if setresuid seems to work) + AC_RUN_IFELSE( + [AC_LANG_SOURCE([[ ++#include + #include + #include + int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} +@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} + AC_MSG_CHECKING(if setresgid seems to work) + AC_RUN_IFELSE( + [AC_LANG_SOURCE([[ ++#include + #include + #include + int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);} diff --git a/opendnssec.spec b/opendnssec.spec index c551111..1d320db 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 5%{?dist} +Release: 6%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -17,6 +17,9 @@ Source6: opendnssec.cron Source7: opendnssec-2.1.sqlite_convert.sql Source8: opendnssec-2.1.sqlite_rpmversion.sql Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch +Patch2: opendnssec-configure-c99.patch +Patch3: opendnssec-c99-1.patch +Patch4: opendnssec-c99-2.patch Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units Requires: libxml2, libxslt sqlite @@ -47,6 +50,11 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} %patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +# Prevent re-running autoconf. +touch -r aclocal.m4 configure* m4/* # bump default policy ZSK keysize to 2048 sed -i "s/1024/2048/" conf/kasp.xml.in @@ -181,6 +189,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Fri Feb 24 2023 Florian Weimer - 2.1.10-6 +- Port to C99 + * Mon Jan 30 2023 Alexander Bokovoy - 2.1.10-5 - Fix fortification issues leading to crash in FreeIPA setup Upstream PR: https://github.com/opendnssec/opendnssec/pull/842 From 426504b099e47d34995c4a54acbdfd328b9d9411 Mon Sep 17 00:00:00 2001 From: Rafael Guterres Jeffman Date: Thu, 30 Mar 2023 11:41:33 -0300 Subject: [PATCH 15/26] Migrated to SPDX license Signed-off-by: Rafael Guterres Jeffman --- opendnssec.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 1d320db..51fc4ba 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -5,7 +5,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 Release: 6%{?dist} -License: BSD +License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz Source1: ods-enforcerd.service From c919b74c3bab14cc893081a0bc8026bcf08f27e3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 18:02:19 +0000 Subject: [PATCH 16/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 51fc4ba..4db1d5e 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 6%{?dist} +Release: 7%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -189,6 +189,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 2.1.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Fri Feb 24 2023 Florian Weimer - 2.1.10-6 - Port to C99 From 636ceed7aa134ffd60bc950026e742ae873711ab Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 26 Dec 2023 14:13:56 -0500 Subject: [PATCH 17/26] Fix for https://fedoraproject.org/wiki/Changes/PortingToModernC https://github.com/opendnssec/opendnssec/pull/853 --- opendnssec-implicit-declarations.patch | 48 ++++++++++++++++++++++++++ opendnssec.spec | 2 ++ 2 files changed, 50 insertions(+) create mode 100644 opendnssec-implicit-declarations.patch diff --git a/opendnssec-implicit-declarations.patch b/opendnssec-implicit-declarations.patch new file mode 100644 index 0000000..c2a6aed --- /dev/null +++ b/opendnssec-implicit-declarations.patch @@ -0,0 +1,48 @@ +From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001 +From: Yaakov Selkowitz +Date: Tue, 26 Dec 2023 14:09:12 -0500 +Subject: [PATCH] Fix implicit function declarations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’ +utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’ +utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’ +utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’ +utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’ +utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’ +utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’ +utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’ +--- + enforcer/src/utils/kaspcheck.c | 1 + + enforcer/src/utils/kc_helper.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c +index 9bac3b796..b3b808598 100644 +--- a/enforcer/src/utils/kaspcheck.c ++++ b/enforcer/src/utils/kaspcheck.c +@@ -26,6 +26,7 @@ + #define _GNU_SOURCE + #include + #include ++#include + #include + #include + +diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c +index 89e56c61e..e1704f6f9 100644 +--- a/enforcer/src/utils/kc_helper.c ++++ b/enforcer/src/utils/kc_helper.