11 changed files with 869 additions and 503 deletions
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (voms-2.1.3.tar.gz) = c17af601591cd9bdbb678e1db638cd33033cc73b3c5b16e117c8c47e211e5f19e7a105af55095bc2267dc5889c08fba20d340917c61a68b45ba2a76bdffb8f0d
+SHA512 (voms-2.1.0-rc2.tar.gz) = fb41a10b28dca0affe96aebb3dbdd681edcee544fc29d318295442a808dfa4d2be0c07d52c874362e5ffc0f73dec647c39aa7137a155945668b5d8e900a214b8
--- a/voms-change-default-proxy-cert-key-length-to-2048-bits.patch
+++ b/voms-change-default-proxy-cert-key-length-to-2048-bits.patch
@ -0,0 +1,420 @@
+From 53e7d0b7e5d3a6ae21414551a27ea1c6a753b433 Mon Sep 17 00:00:00 2001
+From: Mattias Ellert <mattias.ellert@physics.uu.se>
+Date: Wed, 31 Oct 2018 14:50:21 +0100
+Subject: [PATCH] Change default proxy cert key length to 2048 bits
+
+---
+ src/client/vomsclient.cc        | 2 +-
+ src/utils/vomsfake.cc           | 4 ++--
+ testsuite/lib/vomslib.exp       | 2 +-
+ testsuite/voms/voms/voms007.exp | 2 +-
+ testsuite/voms/voms/voms009.exp | 2 +-
+ testsuite/voms/voms/voms010.exp | 2 +-
+ testsuite/voms/voms/voms011.exp | 2 +-
+ testsuite/voms/voms/voms014.exp | 2 +-
+ testsuite/voms/voms/voms016.exp | 2 +-
+ testsuite/voms/voms/voms020.exp | 2 +-
+ testsuite/voms/voms/voms021.exp | 2 +-
+ testsuite/voms/voms/voms025.exp | 4 ++--
+ testsuite/voms/voms/voms030.exp | 2 +-
+ testsuite/voms/voms/voms041.exp | 2 +-
+ testsuite/voms/voms/voms042.exp | 4 ++--
+ testsuite/voms/voms/voms043.exp | 2 +-
+ testsuite/voms/voms/voms044.exp | 6 +++---
+ testsuite/voms/voms/voms059.exp | 2 +-
+ testsuite/voms/voms/voms060.exp | 2 +-
+ testsuite/voms/voms/voms061.exp | 6 +++---
+ testsuite/voms/voms/voms091.exp | 2 +-
+ testsuite/voms/voms/voms092.exp | 2 +-
+ testsuite/voms/voms/voms124.exp | 2 +-
+ testsuite/voms/voms/voms142.exp | 2 +-
+ testsuite/voms/voms/voms143.exp | 2 +-
+ 25 files changed, 32 insertions(+), 32 deletions(-)
+
+diff --git a/src/client/vomsclient.cc b/src/client/vomsclient.cc
+index e28f4de..9ec19c2 100644
+--- a/src/client/vomsclient.cc
+++ b/src/client/vomsclient.cc
+@@ -483,7 +483,7 @@ Client::Client(int argc, char ** argv) :
+   /* controls that number of bits for the key is appropiate */
+   
+   if (bits == -1)
+-    bits = 1024;
+    bits = 2048;
+ 
+   if ((bits != 0) && (bits!=512) && (bits!=1024) && (bits!=2048) && (bits!=4096)) {
+     Print(ERROR) << "Error: number of bits in key must be one of 512, 1024, 2048, 4096." << std::endl;
+diff --git a/src/utils/vomsfake.cc b/src/utils/vomsfake.cc
+index 0aee29d..4604cd8 100644
+--- a/src/utils/vomsfake.cc
+++ b/src/utils/vomsfake.cc
+@@ -219,7 +219,7 @@ Fake::Fake(int argc, char ** argv) :   confile(conf_file_name),
+     "    -pwstdin                       Allows passphrase from stdin\n" \
+     "    -limited                       Creates a limited proxy\n" \
+     "    -hours H                       Proxy is valid for H hours (default:12)\n" \
+-    "    -bits                          Number of bits in key {512|1024|2048|4096} (default:1024)\n" \
+    "    -bits                          Number of bits in key {512|1024|2048|4096} (default:2048)\n" \
+     "    -cert     <certfile>           Non-standard location of user certificate\n" \
+     "    -key      <keyfile>            Non-standard location of user key\n" \
+     "    -certdir  <certdir>            Non-standard location of trusted cert dir\n" \
+@@ -1021,7 +1021,7 @@ bool Fake::VerifyOptions()
+   /* controls that number of bits for the key is appropiate */
+ 
+   if (bits == -1)
+-    bits = 1024;
+    bits = 2048;
+ 
+   if ((bits!=512) && (bits!=1024) && 
+       (bits!=2048) && (bits!=4096) && (bits != 0))
+diff --git a/testsuite/lib/vomslib.exp b/testsuite/lib/vomslib.exp
+index 9ef3f5f..ae8b25e 100644
+--- a/testsuite/lib/vomslib.exp
+++ b/testsuite/lib/vomslib.exp
+@@ -308,7 +308,7 @@ commonName		= supplied
+ emailAddress		= optional
+ 
+ \[req\]
+-default_bits		= 1024
+default_bits		= 2048
+ default_keyfile 	= privkey.pem
+ distinguished_name=req_distinguished_name
+ #attributes		= req_attributes
+diff --git a/testsuite/voms/voms/voms007.exp b/testsuite/voms/voms/voms007.exp
+index 6f716b7..ae5ec47 100644
+--- a/testsuite/voms/voms/voms007.exp
+++ b/testsuite/voms/voms/voms007.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms009.exp b/testsuite/voms/voms/voms009.exp
+index f25c9cc..0853cbf 100644
+--- a/testsuite/voms/voms/voms009.exp
+++ b/testsuite/voms/voms/voms009.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms010.exp b/testsuite/voms/voms/voms010.exp
+index 5886358..acd4d68 100644
+--- a/testsuite/voms/voms/voms010.exp
+++ b/testsuite/voms/voms/voms010.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms011.exp b/testsuite/voms/voms/voms011.exp
+index 4cf4978..b85aa89 100644
+--- a/testsuite/voms/voms/voms011.exp
+++ b/testsuite/voms/voms/voms011.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms014.exp b/testsuite/voms/voms/voms014.exp
+index 8206187..34a2d0b 100644
+--- a/testsuite/voms/voms/voms014.exp
+++ b/testsuite/voms/voms/voms014.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \(\[0-9\]*\):\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms016.exp b/testsuite/voms/voms/voms016.exp
+index 7f3b1ce..5dd6f03 100644
+--- a/testsuite/voms/voms/voms016.exp
+++ b/testsuite/voms/voms/voms016.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \(\[0-9\]*\):\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms020.exp b/testsuite/voms/voms/voms020.exp
+index 822056f..7958601 100644
+--- a/testsuite/voms/voms/voms020.exp
+++ b/testsuite/voms/voms/voms020.exp
+@@ -29,7 +29,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms021.exp b/testsuite/voms/voms/voms021.exp
+index a1dead6..f424a6a 100644
+--- a/testsuite/voms/voms/voms021.exp
+++ b/testsuite/voms/voms/voms021.exp
+@@ -26,7 +26,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms025.exp b/testsuite/voms/voms/voms025.exp
+index 5cde623..a10d5a9 100644
+--- a/testsuite/voms/voms/voms025.exp
+++ b/testsuite/voms/voms/voms025.exp
+@@ -23,7 +23,7 @@ proc mytest {} {
+         set correct "=== Proxy Chain Information ===
+ subject   : /C=IT/CN=001
+ issuer    : /C=IT/O=INFN/CN=CAFromthisCN
+-strength  : 1024 bits
+strength  : 2048 bits
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ 
+ === Proxy Information ===
+@@ -31,7 +31,7 @@ subject   : /C=IT/CN=001/CN=proxy
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
+ 
+diff --git a/testsuite/voms/voms/voms030.exp b/testsuite/voms/voms/voms030.exp
+index b4f4ed7..c71ed38 100644
+--- a/testsuite/voms/voms/voms030.exp
+++ b/testsuite/voms/voms/voms030.exp
+@@ -20,7 +20,7 @@ proc mytest {} {
+         return $::FAILTEST
+     } else {
+         #match against known (correct) output
+-        set correct "1024"
+        set correct "2048"
+ 
+         loadvar out2 $outname
+         if [regexp $correct $out2] then {
+diff --git a/testsuite/voms/voms/voms041.exp b/testsuite/voms/voms/voms041.exp
+index ea40680..83c4c0c 100644
+--- a/testsuite/voms/voms/voms041.exp
+++ b/testsuite/voms/voms/voms041.exp
+@@ -24,7 +24,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \(\[0-9\]*\):\[0-9\]*:\[0-9\]*"
+ 
+diff --git a/testsuite/voms/voms/voms042.exp b/testsuite/voms/voms/voms042.exp
+index 3f72237..1e0c31a 100644
+--- a/testsuite/voms/voms/voms042.exp
+++ b/testsuite/voms/voms/voms042.exp
+@@ -5,7 +5,7 @@ proc mytest {} {
+     _activateCert mycert2
+ 
+     _vomsStart voms1
+-    set res [log_exec outname {voms-proxy-init --voms voms1 --bits 2048}]
