diff --git a/0001-Catch-exception-by-reference.patch b/0001-Catch-exception-by-reference.patch deleted file mode 100644 index 575ea39..0000000 --- a/0001-Catch-exception-by-reference.patch +++ /dev/null @@ -1,25 +0,0 @@ -From a54a62a4e1a4e6bd34284a5de44550979f3155ec Mon Sep 17 00:00:00 2001 -From: Mattias Ellert -Date: Mon, 2 Jan 2023 07:46:32 +0100 -Subject: [PATCH 1/6] Catch exception by reference - ---- - src/common/options.cc | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/common/options.cc b/src/common/options.cc -index 027644a..d700950 100644 ---- a/src/common/options.cc -+++ b/src/common/options.cc -@@ -198,7 +198,7 @@ getopts(int argc, char * const argv[], struct option *longopts) - - try { - opts = new struct option[num+1]; -- } catch ( std::bad_alloc) { -+ } catch (std::bad_alloc &e) { - return false; - } - --- -2.38.1 - diff --git a/0002-Fix-warning-about-possible-use-after-free.patch b/0002-Fix-warning-about-possible-use-after-free.patch deleted file mode 100644 index cadd67a..0000000 --- a/0002-Fix-warning-about-possible-use-after-free.patch +++ /dev/null @@ -1,44 +0,0 @@ -From b3cc395eddfc0583bba0e2d302230ebe8770599d Mon Sep 17 00:00:00 2001 -From: Mattias Ellert -Date: Mon, 2 Jan 2023 12:51:26 +0100 -Subject: [PATCH 2/6] Fix warning about possible use after free - -Fix also a warning about an unused variable. This piece of code can probably -go away, but let's just fix the warning for the time being. ---- - src/sslutils/sslutils.c | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c -index 6bac77e..8b0f4c4 100644 ---- a/src/sslutils/sslutils.c -+++ b/src/sslutils/sslutils.c -@@ -455,7 +455,7 @@ ERR_load_prxyerr_strings( - #else - char * randfile; - #endif --#if SSLEAY_VERSION_NUMBER >= 0x0090581fL -+#if SSLEAY_VERSION_NUMBER >= 0x0090581fL && !defined(OPENSSL_NO_EGD) - char * egd_path; - #endif - char buffer[200]; -@@ -2703,8 +2703,14 @@ proxy_get_filenames( - } - - } -- else -- strcpy(default_user_cert, certname); -+ else { -+ default_user_cert = strndup(certname, strlen(certname)); -+ -+ if (!default_user_cert) { -+ PRXYerr(PRXYERR_F_INIT_CRED, PRXYERR_R_OUT_OF_MEMORY); -+ goto err; -+ } -+ } - - default_user_key = strndup(default_user_cert, strlen(default_user_cert)); - --- -2.38.1 - diff --git a/0003-Fix-doxygen-warning.patch b/0003-Fix-doxygen-warning.patch deleted file mode 100644 index f73b807..0000000 --- a/0003-Fix-doxygen-warning.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 77020a5574bfdbdcdebe03a3ee5d3d3f99563c03 Mon Sep 17 00:00:00 2001 -From: Mattias Ellert -Date: Mon, 2 Jan 2023 12:53:26 +0100 -Subject: [PATCH 3/6] Fix doxygen warning - -About a documented return type for a function that does not return anything. ---- - src/api/ccapi/voms_apic.h | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/src/api/ccapi/voms_apic.h b/src/api/ccapi/voms_apic.h -index 8807803..a3551f4 100644 ---- a/src/api/ccapi/voms_apic.h -+++ b/src/api/ccapi/voms_apic.h -@@ -205,8 +205,7 @@ extern struct contactdata **VOMS_FindByVO(struct vomsdata *vd, char *vo, - - - extern void VOMS_DeleteContacts(struct contactdata **list); /*!< Frees a contactdata vector. -- \param list The vector to free. -- \return NONE */ -+ \param list The vector to free.*/ - - extern struct vomsdata *VOMS_Init(char *voms, char *cert); /*!< Initializes a vomsdata structure for use by the other functions. - N.B: This is the ONLY way to correctly initialize a vomsdata structure. It --- -2.38.1 - diff --git a/0004-Fix-warning-about-possible-string-truncation.patch b/0004-Fix-warning-about-possible-string-truncation.patch deleted file mode 100644 index 3aee91b..0000000 --- a/0004-Fix-warning-about-possible-string-truncation.patch +++ /dev/null @@ -1,29 +0,0 @@ -From bda11dca2561d937f0452d710a0c6755e9b92c6d Mon Sep 17 00:00:00 2001 -From: Mattias Ellert -Date: Mon, 2 Jan 2023 13:08:28 +0100 -Subject: [PATCH 4/6] Fix warning about possible string truncation - -This is a false positive, since the source is an 8-byte hash and -is copied into an 8-byte substring. memcpy is a better fit anyway. ---- - src/sslutils/evaluate.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/sslutils/evaluate.c b/src/sslutils/evaluate.c -index 09b8ba4..9c03fdc 100644 ---- a/src/sslutils/evaluate.c -+++ b/src/sslutils/evaluate.c -@@ -353,8 +353,8 @@ void PRIVATE read_pathrestriction(STACK_OF(X509) *chain, char *path, - hash = gethash(cert, hashed); - - /* Determine file names */ -- strncpy(signing + 1, hash, 8); -- strncpy(namespace + 1, hash, 8); -+ memcpy(signing + 1, hash, 8); -+ memcpy(namespace + 1, hash, 8); - - file = open_from_dir(path, signing); - if (file) { --- -2.38.1 - diff --git a/0005-config.h-must-not-be-included-in-public-header-file.patch b/0005-config.h-must-not-be-included-in-public-header-file.patch deleted file mode 100644 index eacbd98..0000000 --- a/0005-config.h-must-not-be-included-in-public-header-file.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 25dfdfc41b9dafdbe3b140d7b9f4ef61c7cd57ac Mon Sep 17 00:00:00 2001 -From: Mattias Ellert -Date: Mon, 2 Jan 2023 13:41:19 +0100 -Subject: [PATCH 5/6] config.h must not be included in public header file - -This reverts 5c022c1 ---- - src/api/ccapi/voms_api.h | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/src/api/ccapi/voms_api.h b/src/api/ccapi/voms_api.h -index 0cb4e15..7a272cd 100644 ---- a/src/api/ccapi/voms_api.h -+++ b/src/api/ccapi/voms_api.h -@@ -26,8 +26,6 @@ - #ifndef VOMS_API_H - #define VOMS_API_H - --#include "config.h" -- - #include - #include - #include --- -2.38.1 - diff --git a/0006-Include-config.h-before-other-header-files.patch b/0006-Include-config.h-before-other-header-files.patch deleted file mode 100644 index c7a4b82..0000000 --- a/0006-Include-config.h-before-other-header-files.patch +++ /dev/null @@ -1,30 +0,0 @@ -From b7a926e38db6b883f012c39ebcb10b4ee20912cc Mon Sep 17 00:00:00 2001 -From: Francesco Giacomini -Date: Mon, 2 Jan 2023 13:42:26 +0100 -Subject: [PATCH 6/6] Include config.h before other header files - -This is an alternative (and not wrong) solution to commit 5c022c1 -to define the macro OPENSSL_COMPAT_API before OpenSSL does it. ---- - src/api/ccapi/api_util.cc | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc -index e023cfc..848bfbd 100644 ---- a/src/api/ccapi/api_util.cc -+++ b/src/api/ccapi/api_util.cc -@@ -23,10 +23,10 @@ - * - *********************************************************************/ - -+#include "config.h" - #include "api_util.h" - - extern "C" { --#include "config.h" - #include "replace.h" - - #include --- -2.38.1 - diff --git a/0007-Compile-and-link-libvomsapi-with-proper-thread-flags.patch b/0007-Compile-and-link-libvomsapi-with-proper-thread-flags.patch deleted file mode 100644 index c09d947..0000000 --- a/0007-Compile-and-link-libvomsapi-with-proper-thread-flags.patch +++ /dev/null @@ -1,589 +0,0 @@ -From 0d6d98cf444ba12418a03419852edf4560988c58 Mon Sep 17 00:00:00 2001 -From: Francesco Giacomini -Date: Sun, 8 Jan 2023 20:07:36 +0100 -Subject: [PATCH 07/12] Compile and link libvomsapi with proper thread flags - ---- - .gitignore | 1 + - configure.ac | 2 + - m4/ax_pthread.m4 | 522 ++++++++++++++++++++++++++++++++++++++ - src/api/ccapi/Makefile.am | 2 + - 4 files changed, 527 insertions(+) - create mode 100644 m4/ax_pthread.m4 - -diff --git a/.gitignore b/.gitignore -index fa51e16..a033402 100644 ---- a/.gitignore -+++ b/.gitignore -@@ -13,6 +13,7 @@ Makefile.in - Makefile - /aux - /m4/* -+!/m4/ax_pthread.m4 - !/m4/glite.m4 - !/m4/voms.m4 - !