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + #include +-- +2.43.0 + diff --git a/opendnssec.spec b/opendnssec.spec index 4db1d5e..f68283d 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -20,6 +20,7 @@ Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch Patch2: opendnssec-configure-c99.patch Patch3: opendnssec-c99-1.patch Patch4: opendnssec-c99-2.patch +Patch5: opendnssec-implicit-declarations.patch Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units Requires: libxml2, libxslt sqlite @@ -53,6 +54,7 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch -P5 -p1 # Prevent re-running autoconf. touch -r aclocal.m4 configure* m4/* From 323443742631a4d2f130a446c95b6821d13a68cd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 11:11:11 +0000 Subject: [PATCH 18/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index f68283d..7e62735 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 7%{?dist} +Release: 8%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -191,6 +191,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 2.1.10-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 20 2023 Fedora Release Engineering - 2.1.10-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From d240ecae2e81757c83232e944c1b2f56c7aad997 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 11:16:05 +0000 Subject: [PATCH 19/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 7e62735..57ffc4a 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.10 -Release: 8%{?dist} +Release: 9%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -191,6 +191,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jan 25 2024 Fedora Release Engineering - 2.1.10-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 2.1.10-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 68df51a565184a85a98228483741d5370b9b5dd7 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 8 Feb 2024 13:58:17 +0200 Subject: [PATCH 20/26] Upstream release 2.1.14rc1 Fix GCC14 incompatibilities Resolves: rhbz#2261421 Signed-off-by: Alexander Bokovoy --- .gitignore | 2 ++ opendnssec-2.1.14rc1-gcc14.patch | 34 ++++++++++++++++++++++++++++++++ opendnssec-c99-1.patch | 18 ----------------- opendnssec.spec | 25 ++++++++++++++--------- sources | 4 ++-- 5 files changed, 54 insertions(+), 29 deletions(-) create mode 100644 opendnssec-2.1.14rc1-gcc14.patch delete mode 100644 opendnssec-c99-1.patch diff --git a/.gitignore b/.gitignore index ecd9c4f..1c99c24 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /opendnssec-2.1.9.tar.gz.sig /opendnssec-2.1.10.tar.gz.sig /opendnssec-2.1.10.tar.gz +/opendnssec-2.1.14rc1.tar.gz +/opendnssec-2.1.14rc1.tar.gz.sig diff --git a/opendnssec-2.1.14rc1-gcc14.patch b/opendnssec-2.1.14rc1-gcc14.patch new file mode 100644 index 0000000..51b8095 --- /dev/null +++ b/opendnssec-2.1.14rc1-gcc14.patch @@ -0,0 +1,34 @@ +From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Thu, 8 Feb 2024 13:10:53 +0200 +Subject: [PATCH] Fix missing include +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +scheduler/task.c: In function ‘task_perform’: +scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration] + 137 | task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF); + | ^~~~~ +make[2]: *** [Makefile:600: scheduler/task.o] Error 1 + +Signed-off-by: Alexander Bokovoy +--- + common/scheduler/task.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/common/scheduler/task.c b/common/scheduler/task.c +index 4dcf9e900..0dfa496a2 100644 +--- a/common/scheduler/task.c ++++ b/common/scheduler/task.c +@@ -40,6 +40,7 @@ + #include "duration.h" + #include "file.h" + #include "log.h" ++#include "utilities.h" + + static const char* task_str = "task"; + static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER; +-- +2.43.0 + diff --git a/opendnssec-c99-1.patch b/opendnssec-c99-1.patch deleted file mode 100644 index 531a73f..0000000 --- a/opendnssec-c99-1.patch +++ /dev/null @@ -1,18 +0,0 @@ -commit 27290c5fcd065a5a857d37236e7f79121e303d0a -Author: Mathieu Mirmont -Date: Sun Dec 1 18:43:53 2019 +0100 - - common: add missing util.h header - -diff --git a/common/scheduler/task.c b/common/scheduler/task.c -index cfdbd2d101aae795..9c09dc1893363abe 100644 ---- a/common/scheduler/task.c -+++ b/common/scheduler/task.c -@@ -39,6 +39,7 @@ - #include "status.h" - #include "duration.h" - #include "file.h" -+#include "util.h" - #include "log.h" - - static const char* task_str = "task"; diff --git a/opendnssec.spec b/opendnssec.spec index 57ffc4a..70a2ae1 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,13 +1,14 @@ -#global prever rcX +%global prever rc1 %global _hardened_build 1 Summary: DNSSEC key and zone management software Name: opendnssec -Version: 2.1.10 -Release: 9%{?dist} +Version: 2.1.14 +Release: 0.1rc1%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz +Source10: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig Source1: ods-enforcerd.service Source2: ods-signerd.service Source3: ods.sysconfig @@ -18,7 +19,7 @@ Source7: opendnssec-2.1.sqlite_convert.sql Source8: opendnssec-2.1.sqlite_rpmversion.sql Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch Patch2: opendnssec-configure-c99.patch -Patch3: opendnssec-c99-1.patch +Patch3: opendnssec-2.1.14rc1-gcc14.patch Patch4: opendnssec-c99-2.patch Patch5: opendnssec-implicit-declarations.patch @@ -50,11 +51,12 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 +%patch -P1 -p1 +%patch -P2 -p1 +%patch -P3 -p1 +%patch -P4 -p1 %patch -P5 -p1 + # Prevent re-running autoconf. touch -r aclocal.m4 configure* m4/* @@ -67,7 +69,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -W export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security" %if 0%{?prever:1} # for development snapshots -sh ./autogen.sh +autoreconf %endif %configure --with-ldns=%{_libdir} %make_build @@ -191,6 +193,11 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Feb 08 2024 Alexander Bokovoy - 2.1.14-0.1rc1 +- Upstream release 2.1.14RC1 +- Fix build with gcc 14 +- Resolves: rhbz#2261421 + * Thu Jan 25 2024 Fedora Release Engineering - 2.1.10-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 51ddc35..71692d1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (opendnssec-2.1.10.tar.gz.sig) = edae30f551465a70a8c9476dc91e079d36a0fa2cf84e1973cbcce6ee2c6a2eba4a773deb9f18fe6787189ce7d3ae7a2c948dee0a6f6cf2f59b745d5cbe68d7b8 -SHA512 (opendnssec-2.1.10.tar.gz) = c7fdbf1c3867d7b53ac11ab5cb5e636af4595dbee8d704429c7fb84cc3a6b2082ed490c33aad7747d4ee1a2c580afcf24a260bc3ed29eaf5e9d337004045b82d +SHA512 (opendnssec-2.1.14rc1.tar.gz) = 82e86f1146e889328ac702ced686d01ddc4afb05450e03198d32a70409fcca702c59fdcebf93b35458ba9a9f5d34d8cd038291f9de8341a8d42947c271e3ac9e +SHA512 (opendnssec-2.1.14rc1.tar.gz.sig) = 205dfe315e72d1055df713f6c25b9dda3d233dab23d17e6bc7b4e942365560ad2da822cfad48b6cdd401eeb33a61817e261b35f0d5da03281b4de7479331fb99 From 14dfcf91409e5ec9c58e184835b1b68dee4cbc39 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 8 Feb 2024 14:19:10 +0200 Subject: [PATCH 21/26] Do not require java outside of supported Java architectures When building pre-releases, RelaxNG needs java but Fedora does not ship one on i686: https://fedoraproject.org/wiki/Changes/Drop_i686_JDKs Signed-off-by: Alexander Bokovoy --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 70a2ae1..66c54d7 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -41,7 +41,10 @@ Requires(preun): systemd-units Requires(postun): systemd-units %if 0%{?prever:1} # For building development snapshots -Buildrequires: autoconf, automake, libtool, java +Buildrequires: autoconf, automake, libtool +%ifarch %{java_arches} +Buildrequires: java +%endif %endif %description From 3c897d39f1f9c482f42ad6c3f619377a5780f20b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 20:50:20 +0000 Subject: [PATCH 22/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 66c54d7..67917bd 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.14 -Release: 0.1rc1%{?dist} +Release: 0.2rc1%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -196,6 +196,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 2.1.14-0.2rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Thu Feb 08 2024 Alexander Bokovoy - 2.1.14-0.1rc1 - Upstream release 2.1.14RC1 - Fix build with gcc 14 From 566d4cae15c90b0073101ade210925d4226832a8 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 22 Oct 2024 13:39:46 +0100 Subject: [PATCH 23/26] Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) --- opendnssec.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 67917bd..ee53473 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.14 -Release: 0.2rc1%{?dist} +Release: 0.3rc1%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -196,6 +196,10 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Tue Oct 22 2024 Richard W.M. Jones - 2.1.14-0.3rc1 +- Rebuild for Jansson 2.14 + (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) + * Thu Jul 18 2024 Fedora Release Engineering - 2.1.14-0.2rc1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From e0e84268d9a542adcfbe0c5e31f282f62eebd886 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 21:39:28 +0000 Subject: [PATCH 24/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index ee53473..363399e 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -4,7 +4,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.14 -Release: 0.3rc1%{?dist} +Release: 0.4rc1%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -196,6 +196,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 2.1.14-0.4rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Oct 22 2024 Richard W.M. Jones - 2.1.14-0.3rc1 - Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) From fbf6915b0d7a9bd06e6b95029495e13b9661f817 Mon Sep 17 00:00:00 2001 From: Rafael Guterres Jeffman Date: Tue, 21 Jan 2025 15:13:53 -0300 Subject: [PATCH 25/26] Rebase to stable version 2.1.14 and use systemd-users for ods user Signed-off-by: Rafael Guterres Jeffman --- .gitignore | 2 ++ opendnssec-sysusers.conf | 1 + opendnssec.spec | 21 ++++++++++++--------- sources | 4 ++-- 4 files changed, 17 insertions(+), 11 deletions(-) create mode 100644 opendnssec-sysusers.conf diff --git a/.gitignore b/.gitignore index 1c99c24..105f0cf 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,5 @@ /opendnssec-2.1.10.tar.gz /opendnssec-2.1.14rc1.tar.gz /opendnssec-2.1.14rc1.tar.gz.sig +/opendnssec-2.1.14.tar.gz +/opendnssec-2.1.14.tar.gz.sig diff --git a/opendnssec-sysusers.conf b/opendnssec-sysusers.conf new file mode 100644 index 0000000..b47c25f --- /dev/null +++ b/opendnssec-sysusers.conf @@ -0,0 +1 @@ +u ods - "opendnssec daemon account" diff --git a/opendnssec.spec b/opendnssec.spec index 363399e..59c9f47 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -1,14 +1,13 @@ -%global prever rc1 %global _hardened_build 1 Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.14 -Release: 0.4rc1%{?dist} +Release: 1%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ -Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz -Source10: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig +Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz +Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig Source1: ods-enforcerd.service Source2: ods-signerd.service Source3: ods.sysconfig @@ -17,6 +16,7 @@ Source5: tmpfiles-opendnssec.conf Source6: opendnssec.cron Source7: opendnssec-2.1.sqlite_convert.sql Source8: opendnssec-2.1.sqlite_rpmversion.sql +Source9: %{name}-sysusers.conf Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch Patch2: opendnssec-configure-c99.patch Patch3: opendnssec-2.1.14rc1-gcc14.patch @@ -94,6 +94,7 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ +install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf mkdir -p %{buildroot}%{_tmpfilesdir}/ install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec @@ -131,13 +132,11 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert %{_bindir}/* %attr(0755,root,root) %dir %{_datadir}/opendnssec %{_datadir}/opendnssec/* +%{_sysusersdir}/%{name}.conf %pre -getent group ods >/dev/null || groupadd -r ods -getent passwd ods >/dev/null || \ -useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ --c "opendnssec daemon account" ods -exit 0 + +%sysusers_create_package %{name} %{SOURCE9} %post # Initialise a slot on the softhsm on first install @@ -196,6 +195,10 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Tue Jan 21 2025 Rafel Jeffman - 2.1.14-1 +- Upstream release 2.1.14 +- Use systemd-sysusers + * Fri Jan 17 2025 Fedora Release Engineering - 2.1.14-0.4rc1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 71692d1..1f2ad74 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (opendnssec-2.1.14rc1.tar.gz) = 82e86f1146e889328ac702ced686d01ddc4afb05450e03198d32a70409fcca702c59fdcebf93b35458ba9a9f5d34d8cd038291f9de8341a8d42947c271e3ac9e -SHA512 (opendnssec-2.1.14rc1.tar.gz.sig) = 205dfe315e72d1055df713f6c25b9dda3d233dab23d17e6bc7b4e942365560ad2da822cfad48b6cdd401eeb33a61817e261b35f0d5da03281b4de7479331fb99 +SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620 +SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f From dc2d8a5cfcb296d2d6db9be7d549886d11867bfa Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 23:34:57 +0000 Subject: [PATCH 26/26] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- opendnssec.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/opendnssec.spec b/opendnssec.spec index 59c9f47..f11d67a 100644 --- a/opendnssec.spec +++ b/opendnssec.spec @@ -3,7 +3,7 @@ Summary: DNSSEC key and zone management software Name: opendnssec Version: 2.1.14 -Release: 1%{?dist} +Release: 2%{?dist} License: BSD-2-Clause Url: http://www.opendnssec.org/ Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz @@ -195,6 +195,9 @@ ods-enforcer update all >/dev/null 2>/dev/null ||: %systemd_postun_with_restart ods-signerd.service %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 2.1.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Jan 21 2025 Rafel Jeffman - 2.1.14-1 - Upstream release 2.1.14 - Use systemd-sysusers