Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

Drop patch accepted upstream

sources

@@ -1 +1 @@
-SHA512 (voms-2.1.0-rc2.tar.gz) = fb41a10b28dca0affe96aebb3dbdd681edcee544fc29d318295442a808dfa4d2be0c07d52c874362e5ffc0f73dec647c39aa7137a155945668b5d8e900a214b8
+SHA512 (voms-2.1.3.tar.gz) = c17af601591cd9bdbb678e1db638cd33033cc73b3c5b16e117c8c47e211e5f19e7a105af55095bc2267dc5889c08fba20d340917c61a68b45ba2a76bdffb8f0d

voms-change-default-proxy-cert-key-length-to-2048-bits.patch

@@ -1,420 +0,0 @@
-From 53e7d0b7e5d3a6ae21414551a27ea1c6a753b433 Mon Sep 17 00:00:00 2001
-From: Mattias Ellert <mattias.ellert@physics.uu.se>
-Date: Wed, 31 Oct 2018 14:50:21 +0100
-Subject: [PATCH] Change default proxy cert key length to 2048 bits
-
----
- src/client/vomsclient.cc        | 2 +-
- src/utils/vomsfake.cc           | 4 ++--
- testsuite/lib/vomslib.exp       | 2 +-
- testsuite/voms/voms/voms007.exp | 2 +-
- testsuite/voms/voms/voms009.exp | 2 +-
- testsuite/voms/voms/voms010.exp | 2 +-
- testsuite/voms/voms/voms011.exp | 2 +-
- testsuite/voms/voms/voms014.exp | 2 +-
- testsuite/voms/voms/voms016.exp | 2 +-
- testsuite/voms/voms/voms020.exp | 2 +-
- testsuite/voms/voms/voms021.exp | 2 +-
- testsuite/voms/voms/voms025.exp | 4 ++--
- testsuite/voms/voms/voms030.exp | 2 +-
- testsuite/voms/voms/voms041.exp | 2 +-
- testsuite/voms/voms/voms042.exp | 4 ++--
- testsuite/voms/voms/voms043.exp | 2 +-
- testsuite/voms/voms/voms044.exp | 6 +++---
- testsuite/voms/voms/voms059.exp | 2 +-
- testsuite/voms/voms/voms060.exp | 2 +-
- testsuite/voms/voms/voms061.exp | 6 +++---
- testsuite/voms/voms/voms091.exp | 2 +-
- testsuite/voms/voms/voms092.exp | 2 +-
- testsuite/voms/voms/voms124.exp | 2 +-
- testsuite/voms/voms/voms142.exp | 2 +-
- testsuite/voms/voms/voms143.exp | 2 +-
- 25 files changed, 32 insertions(+), 32 deletions(-)
-
-diff --git a/src/client/vomsclient.cc b/src/client/vomsclient.cc
-index e28f4de..9ec19c2 100644
---- a/src/client/vomsclient.cc
-+++ b/src/client/vomsclient.cc
-@@ -483,7 +483,7 @@ Client::Client(int argc, char ** argv) :
-   /* controls that number of bits for the key is appropiate */
-   
-   if (bits == -1)
--    bits = 1024;
-+    bits = 2048;
- 
-   if ((bits != 0) && (bits!=512) && (bits!=1024) && (bits!=2048) && (bits!=4096)) {
-     Print(ERROR) << "Error: number of bits in key must be one of 512, 1024, 2048, 4096." << std::endl;
-diff --git a/src/utils/vomsfake.cc b/src/utils/vomsfake.cc
-index 0aee29d..4604cd8 100644
---- a/src/utils/vomsfake.cc
-+++ b/src/utils/vomsfake.cc
-@@ -219,7 +219,7 @@ Fake::Fake(int argc, char ** argv) :   confile(conf_file_name),
-     "    -pwstdin                       Allows passphrase from stdin\n" \
-     "    -limited                       Creates a limited proxy\n" \
-     "    -hours H                       Proxy is valid for H hours (default:12)\n" \
--    "    -bits                          Number of bits in key {512|1024|2048|4096} (default:1024)\n" \
-+    "    -bits                          Number of bits in key {512|1024|2048|4096} (default:2048)\n" \
-     "    -cert     <certfile>           Non-standard location of user certificate\n" \
-     "    -key      <keyfile>            Non-standard location of user key\n" \
-     "    -certdir  <certdir>            Non-standard location of trusted cert dir\n" \
-@@ -1021,7 +1021,7 @@ bool Fake::VerifyOptions()
-   /* controls that number of bits for the key is appropiate */
- 
-   if (bits == -1)
--    bits = 1024;
-+    bits = 2048;
- 
-   if ((bits!=512) && (bits!=1024) && 
-       (bits!=2048) && (bits!=4096) && (bits != 0))
-diff --git a/testsuite/lib/vomslib.exp b/testsuite/lib/vomslib.exp
-index 9ef3f5f..ae8b25e 100644
---- a/testsuite/lib/vomslib.exp
-+++ b/testsuite/lib/vomslib.exp
-@@ -308,7 +308,7 @@ commonName		= supplied
- emailAddress		= optional
- 
- \[req\]
--default_bits		= 1024
-+default_bits		= 2048
- default_keyfile 	= privkey.pem
- distinguished_name=req_distinguished_name
- #attributes		= req_attributes
-diff --git a/testsuite/voms/voms/voms007.exp b/testsuite/voms/voms/voms007.exp
-index 6f716b7..ae5ec47 100644
---- a/testsuite/voms/voms/voms007.exp
-+++ b/testsuite/voms/voms/voms007.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms009.exp b/testsuite/voms/voms/voms009.exp
-index f25c9cc..0853cbf 100644
---- a/testsuite/voms/voms/voms009.exp
-+++ b/testsuite/voms/voms/voms009.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms010.exp b/testsuite/voms/voms/voms010.exp
-index 5886358..acd4d68 100644
---- a/testsuite/voms/voms/voms010.exp
-+++ b/testsuite/voms/voms/voms010.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms011.exp b/testsuite/voms/voms/voms011.exp
-index 4cf4978..b85aa89 100644
---- a/testsuite/voms/voms/voms011.exp
-+++ b/testsuite/voms/voms/voms011.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms014.exp b/testsuite/voms/voms/voms014.exp
-index 8206187..34a2d0b 100644
---- a/testsuite/voms/voms/voms014.exp
-+++ b/testsuite/voms/voms/voms014.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \(\[0-9\]*\):\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms016.exp b/testsuite/voms/voms/voms016.exp
-index 7f3b1ce..5dd6f03 100644
---- a/testsuite/voms/voms/voms016.exp
-+++ b/testsuite/voms/voms/voms016.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \(\[0-9\]*\):\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms020.exp b/testsuite/voms/voms/voms020.exp
-index 822056f..7958601 100644
---- a/testsuite/voms/voms/voms020.exp
-+++ b/testsuite/voms/voms/voms020.exp
-@@ -29,7 +29,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms021.exp b/testsuite/voms/voms/voms021.exp
-index a1dead6..f424a6a 100644
---- a/testsuite/voms/voms/voms021.exp
-+++ b/testsuite/voms/voms/voms021.exp
-@@ -26,7 +26,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms025.exp b/testsuite/voms/voms/voms025.exp
-index 5cde623..a10d5a9 100644
---- a/testsuite/voms/voms/voms025.exp
-+++ b/testsuite/voms/voms/voms025.exp
-@@ -23,7 +23,7 @@ proc mytest {} {
-         set correct "=== Proxy Chain Information ===
- subject   : /C=IT/CN=001
- issuer    : /C=IT/O=INFN/CN=CAFromthisCN
--strength  : 1024 bits
-+strength  : 2048 bits
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- 
- === Proxy Information ===
-@@ -31,7 +31,7 @@ subject   : /C=IT/CN=001/CN=proxy
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
- 
-diff --git a/testsuite/voms/voms/voms030.exp b/testsuite/voms/voms/voms030.exp
-index b4f4ed7..c71ed38 100644
---- a/testsuite/voms/voms/voms030.exp
-+++ b/testsuite/voms/voms/voms030.exp
-@@ -20,7 +20,7 @@ proc mytest {} {
-         return $::FAILTEST
-     } else {
-         #match against known (correct) output
--        set correct "1024"
-+        set correct "2048"
- 
-         loadvar out2 $outname
-         if [regexp $correct $out2] then {
-diff --git a/testsuite/voms/voms/voms041.exp b/testsuite/voms/voms/voms041.exp
-index ea40680..83c4c0c 100644
---- a/testsuite/voms/voms/voms041.exp
-+++ b/testsuite/voms/voms/voms041.exp
-@@ -24,7 +24,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \(\[0-9\]*\):\[0-9\]*:\[0-9\]*"
- 
-diff --git a/testsuite/voms/voms/voms042.exp b/testsuite/voms/voms/voms042.exp
-index 3f72237..1e0c31a 100644
---- a/testsuite/voms/voms/voms042.exp
-+++ b/testsuite/voms/voms/voms042.exp
-@@ -5,7 +5,7 @@ proc mytest {} {
-     _activateCert mycert2
- 
-     _vomsStart voms1
--    set res [log_exec outname {voms-proxy-init --voms voms1 --bits 2048}]
-+    set res [log_exec outname {voms-proxy-init --voms voms1 --bits 4096}]
-     _vomsStop voms1
- 
-     if $res then {
-@@ -24,7 +24,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 2048 bits
-+strength  : 4096 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
- 
-diff --git a/testsuite/voms/voms/voms043.exp b/testsuite/voms/voms/voms043.exp
-index bfa5bbe..a4f85bb 100644
---- a/testsuite/voms/voms/voms043.exp
-+++ b/testsuite/voms/voms/voms043.exp
-@@ -30,7 +30,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- included  : testo di prova"
-diff --git a/testsuite/voms/voms/voms044.exp b/testsuite/voms/voms/voms044.exp
-index 58c0ad5..899fd48 100644
---- a/testsuite/voms/voms/voms044.exp
-+++ b/testsuite/voms/voms/voms044.exp
-@@ -24,13 +24,13 @@ proc mytest {} {
-         set correct "=== Proxy Chain Information ===
- subject   : /C=IT/CN=001
- issuer    : /C=IT/O=INFN/CN=CAFromthisCN
--strength  : 1024 bits
-+strength  : 2048 bits
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- 
- subject   : /C=IT/CN=001/CN=proxy
- issuer    : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- 
- === Proxy Information ===
-@@ -38,7 +38,7 @@ subject   : /C=IT/CN=001/CN=proxy/CN=proxy
- issuer    : /C=IT/CN=001/CN=proxy
- identity  : /C=IT/CN=001/CN=proxy
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
- 
-diff --git a/testsuite/voms/voms/voms059.exp b/testsuite/voms/voms/voms059.exp
-index 973bc16..115c4bc 100644
---- a/testsuite/voms/voms/voms059.exp
-+++ b/testsuite/voms/voms/voms059.exp
-@@ -24,7 +24,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms060.exp b/testsuite/voms/voms/voms060.exp
-index c806f01..b0f44fc 100644
---- a/testsuite/voms/voms/voms060.exp
-+++ b/testsuite/voms/voms/voms060.exp
-@@ -24,7 +24,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms061.exp b/testsuite/voms/voms/voms061.exp
-index 66ff04c..4c9a13d 100644
---- a/testsuite/voms/voms/voms061.exp
-+++ b/testsuite/voms/voms/voms061.exp
-@@ -24,13 +24,13 @@ proc mytest {} {
-         set correct "=== Proxy Chain Information ===
- subject   : /C=IT/CN=001
- issuer    : /C=IT/O=INFN/CN=CAFromthisCN
--strength  : 1024 bits
-+strength  : 2048 bits
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- 
- subject   : /C=IT/CN=001/CN=proxy
- issuer    : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- 
- === Proxy Information ===
-@@ -38,7 +38,7 @@ subject   : /C=IT/CN=001/CN=proxy/CN=proxy
- issuer    : /C=IT/CN=001/CN=proxy
- identity  : /C=IT/CN=001/CN=proxy
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
- 
-diff --git a/testsuite/voms/voms/voms091.exp b/testsuite/voms/voms/voms091.exp
-index fcced39..fbd3260 100644
---- a/testsuite/voms/voms/voms091.exp
-+++ b/testsuite/voms/voms/voms091.exp
-@@ -43,7 +43,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms092.exp b/testsuite/voms/voms/voms092.exp
-index ee65692..2cee5db 100644
---- a/testsuite/voms/voms/voms092.exp
-+++ b/testsuite/voms/voms/voms092.exp
-@@ -31,7 +31,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
- key usage : Digital Signature, Key Encipherment
-diff --git a/testsuite/voms/voms/voms124.exp b/testsuite/voms/voms/voms124.exp
-index 8a54782..a004c2f 100644
---- a/testsuite/voms/voms/voms124.exp
-+++ b/testsuite/voms/voms/voms124.exp
-@@ -18,7 +18,7 @@ proc mytest {} {
- 
-     set correct "Detected Globus version: 2.2
- Unspecified proxy version, settling on Globus version: 2
--Number of bits in key :1024
-+Number of bits in key :2048
- Files being used:
-  CA certificate file: none
-  Trusted certificates directory : $::ETC_DIR/grid-security/certificates
-diff --git a/testsuite/voms/voms/voms142.exp b/testsuite/voms/voms/voms142.exp
-index fc02384..7444c5c 100644
---- a/testsuite/voms/voms/voms142.exp
-+++ b/testsuite/voms/voms/voms142.exp
-@@ -24,7 +24,7 @@ proc mytest {} {
- issuer    : /C=IT/CN=001
- identity  : /C=IT/CN=001
- type      : proxy
--strength  : 1024 bits
-+strength  : 2048 bits
- path      : /tmp/x509up_u\[0-9\]*
- timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
- 
-diff --git a/testsuite/voms/voms/voms143.exp b/testsuite/voms/voms/voms143.exp
-index ef6edfe..bc40c9d 100644
---- a/testsuite/voms/voms/voms143.exp
-+++ b/testsuite/voms/voms/voms143.exp
-@@ -21,7 +21,7 @@ proc mytest {} {
-         return $::FAILTEST
-     }
- 
--    set correct "Key: \\(1024 bit\\)"
-+    set correct "Key: \\(2048 bit\\)"
- 
-     loadvar out2 $outname
-     if [regexp $correct $out2] then {
--- 
-2.17.2
-

