diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/plans/basic.fmf b/plans/basic.fmf deleted file mode 100644 index a1bca5a..0000000 --- a/plans/basic.fmf +++ /dev/null @@ -1,9 +0,0 @@ -summary: Basic test plan -prepare: - how: install - package: - - sblim-sfcb -discover: - how: fmf -execute: - how: tmt diff --git a/rpminspect.yaml b/rpminspect.yaml deleted file mode 100644 index f82c3c2..0000000 --- a/rpminspect.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -badfuncs: - allowed: - /usr/lib64/sfcb/libsfcHttpAdapter.so.*: - - inet_aton - -runpath: - allowed_paths: - - /usr/lib64/sfcb diff --git a/sblim-sfcb-1.4.9-docdir-license.patch b/sblim-sfcb-1.4.9-docdir-license.patch deleted file mode 100644 index 1262628..0000000 --- a/sblim-sfcb-1.4.9-docdir-license.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -up sblim-sfcb-1.4.9/Makefile.in.orig sblim-sfcb-1.4.9/Makefile.in ---- sblim-sfcb-1.4.9/Makefile.in.orig 2018-10-11 10:03:54.533549400 +0200 -+++ sblim-sfcb-1.4.9/Makefile.in 2018-10-11 10:04:12.199570473 +0200 -@@ -619,7 +619,7 @@ top_srcdir = @top_srcdir@ - # - # - AUTOMAKE_OPTIONS = no-dist-gzip dist-bzip2 --sfcbdocdir = $(datadir)/doc/sfcb-$(VERSION) -+sfcbdocdir = $(datadir)/doc/sblim-sfcb - sfcbdatadir = $(datadir)/sfcb - sfcbconfdir = $(sysconfdir)/sfcb - sfcbstatedir = $(localstatedir)/lib/sfcb -@@ -908,7 +908,7 @@ dist_sfcbdata_DATA = default.reg 10_inte - nodist_bin_SCRIPTS = sfcbrepos sfcbstage sfcbunstage sfcbuuid - dist_bin_SCRIPTS = wbemcat xmltest - init_SCRIPTS = sfcb --sfcbdoc_DATA = README AUTHORS COPYING -+sfcbdoc_DATA = README AUTHORS - sfcbconf_DATA = sfcb.cfg - @PAM_TRUE@dist_pam_DATA = pam/sfcb - @DOCS_TRUE@noinst_DATA = doc/html/index.html diff --git a/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch b/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch deleted file mode 100644 index f1ebb45..0000000 --- a/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up sblim-sfcb-1.4.9/configure.orig sblim-sfcb-1.4.9/configure ---- sblim-sfcb-1.4.9/configure.orig 2018-09-26 09:43:18.678547933 +0200 -+++ sblim-sfcb-1.4.9/configure 2018-09-26 09:43:31.603560105 +0200 -@@ -5426,8 +5426,6 @@ case $host_cpu in - $as_echo "#define SFCB_IX86 1" >>confdefs.h - - ;; -- powerpc*) CFLAGS="$CFLAGS -O0" -- ;; - esac - - diff --git a/sblim-sfcb-1.4.9-post-quantum.patch b/sblim-sfcb-1.4.9-post-quantum.patch deleted file mode 100644 index 16e64a4..0000000 --- a/sblim-sfcb-1.4.9-post-quantum.patch +++ /dev/null @@ -1,77 +0,0 @@ -diff -up sblim-sfcb-1.4.9/control.c.orig sblim-sfcb-1.4.9/control.c ---- sblim-sfcb-1.4.9/control.c.orig 2025-05-28 10:39:14.751599855 +0200 -+++ sblim-sfcb-1.4.9/control.c 2025-06-12 10:20:43.025624410 +0200 -@@ -171,10 +171,12 @@ static Control init[] = { - - {"sslKeyFilePath", CTL_STRING, SFCB_CONFDIR "/file.pem", {0}}, - {"sslCertificateFilePath", CTL_STRING, SFCB_CONFDIR "/server.pem", {0}}, -+ {"sslKeyFallbackFilePath", CTL_STRING, NULL, {0}}, -+ {"sslCertificateFallbackFilePath", CTL_STRING, NULL, {0}}, - {"sslCertList", CTL_STRING, SFCB_CONFDIR "/clist.pem", {0}}, - {"sslCiphers", CTL_STRING, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", {0}}, - {"sslDhParamsFilePath", CTL_STRING, NULL, {0}}, -- {"sslEcDhCurveName", CTL_STRING, "secp384r1", {0}}, -+ {"sslEcDhCurveName", CTL_STRING, NULL, {0}}, - {"enableSslCipherServerPref", CTL_BOOL, NULL, {.b=0}}, - - {"registrationDir", CTL_STRING, SFCB_STATEDIR "/registration", {0}}, -diff -up sblim-sfcb-1.4.9/httpAdapter.c.orig sblim-sfcb-1.4.9/httpAdapter.c ---- sblim-sfcb-1.4.9/httpAdapter.c.orig 2025-05-21 10:41:30.727123823 +0200 -+++ sblim-sfcb-1.4.9/httpAdapter.c 2025-06-12 11:14:32.906455875 +0200 -@@ -2053,6 +2053,24 @@ initSSL() - _SFCB_TRACE(1, ("--- sslKeyFilePath = %s", fnk)); - if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1) - intSSLerror("Error loading private key from file"); -+ -+ /* -+ * Add