Add 'sscg' SSL files generation test

Signed-off-by: Björn Esser <besser82@fedoraproject.org>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,2 +1,2 @@
 /openwsmand.8.gz
-/v2.7.1.tar.gz
+/v2.8.1.tar.gz

openwsman-2.4.12-ruby-binding-build.patch

@@ -1,12 +1,73 @@
-diff -up openwsman-2.4.12/bindings/ruby/extconf.rb.orig openwsman-2.4.12/bindings/ruby/extconf.rb
---- openwsman-2.4.12/bindings/ruby/extconf.rb.orig	2015-02-09 09:28:58.232581263 +0100
-+++ openwsman-2.4.12/bindings/ruby/extconf.rb	2015-02-09 09:38:22.836772879 +0100
-@@ -32,7 +32,7 @@ swig = find_executable("swig")
+--- openwsman-2.8.1/bindings/ruby/extconf.rb.orig	2025-11-11 11:49:59.880195434 +0100
++++ openwsman-2.8.1/bindings/ruby/extconf.rb	2025-11-11 11:50:46.870685458 +0100
+@@ -5,20 +5,41 @@
+ require 'mkmf'
+ # $CFLAGS = "#{$CFLAGS} -Werror"
+ 
++# libwsman requires 'int facility' to be defined by the application
++# Add syslog.h for LOG_DAEMON constant
++$CFLAGS = "#{$CFLAGS} -include syslog.h"
++
+ # requires wsman, wsman_client, and libxml2
++# Use CPATH and LIBRARY_PATH environment variables set by the build system
++if ENV['CPATH']
++  ENV['CPATH'].split(':').each do |path|
++    $CPPFLAGS = "#{$CPPFLAGS} -I#{path}"
++  end
++end
++if ENV['LIBRARY_PATH']
++  ENV['LIBRARY_PATH'].split(':').each do |path|
++    $LDFLAGS = "#{$LDFLAGS} -L#{path}"
++  end
++end
+ 
+-unless have_library('wsman', 'wsman_create_doc')
++# Custom test for libwsman that includes facility definition
++unless try_link("#include <syslog.h>\n#include <wsman-soap-envelope.h>\nint facility = LOG_DAEMON;\nint main() {\n  wsman_create_doc(\"test\");\n  return 0;\n}", '-lwsman')
+   STDERR.puts "Cannot find wsman_create_doc() in libwsman"
+   STDERR.puts "Is openwsman-devel installed ?"
+   exit 1
+ end
++# Explicitly add libwsman to linker flags since we used try_link instead of have_library
++$libs = append_library($libs, "wsman")
+ find_header 'wsman-xml-api.h', '/usr/include/openwsman'
+ 
+-unless have_library('wsman_client', 'wsmc_create')
++# Custom test for libwsman_client that includes facility definition
++unless try_link("#include <syslog.h>\n#include <wsman-client-api.h>\nint facility = LOG_DAEMON;\nint main() {\n  wsmc_create(\"localhost\", 80, \"/wsman\", \"http\", \"user\", \"pass\");\n  return 0;\n}", '-lwsman_client -lwsman')
+   STDERR.puts "Cannot find wsmc_create() in libwsman_client"
+   STDERR.puts "Is openwsman-devel installed ?"
+   exit 1
+ end
++# Explicitly add libwsman_client to linker flags since we used try_link instead of have_library
++$libs = append_library($libs, "wsman_client")
+ find_header 'wsman-client-api.h', '/usr/include/openwsman'
+ 
+ unless have_library('xml2', 'xmlNewDoc')
+@@ -28,12 +49,25 @@
+ end
+ find_header 'libxml/parser.h', '/usr/include/libxml2'
+ 
++# Check for Ruby 3.3+ IO types
++have_type('rb_io_t', 'ruby/io.h')
++have_header 'ruby/thread.h'
++
+ swig = find_executable("swig")
  raise "SWIG not found" unless swig
  
  major, minor, path = RUBY_VERSION.split(".")
 -raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
-+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.7.1/include/ -o openwsman_wrap.c openwsman.i")
++
++# Build SWIG include paths from CPATH environment variable
++swig_includes = "-I. -I/usr/include/openwsman"
++if ENV['CPATH']
++  ENV['CPATH'].split(':').each do |path|
++    swig_includes += " -I#{path}"
++  end
++end
++raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} #{swig_includes} -o openwsman_wrap.c openwsman.i")
  
  $CPPFLAGS = "-I/usr/include/openwsman -I.."
  
+ create_makefile('_openwsman')
++

openwsman-2.6.2-openssl-1.1-fix.patch

@@ -1,6 +1,6 @@
-diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/src/server/shttpd/compat_unix.h
---- openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/compat_unix.h	2021-03-09 09:15:26.750942006 +0100
+diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
+--- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/compat_unix.h	2025-02-03 09:11:35.072818890 +0100
 @@ -27,10 +27,6 @@
  	pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
  #endif /* !NO_THREADS */
@@ -12,9 +12,9 @@ diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/sr
  #define	DIRSEP				'/'
  #define	IS_DIRSEP_CHAR(c)		((c) == '/')
  #define	O_BINARY			0
-diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/server/shttpd/io_ssl.c
---- openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/io_ssl.c	2021-03-09 09:15:26.750942006 +0100
+diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
+--- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/io_ssl.c	2025-02-03 09:12:22.387355905 +0100
 @@ -11,28 +11,6 @@
  #include "defs.h"
  
@@ -44,10 +44,10 @@ diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/ser
  void
  _shttpd_ssl_handshake(struct stream *stream)
  {
-diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/server/shttpd/shttpd.c
---- openwsman-2.7.0/src/server/shttpd/shttpd.c.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/shttpd.c	2021-03-09 09:16:58.843241510 +0100
-@@ -1489,25 +1489,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
+--- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/shttpd.c	2025-02-03 09:13:43.415562784 +0100
+@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
  	int		retval = FALSE;
  	EC_KEY*		key;
  
@@ -73,10 +73,10 @@ diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/ser
 +        OPENSSL_init_ssl(0, NULL);
  	if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
  #endif
- 		_shttpd_elog(E_LOG, NULL, "SSL_CTX_new error");
-diff -up openwsman-2.7.0/src/server/shttpd/ssl.h.orig openwsman-2.7.0/src/server/shttpd/ssl.h
---- openwsman-2.7.0/src/server/shttpd/ssl.h.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/ssl.h	2021-03-09 09:15:26.750942006 +0100
+ 	        _shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
+diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
+--- openwsman-2.8.1/src/server/shttpd/ssl.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/ssl.h	2025-02-03 09:14:43.142975166 +0100
 @@ -12,55 +12,4 @@
  
  #include <openssl/ssl.h>

openwsman-2.7.1-fix-ruby-bindings-for-swig-41.patch

@@ -1,12 +0,0 @@
-diff -up openwsman-2.7.1/bindings/ruby/helpers.h.orig openwsman-2.7.1/bindings/ruby/helpers.h
---- openwsman-2.7.1/bindings/ruby/helpers.h.orig	2021-04-07 17:25:55.000000000 +0200
-+++ openwsman-2.7.1/bindings/ruby/helpers.h	2022-10-21 08:36:24.901459057 +0200
-@@ -47,7 +47,7 @@
-  * 
-  */
- 
--#if SWIGVERSION > 0x020004
-+#if SWIG_VERSION > 0x020004
- #define KLASS_DECL(k,t) swig_class *k = (swig_class *)(t->clientdata)
- #define KLASS_OF(x) x->klass
- #else

openwsman-2.7.1-http-unauthorized-improve.patch

@@ -1,56 +0,0 @@
-diff -up openwsman-2.7.1/src/lib/wsman-curl-client-transport.c.orig openwsman-2.7.1/src/lib/wsman-curl-client-transport.c
---- openwsman-2.7.1/src/lib/wsman-curl-client-transport.c.orig	2021-04-07 17:25:55.000000000 +0200
-+++ openwsman-2.7.1/src/lib/wsman-curl-client-transport.c	2022-07-19 09:25:22.435355610 +0200
-@@ -459,6 +459,7 @@ wsmc_handler( WsManClient *cl,
- 	long http_code;
- 	long auth_avail = 0;
- 	char *_user = NULL, *_pass = NULL;
-+	int _no_auth = 0; /* 0 if authentication is used, 1 if no authentication was used */
- 	u_buf_t *response = NULL;
- 	//char *soapaction;
- 	char *tmp_str = NULL;
-@@ -564,6 +565,7 @@ wsmc_handler( WsManClient *cl,
- 		_user = wsmc_get_user(cl);
- 		_pass = wsmc_get_password(cl);
- 		if (_user && _pass && cl->data.auth_set) {
-+			_no_auth = 0;
- 			r = curl_easy_setopt(curl, CURLOPT_HTTPAUTH, cl->data.auth_set);
- 			if (r != CURLE_OK) {
- 				cl->fault_string = u_strdup(curl_easy_strerror(r));
-@@ -584,6 +586,11 @@ wsmc_handler( WsManClient *cl,
- 				curl_err("curl_easy_setopt(curl, CURLOPT_USERPWD, ..) failed");
- 				goto DONE;
- 			}
-+        } else {
-+            /* request without user credentials, remember this for
-+             * later use when it might become necessary to print an error message
-+             */
-+            _no_auth = 1;
- 		}
- 
- 		if (wsman_debug_level_debugged(DEBUG_LEVEL_MESSAGE)) {
-@@ -616,6 +623,24 @@ wsmc_handler( WsManClient *cl,
- 				break;
- 			case 401:
- 				// The server requires authentication.
-+                /* RFC 2616 states:
-+                 *
-+                 * If the request already included Authorization credentials, then the 401
-+                 * response indicates that authorization has been refused for those
-+                 * credentials. If the 401 response contains the same challenge as the
-+                 * prior response, and the user agent has already attempted
-+                 * authentication at least once, then the user SHOULD be presented the
-+                 * entity that was given in the response, since that entity might
-+                 * include relevant diagnostic information.
-+                 */
-+                if (_no_auth == 0) {
-+                    /* no authentication credentials were used. It is only
-+                     * possible to write a message about the current situation. There
-+                     * is no information about the last attempt to access the resource.
-+                     * Maybe at a later point in time I will implement more state information.
-+                     */
-+                    fprintf(stdout,"Authentication failed, please retry\n");
-+                }
- 				break;
- 			default:
- 				// The status code does not indicate success.