voms-default-proxyver.patch

@@ -1,120 +0,0 @@
-From 76b0410b00156ecb1bd9c9b91553a89792fb99ef Mon Sep 17 00:00:00 2001
-From: Mattias Ellert <mattias.ellert@physics.uu.se>
-Date: Mon, 3 May 2021 22:17:01 +0200
-Subject: [PATCH] Ignore -globus option in voms-proxy-fake and default to RFC
- proxies. voms-proxy-init was already changed to work this way.
-
-Remove obsolete (and buggy) globus() function that detemines the
-globus version. No longer used to define the default proxy version.
----
- src/client/vomsclient.cc  |  5 -----
- src/common/credentials.c  | 23 -----------------------
- src/include/credentials.h |  1 -
- src/utils/vomsfake.cc     | 22 ++--------------------
- 4 files changed, 2 insertions(+), 49 deletions(-)
-
-diff --git a/src/client/vomsclient.cc b/src/client/vomsclient.cc
-index 56664f4..8bafcf4 100644
---- a/src/client/vomsclient.cc
-+++ b/src/client/vomsclient.cc
-@@ -422,11 +422,6 @@ Client::Client(int argc, char ** argv) :
-       dontverifyac = true;
-   }
- 
--  /* set globus version */
--
--  version = globus(version);
--  Print(DEBUG) << "Detected Globus version: " << version/10 << "." << version % 10 << std::endl;
--  
-   /* set proxy version */
-   if (rfc)
-     proxyver = 4;
-diff --git a/src/common/credentials.c b/src/common/credentials.c
-index f834dca..5fb3b02 100644
---- a/src/common/credentials.c
-+++ b/src/common/credentials.c
-@@ -40,29 +40,6 @@
- #include "sslutils.h"
- #include "voms_cert_type.h"
- 
--int
--globus(int version)
--{
--  if (version == 0) {
--    char *gver = getenv("GLOBUS_VERSION");
--
--    if (gver) {
--      char *tmp;
--      
--      version = strtol(gver, &tmp, 10);
--      if (!(*tmp))
--        return 22;
--    }
--  }
--  
--  if (version >= 42 || version == 0)
--    version = 22;
--
--  return version;
--}
--
--
--
- X509 *
- get_real_cert(X509 *base, STACK_OF(X509) *stk)
- {
-diff --git a/src/include/credentials.h b/src/include/credentials.h
-index b825d39..9ffbb83 100644
---- a/src/include/credentials.h
-+++ b/src/include/credentials.h
-@@ -29,7 +29,6 @@
- #include <openssl/x509.h>
- #include <openssl/evp.h>
- 
--extern int globus(int);
- extern X509 *get_real_cert(X509 *base, STACK_OF(X509) *stk);
- extern char *get_peer_serial(X509 *);
- 
-diff --git a/src/utils/vomsfake.cc b/src/utils/vomsfake.cc
-index 4604cd8..2cf1b23 100644
---- a/src/utils/vomsfake.cc
-+++ b/src/utils/vomsfake.cc
-@@ -943,16 +943,6 @@ bool Fake::VerifyOptions()
-       exitError("Error: You must specify an host key!");
-   }
- 
--  /* set globus version */
--
--  version = globus(version);
--  if (version == 0) {
--    version = 22;
--    Print(DEBUG) << "Unable to discover Globus version: trying for 2.2" << std::endl;
--  }
--  else 
--    Print(DEBUG) << "Detected Globus version: " << version << std::endl;
--
-   if (!selfsigned) {
-     /* proxyversion is only significant if this is not a selfsigned certificate */
-     if (rfc && proxyver != 0) 
-@@ -966,16 +956,8 @@ bool Fake::VerifyOptions()
-     if (proxyver!=2 && proxyver!=3 && proxyver!=4 && proxyver!=0)
-       exitError("Error: proxyver must be 2 or 3 or 4");
-     else if (proxyver==0) {
--      Print(DEBUG) << "Unspecified proxy version, settling on version: ";
--
--      if (version<30)
--        proxyver = 2;
--      else if (version<40)
--        proxyver = 3;
--      else
--        proxyver = 4;
--
--      Print(DEBUG) << proxyver << std::endl;
-+      Print(DEBUG) << "Unspecified proxy version, settling on version 4 (RFC)" << std::endl;
-+      proxyver = 4;
-     }
- 
-     /* PCI extension option */ 
--- 
-2.36.1
-

voms-gcc7.patch

@@ -1,13 +0,0 @@
-diff --git a/src/server/vomsd.cc b/src/server/vomsd.cc
-index 700c5f1..4f4d1f7 100644
---- a/src/server/vomsd.cc
-+++ b/src/server/vomsd.cc
-@@ -1451,7 +1451,7 @@ static bool determine_group_and_role(std::string command, char *comm, char **gro
-     case 'B':
-       *role = strchr(string, ':');
-       if (*role) {
--        (*role) = '\0';
-+        (**role) = '\0';
-         (*role)++;
-       }
-       break;

voms-init-ssl.patch

@@ -1,79 +0,0 @@
-diff --git a/src/api/ccapi/voms_api.cc b/src/api/ccapi/voms_api.cc
-index 8e387ae..b617732 100644
---- a/src/api/ccapi/voms_api.cc
-+++ b/src/api/ccapi/voms_api.cc
-@@ -93,8 +93,6 @@ extern int AC_Init(void);
- std::map<vomsdata*, vomsspace::internal*> privatedata;
- pthread_mutex_t privatelock = PTHREAD_MUTEX_INITIALIZER;
- 
--static bool initialized = false;
--
- void vomsdata::seterror(verror_type err, std::string message)
- {
-   error = err;
-@@ -106,6 +104,31 @@ std::string vomsdata::ErrorMessage(void)
-   return errmessage;
- }
- 
-+static pthread_once_t initialized = PTHREAD_ONCE_INIT;
-+static bool ssl_is_initialized = false;
-+
-+static void initialize()
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+  if (!ssl_is_initialized) {
-+    // not strictly necessary, since initialize is called only once
-+    ssl_is_initialized = true;
-+
-+    SSL_library_init();
-+    OpenSSL_add_all_algorithms();
-+    ERR_load_crypto_strings();
-+    OpenSSL_add_all_ciphers();
-+  }
-+#endif
-+  AC_Init();
-+  InitProxyCertInfoExtension(1);
-+}
-+
-+void vomsdata::SkipSslInitialization()
-+{
-+  ssl_is_initialized = true;
-+}
-+
- vomsdata::vomsdata(std::string voms_dir, std::string cert_dir) :  ca_cert_dir(cert_dir),
-                                                                   voms_cert_dir(voms_dir),
-                                                                   duration(0),
-@@ -118,19 +141,7 @@ vomsdata::vomsdata(std::string voms_dir, std::string cert_dir) :  ca_cert_dir(ce
-                                                                   verificationtime(0),
-                                                                   vdp(NULL)
- {
--   if (!initialized) {
--     initialized = true;
--#ifdef NOGLOBUS
--     SSL_library_init();
--     OpenSSL_add_all_algorithms();
--     ERR_load_crypto_strings();
--     OpenSSL_add_all_ciphers();
--
--     (void)AC_Init();
--     InitProxyCertInfoExtension(1);
--#endif
--     PKCS12_PBE_add();
--   }
-+  pthread_once(&initialized, initialize);
- 
-   if (voms_cert_dir.empty()) {
-     char *v;
-diff --git a/src/api/ccapi/voms_api.h b/src/api/ccapi/voms_api.h
-index 9648de9..7a272cd 100644
---- a/src/api/ccapi/voms_api.h
-+++ b/src/api/ccapi/voms_api.h
-@@ -215,6 +215,8 @@ struct vomsdata {
-   public:
-   verror_type error; /*!< Error code */
- 
-+  static void SkipSslInitialization();
-+
-   vomsdata(std::string voms_dir = "", 
- 	   std::string cert_dir = ""); /*!< \param voms_dir The directory which contains the certificate 
-                                               of the VOMS server