+    set res [log_exec outname {voms-proxy-init --voms voms1 --bits 4096}]
+     _vomsStop voms1
+ 
+     if $res then {
+@@ -24,7 +24,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 2048 bits
+strength  : 4096 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
+ 
+diff --git a/testsuite/voms/voms/voms043.exp b/testsuite/voms/voms/voms043.exp
+index bfa5bbe..a4f85bb 100644
+--- a/testsuite/voms/voms/voms043.exp
+++ b/testsuite/voms/voms/voms043.exp
+@@ -30,7 +30,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ included  : testo di prova"
+diff --git a/testsuite/voms/voms/voms044.exp b/testsuite/voms/voms/voms044.exp
+index 58c0ad5..899fd48 100644
+--- a/testsuite/voms/voms/voms044.exp
+++ b/testsuite/voms/voms/voms044.exp
+@@ -24,13 +24,13 @@ proc mytest {} {
+         set correct "=== Proxy Chain Information ===
+ subject   : /C=IT/CN=001
+ issuer    : /C=IT/O=INFN/CN=CAFromthisCN
+-strength  : 1024 bits
+strength  : 2048 bits
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ 
+ subject   : /C=IT/CN=001/CN=proxy
+ issuer    : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ 
+ === Proxy Information ===
+@@ -38,7 +38,7 @@ subject   : /C=IT/CN=001/CN=proxy/CN=proxy
+ issuer    : /C=IT/CN=001/CN=proxy
+ identity  : /C=IT/CN=001/CN=proxy
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
+ 
+diff --git a/testsuite/voms/voms/voms059.exp b/testsuite/voms/voms/voms059.exp
+index 973bc16..115c4bc 100644
+--- a/testsuite/voms/voms/voms059.exp
+++ b/testsuite/voms/voms/voms059.exp
+@@ -24,7 +24,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms060.exp b/testsuite/voms/voms/voms060.exp
+index c806f01..b0f44fc 100644
+--- a/testsuite/voms/voms/voms060.exp
+++ b/testsuite/voms/voms/voms060.exp
+@@ -24,7 +24,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms061.exp b/testsuite/voms/voms/voms061.exp
+index 66ff04c..4c9a13d 100644
+--- a/testsuite/voms/voms/voms061.exp
+++ b/testsuite/voms/voms/voms061.exp
+@@ -24,13 +24,13 @@ proc mytest {} {
+         set correct "=== Proxy Chain Information ===
+ subject   : /C=IT/CN=001
+ issuer    : /C=IT/O=INFN/CN=CAFromthisCN
+-strength  : 1024 bits
+strength  : 2048 bits
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ 
+ subject   : /C=IT/CN=001/CN=proxy
+ issuer    : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ 
+ === Proxy Information ===
+@@ -38,7 +38,7 @@ subject   : /C=IT/CN=001/CN=proxy/CN=proxy
+ issuer    : /C=IT/CN=001/CN=proxy
+ identity  : /C=IT/CN=001/CN=proxy
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
+ 
+diff --git a/testsuite/voms/voms/voms091.exp b/testsuite/voms/voms/voms091.exp
+index fcced39..fbd3260 100644
+--- a/testsuite/voms/voms/voms091.exp
+++ b/testsuite/voms/voms/voms091.exp
+@@ -43,7 +43,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms092.exp b/testsuite/voms/voms/voms092.exp
+index ee65692..2cee5db 100644
+--- a/testsuite/voms/voms/voms092.exp
+++ b/testsuite/voms/voms/voms092.exp
+@@ -31,7 +31,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*
+ key usage : Digital Signature, Key Encipherment
+diff --git a/testsuite/voms/voms/voms124.exp b/testsuite/voms/voms/voms124.exp
+index 8a54782..a004c2f 100644
+--- a/testsuite/voms/voms/voms124.exp
+++ b/testsuite/voms/voms/voms124.exp
+@@ -18,7 +18,7 @@ proc mytest {} {
+ 
+     set correct "Detected Globus version: 2.2
+ Unspecified proxy version, settling on Globus version: 2
+-Number of bits in key :1024
+Number of bits in key :2048
+ Files being used:
+  CA certificate file: none
+  Trusted certificates directory : $::ETC_DIR/grid-security/certificates
+diff --git a/testsuite/voms/voms/voms142.exp b/testsuite/voms/voms/voms142.exp
+index fc02384..7444c5c 100644
+--- a/testsuite/voms/voms/voms142.exp
+++ b/testsuite/voms/voms/voms142.exp
+@@ -24,7 +24,7 @@ proc mytest {} {
+ issuer    : /C=IT/CN=001
+ identity  : /C=IT/CN=001
+ type      : proxy
+-strength  : 1024 bits
+strength  : 2048 bits
+ path      : /tmp/x509up_u\[0-9\]*
+ timeleft  : \[0-9\]*:\[0-9\]*:\[0-9\]*"
+ 
+diff --git a/testsuite/voms/voms/voms143.exp b/testsuite/voms/voms/voms143.exp
+index ef6edfe..bc40c9d 100644
+--- a/testsuite/voms/voms/voms143.exp
+++ b/testsuite/voms/voms/voms143.exp
+@@ -21,7 +21,7 @@ proc mytest {} {
+         return $::FAILTEST
+     }
+ 
+-    set correct "Key: \\(1024 bit\\)"
+    set correct "Key: \\(2048 bit\\)"
+ 
+     loadvar out2 $outname
+     if [regexp $correct $out2] then {
+-- 
+2.17.2
+
--- a/voms-default-proxyver.patch
+++ b/voms-default-proxyver.patch
@ -0,0 +1,120 @@
+From 76b0410b00156ecb1bd9c9b91553a89792fb99ef Mon Sep 17 00:00:00 2001
+From: Mattias Ellert <mattias.ellert@physics.uu.se>
+Date: Mon, 3 May 2021 22:17:01 +0200
+Subject: [PATCH] Ignore -globus option in voms-proxy-fake and default to RFC
+ proxies. voms-proxy-init was already changed to work this way.
+
+Remove obsolete (and buggy) globus() function that detemines the
+globus version. No longer used to define the default proxy version.
+---
+ src/client/vomsclient.cc  |  5 -----
+ src/common/credentials.c  | 23 -----------------------
+ src/include/credentials.h |  1 -
+ src/utils/vomsfake.cc     | 22 ++--------------------
+ 4 files changed, 2 insertions(+), 49 deletions(-)
+
+diff --git a/src/client/vomsclient.cc b/src/client/vomsclient.cc
+index 56664f4..8bafcf4 100644
+--- a/src/client/vomsclient.cc
+++ b/src/client/vomsclient.cc
+@@ -422,11 +422,6 @@ Client::Client(int argc, char ** argv) :
+       dontverifyac = true;
+   }
+ 
+-  /* set globus version */
+-
+-  version = globus(version);
+-  Print(DEBUG) << "Detected Globus version: " << version/10 << "." << version % 10 << std::endl;
+-  
+   /* set proxy version */
+   if (rfc)
+     proxyver = 4;
+diff --git a/src/common/credentials.c b/src/common/credentials.c
+index f834dca..5fb3b02 100644
+--- a/src/common/credentials.c
+++ b/src/common/credentials.c
+@@ -40,29 +40,6 @@
+ #include "sslutils.h"
+ #include "voms_cert_type.h"
+ 
+-int
+-globus(int version)
+-{
+-  if (version == 0) {
+-    char *gver = getenv("GLOBUS_VERSION");
+-
+-    if (gver) {
+-      char *tmp;
+-      
+-      version = strtol(gver, &tmp, 10);
+-      if (!(*tmp))
+-        return 22;
+-    }
+-  }
+-  
+-  if (version >= 42 || version == 0)
+-    version = 22;
+-
+-  return version;
+-}
+-
+-
+-
+ X509 *
+ get_real_cert(X509 *base, STACK_OF(X509) *stk)
+ {
+diff --git a/src/include/credentials.h b/src/include/credentials.h
+index b825d39..9ffbb83 100644
+--- a/src/include/credentials.h
+++ b/src/include/credentials.h
+@@ -29,7 +29,6 @@
+ #include <openssl/x509.h>
+ #include <openssl/evp.h>
+ 
+-extern int globus(int);
+ extern X509 *get_real_cert(X509 *base, STACK_OF(X509) *stk);
+ extern char *get_peer_serial(X509 *);
+ 
+diff --git a/src/utils/vomsfake.cc b/src/utils/vomsfake.cc
+index 4604cd8..2cf1b23 100644
+--- a/src/utils/vomsfake.cc
+++ b/src/utils/vomsfake.cc
+@@ -943,16 +943,6 @@ bool Fake::VerifyOptions()
+       exitError("Error: You must specify an host key!");
+   }
+ 
+-  /* set globus version */
+-
+-  version = globus(version);
+-  if (version == 0) {
+-    version = 22;
+-    Print(DEBUG) << "Unable to discover Globus version: trying for 2.2" << std::endl;
+-  }
+-  else 
+-    Print(DEBUG) << "Detected Globus version: " << version << std::endl;
+-
+   if (!selfsigned) {
+     /* proxyversion is only significant if this is not a selfsigned certificate */
+     if (rfc && proxyver != 0) 
+@@ -966,16 +956,8 @@ bool Fake::VerifyOptions()
