Compare commits

..

No commits in common. "rawhide" and "f36" have entirely different histories.

10 changed files with 279 additions and 487 deletions

View file

@ -0,0 +1,25 @@
From a54a62a4e1a4e6bd34284a5de44550979f3155ec Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Mon, 2 Jan 2023 07:46:32 +0100
Subject: [PATCH 1/6] Catch exception by reference
---
src/common/options.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/common/options.cc b/src/common/options.cc
index 027644a..d700950 100644
--- a/src/common/options.cc
+++ b/src/common/options.cc
@@ -198,7 +198,7 @@ getopts(int argc, char * const argv[], struct option *longopts)
try {
opts = new struct option[num+1];
- } catch ( std::bad_alloc) {
+ } catch (std::bad_alloc &e) {
return false;
}
--
2.38.1

View file

@ -0,0 +1,44 @@
From b3cc395eddfc0583bba0e2d302230ebe8770599d Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Mon, 2 Jan 2023 12:51:26 +0100
Subject: [PATCH 2/6] Fix warning about possible use after free
Fix also a warning about an unused variable. This piece of code can probably
go away, but let's just fix the warning for the time being.
---
src/sslutils/sslutils.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c
index 6bac77e..8b0f4c4 100644
--- a/src/sslutils/sslutils.c
+++ b/src/sslutils/sslutils.c
@@ -455,7 +455,7 @@ ERR_load_prxyerr_strings(
#else
char * randfile;
#endif
-#if SSLEAY_VERSION_NUMBER >= 0x0090581fL
+#if SSLEAY_VERSION_NUMBER >= 0x0090581fL && !defined(OPENSSL_NO_EGD)
char * egd_path;
#endif
char buffer[200];
@@ -2703,8 +2703,14 @@ proxy_get_filenames(
}
}
- else
- strcpy(default_user_cert, certname);
+ else {
+ default_user_cert = strndup(certname, strlen(certname));
+
+ if (!default_user_cert) {
+ PRXYerr(PRXYERR_F_INIT_CRED, PRXYERR_R_OUT_OF_MEMORY);
+ goto err;
+ }
+ }
default_user_key = strndup(default_user_cert, strlen(default_user_cert));
--
2.38.1

View file

@ -0,0 +1,27 @@
From 77020a5574bfdbdcdebe03a3ee5d3d3f99563c03 Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Mon, 2 Jan 2023 12:53:26 +0100
Subject: [PATCH 3/6] Fix doxygen warning
About a documented return type for a function that does not return anything.
---
src/api/ccapi/voms_apic.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/src/api/ccapi/voms_apic.h b/src/api/ccapi/voms_apic.h
index 8807803..a3551f4 100644
--- a/src/api/ccapi/voms_apic.h
+++ b/src/api/ccapi/voms_apic.h
@@ -205,8 +205,7 @@ extern struct contactdata **VOMS_FindByVO(struct vomsdata *vd, char *vo,
extern void VOMS_DeleteContacts(struct contactdata **list); /*!< Frees a contactdata vector.
- \param list The vector to free.
- \return NONE */
+ \param list The vector to free.*/
extern struct vomsdata *VOMS_Init(char *voms, char *cert); /*!< Initializes a vomsdata structure for use by the other functions.
N.B: This is the ONLY way to correctly initialize a vomsdata structure. It
--
2.38.1

View file

@ -0,0 +1,29 @@
From bda11dca2561d937f0452d710a0c6755e9b92c6d Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Mon, 2 Jan 2023 13:08:28 +0100
Subject: [PATCH 4/6] Fix warning about possible string truncation
This is a false positive, since the source is an 8-byte hash and
is copied into an 8-byte substring. memcpy is a better fit anyway.
---
src/sslutils/evaluate.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/sslutils/evaluate.c b/src/sslutils/evaluate.c
index 09b8ba4..9c03fdc 100644
--- a/src/sslutils/evaluate.c
+++ b/src/sslutils/evaluate.c
@@ -353,8 +353,8 @@ void PRIVATE read_pathrestriction(STACK_OF(X509) *chain, char *path,
hash = gethash(cert, hashed);
/* Determine file names */
- strncpy(signing + 1, hash, 8);
- strncpy(namespace + 1, hash, 8);
+ memcpy(signing + 1, hash, 8);
+ memcpy(namespace + 1, hash, 8);
file = open_from_dir(path, signing);
if (file) {
--
2.38.1