voms-lib-check-no-macro.patch

@@ -1,22 +0,0 @@
-diff --git a/m4/acinclude.m4 b/m4/acinclude.m4
-index f78f275..b67ac1e 100644
---- a/m4/acinclude.m4
-+++ b/m4/acinclude.m4
-@@ -117,7 +117,7 @@ AC_DEFUN([AC_OPENSSL],
-               [with_openssl_prefix=/usr])
- 
-   if test "x$with_openssl_prefix" = "x/usr" ; then
--    AC_CHECK_LIB(crypto, CRYPTO_num_locks, [found=yes], [found=no])
-+    AC_CHECK_LIB(crypto, ERR_print_errors_fp, [found=yes], [found=no])
- 
-     if test "x$found" = "xyes" ; then
- 	OPENSSL_LIBS="-lcrypto -lssl"
-@@ -128,7 +128,7 @@ AC_DEFUN([AC_OPENSSL],
-     LD_LIBRARY_PATH="$with_openssl_prefix/lib"
- 
-     AC_LANG_PUSH(C)
--    AC_CHECK_LIB(crypto, CRYPTO_num_locks, [found=yes], [found=no])
-+    AC_CHECK_LIB(crypto, ERR_print_errors_fp, [found=yes], [found=no])
-     AC_LANG_POP(C)  
-     NO_GLOBUS_FLAGS="-I$with_openssl_prefix/include"
- 

voms-openssl3.patch

@@ -1,64 +0,0 @@
-From 7c50964e6851452177e1335386812014ee945987 Mon Sep 17 00:00:00 2001
-From: Mischa Salle <msalle@nikhef.nl>
-Date: Mon, 28 Jun 2021 21:24:01 +0200
-Subject: [PATCH] Fixes for OpenSSL-3.0.0-beta1
-
-- several functions now have 'constified' their parameters
-- defining AC_dup using &(AC_it) causes a SEGV in OpenSSL 3.0. The proper way
-  seems to always have been to use ASN1_ITEM_rptr(), see for example
-  https://github.com/openssl/openssl/blob/OpenSSL_1_1_1/crypto/rsa/rsa_asn1.c#L113_L116
----
- src/ac/newformat.c        | 6 +++++-
- src/include/newformat.h   | 4 ++++
- src/include/proxypolicy.h | 4 ++++
- 3 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/src/ac/newformat.c b/src/ac/newformat.c
-index 078cbff1..7c593085 100644
---- a/src/ac/newformat.c
-+++ b/src/ac/newformat.c
-@@ -172,7 +172,11 @@ ASN1_SEQUENCE(AC) = {
- 
- IMPLEMENT_ASN1_FUNCTIONS(AC)
- 
--AC * AC_dup(AC *x) { return (AC*)ASN1_item_dup((&(AC_it)), x); }
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+AC * AC_dup(AC *x) { return ASN1_item_dup(ASN1_ITEM_rptr(AC), x); }
-+#else
-+AC * AC_dup(const AC *x) { return ASN1_item_dup(ASN1_ITEM_rptr(AC), x); }
-+#endif
- 
- ASN1_SEQUENCE(AC_SEQ) = {
-   ASN1_SEQUENCE_OF(AC_SEQ, acs, AC)
-diff --git a/src/include/newformat.h b/src/include/newformat.h
-index 886d8195..cc8d69fd 100644
---- a/src/include/newformat.h
-+++ b/src/include/newformat.h
-@@ -162,7 +162,11 @@ DECLARE_ASN1_FUNCTIONS(AC_CERTS)
- 
- DECLARE_ASN1_PRINT_FUNCTION(AC)
- 
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- extern AC *AC_dup(AC *ac);
-+#else
-+extern AC *AC_dup(const AC *ac);
-+#endif
- 
- extern EVP_PKEY *EVP_PKEY_dup(EVP_PKEY *pkey);
- 
-diff --git a/src/include/proxypolicy.h b/src/include/proxypolicy.h
-index c5bec33e..56a006a1 100644
---- a/src/include/proxypolicy.h
-+++ b/src/include/proxypolicy.h
-@@ -78,7 +78,11 @@ extern "C" {
-     , unsigned char *                     policy
-     , int                                 length);
- 
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-   PROXY_POLICY* PROXY_POLICY_dup(PROXY_POLICY* policy);
-+#else
-+  PROXY_POLICY* PROXY_POLICY_dup(const PROXY_POLICY* policy);
-+#endif
-   
- #ifdef __cplusplus
- }

