.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,2 +1,2 @@
 /openwsmand.8.gz
-/v2.8.1.tar.gz
+/v2.7.2.tar.gz

openwsman-2.4.12-ruby-binding-build.patch

@@ -1,73 +1,12 @@
---- openwsman-2.8.1/bindings/ruby/extconf.rb.orig	2025-11-11 11:49:59.880195434 +0100
-+++ openwsman-2.8.1/bindings/ruby/extconf.rb	2025-11-11 11:50:46.870685458 +0100
-@@ -5,20 +5,41 @@
- require 'mkmf'
- # $CFLAGS = "#{$CFLAGS} -Werror"
- 
-+# libwsman requires 'int facility' to be defined by the application
-+# Add syslog.h for LOG_DAEMON constant
-+$CFLAGS = "#{$CFLAGS} -include syslog.h"
-+
- # requires wsman, wsman_client, and libxml2
-+# Use CPATH and LIBRARY_PATH environment variables set by the build system
-+if ENV['CPATH']
-+  ENV['CPATH'].split(':').each do |path|
-+    $CPPFLAGS = "#{$CPPFLAGS} -I#{path}"
-+  end
-+end
-+if ENV['LIBRARY_PATH']
-+  ENV['LIBRARY_PATH'].split(':').each do |path|
-+    $LDFLAGS = "#{$LDFLAGS} -L#{path}"
-+  end
-+end
- 
--unless have_library('wsman', 'wsman_create_doc')
-+# Custom test for libwsman that includes facility definition
-+unless try_link("#include <syslog.h>\n#include <wsman-soap-envelope.h>\nint facility = LOG_DAEMON;\nint main() {\n  wsman_create_doc(\"test\");\n  return 0;\n}", '-lwsman')
-   STDERR.puts "Cannot find wsman_create_doc() in libwsman"
-   STDERR.puts "Is openwsman-devel installed ?"
-   exit 1
- end
-+# Explicitly add libwsman to linker flags since we used try_link instead of have_library
-+$libs = append_library($libs, "wsman")
- find_header 'wsman-xml-api.h', '/usr/include/openwsman'
- 
--unless have_library('wsman_client', 'wsmc_create')
-+# Custom test for libwsman_client that includes facility definition
-+unless try_link("#include <syslog.h>\n#include <wsman-client-api.h>\nint facility = LOG_DAEMON;\nint main() {\n  wsmc_create(\"localhost\", 80, \"/wsman\", \"http\", \"user\", \"pass\");\n  return 0;\n}", '-lwsman_client -lwsman')
-   STDERR.puts "Cannot find wsmc_create() in libwsman_client"
-   STDERR.puts "Is openwsman-devel installed ?"
-   exit 1
- end
-+# Explicitly add libwsman_client to linker flags since we used try_link instead of have_library
-+$libs = append_library($libs, "wsman_client")
- find_header 'wsman-client-api.h', '/usr/include/openwsman'
- 
- unless have_library('xml2', 'xmlNewDoc')
-@@ -28,12 +49,25 @@
- end
- find_header 'libxml/parser.h', '/usr/include/libxml2'
- 
-+# Check for Ruby 3.3+ IO types
-+have_type('rb_io_t', 'ruby/io.h')
-+have_header 'ruby/thread.h'
-+
- swig = find_executable("swig")
+diff -up openwsman-2.7.2/bindings/ruby/extconf.rb.orig openwsman-2.7.2/bindings/ruby/extconf.rb
+--- openwsman-2.7.2/bindings/ruby/extconf.rb.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/bindings/ruby/extconf.rb	2023-08-09 12:50:21.361216733 +0200
+@@ -32,7 +32,7 @@ swig = find_executable("swig")
  raise "SWIG not found" unless swig
  
  major, minor, path = RUBY_VERSION.split(".")
 -raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
-+
-+# Build SWIG include paths from CPATH environment variable
-+swig_includes = "-I. -I/usr/include/openwsman"
-+if ENV['CPATH']
-+  ENV['CPATH'].split(':').each do |path|
-+    swig_includes += " -I#{path}"
-+  end
-+end
-+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} #{swig_includes} -o openwsman_wrap.c openwsman.i")
++raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.7.2-build/openwsman-2.7.2/include/ -o openwsman_wrap.c openwsman.i")
  
  $CPPFLAGS = "-I/usr/include/openwsman -I.."
  