+     if (proxyver!=2 && proxyver!=3 && proxyver!=4 && proxyver!=0)
+       exitError("Error: proxyver must be 2 or 3 or 4");
+     else if (proxyver==0) {
+-      Print(DEBUG) << "Unspecified proxy version, settling on version: ";
+-
+-      if (version<30)
+-        proxyver = 2;
+-      else if (version<40)
+-        proxyver = 3;
+-      else
+-        proxyver = 4;
+-
+-      Print(DEBUG) << proxyver << std::endl;
+      Print(DEBUG) << "Unspecified proxy version, settling on version 4 (RFC)" << std::endl;
+      proxyver = 4;
+     }
+ 
+     /* PCI extension option */ 
+-- 
+2.36.1
+
--- a/voms-gcc7.patch
+++ b/voms-gcc7.patch
@ -0,0 +1,13 @@
+diff --git a/src/server/vomsd.cc b/src/server/vomsd.cc
+index 700c5f1..4f4d1f7 100644
+--- a/src/server/vomsd.cc
+++ b/src/server/vomsd.cc
+@@ -1451,7 +1451,7 @@ static bool determine_group_and_role(std::string command, char *comm, char **gro
+     case 'B':
+       *role = strchr(string, ':');
+       if (*role) {
+-        (*role) = '\0';
+        (**role) = '\0';
+         (*role)++;
+       }
+       break;
--- a/voms-init-ssl.patch
+++ b/voms-init-ssl.patch
@ -0,0 +1,79 @@
+diff --git a/src/api/ccapi/voms_api.cc b/src/api/ccapi/voms_api.cc
+index 8e387ae..b617732 100644
+--- a/src/api/ccapi/voms_api.cc
+++ b/src/api/ccapi/voms_api.cc
+@@ -93,8 +93,6 @@ extern int AC_Init(void);
+ std::map<vomsdata*, vomsspace::internal*> privatedata;
+ pthread_mutex_t privatelock = PTHREAD_MUTEX_INITIALIZER;
+ 
+-static bool initialized = false;
+-
+ void vomsdata::seterror(verror_type err, std::string message)
+ {
+   error = err;
+@@ -106,6 +104,31 @@ std::string vomsdata::ErrorMessage(void)
+   return errmessage;
+ }
+ 
+static pthread_once_t initialized = PTHREAD_ONCE_INIT;
+static bool ssl_is_initialized = false;
+
+static void initialize()
+{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+  if (!ssl_is_initialized) {
+    // not strictly necessary, since initialize is called only once
+    ssl_is_initialized = true;
+
+    SSL_library_init();
+    OpenSSL_add_all_algorithms();
+    ERR_load_crypto_strings();
+    OpenSSL_add_all_ciphers();
+  }
+#endif
+  AC_Init();
+  InitProxyCertInfoExtension(1);
+}
+
+void vomsdata::SkipSslInitialization()
+{
+  ssl_is_initialized = true;
+}
+
+ vomsdata::vomsdata(std::string voms_dir, std::string cert_dir) :  ca_cert_dir(cert_dir),
+                                                                   voms_cert_dir(voms_dir),
+                                                                   duration(0),
+@@ -118,19 +141,7 @@ vomsdata::vomsdata(std::string voms_dir, std::string cert_dir) :  ca_cert_dir(ce
+                                                                   verificationtime(0),
+                                                                   vdp(NULL)
+ {
+-   if (!initialized) {
+-     initialized = true;
+-#ifdef NOGLOBUS
+-     SSL_library_init();
+-     OpenSSL_add_all_algorithms();
+-     ERR_load_crypto_strings();
+-     OpenSSL_add_all_ciphers();
+-
+-     (void)AC_Init();
+-     InitProxyCertInfoExtension(1);
+-#endif
+-     PKCS12_PBE_add();
+-   }
+  pthread_once(&initialized, initialize);
+ 
+   if (voms_cert_dir.empty()) {
+     char *v;
+diff --git a/src/api/ccapi/voms_api.h b/src/api/ccapi/voms_api.h
+index 9648de9..7a272cd 100644
+--- a/src/api/ccapi/voms_api.h
+++ b/src/api/ccapi/voms_api.h
+@@ -215,6 +215,8 @@ struct vomsdata {
+   public:
+   verror_type error; /*!< Error code */
+ 
+  static void SkipSslInitialization();
+
+   vomsdata(std::string voms_dir = "", 
+ 	   std::string cert_dir = ""); /*!< \param voms_dir The directory which contains the certificate 
+                                               of the VOMS server
--- a/voms-lib-check-no-macro.patch
+++ b/voms-lib-check-no-macro.patch
@ -0,0 +1,22 @@
+diff --git a/m4/acinclude.m4 b/m4/acinclude.m4
+index f78f275..b67ac1e 100644
+--- a/m4/acinclude.m4
+++ b/m4/acinclude.m4
+@@ -117,7 +117,7 @@ AC_DEFUN([AC_OPENSSL],
+               [with_openssl_prefix=/usr])
+ 
+   if test "x$with_openssl_prefix" = "x/usr" ; then
+-    AC_CHECK_LIB(crypto, CRYPTO_num_locks, [found=yes], [found=no])
+    AC_CHECK_LIB(crypto, ERR_print_errors_fp, [found=yes], [found=no])
+ 
+     if test "x$found" = "xyes" ; then
+ 	OPENSSL_LIBS="-lcrypto -lssl"
+@@ -128,7 +128,7 @@ AC_DEFUN([AC_OPENSSL],
+     LD_LIBRARY_PATH="$with_openssl_prefix/lib"
+ 
+     AC_LANG_PUSH(C)
+-    AC_CHECK_LIB(crypto, CRYPTO_num_locks, [found=yes], [found=no])
+    AC_CHECK_LIB(crypto, ERR_print_errors_fp, [found=yes], [found=no])
+     AC_LANG_POP(C)  
+     NO_GLOBUS_FLAGS="-I$with_openssl_prefix/include"
+ 
--- a/voms-openssl3.patch
+++ b/voms-openssl3.patch
@ -0,0 +1,64 @@
+From 7c50964e6851452177e1335386812014ee945987 Mon Sep 17 00:00:00 2001
+From: Mischa Salle <msalle@nikhef.nl>
+Date: Mon, 28 Jun 2021 21:24:01 +0200
+Subject: [PATCH] Fixes for OpenSSL-3.0.0-beta1
+
+- several functions now have 'constified' their parameters
+- defining AC_dup using &(AC_it) causes a SEGV in OpenSSL 3.0. The proper way
+  seems to always have been to use ASN1_ITEM_rptr(), see for example
+  https://github.com/openssl/openssl/blob/OpenSSL_1_1_1/crypto/rsa/rsa_asn1.c#L113_L116
+---
+ src/ac/newformat.c        | 6 +++++-
+ src/include/newformat.h   | 4 ++++
+ src/include/proxypolicy.h | 4 ++++
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/src/ac/newformat.c b/src/ac/newformat.c
+index 078cbff1..7c593085 100644
+--- a/src/ac/newformat.c
+++ b/src/ac/newformat.c
+@@ -172,7 +172,11 @@ ASN1_SEQUENCE(AC) = {
+ 
+ IMPLEMENT_ASN1_FUNCTIONS(AC)
+ 
+-AC * AC_dup(AC *x) { return (AC*)ASN1_item_dup((&(AC_it)), x); }
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+AC * AC_dup(AC *x) { return ASN1_item_dup(ASN1_ITEM_rptr(AC), x); }
+#else
+AC * AC_dup(const AC *x) { return ASN1_item_dup(ASN1_ITEM_rptr(AC), x); }
+#endif
+ 
+ ASN1_SEQUENCE(AC_SEQ) = {
+   ASN1_SEQUENCE_OF(AC_SEQ, acs, AC)
+diff --git a/src/include/newformat.h b/src/include/newformat.h
+index 886d8195..cc8d69fd 100644
+--- a/src/include/newformat.h
+++ b/src/include/newformat.h
+@@ -162,7 +162,11 @@ DECLARE_ASN1_FUNCTIONS(AC_CERTS)
+ 
+ DECLARE_ASN1_PRINT_FUNCTION(AC)
+ 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ extern AC *AC_dup(AC *ac);
+#else
+extern AC *AC_dup(const AC *ac);
+#endif
+ 
+ extern EVP_PKEY *EVP_PKEY_dup(EVP_PKEY *pkey);
+ 
+diff --git a/src/include/proxypolicy.h b/src/include/proxypolicy.h
+index c5bec33e..56a006a1 100644
+--- a/src/include/proxypolicy.h
+++ b/src/include/proxypolicy.h
+@@ -78,7 +78,11 @@ extern "C" {
+     , unsigned char *                     policy
+     , int                                 length);
+ 
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   PROXY_POLICY* PROXY_POLICY_dup(PROXY_POLICY* policy);
+#else
+  PROXY_POLICY* PROXY_POLICY_dup(const PROXY_POLICY* policy);
+#endif
+   
+ #ifdef __cplusplus
+ }
--- a/voms-openssl4.patch
+++ b/voms-openssl4.patch
@ -1,374 +0,0 @@
-diff -ruN a/src/ac/validate.cc b/src/ac/validate.cc
--- a/src/ac/validate.cc	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/ac/validate.cc	2026-04-29 15:38:19.136425930 +0200
-@@ -205,8 +205,8 @@
-   }
- 
-   v.version    = 1;
-  v.siglen     = ac->signature->length;
-  v.signature  = std::string((char*)ac->signature->data, ac->signature->length);
-+  v.siglen     = ASN1_STRING_length(ac->signature);
-+  v.signature  = std::string((char*)ASN1_STRING_get0_data(ac->signature), ASN1_STRING_length(ac->signature));
