Compare commits
3 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
e49880eab0 |
||
|
a11e244b04 | ||
|
fc11697c9b |
9 changed files with 15 additions and 296 deletions
9
.gitignore
vendored
9
.gitignore
vendored
|
|
@ -17,12 +17,3 @@
|
|||
/opendnssec-1.4.14.tar.gz
|
||||
/opendnssec-2.1.6.tar.gz
|
||||
/opendnssec-2.1.7.tar.gz
|
||||
/opendnssec-2.1.8.tar.gz
|
||||
/opendnssec-2.1.9.tar.gz
|
||||
/opendnssec-2.1.9.tar.gz.sig
|
||||
/opendnssec-2.1.10.tar.gz.sig
|
||||
/opendnssec-2.1.10.tar.gz
|
||||
/opendnssec-2.1.14rc1.tar.gz
|
||||
/opendnssec-2.1.14rc1.tar.gz.sig
|
||||
/opendnssec-2.1.14.tar.gz
|
||||
/opendnssec-2.1.14.tar.gz.sig
|
||||
|
|
|
|||
|
|
@ -1,35 +0,0 @@
|
|||
From 4d87db0f11bcdd5c54fadb92351b603bd07f76f8 Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Mon, 30 Jan 2023 11:44:49 +0200
|
||||
Subject: [PATCH] Pass right remaining buffer size in hsm_hex_unparse to handle
|
||||
string fortification
|
||||
|
||||
When string fortification is in use (-DFORTIFY_SOURCE=3), GCC and glibc
|
||||
will cut few bytes off the string buffer for prevention of buffer
|
||||
overruns. As a result, hsm_hex_unparse() will call into snprintf() with
|
||||
a buffer length bigger than the size of the buffer as seen by the
|
||||
GCC/glibc pair.
|
||||
|
||||
See also: https://pagure.io/freeipa/issue/9312
|
||||
|
||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
---
|
||||
libhsm/src/lib/libhsm.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c
|
||||
index 88dc79e31..8f1e0c3bc 100644
|
||||
--- a/libhsm/src/lib/libhsm.c
|
||||
+++ b/libhsm/src/lib/libhsm.c
|
||||
@@ -1382,7 +1382,7 @@ hsm_hex_unparse(char *dst, const unsigned char *src, size_t len)
|
||||
size_t i;
|
||||
|
||||
for (i = 0; i < len; i++) {
|
||||
- snprintf(dst + (2*i), dst_len, "%02x", src[i]);
|
||||
+ snprintf(dst + (2*i), dst_len - (2*i), "%02x", src[i]);
|
||||
}
|
||||
dst[len*2] = '\0';
|
||||
}
|
||||
--
|
||||
2.39.0
|
||||
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
From 17e9e444e052ca43ab31da77e9327f159baf5b9c Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Thu, 8 Feb 2024 13:10:53 +0200
|
||||
Subject: [PATCH] Fix missing include
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
scheduler/task.c: In function ‘task_perform’:
|
||||
scheduler/task.c:137:25: error: implicit declaration of function ‘clamp’ [-Wimplicit-function-declaration]
|
||||
137 | task->backoff = clamp(task->backoff * 2, 60, ODS_SE_MAX_BACKOFF);
|
||||
| ^~~~~
|
||||
make[2]: *** [Makefile:600: scheduler/task.o] Error 1
|
||||
|
||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
---
|
||||
common/scheduler/task.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/common/scheduler/task.c b/common/scheduler/task.c
|
||||
index 4dcf9e900..0dfa496a2 100644
|
||||
--- a/common/scheduler/task.c
|
||||
+++ b/common/scheduler/task.c
|
||||
@@ -40,6 +40,7 @@
|
||||
#include "duration.h"
|
||||
#include "file.h"
|
||||
#include "log.h"
|
||||
+#include "utilities.h"
|
||||
|
||||
static const char* task_str = "task";
|
||||
static pthread_mutex_t worklock = PTHREAD_MUTEX_INITIALIZER;
|
||||
--
|
||||
2.43.0
|
||||
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
commit 5422819c17c02e6069328b2f5e4bef6fe5c179df
|
||||
Author: Mathieu Mirmont <mat@parad0x.org>
|
||||
Date: Sun Dec 1 17:57:36 2019 +0100
|
||||
|
||||
enforcer: remove remove strptime build warning
|
||||
|
||||
diff --git a/enforcer/src/daemon/time_leap_cmd.c b/enforcer/src/daemon/time_leap_cmd.c
|
||||
index f1ee21b87529c136..5baef1b6ff7c4cc2 100644
|
||||
--- a/enforcer/src/daemon/time_leap_cmd.c
|
||||
+++ b/enforcer/src/daemon/time_leap_cmd.c
|
||||
@@ -26,8 +26,8 @@
|
||||
*
|
||||
*/
|
||||
|
||||
-#include <getopt.h>
|
||||
#include "config.h"
|
||||
+#include <getopt.h>
|
||||
|
||||
#include "file.h"
|
||||
#include "duration.h"
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
Include <unistd.h> for the setresuid and setresgid functions,
|
||||
to avoid an implicit function declaration.
