add note on why this cannot be built - ldns is too old

- Update to 1.4.14 as first steop to migrating to 2.x

.gitignore

@@ -1,5 +1,3 @@
-/opendnssec-1.4.0a1.tar.gz
-/opendnssec-1.4.0a2.tar.gz
 /opendnssec-1.4.0b1.tar.gz
 /opendnssec-1.4.0b2.tar.gz
 /opendnssec-1.4.0rc1.tar.gz
@@ -7,7 +5,6 @@
 /opendnssec-1.4.0rc3.tar.gz
 /opendnssec-1.4.0.tar.gz
 /opendnssec-1.4.1.tar.gz
-/opendnssec-1.4.2.tar.gz
 /opendnssec-1.4.3.tar.gz
 /opendnssec-1.4.4.tar.gz
 /opendnssec-1.4.5.tar.gz
@@ -15,14 +12,3 @@
 /opendnssec-1.4.7.tar.gz
 /opendnssec-1.4.9.tar.gz
 /opendnssec-1.4.14.tar.gz
-/opendnssec-2.1.6.tar.gz
-/opendnssec-2.1.7.tar.gz
-/opendnssec-2.1.8.tar.gz
-/opendnssec-2.1.9.tar.gz
-/opendnssec-2.1.9.tar.gz.sig
-/opendnssec-2.1.10.tar.gz.sig
-/opendnssec-2.1.10.tar.gz
-/opendnssec-2.1.14rc1.tar.gz
-/opendnssec-2.1.14rc1.tar.gz.sig
-/opendnssec-2.1.14.tar.gz
-/opendnssec-2.1.14.tar.gz.sig

0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch

@@ -1,35 +0,0 @@
-From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Mon, 30 Jan 2023 11:44:49 +0200
-Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle
- string fortification
-
-When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc
-will cut few bytes off the string buffer for prevention of buffer
-overruns. As a result, hsm_hex_unparse() will call into snprintf() with
-a buffer length bigger than the size of the buffer as seen by the
-GCC/glibc pair.
-
-See also: https://pagure.io/freeipa/issue/9312
-
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
----
- libhsm/src/lib/libhsm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c
-index 88dc79e31..8f1e0c3bc 100644
---- a/libhsm/src/lib/libhsm.c
-+++ b/libhsm/src/lib/libhsm.c
-@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len)
-     size_t i;
- 
-     for (i = 0; i < len; i++) {
--        snprintf(dst + (2*i), dst_len, "%02x", src[i]);
-+        snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]);
-     }
-     dst[len*2] = '\0';
- }
--- 
-2.39.0
-

conf.xml

@@ -48,6 +48,7 @@
 		</Privileges>
 
 		<Datastore><SQLite>/var/opendnssec/kasp.db</SQLite></Datastore>
+		<Interval>PT3600S</Interval>
 		<!-- <ManualKeyGeneration/> -->
 		<!-- <RolloverNotification>P14D</RolloverNotification> -->
 		

kasp.xml

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  
+  NOTE:  The default policy below is a TEMPLATE ONLY and should be reviewed
+         before used in any production environment. The administrator should
+         consult the OpenDNSSEC documentation before changing any parameters.
+         
+         If you can read this message, it is likely that this file has not
+         been reviewed nor updated.
+
+  -->
+
+<KASP>
+
+	<Policy name="default">
+		<Description>A default policy that will amaze you and your friends</Description>
+		<Signatures>
+			<Resign>PT2H</Resign>
+			<Refresh>P3D</Refresh>
+			<Validity>
+				<Default>P7D</Default>
+				<Denial>P7D</Denial>
+			</Validity>
+			<Jitter>PT12H</Jitter>
+			<!-- two hours to avoid daylight saving disasters -->
+			<InceptionOffset>PT7200S</InceptionOffset>
+		</Signatures>
+
+		<Denial>
+			<NSEC3>
+				<!-- <OptOut/> -->
+				<Resalt>P100D</Resalt>
+				<Hash>
+					<Algorithm>1</Algorithm>
+					<Iterations>5</Iterations>
+					<Salt length="8"/>
+				</Hash>
+			</NSEC3>
+		</Denial>
+
+		<Keys>
+			<!-- Parameters for both KSK and ZSK -->
+			<TTL>PT3600S</TTL>
+			<RetireSafety>PT3600S</RetireSafety>
+			<PublishSafety>PT3600S</PublishSafety>
+			<!-- <ShareKeys/> -->
+			<Purge>P14D</Purge>
+
+			<!-- Parameters for KSK only -->
+			<KSK>
+				<Algorithm length="2048">8</Algorithm>
+				<Lifetime>P1Y</Lifetime>
+				<Repository>AEP</Repository>
+			</KSK>
+
+			<!-- Parameters for ZSK only -->
+			<ZSK>
+				<Algorithm length="1024">8</Algorithm>
+				<Lifetime>P30D</Lifetime>
+				<Repository>AEP</Repository>
+				<!-- <ManualRollover/> -->
+			</ZSK>
+		</Keys>
+
+		<Zone>
+			<PropagationDelay>PT43200S</PropagationDelay>
+			<SOA>
+				<TTL>PT3600S</TTL>
+				<Minimum>PT3600S</Minimum>
+				<Serial>unixtime</Serial>
+			</SOA>
+		</Zone>
+
+		<Parent>
+			<PropagationDelay>PT9999S</PropagationDelay>
+			<DS>
+				<TTL>PT3600S</TTL>
+			</DS>
+			<SOA>
+				<TTL>PT172800S</TTL>
+				<Minimum>PT10800S</Minimum>
+			</SOA>
+		</Parent>
+
+
+	</Policy>
+</KASP>

ods-enforcerd.service

@@ -1,16 +0,0 @@
-[Unit]
-Description=OpenDNSSEC Enforcer daemon
-After=syslog.target network.target
-
-[Service]
-Type=forking
-User=ods
-Group=ods
-PIDFile=/run/opendnssec/enforcerd.pid
-EnvironmentFile=-/etc/sysconfig/ods
-ExecStart=/usr/sbin/ods-enforcerd $ODS_ENFORCERD_OPT
-ExecStartPost=/bin/bash -c 'while [ ! -S /run/opendnssec/enforcer.sock ]; do sleep 1; echo "Waiting for socket"; done'
-TimeoutStartSec=20
-
-[Install]
-WantedBy=multi-user.target

ods-signerd.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=OpenDNSSEC signer daemon
-After=syslog.target network.target ods-enforcerd.service
-
-[Service]
-Type=simple
-User=ods
-Group=ods
-PIDFile=/run/opendnssec/signerd.pid
-EnvironmentFile=-/etc/sysconfig/ods
-ExecStart=/usr/sbin/ods-signerd -d $ODS_SIGNERD_OPT
-
-[Install]
-WantedBy=multi-user.target

opendnssec-1.4.0b1-nonempty-terminals.patch

@@ -0,0 +1,54 @@
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c	2012-11-23 11:17:00.752148535 -0500
++++ opendnssec-1.4.0b1/signer/src/signer/domain.c	2012-11-23 11:23:00.243158628 -0500
+@@ -399,6 +399,7 @@
+ {
+     ldns_rbnode_t* n = LDNS_RBTREE_NULL;
+     domain_type* d = NULL;
++    int unsigned_delegpt = 1;
+ 
+     ods_log_assert(domain);
+     if (domain->rrsets) {
+@@ -411,20 +412,15 @@
+             break;
+         }
+         if (d->rrsets) {
+-            if (domain_is_delegpt(d) == LDNS_RR_TYPE_NS) {
+-                /* domain has unsigned delegation */
+-                return 1;
+-            } else {
+-                /* domain has authoritative data or signed delegation */
++	if (domain_is_delegpt(d) != LDNS_RR_TYPE_NS) {
++		/* domain has signed delegation/auth */
+                 return 0;
+             }
+         }
+         /* maybe there is data at the next domain */
+         n = ldns_rbtree_next(n);
+     }
+-    ods_log_warning("[%s] encountered empty terminal that is treated as "
+-        "non-terminal", dname_str);
+-    return 0;
++    return unsigned_delegpt;
+ }
+ 
+ 
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c opendnssec-1.4.0b1/signer/src/signer/namedb.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c	2012-08-28 09:43:15.000000000 -0400
++++ opendnssec-1.4.0b1/signer/src/signer/namedb.c	2012-11-23 11:23:39.420172841 -0500
+@@ -788,13 +788,13 @@
+     if (!db || !db->domains) {
+         return;
+     }
+-    node = ldns_rbtree_first(db->domains);
++    node = ldns_rbtree_last(db->domains);
+     if (!node || node == LDNS_RBTREE_NULL) {
+         return;
+     }
+     while (node && node != LDNS_RBTREE_NULL) {
+         domain = (domain_type*) node->data;
+-        node = ldns_rbtree_next(node);
++        node = ldns_rbtree_previous(node);
+         domain_diff(domain, is_ixfr);
+         domain = namedb_del_denial_trigger(db, domain, 0);
+         if (domain) {