fall back certificate/key pair -+ */ -+ getControlChars("sslCertificateFallbackFilePath", &fnc); -+ if (fnc) { -+ _SFCB_TRACE(1, ("--- sslCertificateFallbackFilePath = %s", fnc)); -+ if (SSL_CTX_use_certificate_chain_file(ctx, fnc) != 1) -+ intSSLerror("Error loading certificate fall back from file"); -+ } -+ -+ getControlChars("sslKeyFallbackFilePath", &fnk); -+ if (fnk) { -+ _SFCB_TRACE(1, ("--- sslKeyFallbackFilePath = %s", fnk)); -+ if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1) -+ intSSLerror("Error loading private key fall back from file"); -+ } -+ - getControlChars("sslClientCertificate", &fnl); - _SFCB_TRACE(1, ("--- sslClientCertificate = %s", fnl)); - getControlChars("sslCertList", &fcert); -diff -up sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig sblim-sfcb-1.4.9/sfcb.cfg.pre.in ---- sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig 2025-05-28 10:05:42.359932525 +0200 -+++ sblim-sfcb-1.4.9/sfcb.cfg.pre.in 2025-06-12 11:23:37.424277273 +0200 -@@ -244,6 +244,15 @@ sslKeyFilePath: @sysconfdir@/sfcb/file.p - ## Default is @sysconfdir@/sfcb/server.pem - sslCertificateFilePath: @sysconfdir@/sfcb/server.pem - -+## Filename containing the fall back private key for the server's fall back certificate. -+## The file must be in PEM format and may not be passphrase-protected. The file is -+## relevant for both client connect and indications sent via https. -+#sslKeyFallbackFilePath: @sysconfdir@/sfcb/file-fallback.pem -+ -+## Filename containing the server's fall back certificate. Must be in PEM format. -+## The file is relevant for both client connect and indications sent via https. -+#sslCertificateFallbackFilePath: @sysconfdir@/sfcb/server-fallback.pem -+ - ## Filename containing list of certificates server accepts. - ## The file is relevant client connect only. - ## Default is @sysconfdir@/sfcb/clist.pem -@@ -302,10 +311,10 @@ sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STR - ## Configure a curve name for ECDH ephemeral key generation. See man - ## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name - ## listed by the "openssl ecparam -list_curves" command in the SFCB runtime --## environment. If this value is not set, the indicated default is in effect. -+## environment. If this value is not set, ECDH ephemeral key generation is not used. - ## If the value is set but the curve name is not recognized by the underlying - ## openssl implementation, SFCB will abort. --## Default is secp384r1 -+## Default is: not set - #sslEcDhCurveName: secp384r1 - - ## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl diff --git a/sblim-sfcb.spec b/sblim-sfcb.spec index c3e8c28..6ee64dd 100644 --- a/sblim-sfcb.spec +++ b/sblim-sfcb.spec @@ -8,16 +8,14 @@ Name: sblim-sfcb Summary: Small Footprint CIM Broker URL: http://sblim.wiki.sourceforge.net/ Version: 1.4.9 -Release: 38%{?dist} -License: EPL-1.0 +Release: 9%{?dist} +License: EPL Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2 Source1: sfcb.service # Missing man pages Source2: sfcbdump.1.gz Source3: sfcbinst2mof.1.gz Source4: sfcbtrace.1.gz -# /etc/tmpfiles.d configuration file -Source5: sblim-sfcb.tmpfiles # Patch0: changes schema location to the path we use Patch0: sblim-sfcb-1.3.9-sfcbrepos-schema-location.patch # Patch1: Fix provider debugging - variable for stopping wait-for-debugger @@ -38,18 +36,9 @@ Patch7: sblim-sfcb-1.4.9-fix-null-deref.patch # Patch8: fix null pointer (DoS) vulnerability via POST request to /cimom # (CVE-2018-6644), patch by Adam Majer, rhbz#1543826 Patch8: sblim-sfcb-1.4.9-fix-null-content-type-crash.patch -# Patch9: removes decrease of optimization level to -O0 on ppc64le -Patch9: sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch -# Patch10: fixes docdir name and removes install of COPYING with license -# which is included through %%license -Patch10: sblim-sfcb-1.4.9-docdir-license.patch -# Patch11: adds configuration options to specify fallback SSL cert/key pair -# and disables default ECDH ephemeral key generation -Patch11: sblim-sfcb-1.4.9-post-quantum.patch Provides: cim-server = 0 Requires: cim-schema Requires: sblim-sfcCommon -BuildRequires: make BuildRequires: libcurl-devel BuildRequires: perl-generators BuildRequires: zlib-devel @@ -61,7 +50,6 @@ BuildRequires: sblim-cmpi-devel BuildRequires: systemd BuildRequires: sblim-sfcCommon-devel BuildRequires: openslp-devel -BuildRequires: gcc Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units @@ -76,29 +64,20 @@ Programming Interface (CMPI). %prep %setup -q -T -b 0 -n %{name}-%{version} -%patch -P0 -p1 -b .sfcbrepos-schema-location -%patch -P1 -p1 -b .fix-provider-debugging -%patch -P2 -p1 -b .maxMsgLen -%patch -P3 -p1 -b .service -%patch -P4 -p1 -b .multilib-man-cfg -%patch -P5 -p1 -b .default-ecdh-curve-name -%patch -P6 -p1 -b .fix-ftbfs -%patch -P7 -p1 -b .fix-null-deref -%patch -P8 -p1 -b .fix-null-content-type-crash -%patch -P9 -p1 -b .fix-ppc-optimization-level -%patch -P10 -p1 -b .docdir-license -%patch -P11 -p1 -b .post-quantum - -# Create a sysusers.d config file -cat >sblim-sfcb.sysusers.conf < _pkg_list +echo "%defattr(-,root,root,-)" > _pkg_list + find $RPM_BUILD_ROOT/%{_datadir}/sfcb -type f | grep -v $RPM_BUILD_ROOT/%{_datadir}/sfcb/CIM >> _pkg_list sed -i s?$RPM_BUILD_ROOT??g _pkg_list > _pkg_list_2 echo "%config(noreplace) %{_sysconfdir}/sfcb/*" >> _pkg_list echo "%config(noreplace) %{_sysconfdir}/pam.d/*" >> _pkg_list -echo "%doc %{_datadir}/doc/sblim-sfcb/[!COPYING]*" >> _pkg_list +echo "%doc %{_datadir}/doc/*" >> _pkg_list echo "%{_datadir}/man/man1/*" >> _pkg_list echo "%{_unitdir}/sblim-sfcb.service" >> _pkg_list echo "%{_localstatedir}/lib/sfcb" >> _pkg_list echo "%{_bindir}/*" >> _pkg_list +echo "%{_sbindir}/*" >> _pkg_list echo "%{_libdir}/sfcb/*.so.*" >> _pkg_list echo "%{_libdir}/sfcb/*.so" >> _pkg_list cat _pkg_list -install -m0644 -D sblim-sfcb.sysusers.conf %{buildroot}%{_sysusersdir}/sblim-sfcb.conf -mkdir -p %{buildroot}/%{_tmpfilesdir} -install -p -D -m 644 %{SOURCE5} %{buildroot}/%{_tmpfilesdir}/sblim-sfcb.conf +%pre +/usr/bin/getent group sfcb >/dev/null || /usr/sbin/groupadd -r sfcb +/usr/sbin/usermod -a -G sfcb root > /dev/null 2>&1 || : %post %{_datadir}/sfcb/genSslCert.sh %{_sysconfdir}/sfcb &>/dev/null || : /sbin/ldconfig -%{_bindir}/sfcbrepos -f > /dev/null 2>&1 +%{_bindir}/sfcbrepos -f > /dev/null 2>1 %systemd_post sblim-sfcb.service -# copy content of /var/lib/sfcb to temporary place for Image Mode -(mkdir -p /usr/share/factory/var/lib && cp -a /var/lib/sfcb /usr/share/factory/var/lib/sfcb) >/dev/null 2>&1 || : %preun %systemd_preun sblim-sfcb.service -if [ $1 -eq 0 ]; then - # Package removal, not upgrade - rm -rf /usr/share/factory/var/lib/sfcb -fi %postun /sbin/ldconfig %systemd_postun_with_restart sblim-sfcb.service +if [ $1 -eq 0 ]; then + /usr/sbin/groupdel sfcb > /dev/null 2>&1 || :; +fi; %files -f _pkg_list -%{_sysusersdir}/sblim-sfcb.conf -%{_tmpfilesdir}/sblim-sfcb.conf %changelog -* Fri Sep 12 2025 Vitezslav Crhonek - 1.4.9-38 -- Add support for Image Mode - -* Fri Jul 25 2025 Fedora Release Engineering - 1.4.9-37 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jun 17 2025 Vitezslav Crhonek - 1.4.9-36 -- Update to better support post-quantum cryptography - -* Thu Mar 06 2025 Vitezslav Crhonek - 1.4.9-35 -- bin and sbin unification - -* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek - 1.4.9-34 -- Add sysusers.d config file to allow rpm to create users/groups automatically - -* Sun Jan 19 2025 Fedora Release Engineering - 1.4.9-33 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Sat Jul 20 2024 Fedora Release Engineering - 1.4.9-32 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Jan 27 2024 Fedora Release Engineering - 1.4.9-31 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sat Jul 22 