|
||||
|
||||
Submitted upstream: <https://github.com/opendnssec/opendnssec/pull/843>
|
||||
|
||||
diff --git a/configure b/configure
|
||||
index bf515cde3d4fab71..52d2885d6a6ef546 100755
|
||||
--- a/configure
|
||||
+++ b/configure
|
||||
@@ -21101,6 +21101,7 @@ else
|
||||
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
|
||||
/* end confdefs.h. */
|
||||
|
||||
+#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
|
||||
@@ -21143,6 +21144,7 @@ else
|
||||
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
|
||||
/* end confdefs.h. */
|
||||
|
||||
+#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
|
||||
diff --git a/m4/acx_broken_setres.m4 b/m4/acx_broken_setres.m4
|
||||
index 374cee0b0b8ef196..467db9170a319170 100644
|
||||
--- a/m4/acx_broken_setres.m4
|
||||
+++ b/m4/acx_broken_setres.m4
|
||||
@@ -4,6 +4,7 @@ AC_DEFUN([ACX_BROKEN_SETRES],[
|
||||
AC_MSG_CHECKING(if setresuid seems to work)
|
||||
AC_RUN_IFELSE(
|
||||
[AC_LANG_SOURCE([[
|
||||
+#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
|
||||
@@ -20,6 +21,7 @@ int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
|
||||
AC_MSG_CHECKING(if setresgid seems to work)
|
||||
AC_RUN_IFELSE(
|
||||
[AC_LANG_SOURCE([[
|
||||
+#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
From 7060607ef359162d5b0aef62a4b8440fd42c9d28 Mon Sep 17 00:00:00 2001
|
||||
From: Yaakov Selkowitz <yselkowi@redhat.com>
|
||||
Date: Tue, 26 Dec 2023 14:09:12 -0500
|
||||
Subject: [PATCH] Fix implicit function declarations
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
utils/kaspcheck.c:101:33: error: implicit declaration of function ‘exit’
|
||||
utils/kaspcheck.c:136:17: error: implicit declaration of function ‘free’
|
||||
utils/kc_helper.c:47:40: error: implicit declaration of function ‘free’
|
||||
utils/kc_helper.c:519:85: error: implicit declaration of function ‘atoi’
|
||||
utils/kc_helper.c:569:83: error: implicit declaration of function ‘malloc’
|
||||
utils/kc_helper.c:1122:28: error: implicit declaration of function ‘strtol’
|
||||
utils/kc_helper.c:1274:25: error: implicit declaration of function ‘exit’
|
||||
utils/kc_helper.c:1375:21: error: implicit declaration of function ‘calloc’
|
||||
---
|
||||
enforcer/src/utils/kaspcheck.c | 1 +
|
||||
enforcer/src/utils/kc_helper.c | 1 +
|
||||
2 files changed, 2 insertions(+)
|
||||
|
||||
diff --git a/enforcer/src/utils/kaspcheck.c b/enforcer/src/utils/kaspcheck.c
|
||||
index 9bac3b796..b3b808598 100644
|
||||
--- a/enforcer/src/utils/kaspcheck.c
|
||||
+++ b/enforcer/src/utils/kaspcheck.c
|
||||
@@ -26,6 +26,7 @@
|
||||
#define _GNU_SOURCE
|
||||
#include <stdio.h>
|
||||
#include <getopt.h>
|
||||
+#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <syslog.h>
|
||||
|
||||
diff --git a/enforcer/src/utils/kc_helper.c b/enforcer/src/utils/kc_helper.c
|
||||
index 89e56c61e..e1704f6f9 100644
|
||||
--- a/enforcer/src/utils/kc_helper.c
|
||||
+++ b/enforcer/src/utils/kc_helper.c
|
||||
@@ -27,6 +27,7 @@
|
||||
#include <syslog.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdio.h>
|
||||
+#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/stat.h>
|
||||
#include <errno.h>
|
||||
--
|
||||
2.43.0
|
||||
|
||||
|
|
@ -1 +0,0 @@
|
|||
u ods - "opendnssec daemon account"