opendnssec-1.4.0b1-r6816.patch

@@ -0,0 +1,62 @@
+Index: OpenDNSSEC/enforcer/enforcerd/enforcer.c
+===================================================================
+--- OpenDNSSEC/enforcer/enforcerd/enforcer.c	(revision 6815)
++++ OpenDNSSEC/enforcer/enforcerd/enforcer.c	(revision 6816)
+@@ -1293,7 +1293,7 @@
+                 {
+                     int NewDS;
+                     status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS);
+-                    if (status2 != 0) {
++                    if (status2 == 0) {
+                         /* If the DS set changed then log/do something about it */
+                         if (NewDS == 1) {
+                             log_msg(config, LOG_INFO, "DSChanged");
+@@ -1655,8 +1655,11 @@
+         if (system(signer_command))
+         {
+             log_msg(NULL, LOG_ERR, "Could not call signer engine to update all zones");
+-            log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update --all' to manually update all zones");
++            log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update all zones", signer_command);
+         }
++        else {
++            log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command);
++        }
+ 
+         StrFree(signer_command);
+     } else {
+@@ -1693,8 +1696,8 @@
+                                round potentially different behaviour of rename over existing
+                                file.) */
+     int     gencnt;         /* Number of keys in generate state */
++    char *signer_command;   /* how we will call the signer */
+ #ifndef ENFORCER_USE_WORKERS
+-    char *signer_command;   /* how we will call the signer */
+     int     NewDS = 0;      /* Did we change the DS Set in any way? */
+ #endif
+     char*   datetime = DtParseDateTimeString("now");
+@@ -1954,7 +1957,6 @@
+             return -1;
+         }
+ 
+-#ifndef ENFORCER_USE_WORKERS
+         if (*signer_flag == 1) {
+             /* call the signer engine to tell it that something changed */
+             /* TODO for beta version connect straight to the socket
+@@ -1970,13 +1972,15 @@
+             if (status != 0)
+             {
+                 log_msg(NULL, LOG_ERR, "Could not call signer engine");
+-                log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update' to manually update zones");
++                log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update the zone", signer_command);
+                 *signer_flag = 0;
+             }
++            else {
++                log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command);
++            }
+ 
+             StrFree(signer_command);
+         }
+-#endif
+     }
+     else {
+         log_msg(NULL, LOG_INFO, "No change to: %s", current_filename);

opendnssec-1.4.0b1-r6817.patch

@@ -0,0 +1,48 @@
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c opendnssec-1.4.0b1/signer/src/signer/rrset.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c	2012-08-28 10:00:54.000000000 -0400
++++ opendnssec-1.4.0b1/signer/src/signer/rrset.c	2012-11-10 17:16:44.250226281 -0500
+@@ -32,6 +32,7 @@
+  */
+ 
+ #include "config.h"
++#include "shared/file.h"
+ #include "shared/hsm.h"
+ #include "shared/log.h"
+ #include "shared/util.h"
+@@ -557,6 +558,26 @@
+ 
+ 
+ /**
++ * Is the RRset signed with this locator?
++ *
++ */
++static int
++rrset_siglocator(rrset_type* rrset, const char* locator)
++{
++    size_t i = 0;
++    if (!rrset) {
++        return 0;
++    }
++    for (i=0; i < rrset->rrsig_count; i++) {
++        if (!ods_strcmp(locator, rrset->rrsigs[i].key_locator)) {
++            return 1;
++        }
++    }
++    return 0;
++}
++
++
++/**
+  * Transmogrify the RRset to a RRlist.
+  *
+  */
+@@ -702,6 +723,9 @@
+             continue;
+         }
+         /* Additional rules for signatures */
++        if (rrset_siglocator(rrset, zone->signconf->keys->keys[i].locator)) {
++            continue;
++        }
+         if (rrset_sigalgo(rrset, zone->signconf->keys->keys[i].algorithm)) {
+             continue;
+         }

opendnssec-1.4.13-openssl1.1.patch

@@ -1,95 +0,0 @@
-From e2bbb899195ea98b6b5f6c972ab764a53b387789 Mon Sep 17 00:00:00 2001
-From: Yuri Schaeffer <yuri@nlnetlabs.nl>
-Date: Fri, 4 Nov 2016 15:35:06 +0100
-Subject: [PATCH] HMAC_CTX_init deprecated in openssl-1.1.0
-
----
- m4/acx_ssl.m4                  | 12 +++++++++---
- signer/src/Makefile.am         |  4 ++--
- signer/src/wire/tsig-openssl.c | 15 ++++++++++++---
- 3 files changed, 23 insertions(+), 8 deletions(-)
-
-diff --git a/m4/acx_ssl.m4 b/m4/acx_ssl.m4
-index 1dc6e40..3d64626 100644
---- a/m4/acx_ssl.m4
-+++ b/m4/acx_ssl.m4
-@@ -35,12 +35,18 @@ AC_DEFUN([ACX_SSL], [
-             if test x_$ssldir = x_/usr/sfw; then
-                 SSL_LIBS="$SSL_LIBS -R$ssldir/lib";
-             fi
--            AC_CHECK_LIB(crypto, HMAC_CTX_init,, [
--                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
--            ])
-+            AC_CHECK_LIB(crypto, HMAC_CTX_reset, [
-+                    AC_DEFINE_UNQUOTED([HAVE_SSL_NEW_HMAC], [], [Define if you have the SSL libraries with new HMAC related functions.])
-+                    SSL_LIBS="$SSL_LIBS -lcrypto";
-+            ], [
-+                    AC_CHECK_LIB(crypto, HMAC_CTX_init,, [
-+                            AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
-+                    ])
-+            ] )
-             AC_CHECK_FUNCS([EVP_sha1 EVP_sha256])
-         fi
-         AC_SUBST(HAVE_SSL)
-+        AC_SUBST(HAVE_SSL_NEW_HMAC)
-         AC_SUBST(SSL_INCLUDES)
-         AC_SUBST(SSL_LIBS)
-     fi
-diff --git a/signer/src/Makefile.am b/signer/src/Makefile.am
-index 60e8877..b39eac8 100644
---- a/signer/src/Makefile.am
-+++ b/signer/src/Makefile.am
-@@ -133,7 +133,7 @@ ods_signer_SOURCES=		ods-signer.c \
- 				wire/xfrd.c wire/xfrd.h
- 
- ods_signer_LDADD=		$(LIBHSM)
--ods_signer_LDADD+=		@LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@
-+ods_signer_LDADD+=		@LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@ @SSL_LIBS@ 
- ods_signer_LDADD+=		$(LIBCOMPAT)
- 
- ods_getconf_SOURCES=		ods-getconf.c \
-@@ -193,5 +193,5 @@ ods_getconf_SOURCES=		ods-getconf.c \
- 				wire/xfrd.c wire/xfrd.h
- 
- ods_getconf_LDADD=		$(LIBHSM)
--ods_getconf_LDADD+=		@LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@
-+ods_getconf_LDADD+=		@SSL_LIBS@ @LDNS_LIBS@ @XML2_LIBS@ @RT_LIBS@
- ods_getconf_LDADD+=		$(LIBCOMPAT)
-diff --git a/signer/src/wire/tsig-openssl.c b/signer/src/wire/tsig-openssl.c
-index c26b1e7..24fd342 100644
---- a/signer/src/wire/tsig-openssl.c
-+++ b/signer/src/wire/tsig-openssl.c
-@@ -131,8 +131,11 @@ static void
- cleanup_context(void *data)
- {
-     HMAC_CTX* context = (HMAC_CTX*) data;
-+#ifdef HAVE_SSL_NEW_HMAC
-+    HMAC_CTX_free(context);
-+#else
-     HMAC_CTX_cleanup(context);
--    return;
-+#endif
- }
- 
- static void
-@@ -155,9 +158,15 @@ context_add_cleanup(void* context)
- static void*
- create_context(allocator_type* allocator)
- {
--    HMAC_CTX* context = (HMAC_CTX*) allocator_alloc(allocator,
--        sizeof(HMAC_CTX));
-+    HMAC_CTX* context;
-+#ifdef HAVE_SSL_NEW_HMAC
-+    context = HMAC_CTX_new();
-+    if (!context) return NULL;
-+    HMAC_CTX_reset(context);
-+#else
-+    context = (HMAC_CTX*) allocator_alloc(allocator, sizeof(HMAC_CTX));
-     HMAC_CTX_init(context);
-+#endif
-     context_add_cleanup(context);
-     return context;
- }
--- 
-2.9.3
-