-   bn               = ASN1_INTEGER_to_BN(ac->acinfo->serial, NULL);
-   char *bnstring = BN_bn2hex(bn);
-   v.serial     = std::string(bnstring);
-@@ -294,15 +294,15 @@
-       if (X509_NAME_cmp(name->d.dirn, X509_get_subject_name(issuer)))
-         ERROR(AC_ERR_ISSUER_NAME);
- 
-    if (ac->acinfo->serial->length>20)
-+    if (ASN1_STRING_length(ac->acinfo->serial)>20)
-       ERROR(AC_ERR_SERIAL);
-   }
- 
-   b = ac->acinfo->validity->notBefore;
-   a = ac->acinfo->validity->notAfter;
- 
-  v.date1 = std::string((char*)b->data, b->length);
-  v.date2 = std::string((char*)a->data, a->length);
-+  v.date1 = std::string((char*)ASN1_STRING_get0_data(b), ASN1_STRING_length(b));
-+  v.date2 = std::string((char*)ASN1_STRING_get0_data(a), ASN1_STRING_length(a));
- 
-   if (valids & VERIFY_DATE) {
-     time_t ctime, dtime;
-@@ -315,8 +315,8 @@
-     ctime += 300;
-     dtime = ctime-600;
- 
-    if ((a->type != V_ASN1_GENERALIZEDTIME) ||
-        (b->type != V_ASN1_GENERALIZEDTIME))
-+    if ((ASN1_STRING_type(a) != V_ASN1_GENERALIZEDTIME) ||
-+        (ASN1_STRING_type(b) != V_ASN1_GENERALIZEDTIME))
-       ERROR(AC_ERR_DATES);
- 
-     if (((X509_cmp_time(b, &vertime) >= 0) &&
-@@ -379,7 +379,7 @@
-   /* put policyAuthority in voms struct */
-   data = sk_GENERAL_NAME_value(capattr->names, 0);
-   if (data->type == GEN_URI) {
-    v.voname = std::string((char*)data->d.ia5->data, data->d.ia5->length);
-+    v.voname = std::string((char*)ASN1_STRING_get0_data(data->d.ia5), ASN1_STRING_length(data->d.ia5));
-     std::string::size_type point = v.voname.find("://");
- 
-     if (point != std::string::npos) {
-@@ -398,10 +398,10 @@
-   for (int i=0; i<sk_AC_IETFATTRVAL_num(values); i++) {
-     capname = sk_AC_IETFATTRVAL_value(values, i);
- 
-    if (!(capname->type == V_ASN1_OCTET_STRING))
-+    if (!(ASN1_STRING_type(capname) == V_ASN1_OCTET_STRING))
-       return AC_ERR_ATTRIB_FQAN;
- 
-    std::string str  = std::string((char*)capname->data, capname->length);
-+    std::string str  = std::string((char*)ASN1_STRING_get0_data(capname), ASN1_STRING_length(capname));
-     std::string::size_type top_group_size = top_group.size();
-     std::string::size_type str_size = str.size();
- 
-@@ -556,14 +556,14 @@
-           if (key->keyid) {
-             unsigned char hashed[SHA_DIGEST_LENGTH];
- 
-            ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss);
-            if (!SHA1(pubkey->data,
-                      pubkey->length,
-+            const ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss);
-+            if (!SHA1(ASN1_STRING_get0_data(pubkey),
-+                      ASN1_STRING_length(pubkey),
-                       hashed))
-               ret = AC_ERR_EXT_KEY;
-           
-            if ((memcmp(key->keyid->data, hashed, 20) != 0) && 
-                (key->keyid->length == 20))
-+            if ((memcmp(ASN1_STRING_get0_data(key->keyid), hashed, 20) != 0) && 
-+                (ASN1_STRING_length(key->keyid) == 20))
-               ret = AC_ERR_EXT_KEY;
-           }
-           else {
-@@ -574,7 +574,7 @@
-                                 (X509_get0_serialNumber(iss))))
-               ret = AC_ERR_EXT_KEY;
- 	  
-            if (key->serial->type != GEN_DIRNAME)
-+            if (ASN1_STRING_type(key->serial) != GEN_DIRNAME)
-               ret = AC_ERR_EXT_KEY;
- 
-             if (X509_NAME_cmp(sk_GENERAL_NAME_value((key->issuer), 0)->d.dirn, 
-@@ -632,15 +632,15 @@
-       AC_ATTRIBUTE *at = sk_AC_ATTRIBUTE_value(atts, j);
- 
-       struct attribute a;
-      a.name      = std::string((char*)at->name->data,      at->name->length);
-      a.value     = std::string((char*)at->value->data,     at->value->length);
-      a.qualifier = std::string((char*)at->qualifier->data, at->qualifier->length);
-+      a.name      = std::string((char*)ASN1_STRING_get0_data(at->name),      ASN1_STRING_length(at->name));
-+      a.value     = std::string((char*)ASN1_STRING_get0_data(at->value),     ASN1_STRING_length(at->value));
-+      a.qualifier = std::string((char*)ASN1_STRING_get0_data(at->qualifier), ASN1_STRING_length(at->qualifier));
- 
-       al.attributes.push_back(a);
-     }
- 
-     gn = sk_GENERAL_NAME_value(holder->grantor, 0);
-    al.grantor = std::string((char*)gn->d.ia5->data, gn->d.ia5->length);
-+    al.grantor = std::string((char*)ASN1_STRING_get0_data(gn->d.ia5), ASN1_STRING_length(gn->d.ia5));
- 
-     rd->attributes->push_back(al);
-   }
-diff -ruN a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc
--- a/src/api/ccapi/api_util.cc	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/api/ccapi/api_util.cc	2026-04-29 16:05:24.239940677 +0200
-@@ -139,7 +139,7 @@
-   int index = X509_get_ext_by_NID(cert, nid, -1);
- 
-   if (index >= 0)
-    return X509_get_ext(cert, index);
-+    return const_cast<X509_EXTENSION*>(X509_get_ext(cert, index));
-   else
-     return NULL;
- }
-@@ -157,17 +157,17 @@
- 
-   ext = get_ext(cert, "incfile");
-   if (ext) {
-    ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
-+    const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
-     assert(value && "X509_EXTENSION_get_data failed");
-    extra_data = std::string(reinterpret_cast<char*>(value->data), value->length);
-+    extra_data = std::string(reinterpret_cast<const char*>(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value));
-     found = true;
-   }
- 
-   ext = get_ext(cert, "vo");
-   if (ext) {
-    ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
-+    const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
-     assert(value && "X509_EXTENSION_get_data failed");
-    workvo = std::string(reinterpret_cast<char*>(value->data), value->length);
-+    workvo = std::string(reinterpret_cast<const char*>(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value));
-   }
- 
-   return found;
-@@ -423,7 +423,7 @@
-     return NULL;
-   }
-   
-  std::string voname((const char *)name->d.ia5->data, 0, name->d.ia5->length);
-+  std::string voname((const char *)ASN1_STRING_get0_data(name->d.ia5), 0, ASN1_STRING_length(name->d.ia5));
-   std::string::size_type cpos = voname.find("://");
-   std::string hostname;
- 
-diff -ruN a/src/api/ccapi/voms_api.cc b/src/api/ccapi/voms_api.cc
--- a/src/api/ccapi/voms_api.cc	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/api/ccapi/voms_api.cc	2026-04-29 16:05:14.064784528 +0200
-@@ -1025,8 +1025,8 @@
-         AC_TARGET *name = NULL;
-         name = sk_AC_TARGET_value(target->targets, i);
-         if (name->name->type == GEN_URI)
-          targets.push_back(std::string((char*)(name->name->d.ia5->data), 
-                                        name->name->d.ia5->length));
-+          targets.push_back(std::string((char*)ASN1_STRING_get0_data(name->name->d.ia5), 
-+                                        ASN1_STRING_length(name->name->d.ia5)));
-       }
-     }
-     AC_TARGETS_free(target);
-diff -ruN a/src/include/sslutils.h b/src/include/sslutils.h
--- a/src/include/sslutils.h	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/include/sslutils.h	2026-04-29 14:45:17.997509299 +0200
-@@ -403,8 +403,8 @@
- int 
- proxy_check_issued(
-     X509_STORE_CTX *                    ctx,
-    X509 *                              x,
-    X509 *                              issuer);
-+    const X509 *                        x,
-+    const X509 *                        issuer);
- 
- int
- proxy_verify_certchain(
-diff -ruN a/src/sslutils/proxy.c b/src/sslutils/proxy.c