- create_makefile('_openwsman')
-+

openwsman-2.6.2-openssl-1.1-fix.patch

@@ -1,6 +1,6 @@
-diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
---- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/compat_unix.h	2025-02-03 09:11:35.072818890 +0100
+diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/src/server/shttpd/compat_unix.h
+--- openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig	2020-05-25 15:16:28.000000000 +0200
++++ openwsman-2.7.0/src/server/shttpd/compat_unix.h	2021-03-09 09:15:26.750942006 +0100
 @@ -27,10 +27,6 @@
  	pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
  #endif /* !NO_THREADS */
@@ -12,9 +12,9 @@ diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/sr
  #define	DIRSEP				'/'
  #define	IS_DIRSEP_CHAR(c)		((c) == '/')
  #define	O_BINARY			0
-diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
---- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/io_ssl.c	2025-02-03 09:12:22.387355905 +0100
+diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/server/shttpd/io_ssl.c
+--- openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig	2020-05-25 15:16:28.000000000 +0200
++++ openwsman-2.7.0/src/server/shttpd/io_ssl.c	2021-03-09 09:15:26.750942006 +0100
 @@ -11,28 +11,6 @@
  #include "defs.h"
  
@@ -44,10 +44,10 @@ diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/ser
  void
  _shttpd_ssl_handshake(struct stream *stream)
  {
-diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
---- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/shttpd.c	2025-02-03 09:13:43.415562784 +0100
-@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/server/shttpd/shttpd.c
+--- openwsman-2.7.0/src/server/shttpd/shttpd.c.orig	2020-05-25 15:16:28.000000000 +0200
++++ openwsman-2.7.0/src/server/shttpd/shttpd.c	2021-03-09 09:16:58.843241510 +0100
+@@ -1489,25 +1489,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
  	int		retval = FALSE;
  	EC_KEY*		key;
  
@@ -73,10 +73,10 @@ diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/ser
 +        OPENSSL_init_ssl(0, NULL);
  	if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
  #endif
- 	        _shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
-diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
---- openwsman-2.8.1/src/server/shttpd/ssl.h.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/ssl.h	2025-02-03 09:14:43.142975166 +0100
+ 		_shttpd_elog(E_LOG, NULL, "SSL_CTX_new error");
+diff -up openwsman-2.7.0/src/server/shttpd/ssl.h.orig openwsman-2.7.0/src/server/shttpd/ssl.h
+--- openwsman-2.7.0/src/server/shttpd/ssl.h.orig	2020-05-25 15:16:28.000000000 +0200
++++ openwsman-2.7.0/src/server/shttpd/ssl.h	2021-03-09 09:15:26.750942006 +0100
 @@ -12,55 +12,4 @@
  
  #include <openssl/ssl.h>

openwsman-2.7.2-fix-ftbfs.patch

@@ -0,0 +1,12 @@
+diff -up openwsman-2.7.2/bindings/openwsman.i.orig openwsman-2.7.2/bindings/openwsman.i
+--- openwsman-2.7.2/bindings/openwsman.i.orig	2024-01-22 09:36:42.764721705 +0100
++++ openwsman-2.7.2/bindings/openwsman.i	2024-01-22 09:37:29.970817151 +0100
+@@ -109,7 +109,7 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
+ 
+ %typemap(in) FILE* {
+ #if RUBY_VERSION > 18
+-  struct rb_io_t *fptr;
++  struct rb_io *fptr;
+ #else
+   struct OpenFile *fptr;
+ #endif

openwsman-2.7.2-gcc15-fix.patch

@@ -1,24 +0,0 @@
-diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
---- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c	2025-02-03 09:30:36.905616375 +0100
-@@ -49,7 +49,7 @@
-  */
- 
- static VALUE
--load_module()
-+load_module(VALUE)
- {
-   ruby_script(PLUGIN_FILE);
-   return rb_require(PLUGIN_FILE);
-diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
---- openwsman-2.8.1/src/server/CMakeLists.txt.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/CMakeLists.txt	2025-02-03 09:31:15.258241237 +0100
-@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
-   TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
- ENDIF( HAVE_LIBDL )
- 
--INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
-+INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
- 
- #		
- #