voms-openssl4.patch

@@ -0,0 +1,374 @@
+diff -ruN a/src/ac/validate.cc b/src/ac/validate.cc
+--- a/src/ac/validate.cc	2025-12-18 13:39:27.000000000 +0100
++++ b/src/ac/validate.cc	2026-04-29 15:38:19.136425930 +0200
+@@ -205,8 +205,8 @@
+   }
+ 
+   v.version    = 1;
+-  v.siglen     = ac->signature->length;
+-  v.signature  = std::string((char*)ac->signature->data, ac->signature->length);
++  v.siglen     = ASN1_STRING_length(ac->signature);
++  v.signature  = std::string((char*)ASN1_STRING_get0_data(ac->signature), ASN1_STRING_length(ac->signature));
+   bn               = ASN1_INTEGER_to_BN(ac->acinfo->serial, NULL);
+   char *bnstring = BN_bn2hex(bn);
+   v.serial     = std::string(bnstring);
+@@ -294,15 +294,15 @@
+       if (X509_NAME_cmp(name->d.dirn, X509_get_subject_name(issuer)))
+         ERROR(AC_ERR_ISSUER_NAME);
+ 
+-    if (ac->acinfo->serial->length>20)
++    if (ASN1_STRING_length(ac->acinfo->serial)>20)
+       ERROR(AC_ERR_SERIAL);
+   }
+ 
+   b = ac->acinfo->validity->notBefore;
+   a = ac->acinfo->validity->notAfter;
+ 
+-  v.date1 = std::string((char*)b->data, b->length);
+-  v.date2 = std::string((char*)a->data, a->length);
++  v.date1 = std::string((char*)ASN1_STRING_get0_data(b), ASN1_STRING_length(b));
++  v.date2 = std::string((char*)ASN1_STRING_get0_data(a), ASN1_STRING_length(a));
+ 
+   if (valids & VERIFY_DATE) {
+     time_t ctime, dtime;
+@@ -315,8 +315,8 @@
+     ctime += 300;
+     dtime = ctime-600;
+ 
+-    if ((a->type != V_ASN1_GENERALIZEDTIME) ||
+-        (b->type != V_ASN1_GENERALIZEDTIME))
++    if ((ASN1_STRING_type(a) != V_ASN1_GENERALIZEDTIME) ||
++        (ASN1_STRING_type(b) != V_ASN1_GENERALIZEDTIME))
+       ERROR(AC_ERR_DATES);
+ 
+     if (((X509_cmp_time(b, &vertime) >= 0) &&
+@@ -379,7 +379,7 @@
+   /* put policyAuthority in voms struct */
+   data = sk_GENERAL_NAME_value(capattr->names, 0);
+   if (data->type == GEN_URI) {
+-    v.voname = std::string((char*)data->d.ia5->data, data->d.ia5->length);
++    v.voname = std::string((char*)ASN1_STRING_get0_data(data->d.ia5), ASN1_STRING_length(data->d.ia5));
+     std::string::size_type point = v.voname.find("://");
+ 
+     if (point != std::string::npos) {
+@@ -398,10 +398,10 @@
+   for (int i=0; i<sk_AC_IETFATTRVAL_num(values); i++) {
+     capname = sk_AC_IETFATTRVAL_value(values, i);
+ 
+-    if (!(capname->type == V_ASN1_OCTET_STRING))
++    if (!(ASN1_STRING_type(capname) == V_ASN1_OCTET_STRING))
+       return AC_ERR_ATTRIB_FQAN;
+ 
+-    std::string str  = std::string((char*)capname->data, capname->length);
++    std::string str  = std::string((char*)ASN1_STRING_get0_data(capname), ASN1_STRING_length(capname));
+     std::string::size_type top_group_size = top_group.size();
+     std::string::size_type str_size = str.size();
+ 
+@@ -556,14 +556,14 @@
+           if (key->keyid) {
+             unsigned char hashed[SHA_DIGEST_LENGTH];
+ 
+-            ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss);
+-            if (!SHA1(pubkey->data,
+-                      pubkey->length,
++            const ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss);
++            if (!SHA1(ASN1_STRING_get0_data(pubkey),
++                      ASN1_STRING_length(pubkey),
+                       hashed))
+               ret = AC_ERR_EXT_KEY;
+           
+-            if ((memcmp(key->keyid->data, hashed, 20) != 0) && 
+-                (key->keyid->length == 20))
++            if ((memcmp(ASN1_STRING_get0_data(key->keyid), hashed, 20) != 0) && 
++                (ASN1_STRING_length(key->keyid) == 20))
+               ret = AC_ERR_EXT_KEY;
+           }
+           else {
+@@ -574,7 +574,7 @@
+                                 (X509_get0_serialNumber(iss))))
+               ret = AC_ERR_EXT_KEY;
+ 	  
+-            if (key->serial->type != GEN_DIRNAME)
++            if (ASN1_STRING_type(key->serial) != GEN_DIRNAME)
+               ret = AC_ERR_EXT_KEY;
+ 
+             if (X509_NAME_cmp(sk_GENERAL_NAME_value((key->issuer), 0)->d.dirn, 
+@@ -632,15 +632,15 @@
+       AC_ATTRIBUTE *at = sk_AC_ATTRIBUTE_value(atts, j);
+ 
+       struct attribute a;
+-      a.name      = std::string((char*)at->name->data,      at->name->length);
+-      a.value     = std::string((char*)at->value->data,     at->value->length);
+-      a.qualifier = std::string((char*)at->qualifier->data, at->qualifier->length);
++      a.name      = std::string((char*)ASN1_STRING_get0_data(at->name),      ASN1_STRING_length(at->name));
++      a.value     = std::string((char*)ASN1_STRING_get0_data(at->value),     ASN1_STRING_length(at->value));
++      a.qualifier = std::string((char*)ASN1_STRING_get0_data(at->qualifier), ASN1_STRING_length(at->qualifier));
+ 
+       al.attributes.push_back(a);
+     }
+ 
+     gn = sk_GENERAL_NAME_value(holder->grantor, 0);
+-    al.grantor = std::string((char*)gn->d.ia5->data, gn->d.ia5->length);
++    al.grantor = std::string((char*)ASN1_STRING_get0_data(gn->d.ia5), ASN1_STRING_length(gn->d.ia5));
+ 
+     rd->attributes->push_back(al);
+   }
+diff -ruN a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc
+--- a/src/api/ccapi/api_util.cc	2025-12-18 13:39:27.000000000 +0100
++++ b/src/api/ccapi/api_util.cc	2026-04-29 16:05:24.239940677 +0200
+@@ -139,7 +139,7 @@
+   int index = X509_get_ext_by_NID(cert, nid, -1);
+ 
+   if (index >= 0)
+-    return X509_get_ext(cert, index);
++    return const_cast<X509_EXTENSION*>(X509_get_ext(cert, index));
+   else
+     return NULL;
+ }
+@@ -157,17 +157,17 @@
+ 
+   ext = get_ext(cert, "incfile");
+   if (ext) {
+-    ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
++    const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
+     assert(value && "X509_EXTENSION_get_data failed");
+-    extra_data = std::string(reinterpret_cast<char*>(value->data), value->length);
++    extra_data = std::string(reinterpret_cast<const char*>(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value));
+     found = true;
+   }
+ 
+   ext = get_ext(cert, "vo");
+   if (ext) {
+-    ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
++    const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
+     assert(value && "X509_EXTENSION_get_data failed");
+-    workvo = std::string(reinterpret_cast<char*>(value->data), value->length);
++    workvo = std::string(reinterpret_cast<const char*>(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value));
+   }
+ 
+   return found;
+@@ -423,7 +423,7 @@
+     return NULL;
+   }
+   
+-  std::string voname((const char *)name->d.ia5->data, 0, name->d.ia5->length);
++  std::string voname((const char *)ASN1_STRING_get0_data(name->d.ia5), 0, ASN1_STRING_length(name->d.ia5));
+   std::string::size_type cpos = voname.find("://");
+   std::string hostname;
+ 
+diff -ruN a/src/api/ccapi/voms_api.cc b/src/api/ccapi/voms_api.cc
+--- a/src/api/ccapi/voms_api.cc	2025-12-18 13:39:27.000000000 +0100
++++ b/src/api/ccapi/voms_api.cc	2026-04-29 16:05:14.064784528 +0200
+@@ -1025,8 +1025,8 @@
+         AC_TARGET *name = NULL;
+         name = sk_AC_TARGET_value(target->targets, i);
+         if (name->name->type == GEN_URI)
+-          targets.push_back(std::string((char*)(name->name->d.ia5->data), 
+-                                        name->name->d.ia5->length));
++          targets.push_back(std::string((char*)ASN1_STRING_get0_data(name->name->d.ia5), 
++                                        ASN1_STRING_length(name->name->d.ia5)));
+       }
+     }
+     AC_TARGETS_free(target);
+diff -ruN a/src/include/sslutils.h b/src/include/sslutils.h
+--- a/src/include/sslutils.h	2025-12-18 13:39:27.000000000 +0100
++++ b/src/include/sslutils.h	2026-04-29 14:45:17.997509299 +0200
+@@ -403,8 +403,8 @@
+ int 
+ proxy_check_issued(
+     X509_STORE_CTX *                    ctx,
+-    X509 *                              x,
+-    X509 *                              issuer);
++    const X509 *                        x,
++    const X509 *                        issuer);
+ 
+ int
+ proxy_verify_certchain(
+diff -ruN a/src/sslutils/proxy.c b/src/sslutils/proxy.c
+--- a/src/sslutils/proxy.c	2025-12-18 13:39:27.000000000 +0100
++++ b/src/sslutils/proxy.c	2026-04-29 15:21:22.859426069 +0200
+@@ -543,8 +543,9 @@
+       oct = ASN1_OCTET_STRING_new();
+       assert(oct != NULL && "ASN1_OCTET_STRING_new failed");
+ 
+-      oct->data = der;
+-      oct->length = len;
++      ASN1_STRING_set0(oct, der, len);
++
++
+       ex7 = X509_EXTENSION_create_by_NID(NULL, v3nid, 1 /*critical*/, oct);
+ 
+       ASN1_OCTET_STRING_free(oct);
+@@ -683,8 +684,7 @@
+     goto err;
+   }
+   
+-  ex_oct->data   = (unsigned char*)data;
+-  ex_oct->length = datalen;
++  ASN1_STRING_set0(ex_oct, (unsigned char*)data, datalen);
+   
+   if (!(ex = X509_EXTENSION_create_by_OBJ(NULL, ex_obj, crit, ex_oct))) {
+     PRXYerr(PRXYERR_F_PROXY_SIGN,PRXYERR_R_CLASS_ADD_EXT);
+@@ -694,8 +694,7 @@
+   
+   if (ex_oct) {
+     /* avoid spurious free of the contents. */
+-    ex_oct->length = 0;
+-    ex_oct->data = NULL;
++    ASN1_STRING_set0(ex_oct, NULL, 0);
+     ASN1_OCTET_STRING_free(ex_oct);
+   }
+ 
+@@ -806,10 +805,10 @@
+   ASN1_BIT_STRING *usage = X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL);
+   
+   if (usage) {
+-    if (usage->length > 0)
+-      keyusage = usage->data[0];
+-    if (usage->length > 1)
+-      keyusage |= usage->data[1] << 8;
++    if (ASN1_STRING_length(usage) > 0)
++      keyusage = ASN1_STRING_get0_data(usage)[0];
++    if (ASN1_STRING_length(usage) > 1)
++      keyusage |= ASN1_STRING_get0_data(usage)[1] << 8;
+ 
+     ASN1_BIT_STRING_free(usage);
+   }
+diff -ruN a/src/sslutils/proxycertinfo.c b/src/sslutils/proxycertinfo.c
+--- a/src/sslutils/proxycertinfo.c	2025-12-18 13:39:27.000000000 +0100
++++ b/src/sslutils/proxycertinfo.c	2026-04-29 14:44:27.158966391 +0200
+@@ -107,9 +107,9 @@
+     BIO_printf(out, "%*sPolicy Language: ", indent, "");
+     i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
+     BIO_puts(out, "\n");
+-    if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
++    if (pci->proxyPolicy->policy && ASN1_STRING_get0_data(pci->proxyPolicy->policy))
+         BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
+-                   pci->proxyPolicy->policy->data);
++                   ASN1_STRING_get0_data(pci->proxyPolicy->policy));
+     return 1;
+ }
+ 
+@@ -142,11 +142,11 @@
+ {
+     if(policy->policy)
+     { 
+-        (*length) = policy->policy->length;
+-        if(*length > 0 && policy->policy->data)
++        (*length) = ASN1_STRING_length(policy->policy);
++        if(*length > 0 && ASN1_STRING_get0_data(policy->policy))
+         {
+             unsigned char *                 copy = malloc(*length);
+-            memcpy(copy, policy->policy->data, *length);
++            memcpy(copy, ASN1_STRING_get0_data(policy->policy), *length);
+             return copy;
+         }
+     }
+diff -ruN a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c
+--- a/src/sslutils/sslutils.c	2025-12-18 13:39:27.000000000 +0100
++++ b/src/sslutils/sslutils.c	2026-04-29 14:45:33.014031670 +0200
+@@ -404,10 +404,12 @@
+ void PRIVATE
+ ERR_set_continue_needed(void)
+ {
++#if OPENSSL_VERSION_NUMBER < 0x40000000L
+     ERR_STATE *es;
+     es = ERR_get_state();
+     es->err_data_flags[es->top] =
+         es->err_data_flags[es->top] | ERR_DISPLAY_CONTINUE_NEEDED;
++#endif
+ }
+ 
+ 
+@@ -1669,8 +1671,8 @@
+ 
+ int PRIVATE
+ proxy_check_issued(UNUSED(X509_STORE_CTX *  ctx),
+-      X509 *                              x,
+-      X509 *                              issuer)
++      const X509 *                        x,
++      const X509 *                        issuer)
+ {
+   int return_value;
+   int return_code = 1;
+@@ -3268,7 +3270,7 @@
+   struct tm tm;
+   int       size = 0;
+ 
+-  switch (ctm->type) {
++  switch (ASN1_STRING_type(ctm)) {
+   case V_ASN1_UTCTIME:
+     size=10;
+     break;
+@@ -3277,8 +3279,8 @@
+     break;
+   }
+   p = buff1;
+-  i = ctm->length;
+-  str = (char *)ctm->data;
++  i = ASN1_STRING_length(ctm);
++  str = (char *)ASN1_STRING_get0_data(ctm);
+   if ((i < 11) || (i > 17)) {
+     return 0;
+   }
+@@ -3311,7 +3313,7 @@
+ 
+   tm.tm_isdst = 0;
+   int index = 0;
+-  if (ctm->type == V_ASN1_UTCTIME) {
++  if (ASN1_STRING_type(ctm) == V_ASN1_UTCTIME) {
+     tm.tm_year  = (buff1[index++]-'0')*10;
+     tm.tm_year += (buff1[index++]-'0');
+   }
+diff -ruN a/src/sslutils/voms_cert_type.c b/src/sslutils/voms_cert_type.c
+--- a/src/sslutils/voms_cert_type.c	2025-12-18 13:39:27.000000000 +0100
++++ b/src/sslutils/voms_cert_type.c	2026-04-29 15:05:46.737365952 +0200
+@@ -256,11 +256,11 @@
+ 
+     ne_data = X509_NAME_ENTRY_get_data(ne);
+ 
+-    if (ne_data->length == 5 && !memcmp(ne_data->data,"proxy",5))
++    if (ASN1_STRING_length(ne_data) == 5 && !memcmp(ASN1_STRING_get0_data(ne_data),"proxy",5))
+     {
+       *cert_type = VOMS_CERT_TYPE_GSI_2_PROXY;
+     }
+-    else if (ne_data->length == 13 && !memcmp(ne_data->data,"limited proxy",13))
++    else if (ASN1_STRING_length(ne_data) == 13 && !memcmp(ASN1_STRING_get0_data(ne_data),"limited proxy",13))
+     {
+       *cert_type = VOMS_CERT_TYPE_GSI_2_LIMITED_PROXY;
+     }
+@@ -293,7 +293,7 @@
+     ne_data = X509_NAME_ENTRY_get_data(ne);
+ 
+     if ((new_ne = X509_NAME_ENTRY_create_by_NID( NULL, NID_commonName,
+-	    ne_data->type, ne_data->data, -1)) == NULL){
++	    ASN1_STRING_type(ne_data), ASN1_STRING_get0_data(ne_data), -1)) == NULL){
+ 
+       result = voms_validation_error(
+ 	  PRXYERR_R_ERROR_BUILDING_SUBJECT,
+diff -ruN a/src/utils/voms_proxy_info.cc b/src/utils/voms_proxy_info.cc
+--- a/src/utils/voms_proxy_info.cc	2025-12-18 13:39:27.000000000 +0100
++++ b/src/utils/voms_proxy_info.cc	2026-04-29 16:06:20.035319031 +0200
+@@ -466,18 +466,10 @@
+ static ASN1_TIME *
+ convtime(std::string data)
+ {
+-  ASN1_TIME *t= ASN1_TIME_new();
+-
+-  t->data   = (unsigned char*)strdup(data.data());
+-  t->length = data.size();
+-  switch(t->length) {
+-  case 10:
+-    t->type = V_ASN1_UTCTIME;
+-    break;
+-  case 15:
+-    t->type = V_ASN1_GENERALIZEDTIME;
+-    break;
+-  default:
++  ASN1_TIME *t = ASN1_TIME_new();
++  if (!t)
++    return NULL;
++  if (!ASN1_TIME_set_string(t, data.c_str())) {
+     ASN1_TIME_free(t);
+     return NULL;
+   }