/m4/wsdl2h.m4 -diff --git a/configure.ac b/configure.ac -index 0b75342..2899f71 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -31,6 +31,8 @@ AC_PROG_YACC - AC_PROG_LEX - AC_COMPILER - -+AX_PTHREAD -+ - PKG_CHECK_MODULES([OPENSSL], [openssl], [AC_DEFINE([OPENSSL_API_COMPAT], [10100], [Build against OpenSSL 1.1 API])]) - - AC_CHECK_HEADER([expat.h], -diff --git a/m4/ax_pthread.m4 b/m4/ax_pthread.m4 -new file mode 100644 -index 0000000..9f35d13 ---- /dev/null -+++ b/m4/ax_pthread.m4 -@@ -0,0 +1,522 @@ -+# =========================================================================== -+# https://www.gnu.org/software/autoconf-archive/ax_pthread.html -+# =========================================================================== -+# -+# SYNOPSIS -+# -+# AX_PTHREAD([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]]) -+# -+# DESCRIPTION -+# -+# This macro figures out how to build C programs using POSIX threads. It -+# sets the PTHREAD_LIBS output variable to the threads library and linker -+# flags, and the PTHREAD_CFLAGS output variable to any special C compiler -+# flags that are needed. (The user can also force certain compiler -+# flags/libs to be tested by setting these environment variables.) -+# -+# Also sets PTHREAD_CC and PTHREAD_CXX to any special C compiler that is -+# needed for multi-threaded programs (defaults to the value of CC -+# respectively CXX otherwise). (This is necessary on e.g. AIX to use the -+# special cc_r/CC_r compiler alias.) -+# -+# NOTE: You are assumed to not only compile your program with these flags, -+# but also to link with them as well. For example, you might link with -+# $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS -+# $PTHREAD_CXX $CXXFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS -+# -+# If you are only building threaded programs, you may wish to use these -+# variables in your default LIBS, CFLAGS, and CC: -+# -+# LIBS="$PTHREAD_LIBS $LIBS" -+# CFLAGS="$CFLAGS $PTHREAD_CFLAGS" -+# CXXFLAGS="$CXXFLAGS $PTHREAD_CFLAGS" -+# CC="$PTHREAD_CC" -+# CXX="$PTHREAD_CXX" -+# -+# In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant -+# has a nonstandard name, this macro defines PTHREAD_CREATE_JOINABLE to -+# that name (e.g. PTHREAD_CREATE_UNDETACHED on AIX). -+# -+# Also HAVE_PTHREAD_PRIO_INHERIT is defined if pthread is found and the -+# PTHREAD_PRIO_INHERIT symbol is defined when compiling with -+# PTHREAD_CFLAGS. -+# -+# ACTION-IF-FOUND is a list of shell commands to run if a threads library -+# is found, and ACTION-IF-NOT-FOUND is a list of commands to run it if it -+# is not found. If ACTION-IF-FOUND is not specified, the default action -+# will define HAVE_PTHREAD. -+# -+# Please let the authors know if this macro fails on any platform, or if -+# you have any other suggestions or comments. This macro was based on work -+# by SGJ on autoconf scripts for FFTW (http://www.fftw.org/) (with help -+# from M. Frigo), as well as ac_pthread and hb_pthread macros posted by -+# Alejandro Forero Cuervo to the autoconf macro repository. We are also -+# grateful for the helpful feedback of numerous users. -+# -+# Updated for Autoconf 2.68 by Daniel Richard G. -+# -+# LICENSE -+# -+# Copyright (c) 2008 Steven G. Johnson -+# Copyright (c) 2011 Daniel Richard G. -+# Copyright (c) 2019 Marc Stevens -+# -+# This program is free software: you can redistribute it and/or modify it -+# under the terms of the GNU General Public License as published by the -+# Free Software Foundation, either version 3 of the License, or (at your -+# option) any later version. -+# -+# This program is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General -+# Public License for more details. -+# -+# You should have received a copy of the GNU General Public License along -+# with this program. If not, see . -+# -+# As a special exception, the respective Autoconf Macro's copyright owner -+# gives unlimited permission to copy, distribute and modify the configure -+# scripts that are the output of Autoconf when processing the Macro. You -+# need not follow the terms of the GNU General Public License when using -+# or distributing such scripts, even though portions of the text of the -+# Macro appear in them. The GNU General Public License (GPL) does govern -+# all other use of the material that constitutes the Autoconf Macro. -+# -+# This special exception to the GPL applies to versions of the Autoconf -+# Macro released by the Autoconf Archive. When you make and distribute a -+# modified version of the Autoconf Macro, you may extend this special -+# exception to the GPL to apply to your modified version as well. -+ -+#serial 31 -+ -+AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD]) -+AC_DEFUN([AX_PTHREAD], [ -+AC_REQUIRE([AC_CANONICAL_HOST]) -+AC_REQUIRE([AC_PROG_CC]) -+AC_REQUIRE([AC_PROG_SED]) -+AC_LANG_PUSH([C]) -+ax_pthread_ok=no -+ -+# We used to check for pthread.h first, but this fails if pthread.h -+# requires special compiler flags (e.g. on Tru64 or Sequent). -+# It gets checked for in the link test anyway. -+ -+# First of all, check if the user has set any of the PTHREAD_LIBS, -+# etcetera environment variables, and if threads linking works using -+# them: -+if test "x$PTHREAD_CFLAGS$PTHREAD_LIBS" != "x"; then -+ ax_pthread_save_CC="$CC" -+ ax_pthread_save_CFLAGS="$CFLAGS" -+ ax_pthread_save_LIBS="$LIBS" -+ AS_IF([test "x$PTHREAD_CC" != "x"], [CC="$PTHREAD_CC"]) -+ AS_IF([test "x$PTHREAD_CXX" != "x"], [CXX="$PTHREAD_CXX"]) -+ CFLAGS="$CFLAGS $PTHREAD_CFLAGS" -+ LIBS="$PTHREAD_LIBS $LIBS" -+ AC_MSG_CHECKING([for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS]) -+ AC_LINK_IFELSE([AC_LANG_CALL([], [pthread_join])], [ax_pthread_ok=yes]) -+ AC_MSG_RESULT([$ax_pthread_ok]) -+ if test "x$ax_pthread_ok" = "xno"; then -+ PTHREAD_LIBS="" -+ PTHREAD_CFLAGS="" -+ fi -+ CC="$ax_pthread_save_CC" -+ CFLAGS="$ax_pthread_save_CFLAGS" -+ LIBS="$ax_pthread_save_LIBS" -+fi -+ -+# We must check for the threads library under a number of different -+# names; the ordering is very important because some systems -+# (e.g. DEC) have both -lpthread and -lpthreads, where one of the -+# libraries is broken (non-POSIX). -+ -+# Create a list of thread flags to try. Items with a "," contain both -+# C compiler flags (before ",") and linker flags (after ","). Other items -+# starting with a "-" are C compiler flags, and remaining items are -+# library names, except for "none" which indicates that we try without -+# any flags at all, and "pthread-config" which is a program returning -+# the flags for the Pth emulation library. -+ -+ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config" -+ -+# The ordering *is* (sometimes) important. Some notes on the -+# individual items follow: -+ -+# pthreads: AIX (must check this before -lpthread) -+# none: in case threads are in libc; should be tried before -Kthread and -+# other compiler flags to prevent continual compiler warnings -+# -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h) -+# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads), Tru64 -+# (Note: HP C rejects this with "bad form for `-t' option") -+# -pthreads: Solaris/gcc (Note: HP C also rejects) -+# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it -+# doesn't hurt to check since this sometimes defines pthreads and -+# -D_REENTRANT too), HP C (must be checked before -lpthread, which -+# is present but should not be used directly; and before -mthreads, -+# because the compiler interprets this as "-mt" + "-hreads") -+# -mthreads: Mingw32/gcc, Lynx/gcc -+# pthread: Linux, etcetera -+# --thread-safe: KAI C++ -+# pthread-config: use pthread-config program (for GNU Pth library) -+ -+case $host_os in -+ -+ freebsd*) -+ -+ # -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able) -+ # lthread: LinuxThreads port on FreeBSD (also preferred to -pthread) -+ -+ ax_pthread_flags="-kthread lthread $ax_pthread_flags" -+ ;; -+ -+ hpux*) -+ -+ # From the cc(1) man page: "[-mt] Sets various -D flags to enable -+ # multi-threading and also sets -lpthread." -+ -+ ax_pthread_flags="-mt -pthread pthread $ax_pthread_flags" -+ ;; -+ -+ openedition*) -+ -+ # IBM z/OS requires a feature-test macro to be defined in order to -+ # enable POSIX threads at all, so give the user a hint if this is -+ # not set. (We don't define these ourselves, as they can affect -+ # other portions of the system API in unpredictable ways.) -+ -+ AC_EGREP_CPP([AX_PTHREAD_ZOS_MISSING], -+ [ -+# if !defined(_OPEN_THREADS) && !defined(_UNIX03_THREADS) -+ AX_PTHREAD_ZOS_MISSING -+# endif -+ ], -+ [AC_MSG_WARN([IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support.])]) -+ ;; -+ -+ solaris*) -+ -+ # On Solaris (at least, for some versions), libc contains stubbed -+ # (non-functional) versions of the pthreads routines, so link-based -+ # tests will erroneously succeed. (N.B.: The stubs are missing -+ # pthread_cleanup_push, or rather a function called by this macro, -+ # so we could check for that, but who knows whether they'll stub -+ # that too in a future libc.) So we'll check first for the -+ # standard Solaris way of linking pthreads (-mt -lpthread). -+ -+ ax_pthread_flags="-mt,-lpthread pthread $ax_pthread_flags" -+ ;; -+esac -+ -+# Are we compiling with Clang? -+ -+AC_CACHE_CHECK([whether $CC is Clang], -+ [ax_cv_PTHREAD_CLANG], -+ [ax_cv_PTHREAD_CLANG=no -+ # Note that Autoconf sets GCC=yes for Clang as well as GCC -+ if test "x$GCC" = "xyes"; then -+ AC_EGREP_CPP([AX_PTHREAD_CC_IS_CLANG], -+ [/* Note: Clang 2.7 lacks __clang_[a-z]+__ */ -+# if defined(__clang__) && defined(__llvm__) -+ AX_PTHREAD_CC_IS_CLANG -+# endif -+ ], -+ [ax_cv_PTHREAD_CLANG=yes]) -+ fi -+ ]) -+ax_pthread_clang="$ax_cv_PTHREAD_CLANG" -+ -+ -+# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC) -+ -+# Note that for GCC and Clang -pthread generally implies -lpthread, -+# except when -nostdlib is passed. -+# This is problematic using libtool to build C++ shared libraries with pthread: -+# [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25460 -+# [2] https://bugzilla.redhat.com/show_bug.cgi?id=661333 -+# [3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468555 -+# To solve this, first try -pthread together with -lpthread for GCC -+ -+AS_IF([test "x$GCC" = "xyes"], -+ [ax_pthread_flags="-pthread,-lpthread -pthread -pthreads $ax_pthread_flags"]) -+ -+# Clang takes -pthread (never supported any other flag), but we'll try with -lpthread first -+ -+AS_IF([test "x$ax_pthread_clang" = "xyes"], -+ [ax_pthread_flags="-pthread,-lpthread -pthread"]) -+ -+ -+# The presence of a feature test macro requesting re-entrant function -+# definitions is, on some systems, a strong hint that pthreads support is -+# correctly enabled -+ -+case $host_os in -+ darwin* | hpux* | linux* | osf* | solaris*) -+ ax_pthread_check_macro="_REENTRANT" -+ ;; -+ -+ aix*) -+ ax_pthread_check_macro="_THREAD_SAFE" -+ ;; -+ -+ *) -+ ax_pthread_check_macro="--" -+ ;; -+esac -+AS_IF([test "x$ax_pthread_check_macro" = "x--"], -+ [ax_pthread_check_cond=0], -+ [ax_pthread_check_cond="!defined($ax_pthread_check_macro)"]) -+ -+ -+if test "x$ax_pthread_ok" = "xno"; then -+for ax_pthread_try_flag in $ax_pthread_flags; do -+ -+ case $ax_pthread_try_flag in -+ none) -+ AC_MSG_CHECKING([whether pthreads work without any flags]) -+ ;; -+ -+ *,*) -+ PTHREAD_CFLAGS=`echo $ax_pthread_try_flag | sed "s/^\(.*\),\(.*\)$/\1/"` -+ PTHREAD_LIBS=`echo $ax_pthread_try_flag | sed "s/^\(.*\),\(.*\)$/\2/"` -+ AC_MSG_CHECKING([whether pthreads work with "$PTHREAD_CFLAGS" and "$PTHREAD_LIBS"]) -+ ;; -+ -+ -*) -+ AC_MSG_CHECKING([whether pthreads work with $ax_pthread_try_flag]) -+ PTHREAD_CFLAGS="$ax_pthread_try_flag" -+ ;; -+ -+ pthread-config) -+ AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no]) -+ AS_IF([test "x$ax_pthread_config" = "xno"], [continue]) -+ PTHREAD_CFLAGS="`pthread-config --cflags`" -+ PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`" -+ ;; -+ -+ *) -+ AC_MSG_CHECKING([for the pthreads library -l$ax_pthread_try_flag]) -+ PTHREAD_LIBS="-l$ax_pthread_try_flag" -+ ;; -+ esac -+ -+ ax_pthread_save_CFLAGS="$CFLAGS" -+ ax_pthread_save_LIBS="$LIBS" -+ CFLAGS="$CFLAGS $PTHREAD_CFLAGS" -+ LIBS="$PTHREAD_LIBS $LIBS" -+ -+ # Check for various functions. We must include pthread.h, -+ # since some functions may be macros. (On the Sequent, we -+ # need a special flag -Kthread to make this header compile.) -+ # We check for pthread_join because it is in -lpthread on IRIX -+ # while pthread_create is in libc. We check for pthread_attr_init -+ # due to DEC craziness with -lpthreads. We check for -+ # pthread_cleanup_push because it is one of the few pthread -+ # functions on Solaris that doesn't have a non-functional libc stub. -+ # We try pthread_create on general principles. -+ -+ AC_LINK_IFELSE([AC_LANG_PROGRAM([#include -+# if $ax_pthread_check_cond -+# error "$ax_pthread_check_macro must be defined" -+# endif -+ static void *some_global = NULL; -+ static void routine(void *a) -+ { -+ /* To avoid any unused-parameter or -+ unused-but-set-parameter warning. */ -+ some_global = a; -+ } -+ static void *start_routine(void *a) { return a; }], -+ [pthread_t th; pthread_attr_t attr; -+ pthread_create(&th, 0, start_routine, 0); -+ pthread_join(th, 0); -+ pthread_attr_init(&attr); -+ pthread_cleanup_push(routine, 0); -+ pthread_cleanup_pop(0) /* ; */])], -+ [ax_pthread_ok=yes], -+ []) -+ -+ CFLAGS="$ax_pthread_save_CFLAGS" -+ LIBS="$ax_pthread_save_LIBS" -+ -+ AC_MSG_RESULT([$ax_pthread_ok]) -+ AS_IF([test "x$ax_pthread_ok" = "xyes"], [break]) -+ -+ PTHREAD_LIBS="" -+ PTHREAD_CFLAGS="" -+done -+fi -+ -+ -+# Clang needs special handling, because older versions handle the -pthread -+# option in a rather... idiosyncratic way -+ -+if test "x$ax_pthread_clang" = "xyes"; then -+ -+ # Clang takes -pthread; it has never supported any other flag -+ -+ # (Note 1: This will need to be revisited if a system that Clang -+ # supports has POSIX threads in a separate library. This tends not -+ # to be the way of modern systems, but it's conceivable.) -+ -+ # (Note 2: On some systems, notably Darwin, -pthread is not needed -+ # to get POSIX threads support; the API is always present and -+ # active. We could reasonably leave PTHREAD_CFLAGS empty. But -+ # -pthread does define _REENTRANT, and while the Darwin headers -+ # ignore this macro, third-party headers might not.) -+ -+ # However, older versions of Clang make a point of warning the user -+ # that, in an invocation where only linking and no compilation is -+ # taking place, the -pthread option has no effect ("argument unused -+ # during compilation"). They expect -pthread to be passed in only -+ # when source code is being compiled. -+ # -+ # Problem is, this is at odds with the way Automake and most other -+ # C build frameworks function, which is that the same flags used in -+ # compilation (CFLAGS) are also used in linking. Many systems -+ # supported by AX_PTHREAD require exactly this for POSIX threads -+ # support, and in fact it is often not straightforward to specify a -+ # flag that is used only in the compilation phase and not in -+ # linking. Such a scenario is extremely rare in practice. -+ # -+ # Even though use of the -pthread flag in linking would only print -+ # a warning, this can be a nuisance for well-run software projects -+ # that build with -Werror. So if the active version of Clang has -+ # this misfeature, we search for an option to squash it. -+ -+ AC_CACHE_CHECK([whether Clang needs flag to prevent "argument unused" warning when linking with -pthread], -+ [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG], -+ [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown -+ # Create an alternate version of $ac_link that compiles and -+ # links in two steps (.c -> .o, .o -> exe) instead of one -+ # (.c -> exe), because the warning occurs only in the second -+ # step -+ ax_pthread_save_ac_link="$ac_link" -+ ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g' -+ ax_pthread_link_step=`AS_ECHO(["$ac_link"]) | sed "$ax_pthread_sed"` -+ ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)" -+ ax_pthread_save_CFLAGS="$CFLAGS" -+ for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do -+ AS_IF([test "x$ax_pthread_try" = "xunknown"], [break]) -+ CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS" -+ ac_link="$ax_pthread_save_ac_link" -+ AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])], -+ [ac_link="$ax_pthread_2step_ac_link" -+ AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])], -+ [break]) -+ ]) -+ done -+ ac_link="$ax_pthread_save_ac_link" -+ CFLAGS="$ax_pthread_save_CFLAGS" -+ AS_IF([test "x$ax_pthread_try" = "x"], [ax_pthread_try=no]) -+ ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try" -+ ]) -+ -+ case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in -+ no | unknown) ;; -+ *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;; -+ esac -+ -+fi # $ax_pthread_clang = yes -+ -+ -+ -+# Various other checks: -+if test "x$ax_pthread_ok" = "xyes"; then -+ ax_pthread_save_CFLAGS="$CFLAGS" -+ ax_pthread_save_LIBS="$LIBS" -+ CFLAGS="$CFLAGS $PTHREAD_CFLAGS" -+ LIBS="$PTHREAD_LIBS $LIBS" -+ -+ # Detect AIX lossage: JOINABLE attribute is called UNDETACHED. -+ AC_CACHE_CHECK([for joinable pthread attribute], -+ [ax_cv_PTHREAD_JOINABLE_ATTR], -+ [ax_cv_PTHREAD_JOINABLE_ATTR=unknown -+ for ax_pthread_attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do -+ AC_LINK_IFELSE([AC_LANG_PROGRAM([#include ], -+ [int attr = $ax_pthread_attr; return attr /* ; */])], -+ [ax_cv_PTHREAD_JOINABLE_ATTR=$ax_pthread_attr; break], -+ []) -+ done -+ ]) -+ AS_IF([test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xunknown" && \ -+ test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xPTHREAD_CREATE_JOINABLE" && \ -+ test "x$ax_pthread_joinable_attr_defined" != "xyes"], -+ [AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], -+ [$ax_cv_PTHREAD_JOINABLE_ATTR], -+ [Define to necessary symbol if this constant -+ uses a non-standard name on your system.]) -+ ax_pthread_joinable_attr_defined=yes -+ ]) -+ -+ AC_CACHE_CHECK([whether more special flags are required for pthreads], -+ [ax_cv_PTHREAD_SPECIAL_FLAGS], -+ [ax_cv_PTHREAD_SPECIAL_FLAGS=no -+ case $host_os in -+ solaris*) -+ ax_cv_PTHREAD_SPECIAL_FLAGS="-D_POSIX_PTHREAD_SEMANTICS" -+ ;; -+ esac -+ ]) -+ AS_IF([test "x$ax_cv_PTHREAD_SPECIAL_FLAGS" != "xno" && \ -+ test "x$ax_pthread_special_flags_added" != "xyes"], -+ [PTHREAD_CFLAGS="$ax_cv_PTHREAD_SPECIAL_FLAGS $PTHREAD_CFLAGS" -+ ax_pthread_special_flags_added=yes]) -+ -+ AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT], -+ [ax_cv_PTHREAD_PRIO_INHERIT], -+ [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], -+ [[int i = PTHREAD_PRIO_INHERIT; -+ return i;]])], -+ [ax_cv_PTHREAD_PRIO_INHERIT=yes], -+ [ax_cv_PTHREAD_PRIO_INHERIT=no]) -+ ]) -+ AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes" && \ -+ test "x$ax_pthread_prio_inherit_defined" != "xyes"], -+ [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.]) -+ ax_pthread_prio_inherit_defined=yes -+ ]) -+ -+ CFLAGS="$ax_pthread_save_CFLAGS" -+ LIBS="$ax_pthread_save_LIBS" -+ -+ # More AIX lossage: compile with *_r variant -+ if test "x$GCC" != "xyes"; then -+ case $host_os in -+ aix*) -+ AS_CASE(["x/$CC"], -+ [x*/c89|x*/c89_128|x*/c99|x*/c99_128|x*/cc|x*/cc128|x*/xlc|x*/xlc_v6|x*/xlc128|x*/xlc128_v6], -+ [#handle absolute path differently from PATH based program lookup -+ AS_CASE(["x$CC"], -+ [x/*], -+ [ -+ AS_IF([AS_EXECUTABLE_P([${CC}_r])],[PTHREAD_CC="${CC}_r"]) -+ AS_IF([test "x${CXX}" != "x"], [AS_IF([AS_EXECUTABLE_P([${CXX}_r])],[PTHREAD_CXX="${CXX}_r"])]) -+ ], -+ [ -+ AC_CHECK_PROGS([PTHREAD_CC],[${CC}_r],[$CC]) -+ AS_IF([test "x${CXX}" != "x"], [AC_CHECK_PROGS([PTHREAD_CXX],[${CXX}_r],[$CXX])]) -+ ] -+ ) -+ ]) -+ ;; -+ esac -+ fi -+fi -+ -+test -n "$PTHREAD_CC" || PTHREAD_CC="$CC" -+test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX" -+ -+AC_SUBST([PTHREAD_LIBS]) -+AC_SUBST([PTHREAD_CFLAGS]) -+AC_SUBST([PTHREAD_CC]) -+AC_SUBST([PTHREAD_CXX]) -+ -+# Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND: -+if test "x$ax_pthread_ok" = "xyes"; then -+ ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1]) -+ : -+else -+ ax_pthread_ok=no -+ $2 -+fi -+AC_LANG_POP -+])dnl AX_PTHREAD -diff --git a/src/api/ccapi/Makefile.am b/src/api/ccapi/Makefile.am -index 099b86f..1a1af79 100644 ---- a/src/api/ccapi/Makefile.am -+++ b/src/api/ccapi/Makefile.am -@@ -16,6 +16,7 @@ libvomsapi_la_SOURCES = \ - - - libvomsapi_la_CXXFLAGS = \ -+ $(PTHREAD_CFLAGS) \ - $(NO_GLOBUS_FLAGS) \ - -DNOGLOBUS \ - -I$(top_srcdir)/src/include -@@ -27,6 +28,7 @@ libvomsapi_la_LDFLAGS = \ - libvomsapi_la_LIBADD = \ - $(EXPAT_LIBS) \ - $(OPENSSL_LIBS) \ -+ $(PTHREAD_LIBS) \ - $(top_builddir)/src/replib/librep.la \ - $(top_builddir)/src/common/libutilities_nog.la \ - $(top_builddir)/src/common/libutilc_nog.la \ --- -2.41.0 - diff --git a/0008-Fix-memory-leaks-and-double-deletes.patch b/0008-Fix-memory-leaks-and-double-deletes.patch deleted file mode 100644 index ae065be..0000000 --- a/0008-Fix-memory-leaks-and-double-deletes.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 25b39ed6ca70d28ec65dacb897a16688db527768 Mon Sep 17 00:00:00 2001 -From: Francesco Giacomini -Date: Wed, 8 Mar 2023 10:22:48 +0100 -Subject: [PATCH 08/12] Fix memory leaks and double deletes - -They are reported from the runtime checks on EL9 ---- - src/sslutils/sslutils.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c -index 8b0f4c4..4fead09 100644 ---- a/src/sslutils/sslutils.c -+++ b/src/sslutils/sslutils.c -@@ -767,6 +767,9 @@ proxy_genreq( - if (RSA_generate_key_ex(rsa, rbits, rsa_exp, cb)) - { - BN_free(rsa_exp); -+ rsa_exp = NULL; -+ BN_GENCB_free(cb); -+ cb = NULL; - } - else - { -@@ -774,7 +777,11 @@ proxy_genreq( - goto err; - } - -- if (!EVP_PKEY_assign_RSA(pkey,rsa)) -+ if (EVP_PKEY_assign_RSA(pkey,rsa)) -+ { -+ rsa = NULL; -+ } -+ else - { - PRXYerr(PRXYERR_F_PROXY_GENREQ,PRXYERR_R_PROCESS_PROXY_KEY); - goto err; --- -2.41.0 - diff --git a/0009-If-a-detailed-error-message-is-available-do-not-over.patch b/0009-If-a-detailed-error-message-is-available-do-not-over.patch deleted file mode 100644 index 7d26aef..0000000 --- a/0009-If-a-detailed-error-message-is-available-do-not-over.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 564dd86719e15f9e796cbbf27439b07f693e36b6 Mon Sep 17 00:00:00 2001 -From: Brian P Bockelman -Date: Wed, 26 Apr 2023 15:03:13 -0500 -Subject: [PATCH 09/12] If a detailed error message is available, do not - overwrite (#116) - -When verification of ACs fails, the prior behavior is to always have -this message: - -``` -Cannot verify AC signature! -``` - -This can be difficult to debug as there's no indication of whether -its a problem with the proxy itself or with the host configuration. - -This patch appends the underlying error message if one was provided. -For example, - -``` -Cannot verify AC signature! Underlying error: Certificate verification \ - failed for certificate '/CN=voms.example.com': certificate has expired. -``` - -(newlines added for readability) ---- - src/api/ccapi/api_util.cc | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc -index 848bfbd..dcbcafb 100644 ---- a/src/api/ccapi/api_util.cc -+++ b/src/api/ccapi/api_util.cc -@@ -332,7 +332,12 @@ vomsdata::verifydata(AC *ac, UNUSED(const std::string& subject), - issuer = check((void *)ac); - - if (!issuer) { -- seterror(VERR_SIGN, "Cannot verify AC signature!"); -+ std::string oldmessage = ErrorMessage(); -+ if (oldmessage.empty()) { -+ seterror(VERR_SIGN, "Cannot verify AC signature!"); -+ } else { -+ seterror(VERR_SIGN, "Cannot verify AC signature! Underlying error: " + oldmessage); -+ } - return false; - } - } --- -2.41.0 - diff --git a/0010-Add-lexparse.h-headers-for-lexer-parser-integration-.patch b/0010-Add-lexparse.h-headers-for-lexer-parser-integration-.patch deleted file mode 100644 index 526bb7e..0000000 --- a/0010-Add-lexparse.h-headers-for-lexer-parser-integration-.patch +++ /dev/null @@ -1,198 +0,0 @@ -From 9a99f205870ec2481ddeb0020e37f54fdbf09abd Mon Sep 17 00:00:00 2001 -From: Florian Weimer -Date: Sun, 2 Jul 2023 16:25:21 +0200 -Subject: [PATCH 10/12] Add "lexparse.h" headers for lexer/parser integration - (#112) - -And include them in a few strategic places. This avoids build -failures with future compilers that do not support implicit function -declarations by default. - -(NB: This commit does not