diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index de1dfbc..67bb856 100644 --- a/.gitignore +++ b/.gitignore @@ -1,18 +1,2 @@ -openwsman-2.2.3.tar.bz2 -/openwsman-2.2.4.tar.bz2 -/openwsman-2.2.5.tar.bz2 -/openwsman-2.2.7.tar.bz2 -/openwsman-2.3.0.tar.bz2 -/openwsman-2.3.5.tar.bz2 -/openwsman-2.3.6.tar.bz2 /openwsmand.8.gz -/openwsman-2.4.0.tar.gz -/v2.4.3.tar.gz -/v2.4.4.tar.gz -/v2.4.6.tar.gz -/openwsman-2.4.12.tar.gz -/openwsman-2.4.14.tar.gz -/openwsman-2.4.15.tar.gz -/openwsman-2.6.0.tar.gz -/openwsman-2.6.1.tar.gz -/openwsman-2.6.2.tar.gz +/v2.8.1.tar.gz diff --git a/openwsman-2.2.7-libssl.patch b/openwsman-2.2.7-libssl.patch deleted file mode 100644 index 717e88e..0000000 --- a/openwsman-2.2.7-libssl.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up openwsman-2.2.7/src/server/shttpd/compat_unix.h.orig openwsman-2.2.7/src/server/shttpd/compat_unix.h ---- openwsman-2.2.7/src/server/shttpd/compat_unix.h.orig 2012-02-09 13:04:47.528527681 +0100 -+++ openwsman-2.2.7/src/server/shttpd/compat_unix.h 2012-02-09 13:05:31.582568867 +0100 -@@ -21,7 +21,7 @@ - #include - #include - #ifndef SSL_LIB --#define SSL_LIB "libssl.so" -+#define SSL_LIB "libssl.so.10" - #endif - #define DIRSEP '/' - #define IS_DIRSEP_CHAR(c) ((c) == '/') diff --git a/openwsman-2.4.0-pamsetup.patch b/openwsman-2.4.0-pamsetup.patch index 021ca88..466b5df 100644 --- a/openwsman-2.4.0-pamsetup.patch +++ b/openwsman-2.4.0-pamsetup.patch @@ -1,16 +1,13 @@ -diff -up openwsman-2.6.1/etc/pam/openwsman.pamsetup openwsman-2.6.1/etc/pam/openwsman ---- openwsman-2.6.1/etc/pam/openwsman.pamsetup 2015-08-27 15:46:46.000000000 +0200 -+++ openwsman-2.6.1/etc/pam/openwsman 2015-08-31 16:08:28.166913889 +0200 -@@ -1,7 +1,7 @@ - #%PAM-1.0 --auth required pam_unix2.so nullok -+auth required pam_unix.so nullok +diff -up openwsman-2.6.8/etc/pam/openwsman.orig openwsman-2.6.8/etc/pam/openwsman +--- openwsman-2.6.8/etc/pam/openwsman.orig 2018-11-21 13:51:52.776325243 +0100 ++++ openwsman-2.6.8/etc/pam/openwsman 2018-11-21 13:54:17.066351134 +0100 +@@ -2,6 +2,6 @@ + auth required pam_unix.so nullok auth required pam_nologin.so --account required pam_unix2.so --password required pam_pwcheck.so nullok --password required pam_unix2.so nullok use_first_pass use_authtok --session required pam_unix2.so none -+account required pam_unix.so + account required pam_unix.so +-password required pam_cracklib.so nullok +-password required pam_unix.so nullok use_first_pass use_authtok nis shadow +-session required pam_unix.so none +password required pam_pwquality.so -+password required pam_unix.so nullok use_first_pass use_authtok ++password required pam_unix.so nullok use_first_pass use_authtok +session required pam_unix.so diff --git a/openwsman-2.4.12-ruby-binding-build.patch b/openwsman-2.4.12-ruby-binding-build.patch index 133cca3..2c2e25b 100644 --- a/openwsman-2.4.12-ruby-binding-build.patch +++ b/openwsman-2.4.12-ruby-binding-build.patch @@ -1,12 +1,73 @@ -diff -up openwsman-2.4.12/bindings/ruby/extconf.rb.orig openwsman-2.4.12/bindings/ruby/extconf.rb ---- openwsman-2.4.12/bindings/ruby/extconf.rb.orig 2015-02-09 09:28:58.232581263 +0100 -+++ openwsman-2.4.12/bindings/ruby/extconf.rb 2015-02-09 09:38:22.836772879 +0100 -@@ -32,7 +32,7 @@ swig = find_executable("swig") +--- openwsman-2.8.1/bindings/ruby/extconf.rb.orig 2025-11-11 11:49:59.880195434 +0100 ++++ openwsman-2.8.1/bindings/ruby/extconf.rb 2025-11-11 11:50:46.870685458 +0100 +@@ -5,20 +5,41 @@ + require 'mkmf' + # $CFLAGS = "#{$CFLAGS} -Werror" + ++# libwsman requires 'int facility' to be defined by the application ++# Add syslog.h for LOG_DAEMON constant ++$CFLAGS = "#{$CFLAGS} -include syslog.h" ++ + # requires wsman, wsman_client, and libxml2 ++# Use CPATH and LIBRARY_PATH environment variables set by the build system ++if ENV['CPATH'] ++ ENV['CPATH'].split(':').each do |path| ++ $CPPFLAGS = "#{$CPPFLAGS} -I#{path}" ++ end ++end ++if ENV['LIBRARY_PATH'] ++ ENV['LIBRARY_PATH'].split(':').each do |path| ++ $LDFLAGS = "#{$LDFLAGS} -L#{path}" ++ end ++end + +-unless have_library('wsman', 'wsman_create_doc') ++# Custom test for libwsman that includes facility definition ++unless try_link("#include \n#include \nint facility = LOG_DAEMON;\nint main() {\n wsman_create_doc(\"test\");\n return 0;\n}", '-lwsman') + STDERR.puts "Cannot find wsman_create_doc() in libwsman" + STDERR.puts "Is openwsman-devel installed ?" + exit 1 + end ++# Explicitly add libwsman to linker flags since we used try_link instead of have_library ++$libs = append_library($libs, "wsman") + find_header 'wsman-xml-api.h', '/usr/include/openwsman' + +-unless have_library('wsman_client', 'wsmc_create') ++# Custom test for libwsman_client that includes facility definition ++unless try_link("#include \n#include \nint facility = LOG_DAEMON;\nint main() {\n wsmc_create(\"localhost\", 80, \"/wsman\", \"http\", \"user\", \"pass\");\n return 0;\n}", '-lwsman_client -lwsman') + STDERR.puts "Cannot find wsmc_create() in libwsman_client" + STDERR.puts "Is openwsman-devel installed ?" + exit 1 + end ++# Explicitly add libwsman_client to linker flags since we used try_link instead of have_library ++$libs = append_library($libs, "wsman_client") + find_header 'wsman-client-api.h', '/usr/include/openwsman' + + unless have_library('xml2', 'xmlNewDoc') +@@ -28,12 +49,25 @@ + end + find_header 'libxml/parser.h', '/usr/include/libxml2' + ++# Check for Ruby 3.3+ IO types ++have_type('rb_io_t', 'ruby/io.h') ++have_header 'ruby/thread.h' ++ + swig = find_executable("swig") raise "SWIG not found" unless swig major, minor, path = RUBY_VERSION.split(".") -raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i") -+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.6.2/include/ -o openwsman_wrap.c openwsman.i") ++ ++# Build SWIG include paths from CPATH environment variable ++swig_includes = "-I. -I/usr/include/openwsman" ++if ENV['CPATH'] ++ ENV['CPATH'].split(':').each do |path| ++ swig_includes += " -I#{path}" ++ end ++end ++raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} #{swig_includes} -o openwsman_wrap.c openwsman.i") $CPPFLAGS = "-I/usr/include/openwsman -I.." + create_makefile('_openwsman') ++ diff --git a/openwsman-2.6.2-openssl-1.1-fix.patch b/openwsman-2.6.2-openssl-1.1-fix.patch new file mode 100644 index 0000000..9322adb --- /dev/null +++ b/openwsman-2.6.2-openssl-1.1-fix.patch @@ -0,0 +1,135 @@ +diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h +--- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/src/server/shttpd/compat_unix.h 2025-02-03 09:11:35.072818890 +0100 +@@ -27,10 +27,6 @@ + pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0) + #endif /* !NO_THREADS */ + +-#ifndef SSL_LIB +-#define SSL_LIB "libssl.so" +-#endif +- + #define DIRSEP '/' + #define IS_DIRSEP_CHAR(c) ((c) == '/') + #define O_BINARY 0 +diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c +--- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/src/server/shttpd/io_ssl.c 2025-02-03 09:12:22.387355905 +0100 +@@ -11,28 +11,6 @@ + #include "defs.h" + + #if !defined(NO_SSL) +-struct ssl_func ssl_sw[] = { +- {"SSL_free", {0}}, +- {"SSL_accept", {0}}, +- {"SSL_connect", {0}}, +- {"SSL_read", {0}}, +- {"SSL_write", {0}}, +- {"SSL_get_error", {0}}, +- {"SSL_set_fd", {0}}, +- {"SSL_new", {0}}, +- {"SSL_CTX_new", {0}}, +-#if OPENSSL_VERSION_NUMBER < 0x10100000L +- {"SSLv23_server_method", {0}}, +- {"SSL_library_init", {0}}, +-#else +- {"TLS_server_method", {0}}, +- {"OPENSSL_init_ssl", {0}}, +-#endif +- {"SSL_CTX_use_PrivateKey_file", {0}}, +- {"SSL_CTX_use_certificate_file",{0}}, +- {NULL, {0}} +-}; +- + void + _shttpd_ssl_handshake(struct stream *stream) + { +diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c +--- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/src/server/shttpd/shttpd.c 2025-02-03 09:13:43.415562784 +0100 +@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch + int retval = FALSE; + EC_KEY* key; + +- /* Load SSL library dynamically */ +- if ((lib = dlopen(SSL_LIB, RTLD_LAZY)) == NULL) { +- _shttpd_elog(E_LOG, NULL, "set_ssl: cannot load %s", SSL_LIB); +- return (FALSE); +- } +- +- for (fp = ssl_sw; fp->name != NULL; fp++) +- if ((fp->ptr.v_void = dlsym(lib, fp->name)) == NULL) { +- _shttpd_elog(E_LOG, NULL,"set_ssl: cannot find %s", fp->name); +- return (FALSE); +- } +- + /* Initialize SSL crap */ + + #if OPENSSL_VERSION_NUMBER < 0x10100000L + SSL_library_init(); + if ((CTX = SSL_CTX_new(SSLv23_server_method())) == NULL) + #else +- OPENSSL_init_ssl(); ++ OPENSSL_init_ssl(0, NULL); + if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL) + #endif + _shttpd_report_ssl_error("SSL_CTX_new failed", NULL); +diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h +--- openwsman-2.8.1/src/server/shttpd/ssl.h.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/src/server/shttpd/ssl.h 2025-02-03 09:14:43.142975166 +0100 +@@ -12,55 +12,4 @@ + + #include + +-#else +- +-/* +- * Snatched from OpenSSL includes. I put the prototypes here to be independent +- * from the OpenSSL source installation. Having this, shttpd + SSL can be +- * built on any system with binary SSL libraries installed. +- */ +- +-typedef struct ssl_st SSL; +-typedef struct ssl_method_st SSL_METHOD; +-typedef struct ssl_ctx_st SSL_CTX; +- +-#define SSL_ERROR_WANT_READ 2 +-#define SSL_ERROR_WANT_WRITE 3 +-#define SSL_ERROR_SYSCALL 5 +-#define SSL_FILETYPE_PEM 1 +- +-#endif +- +-/* +- * Dynamically loaded SSL functionality +- */ +-struct ssl_func { +- const char *name; /* SSL function name */ +- union variant ptr; /* Function pointer */ +-}; +- +-extern struct ssl_func ssl_sw[]; +- +-#define FUNC(x) ssl_sw[x].ptr.v_func +- +-#define SSL_free(x) (* (void (*)(SSL *)) FUNC(0))(x) +-#define SSL_accept(x) (* (int (*)(SSL *)) FUNC(1))(x) +-#define SSL_connect(x) (* (int (*)(SSL *)) FUNC(2))(x) +-#define SSL_read(x,y,z) (* (int (*)(SSL *, void *, int)) FUNC(3))((x),(y),(z)) +-#define SSL_write(x,y,z) \ +- (* (int (*)(SSL *, const void *,int)) FUNC(4))((x), (y), (z)) +-#define SSL_get_error(x,y)(* (int (*)(SSL *, int)) FUNC(5))((x), (y)) +-#define SSL_set_fd(x,y) (* (int (*)(SSL *, int)) FUNC(6))((x), (y)) +-#define SSL_new(x) (* (SSL * (*)(SSL_CTX *)) FUNC(7))(x) +-#define SSL_CTX_new(x) (* (SSL_CTX * (*)(const SSL_METHOD *)) FUNC(8))(x) +-#if OPENSSL_VERSION_NUMBER < 0x10100000L +-#define SSLv23_server_method() (* (SSL_METHOD * (*)(void)) FUNC(9))() +-#define SSL_library_init() (* (int (*)(void)) FUNC(10))() +-#else +-#define TLS_server_method() (* (SSL_METHOD * (*)(void)) FUNC(9))() +-#define OPENSSL_init_ssl() (* (int (*)(void)) FUNC(10))() + #endif +-#define SSL_CTX_use_PrivateKey_file(x,y,z) (* (int (*)(SSL_CTX *, \ +- const char *, int)) FUNC(11))((x), (y), (z)) +-#define SSL_CTX_use_certificate_file(x,y,z) (* (int (*)(SSL_CTX *, \ +- const char *, int)) FUNC(12))((x), (y), (z)) diff --git a/openwsman-2.6.2-winrs-shebang.patch b/openwsman-2.6.2-winrs-shebang.patch deleted file mode 100644 index 87cdc61..0000000 --- a/openwsman-2.6.2-winrs-shebang.patch +++ /dev/null @@ -1,9 +0,0 @@ -diff -up openwsman-2.6.2/examples/winrs.rb.orig openwsman-2.6.2/examples/winrs.rb ---- openwsman-2.6.2/examples/winrs.rb.orig 2015-10-19 15:27:46.000000000 +0200 -+++ openwsman-2.6.2/examples/winrs.rb 2017-03-13 10:30:22.812169561 +0100 -@@ -1,3 +1,5 @@ -+#!/usr/bin/env ruby -+# - # winrs.rb - # - # Windows Remote Shell diff --git a/openwsman-2.6.5-http-status-line.patch b/openwsman-2.6.5-http-status-line.patch new file mode 100644 index 0000000..f571508 --- /dev/null +++ b/openwsman-2.6.5-http-status-line.patch @@ -0,0 +1,39 @@ +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c 2018-01-22 13:05:04.478923300 +0100 +@@ -344,6 +344,35 @@ DONE: + if (fault_reason == NULL) { + // this is a way to segfault, investigate + //fault_reason = shttpd_reason_phrase(status); ++ // ugly workaround follows... ++ switch (status) { ++ case 200: ++ fault_reason = "OK"; ++ break; ++ case 400: ++ fault_reason = "Bad request"; ++ break; ++ case 401: ++ fault_reason = "Unauthorized"; ++ break; ++ case 403: ++ fault_reason = "Forbidden"; ++ break; ++ case 404: ++ fault_reason = "Not found"; ++ break; ++ case 500: ++ fault_reason = "Internal Error"; ++ break; ++ case 501: ++ fault_reason = "Not implemented"; ++ break; ++ case 415: ++ fault_reason = "Unsupported Media Type"; ++ break; ++ default: ++ fault_reason = ""; ++ } + } + debug("Response status=%d (%s)", status, fault_reason); + diff --git a/openwsman-2.6.8-update-ssleay-conf.patch b/openwsman-2.6.8-update-ssleay-conf.patch new file mode 100644 index 0000000..c312af5 --- /dev/null +++ b/openwsman-2.6.8-update-ssleay-conf.patch @@ -0,0 +1,12 @@ +diff -up openwsman-2.7.1/etc/ssleay.cnf.orig openwsman-2.7.1/etc/ssleay.cnf +--- openwsman-2.7.1/etc/ssleay.cnf.orig 2021-11-09 08:27:48.577749509 +0100 ++++ openwsman-2.7.1/etc/ssleay.cnf 2021-11-09 08:28:10.499967010 +0100 +@@ -3,7 +3,7 @@ + # + + [ req ] +-default_bits = 1024 ++default_bits = 2048 + default_keyfile = privkey.pem + distinguished_name = req_distinguished_name + diff --git a/openwsman-2.7.2-gcc15-fix.patch b/openwsman-2.7.2-gcc15-fix.patch new file mode 100644 index 0000000..590ff14 --- /dev/null +++ b/openwsman-2.7.2-gcc15-fix.patch @@ -0,0 +1,24 @@ +diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c +--- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c 2025-02-03 09:30:36.905616375 +0100 +@@ -49,7 +49,7 @@ + */ + + static VALUE +-load_module() ++load_module(VALUE) + { + ruby_script(PLUGIN_FILE); + return rb_require(PLUGIN_FILE); +diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt +--- openwsman-2.8.1/src/server/CMakeLists.txt.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/src/server/CMakeLists.txt 2025-02-03 09:31:15.258241237 +0100 +@@ -48,7 +48,7 @@ IF( HAVE_LIBDL ) + TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES}) + ENDIF( HAVE_LIBDL ) + +-INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin) ++INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin) + + # + # diff --git a/openwsman-2.7.2-ssl-certs-gen-changes.patch b/openwsman-2.7.2-ssl-certs-gen-changes.patch new file mode 100644 index 0000000..0f0b96a --- /dev/null +++ b/openwsman-2.7.2-ssl-certs-gen-changes.patch @@ -0,0 +1,102 @@ +diff -up openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig openwsman-2.8.1/etc/owsmangencert.sh.cmake +--- openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/etc/owsmangencert.sh.cmake 2025-10-17 10:16:34.482996406 +0200 +@@ -1,10 +1,74 @@ +-#!/bin/sh +- + #!/bin/sh -e + + CERTFILE=@WSMANCONF_DIR@/servercert.pem + KEYFILE=@WSMANCONF_DIR@/serverkey.pem + CNFFILE=@WSMANCONF_DIR@/ssleay.cnf ++CAFILE=@WSMANCONF_DIR@/ca.crt ++DAYS=365 ++ ++function create_ssl_cnf ++{ ++ # Get minimum RSA key length at current security level ++ # This workarounds openssl not enforcing min. key length enforced by current security level ++ KEYSIZE=`grep min_rsa_size /etc/crypto-policies/state/CURRENT.pol | cut -d ' ' -f 3` ++ ++ # Create OpenSSL configuration files for generating certificates ++ echo "[ req ]" > $CNFFILE ++ echo "default_bits = $KEYSIZE" >> $CNFFILE ++ echo "default_keyfile = privkey.pem" >> $CNFFILE ++ echo "distinguished_name = req_distinguished_name" >> $CNFFILE ++ ++ echo "[ req_distinguished_name ]" >> $CNFFILE ++ echo "countryName = Country Name (2 letter code)" >> $CNFFILE ++ echo "countryName_default = GB" >> $CNFFILE ++ echo "countryName_min = 2" >> $CNFFILE ++ echo "countryName_max = 2" >> $CNFFILE ++ ++ echo "stateOrProvinceName = State or Province Name (full name)" >> $CNFFILE ++ echo "stateOrProvinceName_default = Some-State" >> $CNFFILE ++ ++ echo "localityName = Locality Name (eg, city)" >> $CNFFILE ++ ++ echo "organizationName = Organization Name (eg, company; recommended)" >> $CNFFILE ++ echo "organizationName_max = 64" >> $CNFFILE ++ ++ echo "organizationalUnitName = Organizational Unit Name (eg, section)" >> $CNFFILE ++ echo "organizationalUnitName_max = 64" >> $CNFFILE ++ ++ echo "commonName = server name (eg. ssl.domain.tld; required!!!)" >> $CNFFILE ++ echo "commonName_max = 80" >> $CNFFILE ++ ++ echo "emailAddress = Email Address" >> $CNFFILE ++ echo "emailAddress_max = 85" >> $CNFFILE ++} ++ ++function selfsign_sscg() ++{ ++ sscg --quiet \ ++ --lifetime "$DAYS" \ ++ --cert-key-file "$KEYFILE" \ ++ --cert-file "$CERTFILE" \ ++ --ca-file "$CAFILE" ++} ++ ++function selfsign_openssl() ++{ ++ ++ echo ++ echo creating selfsigned certificate ++ echo "replace it with one signed by a certification authority (CA)" ++ echo ++ echo enter your ServerName at the Common Name prompt ++ echo ++ ++ # use special .cnf, because with normal one no valid selfsigned ++ # certificate is created ++ ++ openssl req -days $DAYS $@ -config $CNFFILE \ ++ -new -x509 -nodes -out $CERTFILE \ ++ -keyout $KEYFILE ++ chmod 600 $KEYFILE ++} + + if [ "$1" != "--force" -a -f $KEYFILE ]; then + echo "$KEYFILE exists! Use \"$0 --force.\"" +@@ -15,18 +79,7 @@ if [ "$1" = "--force" ]; then + shift + fi + +-echo +-echo creating selfsigned certificate +-echo "replace it with one signed by a certification authority (CA)" +-echo +-echo enter your ServerName at the Common Name prompt +-echo +- +-# use special .cnf, because with normal one no valid selfsigned +-# certificate is created +- +-openssl req -days 365 $@ -config $CNFFILE \ +- -newkey rsa:2048 -x509 -nodes -out $CERTFILE \ +- -keyout $KEYFILE +-chmod 600 $KEYFILE ++create_ssl_cnf + ++# If sscg fails, try openssl ++selfsign_sscg || selfsign_openssl diff --git a/openwsman-2.8.1-fix-ruby-io.patch b/openwsman-2.8.1-fix-ruby-io.patch new file mode 100644 index 0000000..605bf91 --- /dev/null +++ b/openwsman-2.8.1-fix-ruby-io.patch @@ -0,0 +1,33 @@ +diff -up openwsman-2.8.1/bindings/openwsman.i.orig openwsman-2.8.1/bindings/openwsman.i +--- openwsman-2.8.1/bindings/openwsman.i.orig 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/bindings/openwsman.i 2025-10-21 16:56:01.025576984 +0200 +@@ -105,15 +105,8 @@ SWIGINTERNINLINE SV *SWIG_From_double S + #if HAVE_RUBY_THREAD_H /* New threading model */ + #include + #endif +-#if RUBY_VERSION > 18 +- #if HAVE_RB_IO_T +- #define rb_fptr_t rb_io_t +- #else +- #define rb_fptr_t struct rb_io +- #endif +-#else +- #define rb_fptr_t struct OpenFile +-#endif ++/* Use rb_io_t for Ruby 1.9+ */ ++#define rb_fptr_t rb_io_t + %} + + %typemap(in) FILE* { +@@ -122,11 +115,7 @@ SWIGINTERNINLINE SV *SWIG_From_double S + Check_Type($input, T_FILE); + GetOpenFile($input, fptr); + /*rb_io_check_writable(fptr);*/ +-#if RUBY_VERSION > 18 + $1 = rb_io_stdio_file(fptr); +-#else +- $1 = GetReadFile(fptr); +-#endif + } + + #endif /* SWIGRUBY */ diff --git a/openwsman-2.8.1-post-quantum.patch b/openwsman-2.8.1-post-quantum.patch new file mode 100644 index 0000000..0b9b7bb --- /dev/null +++ b/openwsman-2.8.1-post-quantum.patch @@ -0,0 +1,101 @@ +diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf +--- openwsman-2.7.2/etc/openwsman.conf.orig 2022-12-28 16:43:03.000000000 +0100 ++++ openwsman-2.7.2/etc/openwsman.conf 2025-05-27 08:03:57.890057721 +0200 +@@ -32,8 +32,12 @@ ipv6 = yes + + # the openwsman server certificate file, in .pem format + ssl_cert_file = /etc/openwsman/servercert.pem ++# the openwsman server certificate fallback file, in .pem format ++#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem + # the openwsman server private key, in .pem format + ssl_key_file = /etc/openwsman/serverkey.pem ++# the openwsman server private key fallback, in .pem format ++#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem + + # space-separated list of SSL protocols to *dis*able + # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2 +diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c +--- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig 2025-05-21 10:07:40.404532496 +0200 ++++ openwsman-2.7.2/src/server/shttpd/shttpd.c 2025-06-12 12:27:44.785904555 +0200 +@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch + char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols(); + char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list(); + int retval = FALSE; +- EC_KEY* key; + + /* Initialize SSL crap */ + +@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch + else + retval = TRUE; + +- /* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */ +- key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); +- if (key != NULL) { +- SSL_CTX_set_tmp_ecdh(CTX, key); +- EC_KEY_free(key); ++ /* Add fall back certificate/key pair */ ++ if (wsmand_options_get_ssl_cert_fallback_file() && ++ wsmand_options_get_ssl_key_fallback_file()) { ++ if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1) ++ _shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem); ++ else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1) ++ _shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem); ++ else ++ retval = TRUE; + } + + while (ssl_disabled_protocols) { +diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c +--- openwsman-2.7.2/src/server/wsmand-daemon.c.orig 2025-05-27 07:18:16.878974761 +0200 ++++ openwsman-2.7.2/src/server/wsmand-daemon.c 2025-05-27 07:22:06.832235764 +0200 +@@ -76,8 +76,10 @@ static int use_ipv6 = 0; + #endif + static int use_digest = 0; + static char *ssl_key_file = NULL; ++static char *ssl_key_fallback_file = NULL; + static char *service_path = DEFAULT_SERVICE_PATH; + static char *ssl_cert_file = NULL; ++static char *ssl_cert_fallback_file = NULL; + static char *ssl_disabled_protocols = NULL; + static char *ssl_cipher_list = NULL; + static char *pid_file = DEFAULT_PID_PATH; +@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini) + service_path = + iniparser_getstring(ini, "server:service_path", "/wsman"); + ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file"); ++ ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file"); + ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file"); ++ ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file"); + ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols"); + ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list"); + use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1); +@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v + return ssl_cert_file; + } + ++char *wsmand_options_get_ssl_key_fallback_file(void) ++{ ++ return ssl_key_fallback_file; ++} ++ ++char *wsmand_options_get_ssl_cert_fallback_file(void) ++{ ++ return ssl_cert_fallback_file; ++} ++ + char *wsmand_options_get_ssl_disabled_protocols(void) + { + return ssl_disabled_protocols; +diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h +--- openwsman-2.7.2/src/server/wsmand-daemon.h.orig 2025-05-27 07:15:56.869002037 +0200 ++++ openwsman-2.7.2/src/server/wsmand-daemon.h 2025-05-27 07:18:06.429846617 +0200 +@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void) + int wsmand_options_get_server_ssl_port(void); + char *wsmand_options_get_ssl_key_file(void); + char *wsmand_options_get_ssl_cert_file(void); ++char *wsmand_options_get_ssl_key_fallback_file(void); ++char *wsmand_options_get_ssl_cert_fallback_file(void); + char *wsmand_options_get_ssl_disabled_protocols(void); + char *wsmand_options_get_ssl_cipher_list(void); + int wsmand_options_get_digest(void); diff --git a/openwsman-2.8.1-rdoc-6_16.patch b/openwsman-2.8.1-rdoc-6_16.patch new file mode 100644 index 0000000..c0dc8b4 --- /dev/null +++ b/openwsman-2.8.1-rdoc-6_16.patch @@ -0,0 +1,18 @@ +diff -urp '--exclude=*~' openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb +--- openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb 2026-01-02 23:43:41.804273994 +0900 ++++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb 2026-01-02 23:56:06.991238037 +0900 +@@ -377,7 +377,13 @@ class RDoc::Parser::SWIG < RDoc::Parser + find_modifiers comment, meth_obj if comment + + #meth_obj.params = params +- meth_obj.start_collecting_tokens ++ # https://github.com/ruby/rdoc/pull/1471 changes the parameter for ++ # RDoc::TokenStream.start_collecting_tokens ++ if meth_obj.method(:start_collecting_tokens).arity == 1 ++ meth_obj.start_collecting_tokens :ruby ++ else ++ meth_obj.start_collecting_tokens ++ end + begin + RDoc::const_get "RubyToken" + tk = RDoc::RubyToken::Token.new nil, 1, 1 diff --git a/openwsman-2.8.1-rdoc-ruby34.patch b/openwsman-2.8.1-rdoc-ruby34.patch new file mode 100644 index 0000000..de30428 --- /dev/null +++ b/openwsman-2.8.1-rdoc-ruby34.patch @@ -0,0 +1,29 @@ +--- openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb 2025-01-23 10:23:52.000000000 +0100 ++++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb 2025-11-10 15:00:00.000000000 +0100 +@@ -108,10 +108,24 @@ class RDoc::Parser::SWIG < RDoc::Parser + ## + # Prepare to parse a SWIG file + +- def initialize(top_level, file_name, content, options, stats) +- super ++ def initialize(top_level, file_name, content, options, stats = nil) ++ # RDoc 6.6+ (Ruby 3.3+) removed the stats parameter from Parser.initialize ++ # Check the arity of the parent class initialize method to determine which API we're using ++ parent_arity = RDoc::Parser.instance_method(:initialize).arity ++ ++ if parent_arity == 4 || parent_arity == -5 ++ # RDoc 6.6+: only pass 4 arguments to super ++ super(top_level, file_name, content, options) ++ # Create a dummy stats object for compatibility ++ @stats = Object.new ++ def @stats.method_missing(m, *args); end ++ else ++ # Older RDoc: pass all 5 arguments including stats ++ super(top_level, file_name, content, options, stats) ++ @stats = stats ++ end + + @known_classes = RDoc::KNOWN_CLASSES.dup + @content = handle_tab_width handle_ifdefs_in(@content) + @renames = {} # maps old_name => [ new_name, args ] + @aliases = {} # maps name => [ alias_name, args ] diff --git a/openwsman.fc b/openwsman.fc new file mode 100644 index 0000000..00d0643 --- /dev/null +++ b/openwsman.fc @@ -0,0 +1,7 @@ +/usr/lib/systemd/system/openwsmand.* -- gen_context(system_u:object_r:openwsman_unit_file_t,s0) + +/usr/sbin/openwsmand -- gen_context(system_u:object_r:openwsman_exec_t,s0) + +/var/log/wsmand.* -- gen_context(system_u:object_r:openwsman_log_t,s0) + +/var/run/wsmand.* -- gen_context(system_u:object_r:openwsman_run_t,s0) diff --git a/openwsman.if b/openwsman.if new file mode 100644 index 0000000..747853a --- /dev/null +++ b/openwsman.if @@ -0,0 +1,79 @@ +## WS-Management Server + +######################################## +## +## Execute openwsman in the openwsman domin. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`openwsman_domtrans',` + gen_require(` + type openwsman_t, openwsman_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, openwsman_exec_t, openwsman_t) +') +######################################## +## +## Execute openwsman server in the openwsman domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`openwsman_systemctl',` + gen_require(` + type openwsman_t; + type openwsman_unit_file_t; + ') + + systemd_exec_systemctl($1) + init_reload_services($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 openwsman_unit_file_t:file read_file_perms; + allow $1 openwsman_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, openwsman_t) +') + + +######################################## +## +## All of the rules required to administrate +## an openwsman environment +## +## +## +## Domain allowed access. +## +## +## +# +interface(`openwsman_admin',` + gen_require(` + type openwsman_t; + type openwsman_unit_file_t; + ') + + allow $1 openwsman_t:process { signal_perms }; + ps_process_pattern($1, openwsman_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 openwsman_t:process ptrace; + ') + + openwsman_systemctl($1) + admin_pattern($1, openwsman_unit_file_t) + allow $1 openwsman_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') diff --git a/openwsman.spec b/openwsman.spec index 5d5866e..1a56b52 100644 --- a/openwsman.spec +++ b/openwsman.spec @@ -1,183 +1,200 @@ +# RubyGems's macros expect gem_name to exist. +%global gem_name %{name} -%if ! (0%{?fedora} > 12 || 0%{?rhel} > 5) -%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} -%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} +# defining macros needed by SELinux +# unless running a flatpak build. +%if 0%{?flatpak} +%global with_selinux 0 +%else +%global with_selinux 1 +%global selinuxtype targeted +%global modulename openwsman %endif -# RubyGems's macros expect gem_name to exist. -%global gem_name %{name} +# Bindings install in the wrong path for a flatpak build; this could be fixed, but +# we don't currently need the bindings for any Flatpak'ed application +%if 0%{?flatpak} +%global with_ruby 0 +%global with_perl 0 +%global with_python 0 +%else +%global with_ruby 1 +%global with_perl 1 +%global with_python 1 +%endif -Name: openwsman -BuildRequires: swig -BuildRequires: libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel -BuildRequires: python python-devel ruby ruby-devel rubygems-devel perl -BuildRequires: python python-devel perl -BuildRequires: perl-devel pkgconfig openssl-devel -BuildRequires: cmake -BuildRequires: systemd-units -Version: 2.6.2 -Release: 4%{?dist} -Url: http://www.openwsman.org/ -License: BSD -Group: Applications/System -Summary: Open source Implementation of WS-Management -# You can get this tarball here: -# https://github.com/Openwsman/openwsman/archive/v%{version}.tar.gz -Source: %{name}-%{version}.tar.gz +Name: openwsman +Version: 2.8.1 +Release: 13%{?dist} +Summary: Open source Implementation of WS-Management + +License: BSD-3-Clause AND MIT +URL: http://www.openwsman.org/ +Source0: https://github.com/Openwsman/openwsman/archive/v%{version}.tar.gz # help2man generated manpage for openwsmand binary -Source1: openwsmand.8.gz +Source1: openwsmand.8.gz # service file for systemd -Source2: openwsmand.service +Source2: openwsmand.service # script for testing presence of the certificates in ExecStartPre -Source3: owsmantestcert.sh -Patch1: openwsman-2.2.7-libssl.patch -Patch2: openwsman-2.4.0-pamsetup.patch -Patch3: openwsman-2.4.12-ruby-binding-build.patch -# Patch4: adds shebang to winrs ruby script, already upstream -Patch4: openwsman-2.6.2-winrs-shebang.patch +Source3: owsmantestcert.sh +# Source100-102: selinux policy for openwsman, extracted +# from https://github.com/fedora-selinux/selinux-policy +%if 0%{with_selinux} +Source100: %{modulename}.te +Source101: %{modulename}.if +Source102: %{modulename}.fc +%endif +Patch1: openwsman-2.4.0-pamsetup.patch +Patch2: openwsman-2.4.12-ruby-binding-build.patch +Patch3: openwsman-2.6.2-openssl-1.1-fix.patch +Patch4: openwsman-2.6.5-http-status-line.patch +Patch5: openwsman-2.6.8-update-ssleay-conf.patch +Patch6: openwsman-2.7.2-gcc15-fix.patch +Patch7: openwsman-2.8.1-post-quantum.patch +Patch8: openwsman-2.7.2-ssl-certs-gen-changes.patch +Patch9: openwsman-2.8.1-rdoc-ruby34.patch +Patch10: openwsman-2.8.1-fix-ruby-io.patch +Patch11: openwsman-2.8.1-rdoc-6_16.patch +BuildRequires: make +BuildRequires: swig +BuildRequires: libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel +%if %{with_python} +BuildRequires: python3 python3-devel +%endif +%if %{with_ruby} +BuildRequires: ruby ruby-devel rubygems-devel +%endif +%if %{with_perl} +BuildRequires: perl-interpreter perl-devel perl-generators +%endif +BuildRequires: pkgconfig openssl-devel +BuildRequires: cmake +BuildRequires: systemd-units +BuildRequires: gcc gcc-c++ +BuildRequires: libxcrypt-devel %description Openwsman is a project intended to provide an open-source -implementation of the Web Services Management specipication +implementation of the Web Services Management specification (WS-Management) and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services specifications and usage requirements that exposes a set of operations focused on and covers all system management aspects. - - - %package -n libwsman1 -License: BSD -Group: System Environment/Libraries -Summary: Open source Implementation of WS-Management -Provides: %{name} = %{version}-%{release} -Obsoletes: %{name} < %{version}-%{release} +License: BSD-3-Clause AND MIT +Summary: Open source Implementation of WS-Management +Provides: %{name} = %{version}-%{release} +Obsoletes: %{name} < %{version}-%{release} %description -n libwsman1 -Openwsman library for packages dependent on openwsman - - - +Openwsman library for packages dependent on openwsman. %package -n libwsman-devel -License: BSD -Group: Development/Libraries -Summary: Open source Implementation of WS-Management -Provides: %{name}-devel = %{version}-%{release} -Obsoletes: %{name}-devel < %{version}-%{release} -Requires: libwsman1 = %{version}-%{release} -Requires: %{name}-server = %{version}-%{release} -Requires: %{name}-client = %{version}-%{release} -Requires: sblim-sfcc-devel libxml2-devel pam-devel -Requires: libcurl-devel +License: BSD-3-Clause AND MIT +Summary: Open source Implementation of WS-Management +Provides: %{name}-devel = %{version}-%{release} +Obsoletes: %{name}-devel < %{version}-%{release} +Requires: libwsman1 = %{version}-%{release} +Requires: %{name}-server = %{version}-%{release} +Requires: %{name}-client = %{version}-%{release} +Requires: sblim-sfcc-devel libxml2-devel pam-devel +Requires: libcurl-devel %description -n libwsman-devel -Development files for openwsman - - +Development files for openwsman. %package client -License: BSD -Group: System Environment/Libraries -Summary: Openwsman Client libraries +License: BSD-3-Clause AND MIT +Summary: Openwsman Client libraries %description client -Openwsman Client libraries - - - +Openwsman Client libraries. %package server -License: BSD -Group: System Environment/Daemons -Requires: net-tools -Requires(post): chkconfig -Requires(preun): chkconfig -Requires(postun): initscripts -Summary: Openwsman Server and service libraries -Requires: libwsman1 = %{version}-%{release} +License: BSD-3-Clause AND MIT +Summary: Openwsman Server and service libraries +Requires: libwsman1 = %{version}-%{release} +%if 0%{?with_selinux} +# This ensures that the *-selinux package and all it’s dependencies are not pulled +# into containers and other systems that do not use SELinux +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +%endif %description server -Openwsman Server and service libraries - - - - -%package python -License: BSD -Group: Development/Libraries -Summary: Python bindings for openwsman client API -Requires: python -Requires: libwsman1 = %{version}-%{release} - -%description python -This package provides Python bindings to access the openwsman client -API. - +Openwsman Server and service libraries. +%if %{with_python} +%package python3 +License: BSD-3-Clause AND MIT +Summary: Python bindings for openwsman client API +Requires: %{__python3} +Requires: libwsman1 = %{version}-%{release} +%{?python_provide:%python_provide python3-openwsman} +%description python3 +This package provides Python3 bindings to access the openwsman client API. +%endif +%if %{with_ruby} %package -n rubygem-%{gem_name} -License: BSD -Group: Development/Libraries -Summary: Ruby client bindings for Openwsman -Obsoletes: %{name}-ruby < %{version}-%{release} +License: BSD-3-Clause AND MIT +Summary: Ruby client bindings for Openwsman +Obsoletes: %{name}-ruby < %{version}-%{release} +Requires: libwsman1 = %{version}-%{release} %description -n rubygem-%{gem_name} The openwsman gem provides a Ruby API to manage systems using the WS-Management protocol. %package -n rubygem-%{gem_name}-doc -Summary: Documentation for %{name} -Group: Documentation -Requires: rubygem-%{gem_name} = %{version}-%{release} -BuildArch: noarch +Summary: Documentation for %{name} +Requires: rubygem-%{gem_name} = %{version}-%{release} +BuildArch: noarch %description -n rubygem-%{gem_name}-doc Documentation for rubygem-%{gem_name} +%endif - - - +%if %{with_perl} %package perl -License: BSD -Group: Development/Libraries -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) -Summary: Perl bindings for openwsman client API -Requires: libwsman1 = %{version}-%{release} +License: BSD-3-Clause AND MIT +Summary: Perl bindings for openwsman client API +Requires: libwsman1 = %{version}-%{release} %description perl This package provides Perl bindings to access the openwsman client API. +%endif - - - +%if %{with_ruby} %package winrs -Summary: Windows Remote Shell -Requires: rubygem-%{gem_name} = %{version}-%{release} +Summary: Windows Remote Shell +Requires: rubygem-%{gem_name} = %{version}-%{release} %description winrs -This is a command line tool for the Windows Remote Shell protocol. You -can use it to send shell commands to a remote Windows hosts. - +This is a command line tool for the Windows Remote Shell protocol. +You can use it to send shell commands to a remote Windows hosts. +%endif +%if 0%{?with_selinux} +# SELinux subpackage +%package selinux +Summary: openwsman SELinux policy +BuildArch: noarch +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +BuildRequires: selinux-policy-devel +%{?selinux_requires} +%description selinux +Custom SELinux policy module +%endif %prep %setup -q -%patch1 -p1 -b .libssl -%patch2 -p1 -b .pamsetup -%patch3 -p1 -b .ruby-binding-build -%patch4 -p1 -b .winrs-shebang -# support ruby 2.2 -pushd bindings/ruby -cat rdoc2.1 | sed -e 's|rdoc2_1|rdoc2_2|' > rdoc2.2 -chmod 0755 rdoc2.2 -ln -sf %{_bindir}/rdoc rdoc2_2.rb -popd +%autopatch -p1 %build # Removing executable permissions on .c and .h files to fix rpmlint warnings. @@ -187,44 +204,70 @@ rm -rf build mkdir build export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -DFEDORA -DNO_SSL_CALLBACK" -export SSL_LIB=`readlink %{_libdir}/libssl.so` -export CFLAGS="-D_GNU_SOURCE -fPIE -DPIE" -export LDFLAGS="$LDFLAGS -Wl,-z,now -pie" +export CFLAGS="$RPM_OPT_FLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now" +export CXXFLAGS="$RPM_OPT_FLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now" cd build cmake \ - -DCMAKE_INSTALL_PREFIX=/usr \ - -DCMAKE_VERBOSE_MAKEFILE=TRUE \ - -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_C_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS -fno-strict-aliasing" \ - -DCMAKE_CXX_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS" \ - -DCMAKE_SKIP_RPATH=1 \ - -DPACKAGE_ARCHITECTURE=`uname -m` \ - -DLIB=%{_lib} \ - .. + -DCMAKE_INSTALL_PREFIX=%{_prefix} \ + -DCMAKE_VERBOSE_MAKEFILE=TRUE \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_C_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS -fno-strict-aliasing" \ + -DCMAKE_CXX_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS" \ + -DCMAKE_SKIP_RPATH=1 \ + -DPACKAGE_ARCHITECTURE=`uname -m` \ + -DLIB=%{_lib} \ + -DBUILD_JAVA=no \ + -DBUILD_PYTHON=no \ +%if ! %{with_python} + -DBUILD_PYTHON3=no \ +%endif +%if ! %{with_perl} + -DBUILD_PERL=no \ +%endif +%if ! %{with_ruby} + -DBUILD_RUBY=no \ +%endif + .. -make CFLAGS="-DSSL_LIB='\"$SSL_LIB\"'" +make +%if %{with_ruby} # Make the freshly build openwsman libraries available to build the gem's # binary extension. -export LIBRARY_PATH=/builddir/build/BUILD/%{name}-%{version}/build/src/lib -export CPATH=/builddir/build/BUILD/%{name}-%{version}/include/ -export LD_LIBRARY_PATH=/builddir/build/BUILD/%{name}-%{version}/build/src/lib/ +export LIBRARY_PATH=%{_builddir}/%{name}-%{version}/build/src/lib +export CPATH=%{_builddir}/%{name}-%{version}/include/ +export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/build/src/lib/ %gem_install -n ./bindings/ruby/%{name}-%{version}.gem +%endif + +%if 0%{?with_selinux} +# SELinux policy (originally from selinux-policy-contrib) +# this policy module will override the production module +mkdir selinux +cp -p %{SOURCE100} %{SOURCE101} %{SOURCE102} selinux/ +make -f %{_datadir}/selinux/devel/Makefile %{modulename}.pp +bzip2 -9 %{modulename}.pp +%endif %install cd build +%if %{with_ruby} # Do not install the ruby extension, we are proviging the rubygem- instead. echo -n > bindings/ruby/cmake_install.cmake +%endif -make DESTDIR=%{buildroot} install +%make_install cd .. rm -f %{buildroot}/%{_libdir}/*.la rm -f %{buildroot}/%{_libdir}/openwsman/plugins/*.la rm -f %{buildroot}/%{_libdir}/openwsman/authenticators/*.la +%if %{with_ruby} [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsmanplugin.rb +[ -d %{buildroot}/%{ruby_sitelibdir} ] && rm -f %{buildroot}/%{ruby_sitelibdir}/openwsmanplugin.rb [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsman.rb +%endif mkdir -p %{buildroot}%{_sysconfdir}/init.d install -m 644 etc/openwsman.conf %{buildroot}/%{_sysconfdir}/openwsman install -m 644 etc/openwsman_client.conf %{buildroot}/%{_sysconfdir}/openwsman @@ -240,24 +283,28 @@ install -m 644 include/wsman-xml.h %{buildroot}/%{_includedir}/openwsman install -m 644 include/wsman-xml-binding.h %{buildroot}/%{_includedir}/openwsman install -m 644 include/wsman-dispatcher.h %{buildroot}/%{_includedir}/openwsman +%if %{with_ruby} mkdir -p %{buildroot}%{gem_dir} cp -pa ./build%{gem_dir}/* \ - %{buildroot}%{gem_dir}/ + %{buildroot}%{gem_dir}/ rm -rf %{buildroot}%{gem_instdir}/ext mkdir -p %{buildroot}%{gem_extdir_mri} cp -a ./build%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/ +%else +rm -f %{buildroot}%{_bindir}/winrs +%endif -# rename winrs.rb -> winrs -mv %{buildroot}/%{_bindir}/winrs.rb %{buildroot}%{_bindir}/winrs +%if 0%{?with_selinux} +install -D -m 0644 build/%{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2 +install -D -p -m 0644 build/selinux/%{modulename}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if +%endif -%post -n libwsman1 -p /sbin/ldconfig - -%postun -n libwsman1 -p /sbin/ldconfig +%ldconfig_scriptlets -n libwsman1 %post server -/sbin/ldconfig +%{?ldconfig} %systemd_post openwsmand.service %preun server @@ -266,11 +313,31 @@ mv %{buildroot}/%{_bindir}/winrs.rb %{buildroot}%{_bindir}/winrs %postun server rm -f /var/log/wsmand.log %systemd_postun_with_restart openwsmand.service -/sbin/ldconfig +%{?ldconfig} -%post client -p /sbin/ldconfig +%ldconfig_scriptlets client -%postun client -p /sbin/ldconfig +%if 0%{?with_selinux} +# SELinux contexts are saved so that only affected files can be +# relabeled after the policy module installation +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2 +%selinux_relabel_post -s %{selinuxtype} + +if [ "$1" -le "1" ]; then # First install + # the service needs to be restarted for the custom label to be applied + %systemd_postun_with_restart openwsmand.service +fi + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{modulename} + %selinux_relabel_post -s %{selinuxtype} +fi +%endif %files -n libwsman1 %doc AUTHORS COPYING ChangeLog README.md TODO @@ -279,18 +346,20 @@ rm -f /var/log/wsmand.log %{_libdir}/libwsman_curl_client_transport.so.* %files -n libwsman-devel +%doc AUTHORS COPYING ChangeLog README.md %{_includedir}/* %{_libdir}/pkgconfig/* %{_libdir}/*.so -%doc AUTHORS COPYING ChangeLog README.md -%files python -%{python_sitearch}/*.so -%{python_sitearch}/*.py -%{python_sitearch}/*.pyc -%{python_sitearch}/*.pyo +%if %{with_python} +%files python3 %doc AUTHORS COPYING ChangeLog README.md +%{python3_sitearch}/*.so +%{python3_sitearch}/*.py +%{python3_sitearch}/__pycache__/* +%endif +%if %{with_ruby} %files -n rubygem-%{gem_name} %doc AUTHORS COPYING ChangeLog README.md %dir %{gem_instdir} @@ -298,16 +367,22 @@ rm -f /var/log/wsmand.log %{gem_extdir_mri} %exclude %{gem_cache} %{gem_spec} +%endif +%if %{with_ruby} %files -n rubygem-%{gem_name}-doc %doc %{gem_docdir} +%endif +%if %{with_perl} %files perl +%doc AUTHORS COPYING ChangeLog README.md %{perl_vendorarch}/openwsman.so %{perl_vendorlib}/openwsman.pm -%doc AUTHORS COPYING ChangeLog README.md +%endif %files server +%doc AUTHORS COPYING ChangeLog README.md # Don't remove *.so files from the server package. # the server fails to start without these files. %dir %{_sysconfdir}/openwsman @@ -324,24 +399,348 @@ rm -f /var/log/wsmand.log %dir %{_libdir}/openwsman/plugins %{_libdir}/openwsman/plugins/*.so %{_libdir}/openwsman/plugins/*.so.* -%{_sbindir}/openwsmand +%{_bindir}/openwsmand %{_libdir}/libwsman_server.so.* %{_mandir}/man8/* -%doc AUTHORS COPYING ChangeLog README.md %files client +%doc AUTHORS COPYING ChangeLog README.md %{_libdir}/libwsman_clientpp.so.* %config(noreplace) %{_sysconfdir}/openwsman/openwsman_client.conf -%doc AUTHORS COPYING ChangeLog README.md +%if %{with_ruby} %files winrs -%attr(0755,root,root) %{_bindir}/winrs +%{_bindir}/winrs +%endif +%if 0%{?with_selinux} +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.* +%{_datadir}/selinux/devel/include/distributed/%{modulename}.if +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename} +%endif %changelog -* Mon Mar 13 2017 Vitezslav Crhonek - 2.6.2-4 -- Add shebang to winrs ruby script, make it executable - Resolves: #1387087 +* Thu Jan 08 2026 Vitezslav Crhonek - 2.8.1-13 +- Fix bogus 'sscg' arguments + +* Fri Jan 02 2026 Mamoru TASAKA - 2.8.1-12 +- Support rdoc 6.16 and above (for ruby4.0) + +* Wed Nov 12 2025 Vitezslav Crhonek - 2.8.1-11 +- Update OpenSSL certificates set up +- Fix ruby binding, enable it + +* Fri Sep 19 2025 Python Maint - 2.8.1-10 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 2.8.1-9 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Thu Jul 24 2025 Fedora Release Engineering - 2.8.1-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Mon Jul 07 2025 Jitka Plesnikova - 2.8.1-7 +- Perl 5.42 rebuild + +* Tue Jun 17 2025 Vitezslav Crhonek - 2.8.1-6 +- Update to better support post-quantum cryptography + +* Mon Jun 09 2025 Python Maint - 2.8.1-5 +- Rebuilt for Python 3.14 + +* Mon Jun 09 2025 Vitezslav Crhonek - 2.8.1-4 +- Remove deprecated path from systemd service file + +* Tue Jun 03 2025 Python Maint - 2.8.1-3 +- Rebuilt for Python 3.14 + +* Thu Apr 10 2025 Vitezslav Crhonek - 2.8.1-2 +- Build winrs only when ruby binding is enabled + +* Mon Apr 07 2025 Vitezslav Crhonek - 2.8.1-1 +- Update to openwsman-2.8.1 + +* Fri Feb 28 2025 Vitezslav Crhonek - 2.7.2-16 +- Update minimum required cmake version + +* Sat Feb 01 2025 Björn Esser - 2.7.2-15 +- Add explicit BR: libxcrypt-devel + +* Thu Jan 23 2025 Vitezslav Crhonek - 2.7.2-14 +- Fix FTBFS with GCC 15, bin and sbin unification + +* Fri Jan 17 2025 Fedora Release Engineering - 2.7.2-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Wed Jan 08 2025 Mamoru TASAKA - 2.7.2-12 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 + +* Thu Jul 18 2024 Fedora Release Engineering - 2.7.2-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jun 25 2024 Vitezslav Crhonek - 2.7.2-10 +- Rebuild + Resolves: #2290726 + +* Tue Jun 18 2024 Python Maint - 2.7.2-9 +- Rebuilt for Python 3.13 + +* Wed Jun 12 2024 Jitka Plesnikova - 2.7.2-8 +- Perl 5.40 rebuild + +* Fri Jun 07 2024 Python Maint - 2.7.2-7 +- Rebuilt for Python 3.13 + +* Fri May 10 2024 Vitezslav Crhonek - 2.7.2-6 +- Update license tags in subpackages to SPDX format + +* Thu Jan 25 2024 Fedora Release Engineering - 2.7.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Vitezslav Crhonek - 2.7.2-4 +- Fix FTBFS + Resolves: #2259165 + +* Sun Jan 21 2024 Fedora Release Engineering - 2.7.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Jan 03 2024 Mamoru TASAKA - 2.7.2-2 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 + +* Thu Aug 31 2023 Vitezslav Crhonek - 2.7.2-1 +- Update to openwsman-2.7.2 + +* Thu Jul 20 2023 Fedora Release Engineering - 2.7.1-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 2.7.1-13 +- Perl 5.38 rebuild + +* Wed Jun 14 2023 Python Maint - 2.7.1-12 +- Rebuilt for Python 3.12 + +* Tue Feb 14 2023 Vitezslav Crhonek - 2.7.1-11 +- SPDX migration + +* Thu Jan 19 2023 Fedora Release Engineering - 2.7.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Wed Jan 04 2023 Mamoru TASAKA - 2.7.1-9 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2 + +* Fri Oct 21 2022 Vitezslav Crhonek - 2.7.1-8 +- Fix Ruby bindings for swig 4.1 (backported from upstream) + Resolves: #2136510 +- Remove mixed use of spaces and tabs from spec file + +* Fri Jul 22 2022 Fedora Release Engineering - 2.7.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Wed Jul 20 2022 Vitezslav Crhonek - 2.7.1-6 +- Improve handling of HTTP 401 Unauthorized + +* Wed Jun 15 2022 Python Maint - 2.7.1-5 +- Rebuilt for Python 3.11 + +* Mon May 30 2022 Jitka Plesnikova - 2.7.1-4 +- Perl 5.36 rebuild + +* Thu Jan 27 2022 Mamoru TASAKA - 2.7.1-3 +- F-36: rebuild against ruby31 + +* Thu Jan 20 2022 Fedora Release Engineering - 2.7.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Nov 11 2021 Vitezslav Crhonek - 2.7.1-1 +- Update to openwsman-2.7.1 + +* Tue Sep 14 2021 Sahana Prasad - 2.7.0-6 +- Rebuilt with OpenSSL 3.0.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 2.7.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Jun 08 2021 Vitezslav Crhonek - 2.7.0-4 +- Incorporate -selinux subpackage + See https://fedoraproject.org/wiki/SELinux/IndependentPolicy + +* Fri Jun 04 2021 Python Maint - 2.7.0-3 +- Rebuilt for Python 3.10 + +* Fri May 21 2021 Jitka Plesnikova - 2.7.0-2 +- Perl 5.34 rebuild + +* Tue Mar 09 2021 Vitezslav Crhonek - 2.7.0-1 +- Update to openwsman-2.7.0 (thanks for a patch to Bastian Germann) + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2.6.8-20 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Tue Jan 26 2021 Fedora Release Engineering - 2.6.8-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jan 06 2021 Mamoru TASAKA - 2.6.8-18 +- F-34: rebuild against ruby 3.0 + +* Tue Sep 22 2020 Vitezslav Crhonek - 2.6.8-17 +- Use make macros, patch by Tom Stellard + (https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro) +- Update flags, enable LTO +- Remove RANDFILE and increase default bits in ssleay.conf + +* Tue Jul 28 2020 Fedora Release Engineering - 2.6.8-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 08 2020 Jeff Law - 2.6.8-15 +- Disable LTO + +* Mon Jun 22 2020 Jitka Plesnikova - 2.6.8-14 +- Perl 5.32 rebuild + +* Tue May 26 2020 Miro Hrončok - 2.6.8-13 +- Rebuilt for Python 3.9 + +* Wed Jan 29 2020 Fedora Release Engineering - 2.6.8-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sat Jan 18 2020 Mamoru TASAKA - 2.6.8-11 +- F-32: rebuild against ruby27 + +* Thu Oct 03 2019 Miro Hrončok - 2.6.8-10 +- Rebuilt for Python 3.8.0rc1 (#1748018) + +* Mon Aug 19 2019 Miro Hrončok - 2.6.8-9 +- Rebuilt for Python 3.8 + +* Thu Jul 25 2019 Fedora Release Engineering - 2.6.8-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu May 30 2019 Jitka Plesnikova - 2.6.8-7 +- Perl 5.30 rebuild + +* Mon Apr 01 2019 Vitezslav Crhonek - 2.6.8-6 +- Add requires libwsman1 for rubygem-openwsman + +* Wed Mar 13 2019 Vitezslav Crhonek - 2.6.8-5 +- Fix CVE-2019-3816 + Resolves: #1687760 +- Fix CVE-2019-3833 + Resolves: #1687762 +- Remove Dist Tag from the oldest changelog entry + +* Fri Feb 01 2019 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 21 2019 Mamoru TASAKA - 2.6.8-3 +- F-30: rebuild against ruby26 + +* Mon Jan 14 2019 Björn Esser - 2.6.8-2 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Thu Nov 22 2018 Vitezslav Crhonek - 2.6.8-1 +- Update to openwsman-2.6.8 + +* Wed Nov 14 2018 Vitezslav Crhonek - 2.6.5-10 +- Reflect changes in libcurl error codes + Resolves: #1649393 + +* Mon Oct 01 2018 Vitezslav Crhonek - 2.6.5-9 +- Require the Python interpreter directly instead of using the package name + +* Fri Jul 13 2018 Fedora Release Engineering - 2.6.5-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Tue Jul 03 2018 Petr Pisar - 2.6.5-7 +- Perl 5.28 rebuild + +* Thu Jun 28 2018 Jitka Plesnikova - 2.6.5-6 +- Perl 5.28 rebuild + +* Tue Jun 19 2018 Miro Hrončok - 2.6.5-5 +- Rebuilt for Python 3.7 + +* Tue Jun 19 2018 Miro Hrončok - 2.6.5-4 +- Rebuilt for Python 3.7 + +* Thu Feb 22 2018 Vitezslav Crhonek - 2.6.5-3 +- Fix wrong SSL_CTX_set_cipher_list() retval check +- Add BuildRequires gcc and gcc-c++ +- Explicitly disable build of java bindings (build fails if java-devel is installed) + +* Thu Feb 08 2018 Fedora Release Engineering - 2.6.