|
||||
116
opendnssec.spec
116
opendnssec.spec
|
|
@ -1,13 +1,13 @@
|
|||
#global prever rcX
|
||||
%global _hardened_build 1
|
||||
|
||||
Summary: DNSSEC key and zone management software
|
||||
Name: opendnssec
|
||||
Version: 2.1.14
|
||||
Release: 2%{?dist}
|
||||
License: BSD-2-Clause
|
||||
Version: 2.1.7
|
||||
Release: 3%{?prever}%{?dist}
|
||||
License: BSD
|
||||
Url: http://www.opendnssec.org/
|
||||
Source0: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
|
||||
Source10: https://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz.sig
|
||||
Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
|
||||
Source1: ods-enforcerd.service
|
||||
Source2: ods-signerd.service
|
||||
Source3: ods.sysconfig
|
||||
|
|
@ -16,16 +16,9 @@ Source5: tmpfiles-opendnssec.conf
|
|||
Source6: opendnssec.cron
|
||||
Source7: opendnssec-2.1.sqlite_convert.sql
|
||||
Source8: opendnssec-2.1.sqlite_rpmversion.sql
|
||||
Source9: %{name}-sysusers.conf
|
||||
Patch1: 0001-Pass-right-remaining-buffer-size-in-hsm_hex_unparse-.patch
|
||||
Patch2: opendnssec-configure-c99.patch
|
||||
Patch3: opendnssec-2.1.14rc1-gcc14.patch
|
||||
Patch4: opendnssec-c99-2.patch
|
||||
Patch5: opendnssec-implicit-declarations.patch
|
||||
|
||||
Requires: opencryptoki, softhsm >= 2.5.0 , systemd-units
|
||||
Requires: libxml2, libxslt sqlite
|
||||
BuildRequires: make
|
||||
BuildRequires: gcc
|
||||
BuildRequires: ldns-devel >= 1.6.12, sqlite-devel >= 3.0.0, openssl-devel
|
||||
BuildRequires: libxml2-devel CUnit-devel, doxygen
|
||||
|
|
@ -41,10 +34,7 @@ Requires(preun): systemd-units
|
|||
Requires(postun): systemd-units
|
||||
%if 0%{?prever:1}
|
||||
# For building development snapshots
|
||||
Buildrequires: autoconf, automake, libtool
|
||||
%ifarch %{java_arches}
|
||||
Buildrequires: java
|
||||
%endif
|
||||
Buildrequires: autoconf, automake, libtool, java
|
||||
%endif
|
||||
|
||||
%description
|
||||
|
|
@ -54,15 +44,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm
|
|||
|
||||
%prep
|
||||
%setup -q -n %{name}-%{version}%{?prever}
|
||||
%patch -P1 -p1
|
||||
%patch -P2 -p1
|
||||
%patch -P3 -p1
|
||||
%patch -P4 -p1
|
||||
%patch -P5 -p1
|
||||
|
||||
# Prevent re-running autoconf.
|
||||
touch -r aclocal.m4 configure* m4/*
|
||||
|
||||
# bump default policy ZSK keysize to 2048
|
||||
sed -i "s/1024/2048/" conf/kasp.xml.in
|
||||
|
||||
|
|
@ -72,7 +53,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -W
|
|||
export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security"
|
||||
%if 0%{?prever:1}
|
||||
# for development snapshots
|
||||
autoreconf
|
||||
sh ./autogen.sh
|
||||
%endif
|
||||
%configure --with-ldns=%{_libdir}
|
||||
%make_build
|
||||
|
|
@ -94,7 +75,6 @@ install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/
|
|||
install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/
|
||||
install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
|
||||
install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/
|
||||
install -D %{SOURCE9} %{buildroot}%{_sysusersdir}/%{name}.conf
|
||||
mkdir -p %{buildroot}%{_tmpfilesdir}/
|
||||
install -m 0644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/opendnssec.conf
|
||||
mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
|
||||
|
|
@ -132,11 +112,13 @@ sed -i "s:sqlite_convert.sql:%{_datadir}/opendnssec/migration/1.4-2.0_db_convert
|
|||
%{_bindir}/*
|
||||
%attr(0755,root,root) %dir %{_datadir}/opendnssec
|
||||
%{_datadir}/opendnssec/*
|
||||
%{_sysusersdir}/%{name}.conf
|
||||
|
||||
%pre
|
||||
|
||||
%sysusers_create_package %{name} %{SOURCE9}
|
||||
getent group ods >/dev/null || groupadd -r ods
|
||||
getent passwd ods >/dev/null || \
|
||||
useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