regenerate the lexers/parsers, so the -line numbers are slightly off.) ---- - src/sslutils/lex.namespaces.c | 1 + - src/sslutils/lex.signing.c | 1 + - src/sslutils/lexparse.h | 4 ++++ - src/sslutils/namespaces.c | 1 + - src/sslutils/namespaces.l | 1 + - src/sslutils/namespaces.y | 1 + - src/sslutils/signing_policy.c | 1 + - src/sslutils/signing_policy.l | 1 + - src/sslutils/signing_policy.y | 1 + - src/utils/lex.yy.c | 1 + - src/utils/lexparse.h | 4 ++++ - src/utils/vomsfake.y | 1 + - src/utils/vomsparser.c | 1 + - src/utils/vomsparser.l | 1 + - 14 files changed, 20 insertions(+) - create mode 100644 src/sslutils/lexparse.h - create mode 100644 src/utils/lexparse.h - -diff --git a/src/sslutils/lex.namespaces.c b/src/sslutils/lex.namespaces.c -index af359bf..646156a 100644 ---- a/src/sslutils/lex.namespaces.c -+++ b/src/sslutils/lex.namespaces.c -@@ -1410,6 +1410,7 @@ static yyconst flex_int16_t yy_rule_linenum[15] = - #include - - #include "parsertypes.h" -+#include "lexparse.h" - #include "namespaces.h" - #ifndef strndup - extern char *strndup(const char*, size_t); -diff --git a/src/sslutils/lex.signing.c b/src/sslutils/lex.signing.c -index 6906a5a..e32364d 100644 ---- a/src/sslutils/lex.signing.c -+++ b/src/sslutils/lex.signing.c -@@ -2356,6 +2356,7 @@ static yyconst flex_int16_t yy_rule_linenum[17] = - - #include "parsertypes.h" - #include "signing_policy.h" -+#include "lexparse.h" - #ifndef strndup - extern char *strndup(const char*, size_t); - #endif -diff --git a/src/sslutils/lexparse.h b/src/sslutils/lexparse.h -new file mode 100644 -index 0000000..675a10f ---- /dev/null -+++ b/src/sslutils/lexparse.h -@@ -0,0 +1,4 @@ -+/* Declarations for lexer/parser integration. */ -+union YYSTYPE; -+int signinglex (union YYSTYPE *, void *); -+int namespaceslex (union YYSTYPE *, void *); -diff --git a/src/sslutils/namespaces.c b/src/sslutils/namespaces.c -index 780845d..a006499 100644 ---- a/src/sslutils/namespaces.c -+++ b/src/sslutils/namespaces.c -@@ -108,6 +108,7 @@ - #include - - #include "parsertypes.h" -+#include "lexparse.h" - #include "listfunc.h" - - char **parse_subjects(char *string); -diff --git a/src/sslutils/namespaces.l b/src/sslutils/namespaces.l -index c3e6b04..cdd10df 100644 ---- a/src/sslutils/namespaces.l -+++ b/src/sslutils/namespaces.l -@@ -30,6 +30,7 @@ - #include - - #include "parsertypes.h" -+#include "lexparse.h" - #include "namespaces.h" - #ifndef strndup - extern char *strndup(const char*, size_t); -diff --git a/src/sslutils/namespaces.y b/src/sslutils/namespaces.y -index 23e5193..9be4271 100644 ---- a/src/sslutils/namespaces.y -+++ b/src/sslutils/namespaces.y -@@ -29,6 +29,7 @@ - #include - - #include "parsertypes.h" -+#include "lexparse.h" - #include "listfunc.h" - - char **parse_subjects(char *string); -diff --git a/src/sslutils/signing_policy.c b/src/sslutils/signing_policy.c -index 03f13ab..f36374b 100644 ---- a/src/sslutils/signing_policy.c -+++ b/src/sslutils/signing_policy.c -@@ -110,6 +110,7 @@ - #include - - #include "parsertypes.h" -+#include "lexparse.h" - #include "listfunc.h" - - char **parse_subjects(char *string); -diff --git a/src/sslutils/signing_policy.l b/src/sslutils/signing_policy.l -index c5115a1..c521dd5 100644 ---- a/src/sslutils/signing_policy.l -+++ b/src/sslutils/signing_policy.l -@@ -31,6 +31,7 @@ - - #include "parsertypes.h" - #include "signing_policy.h" -+#include "lexparse.h" - #ifndef strndup - extern char *strndup(const char*, size_t); - #endif -diff --git a/src/sslutils/signing_policy.y b/src/sslutils/signing_policy.y -index 93fab4f..a56ac37 100644 ---- a/src/sslutils/signing_policy.y -+++ b/src/sslutils/signing_policy.y -@@ -31,6 +31,7 @@ - #include - - #include "parsertypes.h" -+#include "lexparse.h" - #include "listfunc.h" - - char **parse_subjects(char *string); -diff --git a/src/utils/lex.yy.c b/src/utils/lex.yy.c -index afa13ea..ac1768b 100644 ---- a/src/utils/lex.yy.c -+++ b/src/utils/lex.yy.c -@@ -486,6 +486,7 @@ char *yytext; - - #include "fakeparsertypes.h" - #include "vomsparser.h" -+#include "lexparse.h" - - #line 491 "lex.yy.c" - -diff --git a/src/utils/lexparse.h b/src/utils/lexparse.h -new file mode 100644 -index 0000000..9937dfa ---- /dev/null -+++ b/src/utils/lexparse.h -@@ -0,0 +1,4 @@ -+/* Declarations for lexer/parser integration. */ -+union YYSTYPE; -+int yylex(); -+void yyerror(const char *); -diff --git a/src/utils/vomsfake.y b/src/utils/vomsfake.y -index 7d47bf8..afc32f6 100644 ---- a/src/utils/vomsfake.y -+++ b/src/utils/vomsfake.y -@@ -19,6 +19,7 @@ - #include - - #include "fakeparsertypes.h" -+#include "lexparse.h" - - #define MAX_SIZE 200 - -diff --git a/src/utils/vomsparser.c b/src/utils/vomsparser.c -index ad61f13..8312571 100644 ---- a/src/utils/vomsparser.c -+++ b/src/utils/vomsparser.c -@@ -90,6 +90,7 @@ - #include - - #include "fakeparsertypes.h" -+#include "lexparse.h" - - #define MAX_SIZE 200 - -diff --git a/src/utils/vomsparser.l b/src/utils/vomsparser.l -index 649bea7..1bf72cd 100644 ---- a/src/utils/vomsparser.l -+++ b/src/utils/vomsparser.l -@@ -31,6 +31,7 @@ - - #include "fakeparsertypes.h" - #include "vomsparser.h" -+#include "lexparse.h" - %} - - %x STR --- -2.41.0 - diff --git a/0011-Only-process-authority-and-subject-key-identifiers-i.patch b/0011-Only-process-authority-and-subject-key-identifiers-i.patch deleted file mode 100644 index bbc5cd2..0000000 --- a/0011-Only-process-authority-and-subject-key-identifiers-i.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 16294121bcc68d312feabc26b172eefaaf1566f9 Mon Sep 17 00:00:00 2001 -From: DrDaveD <2129743+DrDaveD@users.noreply.github.com> -Date: Thu, 7 Sep 2023 15:50:15 -0500 -Subject: [PATCH 11/12] Only process authority and subject key identifiers in - certificates (#121) - ---- - src/sslutils/proxy.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/src/sslutils/proxy.c b/src/sslutils/proxy.c -index 8a1e209..da4d782 100644 ---- a/src/sslutils/proxy.c -+++ b/src/sslutils/proxy.c -@@ -353,9 +353,10 @@ struct VOMSProxy *VOMS_MakeProxy(struct VOMSProxyArguments *args, int *warning, - } - } - -- /* authority key identifier and subject key identifier extension */ -+ /* authority key identifier and subject key identifier extension -+ (certificates only, not proxies) */ - -- { -+ if (args->proxyversion == 0) { - X509V3_CTX ctx; - - X509V3_set_ctx(&ctx, (args->selfsigned ? NULL : args->cert), NULL, req, NULL, 0); --- -2.41.0 - diff --git a/0012-Consider-the-Authority-Key-Id-extension-only-if-it-s.patch b/0012-Consider-the-Authority-Key-Id-extension-only-if-it-s.patch deleted file mode 100644 index 785d3ce..0000000 --- a/0012-Consider-the-Authority-Key-Id-extension-only-if-it-s.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 6a083788991f0667a4bf0cc2d6f3085e08df39bc Mon Sep 17 00:00:00 2001 -From: Chris Burr -Date: Thu, 7 Sep 2023 23:16:44 +0200 -Subject: [PATCH 12/12] Consider the Authority Key Id extension only if it's - available (#113) - ---- - src/sslutils/proxy.