voms-run-default.patch

@@ -1,34 +0,0 @@
-From 9a9f8400c952bc29a1f8764e865bc60a1d416878 Mon Sep 17 00:00:00 2001
-From: Mattias Ellert <mattias.ellert@physics.uu.se>
-Date: Tue, 6 Feb 2018 04:57:29 +0100
-Subject: [PATCH] Assign default value before reading sysconfig
-
----
- src/install/voms.start.in | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/install/voms.start.in b/src/install/voms.start.in
-index e5ab08f..e8c9e19 100644
---- a/src/install/voms.start.in
-+++ b/src/install/voms.start.in
-@@ -44,6 +44,8 @@
- # Description:       Virtual Organization Membership Service
- ### END INIT INFO
- 
-+RUN=yes
-+
- etcpath=@ETC_DIR@
- 
- # Source an auxiliary profile file if we have one and pick up VOMS_USER and RUN
-@@ -58,8 +60,6 @@ fi
- @LOCATION_ENV@=@LOCATION_DIR@
- @VAR_LOCATION_ENV@=@VAR_DIR@
- 
--RUN=yes
--
- # check whether $@VAR_LOCATION_ENV@/lock/subsys exists
- if ! test -d $@VAR_LOCATION_ENV@/lock/subsys ; then
-     mkdir -p $@VAR_LOCATION_ENV@/lock/subsys
--- 
-2.14.3
-