--- a/src/sslutils/proxy.c	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/sslutils/proxy.c	2026-04-29 15:21:22.859426069 +0200
-@@ -543,8 +543,9 @@
-       oct = ASN1_OCTET_STRING_new();
-       assert(oct != NULL && "ASN1_OCTET_STRING_new failed");
- 
-      oct->data = der;
-      oct->length = len;
-+      ASN1_STRING_set0(oct, der, len);
-+
-+
-       ex7 = X509_EXTENSION_create_by_NID(NULL, v3nid, 1 /*critical*/, oct);
- 
-       ASN1_OCTET_STRING_free(oct);
-@@ -683,8 +684,7 @@
-     goto err;
-   }
-   
-  ex_oct->data   = (unsigned char*)data;
-  ex_oct->length = datalen;
-+  ASN1_STRING_set0(ex_oct, (unsigned char*)data, datalen);
-   
-   if (!(ex = X509_EXTENSION_create_by_OBJ(NULL, ex_obj, crit, ex_oct))) {
-     PRXYerr(PRXYERR_F_PROXY_SIGN,PRXYERR_R_CLASS_ADD_EXT);
-@@ -694,8 +694,7 @@
-   
-   if (ex_oct) {
-     /* avoid spurious free of the contents. */
-    ex_oct->length = 0;
-    ex_oct->data = NULL;
-+    ASN1_STRING_set0(ex_oct, NULL, 0);
-     ASN1_OCTET_STRING_free(ex_oct);
-   }
- 
-@@ -806,10 +805,10 @@
-   ASN1_BIT_STRING *usage = X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL);
-   
-   if (usage) {
-    if (usage->length > 0)
-      keyusage = usage->data[0];
-    if (usage->length > 1)
-      keyusage |= usage->data[1] << 8;
-+    if (ASN1_STRING_length(usage) > 0)
-+      keyusage = ASN1_STRING_get0_data(usage)[0];
-+    if (ASN1_STRING_length(usage) > 1)
-+      keyusage |= ASN1_STRING_get0_data(usage)[1] << 8;
- 
-     ASN1_BIT_STRING_free(usage);
-   }
-diff -ruN a/src/sslutils/proxycertinfo.c b/src/sslutils/proxycertinfo.c
--- a/src/sslutils/proxycertinfo.c	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/sslutils/proxycertinfo.c	2026-04-29 14:44:27.158966391 +0200
-@@ -107,9 +107,9 @@
-     BIO_printf(out, "%*sPolicy Language: ", indent, "");
-     i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
-     BIO_puts(out, "\n");
-    if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
-+    if (pci->proxyPolicy->policy && ASN1_STRING_get0_data(pci->proxyPolicy->policy))
-         BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
-                   pci->proxyPolicy->policy->data);
-+                   ASN1_STRING_get0_data(pci->proxyPolicy->policy));
-     return 1;
- }
- 
-@@ -142,11 +142,11 @@
- {
-     if(policy->policy)
-     { 
-        (*length) = policy->policy->length;
-        if(*length > 0 && policy->policy->data)
-+        (*length) = ASN1_STRING_length(policy->policy);
-+        if(*length > 0 && ASN1_STRING_get0_data(policy->policy))
-         {
-             unsigned char *                 copy = malloc(*length);
-            memcpy(copy, policy->policy->data, *length);
-+            memcpy(copy, ASN1_STRING_get0_data(policy->policy), *length);
-             return copy;
-         }
-     }
-diff -ruN a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c
--- a/src/sslutils/sslutils.c	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/sslutils/sslutils.c	2026-04-29 14:45:33.014031670 +0200
-@@ -404,10 +404,12 @@
- void PRIVATE
- ERR_set_continue_needed(void)
- {
-+#if OPENSSL_VERSION_NUMBER < 0x40000000L
-     ERR_STATE *es;
-     es = ERR_get_state();
-     es->err_data_flags[es->top] =
-         es->err_data_flags[es->top] | ERR_DISPLAY_CONTINUE_NEEDED;
-+#endif
- }
- 
- 
-@@ -1669,8 +1671,8 @@
- 
- int PRIVATE
- proxy_check_issued(UNUSED(X509_STORE_CTX *  ctx),
-      X509 *                              x,
-      X509 *                              issuer)
-+      const X509 *                        x,
-+      const X509 *                        issuer)
- {
-   int return_value;
-   int return_code = 1;
-@@ -3268,7 +3270,7 @@
-   struct tm tm;
-   int       size = 0;
- 
-  switch (ctm->type) {
-+  switch (ASN1_STRING_type(ctm)) {
-   case V_ASN1_UTCTIME:
-     size=10;
-     break;
-@@ -3277,8 +3279,8 @@
-     break;
-   }
-   p = buff1;
-  i = ctm->length;
-  str = (char *)ctm->data;
-+  i = ASN1_STRING_length(ctm);
-+  str = (char *)ASN1_STRING_get0_data(ctm);
-   if ((i < 11) || (i > 17)) {
-     return 0;
-   }
-@@ -3311,7 +3313,7 @@
- 
-   tm.tm_isdst = 0;
-   int index = 0;
-  if (ctm->type == V_ASN1_UTCTIME) {
-+  if (ASN1_STRING_type(ctm) == V_ASN1_UTCTIME) {
-     tm.tm_year  = (buff1[index++]-'0')*10;
-     tm.tm_year += (buff1[index++]-'0');
-   }
-diff -ruN a/src/sslutils/voms_cert_type.c b/src/sslutils/voms_cert_type.c
--- a/src/sslutils/voms_cert_type.c	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/sslutils/voms_cert_type.c	2026-04-29 15:05:46.737365952 +0200
-@@ -256,11 +256,11 @@
- 
-     ne_data = X509_NAME_ENTRY_get_data(ne);
- 
-    if (ne_data->length == 5 && !memcmp(ne_data->data,"proxy",5))
-+    if (ASN1_STRING_length(ne_data) == 5 && !memcmp(ASN1_STRING_get0_data(ne_data),"proxy",5))
-     {
-       *cert_type = VOMS_CERT_TYPE_GSI_2_PROXY;
-     }
-    else if (ne_data->length == 13 && !memcmp(ne_data->data,"limited proxy",13))
-+    else if (ASN1_STRING_length(ne_data) == 13 && !memcmp(ASN1_STRING_get0_data(ne_data),"limited proxy",13))
-     {
-       *cert_type = VOMS_CERT_TYPE_GSI_2_LIMITED_PROXY;
-     }
-@@ -293,7 +293,7 @@
-     ne_data = X509_NAME_ENTRY_get_data(ne);
- 
-     if ((new_ne = X509_NAME_ENTRY_create_by_NID( NULL, NID_commonName,
-	    ne_data->type, ne_data->data, -1)) == NULL){
-+	    ASN1_STRING_type(ne_data), ASN1_STRING_get0_data(ne_data), -1)) == NULL){
- 
-       result = voms_validation_error(
- 	  PRXYERR_R_ERROR_BUILDING_SUBJECT,
-diff -ruN a/src/utils/voms_proxy_info.cc b/src/utils/voms_proxy_info.cc
--- a/src/utils/voms_proxy_info.cc	2025-12-18 13:39:27.000000000 +0100
-+++ b/src/utils/voms_proxy_info.cc	2026-04-29 16:06:20.035319031 +0200
-@@ -466,18 +466,10 @@
- static ASN1_TIME *
- convtime(std::string data)
- {
-  ASN1_TIME *t= ASN1_TIME_new();
-
-  t->data   = (unsigned char*)strdup(data.data());
-  t->length = data.size();
-  switch(t->length) {
-  case 10:
-    t->type = V_ASN1_UTCTIME;
-    break;
-  case 15:
-    t->type = V_ASN1_GENERALIZEDTIME;
-    break;
-  default:
-+  ASN1_TIME *t = ASN1_TIME_new();
-+  if (!t)
-+    return NULL;
-+  if (!ASN1_TIME_set_string(t, data.c_str())) {
-     ASN1_TIME_free(t);
-     return NULL;
-   }
--- a/voms-run-default.patch
+++ b/voms-run-default.patch
@ -0,0 +1,34 @@
+From 9a9f8400c952bc29a1f8764e865bc60a1d416878 Mon Sep 17 00:00:00 2001
+From: Mattias Ellert <mattias.ellert@physics.uu.se>
+Date: Tue, 6 Feb 2018 04:57:29 +0100
+Subject: [PATCH] Assign default value before reading sysconfig
+
+---
+ src/install/voms.start.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/install/voms.start.in b/src/install/voms.start.in
+index e5ab08f..e8c9e19 100644
+--- a/src/install/voms.start.in
+++ b/src/install/voms.start.in
+@@ -44,6 +44,8 @@
+ # Description:       Virtual Organization Membership Service
+ ### END INIT INFO
+ 
+RUN=yes
+
+ etcpath=@ETC_DIR@
+ 
+ # Source an auxiliary profile file if we have one and pick up VOMS_USER and RUN
+@@ -58,8 +60,6 @@ fi
+ @LOCATION_ENV@=@LOCATION_DIR@
+ @VAR_LOCATION_ENV@=@VAR_DIR@
+ 
+-RUN=yes
+-
+ # check whether $@VAR_LOCATION_ENV@/lock/subsys exists
+ if ! test -d $@VAR_LOCATION_ENV@/lock/subsys ; then
+     mkdir -p $@VAR_LOCATION_ENV@/lock/subsys
+-- 
+2.14.3
+
--- a/voms-sysusers.conf
+++ b/voms-sysusers.conf
@ -1,2 +0,0 @@
-# Name ID GECOS                 Home directory Shell
-u voms -  "VOMS Server Account" /etc/voms      -
--- a/voms.spec
+++ b/voms.spec
@ -1,19 +1,43 @@
 %global _hardened_build 1