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/sslutils/proxy.c b/src/sslutils/proxy.c -index da4d782..78a40f6 100644 ---- a/src/sslutils/proxy.c -+++ b/src/sslutils/proxy.c -@@ -390,14 +390,14 @@ struct VOMSProxy *VOMS_MakeProxy(struct VOMSProxyArguments *args, int *warning, - ex11 = X509V3_EXT_conf_nid(NULL, &ctx, NID_authority_key_identifier, "keyid"); - } - -- if (!ex11) { -+ if (ex11) { -+ if (!SET_EXT(ex11)) { -+ goto err; -+ } -+ } else if (args->selfsigned) { - PRXYerr(PRXYERR_F_PROXY_SIGN,PRXYERR_R_CLASS_ADD_EXT); - goto err; - } -- -- if (!SET_EXT(ex11)) { -- goto err; -- } - } - - /* class_add extension */ --- -2.41.0 - diff --git a/sources b/sources index 68e0609..cc1111c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (voms-2.1.0-rc3.tar.gz) = 003181764592776359aa67e088f865f9f975b6be2e0f33e3bbee31dbd0e241524b863a8d39163ca549430266fb9250bc948a426ce1baf641381a8b1423a924cd +SHA512 (voms-2.1.3.tar.gz) = c17af601591cd9bdbb678e1db638cd33033cc73b3c5b16e117c8c47e211e5f19e7a105af55095bc2267dc5889c08fba20d340917c61a68b45ba2a76bdffb8f0d diff --git a/voms-openssl4.patch b/voms-openssl4.patch new file mode 100644 index 0000000..5b96532 --- /dev/null +++ b/voms-openssl4.patch @@ -0,0 +1,374 @@ +diff -ruN a/src/ac/validate.cc b/src/ac/validate.cc +--- a/src/ac/validate.cc 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/ac/validate.cc 2026-04-29 15:38:19.136425930 +0200 +@@ -205,8 +205,8 @@ + } + + v.version = 1; +- v.siglen = ac->signature->length; +- v.signature = std::string((char*)ac->signature->data, ac->signature->length); ++ v.siglen = ASN1_STRING_length(ac->signature); ++ v.signature = std::string((char*)ASN1_STRING_get0_data(ac->signature), ASN1_STRING_length(ac->signature)); + bn = ASN1_INTEGER_to_BN(ac->acinfo->serial, NULL); + char *bnstring = BN_bn2hex(bn); + v.serial = std::string(bnstring); +@@ -294,15 +294,15 @@ + if (X509_NAME_cmp(name->d.dirn, X509_get_subject_name(issuer))) + ERROR(AC_ERR_ISSUER_NAME); + +- if (ac->acinfo->serial->length>20) ++ if (ASN1_STRING_length(ac->acinfo->serial)>20) + ERROR(AC_ERR_SERIAL); + } + + b = ac->acinfo->validity->notBefore; + a = ac->acinfo->validity->notAfter; + +- v.date1 = std::string((char*)b->data, b->length); +- v.date2 = std::string((char*)a->data, a->length); ++ v.date1 = std::string((char*)ASN1_STRING_get0_data(b), ASN1_STRING_length(b)); ++ v.date2 = std::string((char*)ASN1_STRING_get0_data(a), ASN1_STRING_length(a)); + + if (valids & VERIFY_DATE) { + time_t ctime, dtime; +@@ -315,8 +315,8 @@ + ctime += 300; + dtime = ctime-600; + +- if ((a->type != V_ASN1_GENERALIZEDTIME) || +- (b->type != V_ASN1_GENERALIZEDTIME)) ++ if ((ASN1_STRING_type(a) != V_ASN1_GENERALIZEDTIME) || ++ (ASN1_STRING_type(b) != V_ASN1_GENERALIZEDTIME)) + ERROR(AC_ERR_DATES); + + if (((X509_cmp_time(b, &vertime) >= 0) && +@@ -379,7 +379,7 @@ + /* put policyAuthority in voms struct */ + data = sk_GENERAL_NAME_value(capattr->names, 0); + if (data->type == GEN_URI) { +- v.voname = std::string((char*)data->d.ia5->data, data->d.ia5->length); ++ v.voname = std::string((char*)ASN1_STRING_get0_data(data->d.ia5), ASN1_STRING_length(data->d.ia5)); + std::string::size_type point = v.voname.find("://"); + + if (point != std::string::npos) { +@@ -398,10 +398,10 @@ + for (int i=0; itype == V_ASN1_OCTET_STRING)) ++ if (!(ASN1_STRING_type(capname) == V_ASN1_OCTET_STRING)) + return AC_ERR_ATTRIB_FQAN; + +- std::string str = std::string((char*)capname->data, capname->length); ++ std::string str = std::string((char*)ASN1_STRING_get0_data(capname), ASN1_STRING_length(capname)); + std::string::size_type top_group_size = top_group.size(); + std::string::size_type str_size = str.size(); + +@@ -556,14 +556,14 @@ + if (key->keyid) { + unsigned char hashed[SHA_DIGEST_LENGTH]; + +- ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss); +- if (!SHA1(pubkey->data, +- pubkey->length, ++ const ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss); ++ if (!SHA1(ASN1_STRING_get0_data(pubkey), ++ ASN1_STRING_length(pubkey), + hashed)) + ret = AC_ERR_EXT_KEY; + +- if ((memcmp(key->keyid->data, hashed, 20) != 0) && +- (key->keyid->length == 20)) ++ if ((memcmp(ASN1_STRING_get0_data(key->keyid), hashed, 20) != 0) && ++ (ASN1_STRING_length(key->keyid) == 20)) + ret = AC_ERR_EXT_KEY; + } + else { +@@ -574,7 +574,7 @@ + (X509_get0_serialNumber(iss)))) + ret = AC_ERR_EXT_KEY; + +- if (key->serial->type != GEN_DIRNAME) ++ if (ASN1_STRING_type(key->serial) != GEN_DIRNAME) + ret = AC_ERR_EXT_KEY; + + if (X509_NAME_cmp(sk_GENERAL_NAME_value((key->issuer), 0)->d.dirn, +@@ -632,15 +632,15 @@ + AC_ATTRIBUTE *at = sk_AC_ATTRIBUTE_value(atts, j); + + struct attribute a; +- a.name = std::string((char*)at->name->data, at->name->length); +- a.value = std::string((char*)at->value->data, at->value->length); +- a.qualifier = std::string((char*)at->qualifier->data, at->qualifier->length); ++ a.name = std::string((char*)ASN1_STRING_get0_data(at->name), ASN1_STRING_length(at->name)); ++ a.value = std::string((char*)ASN1_STRING_get0_data(at->value), ASN1_STRING_length(at->value)); ++ a.qualifier = std::string((char*)ASN1_STRING_get0_data(at->qualifier), ASN1_STRING_length(at->qualifier)); + + al.attributes.push_back(a); + } + + gn = sk_GENERAL_NAME_value(holder->grantor, 0); +- al.grantor = std::string((char*)gn->d.ia5->data, gn->d.ia5->length); ++ al.grantor = std::string((char*)ASN1_STRING_get0_data(gn->d.ia5), ASN1_STRING_length(gn->d.ia5)); + + rd->attributes->push_back(al); + } +diff -ruN a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc +--- a/src/api/ccapi/api_util.cc 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/api/ccapi/api_util.cc 2026-04-29 16:05:24.239940677 +0200 +@@ -139,7 +139,7 @@ + int index = X509_get_ext_by_NID(cert, nid, -1); + + if (index >= 0) +- return X509_get_ext(cert, index); ++ return const_cast(X509_get_ext(cert, index)); + else + return NULL; + } +@@ -157,17 +157,17 @@ + + ext = get_ext(cert, "incfile"); + if (ext) { +- ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext); ++ const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext); + assert(value && "X509_EXTENSION_get_data failed"); +- extra_data = std::string(reinterpret_cast(value->data), value->length); ++ extra_data = std::string(reinterpret_cast(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value)); + found = true; + } + + ext = get_ext(cert, "vo"); + if (ext) { +- ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext); ++ const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext); + assert(value && "X509_EXTENSION_get_data failed"); +- workvo = std::string(reinterpret_cast(value->data), value->length); ++ workvo = std::string(reinterpret_cast(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value)); + } + + return found; +@@ -423,7 +423,7 @@ + return NULL; + } + +- std::string voname((const char *)name->d.ia5->data, 0, name->d.ia5->length); ++ std::string voname((const char *)ASN1_STRING_get0_data(name->d.ia5), 0, ASN1_STRING_length(name->d.ia5)); + std::string::size_type cpos = voname.find("://"); + std::string hostname; + +diff -ruN a/src/api/ccapi/voms_api.cc b/src/api/ccapi/voms_api.cc +--- a/src/api/ccapi/voms_api.cc 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/api/ccapi/voms_api.cc 2026-04-29 16:05:14.064784528 +0200 +@@ -1025,8 +1025,8 @@ + AC_TARGET *name = NULL; + name = sk_AC_TARGET_value(target->targets, i); + if (name->name->type == GEN_URI) +- targets.push_back(std::string((char*)(name->name->d.ia5->data), +- name->name->d.ia5->length)); ++ targets.push_back(std::string((char*)ASN1_STRING_get0_data(name->name->d.ia5), ++ ASN1_STRING_length(name->name->d.ia5))); + } + } + AC_TARGETS_free(target); +diff -ruN a/src/include/sslutils.h b/src/include/sslutils.h +--- a/src/include/sslutils.h 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/include/sslutils.h 2026-04-29 14:45:17.997509299 +0200 +@@ -403,8 +403,8 @@ + int + proxy_check_issued( + X509_STORE_CTX * ctx, +- X509 * x, +- X509 * issuer); ++ const X509 * x, ++ const X509 * issuer); + + int + proxy_verify_certchain( +diff -ruN a/src/sslutils/proxy.c b/src/sslutils/proxy.c +--- a/src/sslutils/proxy.c 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/sslutils/proxy.c 2026-04-29 15:21:22.859426069 +0200 +@@ -543,8 +543,9 @@ + oct = ASN1_OCTET_STRING_new(); + assert(oct != NULL && "ASN1_OCTET_STRING_new failed"); + +- oct->data = der; +- oct->length = len; ++ ASN1_STRING_set0(oct, der, len); ++ ++ + ex7 = X509_EXTENSION_create_by_NID(NULL, v3nid, 1 /*critical*/, oct); + + ASN1_OCTET_STRING_free(oct); +@@ -683,8 +684,7 @@ + goto err; + } + +- ex_oct->data = (unsigned char*)data; +- ex_oct->length = datalen; ++ ASN1_STRING_set0(ex_oct, (unsigned char*)data, datalen); + + if (!