|
||||
-c "opendnssec daemon account" ods
|
||||
exit 0
|
||||
|
||||
%post
|
||||
# Initialise a slot on the softhsm on first install
|
||||
|
|
@ -195,78 +177,8 @@ ods-enforcer update all >/dev/null 2>/dev/null ||:
|
|||
%systemd_postun_with_restart ods-signerd.service
|
||||
|
||||
%changelog
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Tue Jan 21 2025 Rafel Jeffman <rjeffman@redhat.com> - 2.1.14-1
|
||||
- Upstream release 2.1.14
|
||||
- Use systemd-sysusers
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.4rc1
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Tue Oct 22 2024 Richard W.M. Jones <rjones@redhat.com> - 2.1.14-0.3rc1
|
||||
- Rebuild for Jansson 2.14
|
||||
(https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/)
|
||||
|
||||
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.14-0.2rc1
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Thu Feb 08 2024 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.14-0.1rc1
|
||||
- Upstream release 2.1.14RC1
|
||||
- Fix build with gcc 14
|
||||
- Resolves: rhbz#2261421
|
||||
|
||||
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-9
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-8
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Fri Feb 24 2023 Florian Weimer <fweimer@redhat.com> - 2.1.10-6
|
||||
- Port to C99
|
||||
|
||||
* Mon Jan 30 2023 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.10-5
|
||||
- Fix fortification issues leading to crash in FreeIPA setup
|
||||
Upstream PR: https://github.com/opendnssec/opendnssec/pull/842
|
||||
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.10-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Mon Oct 18 2021 François Cami <fcami@redhat.com> - 2.1.10-1
|
||||
- Update to 2.1.10 (rhbz#2003250).
|
||||
|
||||
* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.1.9-3
|
||||
- Rebuilt with OpenSSL 3.0.0
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.9-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Tue Jul 06 2021 François Cami <fcami@redhat.com> - 2.1.9-1
|
||||
- Update to 2.1.9 (rhbz#1956561). Solves OPENDNSSEC-955 and OPENDNSSEC-956.
|
||||
- Known issue: OPENDNSSEC-957: Signer daemon stops with failure exit code even when no error occured.
|
||||
|
||||
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.8-2
|
||||
- Rebuilt for updated systemd-rpm-macros
|
||||
See https://pagure.io/fesco/issue/2583.
|
||||
|
||||
* Sat Feb 20 2021 Fedora Release Monitoring <release-monitoring@fedoraproject.org> - 2.1.8-1
|
||||
- Update to 2.1.8 (#1931143)
|
||||
|
||||
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.7-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Sat Dec 19 10:13:50 PST 2020 awilliam@redhat.com - 2.1.7-3
|
||||
- Rebuild for libldns soname bump
|
||||
* Mon May 31 2021 Paul Wouters <paul.wouters@aiven.io> - 2.1.7-3
|
||||
- Bump for ldns update that changed so version
|
||||
|
||||
* Tue Dec 8 21:09:23 EST 2020 Paul Wouters <pwouters@redhat.com> - 2.1.7-2
|
||||
- Resolves rhbz#1826233 ods-enforcerd.service should wait until socket is ready
|
||||
|
|
|
|||
3
sources
3
sources
|
|
@ -1,2 +1 @@
|
|||
SHA512 (opendnssec-2.1.14.tar.gz.sig) = 45684220fa29e31e7c77a2f5802f5e56edb780a536fe7c81b9fae2b9c41664647f1f321f1f3bea8a82d806dda08d21ac32edc8f3e5ed3bea72729c7fd3b94620
|
||||
SHA512 (opendnssec-2.1.14.tar.gz) = 406532008b85fbcae765a41e9fba28ce97051d86f6b64f58ded02288ac7a417a83bf93739712588b641c7d782a06448aeeb65415fd5585f70a362211a184593f
|
||||
SHA512 (opendnssec-2.1.7.tar.gz) = 6f2ca2115195fd2fcd0b22186c41c9e64ec24d98b34a10a8a75d64b4671b5afe3a655f32bbd241a0df84affda1f6cecd4daac0e6fa7081e4c9fa02d1bb4ed1eb
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue