Merge branch 'master' into f32

- Resolves: rhbz#1833718 ods-signerd.service missing .service
- Resolves: rhbz#1825812 AVC avc: denied { dac_override } for comm="ods-enforcerd
2020-12-08 21:15:17 -05:00 · 2020-05-28 13:39:36 -04:00 · 2020-04-20 09:47:54 -04:00
9 changed files with 13 additions and 297 deletions
--- a/.gitignore
+++ b/.gitignore
@ -17,12 +17,3 @@
 /opendnssec-1.4.14.tar.gz
 /opendnssec-2.1.6.tar.gz
 /opendnssec-2.1.7.tar.gz
-/opendnssec-2.1.8.tar.gz
-/opendnssec-2.1.9.tar.gz
-/opendnssec-2.1.9.tar.gz.sig
-/opendnssec-2.1.10.tar.gz.sig
-/opendnssec-2.1.10.tar.gz
-/opendnssec-2.1.14rc1.tar.gz
-/opendnssec-2.1.14rc1.tar.gz.sig
-/opendnssec-2.1.14.tar.gz
-/opendnssec-2.1.14.tar.gz.sig
--- a/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
+++ b/0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
@ -1,35 +0,0 @@
-From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Mon, 30 Jan 2023 11:44:49 +0200
-Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle
- string fortification
-
-When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc
-will cut few bytes off the string buffer for prevention of buffer
-overruns. As a result, hsm_hex_unparse() will call into snprintf() with
-a buffer length bigger than the size of the buffer as seen by the
-GCC/glibc pair.
-
-See also: https://pagure.io/freeipa/issue/9312
-
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
- libhsm/src/lib/libhsm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c
-index 88dc79e31..8f1e0c3bc 100644
--- a/libhsm/src/lib/libhsm.c
-+++ b/libhsm/src/lib/libhsm.c
-@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len)
-     size_t i;
- 
-     for (i = 0; i < len; i++) {
-        snprintf(dst + (2*i), dst_len, "%02x", src[i]);
-+        snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]);
-     }
-     dst[len*2] = '\0';
- }
-- 
-2.39.0
-
--- a/opendnssec-2.1.14rc1-gcc14.patch
+++ b/opendnssec-2.1.14rc1-gcc14.patch
@ -1,34 +0,0 @@
-From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Thu, 8 Feb 2024 13:10:53 +0200
-Subject: [PATCH] Fix missing include
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-scheduler/task.c: In function ‘task_perform’:
-scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration]
-  137 |         task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF);
-      |                         ^~~~~
-make[2]: *** [Makefile:600: scheduler/task.o] Error 1
-
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
- common/scheduler/task.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/common/scheduler/task.c b/common/scheduler/task.c
-index 4dcf9e900..0dfa496a2 100644
--- a/common/scheduler/task.c
-+++ b/common/scheduler/task.c
-@@ -40,6 +40,7 @@
- #include "duration.h"
- #include "file.h"
- #include "log.h"
-+#include "utilities.h"
- 
- static const char* task_str = "task";
- static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER;
-- 
-2.43.0
-
--- a/opendnssec-c99-2.patch
+++ b/opendnssec-c99-2.patch
@ -1,20 +0,0 @@
-commit 5422819c17c02e6069328b2f5e4bef6fe5c179df
-Author: Mathieu Mirmont <mat@parad0x.org>
-Date:   Sun Dec 1 17:57:36 2019 +0100
-
-    enforcer: remove remove strptime build warning
-
-diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c
-index f1ee21b87529c136..5baef1b6ff7c4cc2 100644
--- a/enforcer/src/daemon/time_leap_cmd.c
-+++ b/enforcer/src/daemon/time_leap_cmd.c
-@@ -26,8 +26,8 @@
-  *
-  */
- 
-#include <getopt.h>
- #include "config.h"
-+#include <getopt.h>
- 
- #include "file.h"
- #include "duration.h"
--- a/opendnssec-configure-c99.patch
+++ b/opendnssec-configure-c99.patch
@ -1,45 +0,0 @@
-Include <unistd.h> for the setresuid and setresgid functions,
-to avoid an implicit function declaration.
-
-Submitted upstream: <https://github.com/opendnssec/opendnssec/pull/843>
-
-diff --git a/configure b/configure
-index bf515cde3d4fab71..52d2885d6a6ef546 100755
--- a/configure
-+++ b/configure
-@@ -21101,6 +21101,7 @@ else
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
- 
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
-@@ -21143,6 +21144,7 @@ else
-   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- /* end confdefs.h.  */
- 
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
-diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4
-index 374cee0b0b8ef196..467db9170a319170 100644
--- a/m4/acx_broken_setres.m4
-+++ b/m4/acx_broken_setres.m4
-@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[
- 		AC_MSG_CHECKING(if setresuid seems to work)
- 		AC_RUN_IFELSE(
- 			[AC_LANG_SOURCE([[
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
-@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
- 		AC_MSG_CHECKING(if setresgid seems to work)
- 		AC_RUN_IFELSE(
- 			[AC_LANG_SOURCE([[
-+#include <unistd.h>
- #include <stdlib.h>
- #include <errno.h>
- int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
--- a/opendnssec-implicit-declarations.patch
+++ b/opendnssec-implicit-declarations.patch
@ -1,48 +0,0 @@
-From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001
-From: Yaakov Selkowitz <yselkowi@redhat.com>
-Date: Tue, 26 Dec 2023 14:09:12 -0500
-Subject: [PATCH] Fix implicit function declarations
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’
-utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’
-utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’
-utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’
-utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’
-utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’
-utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’
-utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’
---
- enforcer/src/utils/kaspcheck.c | 1 +
- enforcer/src/utils/kc_helper.c | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c
-index 9bac3b796..b3b808598 100644
--- a/enforcer/src/utils/kaspcheck.c
-+++ b/enforcer/src/utils/kaspcheck.c
-@@ -26,6 +26,7 @@
- #define _GNU_SOURCE
- #include <stdio.h>
- #include <getopt.h>
-+#include <stdlib.h>
- #include <string.h>
- #include <syslog.h>
- 
-diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c
-index 89e56c61e..e1704f6f9 100644
--- a/enforcer/src/utils/kc_helper.c
-+++ b/enforcer/src/utils/kc_helper.c
-@@ -27,6 +27,7 @@
- #include <syslog.h>
- #include <stdarg.h>
- #include <stdio.h>
-+#include <stdlib.h>
- #include <string.h>
- #include <sys/stat.h>
- #include <errno.h>
-- 
-2.43.0
-
--- a/opendnssec-sysusers.conf
+++ b/opendnssec-sysusers.conf
@ -1 +0,0 @@
-u ods - "opendnssec daemon account"
--- a/opendnssec.spec
+++ b/opendnssec.spec
@ -1,13 +1,13 @@
+#global prever rcX
 %global _hardened_build 1

 Summary: DNSSEC key and zone management software
 Name: opendnssec
-Version: 2.1.14
-Release: 2%{?dist}
-License: BSD-2-Clause
+Version: 2.1.7
+Release: 2%{?prever}%{?dist}
+License: BSD
 Url: http://www.opendnssec.org/
-Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
-Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig
+Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
 Source1: ods-enforcerd.service
 Source2: ods-signerd.service
 Source3: ods.sysconfig
@ -16,16 +16,9 @@ Source5: tmpfiles-opendnssec.conf
 Source6: opendnssec.cron
 Source7: opendnssec-2.1.sqlite_convert.sql
 Source8: opendnssec-2.1.sqlite_rpmversion.sql
-Source9: %{name}-sysusers.conf
-Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
-Patch2: opendnssec-configure-c99.patch
-Patch3: opendnssec-2.1.14rc1-gcc14.patch
-Patch4: opendnssec-c99-2.patch
-Patch5: opendnssec-implicit-declarations.patch

 Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units
 Requires: libxml2, libxslt sqlite
-BuildRequires: make
 BuildRequires:  gcc
 BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel
 BuildRequires: libxml2-devel CUnit-devel, doxygen
@ -41,10 +34,7 @@ Requires(preun): systemd-units
 Requires(postun): systemd-units
 %if 0%{?prever:1}
 # For building development snapshots
-Buildrequires: autoconf, automake, libtool
-%ifarch %{java_arches}
-Buildrequires: java
-%endif
+Buildrequires: autoconf, automake, libtool, java
 %endif