voms-sysusers.conf

@@ -0,0 +1,2 @@
+# Name ID GECOS                 Home directory Shell
+u voms -  "VOMS Server Account" /etc/voms      -

voms.spec

@@ -1,43 +1,19 @@
 %global _hardened_build 1
 
-%if %{?fedora}%{!?fedora:0} >= 25 || %{?rhel}%{!?rhel:0} >= 8
-%global use_systemd 1
-%else
-%global use_systemd 0
-%endif
-
 Name:		voms
-Version:	2.1.0
-Release:	0.24.rc2%{?dist}
+Version:	2.1.3
+Release:	7%{?dist}
 Summary:	Virtual Organization Membership Service
 
-License:	ASL 2.0
+License:	Apache-2.0
 URL:		https://italiangrid.github.io/voms/
-Source0:	https://github.com/italiangrid/%{name}/archive/v%{version}-rc2/%{name}-%{version}-rc2.tar.gz
+Source0:	https://github.com/italiangrid/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 #		Post-install setup instructions:
 Source1:	%{name}.INSTALL
-#		Fix for GCC 7
-#		https://github.com/italiangrid/voms/pull/56
-Patch0:		%{name}-gcc7.patch
-#		Create RFC proxies as default
-#		https://github.com/italiangrid/voms/pull/97
-Patch1:		%{name}-default-proxyver.patch
-#		Don't use macros in AC_CHECK_LIB
-#		https://github.com/italiangrid/voms/pull/58
-Patch2:		%{name}-lib-check-no-macro.patch
-#		Change default proxy cert key length to 2048 bits
-#		https://github.com/italiangrid/voms/pull/75
-Patch3:		%{name}-change-default-proxy-cert-key-length-to-2048-bits.patch
-#		Fix compilation with OpenSSL 3.0
-#		https://github.com/italiangrid/voms/pull/98
-Patch4:		%{name}-openssl3.patch
-#		Assign default RUN value before reading sysconfig
-#		https://github.com/italiangrid/voms/pull/73
-Patch5:		%{name}-run-default.patch
-#		Better OpenSSL initialization
-#		https://github.com/italiangrid/voms/pull/94
-#		https://github.com/italiangrid/voms/pull/95
-Patch6:		%{name}-init-ssl.patch
+#		System user creation config
+Source2:	%{name}-sysusers.conf
+
+Patch0:		voms-openssl4.patch
 
 BuildRequires:	make
 BuildRequires:	gcc-c++
@@ -49,9 +25,7 @@ BuildRequires:	pkgconfig
 BuildRequires:	libxslt
 BuildRequires:	docbook-style-xsl
 BuildRequires:	doxygen
-%if %{use_systemd}
-BuildRequires:	systemd
-%endif
+BuildRequires:	systemd-rpm-macros
 
 %description
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@@ -84,7 +58,15 @@ Summary:	Virtual Organization Membership Service Documentation
 BuildArch:	noarch
 
 %description doc
-Documentation for the Virtual Organization Membership Service.
+The Virtual Organization Membership Service (VOMS) is an attribute authority
+which serves as central repository for VO user authorization information,
+providing support for sorting users into group hierarchies, keeping track of
+their roles and other attributes in order to issue trusted attribute
+certificates and SAML assertions used in the Grid environment for
+authorization purposes.
+
+This package provides documentation for the Virtual Organization Membership
+Service.
 
 %package clients-cpp
 Summary:	Virtual Organization Membership Service Clients
@@ -93,7 +75,7 @@ Provides:	voms-clients = %{version}-%{release}
 Obsoletes:	voms-clients < 2.0.12-3
 
 Requires(post):		%{_sbindir}/update-alternatives
-Requires(postun):	%{_sbindir}/update-alternatives
+Requires(preun):	%{_sbindir}/update-alternatives
 
 %description clients-cpp
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@@ -109,16 +91,8 @@ services.
 %package server
 Summary:	Virtual Organization Membership Service Server
 Requires:	%{name}%{?_isa} = %{version}-%{release}
-
-Requires(pre):		shadow-utils
-%if %{use_systemd}
+%{?sysusers_requires_compat}
 %{?systemd_requires}
-%else
-Requires(post):		chkconfig
-Requires(preun):	chkconfig
-Requires(preun):	initscripts
-Requires(postun):	initscripts
-%endif
 
 %description server
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@@ -131,14 +105,8 @@ authorization purposes.
 This package provides the VOMS service.
 
 %prep
-%setup -q -n %{name}-%{version}-rc2
-%patch0 -p1
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
+%setup -q
+%patch 0 -p1 -b .openssl4
 
 ./autogen.sh
 
@@ -154,22 +122,13 @@ install -m 644 -p %{SOURCE1} README.Fedora
 
 rm %{buildroot}%{_libdir}/*.la
 
-%if %{use_systemd}
 mkdir -p %{buildroot}%{_unitdir}
 install -m 644 -p systemd/%{name}@.service %{buildroot}%{_unitdir}
 rm %{buildroot}%{_initrddir}/%{name}
 rm %{buildroot}%{_sysconfdir}/sysconfig/%{name}
-%else
-# Turn off default enabling of the service
-sed -e 's/\(chkconfig: \)\w*/\1-/' \
-    -e '/Default-Start/d' \
-    -e 's/\(Default-Stop:\s*\).*/\10 1 2 3 4 5 6/' \
-    -i %{buildroot}%{_initrddir}/%{name}
-%endif
 
-mkdir -p %{buildroot}%{_pkgdocdir}
-install -m 644 -p AUTHORS README.md %{buildroot}%{_pkgdocdir}
-%{!?_licensedir: install -m 644 -p LICENSE %{buildroot}%{_pkgdocdir}}
+mkdir -p %{buildroot}%{_sysusersdir}
+install -m 644 -p %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
 
 mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_C_API
 cp -pr doc/apidoc/api/VOMS_C_API/html %{buildroot}%{_pkgdocdir}/VOMS_C_API
@@ -179,18 +138,18 @@ mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_CC_API
 cp -pr doc/apidoc/api/VOMS_CC_API/html %{buildroot}%{_pkgdocdir}/VOMS_CC_API
 rm -f %{buildroot}%{_pkgdocdir}/VOMS_CC_API/html/installdox
 
+mkdir -p %{buildroot}%{_sysconfdir}/alternatives
 for b in voms-proxy-init voms-proxy-info voms-proxy-destroy; do
   ## Rename client binaries
   mv %{buildroot}%{_bindir}/${b} %{buildroot}%{_bindir}/${b}2
-  touch %{buildroot}/%{_bindir}/${b}
-  chmod 755 %{buildroot}/%{_bindir}/${b}
+  ln -s %{_bindir}/${b}2 %{buildroot}%{_sysconfdir}/alternatives/${b}
+  ln -s %{_sysconfdir}/alternatives/${b} %{buildroot}%{_bindir}/${b}
   ## and man pages
   mv %{buildroot}%{_mandir}/man1/${b}.1 %{buildroot}%{_mandir}/man1/${b}2.1
-  touch %{buildroot}%{_mandir}/man1/${b}.1
+  ln -s %{_mandir}/man1/${b}2.1.gz %{buildroot}%{_sysconfdir}/alternatives/${b}.1.gz
+  ln -s %{_sysconfdir}/alternatives/${b}.1.gz %{buildroot}%{_mandir}/man1/${b}.1.gz
 done
 