openwsman-2.7.2-ssl-certs-gen-changes.patch

@@ -1,102 +0,0 @@
-diff -up openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig openwsman-2.8.1/etc/owsmangencert.sh.cmake
---- openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/etc/owsmangencert.sh.cmake	2025-10-17 10:16:34.482996406 +0200
-@@ -1,10 +1,74 @@
--#!/bin/sh
--
- #!/bin/sh -e
- 
- CERTFILE=@WSMANCONF_DIR@/servercert.pem
- KEYFILE=@WSMANCONF_DIR@/serverkey.pem
- CNFFILE=@WSMANCONF_DIR@/ssleay.cnf
-+CAFILE=@WSMANCONF_DIR@/ca.crt
-+DAYS=365
-+
-+function create_ssl_cnf
-+{
-+    # Get minimum RSA key length at current security level
-+    # This workarounds openssl not enforcing min. key length enforced by current security level
-+    KEYSIZE=`grep min_rsa_size /etc/crypto-policies/state/CURRENT.pol | cut -d ' ' -f 3`
-+
-+    # Create OpenSSL configuration files for generating certificates
-+    echo "[ req ]" > $CNFFILE
-+    echo "default_bits            = $KEYSIZE" >> $CNFFILE
-+    echo "default_keyfile         = privkey.pem" >> $CNFFILE
-+    echo "distinguished_name      = req_distinguished_name" >> $CNFFILE
-+
-+    echo "[ req_distinguished_name ]" >> $CNFFILE
-+    echo "countryName                     = Country Name (2 letter code)" >> $CNFFILE
-+    echo "countryName_default             = GB" >> $CNFFILE
-+    echo "countryName_min                 = 2" >> $CNFFILE
-+    echo "countryName_max                 = 2" >> $CNFFILE
-+
-+    echo "stateOrProvinceName             = State or Province Name (full name)" >> $CNFFILE
-+    echo "stateOrProvinceName_default     = Some-State" >> $CNFFILE
-+
-+    echo "localityName                    = Locality Name (eg, city)" >> $CNFFILE
-+
-+    echo "organizationName                = Organization Name (eg, company; recommended)" >> $CNFFILE
-+    echo "organizationName_max            = 64" >> $CNFFILE
-+
-+    echo "organizationalUnitName          = Organizational Unit Name (eg, section)" >> $CNFFILE
-+    echo "organizationalUnitName_max      = 64" >> $CNFFILE
-+
-+    echo "commonName                      = server name (eg. ssl.domain.tld; required!!!)" >> $CNFFILE
-+    echo "commonName_max                  = 80" >> $CNFFILE
-+
-+    echo "emailAddress                    = Email Address" >> $CNFFILE
-+    echo "emailAddress_max                = 85" >> $CNFFILE
-+}
-+
-+function selfsign_sscg()
-+{
-+    sscg --quiet \
-+         --lifetime "$DAYS" \
-+         --cert-key-file "$KEYFILE" \
-+         --cert-file "$CERTFILE" \
-+         --ca-file "$CAFILE"
-+}
-+
-+function selfsign_openssl()
-+{
-+
-+    echo
-+    echo creating selfsigned certificate
-+    echo "replace it with one signed by a certification authority (CA)"
-+    echo
-+    echo enter your ServerName at the Common Name prompt
-+    echo
-+
-+    # use special .cnf, because with normal one no valid selfsigned
-+    # certificate is created
-+
-+    openssl req -days $DAYS $@ -config $CNFFILE \
-+        -new -x509 -nodes -out $CERTFILE \
-+        -keyout $KEYFILE
-+    chmod 600 $KEYFILE
-+}
- 
- if [ "$1" != "--force" -a -f $KEYFILE ]; then
-   echo "$KEYFILE exists!  Use \"$0 --force.\""
-@@ -15,18 +79,7 @@ if [ "$1" = "--force" ]; then
-   shift
- fi
- 
--echo
--echo creating selfsigned certificate
--echo "replace it with one signed by a certification authority (CA)"
--echo
--echo enter your ServerName at the Common Name prompt
--echo
--
--# use special .cnf, because with normal one no valid selfsigned
--# certificate is created
--
--openssl req -days 365 $@ -config $CNFFILE \
--  -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
--  -keyout $KEYFILE
--chmod 600 $KEYFILE
-+create_ssl_cnf
- 
-+# If sscg fails, try openssl
-+selfsign_sscg || selfsign_openssl