openwsman-2.7.2-gcc15-fix.patch

@@ -0,0 +1,24 @@
+diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
+--- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c	2025-02-03 09:30:36.905616375 +0100
+@@ -49,7 +49,7 @@
+  */
+ 
+ static VALUE
+-load_module()
++load_module(VALUE)
+ {
+   ruby_script(PLUGIN_FILE);
+   return rb_require(PLUGIN_FILE);
+diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
+--- openwsman-2.8.1/src/server/CMakeLists.txt.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/CMakeLists.txt	2025-02-03 09:31:15.258241237 +0100
+@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
+   TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
+ ENDIF( HAVE_LIBDL )
+ 
+-INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
++INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
+ 
+ #		
+ #

openwsman-2.7.2-ssl-certs-gen-changes.patch

@@ -0,0 +1,102 @@
+diff -up openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig openwsman-2.8.1/etc/owsmangencert.sh.cmake
+--- openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/etc/owsmangencert.sh.cmake	2025-10-17 10:16:34.482996406 +0200
+@@ -1,10 +1,74 @@
+-#!/bin/sh
+-
+ #!/bin/sh -e
+ 
+ CERTFILE=@WSMANCONF_DIR@/servercert.pem
+ KEYFILE=@WSMANCONF_DIR@/serverkey.pem
+ CNFFILE=@WSMANCONF_DIR@/ssleay.cnf
++CAFILE=@WSMANCONF_DIR@/ca.crt
++DAYS=365
++
++function create_ssl_cnf
++{
++    # Get minimum RSA key length at current security level
++    # This workarounds openssl not enforcing min. key length enforced by current security level
++    KEYSIZE=`grep min_rsa_size /etc/crypto-policies/state/CURRENT.pol | cut -d ' ' -f 3`
++
++    # Create OpenSSL configuration files for generating certificates
++    echo "[ req ]" > $CNFFILE
++    echo "default_bits            = $KEYSIZE" >> $CNFFILE
++    echo "default_keyfile         = privkey.pem" >> $CNFFILE
++    echo "distinguished_name      = req_distinguished_name" >> $CNFFILE
++
++    echo "[ req_distinguished_name ]" >> $CNFFILE
++    echo "countryName                     = Country Name (2 letter code)" >> $CNFFILE
++    echo "countryName_default             = GB" >> $CNFFILE
++    echo "countryName_min                 = 2" >> $CNFFILE
++    echo "countryName_max                 = 2" >> $CNFFILE
++
++    echo "stateOrProvinceName             = State or Province Name (full name)" >> $CNFFILE
++    echo "stateOrProvinceName_default     = Some-State" >> $CNFFILE
++
++    echo "localityName                    = Locality Name (eg, city)" >> $CNFFILE
++
++    echo "organizationName                = Organization Name (eg, company; recommended)" >> $CNFFILE
++    echo "organizationName_max            = 64" >> $CNFFILE
++
++    echo "organizationalUnitName          = Organizational Unit Name (eg, section)" >> $CNFFILE
++    echo "organizationalUnitName_max      = 64" >> $CNFFILE
++
++    echo "commonName                      = server name (eg. ssl.domain.tld; required!!!)" >> $CNFFILE
++    echo "commonName_max                  = 80" >> $CNFFILE
++
++    echo "emailAddress                    = Email Address" >> $CNFFILE
++    echo "emailAddress_max                = 85" >> $CNFFILE
++}
++
++function selfsign_sscg()
++{
++    sscg --quiet \
++         --lifetime "$DAYS" \
++         --cert-key-file "$KEYFILE" \
++         --cert-file "$CERTFILE" \
++         --ca-file "$CAFILE"
++}
++
++function selfsign_openssl()
++{
++
++    echo
++    echo creating selfsigned certificate
++    echo "replace it with one signed by a certification authority (CA)"
++    echo
++    echo enter your ServerName at the Common Name prompt
++    echo
++
++    # use special .cnf, because with normal one no valid selfsigned
++    # certificate is created
++
++    openssl req -days $DAYS $@ -config $CNFFILE \
++        -new -x509 -nodes -out $CERTFILE \
++        -keyout $KEYFILE
++    chmod 600 $KEYFILE
++}
+ 
+ if [ "$1" != "--force" -a -f $KEYFILE ]; then
+   echo "$KEYFILE exists!  Use \"$0 --force.\""
+@@ -15,18 +79,7 @@ if [ "$1" = "--force" ]; then
+   shift
+ fi
+ 
+-echo
+-echo creating selfsigned certificate
+-echo "replace it with one signed by a certification authority (CA)"
+-echo
+-echo enter your ServerName at the Common Name prompt
+-echo
+-
+-# use special .cnf, because with normal one no valid selfsigned
+-# certificate is created
+-
+-openssl req -days 365 $@ -config $CNFFILE \
+-  -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
+-  -keyout $KEYFILE
+-chmod 600 $KEYFILE
++create_ssl_cnf
+ 
++# If sscg fails, try openssl
++selfsign_sscg || selfsign_openssl

openwsman-2.8.1-fix-ruby-io.patch

@@ -0,0 +1,33 @@
+diff -up openwsman-2.8.1/bindings/openwsman.i.orig openwsman-2.8.1/bindings/openwsman.i
+--- openwsman-2.8.1/bindings/openwsman.i.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/bindings/openwsman.i	2025-10-21 16:56:01.025576984 +0200
+@@ -105,15 +105,8 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
+ #if HAVE_RUBY_THREAD_H /* New threading model */
+ #include <ruby/thread.h>
+ #endif
+-#if RUBY_VERSION > 18
+-  #if HAVE_RB_IO_T
+-    #define rb_fptr_t rb_io_t
+-  #else
+-    #define rb_fptr_t struct rb_io
+-  #endif
+-#else
+-  #define rb_fptr_t struct OpenFile
+-#endif
++/* Use rb_io_t for Ruby 1.9+ */
++#define rb_fptr_t rb_io_t
+ %}
+ 
+ %typemap(in) FILE* {
+@@ -122,11 +115,7 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
+   Check_Type($input, T_FILE);
+   GetOpenFile($input, fptr);
+   /*rb_io_check_writable(fptr);*/
+-#if RUBY_VERSION > 18
+   $1 = rb_io_stdio_file(fptr);
+-#else
+-  $1 = GetReadFile(fptr);
+-#endif
+ }
+ 
+ #endif /* SWIGRUBY */

openwsman-2.8.1-post-quantum.patch

@@ -0,0 +1,101 @@
+diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
+--- openwsman-2.7.2/etc/openwsman.conf.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/etc/openwsman.conf	2025-05-27 08:03:57.890057721 +0200
+@@ -32,8 +32,12 @@ ipv6 = yes
+ 
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
++# the openwsman server certificate fallback file, in .pem format
++#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
++# the openwsman server private key fallback, in .pem format
++#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
+--- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig	2025-05-21 10:07:40.404532496 +0200
++++ openwsman-2.7.2/src/server/shttpd/shttpd.c	2025-06-12 12:27:44.785904555 +0200
+@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
+ 	char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
+ 	int		retval = FALSE;
+-	EC_KEY*		key;
+ 
+ 	/* Initialize SSL crap */
+ 
+@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	else
+ 		retval = TRUE;
+ 
+-	/* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
+-	key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+-	if (key != NULL) {
+-		SSL_CTX_set_tmp_ecdh(CTX, key);
+-		EC_KEY_free(key);
++	/* Add fall back certificate/key pair */
++	if (wsmand_options_get_ssl_cert_fallback_file() &&
++                    wsmand_options_get_ssl_key_fallback_file()) {
++		if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
++		else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
++		else
++			retval = TRUE;
+ 	}
+ 
+ 	while (ssl_disabled_protocols) {
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
+--- openwsman-2.7.2/src/server/wsmand-daemon.c.orig	2025-05-27 07:18:16.878974761 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.c	2025-05-27 07:22:06.832235764 +0200
+@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
+ #endif
+ static int use_digest = 0;
+ static char *ssl_key_file = NULL;
++static char *ssl_key_fallback_file = NULL;
+ static char *service_path = DEFAULT_SERVICE_PATH;
+ static char *ssl_cert_file = NULL;
++static char *ssl_cert_fallback_file = NULL;
+ static char *ssl_disabled_protocols = NULL;
+ static char *ssl_cipher_list = NULL;
+ static char *pid_file = DEFAULT_PID_PATH;
+@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
+ 	service_path =
+ 	    iniparser_getstring(ini, "server:service_path", "/wsman");
+ 	ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
++	ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
+ 	ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
++	ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
+         ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
+         ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
+ 	use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
+@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
+ 	return ssl_cert_file;
+ }
+ 
++char *wsmand_options_get_ssl_key_fallback_file(void)
++{
++	return ssl_key_fallback_file;
++}
++
++char *wsmand_options_get_ssl_cert_fallback_file(void)
++{
++	return ssl_cert_fallback_file;
++}
++
+ char *wsmand_options_get_ssl_disabled_protocols(void)
+ {
+ 	return ssl_disabled_protocols;
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
+--- openwsman-2.7.2/src/server/wsmand-daemon.h.orig	2025-05-27 07:15:56.869002037 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.h	2025-05-27 07:18:06.429846617 +0200
+@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
+ int wsmand_options_get_server_ssl_port(void);
+ char *wsmand_options_get_ssl_key_file(void);
+ char *wsmand_options_get_ssl_cert_file(void);
++char *wsmand_options_get_ssl_key_fallback_file(void);
++char *wsmand_options_get_ssl_cert_fallback_file(void);
+ char *wsmand_options_get_ssl_disabled_protocols(void);
+ char *wsmand_options_get_ssl_cipher_list(void);
+ int wsmand_options_get_digest(void);

openwsman-2.8.1-rdoc-6_16.patch

@@ -0,0 +1,18 @@
+diff -urp '--exclude=*~' openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb
+--- openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb	2026-01-02 23:43:41.804273994 +0900
++++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2026-01-02 23:56:06.991238037 +0900
+@@ -377,7 +377,13 @@ class RDoc::Parser::SWIG < RDoc::Parser
+       find_modifiers comment, meth_obj if comment
+ 
+       #meth_obj.params = params
+-      meth_obj.start_collecting_tokens
++      # https://github.com/ruby/rdoc/pull/1471 changes the parameter for
++      # RDoc::TokenStream.start_collecting_tokens
++      if meth_obj.method(:start_collecting_tokens).arity == 1
++        meth_obj.start_collecting_tokens :ruby
++      else
++        meth_obj.start_collecting_tokens
++      end
+       begin
+         RDoc::const_get "RubyToken"
+         tk = RDoc::RubyToken::Token.new nil, 1, 1

openwsman-2.8.1-rdoc-ruby34.patch

@@ -0,0 +1,29 @@
+--- openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2025-11-10 15:00:00.000000000 +0100
+@@ -108,10 +108,24 @@ class RDoc::Parser::SWIG < RDoc::Parser
+   ##
+   # Prepare to parse a SWIG file
+ 
+-  def initialize(top_level, file_name, content, options, stats)
+-    super
++  def initialize(top_level, file_name, content, options, stats = nil)
++    # RDoc 6.6+ (Ruby 3.3+) removed the stats parameter from Parser.initialize
++    # Check the arity of the parent class initialize method to determine which API we're using
++    parent_arity = RDoc::Parser.instance_method(:initialize).arity
++    
++    if parent_arity == 4 || parent_arity == -5
++      # RDoc 6.6+: only pass 4 arguments to super
++      super(top_level, file_name, content, options)
++      # Create a dummy stats object for compatibility
++      @stats = Object.new
++      def @stats.method_missing(m, *args); end
++    else
++      # Older RDoc: pass all 5 arguments including stats
++      super(top_level, file_name, content, options, stats)
++      @stats = stats
++    end
+ 
+     @known_classes = RDoc::KNOWN_CLASSES.dup
+     @content = handle_tab_width handle_ifdefs_in(@content)
+     @renames = {} # maps old_name => [ new_name, args ]
+     @aliases = {} # maps name => [ alias_name, args ]

openwsman.spec

@@ -24,11 +24,11 @@
 %endif
 
 Name:		openwsman
-Version:	2.7.1
-Release:	10%{?dist}
+Version:	2.8.1
+Release:	13%{?dist}
 Summary:	Open source Implementation of WS-Management
 
-License:	BSD
+License:	BSD-3-Clause AND MIT
 URL:		http://www.openwsman.org/
 Source0:	https://github.com/Openwsman/openwsman/archive/v%{version}.tar.gz
 # help2man generated manpage for openwsmand binary
@@ -49,8 +49,12 @@ Patch2:		openwsman-2.4.12-ruby-binding-build.patch
 Patch3:		openwsman-2.6.2-openssl-1.1-fix.patch
 Patch4:		openwsman-2.6.5-http-status-line.patch
 Patch5:		openwsman-2.6.8-update-ssleay-conf.patch
-Patch6:		openwsman-2.7.1-http-unauthorized-improve.patch
-Patch7:		openwsman-2.7.1-fix-ruby-bindings-for-swig-41.patch
+Patch6:		openwsman-2.7.2-gcc15-fix.patch
+Patch7:		openwsman-2.8.1-post-quantum.patch
+Patch8:		openwsman-2.7.2-ssl-certs-gen-changes.patch
+Patch9:		openwsman-2.8.1-rdoc-ruby34.patch
+Patch10:	openwsman-2.8.1-fix-ruby-io.patch
+Patch11:	openwsman-2.8.1-rdoc-6_16.patch
 BuildRequires:	make
 BuildRequires:	swig
 BuildRequires:	libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel
@@ -67,6 +71,7 @@ BuildRequires:	pkgconfig openssl-devel
 BuildRequires:	cmake
 BuildRequires:	systemd-units
 BuildRequires:	gcc gcc-c++
+BuildRequires:	libxcrypt-devel
 
 %description
 Openwsman is a project intended to provide an open-source
@@ -78,7 +83,7 @@ requirements that exposes a set of operations focused on and covers
 all system management aspects.
 
 %package -n libwsman1
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Open source Implementation of WS-Management
 Provides:	%{name} = %{version}-%{release}
 Obsoletes:	%{name} < %{version}-%{release}
@@ -87,7 +92,7 @@ Obsoletes:	%{name} < %{version}-%{release}
 Openwsman library for packages dependent on openwsman.
 
 %package -n libwsman-devel
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Open source Implementation of WS-Management
 Provides:	%{name}-devel = %{version}-%{release}
 Obsoletes:	%{name}-devel < %{version}-%{release}
@@ -101,14 +106,14 @@ Requires:	libcurl-devel
 Development files for openwsman.
 
 %package client
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Openwsman Client libraries
 
 %description client
 Openwsman Client libraries.
 
 %package server
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Openwsman Server and service libraries
 Requires:	libwsman1 = %{version}-%{release}
 %if 0%{?with_selinux}
@@ -122,7 +127,7 @@ Openwsman Server and service libraries.
 
 %if %{with_python}
 %package python3
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Python bindings for openwsman client API
 Requires:	%{__python3}
 Requires:	libwsman1 = %{version}-%{release}
@@ -134,7 +139,7 @@ This package provides Python3 bindings to access the openwsman client API.
 
 %if %{with_ruby}
 %package -n rubygem-%{gem_name}
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Ruby client bindings for Openwsman
 Obsoletes:	%{name}-ruby < %{version}-%{release}
 Requires:	libwsman1 = %{version}-%{release}
@@ -154,7 +159,7 @@ Documentation for rubygem-%{gem_name}
 
 %if %{with_perl}
 %package perl
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Perl bindings for openwsman client API
 Requires:	libwsman1 = %{version}-%{release}
 
@@ -162,6 +167,7 @@ Requires:	libwsman1 = %{version}-%{release}
 This package provides Perl bindings to access the openwsman client API.
 %endif
 
+%if %{with_ruby}
 %package winrs
 Summary:	Windows Remote Shell
 Requires:	rubygem-%{gem_name} = %{version}-%{release}
@@ -169,6 +175,7 @@ Requires:	rubygem-%{gem_name} = %{version}-%{release}
 %description winrs
 This is a command line tool for the Windows Remote Shell protocol.
 You can use it to send shell commands to a remote Windows hosts.
+%endif
 
 %if 0%{?with_selinux}
 # SELinux subpackage
@@ -187,13 +194,7 @@ Custom SELinux policy module
 %prep
 %setup -q
 
-%patch1 -p1 -b .pamsetup
-%patch2 -p1 -b .ruby-binding-build
-%patch3 -p1 -b .openssl-1.1-fix
-%patch4 -p1 -b .http-status-line
-%patch5 -p1 -b .update-ssleay-conf
-%patch6 -p1 -b .http-unauthorized-improve
-%patch7 -p1 -b .fix-ruby-bindings-for-swig-41
+%autopatch -p1
 
 %build
 # Removing executable permissions on .c and .h files to fix rpmlint warnings. 
@@ -264,6 +265,7 @@ rm -f %{buildroot}/%{_libdir}/openwsman/plugins/*.la
 rm -f %{buildroot}/%{_libdir}/openwsman/authenticators/*.la
 %if %{with_ruby}
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsmanplugin.rb
+[ -d %{buildroot}/%{ruby_sitelibdir} ] && rm -f %{buildroot}/%{ruby_sitelibdir}/openwsmanplugin.rb
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsman.rb
 %endif
 mkdir -p %{buildroot}%{_sysconfdir}/init.d
@@ -290,6 +292,8 @@ rm -rf %{buildroot}%{gem_instdir}/ext
 
 mkdir -p %{buildroot}%{gem_extdir_mri}
 cp -a ./build%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/
+%else
+rm -f %{buildroot}%{_bindir}/winrs
 %endif
 
 %if 0%{?with_selinux}
@@ -395,7 +399,7 @@ fi
 %dir %{_libdir}/openwsman/plugins
 %{_libdir}/openwsman/plugins/*.so
 %{_libdir}/openwsman/plugins/*.so.*
-%{_sbindir}/openwsmand
+%{_bindir}/openwsmand
 %{_libdir}/libwsman_server.so.*
 %{_mandir}/man8/*
 
@@ -404,8 +408,10 @@ fi
 %{_libdir}/libwsman_clientpp.so.*
 %config(noreplace) %{_sysconfdir}/openwsman/openwsman_client.conf
 
+%if %{with_ruby}
 %files winrs
 %{_bindir}/winrs
+%endif
 
 %if 0%{?with_selinux}
 %files selinux
@@ -415,6 +421,108 @@ fi
 %endif
 
 %changelog
+* Thu Jan 08 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-13
+- Fix bogus 'sscg' arguments
+
+* Fri Jan 02 2026 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.8.1-12
+- Support rdoc 6.16 and above (for ruby4.0)
+
+* Wed Nov 12 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-11
+- Update OpenSSL certificates set up
+- Fix ruby binding, enable it
+
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 2.8.1-10
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 2.8.1-9
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 2.8.1-7
+- Perl 5.42 rebuild
+
+* Tue Jun 17 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-6
+- Update to better support post-quantum cryptography
+
+* Mon Jun 09 2025 Python Maint <python-maint@redhat.com> - 2.8.1-5
+- Rebuilt for Python 3.14
+
+* Mon Jun 09 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-4
+- Remove deprecated path from systemd service file
+
+* Tue Jun 03 2025 Python Maint <python-maint@redhat.com> - 2.8.1-3
+- Rebuilt for Python 3.14
+
+* Thu Apr 10 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
+- Build winrs only when ruby binding is enabled
+
+* Mon Apr 07 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
+- Update to openwsman-2.8.1
+
+* Fri Feb 28 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-16
+- Update minimum required cmake version
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.7.2-15
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-14
+- Fix FTBFS with GCC 15, bin and sbin unification
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Jan 08 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-12
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jun 25 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-10
+- Rebuild
+  Resolves: #2290726
+
+* Tue Jun 18 2024 Python Maint <python-maint@redhat.com> - 2.7.2-9
+- Rebuilt for Python 3.13
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.2-8
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 2.7.2-7
+- Rebuilt for Python 3.13
+
+* Fri May 10 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-6
+- Update license tags in subpackages to SPDX format
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Jan 22 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-4
+- Fix FTBFS
+  Resolves: #2259165
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jan 03 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-2
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3
+
+* Thu Aug 31 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-1
+- Update to openwsman-2.7.2
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.1-13
+- Perl 5.38 rebuild
+
+* Wed Jun 14 2023 Python Maint <python-maint@redhat.com> - 2.7.1-12
+- Rebuilt for Python 3.12
+
+* Tue Feb 14 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.1-11
+- SPDX migration
+
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 

openwsmand.service

@@ -6,7 +6,7 @@ After=syslog.target
 Type=forking
 ExecStart=/usr/sbin/openwsmand -S
 ExecStartPre=/etc/openwsman/owsmantestcert.sh
-PIDFile=/var/run/wsmand.pid
+PIDFile=/run/wsmand.pid
 
 [Install]
 WantedBy=multi-user.target

plans/basic.fmf

@@ -0,0 +1,9 @@
+summary: Basic test plan
+prepare:
+    how: install
+    package:
+        - openwsman-server
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -0,0 +1,5 @@
+---
+badfuncs:
+    allowed:
+        /usr/sbin/openwsmand:
+            - inet_ntoa

sources

@@ -1,2 +1,2 @@
 SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
-SHA512 (v2.7.1.tar.gz) = 37738bc5be7b1c3fa961587fca4db74b8e7714fc0641a550682275fbe925b2c8e18a683cf493f4740e479f7461cc98392d3d675f4769f5cf04e7249f1e9ee880
+SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972

tests/post-quantum-cryptography/main.fmf

@@ -0,0 +1,6 @@
+summary: Post-quantum cryptography support test
+author: Vitezslav Crhonek <vcrhonek@redhat.com>
+contact: Vitezslav Crhonek <vcrhonek@redhat.com>
+require: patch
+duration: 10m
+test: ./runtest.sh

tests/post-quantum-cryptography/runtest.sh

@@ -0,0 +1,92 @@
+#!/bin/sh -eux
+
+function check_key_and_cert()
+{
+  echo -e "\n===== key info"
+  ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
+  file /etc/openwsman/serverkey.pem
+  echo -e "\n\n\n"
+
+  echo -e "\n===== cert info"
+  openssl x509 -in /etc/openwsman/servercert.pem --text --noout
+  echo -e "\n\n\n"
+}
+
+function test_key_exchange()
+{
+  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
+  echo -e "\n\n\n"
+  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
+  echo -e "\n\n\n"
+}
+
+function test_cert_support()
+{
+  echo -e "\n===== check that TLS certificate using ML-DSA works"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: mldsa65" cert-mldsa.out
+  echo -e "\n\n\n"
+  # simulate lack of ML-DSA support
+  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
+    tee cert-classic.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
+  echo -e "\n\n\n"
+}
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+systemctl start openwsmand
+check_key_and_cert
+test_key_exchange
+systemctl stop openwsmand
+
+# keep RSA certificate and key
+cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
+cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
+# remove previously generated certificates/keys
+rm -rf /etc/openwsman/{servercert,serverkey}.pem
+
+# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
+# and issue a self-signed certificate for localhost using this key
+patch /etc/openwsman/owsmangencert.sh << 'EOF'
+--- owsmangencert.sh.orig	2026-01-08 03:50:31.852413993 -0500
++++ owsmangencert.sh	2026-01-08 03:52:41.883088457 -0500
+@@ -65,7 +65,7 @@
+     # certificate is created
+ 
+     openssl req -days $DAYS $@ -config $CNFFILE \
+-        -new -x509 -nodes -out $CERTFILE \
++        -newkey mldsa65 -x509 -nodes -out $CERTFILE \
+         -keyout $KEYFILE
+     chmod 600 $KEYFILE
+ }
+EOF
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+
+# update config file
+patch /etc/openwsman/openwsman.conf << 'EOF'
+--- openwsman.conf.orig	2025-06-05 07:50:30.285822838 -0400
++++ openwsman.conf	2025-06-05 07:50:38.609822838 -0400
+@@ -33,11 +33,11 @@
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
+ # the openwsman server certificate fallback file, in .pem format
+-#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
++ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
+ # the openwsman server private key fallback, in .pem format
+-#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
++ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+EOF
+
+systemctl start openwsmand
+check_key_and_cert
+test_cert_support

tests/sscg-generated-certificates/main.fmf

@@ -0,0 +1,6 @@
+summary: Service works with 'sscg' generated SSL certificates
+author: Vitezslav Crhonek <vcrhonek@redhat.com>
+contact: Vitezslav Crhonek <vcrhonek@redhat.com>
+require: sscg
+duration: 10m
+test: ./runtest.sh

tests/sscg-generated-certificates/runtest.sh

@@ -0,0 +1,17 @@
+#!/bin/sh -ux
+
+# remove previously generated SSL files
+rm -rf /etc/openwsman/{servercert,serverkey}*.pem /etc/openwsman/ca.crt
+
+# remove SSL fallback to relly really just on sscg
+cp /etc/openwsman/owsmangencert.sh /etc/openwsman/test-script.sh
+sed -i 's/^selfsign_sscg ||.*/selfsign_sscg/' /etc/openwsman/test-script.sh
+
+# generate new SSL files using sscg
+/etc/openwsman/test-script.sh
+
+# check that SSL files were generated
+[ -f /etc/openwsman/servercert.pem ] && [ -f /etc/openwsman/serverkey.pem ] || { echo "Error: SSL files missing"; exit 1; }
+
+# try to start the service
+systemctl start openwsmand

tests/tests-DSP.yml

@@ -1,37 +0,0 @@
-- hosts: localhost
-
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    repositories:
-      - repo: https://pagure.io/DSP_test.git
-        dest: DSP_test
-        version: master
-
-    tests:
-    - DSP_test
-    environment:
-      # RPM package containing the policy module
-      TEST_RPM: openwsman-selinux
-      # policy module name
-      TEST_POLICY: openwsman
-      # policy sources will be extracted from corresponding .src.rpm
-      # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz")
-      # or empty string if policy sources are not inside a tar archive
-      POLICY_TAR: ''
-      # path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
-      # or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
-      # can contain wildcards (e.g. for versions etc.)
-      POLICY_PATH: .
-
-    required_packages:
-    - policycoreutils
-    - selinux-policy
-    - selinux-policy-targeted
-    - setools-console
-    - libselinux-utils
-    - rpm
-    - tar
-    - git
-    - openwsman-server