-%ldconfig_scriptlets
-
 %posttrans
 # Recover /etc/vomses...
 if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then
@@ -198,17 +157,7 @@ if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then
 fi
 
 %pre server
-getent group %{name} >/dev/null || groupadd -r %{name}
-getent passwd %{name} >/dev/null || useradd -r -g %{name} \
-    -d %{_sysconfdir}/%{name} -s /sbin/nologin -c "VOMS Server Account" %{name}
-
-%if %{use_systemd}
-# Remove old init config when systemd is used
-/sbin/service voms stop >/dev/null 2>&1 || :
-/sbin/chkconfig --del voms >/dev/null 2>&1 || :
-%endif
-
-%if %{use_systemd}
+%sysusers_create_compat %{SOURCE2}
 
 %post server
 if [ $1 -eq 1 ] ; then
@@ -231,26 +180,6 @@ if [ $1 -ge 1 ] ; then
     done
 fi
 
-%else
-
-%post server
-if [ $1 = 1 ]; then
-    /sbin/chkconfig --add %{name}
-fi
-
-%preun server
-if [ $1 = 0 ]; then
-    /sbin/service %{name} stop >/dev/null 2>&1 || :
-    /sbin/chkconfig --del %{name}
-fi
-
-%postun server
-if [ $1 -ge 1 ]; then
-    /sbin/service %{name} condrestart >/dev/null 2>&1 || :
-fi
-
-%endif
-
 %pre clients-cpp
 if [ $1 -gt 1 ]; then
   for c in voms-proxy-init voms-proxy-info voms-proxy-destroy; do
@@ -277,7 +206,7 @@ fi
     --slave %{_mandir}/man1/voms-proxy-destroy.1.gz voms-proxy-destroy-man \
     %{_mandir}/man1/voms-proxy-destroy2.1.gz
 
-%postun clients-cpp
+%preun clients-cpp
 if [ $1 -eq 0 ] ; then
     %{_sbindir}/update-alternatives --remove voms-proxy-init \
     %{_bindir}/voms-proxy-init2
@@ -309,11 +238,9 @@ fi
 %dir %{_sysconfdir}/grid-security/vomsdir
 %dir %{_datadir}/%{name}
 %{_datadir}/%{name}/vomses.template
-%doc %dir %{_pkgdocdir}
-%doc %{_pkgdocdir}/AUTHORS
-%doc %{_pkgdocdir}/README.md
-%{!?_licensedir: %doc %{_pkgdocdir}/LICENSE}
-%{?_licensedir: %license LICENSE}
+%doc AUTHORS
+%doc README.md
+%license LICENSE
 
 %files devel
 %{_libdir}/libvomsapi.so
@@ -323,11 +250,11 @@ fi
 %{_mandir}/man3/*
 
 %files doc
-%doc %{_pkgdocdir}/AUTHORS
+%doc %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/VOMS_C_API
 %doc %{_pkgdocdir}/VOMS_CC_API
-%{!?_licensedir: %doc %{_pkgdocdir}/LICENSE}
-%{?_licensedir: %license LICENSE}
+%doc AUTHORS
+%license LICENSE
 
 %files clients-cpp
 %{_bindir}/voms-proxy-destroy2
@@ -339,6 +266,9 @@ fi
 %ghost %{_bindir}/voms-proxy-destroy
 %ghost %{_bindir}/voms-proxy-info
 %ghost %{_bindir}/voms-proxy-init
+%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy
+%ghost %{_sysconfdir}/alternatives/voms-proxy-info
+%ghost %{_sysconfdir}/alternatives/voms-proxy-init
 %{_mandir}/man1/voms-proxy-destroy2.1*
 %{_mandir}/man1/voms-proxy-info2.1*
 %{_mandir}/man1/voms-proxy-init2.1*
@@ -347,15 +277,13 @@ fi
 %ghost %{_mandir}/man1/voms-proxy-destroy.1*
 %ghost %{_mandir}/man1/voms-proxy-info.1*
 %ghost %{_mandir}/man1/voms-proxy-init.1*
+%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy.1*
+%ghost %{_sysconfdir}/alternatives/voms-proxy-info.1*
+%ghost %{_sysconfdir}/alternatives/voms-proxy-init.1*
 
 %files server
 %{_sbindir}/%{name}
-%if %{use_systemd}
 %{_unitdir}/%{name}@.service
-%else
-%{_initrddir}/%{name}
-%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
-%endif
 %attr(-,voms,voms) %dir %{_sysconfdir}/%{name}
 %dir %{_sysconfdir}/grid-security/%{name}
 %attr(-,voms,voms) %dir %{_localstatedir}/log/%{name}
@@ -367,9 +295,91 @@ fi
 %{_datadir}/%{name}/voms_replica_master_setup.sh
 %{_datadir}/%{name}/voms_replica_slave_setup.sh
 %{_mandir}/man8/voms.8*
+%{_sysusersdir}/%{name}.conf
 %doc README.Fedora
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Mon Jun 15 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.3-6
+- Rebuilt for gsoap 2.8.142
+
+* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.3-5
+- Rebuilt for openssl 4.0
+
+* Wed Apr 29 2026 Dmitry Belyavskiy <beldmit@gmail.com> - 2.1.3-4
+- Fix build with OpenSSL 4.0 (opaque ASN1_STRING, const X509, removed ERR_STATE)
+
+* Tue Jan 20 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.3-3
+- Rebuild for gsoap 2.8.139 (Fedora 44)
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Sat Dec 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.3-1
+- Update to version 2.1.3
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Thu Mar 27 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.2-1
+- Update to version 2.1.2
+- Drop patch accepted upstream
+
+* Sat Mar 08 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-5
+- Move user/group creation logic to sysusers.d fragment
+
+* Sun Jan 19 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-4
+- Fix compilation with GCC 15
+
+* Thu Oct 31 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-3
+- Rebuild for gsoap 2.8.135 (Fedora 42)
+- Add additional ghost files to package (rpmlint)
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Fri Jul 05 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-1
+- Update to version 2.1.0
+- Drop EPEL 7 support from spec file (EOL)
+
+* Tue Jun 18 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.35.rc5
+- Update to version 2.1.0-rc5
+
+* Fri May 03 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.34.rc4
+- Update to version 2.1.0-rc4
+- Drop patches accepted upstream
+
+* Wed Apr 10 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.33.rc3
+- Fix problem with newer gsoap versions
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.32.rc3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Sep 14 2023 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.31.rc3
+- More patches from upstream
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.30.rc3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Thu Feb 09 2023 Florian Weimer <fweimer@redhat.com> - 2.1.0-0.29.rc3
+- Port lexer/parser integration to C99 (#2168585)
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.28.rc3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Mon Jan 02 2023 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
+- Update to version 2.1.0-rc3
+- Drop patches accepted upstream
+- Add new patches (the PRs have been accepted upstream)
+
+* Wed Dec 21 2022 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.26.rc2
+- Rebuild for gsoap 2.8.124 (Fedora 38)
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.25.rc2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
 * Wed Jun 01 2022 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.24.rc2
 - Backport fixes from upstream