2023 Fedora Release Engineering - 1.4.9-30 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Tue Feb 14 2023 Vitezslav Crhonek - 1.4.9-29 -- SPDX migration - -* Sat Jan 21 2023 Fedora Release Engineering - 1.4.9-28 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 1.4.9-27 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Jan 27 2022 Vitezslav Crhonek - 1.4.9-26 -- Change build flags, fix errors during the start of the service - -* Sat Jan 22 2022 Fedora Release Engineering - 1.4.9-25 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Sep 14 2021 Sahana Prasad - 1.4.9-24 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 1.4.9-23 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.4.9-22 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Wed Jan 27 2021 Fedora Release Engineering - 1.4.9-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 1.4.9-20 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Wed Jul 08 2020 Vitezslav Crhonek - 1.4.9-19 -- Fix sfcbrepos redirection - -* Wed Feb 12 2020 Vitezslav Crhonek - 1.4.9-18 -- Fixes multiple definiton of variables (FTBFS with GCC 10) - Resolves: #1800074 - -* Thu Jan 30 2020 Fedora Release Engineering - 1.4.9-17 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Jul 26 2019 Fedora Release Engineering - 1.4.9-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Sat Feb 02 2019 Fedora Release Engineering - 1.4.9-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Oct 11 2018 Vitezslav Crhonek - 1.4.9-14 -- Don't decrease optimization level to -O0 on ppc64le -- Use %%license for file which contains the text of the license -- Change versioned docdir to unversioned and rename the docdir to match - the package name -- Remove %%defattr - -* Mon Oct 08 2018 Vitezslav Crhonek - 1.4.9-13 -- Fix license tag - -* Sat Jul 14 2018 Fedora Release Engineering - 1.4.9-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Tue Feb 27 2018 Vitezslav Crhonek - 1.4.9-11 -- Add BuildRequires gcc - -* Wed Feb 14 2018 Vitezslav Crhonek - 1.4.9-10 +* Wed Feb 14 2018 Vitezslav Crhonek - 1.4.9-9 - Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644) (patch by Adam Majer) Resolves: #1543825 -* Fri Feb 09 2018 Fedora Release Engineering - 1.4.9-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - * Thu Aug 03 2017 Fedora Release Engineering - 1.4.9-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild diff --git a/sblim-sfcb.tmpfiles b/sblim-sfcb.tmpfiles deleted file mode 100644 index 897304c..0000000 --- a/sblim-sfcb.tmpfiles +++ /dev/null @@ -1,2 +0,0 @@ -# populate /var/lib/sfcb with content from /usr/share/factory/var/lib/sfcb -C /var/lib/sfcb - - - - diff --git a/tests/post-quantum-cryptography/main.fmf b/tests/post-quantum-cryptography/main.fmf deleted file mode 100644 index 51ba4e2..0000000 --- a/tests/post-quantum-cryptography/main.fmf +++ /dev/null @@ -1,6 +0,0 @@ -summary: Post-quantum cryptography support test -author: Vitezslav Crhonek -contact: Vitezslav Crhonek -require: patch -duration: 10m -test: ./runtest.sh diff --git a/tests/post-quantum-cryptography/runtest.sh b/tests/post-quantum-cryptography/runtest.sh deleted file mode 100755 index 568b5b2..0000000 --- a/tests/post-quantum-cryptography/runtest.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/sh -eux - -function check_key_and_cert() -{ - echo -e "\n===== key info" - ssh-keygen -l -f /etc/sfcb/file.pem || : - file /etc/sfcb/file.pem - echo -e "\n\n\n" - - echo -e "\n===== cert info" - openssl x509 -in /etc/sfcb/server.pem --text --noout - echo -e "\n\n\n" -} - -function test_key_exchange() -{ - echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it" - openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client.pem > /etc/sfcb/sfcb.cfg -echo "sslCertificateFallbackFilePath: /etc/sfcb/server-fallback.pem" >> /etc/sfcb/sfcb.cfg - -systemctl start sblim-sfcb -check_key_and_cert -test_cert_support