opendnssec-1.4.6-extract.patch

@@ -1,168 +0,0 @@
-commit 672d2c75ccd3cd5f2317bb76af4c9cc4e5aa4a37
-Author: Petr Spacek <pspacek@redhat.com>
-Date:   Fri Jul 18 16:19:36 2014 +0200
-
-    add libhsm configuration option <AllowExtraction/>
-    
-    This option allows user to generate private keys with CKA_EXTRACTABLE
-    flag set to TRUE. Defaults to FALSE.
-
-diff --git a/NEWS b/NEWS
-index 4db7038..2efa176 100644
---- a/NEWS
-+++ b/NEWS
-@@ -1,3 +1,8 @@
-+* Enforcer: New repository option <AllowExtraction/> allows to generate keys
-+  with CKA_EXTRACTABLE attribute set to TRUE so keys can be wrapped
-+  and extracted from HSM.
-+
-+
- OpenDNSSEC 1.4.6 - 2014-07-21
- 
- * Signer Engine: Print secondary server address when logging notify reply
-diff --git a/conf/conf.rnc b/conf/conf.rnc
-index 71d527f..65f837e 100644
---- a/conf/conf.rnc
-+++ b/conf/conf.rnc
-@@ -50,7 +50,10 @@ start = element Configuration {
- 			element RequireBackup { empty }?,
- 
- 			# Do not maintain public keys in the repository (optional)
--			element SkipPublicKey { empty }?
-+			element SkipPublicKey { empty }?,
-+
-+			# Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional)
-+			element AllowExtraction { empty }?
- 		}*
- 	},
- 
-diff --git a/conf/conf.xml.in b/conf/conf.xml.in
-index 0ef2ab9..0536681 100644
---- a/conf/conf.xml.in
-+++ b/conf/conf.xml.in
-@@ -9,6 +9,9 @@
- 			<TokenLabel>OpenDNSSEC</TokenLabel>
- 			<PIN>1234</PIN>
- 			<SkipPublicKey/>
-+			<!--
-+			<AllowExtraction/>
-+			-->
- 		</Repository>
- 
- <!--
-diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c
-index d723b31..1f9720e 100644
---- a/libhsm/src/lib/libhsm.c
-+++ b/libhsm/src/lib/libhsm.c
-@@ -504,6 +504,7 @@ static void
- hsm_config_default(hsm_config_t *config)
- {
-     config->use_pubkey = 1;
-+    config->allow_extract = 0;
- }
- 
- /* creates a session_t structure, and automatically adds and initializes
-@@ -2054,6 +2055,8 @@ hsm_open(const char *config,
-                     module_pin = (char *) xmlNodeGetContent(curNode);
-                 if (xmlStrEqual(curNode->name, (const xmlChar *)"SkipPublicKey"))
-                     module_config.use_pubkey = 0;
-+                if (xmlStrEqual(curNode->name, (const xmlChar *)"AllowExtraction"))
-+                    module_config.allow_extract = 1;
-                 curNode = curNode->next;
-             }
- 
-@@ -2341,10 +2344,12 @@ hsm_generate_rsa_key(hsm_ctx_t *ctx,
-     CK_BBOOL ctrue = CK_TRUE;
-     CK_BBOOL cfalse = CK_FALSE;
-     CK_BBOOL ctoken = CK_TRUE;
-+    CK_BBOOL cextractable = CK_FALSE;
- 
-     if (!ctx) ctx = _hsm_ctx;
-     session = hsm_find_repository_session(ctx, repository);
-     if (!session) return NULL;
-+    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;
- 
-     /* check whether this key doesn't happen to exist already */
-     do {
-@@ -2380,7 +2385,7 @@ hsm_generate_rsa_key(hsm_ctx_t *ctx,
-         { CKA_SENSITIVE,   &ctrue,   sizeof (ctrue) },
-         { CKA_TOKEN,       &ctrue,   sizeof (ctrue)  },
-         { CKA_PRIVATE,     &ctrue,   sizeof (ctrue)  },
--        { CKA_EXTRACTABLE, &cfalse,  sizeof (cfalse) }
-+        { CKA_EXTRACTABLE, &cextractable,  sizeof (cextractable) }
-     };
- 
-     rv = ((CK_FUNCTION_LIST_PTR)session->module->sym)->C_GenerateKeyPair(session->session,
-@@ -2420,6 +2425,7 @@ hsm_generate_dsa_key(hsm_ctx_t *ctx,
-     CK_OBJECT_HANDLE domainPar, publicKey, privateKey;
-     CK_BBOOL ctrue = CK_TRUE;
-     CK_BBOOL cfalse = CK_FALSE;
-+    CK_BBOOL cextractable = CK_FALSE;
- 
-     /* ids we create are 16 bytes of data */
-     unsigned char id[16];
-@@ -2466,12 +2472,13 @@ hsm_generate_dsa_key(hsm_ctx_t *ctx,
-         { CKA_SENSITIVE,           &ctrue,   sizeof(ctrue)   },
-         { CKA_TOKEN,               &ctrue,   sizeof(ctrue)   },
-         { CKA_PRIVATE,             &ctrue,   sizeof(ctrue)   },
--        { CKA_EXTRACTABLE,         &cfalse,  sizeof(cfalse)  }
-+        { CKA_EXTRACTABLE, &cextractable,  sizeof (cextractable) }
-     };
- 
-     if (!ctx) ctx = _hsm_ctx;
-     session = hsm_find_repository_session(ctx, repository);
-     if (!session) return NULL;
-+    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;
- 
-     /* check whether this key doesn't happen to exist already */
- 
-@@ -2533,6 +2540,7 @@ hsm_generate_gost_key(hsm_ctx_t *ctx,
-     CK_OBJECT_HANDLE publicKey, privateKey;
-     CK_BBOOL ctrue = CK_TRUE;
-     CK_BBOOL cfalse = CK_FALSE;
-+    CK_BBOOL cextractable = CK_FALSE;
- 
-     /* ids we create are 16 bytes of data */
-     unsigned char id[16];
-@@ -2569,12 +2577,13 @@ hsm_generate_gost_key(hsm_ctx_t *ctx,
-         { CKA_SENSITIVE,           &ctrue,   sizeof(ctrue)   },
-         { CKA_TOKEN,               &ctrue,   sizeof(ctrue)   },
-         { CKA_PRIVATE,             &ctrue,   sizeof(ctrue)   },
--        { CKA_EXTRACTABLE,         &cfalse,  sizeof(cfalse)  }
-+        { CKA_EXTRACTABLE,         &cextractable,  sizeof (cextractable) }
-     };
- 
-     if (!ctx) ctx = _hsm_ctx;
-     session = hsm_find_repository_session(ctx, repository);
-     if (!session) return NULL;
-+    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;
- 
-     /* check whether this key doesn't happen to exist already */
- 
-diff --git a/libhsm/src/lib/libhsm.h b/libhsm/src/lib/libhsm.h
-index 45d110a..08224b8 100644
---- a/libhsm/src/lib/libhsm.h
-+++ b/libhsm/src/lib/libhsm.h
-@@ -75,6 +75,7 @@
- /*! HSM configuration */
- typedef struct {
-     unsigned int use_pubkey;     /*!< Maintain public keys in HSM */
-+    unsigned int allow_extract;  /*!< Generate CKA_EXTRACTABLE private keys */
- } hsm_config_t;
- 
- /*! Data type to describe an HSM */
---- a/conf/conf.rng
-+++ b/conf/conf.rng
-@@ -71,6 +71,12 @@
-                 <empty/>
-               </element>
-             </optional>
-+            <optional>
-+              <!-- Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional) -->
-+              <element name="AllowExtraction">
-+                <empty/>
-+              </element>
-+            </optional>
-           </element>
-         </zeroOrMore>
-       </element>

opendnssec-2.1.14rc1-gcc14.patch

@@ -1,34 +0,0 @@
-From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Thu, 8 Feb 2024 13:10:53 +0200
-Subject: [PATCH] Fix missing include
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-scheduler/task.c: In function ‘task_perform’:
-scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration]
-  137 |         task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF);
-      |                         ^~~~~
-make[2]: *** [Makefile:600: scheduler/task.o] Error 1
-
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
----
- common/scheduler/task.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/common/scheduler/task.c b/common/scheduler/task.c
-index 4dcf9e900..0dfa496a2 100644
---- a/common/scheduler/task.c
-+++ b/common/scheduler/task.c
-@@ -40,6 +40,7 @@
- #include "duration.h"
- #include "file.h"
- #include "log.h"
-+#include "utilities.h"
- 
- static const char* task_str = "task";
- static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER;
--- 
-2.43.0
-