(ex = X509_EXTENSION_create_by_OBJ(NULL, ex_obj, crit, ex_oct))) { + PRXYerr(PRXYERR_F_PROXY_SIGN,PRXYERR_R_CLASS_ADD_EXT); +@@ -694,8 +694,7 @@ + + if (ex_oct) { + /* avoid spurious free of the contents. */ +- ex_oct->length = 0; +- ex_oct->data = NULL; ++ ASN1_STRING_set0(ex_oct, NULL, 0); + ASN1_OCTET_STRING_free(ex_oct); + } + +@@ -806,10 +805,10 @@ + ASN1_BIT_STRING *usage = X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL); + + if (usage) { +- if (usage->length > 0) +- keyusage = usage->data[0]; +- if (usage->length > 1) +- keyusage |= usage->data[1] << 8; ++ if (ASN1_STRING_length(usage) > 0) ++ keyusage = ASN1_STRING_get0_data(usage)[0]; ++ if (ASN1_STRING_length(usage) > 1) ++ keyusage |= ASN1_STRING_get0_data(usage)[1] << 8; + + ASN1_BIT_STRING_free(usage); + } +diff -ruN a/src/sslutils/proxycertinfo.c b/src/sslutils/proxycertinfo.c +--- a/src/sslutils/proxycertinfo.c 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/sslutils/proxycertinfo.c 2026-04-29 14:44:27.158966391 +0200 +@@ -107,9 +107,9 @@ + BIO_printf(out, "%*sPolicy Language: ", indent, ""); + i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage); + BIO_puts(out, "\n"); +- if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data) ++ if (pci->proxyPolicy->policy && ASN1_STRING_get0_data(pci->proxyPolicy->policy)) + BIO_printf(out, "%*sPolicy Text: %s\n", indent, "", +- pci->proxyPolicy->policy->data); ++ ASN1_STRING_get0_data(pci->proxyPolicy->policy)); + return 1; + } + +@@ -142,11 +142,11 @@ + { + if(policy->policy) + { +- (*length) = policy->policy->length; +- if(*length > 0 && policy->policy->data) ++ (*length) = ASN1_STRING_length(policy->policy); ++ if(*length > 0 && ASN1_STRING_get0_data(policy->policy)) + { + unsigned char * copy = malloc(*length); +- memcpy(copy, policy->policy->data, *length); ++ memcpy(copy, ASN1_STRING_get0_data(policy->policy), *length); + return copy; + } + } +diff -ruN a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c +--- a/src/sslutils/sslutils.c 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/sslutils/sslutils.c 2026-04-29 14:45:33.014031670 +0200 +@@ -404,10 +404,12 @@ + void PRIVATE + ERR_set_continue_needed(void) + { ++#if OPENSSL_VERSION_NUMBER < 0x40000000L + ERR_STATE *es; + es = ERR_get_state(); + es->err_data_flags[es->top] = + es->err_data_flags[es->top] | ERR_DISPLAY_CONTINUE_NEEDED; ++#endif + } + + +@@ -1669,8 +1671,8 @@ + + int PRIVATE + proxy_check_issued(UNUSED(X509_STORE_CTX * ctx), +- X509 * x, +- X509 * issuer) ++ const X509 * x, ++ const X509 * issuer) + { + int return_value; + int return_code = 1; +@@ -3268,7 +3270,7 @@ + struct tm tm; + int size = 0; + +- switch (ctm->type) { ++ switch (ASN1_STRING_type(ctm)) { + case V_ASN1_UTCTIME: + size=10; + break; +@@ -3277,8 +3279,8 @@ + break; + } + p = buff1; +- i = ctm->length; +- str = (char *)ctm->data; ++ i = ASN1_STRING_length(ctm); ++ str = (char *)ASN1_STRING_get0_data(ctm); + if ((i < 11) || (i > 17)) { + return 0; + } +@@ -3311,7 +3313,7 @@ + + tm.tm_isdst = 0; + int index = 0; +- if (ctm->type == V_ASN1_UTCTIME) { ++ if (ASN1_STRING_type(ctm) == V_ASN1_UTCTIME) { + tm.tm_year = (buff1[index++]-'0')*10; + tm.tm_year += (buff1[index++]-'0'); + } +diff -ruN a/src/sslutils/voms_cert_type.c b/src/sslutils/voms_cert_type.c +--- a/src/sslutils/voms_cert_type.c 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/sslutils/voms_cert_type.c 2026-04-29 15:05:46.737365952 +0200 +@@ -256,11 +256,11 @@ + + ne_data = X509_NAME_ENTRY_get_data(ne); + +- if (ne_data->length == 5 && !memcmp(ne_data->data,"proxy",5)) ++ if (ASN1_STRING_length(ne_data) == 5 && !memcmp(ASN1_STRING_get0_data(ne_data),"proxy",5)) + { + *cert_type = VOMS_CERT_TYPE_GSI_2_PROXY; + } +- else if (ne_data->length == 13 && !memcmp(ne_data->data,"limited proxy",13)) ++ else if (ASN1_STRING_length(ne_data) == 13 && !memcmp(ASN1_STRING_get0_data(ne_data),"limited proxy",13)) + { + *cert_type = VOMS_CERT_TYPE_GSI_2_LIMITED_PROXY; + } +@@ -293,7 +293,7 @@ + ne_data = X509_NAME_ENTRY_get_data(ne); + + if ((new_ne = X509_NAME_ENTRY_create_by_NID( NULL, NID_commonName, +- ne_data->type, ne_data->data, -1)) == NULL){ ++ ASN1_STRING_type(ne_data), ASN1_STRING_get0_data(ne_data), -1)) == NULL){ + + result = voms_validation_error( + PRXYERR_R_ERROR_BUILDING_SUBJECT, +diff -ruN a/src/utils/voms_proxy_info.cc b/src/utils/voms_proxy_info.cc +--- a/src/utils/voms_proxy_info.cc 2025-12-18 13:39:27.000000000 +0100 ++++ b/src/utils/voms_proxy_info.cc 2026-04-29 16:06:20.035319031 +0200 +@@ -466,18 +466,10 @@ + static ASN1_TIME * + convtime(std::string data) + { +- ASN1_TIME *t= ASN1_TIME_new(); +- +- t->data = (unsigned char*)strdup(data.data()); +- t->length = data.size(); +- switch(t->length) { +- case 10: +- t->type = V_ASN1_UTCTIME; +- break; +- case 15: +- t->type = V_ASN1_GENERALIZEDTIME; +- break; +- default: ++ ASN1_TIME *t = ASN1_TIME_new(); ++ if (!t) ++ return NULL; ++ if (!ASN1_TIME_set_string(t, data.c_str())) { + ASN1_TIME_free(t); + return NULL; + } diff --git a/voms-sysusers.conf b/voms-sysusers.conf new file mode 100644 index 0000000..285c016 --- /dev/null +++ b/voms-sysusers.conf @@ -0,0 +1,2 @@ +# Name ID GECOS Home directory Shell +u voms - "VOMS Server Account" /etc/voms - diff --git a/voms.spec b/voms.spec index 083e50f..c501ac4 100644 --- a/voms.spec +++ b/voms.spec @@ -1,44 +1,19 @@ %global _hardened_build 1 -%if %{?fedora}%{!?fedora:0} >= 25 || %{?rhel}%{!?rhel:0} >= 8 -%global use_systemd 1 -%else -%global use_systemd 0 -%endif - Name: voms -Version: 2.1.0 -Release: 0.31.rc3%{?dist} +Version: 2.1.3 +Release: 7%{?dist} Summary: Virtual Organization Membership Service License: Apache-2.0 URL: https://italiangrid.github.io/voms/ -Source0: https://github.com/italiangrid/%{name}/archive/v%{version}-rc3/%{name}-%{version}-rc3.tar.gz +Source0: https://github.com/italiangrid/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz # Post-install setup instructions: Source1: %{name}.INSTALL -# https://github.com/italiangrid/voms/pull/105 -Patch0: 0001-Catch-exception-by-reference.patch -# https://github.com/italiangrid/voms/pull/106 -Patch1: 0002-Fix-warning-about-possible-use-after-free.patch -# https://github.com/italiangrid/voms/pull/107 -Patch2: 0003-Fix-doxygen-warning.patch -# https://github.com/italiangrid/voms/pull/108 -Patch3: 0004-Fix-warning-about-possible-string-truncation.patch -# https://github.com/italiangrid/voms/pull/104 -Patch4: 0005-config.h-must-not-be-included-in-public-header-file.patch -Patch5: 0006-Include-config.h-before-other-header-files.patch -# https://github.com/italiangrid/voms/pull/109 -Patch6: 0007-Compile-and-link-libvomsapi-with-proper-thread-flags.patch -# Backport from upstream -Patch7: 0008-Fix-memory-leaks-and-double-deletes.patch -# https://github.com/italiangrid/voms/pull/116 -Patch8: 0009-If-a-detailed-error-message-is-available-do-not-over.patch -# https://github.com/italiangrid/voms/pull/112 -Patch9: 0010-Add-lexparse.h-headers-for-lexer-parser-integration-.patch -# https://github.com/italiangrid/voms/pull/121 -Patch10: 0011-Only-process-authority-and-subject-key-identifiers-i.patch -# https://github.com/italiangrid/voms/pull/113 -Patch11: 0012-Consider-the-Authority-Key-Id-extension-only-if-it-s.patch +# System user creation config +Source2: %{name}-sysusers.conf + +Patch0: voms-openssl4.patch BuildRequires: make BuildRequires: gcc-c++ @@ -50,9 +25,7 @@ BuildRequires: pkgconfig BuildRequires: libxslt BuildRequires: docbook-style-xsl BuildRequires: doxygen -%if %{use_systemd} BuildRequires: systemd-rpm-macros -%endif %description The Virtual Organization Membership Service (VOMS) is an attribute authority @@ -85,7 +58,15 @@ Summary: Virtual Organization Membership Service Documentation BuildArch: noarch %description doc -Documentation for the Virtual Organization Membership Service. +The Virtual Organization Membership Service (VOMS) is an attribute authority +which serves as central repository for VO user authorization information, +providing support for sorting users into group hierarchies, keeping track of +their roles and other attributes in order to issue trusted attribute +certificates and SAML assertions used in the Grid environment for +authorization purposes. + +This package provides documentation for the Virtual Organization Membership +Service. %package clients-cpp Summary: Virtual Organization Membership Service Clients @@ -94,7 +75,7 @@ Provides: voms-clients = %{version}-%{release} Obsoletes: voms-clients < 2.0.12-3 Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/update-alternatives %description clients-cpp The Virtual Organization Membership Service (VOMS) is an attribute authority @@ -110,16 +91,8 @@ services. %package server Summary: Virtual Organization Membership Service Server Requires: %{name}%{?