+%if %{?fedora}%{!?fedora:0} >= 25 || %{?rhel}%{!?rhel:0} >= 8
+%global use_systemd 1
+%else
+%global use_systemd 0
+%endif
+
 Name:		voms
-Version:	2.1.3
-Release:	7%{?dist}
+Version:	2.1.0
+Release:	0.24.rc2%{?dist}
 Summary:	Virtual Organization Membership Service

-License:	Apache-2.0
+License:	ASL 2.0
 URL:		https://italiangrid.github.io/voms/
-Source0:	https://github.com/italiangrid/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+Source0:	https://github.com/italiangrid/%{name}/archive/v%{version}-rc2/%{name}-%{version}-rc2.tar.gz
 #		Post-install setup instructions:
 Source1:	%{name}.INSTALL
-#		System user creation config
-Source2:	%{name}-sysusers.conf
-
-Patch0:		voms-openssl4.patch
+#		Fix for GCC 7
+#		https://github.com/italiangrid/voms/pull/56
+Patch0:		%{name}-gcc7.patch
+#		Create RFC proxies as default
+#		https://github.com/italiangrid/voms/pull/97
+Patch1:		%{name}-default-proxyver.patch
+#		Don't use macros in AC_CHECK_LIB
+#		https://github.com/italiangrid/voms/pull/58
+Patch2:		%{name}-lib-check-no-macro.patch
+#		Change default proxy cert key length to 2048 bits
+#		https://github.com/italiangrid/voms/pull/75
+Patch3:		%{name}-change-default-proxy-cert-key-length-to-2048-bits.patch
+#		Fix compilation with OpenSSL 3.0
+#		https://github.com/italiangrid/voms/pull/98
+Patch4:		%{name}-openssl3.patch
+#		Assign default RUN value before reading sysconfig
+#		https://github.com/italiangrid/voms/pull/73
+Patch5:		%{name}-run-default.patch
+#		Better OpenSSL initialization
+#		https://github.com/italiangrid/voms/pull/94
+#		https://github.com/italiangrid/voms/pull/95
+Patch6:		%{name}-init-ssl.patch

 BuildRequires:	make
 BuildRequires:	gcc-c++
@ -25,7 +49,9 @@ BuildRequires:	pkgconfig
 BuildRequires:	libxslt
 BuildRequires:	docbook-style-xsl
 BuildRequires:	doxygen
-BuildRequires:	systemd-rpm-macros
+%if %{use_systemd}
+BuildRequires:	systemd
+%endif

 %description
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@ -58,15 +84,7 @@ Summary:	Virtual Organization Membership Service Documentation
 BuildArch:	noarch

 %description doc
-The Virtual Organization Membership Service (VOMS) is an attribute authority
-which serves as central repository for VO user authorization information,
-providing support for sorting users into group hierarchies, keeping track of
-their roles and other attributes in order to issue trusted attribute
-certificates and SAML assertions used in the Grid environment for
-authorization purposes.
-
-This package provides documentation for the Virtual Organization Membership
-Service.
+Documentation for the Virtual Organization Membership Service.

 %package clients-cpp
 Summary:	Virtual Organization Membership Service Clients
@ -75,7 +93,7 @@ Provides:	voms-clients = %{version}-%{release}
 Obsoletes:	voms-clients < 2.0.12-3

 Requires(post):		%{_sbindir}/update-alternatives
-Requires(preun):	%{_sbindir}/update-alternatives
+Requires(postun):	%{_sbindir}/update-alternatives

 %description clients-cpp
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@ -91,8 +109,16 @@ services.
 %package server
 Summary:	Virtual Organization Membership Service Server
 Requires:	%{name}%{?_isa} = %{version}-%{release}
-%{?sysusers_requires_compat}
+
+Requires(pre):		shadow-utils
+%if %{use_systemd}
 %{?systemd_requires}
+%else
+Requires(post):		chkconfig
+Requires(preun):	chkconfig
+Requires(preun):	initscripts
+Requires(postun):	initscripts
+%endif

 %description server
 The Virtual Organization Membership Service (VOMS) is an attribute authority
@ -105,8 +131,14 @@ authorization purposes.
 This package provides the VOMS service.

 %prep
-%setup -q
-%patch 0 -p1 -b .openssl4
+%setup -q -n %{name}-%{version}-rc2
+%patch0 -p1
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1

 ./autogen.sh

@ -122,13 +154,22 @@ install -m 644 -p %{SOURCE1} README.Fedora

 rm %{buildroot}%{_libdir}/*.la

+%if %{use_systemd}
 mkdir -p %{buildroot}%{_unitdir}
 install -m 644 -p systemd/%{name}@.service %{buildroot}%{_unitdir}
 rm %{buildroot}%{_initrddir}/%{name}
 rm %{buildroot}%{_sysconfdir}/sysconfig/%{name}
+%else
+# Turn off default enabling of the service
+sed -e 's/\(chkconfig: \)\w*/\1-/' \
+    -e '/Default-Start/d' \
+    -e 's/\(Default-Stop:\s*\).*/\10 1 2 3 4 5 6/' \
+    -i %{buildroot}%{_initrddir}/%{name}
+%endif

-mkdir -p %{buildroot}%{_sysusersdir}
-install -m 644 -p %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
+mkdir -p %{buildroot}%{_pkgdocdir}
+install -m 644 -p AUTHORS README.md %{buildroot}%{_pkgdocdir}
+%{!?_licensedir: install -m 644 -p LICENSE %{buildroot}%{_pkgdocdir}}

 mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_C_API
 cp -pr doc/apidoc/api/VOMS_C_API/html %{buildroot}%{_pkgdocdir}/VOMS_C_API
@ -138,18 +179,18 @@ mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_CC_API
 cp -pr doc/apidoc/api/VOMS_CC_API/html %{buildroot}%{_pkgdocdir}/VOMS_CC_API
 rm -f %{buildroot}%{_pkgdocdir}/VOMS_CC_API/html/installdox

-mkdir -p %{buildroot}%{_sysconfdir}/alternatives
 for b in voms-proxy-init voms-proxy-info voms-proxy-destroy; do
  ## Rename client binaries
  mv %{buildroot}%{_bindir}/${b} %{buildroot}%{_bindir}/${b}2
-  ln -s %{_bindir}/${b}2 %{buildroot}%{_sysconfdir}/alternatives/${b}
-  ln -s %{_sysconfdir}/alternatives/${b} %{buildroot}%{_bindir}/${b}
+  touch %{buildroot}/%{_bindir}/${b}
+  chmod 755 %{buildroot}/%{_bindir}/${b}
  ## and man pages
  mv %{buildroot}%{_mandir}/man1/${b}.1 %{buildroot}%{_mandir}/man1/${b}2.1
-  ln -s %{_mandir}/man1/${b}2.1.gz %{buildroot}%{_sysconfdir}/alternatives/${b}.1.gz
-  ln -s %{_sysconfdir}/alternatives/${b}.1.gz %{buildroot}%{_mandir}/man1/${b}.1.gz
+  touch %{buildroot}%{_mandir}/man1/${b}.1
 done

+%ldconfig_scriptlets
+
 %posttrans
 # Recover /etc/vomses...
 if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then
@ -157,7 +198,17 @@ if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then
 fi

 %pre server
-%sysusers_create_compat %{SOURCE2}
+getent group %{name} >/dev/null || groupadd -r %{name}
+getent passwd %{name} >/dev/null || useradd -r -g %{name} \
+    -d %{_sysconfdir}/%{name} -s /sbin/nologin -c "VOMS Server Account" %{name}
+
+%if %{use_systemd}
+# Remove old init config when systemd is used
+/sbin/service voms stop >/dev/null 2>&1 || :
+/sbin/chkconfig --del voms >/dev/null 2>&1 || :
+%endif
+
+%if %{use_systemd}

 %post server
 if [ $1 -eq 1 ] ; then
@ -180,6 +231,26 @@ if [ $1 -ge 1 ] ; then
    done
 fi

+%else
+
+%post server
+if [ $1 = 1 ]; then
+    /sbin/chkconfig --add %{name}
+fi
+
+%preun server
+if [ $1 = 0 ]; then
+    /sbin/service %{name} stop >/dev/null 2>&1 || :
+    /sbin/chkconfig --del %{name}
+fi
+
+%postun server
+if [ $1 -ge 1 ]; then
+    /sbin/service %{name} condrestart >/dev/null 2>&1 || :
+fi
+
+%endif
+
 %pre clients-cpp
 if [ $1 -gt 1 ]; then
  for c in voms-proxy-init voms-proxy-info voms-proxy-destroy; do
@ -206,7 +277,7 @@ fi
    --slave %{_mandir}/man1/voms-proxy-destroy.1.gz voms-proxy-destroy-man \
    %{_mandir}/man1/voms-proxy-destroy2.1.gz

-%preun clients-cpp
+%postun clients-cpp
 if [ $1 -eq 0 ] ; then
    %{_sbindir}/update-alternatives --remove voms-proxy-init \
    %{_bindir}/voms-proxy-init2
@ -238,9 +309,11 @@ fi
 %dir %{_sysconfdir}/grid-security/vomsdir
 %dir %{_datadir}/%{name}
 %{_datadir}/%{name}/vomses.template
-%doc AUTHORS
-%doc README.md
-%license LICENSE
+%doc %dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/AUTHORS
+%doc %{_pkgdocdir}/README.md
+%{!?_licensedir: %doc %{_pkgdocdir}/LICENSE}
+%{?_licensedir: %license LICENSE}

 %files devel
 %{_libdir}/libvomsapi.so
@ -250,11 +323,11 @@ fi
 %{_mandir}/man3/*

 %files doc
-%doc %dir %{_pkgdocdir}
+%doc %{_pkgdocdir}/AUTHORS
 %doc %{_pkgdocdir}/VOMS_C_API
 %doc %{_pkgdocdir}/VOMS_CC_API
-%doc AUTHORS
-%license LICENSE
+%{!?_licensedir: %doc %{_pkgdocdir}/LICENSE}
+%{?_licensedir: %license LICENSE}

 %files clients-cpp
 %{_bindir}/voms-proxy-destroy2
@ -266,9 +339,6 @@ fi
 %ghost %{_bindir}/voms-proxy-destroy
 %ghost %{_bindir}/voms-proxy-info
 %ghost %{_bindir}/voms-proxy-init
-%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy
-%ghost %{_sysconfdir}/alternatives/voms-proxy-info
-%ghost %{_sysconfdir}/alternatives/voms-proxy-init
 %{_mandir}/man1/voms-proxy-destroy2.1*
 %{_mandir}/man1/voms-proxy-info2.1*
 %{_mandir}/man1/voms-proxy-init2.1*
@ -277,13 +347,15 @@ fi
 %ghost %{_mandir}/man1/voms-proxy-destroy.1*
 %ghost %{_mandir}/man1/voms-proxy-info.1*
 %ghost %{_mandir}/man1/voms-proxy-init.1*
-%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy.1*
-%ghost %{_sysconfdir}/alternatives/voms-proxy-info.1*
-%ghost %{_sysconfdir}/alternatives/voms-proxy-init.1*

 %files server
 %{_sbindir}/%{name}
+%if %{use_systemd}
 %{_unitdir}/%{name}@.service
+%else
+%{_initrddir}/%{name}
+%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
+%endif
 %attr(-,voms,voms) %dir %{_sysconfdir}/%{name}
 %dir %{_sysconfdir}/grid-security/%{name}
 %attr(-,voms,voms) %dir %{_localstatedir}/log/%{name}
@ -295,91 +367,9 @@ fi
 %{_datadir}/%{name}/voms_replica_master_setup.sh
 %{_datadir}/%{name}/voms_replica_slave_setup.sh
 %{_mandir}/man8/voms.8*
-%{_sysusersdir}/%{name}.conf
 %doc README.Fedora

 %changelog
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Mon Jun 15 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.3-6
- Rebuilt for gsoap 2.8.142
-
-* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.3-5
- Rebuilt for openssl 4.0
-
-* Wed Apr 29 2026 Dmitry Belyavskiy <beldmit@gmail.com> - 2.1.3-4
- Fix build with OpenSSL 4.0 (opaque ASN1_STRING, const X509, removed ERR_STATE)
-
-* Tue Jan 20 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.3-3
- Rebuild for gsoap 2.8.139 (Fedora 44)
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Sat Dec 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.3-1
- Update to version 2.1.3
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Mar 27 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.2-1
- Update to version 2.1.2
- Drop patch accepted upstream
-
-* Sat Mar 08 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-5
- Move user/group creation logic to sysusers.d fragment
-
-* Sun Jan 19 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-4
- Fix compilation with GCC 15
-
-* Thu Oct 31 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-3
- Rebuild for gsoap 2.8.135 (Fedora 42)
- Add additional ghost files to package (rpmlint)
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Fri Jul 05 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-1
- Update to version 2.1.0
- Drop EPEL 7 support from spec file (EOL)
-
-* Tue Jun 18 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.35.rc5
- Update to version 2.1.0-rc5
-
-* Fri May 03 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.34.rc4
- Update to version 2.1.0-rc4
- Drop patches accepted upstream
-
-* Wed Apr 10 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.33.rc3
- Fix problem with newer gsoap versions
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.32.rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Sep 14 2023 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.31.rc3
- More patches from upstream
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.30.rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Thu Feb 09 2023 Florian Weimer <fweimer@redhat.com> - 2.1.0-0.29.rc3
- Port lexer/parser integration to C99 (#2168585)
-
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.28.rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Mon Jan 02 2023 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
- Update to version 2.1.0-rc3
- Drop patches accepted upstream
- Add new patches (the PRs have been accepted upstream)
-
-* Wed Dec 21 2022 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.26.rc2
- Rebuild for gsoap 2.8.124 (Fedora 38)
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.25.rc2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
 * Wed Jun 01 2022 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.24.rc2
 - Backport fixes from upstream