opendnssec-2.1.sqlite_convert.sql

@@ -1,842 +0,0 @@
-INSERT INTO databaseVersion VALUES (NULL, 1, 1);
-
--- ~ ************
--- ~ ** policy table
--- ~ **
--- ~ **
--- ~ **
--- ~ **
--- ~ ************
-
-INSERT INTO policy 
-SELECT id, 1, name, description,
-0, 0, 0,
-0, 0, 0, 0,
-86400, 0, 0,
-0, 0, 0,
-0, 0, 0,
-0, 0, 0,
-0, 0, 0,
-0, 0, 0,
-0, 0, 0,
-0, 0, 0,
-0
-FROM REMOTE.policies;
-
-UPDATE policy
-SET signaturesResign = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 1
-		AND REMOTE.parameters.name = 'resign');
-
-UPDATE policy
-SET signaturesRefresh = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 1
-		AND REMOTE.parameters.name = 'refresh') ;
-
-UPDATE policy
-SET signaturesJitter = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 1
-		AND REMOTE.parameters.name = 'jitter');
-
-UPDATE policy
-SET signaturesInceptionOffset = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 1
-		AND REMOTE.parameters.name = 'clockskew');
-
-UPDATE policy
-SET signaturesValidityDefault = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 1
-		AND REMOTE.parameters.name = 'valdefault');
-
-UPDATE policy
-SET signaturesValidityDenial = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 1
-		AND REMOTE.parameters.name = 'valdenial');
-
---MaxZoneTTL default 86400
-
--- We need the following mapping 1.4 -> 2.0 for denialType
--- 0 -> 1
--- 3 -> 0
-
-UPDATE policy
-SET denialType = (
-	SELECT (~value)&1
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'version');
-
--- I'm pretty sure this is not the correct way to do it. It is aweful but
--- I can't figure it out how it would work for sqlite.
-UPDATE policy
-SET denialOptout = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'optout')
-WHERE null !=  (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'optout');
-
-UPDATE policy
-SET denialTtl = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'ttl')
-WHERE null != (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'ttl');
-
-UPDATE policy
-SET denialResalt = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'resalt')
-WHERE null != (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'resalt');
-
-UPDATE policy
-SET denialAlgorithm = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'algorithm')
-WHERE null != (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'algorithm');
-
-UPDATE policy
-SET denialIterations = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'iterations')
-WHERE null != (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'iterations');
-
-UPDATE policy
-SET denialSaltLength = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'saltlength')
-WHERE null != (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 2
-		AND REMOTE.parameters.name = 'saltlength');
-
--- clumsy salt update. salt is optional in 1.4 but required in 2.0
--- sqlite is limited in what it can do in an update. I hope there is a
--- better way for this?
-
-UPDATE policy
-SET denialSalt = (
-	SELECT salt
-	FROM  REMOTE.policies
-	WHERE REMOTE.policies.id = policy.id)
-WHERE (
-	SELECT salt
-	FROM  REMOTE.policies
-	WHERE REMOTE.policies.id = policy.id) != null;
-
-UPDATE policy
-SET denialSaltLastChange = (
-	SELECT salt_stamp
-	FROM  REMOTE.policies
-	WHERE REMOTE.policies.id = policy.id)
-WHERE (
-	SELECT salt_stamp
-	FROM  REMOTE.policies
-	WHERE REMOTE.policies.id = policy.id) != null;
-
-UPDATE policy
-SET keysTtl = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 5
-		AND REMOTE.parameters.name = 'ttl');
-
-UPDATE policy
-SET keysRetireSafety = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 5
-		AND REMOTE.parameters.name = 'retiresafety');
-
-UPDATE policy
-SET keysPublishSafety = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 5
-		AND REMOTE.parameters.name = 'publishsafety');
-
-UPDATE policy
-SET keysShared = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 5
-		AND REMOTE.parameters.name = 'zones_share_keys');
-
-UPDATE policy
-SET keysPurgeAfter = COALESCE((
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 5
-		AND REMOTE.parameters.name = 'purge'), 0);
-
-UPDATE policy
-SET zonePropagationDelay = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 7
-		AND REMOTE.parameters.name = 'propagationdelay');
-
-UPDATE policy
-SET zoneSoaTtl = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 7
-		AND REMOTE.parameters.name = 'ttl');
-
-UPDATE policy
-SET zoneSoaMinimum = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 7
-		AND REMOTE.parameters.name = 'min');
-
--- Temporary mapping table between 1.4 and 2.0 SOA serial strategy
-CREATE TABLE mapping (
-	soa14 INTEGER,
-	soa20 INTEGER
-);
-INSERT INTO mapping SELECT  1, 2;
-INSERT INTO mapping SELECT  2, 0;
-INSERT INTO mapping SELECT  3, 1;
-INSERT INTO mapping SELECT  4, 3;
-
-UPDATE policy
-SET zoneSoaSerial = (
-	SELECT mapping.soa20
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-        INNER JOIN mapping
-        ON REMOTE.parameters_policies.value = mapping.soa14
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 7
-		AND REMOTE.parameters.name = 'serial');
-
-DROP TABLE mapping;
-
--- parentRegistrationDelay = 0 on 1.4
-
-UPDATE policy
-SET parentPropagationDelay = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 8
-		AND REMOTE.parameters.name = 'propagationdelay');
-
-UPDATE policy
-SET parentDsTtl = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 8
-		AND REMOTE.parameters.name = 'ttlds');
-
-UPDATE policy
-SET parentSoaTtl = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 8
-		AND REMOTE.parameters.name = 'ttl');
-
-UPDATE policy
-SET parentSoaMinimum = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id 
-	WHERE REMOTE.parameters_policies.policy_id = policy.id 
-		AND REMOTE.parameters.category_id = 8
-		AND REMOTE.parameters.name = 'min');
-
--- passthrough = 0
-
--- ~ ************
--- ~ ** policyKey table
--- ~ **
--- ~ ** For each policy in 1.4 add two keys: KSK and ZSK
--- ~ **
--- ~ **
--- ~ ************
-
--- Insert each KSK
-INSERT INTO policyKey
-SELECT null, 1, id,
-		1, 0, 0,
-		0, 0, 0,
-		0, 0, 4
-FROM REMOTE.policies;
-
--- Insert each ZSK
-INSERT INTO policyKey
-SELECT null, 1, id,
-		2, 0, 0,
-		0, 0, 0,
-		0, 0, 1
-FROM REMOTE.policies;
-
-UPDATE policyKey
-SET algorithm = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 3
-		AND REMOTE.parameters.name = 'algorithm')
-WHERE policyKey.role = 1;
-
-UPDATE policyKey
-SET algorithm = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 4
-		AND REMOTE.parameters.name = 'algorithm')
-WHERE policyKey.role = 2;
-
-UPDATE policyKey
-SET bits = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 3
-		AND REMOTE.parameters.name = 'bits')
-WHERE policyKey.role = 1;
-
-UPDATE policyKey
-SET bits = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 4
-		AND REMOTE.parameters.name = 'bits')
-WHERE policyKey.role = 2;
-
-UPDATE policyKey
-SET lifetime = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 3
-		AND REMOTE.parameters.name = 'lifetime')
-WHERE policyKey.role = 1;
-
-UPDATE policyKey
-SET lifetime = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 4
-		AND REMOTE.parameters.name = 'lifetime')
-WHERE policyKey.role = 2;
-
-UPDATE policyKey
-SET repository = (
-	SELECT REMOTE.securitymodules.name
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	INNER JOIN REMOTE.securitymodules
-	ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 3
-		AND REMOTE.parameters.name = 'repository')
-WHERE policyKey.role = 1;
-
-UPDATE policyKey
-SET repository = (
-	SELECT REMOTE.securitymodules.name
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	INNER JOIN REMOTE.securitymodules
-	ON REMOTE.parameters_policies.value = REMOTE.securitymodules.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 4
-		AND REMOTE.parameters.name = 'repository')
-WHERE policyKey.role = 2;
-
-UPDATE policyKey
-SET standby = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 3
-		AND REMOTE.parameters.name = 'standby')
-WHERE policyKey.role = 1;
-
-UPDATE policyKey
-SET standby = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 4
-		AND REMOTE.parameters.name = 'standby')
-WHERE policyKey.role = 2;
-
-UPDATE policyKey
-SET manualRollover = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 3
-		AND REMOTE.parameters.name = 'manual_rollover')
-WHERE policyKey.role = 1;
-
-UPDATE policyKey
-SET manualRollover = (
-	SELECT value
-	FROM  REMOTE.parameters_policies
-	INNER JOIN REMOTE.parameters
-	ON REMOTE.parameters_policies.parameter_id = REMOTE.parameters.id
-	WHERE REMOTE.parameters_policies.policy_id = policyKey.policyId
-		AND REMOTE.parameters.category_id = 4
-		AND REMOTE.parameters.name = 'manual_rollover')
-WHERE policyKey.role = 2;
-
--- rfc5011 = 0. 2.0 has no support
--- minimize already set
-
--- ~ ************
--- ~ ** hsmKey table
--- ~ **
--- ~ ** get from keypairs and dnsseckeys
--- ~ **
--- ~ **
--- ~ ************
-
-INSERT INTO hsmKey
-SELECT DISTINCT REMOTE.keypairs.id, 1, REMOTE.keypairs.policy_id,
-REMOTE.keypairs.HSMkey_id, 2, REMOTE.keypairs.size, 
-REMOTE.keypairs.algorithm,  (~(REMOTE.dnsseckeys.keytype)&1)+1, 
-CASE WHEN REMOTE.keypairs.generate IS NOT NULL THEN 
-	strftime('%s', REMOTE.keypairs.generate) 
-	ELSE strftime("%s", "now") END, 
-0, 
-1, --only RSA supported
- REMOTE.securitymodules.name, 
-0 --assume no backup 
-FROM REMOTE.keypairs
-JOIN REMOTE.dnsseckeys 
-	ON REMOTE.keypairs.id = REMOTE.dnsseckeys.keypair_id
-JOIN REMOTE.securitymodules 
-	ON REMOTE.securitymodules.id = REMOTE.keypairs.securitymodule_id;
-
--- For some policies put the keys in a shared state
-UPDATE hsmKey 
-SET state = 3
-WHERE EXISTS 
-	(SELECT * FROM hsmKey AS h 
-	JOIN policy ON policy.id = h.policyId 
-	WHERE policy.keysShared AND hsmKey.id = h.id);
-
--- ~ ************
--- ~ ** zone table
--- ~ **
--- ~ ** 
--- ~ **
--- ~ **
--- ~ ************
-
-INSERT INTO zone
-SELECT zones.id, 1, zones.policy_id, 
-	zones.name, 1, zones.signconf, 0,  
-	0,0,0, 
-	0,0,0,
-	zones.in_type, zones.input,
-	zones.out_type, zones.output,
-	0,0,0
-	FROM REMOTE.zones;
-
--- ~ ************
--- ~ ** keyData table
--- ~ **
--- ~ ** 
--- ~ **
--- ~ **
--- ~ ************
-
--- Temporary mapping table between 1.4 states and 2.0 ds_at_parent states
--- We are ignoring the fact this may set a DS state for a ZSK; We don't care
-CREATE TABLE mapping (
-	state INTEGER,
-	ds_state INTEGER
-);
-INSERT INTO mapping SELECT  1, 0;
-INSERT INTO mapping SELECT  2, 0;
-INSERT INTO mapping SELECT  3, 1;
-INSERT INTO mapping SELECT  4, 3;
-INSERT INTO mapping SELECT  5, 5;
-INSERT INTO mapping SELECT  6, 5;
-INSERT INTO mapping SELECT  7, 5;
-INSERT INTO mapping SELECT  8, 5;
-INSERT INTO mapping SELECT  9, 5;
-INSERT INTO mapping SELECT 10, 5;
-
-INSERT INTO keyData
-SELECT 
-	NULL, 1, REMOTE.dnsseckeys.zone_id,
-	REMOTE.dnsseckeys.keypair_id, REMOTE.keypairs.algorithm,
-	CASE WHEN REMOTE.dnsseckeys.publish IS NOT NULL THEN 
-		strftime('%s', REMOTE.dnsseckeys.publish) 
-		ELSE strftime("%s", "now") END, 
-	(~REMOTE.dnsseckeys.keytype&1)+1,
-	REMOTE.dnsseckeys.state <= 4, -- introducing
-	0, -- should revoke, not used
-	0, -- standby
-	REMOTE.dnsseckeys.state  = 4 AND REMOTE.dnsseckeys.keytype = 256, --activeZSK: 
-	REMOTE.dnsseckeys.state >= 2 AND REMOTE.dnsseckeys.state <= 5, --publish
-	REMOTE.dnsseckeys.state  = 4 AND REMOTE.dnsseckeys.keytype = 257, --activeKSK: 
-	mapping.ds_state, --dsatparent
-	1<<16, --keytag (crap, will 2.0 regenerate this?)
-	(REMOTE.dnsseckeys.keytype&1)*3+1 --minimize
-FROM REMOTE.dnsseckeys
-JOIN REMOTE.keypairs 
-	ON REMOTE.dnsseckeys.keypair_id = REMOTE.keypairs.id
-JOIN mapping 
-	ON REMOTE.dnsseckeys.state = mapping.state
-WHERE EXISTS(select REMOTE.zones.id FROM REMOTE.zones WHERE REMOTE.zones.id = REMOTE.dnsseckeys.zone_id);
-
--- Everything that is just a ZSK must not have dsatparent set.
-UPDATE keyData
-SET dsatparent = 0
-WHERE role = 2;
-
-DROP TABLE mapping;
-
--- If a active time is set for a ready KSK dsAtParent is submitted 
--- instead of submit
-UPDATE keyData
-SET dsatparent = 2
-WHERE keyData.dsAtParent = 1 AND keyData.id IN (
-	SELECT keyData.id
-	FROM keyData
-	JOIN REMOTE.dnsseckeys
-	ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-	WHERE REMOTE.dnsseckeys.active IS NOT NULL);
-
-
--- ~ ************
--- ~ ** Keystate table
--- ~ **
--- ~ ** 
--- ~ **
--- ~ **
--- ~ ************
-
-CREATE TABLE mapping (
-	state INTEGER,
-	ds INTEGER,
-	dk INTEGER,
-	ks INTEGER,
-	rs INTEGER
-);
-INSERT INTO mapping SELECT  1, 0, 0, 0, 0;
-INSERT INTO mapping SELECT  2, 0, 1, 1, 1;
-INSERT INTO mapping SELECT  3, 0, 2, 2, 1;
-INSERT INTO mapping SELECT  4, 2, 2, 2, 1;
-INSERT INTO mapping SELECT  5, 3, 2, 2, 3;
-INSERT INTO mapping SELECT  6, 0, 3, 3, 0;
-INSERT INTO mapping SELECT  7, 3, 0, 0, 0;
-INSERT INTO mapping SELECT  8, 3, 0, 0, 0;
-INSERT INTO mapping SELECT  9, 3, 0, 0, 0;
-INSERT INTO mapping SELECT 10, 3, 0, 0, 0;
-
--- DS RECORDS
-INSERT INTO keyState
-SELECT NULL, 1, keyData.id, 0, mapping.ds, strftime("%s", "now"), (keyData.minimize>>2)&1, policy.parentDsTtl
-FROM keyData
-JOIN zone
-	ON zone.id = keyData.zoneId
-JOIN policy
-	ON policy.id = zone.policyId
-JOIN REMOTE.dnsseckeys
-	ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-JOIN mapping
-	ON mapping.state = REMOTE.dnsseckeys.state;
-
-UPDATE keyState
-SET state = 1
-WHERE keyState.state = 0 AND keyState.type = 0 AND keyState.id IN (
-	SELECT keyState.id
-	FROM keyState
-	JOIN keyData
-		ON keyData.id = keyState.keydataId
-	JOIN REMOTE.dnsseckeys
-		ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-	WHERE REMOTE.dnsseckeys.active IS NOT NULL);
-
--- DNSKEY RECORDS
-INSERT INTO keyState
-SELECT NULL, 1, keyData.id, 2, mapping.dk, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl
-FROM keyData
-JOIN zone
-	ON zone.id = keyData.zoneId
-JOIN policy
-	ON policy.id = zone.policyId
-JOIN REMOTE.dnsseckeys
-	ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-JOIN mapping
-	ON mapping.state = REMOTE.dnsseckeys.state;
-
--- RRSIG DNSKEY RECORDS
-INSERT INTO keyState
-SELECT NULL, 1, keyData.id, 3, mapping.ks, strftime("%s", "now"), (keyData.minimize>>1)&1, policy.keysTtl
-FROM keyData
-JOIN zone
-	ON zone.id = keyData.zoneId
-JOIN policy
-	ON policy.id = zone.policyId
-JOIN REMOTE.dnsseckeys
-	ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-JOIN mapping
-	ON mapping.state = REMOTE.dnsseckeys.state;
-
--- RRSIG RECORDS
-INSERT INTO keyState
-SELECT NULL, 1, keyData.id, 1, mapping.rs, strftime("%s", "now"), (keyData.minimize>>0)&1, policy.signaturesMaxZoneTtl
-FROM keyData
-JOIN zone
-	ON zone.id = keyData.zoneId
-JOIN policy
-	ON policy.id = zone.policyId
-JOIN REMOTE.dnsseckeys
-	ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-JOIN mapping
-	ON mapping.state = REMOTE.dnsseckeys.state;
-
---Set to OMN if Tactive + Dttl < Tnow
-UPDATE keyState
-SET state = 2
-WHERE keyState.state = 1 AND keyState.type = 1 AND keyState.id IN (
-        SELECT keyState.id
-        FROM keyState
-        JOIN keyData
-                ON keyData.id = keyState.keydataId
-        JOIN REMOTE.dnsseckeys
-                ON REMOTE.dnsseckeys.keypair_id = keyData.hsmkeyid
-        JOIN zone
-                ON keyData.zoneId = zone.id
-        JOIN policy
-                ON policy.id = zone.policyId
-        WHERE CAST(strftime("%s", REMOTE.dnsseckeys.active) + policy.signaturesValidityDefault as INTEGER) < strftime("%s", "now"));
-
---Force the RRSIG state in omnipresent if rumoured and there is no old ZSK
--- unretentive
-UPDATE keyState 
-SET state = 2
-WHERE keyState.id IN (
-SELECT rs.id FROM keyState AS rs 
-JOIN keystate AS dk ON dk.keyDataId == rs.keyDataId
-WHERE rs.type == 1 AND dk.type == 2 AND rs.state == 1 AND dk.state == 2
-AND NOT EXISTS(
-	SELECT* FROM keystate AS rs2
-	JOIN keystate AS dk2 ON dk2.keyDataId == rs2.keyDataId
-	WHERE rs2.type == 1 AND dk2.type == 2 AND rs2.state == 3 AND dk2.state == 2
-));
-
-DROP TABLE mapping;
-
--- We need to create records in the keydependency table in case we are in a
--- rollover. Only done for ZSK. For every introducing ZSK with RRSIG rumoured
--- that has an outroducing ZSK with RRSIG unretentive, we add a record.
-INSERT INTO keyDependency
-SELECT NULL, 0, keyData.zoneID, SUB.IDout, keyData.id, 1
-FROM keyData
-JOIN keyState AS KS1 
-	ON KS1.keyDataId == keyData.id
-JOIN keyState AS KS2 
-	ON KS2.keyDataId == keyData.id
-JOIN (
-	SELECT keyData.id AS IDout, keyData.zoneID 
-	FROM keyData
-	JOIN keyState AS KS1 
-		ON KS1.keyDataId == keyData.id
-	JOIN keyState AS KS2 
-		ON KS2.keyDataId == keyData.id
-	WHERE KS1.type == 2 
-		AND ks1.state = 2 
-		AND KS2.type == 1 
-		AND KS2.state == 3
-		AND keyData.introducing == 0 
-		AND keyData.role == 2
-) AS SUB
-	ON SUB.zoneId == keyData.zoneId
-WHERE 
-	KS1.type == 2 
-	AND ks1.state = 2 
-	AND KS2.type == 1 
-	AND KS2.state == 1
-	AND keyData.introducing == 1 
-	AND keyData.role == 2;
-
--- ZSK
-UPDATE keyState
-SET state = 4
-WHERE (keyState.type = 0 OR keyState.type = 3) AND keyDataId IN (
-	SELECT keyData.id
-	FROM keyData
-	WHERE keyData.role = 2);
-
---KSK
-UPDATE keyState
-SET state = 4
-WHERE keyState.type = 1 AND keyDataId IN (
-	SELECT keyData.id
-	FROM keyData
-	WHERE keyData.role = 1);
-
--- For rpm based systems to see if db was migrated already. store opendnssec major minor version
-CREATE TABLE rpm_migration (
-        major INTEGER,
-        minor INTEGER
-);
-INSERT INTO rpm_migration VALUES(2, 1);
-

opendnssec-2.1.sqlite_rpmversion.sql

@@ -1,7 +0,0 @@
--- For rpm based systems to see if db was migrated already. store opendnssec major minor version
-CREATE TABLE rpm_migration (
-        major INTEGER,
-        minor INTEGER
-);
-INSERT INTO rpm_migration VALUES(2, 1);
-

opendnssec-aggressive-retry.patch

@@ -0,0 +1,15 @@
+diff -Naur opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c opendnssec-1.4.0a3/signer/src/daemon/worker.c
+--- opendnssec-1.4.0a3-orig/signer/src/daemon/worker.c	2012-08-02 16:57:01.000000000 -0400
++++ opendnssec-1.4.0a3/signer/src/daemon/worker.c	2012-08-20 15:41:34.665175565 -0400
+@@ -173,7 +173,11 @@
+          * lets take a small break to not hog CPU.
+          */
+         if (status == ODS_STATUS_UNCHANGED) {
++#if 0
+             worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 60);
++#else
++            worker_wait_timeout_locked(&q->q_lock, &q->q_nonfull, 5);
++#endif
+         }
+         lock_basic_unlock(&q->q_lock);
+     }

opendnssec-c99-2.patch

@@ -1,20 +0,0 @@
-commit 5422819c17c02e6069328b2f5e4bef6fe5c179df
-Author: Mathieu Mirmont <mat@parad0x.org>
-Date:   Sun Dec 1 17:57:36 2019 +0100
-
-    enforcer: remove remove strptime build warning
-
-diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c
-index f1ee21b87529c136..5baef1b6ff7c4cc2 100644
---- a/enforcer/src/daemon/time_leap_cmd.c
-+++ b/enforcer/src/daemon/time_leap_cmd.c
-@@ -26,8 +26,8 @@
-  *
-  */
- 
--#include <getopt.h>
- #include "config.h"
-+#include <getopt.h>
- 
- #include "file.h"
- #include "duration.h"

opendnssec-configure-c99.patch

@@ -1,45 +0,0 @@
-Include <unistd.h> for the setresuid and setresgid functions,
-to avoid an implicit function declaration.
-
-Submitted upstream: <https://github.com/opendnssec/opendnssec/pull/843>
-
-diff --git a/configure b/configure
-index bf515cde3d4fab71..52d2885d6a6ef546 100755
---- a/configure
-+++ b/configure
-@@ -21101,6 +21101,7 @@ else
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
- 
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
-@@ -21143,6 +21144,7 @@ else
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
- 
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
-diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4
-index 374cee0b0b8ef196..467db9170a319170 100644
---- a/m4/acx_broken_setres.m4
-+++ b/m4/acx_broken_setres.m4
-@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[
- 		AC_MSG_CHECKING(if setresuid seems to work)
- 		AC_RUN_IFELSE(
- 			[AC_LANG_SOURCE([[
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
-@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
- 		AC_MSG_CHECKING(if setresgid seems to work)
- 		AC_RUN_IFELSE(
- 			[AC_LANG_SOURCE([[
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}

opendnssec-implicit-declarations.patch

@@ -1,48 +0,0 @@
-From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001
-From: Yaakov Selkowitz <yselkowi@redhat.com>
-Date: Tue, 26 Dec 2023 14:09:12 -0500
-Subject: [PATCH] Fix implicit function declarations
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’
-utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’
-utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’
-utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’
-utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’
-utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’
-utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’
-utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’
----
- enforcer/src/utils/kaspcheck.c | 1 +
- enforcer/src/utils/kc_helper.c | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c
-index 9bac3b796..b3b808598 100644
---- a/enforcer/src/utils/kaspcheck.c
-+++ b/enforcer/src/utils/kaspcheck.c
-@@ -26,6 +26,7 @@
- #define _GNU_SOURCE
- #include <stdio.h>
- #include <getopt.h>
-+#include <stdlib.h>
- #include <string.h>
- #include <syslog.h>
- 
-diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c
-index 89e56c61e..e1704f6f9 100644
---- a/enforcer/src/utils/kc_helper.c
-+++ b/enforcer/src/utils/kc_helper.c
-@@ -27,6 +27,7 @@
- #include <syslog.h>
- #include <stdarg.h>
- #include <stdio.h>
-+#include <stdlib.h>
- #include <string.h>
- #include <sys/stat.h>
- #include <errno.h>
--- 
-2.43.0
-

opendnssec-ksk-premature-retirement.patch

@@ -0,0 +1,20 @@
+--- enforcer/enforcerd/enforcer.c   (revision 6951)
++++ enforcer/enforcerd/enforcer.c   (revision 6952)
+@@ -1291,7 +1291,7 @@
+                 /* turn this zone and policy into a file */
+ #ifdef ENFORCER_USE_WORKERS
+                 {
+-                    int NewDS;
++                    int NewDS = 0;
+                     status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS);
+                     if (status2 == 0) {
+                         /* If the DS set changed then log/do something about it */
+--- NEWS    (revision 6951)
++++ NEWS    (revision 6952)
+@@ -1,5 +1,7 @@
+ $Id: NEWS 6934 2013-01-10 14:32:16Z jerry $
+ 
++* OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired.
++
+ 
+ OpenDNSSEC 1.4.0rc1 - 2013-01-10

opendnssec-sysusers.conf

@@ -1 +0,0 @@
-u ods - "opendnssec daemon account"

opendnssec.spec

@@ -1,50 +1,35 @@
+#global prever rc3
 %global _hardened_build 1
 
 Summary: DNSSEC key and zone management software
 Name: opendnssec
-Version: 2.1.14
-Release: 2%{?dist}
-License: BSD-2-Clause
+Version: 1.4.14
+Release: 1%{?prever}%{?dist}
+License: BSD
 Url: http://www.opendnssec.org/
-Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
-Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig
-Source1: ods-enforcerd.service
-Source2: ods-signerd.service
+Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
+Source1: ods-enforcerd.init
+Source2: ods-signerd.init
 Source3: ods.sysconfig
 Source4: conf.xml
-Source5: tmpfiles-opendnssec.conf
-Source6: opendnssec.cron
-Source7: opendnssec-2.1.sqlite_convert.sql
-Source8: opendnssec-2.1.sqlite_rpmversion.sql
-Source9: %{name}-sysusers.conf
-Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
-Patch2: opendnssec-configure-c99.patch
-Patch3: opendnssec-2.1.14rc1-gcc14.patch
-Patch4: opendnssec-c99-2.patch
-Patch5: opendnssec-implicit-declarations.patch
+Source5: opendnssec.cron
+Source6: kasp.xml
 
-Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units
-Requires: libxml2, libxslt sqlite
-BuildRequires: make
-BuildRequires:  gcc
-BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel
+Group: Applications/System
+Requires: opencryptoki, softhsm
+BuildRequires: libxml2, libxslt
+Requires: libxml2, libxslt
+BuildRequires: ldns-devel >= 1.6.13, sqlite-devel , openssl-devel
 BuildRequires: libxml2-devel CUnit-devel, doxygen
 # It tests for pkill/killall and would use /bin/false if not found
-BuildRequires: procps-ng
-BuildRequires: perl-interpreter
-BuildRequires: libmicrohttpd-devel jansson-devel libyaml-devel
+BuildRequires: procps
+# or else no debug package on epel6
+BuildRequires: redhat-rpm-config
 
-BuildRequires: systemd-units
 Requires(pre): shadow-utils
-Requires(post): systemd-units
-Requires(preun): systemd-units
-Requires(postun): systemd-units
 %if 0%{?prever:1}
-# For building development snapshots
-Buildrequires: autoconf, automake, libtool
-%ifarch %{java_arches}
-Buildrequires: java
-%endif
+# For building snapshots
+Buildrequires: autoconf, automake, libtool, java
 %endif
 
 %description
@@ -54,28 +39,15 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm
 
 %prep
 %setup -q -n %{name}-%{version}%{?prever}
-%patch -P1 -p1
-%patch -P2 -p1
-%patch -P3 -p1
-%patch -P4 -p1
-%patch -P5 -p1
-
-# Prevent re-running autoconf.
-touch -r aclocal.m4 configure* m4/*
-
 # bump default policy ZSK keysize to 2048
 sed -i "s/1024/2048/" conf/kasp.xml.in
 
 %build
-export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"
+export LDFLAGS="-Wl,-z,relro,-z,now -pie"
 export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security"
-export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security"
-%if 0%{?prever:1}
-# for development snapshots
-autoreconf
-%endif
+
 %configure --with-ldns=%{_libdir}
-%make_build
+make %{?_smp_mflags}
 
 %check
 # Requires sample db not shipped with upstream
@@ -83,338 +55,143 @@ autoreconf
 
 %install
 rm -rf %{buildroot}
-%make_install
-mkdir -p %{buildroot}%{_localstatedir}/opendnssec/{tmp,signed,signconf,enforcer}
+make DESTDIR=%{buildroot} install
+mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf}
+mkdir -p %{buildroot}/%{_initrddir}
+install -p -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/ods-enforcerd
+install -p -m 0755 %{SOURCE2} %{buildroot}/%{_initrddir}/ods-signerd
 install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/
-install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec
+install -p -m 0644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec
+
+# cleanup sample files
 rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample
 install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig
-install -d -m 0755 %{buildroot}%{_unitdir}
-install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/
-install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/
-install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
-install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/
-install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf
-mkdir -p %{buildroot}%{_tmpfilesdir}/
-install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf
+install -p -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
+install -p -m 0644 %{SOURCE4} %{SOURCE6} %{buildroot}/%{_sysconfdir}/opendnssec/
 mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
-mkdir -p %{buildroot}%{_datadir}/opendnssec/
-cp -a enforcer/utils %{buildroot}%{_datadir}/opendnssec/migration
-cp -a enforcer/src/db/schema.* %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/
-# fixup path for mysql/sqlite. Use our replacement sqlite_convert.sql to detect previous migration
-cp -a %{SOURCE7} %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/sqlite_convert.sql
-cp -a %{SOURCE8} %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/rpmversion.sql
-sed -i "s:^SCHEMA=.*schema:SCHEMA=%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/schema:" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite
-sed -i "s:find_problematic_zones.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/find_problematic_zones.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite
-sed -i "s:^SCHEMA=.*schema:SCHEMA=%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/schema:" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_mysql
-sed -i "s:find_problematic_zones.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/find_problematic_zones.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_mysql
-sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/sqlite_convert.sql:g" %{buildroot}%{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite
-
 
 %files
-%{_unitdir}/ods-enforcerd.service
-%{_unitdir}/ods-signerd.service
-%config(noreplace) %{_tmpfilesdir}/opendnssec.conf
-%attr(0770,root,ods) %dir %{_sysconfdir}/opendnssec
+%attr(0755,root,root) %{_initrddir}/ods-enforcerd
+%attr(0755,root,root) %{_initrddir}/ods-signerd
+%attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec
 %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec
 %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp
-%attr(0775,root,ods) %dir %{_localstatedir}/opendnssec/signed
+%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signed
 %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf
-%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/enforcer
 %attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods
 %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec
-%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/cron.d/opendnssec
-%doc NEWS README.md
-%license LICENSE
+%attr(0644,root,root) %{_sysconfdir}/cron.d/opendnssec
+%doc NEWS README.md LICENSE
 %{_mandir}/*/*
 %{_sbindir}/*
 %{_bindir}/*
-%attr(0755,root,root) %dir %{_datadir}/opendnssec
-%{_datadir}/opendnssec/*
-%{_sysusersdir}/%{name}.conf
+%attr(0755,root,root) %dir %{_datadir}/%{name}
+%{_datadir}/%{name}/*
 
 %pre
-
-%sysusers_create_package %{name} %{SOURCE9}
+getent group ods >/dev/null || groupadd -r ods
+getent passwd ods >/dev/null || \
+useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
+-c "opendnssec daemon account" ods
+exit 0
 
 %post
+/sbin/chkconfig --add ods-enforcerd
+/sbin/chkconfig --add ods-signerd
 # Initialise a slot on the softhsm on first install
 if [ "$1" -eq 1 ]; then
-   %{_sbindir}/runuser -u ods -- %{_bindir}/softhsm2-util --init-token \
-                --free --label "OpenDNSSEC" --pin 1234 --so-pin 1234
-   if [ ! -s %{_localstatedir}/opendnssec/kasp.db ]; then
-      echo y | %{_sbindir}/ods-enforcer-db-setup
-      %{_bindir}/sqlite3 -batch %{_localstatedir}/opendnssec/kasp.db < %{_datadir}/opendnssec/migration/1.4-2.0_db_convert/rpmversion.sql
-   fi
-
-elif [ -z "$(%{_bindir}/sqlite3 %{_localstatedir}/opendnssec/kasp.db 'select * from rpm_migration;')" ]; then
-   # Migrate version 1.4 db to version 2.1 db
-   if [ -e %{_localstatedir}/opendnssec/rpm-migration-in-progress ]; then
-      echo "previous (partial?) migration found - human intervention is needed"
-   else
-      echo "opendnssec 1.4 database found, migrating to 2.x"
-      touch %{_localstatedir}/opendnssec/rpm-migration-in-progress
-      mv -n %{_localstatedir}/opendnssec/kasp.db %{_localstatedir}/opendnssec/kasp.db-1.4
-      echo "migrating conf.xml from 1.4 to 2.1 schema"
-      cp -n %{_sysconfdir}/opendnssec/conf.xml %{_sysconfdir}/opendnssec/conf.xml-1.4
-      # fixup incompatibilities inflicted upon us by upstream :(
-      sed -i "/<Interval>.*Interval>/d" %{_sysconfdir}/opendnssec/conf.xml
-      echo "Converting kasp.db"
-      ERR=""
-      %{_datadir}/opendnssec/migration/1.4-2.0_db_convert/convert_sqlite -i %{_localstatedir}/opendnssec/kasp.db-1.4 -o %{_localstatedir}/opendnssec/kasp.db || ERR="convert_sqlite error"
-      chown ods.ods %{_localstatedir}/opendnssec/kasp.db
-      cp -n %{_sysconfdir}/opendnssec/zonelist.xml %{_localstatedir}/opendnssec/enforcer/zones.xml
-      if [ -z "$ERR" ]; then
-         echo "calling ods-migrate"
-         ods-migrate || ERR="ods-migrate failed"
-         if [ -z "$ERR" ]; then
-            echo "opendnssec 1.4 to 2.x migration completed"
-            rm %{_localstatedir}/opendnssec/rpm-migration-in-progress
-         else
-            echo "ods-migrate process failed - human intervention is needed"
-         fi
-      else
-         echo "%{_localstatedir}/opendnssec/kasp.db conversion failed - not calling ods-migrate to complete migration. human intervention is needed"
-      fi
-   fi
+    if [ ! -f /var/softhsm/slot0.db ]; then
+        %{_sbindir}/runuser -u ods -- softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
+    fi
 fi
-
 # in case we update any xml conf file
-ods-enforcer update all >/dev/null 2>/dev/null ||:
-
-%systemd_post ods-enforcerd.service
-%systemd_post ods-signerd.service
+ods-ksmutil update all >/dev/null 2>/dev/null ||:
 
 %preun
-%systemd_preun ods-enforcerd.service
-%systemd_preun ods-signerd.service
+if [ $1 -eq 0 ]; then
+  /sbin/service ods-signerd stop >/dev/null 2>&1 ||:
+  /sbin/service ods-enforcerd stop >/dev/null 2>&1 ||:
+  /sbin/chkconfig --del ods-enforcerd
+  /sbin/chkconfig --del ods-signerd
+fi
 
 %postun
-%systemd_postun_with_restart ods-enforcerd.service
-%systemd_postun_with_restart ods-signerd.service
+if [ "$1" -ge "1" ]; then
+  ods-ksmutil update all >/dev/null 2>/dev/null ||:
+  /sbin/service ods-enforcerd condrestart >/dev/null 2>&1 ||:
+  /sbin/service ods-signerd condrestart >/dev/null 2>&1 ||:
+fi
 
 %changelog
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jan 21 2025 Rafel Jeffman <rjeffman@redhat.com> - 2.1.14-1
-- Upstream release 2.1.14
-- Use systemd-sysusers
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.4rc1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Oct 22 2024 Richard W.M. Jones <rjones@redhat.com> - 2.1.14-0.3rc1
-- Rebuild for Jansson 2.14
-  (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/)
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.2rc1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Feb 08 2024 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.14-0.1rc1
-- Upstream release 2.1.14RC1
-- Fix build with gcc 14
-- Resolves: rhbz#2261421
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-9
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Feb 24 2023 Florian Weimer <fweimer@redhat.com> - 2.1.10-6
-- Port to C99
-
-* Mon Jan 30 2023 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.10-5
-- Fix fortification issues leading to crash in FreeIPA setup
-  Upstream PR: https://github.com/opendnssec/opendnssec/pull/842
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Oct 18 2021 François Cami <fcami@redhat.com> - 2.1.10-1
-- Update to 2.1.10 (rhbz#2003250).
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.1.9-3
-- Rebuilt with OpenSSL 3.0.0
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.9-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jul 06 2021 François Cami <fcami@redhat.com> - 2.1.9-1
-- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956.
-- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured.
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.8-2
-- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
-* Sat Feb 20 2021 Fedora Release Monitoring <release-monitoring@fedoraproject.org> - 2.1.8-1
-- Update to 2.1.8 (#1931143)
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.7-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3
-- Rebuild for libldns soname bump
-
-* Tue Dec  8 21:09:23 EST 2020 Paul Wouters <pwouters@redhat.com> - 2.1.7-2
-- Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready
-
-* Fri Dec 04 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.7-1
-- Upstream release 2.1.7
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.6-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 2.1.6-7
-- Use make macros
-- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Thu May 28 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-6
-- Resolves: rhbz#1833718 ods-signerd.service missing .service
-
-* Mon Apr 20 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-5
-- Resolves: rhbz#1825812 AVC avc: denied { dac_override } for comm="ods-enforcerd
-
-* Wed Mar 11 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-4
-- Fix migration check to not attempt to check on first install with no db
-
-* Tue Mar 03 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.6-3
-- Create and manage /var/opendnssec/enforcer directory
-- Resolves rhbz#1809492
-
-* Wed Feb 19 2020 Paul Wouters <pwouters@redhat.com> - 2.1.6-2
-- Update to 2.1.6 (major upgrade, supports migration from 1.4.x)
-- gcc10 compile fixups
-- Fix trying to use unversioned libsqlite3.so file
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.14-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
 * Tue Dec 12 2017 Paul Wouters <pwouters@redhat.com> - 1.4.14-1
 - Update to 1.4.14 as first steop to migrating to 2.x
-- Resolves: rhbz#1413254 Move tmpfiles.d config to %%{_tmpfilesdir}, install LICENSE as %%license
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Wed Mar 08 2017 Tomas Hozza <thozza@redhat.com> - 1.4.9-5
-- Fix FTBFS (#1424019) in order to rebuild against new ldns
-
-* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Thu Feb 18 2016 Paul Wouters <pwouters@redhat.com> - 1.4.9-3
-- Resolves: rbz#1303965 upgrade to opendnssec-1.4.9-1.fc23 breaks old installations
-- On initial install, after token init, also run ods-ksmutil setup
-
-* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+  [this version cannot be build until ldns-1.6.17 appears in el6]
 
 * Mon Feb 01 2016 Paul Wouters <pwouters@redhat.com> - 1.4.9-1
 - Updated to 1.4.9
 - Removed merged in patch
 
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.7-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Tue Jun 09 2015 Paul Wouters <pwouters@redhat.com> - 1.4.7-2
-- Resolves rhbz#1219746 ods-signerd.service misplaced After= in section Service
-- Resolves rhbz#1220443 OpenDNSSEC fails to initialise a slot in softhsm on first install
-
-* Tue Dec 09 2014 Paul Wouters <pwouters@redhat.com> - 1.4.7-1
+* Tue Jun 09 2015 Paul Wouters <pwouters@redhat.com> - 1.4.7-1
 - Updated to 1.4.7 (fix zone update can get stuck, crash on retransfer cmd)
+- Create slot as ods user, not root.
+- Added the extract patches from the fedora branch
 
-* Wed Oct 15 2014 Paul Wouters <pwouters@redhat.com> - 1.4.6-4
-- Change /etc/opendnssec to be ods group writable
-
-* Wed Oct 08 2014 Paul Wouters <pwouters@redhat.com> - 1.4.6-3
-- Added Petr Spacek's patch that adds the config option <AllowExtraction/> (rhbz#1123354)
-
-* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.6-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Mon Jul 28 2014 Paul Wouters <pwouters@redhat.com> - 1.4.6-1
+* Wed Aug 20 2014 Paul Wouters <pwouters@redhat.com> - 1.4.6-1
 - Updated to 1.4.6
-- Removed incorporated patch upstream
-- Remove Wants= from ods-signerd.service (rhbz#1098205)
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.5-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+- Removed merged in patch
 
 * Fri Apr 18 2014 Paul Wouters <pwouters@redhat.com> - 1.4.5-2
-- Updated to 1.4.5
 - Added patch for serial 0 bug in XFR adapter
+- Add redhat-rpm-config buildrequire to ensure debug package
+
+* Fri Apr 18 2014 Paul Wouters <pwouters@redhat.com> - 1.4.5-1
+- Updated to 1.4.5
 
 * Tue Apr 01 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-3
 - Add buildrequires for ods-kasp2html (rhbz#1073313)
 
-* Sat Mar 29 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-2
+* Fri Mar 28 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-2
 - Add requires for ods-kasp2html (rhbz#1073313)
-
-* Thu Mar 27 2014 Paul Wouters <pwouters@redhat.com> - 1.4.4-1
-- Updated to 1.4.4 (compatibility with non RFC 5155 errata 3441)
+- Updated to 1.4.4 (rhbz#1080862)
+  (compatibility with non RFC 5155 errata 3441 implementations)
 - Change the default ZSK policy from 1024 to 2048 bit RSA keys
 - Fix post to be quiet when upgrading opendnssec
 
 * Thu Jan 09 2014 Paul Wouters <pwouters@redhat.com> - 1.4.3-1
 - Updated to 1.4.3 (rhel#1048449) - minor bugfixes, minor feature enhancements
-- rhel#1025985 OpenDNSSEC signer cannot be started due to a typo in service file
 
 * Wed Sep 11 2013 Paul Wouters <pwouters@redhat.com> - 1.4.2-1
 - Updated to 1.4.2, bugfix release
 
-* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
 * Fri Jun 28 2013 Paul Wouters <pwouters@redhat.com> - 1.4.1-1
-- Updated to 1.4.1. NSEC3 handling and serial number handling fixes
-- Add BuildRequire for systemd-units
+- Updated to 1.4.1, bugfixes for NSEC3 and serial handling
 
 * Sat May 11 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-1
 - Updated to 1.4.0
+- Enabled full relro/pie protection
 
-* Fri Apr 12 2013 Paul Wouters <pwouters@redhat.com> - 1.4.20-0.8.rc3
+* Mon Apr 15 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.8.rc3
 - Updated to 1.4.0rc3
-- Enabled hardened compile, full relzo/pie
 
-* Fri Jan 25 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.4.0-0.7.rc2
-- Updated to 1.4.0rc2, which includes svn r6952
+* Mon Jan 28 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.7.rc2
+- Updaed to 1.4.0rc2
+- This merges in r6952
 
 * Fri Jan 18 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.4.0-0.6.rc1
 - Updated to 1.4.0rc1
 - Applied opendnssec-ksk-premature-retirement.patch (svn r6952)
 
-* Tue Dec 18 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.5.b2
+* Tue Dec 18 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.6.b2
 - Updated to 1.4.0b2
-- All patches have been merged upstream
-- cron job should be marked as config file
+- All patches synced to/from with new release
+
+* Fri Nov 23 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.6.b1
+- Patch for empty nonterminal NSEC3 records
+
+* Sat Nov 10 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.5.b1
+- Patch r6816 fixes enforcer/signer communication
+- Patch r6817 Don't add double RRSIGs generated by same key for DNSKEY RRset
 
 * Tue Oct 30 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.4.b1
 - Added BuildRequires: procps-ng for bug OPENDNSSEC-345
@@ -422,34 +199,32 @@ ods-enforcer update all >/dev/null 2>/dev/null ||:
   daylight saving issues on resolvers
 - Patch to prevent removal of occluded data
 
-* Wed Sep 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.3.b1
+* Wed Sep 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.2.b1
 - Just an EVR fix to the proper standard
-- Cleanup of spec file
-- Introduce new systemd-rpm macros (rhbz#850242)
+- Remove accidentally added (but not released) Epoch:
+- Minor spec file cleanup
 
 * Wed Sep 12 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.b1.1
 - Updated to 1.4.0b1
-- Patch for NSEC3PARAM TTL
-- Cron job to assist narrowing ods-enforcerd timing differences
+- Patch to more aggressively try to take lock for resigning
+- Patch to give NSEC3PARAM record a TTL=0
 
-* Wed Aug 29 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a3.1
+* Tue Aug 07 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a3.2
 - Updated to 1.4.0a3
-- Patch to more aggressively try to resign
-- Patch to fix locking issue eating up cpu
+- Added opendnssec.cron to sync key rollovers over multiple servers
+- Removed merged in patch.
+- Added patch for cpu lock from trunk
+- Don't re-init softhsm on remove+install of opendnssec (as opposed to upgrade)
 
-* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-0.a2.2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+* Wed May 16 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.4
+- Missed the actual patch line, so previous build did not have the patch
 
-* Tue Jun 12 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a2.1
-- Updated to 1.4.0a2
-- ksm-utils patch for ods-ksmutil to die sooner when it can't lock
-  the HSM.
+* Tue Apr 17 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.3
+- Remove bad artifact dependancy on systemd-units from Fedora branch
 
-* Wed May 16 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.3
-- Patch for crasher with deleted RRsets and NSEC3/OPTOUT chains
-
-* Mon Mar 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.2
+* Thu Mar 29 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.2
 - Added opendnssec LICENSE file from trunk (Thanks Jakob!)
+- Convert back to sysv for EL5/EL6 repos
 
 * Mon Mar 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.1
 - Fix macros in comment

sources

@@ -1,2 +1 @@
-SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620
-SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f
+SHA512 (opendnssec-1.4.14.tar.gz) = b814d13ef95dcf238f3e9d6bb3dc489328d7a4a5db9e32214ac29716043f9e635e62fb3795b9d5d75e8215373f9330ea5a17840830f5e467067f305a610bee6b

tmpfiles-opendnssec.conf

@@ -1 +0,0 @@
-D /run/opendnssec 0755 ods ods -