_isa} = %{version}-%{release} - -Requires(pre): shadow-utils -%if %{use_systemd} +%{?sysusers_requires_compat} %{?systemd_requires} -%else -Requires(post): chkconfig -Requires(preun): chkconfig -Requires(preun): initscripts -Requires(postun): initscripts -%endif %description server The Virtual Organization Membership Service (VOMS) is an attribute authority @@ -132,19 +105,8 @@ authorization purposes. This package provides the VOMS service. %prep -%setup -q -n %{name}-%{version}-rc3 -%patch -P 0 -p1 -%patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 -%patch -P 7 -p1 -%patch -P 8 -p1 -%patch -P 9 -p1 -%patch -P 10 -p1 -%patch -P 11 -p1 +%setup -q +%patch 0 -p1 -b .openssl4 ./autogen.sh @@ -160,21 +122,13 @@ install -m 644 -p %{SOURCE1} README.Fedora rm %{buildroot}%{_libdir}/*.la -%if %{use_systemd} mkdir -p %{buildroot}%{_unitdir} install -m 644 -p systemd/%{name}@.service %{buildroot}%{_unitdir} rm %{buildroot}%{_initrddir}/%{name} rm %{buildroot}%{_sysconfdir}/sysconfig/%{name} -%else -# Turn off default enabling of the service -sed -e 's/\(chkconfig: \)\w*/\1-/' \ - -e '/Default-Start/d' \ - -e 's/\(Default-Stop:\s*\).*/\10 1 2 3 4 5 6/' \ - -i %{buildroot}%{_initrddir}/%{name} -%endif -mkdir -p %{buildroot}%{_pkgdocdir} -install -m 644 -p AUTHORS README.md %{buildroot}%{_pkgdocdir} +mkdir -p %{buildroot}%{_sysusersdir} +install -m 644 -p %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_C_API cp -pr doc/apidoc/api/VOMS_C_API/html %{buildroot}%{_pkgdocdir}/VOMS_C_API @@ -184,18 +138,18 @@ mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_CC_API cp -pr doc/apidoc/api/VOMS_CC_API/html %{buildroot}%{_pkgdocdir}/VOMS_CC_API rm -f %{buildroot}%{_pkgdocdir}/VOMS_CC_API/html/installdox +mkdir -p %{buildroot}%{_sysconfdir}/alternatives for b in voms-proxy-init voms-proxy-info voms-proxy-destroy; do ## Rename client binaries mv %{buildroot}%{_bindir}/${b} %{buildroot}%{_bindir}/${b}2 - touch %{buildroot}/%{_bindir}/${b} - chmod 755 %{buildroot}/%{_bindir}/${b} + ln -s %{_bindir}/${b}2 %{buildroot}%{_sysconfdir}/alternatives/${b} + ln -s %{_sysconfdir}/alternatives/${b} %{buildroot}%{_bindir}/${b} ## and man pages mv %{buildroot}%{_mandir}/man1/${b}.1 %{buildroot}%{_mandir}/man1/${b}2.1 - touch %{buildroot}%{_mandir}/man1/${b}.1 + ln -s %{_mandir}/man1/${b}2.1.gz %{buildroot}%{_sysconfdir}/alternatives/${b}.1.gz + ln -s %{_sysconfdir}/alternatives/${b}.1.gz %{buildroot}%{_mandir}/man1/${b}.1.gz done -%ldconfig_scriptlets - %posttrans # Recover /etc/vomses... if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then @@ -203,17 +157,7 @@ if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then fi %pre server -getent group %{name} >/dev/null || groupadd -r %{name} -getent passwd %{name} >/dev/null || useradd -r -g %{name} \ - -d %{_sysconfdir}/%{name} -s /sbin/nologin -c "VOMS Server Account" %{name} - -%if %{use_systemd} -# Remove old init config when systemd is used -/sbin/service voms stop >/dev/null 2>&1 || : -/sbin/chkconfig --del voms >/dev/null 2>&1 || : -%endif - -%if %{use_systemd} +%sysusers_create_compat %{SOURCE2} %post server if [ $1 -eq 1 ] ; then @@ -236,26 +180,6 @@ if [ $1 -ge 1 ] ; then done fi -%else - -%post server -if [ $1 = 1 ]; then - /sbin/chkconfig --add %{name} -fi - -%preun server -if [ $1 = 0 ]; then - /sbin/service %{name} stop >/dev/null 2>&1 || : - /sbin/chkconfig --del %{name} -fi - -%postun server -if [ $1 -ge 1 ]; then - /sbin/service %{name} condrestart >/dev/null 2>&1 || : -fi - -%endif - %pre clients-cpp if [ $1 -gt 1 ]; then for c in voms-proxy-init voms-proxy-info voms-proxy-destroy; do @@ -282,7 +206,7 @@ fi --slave %{_mandir}/man1/voms-proxy-destroy.1.gz voms-proxy-destroy-man \ %{_mandir}/man1/voms-proxy-destroy2.1.gz -%postun clients-cpp +%preun clients-cpp if [ $1 -eq 0 ] ; then %{_sbindir}/update-alternatives --remove voms-proxy-init \ %{_bindir}/voms-proxy-init2 @@ -314,9 +238,8 @@ fi %dir %{_sysconfdir}/grid-security/vomsdir %dir %{_datadir}/%{name} %{_datadir}/%{name}/vomses.template -%doc %dir %{_pkgdocdir} -%doc %{_pkgdocdir}/AUTHORS -%doc %{_pkgdocdir}/README.md +%doc AUTHORS +%doc README.md %license LICENSE %files devel @@ -328,9 +251,9 @@ fi %files doc %doc %dir %{_pkgdocdir} -%doc %{_pkgdocdir}/AUTHORS %doc %{_pkgdocdir}/VOMS_C_API %doc %{_pkgdocdir}/VOMS_CC_API +%doc AUTHORS %license LICENSE %files clients-cpp @@ -343,6 +266,9 @@ fi %ghost %{_bindir}/voms-proxy-destroy %ghost %{_bindir}/voms-proxy-info %ghost %{_bindir}/voms-proxy-init +%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy +%ghost %{_sysconfdir}/alternatives/voms-proxy-info +%ghost %{_sysconfdir}/alternatives/voms-proxy-init %{_mandir}/man1/voms-proxy-destroy2.1* %{_mandir}/man1/voms-proxy-info2.1* %{_mandir}/man1/voms-proxy-init2.1* @@ -351,15 +277,13 @@ fi %ghost %{_mandir}/man1/voms-proxy-destroy.1* %ghost %{_mandir}/man1/voms-proxy-info.1* %ghost %{_mandir}/man1/voms-proxy-init.1* +%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy.1* +%ghost %{_sysconfdir}/alternatives/voms-proxy-info.1* +%ghost %{_sysconfdir}/alternatives/voms-proxy-init.1* %files server %{_sbindir}/%{name} -%if %{use_systemd} %{_unitdir}/%{name}@.service -%else -%{_initrddir}/%{name} -%config(noreplace) %{_sysconfdir}/sysconfig/%{name} -%endif %attr(-,voms,voms) %dir %{_sysconfdir}/%{name} %dir %{_sysconfdir}/grid-security/%{name} %attr(-,voms,voms) %dir %{_localstatedir}/log/%{name} @@ -371,9 +295,68 @@ fi %{_datadir}/%{name}/voms_replica_master_setup.sh %{_datadir}/%{name}/voms_replica_slave_setup.sh %{_mandir}/man8/voms.8* +%{_sysusersdir}/%{name}.conf %doc README.Fedora %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 2.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Mon Jun 15 2026 Yaakov Selkowitz - 2.1.3-6 +- Rebuilt for gsoap 2.8.142 + +* Fri Jun 12 2026 Yaakov Selkowitz - 2.1.3-5 +- Rebuilt for openssl 4.0 + +* Wed Apr 29 2026 Dmitry Belyavskiy - 2.1.3-4 +- Fix build with OpenSSL 4.0 (opaque ASN1_STRING, const X509, removed ERR_STATE) + +* Tue Jan 20 2026 Mattias Ellert - 2.1.3-3 +- Rebuild for gsoap 2.8.139 (Fedora 44) + +* Sat Jan 17 2026 Fedora Release Engineering - 2.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Sat Dec 20 2025 Mattias Ellert - 2.1.3-1 +- Update to version 2.1.3 + +* Fri Jul 25 2025 Fedora Release Engineering - 2.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Mar 27 2025 Mattias Ellert - 2.1.2-1 +- Update to version 2.1.2 +- Drop patch accepted upstream + +* Sat Mar 08 2025 Mattias Ellert - 2.1.0-5 +- Move user/group creation logic to sysusers.d fragment + +* Sun Jan 19 2025 Mattias Ellert - 2.1.0-4 +- Fix compilation with GCC 15 + +* Thu Oct 31 2024 Mattias Ellert - 2.1.0-3 +- Rebuild for gsoap 2.8.135 (Fedora 42) +- Add additional ghost files to package (rpmlint) + +* Sat Jul 20 2024 Fedora Release Engineering - 2.1.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Fri Jul 05 2024 Mattias Ellert - 2.1.0-1 +- Update to version 2.1.0 +- Drop EPEL 7 support from spec file (EOL) + +* Tue Jun 18 2024 Mattias Ellert - 2.1.0-0.35.rc5 +- Update to version 2.1.0-rc5 + +* Fri May 03 2024 Mattias Ellert - 2.1.0-0.34.rc4 +- Update to version 2.1.0-rc4 +- Drop patches accepted upstream + +* Wed Apr 10 2024 Mattias Ellert - 2.1.0-0.33.rc3 +- Fix problem with newer gsoap versions + +* Sat Jan 27 2024 Fedora Release Engineering - 2.1.0-0.32.rc3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Sep 14 2023 Mattias Ellert - 2.1.0-0.31.rc3 - More patches from upstream