 %description
@ -54,15 +44,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm

 %prep
 %setup -q -n %{name}-%{version}%{?prever}
-%patch -P1 -p1
-%patch -P2 -p1
-%patch -P3 -p1
-%patch -P4 -p1
-%patch -P5 -p1
-
-# Prevent re-running autoconf.
-touch -r aclocal.m4 configure* m4/*
-
 # bump default policy ZSK keysize to 2048
 sed -i "s/1024/2048/" conf/kasp.xml.in

@ -72,7 +53,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -W
 export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security"
 %if 0%{?prever:1}
 # for development snapshots
-autoreconf
+sh ./autogen.sh
 %endif
 %configure --with-ldns=%{_libdir}
 %make_build
@ -94,7 +75,6 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/
 install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/
 install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
 install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/
-install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf
 mkdir -p %{buildroot}%{_tmpfilesdir}/
 install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf
 mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
@ -132,11 +112,13 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert
 %{_bindir}/*
 %attr(0755,root,root) %dir %{_datadir}/opendnssec
 %{_datadir}/opendnssec/*
-%{_sysusersdir}/%{name}.conf

 %pre
-
-%sysusers_create_package %{name} %{SOURCE9}
+getent group ods >/dev/null || groupadd -r ods
+getent passwd ods >/dev/null || \
+useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
+-c "opendnssec daemon account" ods
+exit 0

 %post
 # Initialise a slot on the softhsm on first install
@ -195,79 +177,6 @@ ods-enforcer update all >/dev/null 2>/dev/null ||:
 %systemd_postun_with_restart ods-signerd.service

 %changelog
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jan 21 2025 Rafel Jeffman <rjeffman@redhat.com> - 2.1.14-1
- Upstream release 2.1.14
- Use systemd-sysusers
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.4rc1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Oct 22 2024 Richard W.M. Jones <rjones@redhat.com> - 2.1.14-0.3rc1
- Rebuild for Jansson 2.14
-  (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/)
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.2rc1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Feb 08 2024 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.14-0.1rc1
- Upstream release 2.1.14RC1
- Fix build with gcc 14
- Resolves: rhbz#2261421
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Feb 24 2023 Florian Weimer <fweimer@redhat.com> - 2.1.10-6
- Port to C99
-
-* Mon Jan 30 2023 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.10-5
- Fix fortification issues leading to crash in FreeIPA setup
-  Upstream PR: https://github.com/opendnssec/opendnssec/pull/842
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Oct 18 2021 François Cami <fcami@redhat.com> - 2.1.10-1
- Update to 2.1.10 (rhbz#2003250).
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.1.9-3
- Rebuilt with OpenSSL 3.0.0
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jul 06 2021 François Cami <fcami@redhat.com> - 2.1.9-1
- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956.
- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured.
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.8-2
- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
-* Sat Feb 20 2021 Fedora Release Monitoring <release-monitoring@fedoraproject.org> - 2.1.8-1
- Update to 2.1.8 (#1931143)
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.7-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3
- Rebuild for libldns soname bump
-
 * Tue Dec  8 21:09:23 EST 2020 Paul Wouters <pwouters@redhat.com> - 2.1.7-2
 - Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready

--- a/3
+++ b/3
@ -1,2 +1 @@
-SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620
-SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f
+SHA512 (opendnssec-2.1.7.tar.gz) = 6f2ca2115195fd2fcd0b22186c41c9e64ec24d98b34a10a8a75d64b4671b5afe3a655f32bbd241a0df84affda1f6cecd4daac0e6fa7081e4c9fa02d1bb4ed1eb
Author	SHA1	Message	Date
Paul Wouters	230654603a	Merge branch 'master' into f32	2020-12-08 21:15:17 -05:00
Paul Wouters	18a4866e30	- Resolves: rhbz#1833718 ods-signerd.service missing .service	2020-05-28 13:39:36 -04:00
Paul Wouters	006733c3c1	- Resolves: rhbz#1825812 AVC avc: denied { dac_override } for comm="ods-enforcerd	2020-04-20 09:47:54 -04:00