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Tue Jan 23 2018 Vitezslav Crhonek - 2.6.5-1 +- Update to openwsman-2.6.5 +- Simplify python binding build and drop python2 subpackage +- Fix malformed HTTP 200 status line + +* Sat Jan 20 2018 Björn Esser - 2.6.3-11.git4391e5c +- Rebuilt for switch to libxcrypt + +* Sat Jan 6 2018 Mamoru TASAKA - 2.6.3-10.git4391e5c +- F-28: rebuild for ruby 2.5 +- Backport git patches to support ruby 2.5 + +* Wed Oct 04 2017 Vitezslav Crhonek - 2.6.3-9.git +- Remove unnecessary net-tools requirement + Resolves: #1496142 + +* Tue Sep 12 2017 Vitezslav Crhonek - 2.6.3-8.git4391e5c +- Spec file clean up (removed RPM Groups tags, removed obsolete chkconfig/initscripts + dependencies, improved readability, fixed indentation) +- Updated openssl-1.1 patch to support builds with older openssl versions + +* Sun Aug 20 2017 Zbigniew Jędrzejewski-Szmek - 2.6.3-7.git4391e5c +- Add Provides for the old name without %%_isa + +* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 2.6.3-6.git4391e5c +- Python 2 binary package renamed to python2-openwsman + See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 + +* Thu Aug 03 2017 Fedora Release Engineering - 2.6.3-5.git4391e5c +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 2.6.3-4.git4391e5c +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jun 04 2017 Jitka Plesnikova - 2.6.3-3.git4391e5c +- Perl 5.26 rebuild + +* Sat Feb 11 2017 Fedora Release Engineering - 2.6.3-2.git4391e5c +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Tue Jan 17 2017 Vitezslav Crhonek - 2.6.3-1.git4391e5c +- Update to openwsman-2.6.3 from upstream VCS + (because it contains shttpd 1.42) + +* Thu Jan 12 2017 Vít Ondruch - 2.6.2-11 +- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.4 + +* Mon Jan 09 2017 Vitezslav Crhonek - 2.6.2-10 +- Disable SSL protocols listed in config file + +* Tue Jan 03 2017 Vitezslav Crhonek - 2.6.2-9 +- Port to openssl 1.1.0 + Resolves: #1383992 + +* Mon Dec 19 2016 Miro Hrončok - 2.6.2-8 +- Rebuild for Python 3.6 + +* Thu Aug 11 2016 Vitezslav Crhonek - 2.6.2-7 +- Add openwsman-python3 subpackage + Resolves: #1354481 + +* Tue Jul 19 2016 Fedora Release Engineering - 2.6.2-6 +- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages + +* Sun May 15 2016 Jitka Plesnikova - 2.6.2-5 +- Perl 5.24 rebuild + +* Tue Mar 22 2016 Vitezslav Crhonek - 2.6.2-4 +- Remove SSL_LIB acquired by readlink from CFLAGS * Thu Feb 04 2016 Fedora Release Engineering - 2.6.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild @@ -561,5 +960,5 @@ rm -f /var/log/wsmand.log * Mon Sep 22 2008 Matt Domsch - 2.1.0-1 - update to 2.1.0, resolves security issues -* Tue Aug 19 2008 - 2.0.0-1%{?dist} +* Tue Aug 19 2008 - 2.0.0-1 - Modified the spec file to adhere to fedora packaging guidelines. diff --git a/openwsman.te b/openwsman.te new file mode 100644 index 0000000..e00816c --- /dev/null +++ b/openwsman.te @@ -0,0 +1,74 @@ +policy_module(openwsman, 1.0.0) + +######################################## +# +# Declarations +# + +type openwsman_t; +type openwsman_exec_t; +init_daemon_domain(openwsman_t, openwsman_exec_t) + +type openwsman_tmp_t; +files_tmp_file(openwsman_tmp_t) + +type openwsman_tmpfs_t; +files_tmpfs_file(openwsman_tmpfs_t) + +type openwsman_log_t; +logging_log_file(openwsman_log_t) + +type openwsman_run_t; +files_pid_file(openwsman_run_t) + +type openwsman_unit_file_t; +systemd_unit_file(openwsman_unit_file_t) + +######################################## +# +# openwsman local policy +# + +allow openwsman_t self:capability setuid; + +allow openwsman_t self:process { fork }; +allow openwsman_t self:fifo_file rw_fifo_file_perms; +allow openwsman_t self:unix_stream_socket create_stream_socket_perms; +allow openwsman_t self:tcp_socket { accept create_socket_perms listen }; + +manage_files_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t) +manage_dirs_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t) +files_tmp_filetrans(openwsman_t, openwsman_tmp_t, { dir file }) + +manage_files_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t) +manage_dirs_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t) +fs_tmpfs_filetrans(openwsman_t, openwsman_tmpfs_t, { dir file }) + +manage_files_pattern(openwsman_t, openwsman_log_t, openwsman_log_t) +logging_log_filetrans(openwsman_t, openwsman_log_t, { file }) + +manage_files_pattern(openwsman_t, openwsman_run_t, openwsman_run_t) +files_pid_filetrans(openwsman_t, openwsman_run_t, { file }) + +auth_use_nsswitch(openwsman_t) +auth_domtrans_chkpwd(openwsman_t) + +corenet_tcp_connect_pegasus_https_port(openwsman_t) +corenet_tcp_bind_vnc_port(openwsman_t) +corenet_tcp_bind_http_port(openwsman_t) + +dev_read_urand(openwsman_t) + +logging_send_syslog_msg(openwsman_t) +logging_send_audit_msgs(openwsman_t) + +optional_policy(` + sblim_stream_connect_sfcbd(openwsman_t) + sblim_rw_semaphores_sfcbd(openwsman_t) + sblim_getattr_exec_sfcbd(openwsman_t) +') + +optional_policy(` + unconfined_domain(openwsman_t) +') + diff --git a/openwsmand.service b/openwsmand.service index e10c75d..a42b11f 100644 --- a/openwsmand.service +++ b/openwsmand.service @@ -6,7 +6,7 @@ After=syslog.target Type=forking ExecStart=/usr/sbin/openwsmand -S ExecStartPre=/etc/openwsman/owsmantestcert.sh -PIDFile=/var/run/wsmand.pid +PIDFile=/run/wsmand.pid [Install] WantedBy=multi-user.target diff --git a/plans/basic.fmf b/plans/basic.fmf new file mode 100644 index 0000000..efb100f --- /dev/null +++ b/plans/basic.fmf @@ -0,0 +1,9 @@ +summary: Basic test plan +prepare: + how: install + package: + - openwsman-server +discover: + how: fmf +execute: + how: tmt diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..765cfc9 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,5 @@ +--- +badfuncs: + allowed: + /usr/sbin/openwsmand: + - inet_ntoa diff --git a/sources b/sources index d7b0ede..383285d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -4f2d9b1d7da6d87fcd38a9aa23559723 openwsmand.8.gz -221163800046cca5ddb38868d3f82d7e openwsman-2.6.2.tar.gz +SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c +SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972 diff --git a/tests/post-quantum-cryptography/main.fmf b/tests/post-quantum-cryptography/main.fmf new file mode 100644 index 0000000..51ba4e2 --- /dev/null +++ b/tests/post-quantum-cryptography/main.fmf @@ -0,0 +1,6 @@ +summary: Post-quantum cryptography support test +author: Vitezslav Crhonek +contact: Vitezslav Crhonek +require: patch +duration: 10m +test: ./runtest.sh diff --git a/tests/post-quantum-cryptography/runtest.sh b/tests/post-quantum-cryptography/runtest.sh new file mode 100755 index 0000000..a09dda5 --- /dev/null +++ b/tests/post-quantum-cryptography/runtest.sh @@ -0,0 +1,92 @@ +#!/bin/sh -eux + +function check_key_and_cert() +{ + echo -e "\n===== key info" + ssh-keygen -l -f /etc/openwsman/serverkey.pem || : + file /etc/openwsman/serverkey.pem + echo -e "\n\n\n" + + echo -e "\n===== cert info" + openssl x509 -in /etc/openwsman/servercert.pem --text --noout + echo -e "\n\n\n" +} + +function test_key_exchange() +{ + echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it" + openssl s_client -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem +contact: Vitezslav Crhonek +require: sscg +duration: 10m +test: ./runtest.sh diff --git a/tests/sscg-generated-certificates/runtest.sh b/tests/sscg-generated-certificates/runtest.sh new file mode 100755 index 0000000..459ba4b --- /dev/null +++ b/tests/sscg-generated-certificates/runtest.sh @@ -0,0 +1,17 @@ +#!/bin/sh -ux + +# remove previously generated SSL files +rm -rf /etc/openwsman/{servercert,serverkey}*.pem /etc/openwsman/ca.crt + +# remove SSL fallback to relly really just on sscg +cp /etc/openwsman/owsmangencert.sh /etc/openwsman/test-script.sh +sed -i 's/^selfsign_sscg ||.*/selfsign_sscg/' /etc/openwsman/test-script.sh + +# generate new SSL files using sscg +/etc/openwsman/test-script.sh + +# check that SSL files were generated +[ -f /etc/openwsman/servercert.pem ] && [ -f /etc/openwsman/serverkey.pem ] || { echo "Error: SSL files missing"; exit 1; } + +# try to start the service +systemctl start openwsmand