openwsman-2.8.1-fix-ruby-io.patch

@@ -1,33 +0,0 @@
-diff -up openwsman-2.8.1/bindings/openwsman.i.orig openwsman-2.8.1/bindings/openwsman.i
---- openwsman-2.8.1/bindings/openwsman.i.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/bindings/openwsman.i	2025-10-21 16:56:01.025576984 +0200
-@@ -105,15 +105,8 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
- #if HAVE_RUBY_THREAD_H /* New threading model */
- #include <ruby/thread.h>
- #endif
--#if RUBY_VERSION > 18
--  #if HAVE_RB_IO_T
--    #define rb_fptr_t rb_io_t
--  #else
--    #define rb_fptr_t struct rb_io
--  #endif
--#else
--  #define rb_fptr_t struct OpenFile
--#endif
-+/* Use rb_io_t for Ruby 1.9+ */
-+#define rb_fptr_t rb_io_t
- %}
- 
- %typemap(in) FILE* {
-@@ -122,11 +115,7 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
-   Check_Type($input, T_FILE);
-   GetOpenFile($input, fptr);
-   /*rb_io_check_writable(fptr);*/
--#if RUBY_VERSION > 18
-   $1 = rb_io_stdio_file(fptr);
--#else
--  $1 = GetReadFile(fptr);
--#endif
- }
- 
- #endif /* SWIGRUBY */

openwsman-2.8.1-post-quantum.patch

@@ -1,101 +0,0 @@
-diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
---- openwsman-2.7.2/etc/openwsman.conf.orig	2022-12-28 16:43:03.000000000 +0100
-+++ openwsman-2.7.2/etc/openwsman.conf	2025-05-27 08:03:57.890057721 +0200
-@@ -32,8 +32,12 @@ ipv6 = yes
- 
- # the openwsman server certificate file, in .pem format
- ssl_cert_file = /etc/openwsman/servercert.pem
-+# the openwsman server certificate fallback file, in .pem format
-+#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
- # the openwsman server private key, in .pem format
- ssl_key_file = /etc/openwsman/serverkey.pem
-+# the openwsman server private key fallback, in .pem format
-+#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
- 
- # space-separated list of SSL protocols to *dis*able
- # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
-diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
---- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig	2025-05-21 10:07:40.404532496 +0200
-+++ openwsman-2.7.2/src/server/shttpd/shttpd.c	2025-06-12 12:27:44.785904555 +0200
-@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
- 	char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
- 	char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
- 	int		retval = FALSE;
--	EC_KEY*		key;
- 
- 	/* Initialize SSL crap */
- 
-@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
- 	else
- 		retval = TRUE;
- 
--	/* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
--	key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
--	if (key != NULL) {
--		SSL_CTX_set_tmp_ecdh(CTX, key);
--		EC_KEY_free(key);
-+	/* Add fall back certificate/key pair */
-+	if (wsmand_options_get_ssl_cert_fallback_file() &&
-+                    wsmand_options_get_ssl_key_fallback_file()) {
-+		if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
-+			_shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
-+		else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
-+			_shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
-+		else
-+			retval = TRUE;
- 	}
- 
- 	while (ssl_disabled_protocols) {
-diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
---- openwsman-2.7.2/src/server/wsmand-daemon.c.orig	2025-05-27 07:18:16.878974761 +0200
-+++ openwsman-2.7.2/src/server/wsmand-daemon.c	2025-05-27 07:22:06.832235764 +0200
-@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
- #endif
- static int use_digest = 0;
- static char *ssl_key_file = NULL;
-+static char *ssl_key_fallback_file = NULL;
- static char *service_path = DEFAULT_SERVICE_PATH;
- static char *ssl_cert_file = NULL;
-+static char *ssl_cert_fallback_file = NULL;
- static char *ssl_disabled_protocols = NULL;
- static char *ssl_cipher_list = NULL;
- static char *pid_file = DEFAULT_PID_PATH;
-@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
- 	service_path =
- 	    iniparser_getstring(ini, "server:service_path", "/wsman");
- 	ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
-+	ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
- 	ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
-+	ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
-         ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
-         ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
- 	use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
-@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
- 	return ssl_cert_file;
- }
- 
-+char *wsmand_options_get_ssl_key_fallback_file(void)
-+{
-+	return ssl_key_fallback_file;
-+}
-+
-+char *wsmand_options_get_ssl_cert_fallback_file(void)
-+{
-+	return ssl_cert_fallback_file;
-+}
-+
- char *wsmand_options_get_ssl_disabled_protocols(void)
- {
- 	return ssl_disabled_protocols;
-diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
---- openwsman-2.7.2/src/server/wsmand-daemon.h.orig	2025-05-27 07:15:56.869002037 +0200
-+++ openwsman-2.7.2/src/server/wsmand-daemon.h	2025-05-27 07:18:06.429846617 +0200
-@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
- int wsmand_options_get_server_ssl_port(void);
- char *wsmand_options_get_ssl_key_file(void);
- char *wsmand_options_get_ssl_cert_file(void);
-+char *wsmand_options_get_ssl_key_fallback_file(void);
-+char *wsmand_options_get_ssl_cert_fallback_file(void);
- char *wsmand_options_get_ssl_disabled_protocols(void);
- char *wsmand_options_get_ssl_cipher_list(void);
- int wsmand_options_get_digest(void);

openwsman-2.8.1-rdoc-6_16.patch

@@ -1,18 +0,0 @@
-diff -urp '--exclude=*~' openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb
---- openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb	2026-01-02 23:43:41.804273994 +0900
-+++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2026-01-02 23:56:06.991238037 +0900
-@@ -377,7 +377,13 @@ class RDoc::Parser::SWIG < RDoc::Parser
-       find_modifiers comment, meth_obj if comment
- 
-       #meth_obj.params = params
--      meth_obj.start_collecting_tokens
-+      # https://github.com/ruby/rdoc/pull/1471 changes the parameter for
-+      # RDoc::TokenStream.start_collecting_tokens
-+      if meth_obj.method(:start_collecting_tokens).arity == 1
-+        meth_obj.start_collecting_tokens :ruby
-+      else
-+        meth_obj.start_collecting_tokens
-+      end
-       begin
-         RDoc::const_get "RubyToken"
-         tk = RDoc::RubyToken::Token.new nil, 1, 1

openwsman-2.8.1-rdoc-ruby34.patch

@@ -1,29 +0,0 @@
---- openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2025-11-10 15:00:00.000000000 +0100
-@@ -108,10 +108,24 @@ class RDoc::Parser::SWIG < RDoc::Parser
-   ##
-   # Prepare to parse a SWIG file
- 
--  def initialize(top_level, file_name, content, options, stats)
--    super
-+  def initialize(top_level, file_name, content, options, stats = nil)
-+    # RDoc 6.6+ (Ruby 3.3+) removed the stats parameter from Parser.initialize
-+    # Check the arity of the parent class initialize method to determine which API we're using
-+    parent_arity = RDoc::Parser.instance_method(:initialize).arity
-+    
-+    if parent_arity == 4 || parent_arity == -5
-+      # RDoc 6.6+: only pass 4 arguments to super
-+      super(top_level, file_name, content, options)
-+      # Create a dummy stats object for compatibility
-+      @stats = Object.new
-+      def @stats.method_missing(m, *args); end
-+    else
-+      # Older RDoc: pass all 5 arguments including stats
-+      super(top_level, file_name, content, options, stats)
-+      @stats = stats
-+    end
- 
-     @known_classes = RDoc::KNOWN_CLASSES.dup
-     @content = handle_tab_width handle_ifdefs_in(@content)
-     @renames = {} # maps old_name => [ new_name, args ]
-     @aliases = {} # maps name => [ alias_name, args ]

openwsman.spec

@@ -24,8 +24,8 @@
 %endif
 
 Name:		openwsman
-Version:	2.8.1
-Release:	13%{?dist}
+Version:	2.7.2
+Release:	11%{?dist}
 Summary:	Open source Implementation of WS-Management
 
 License:	BSD-3-Clause AND MIT
@@ -49,12 +49,7 @@ Patch2:		openwsman-2.4.12-ruby-binding-build.patch
 Patch3:		openwsman-2.6.2-openssl-1.1-fix.patch
 Patch4:		openwsman-2.6.5-http-status-line.patch
 Patch5:		openwsman-2.6.8-update-ssleay-conf.patch
-Patch6:		openwsman-2.7.2-gcc15-fix.patch
-Patch7:		openwsman-2.8.1-post-quantum.patch
-Patch8:		openwsman-2.7.2-ssl-certs-gen-changes.patch
-Patch9:		openwsman-2.8.1-rdoc-ruby34.patch
-Patch10:	openwsman-2.8.1-fix-ruby-io.patch
-Patch11:	openwsman-2.8.1-rdoc-6_16.patch
+Patch6:		openwsman-2.7.2-fix-ftbfs.patch
 BuildRequires:	make
 BuildRequires:	swig
 BuildRequires:	libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel
@@ -71,7 +66,6 @@ BuildRequires:	pkgconfig openssl-devel
 BuildRequires:	cmake
 BuildRequires:	systemd-units
 BuildRequires:	gcc gcc-c++
-BuildRequires:	libxcrypt-devel
 
 %description
 Openwsman is a project intended to provide an open-source
@@ -167,7 +161,6 @@ Requires:	libwsman1 = %{version}-%{release}
 This package provides Perl bindings to access the openwsman client API.
 %endif
 
-%if %{with_ruby}
 %package winrs
 Summary:	Windows Remote Shell
 Requires:	rubygem-%{gem_name} = %{version}-%{release}
@@ -175,7 +168,6 @@ Requires:	rubygem-%{gem_name} = %{version}-%{release}
 %description winrs
 This is a command line tool for the Windows Remote Shell protocol.
 You can use it to send shell commands to a remote Windows hosts.
-%endif
 
 %if 0%{?with_selinux}
 # SELinux subpackage
@@ -265,7 +257,6 @@ rm -f %{buildroot}/%{_libdir}/openwsman/plugins/*.la
 rm -f %{buildroot}/%{_libdir}/openwsman/authenticators/*.la
 %if %{with_ruby}
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsmanplugin.rb
-[ -d %{buildroot}/%{ruby_sitelibdir} ] && rm -f %{buildroot}/%{ruby_sitelibdir}/openwsmanplugin.rb
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsman.rb
 %endif
 mkdir -p %{buildroot}%{_sysconfdir}/init.d
@@ -292,8 +283,6 @@ rm -rf %{buildroot}%{gem_instdir}/ext
 
 mkdir -p %{buildroot}%{gem_extdir_mri}
 cp -a ./build%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/
-%else
-rm -f %{buildroot}%{_bindir}/winrs
 %endif
 
 %if 0%{?with_selinux}
@@ -399,7 +388,7 @@ fi
 %dir %{_libdir}/openwsman/plugins
 %{_libdir}/openwsman/plugins/*.so
 %{_libdir}/openwsman/plugins/*.so.*
-%{_bindir}/openwsmand
+%{_sbindir}/openwsmand
 %{_libdir}/libwsman_server.so.*
 %{_mandir}/man8/*
 
@@ -408,10 +397,8 @@ fi
 %{_libdir}/libwsman_clientpp.so.*
 %config(noreplace) %{_sysconfdir}/openwsman/openwsman_client.conf
 
-%if %{with_ruby}
 %files winrs
 %{_bindir}/winrs
-%endif
 
 %if 0%{?with_selinux}
 %files selinux
@@ -421,61 +408,6 @@ fi
 %endif
 
 %changelog
-* Thu Jan 08 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-13
-- Fix bogus 'sscg' arguments
-
-* Fri Jan 02 2026 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.8.1-12
-- Support rdoc 6.16 and above (for ruby4.0)
-
-* Wed Nov 12 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-11
-- Update OpenSSL certificates set up
-- Fix ruby binding, enable it
-
-* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 2.8.1-10
-- Rebuilt for Python 3.14.0rc3 bytecode
-
-* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 2.8.1-9
-- Rebuilt for Python 3.14.0rc2 bytecode
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 2.8.1-7
-- Perl 5.42 rebuild
-
-* Tue Jun 17 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-6
-- Update to better support post-quantum cryptography
-
-* Mon Jun 09 2025 Python Maint <python-maint@redhat.com> - 2.8.1-5
-- Rebuilt for Python 3.14
-
-* Mon Jun 09 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-4
-- Remove deprecated path from systemd service file
-
-* Tue Jun 03 2025 Python Maint <python-maint@redhat.com> - 2.8.1-3
-- Rebuilt for Python 3.14
-
-* Thu Apr 10 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
-- Build winrs only when ruby binding is enabled
-
-* Mon Apr 07 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
-- Update to openwsman-2.8.1
-
-* Fri Feb 28 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-16
-- Update minimum required cmake version
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.7.2-15
-- Add explicit BR: libxcrypt-devel
-
-* Thu Jan 23 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-14
-- Fix FTBFS with GCC 15, bin and sbin unification
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-13
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Jan 08 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-12
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
-
 * Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 

openwsmand.service

@@ -6,7 +6,7 @@ After=syslog.target
 Type=forking
 ExecStart=/usr/sbin/openwsmand -S
 ExecStartPre=/etc/openwsman/owsmantestcert.sh
-PIDFile=/run/wsmand.pid
+PIDFile=/var/run/wsmand.pid
 
 [Install]
 WantedBy=multi-user.target

plans/basic.fmf

@@ -1,9 +0,0 @@
-summary: Basic test plan
-prepare:
-    how: install
-    package:
-        - openwsman-server
-discover:
-    how: fmf
-execute:
-    how: tmt

rpminspect.yaml

@@ -1,5 +0,0 @@
----
-badfuncs:
-    allowed:
-        /usr/sbin/openwsmand:
-            - inet_ntoa

sources

@@ -1,2 +1,2 @@
 SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
-SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972
+SHA512 (v2.7.2.tar.gz) = ffd6a0d00a00b00e321b2b55e0c77326f5943ca3224eee74c706e53a1c5c44ef0e8b1cfde5d631966769eefd4e567b0db8713085b7a8b386c2871ab4ada83046

tests/post-quantum-cryptography/main.fmf

@@ -1,6 +0,0 @@
-summary: Post-quantum cryptography support test
-author: Vitezslav Crhonek <vcrhonek@redhat.com>
-contact: Vitezslav Crhonek <vcrhonek@redhat.com>
-require: patch
-duration: 10m
-test: ./runtest.sh

tests/post-quantum-cryptography/runtest.sh

@@ -1,92 +0,0 @@
-#!/bin/sh -eux
-
-function check_key_and_cert()
-{
-  echo -e "\n===== key info"
-  ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
-  file /etc/openwsman/serverkey.pem
-  echo -e "\n\n\n"
-
-  echo -e "\n===== cert info"
-  openssl x509 -in /etc/openwsman/servercert.pem --text --noout
-  echo -e "\n\n\n"
-}
-
-function test_key_exchange()
-{
-  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
-  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
-  echo -e "\n\n\n"
-  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
-  echo -e "\n\n\n"
-}
-
-function test_cert_support()
-{
-  echo -e "\n===== check that TLS certificate using ML-DSA works"
-  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
-  echo -e "\n\n\n"
-  grep "Peer signature type: mldsa65" cert-mldsa.out
-  echo -e "\n\n\n"
-  # simulate lack of ML-DSA support
-  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
-  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
-    tee cert-classic.out
-  echo -e "\n\n\n"
-  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
-  echo -e "\n\n\n"
-}
-
-(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
-systemctl start openwsmand
-check_key_and_cert
-test_key_exchange
-systemctl stop openwsmand
-
-# keep RSA certificate and key
-cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
-cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
-# remove previously generated certificates/keys
-rm -rf /etc/openwsman/{servercert,serverkey}.pem
-
-# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
-# and issue a self-signed certificate for localhost using this key
-patch /etc/openwsman/owsmangencert.sh << 'EOF'
---- owsmangencert.sh.orig	2026-01-08 03:50:31.852413993 -0500
-+++ owsmangencert.sh	2026-01-08 03:52:41.883088457 -0500
-@@ -65,7 +65,7 @@
-     # certificate is created
- 
-     openssl req -days $DAYS $@ -config $CNFFILE \
--        -new -x509 -nodes -out $CERTFILE \
-+        -newkey mldsa65 -x509 -nodes -out $CERTFILE \
-         -keyout $KEYFILE
-     chmod 600 $KEYFILE
- }
-EOF
-
-(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
-
-# update config file
-patch /etc/openwsman/openwsman.conf << 'EOF'
---- openwsman.conf.orig	2025-06-05 07:50:30.285822838 -0400
-+++ openwsman.conf	2025-06-05 07:50:38.609822838 -0400
-@@ -33,11 +33,11 @@
- # the openwsman server certificate file, in .pem format
- ssl_cert_file = /etc/openwsman/servercert.pem
- # the openwsman server certificate fallback file, in .pem format
--#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
-+ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
- # the openwsman server private key, in .pem format
- ssl_key_file = /etc/openwsman/serverkey.pem
- # the openwsman server private key fallback, in .pem format
--#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
-+ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
- 
- # space-separated list of SSL protocols to *dis*able
- # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
-EOF
-
-systemctl start openwsmand
-check_key_and_cert
-test_cert_support

tests/sscg-generated-certificates/main.fmf

@@ -1,6 +0,0 @@
-summary: Service works with 'sscg' generated SSL certificates
-author: Vitezslav Crhonek <vcrhonek@redhat.com>
-contact: Vitezslav Crhonek <vcrhonek@redhat.com>
-require: sscg
-duration: 10m
-test: ./runtest.sh

tests/sscg-generated-certificates/runtest.sh

@@ -1,17 +0,0 @@
-#!/bin/sh -ux
-
-# remove previously generated SSL files
-rm -rf /etc/openwsman/{servercert,serverkey}*.pem /etc/openwsman/ca.crt
-
-# remove SSL fallback to relly really just on sscg
-cp /etc/openwsman/owsmangencert.sh /etc/openwsman/test-script.sh
-sed -i 's/^selfsign_sscg ||.*/selfsign_sscg/' /etc/openwsman/test-script.sh
-
-# generate new SSL files using sscg
-/etc/openwsman/test-script.sh
-
-# check that SSL files were generated
-[ -f /etc/openwsman/servercert.pem ] && [ -f /etc/openwsman/serverkey.pem ] || { echo "Error: SSL files missing"; exit 1; }
-
-# try to start the service
-systemctl start openwsmand

tests/tests-DSP.yml

@@ -0,0 +1,37 @@
+- hosts: localhost
+
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    repositories:
+      - repo: https://pagure.io/DSP_test.git
+        dest: DSP_test
+        version: master
+
+    tests:
+    - DSP_test
+    environment:
+      # RPM package containing the policy module
+      TEST_RPM: openwsman-selinux
+      # policy module name
+      TEST_POLICY: openwsman
+      # policy sources will be extracted from corresponding .src.rpm
+      # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz")
+      # or empty string if policy sources are not inside a tar archive
+      POLICY_TAR: ''
+      # path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
+      # or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
+      # can contain wildcards (e.g. for versions etc.)
+      POLICY_PATH: .
+
+    required_packages:
+    - policycoreutils
+    - selinux-policy
+    - selinux-policy-targeted
+    - setools-console
+    - libselinux-utils
+    - rpm
+    - tar
+    - git
+    - openwsman-server