View file

@ -0,0 +1,26 @@
From 25dfdfc41b9dafdbe3b140d7b9f4ef61c7cd57ac Mon Sep 17 00:00:00 2001
From: Mattias Ellert <mattias.ellert@physics.uu.se>
Date: Mon, 2 Jan 2023 13:41:19 +0100
Subject: [PATCH 5/6] config.h must not be included in public header file
This reverts 5c022c1
---
src/api/ccapi/voms_api.h | 2 --
1 file changed, 2 deletions(-)
diff --git a/src/api/ccapi/voms_api.h b/src/api/ccapi/voms_api.h
index 0cb4e15..7a272cd 100644
--- a/src/api/ccapi/voms_api.h
+++ b/src/api/ccapi/voms_api.h
@@ -26,8 +26,6 @@
#ifndef VOMS_API_H
#define VOMS_API_H
-#include "config.h"
-
#include <fstream>
#include <string>
#include <vector>
--
2.38.1

View file

@ -0,0 +1,30 @@
From b7a926e38db6b883f012c39ebcb10b4ee20912cc Mon Sep 17 00:00:00 2001
From: Francesco Giacomini <francesco.giacomini@cnaf.infn.it>
Date: Mon, 2 Jan 2023 13:42:26 +0100
Subject: [PATCH 6/6] Include config.h before other header files
This is an alternative (and not wrong) solution to commit 5c022c1
to define the macro OPENSSL_COMPAT_API before OpenSSL does it.
---
src/api/ccapi/api_util.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc
index e023cfc..848bfbd 100644
--- a/src/api/ccapi/api_util.cc
+++ b/src/api/ccapi/api_util.cc
@@ -23,10 +23,10 @@
*
*********************************************************************/
+#include "config.h"
#include "api_util.h"
extern "C" {
-#include "config.h"
#include "replace.h"
#include <sys/types.h>
--
2.38.1

View file

@ -1 +1 @@
SHA512 (voms-2.1.3.tar.gz) = c17af601591cd9bdbb678e1db638cd33033cc73b3c5b16e117c8c47e211e5f19e7a105af55095bc2267dc5889c08fba20d340917c61a68b45ba2a76bdffb8f0d
SHA512 (voms-2.1.0-rc3.tar.gz) = 003181764592776359aa67e088f865f9f975b6be2e0f33e3bbee31dbd0e241524b863a8d39163ca549430266fb9250bc948a426ce1baf641381a8b1423a924cd

View file

@ -1,374 +0,0 @@
diff -ruN a/src/ac/validate.cc b/src/ac/validate.cc
--- a/src/ac/validate.cc 2025-12-18 13:39:27.000000000 +0100
+++ b/src/ac/validate.cc 2026-04-29 15:38:19.136425930 +0200
@@ -205,8 +205,8 @@
}
v.version = 1;
- v.siglen = ac->signature->length;
- v.signature = std::string((char*)ac->signature->data, ac->signature->length);
+ v.siglen = ASN1_STRING_length(ac->signature);
+ v.signature = std::string((char*)ASN1_STRING_get0_data(ac->signature), ASN1_STRING_length(ac->signature));
bn = ASN1_INTEGER_to_BN(ac->acinfo->serial, NULL);
char *bnstring = BN_bn2hex(bn);
v.serial = std::string(bnstring);
@@ -294,15 +294,15 @@
if (X509_NAME_cmp(name->d.dirn, X509_get_subject_name(issuer)))
ERROR(AC_ERR_ISSUER_NAME);
- if (ac->acinfo->serial->length>20)
+ if (ASN1_STRING_length(ac->acinfo->serial)>20)
ERROR(AC_ERR_SERIAL);
}
b = ac->acinfo->validity->notBefore;
a = ac->acinfo->validity->notAfter;
- v.date1 = std::string((char*)b->data, b->length);
- v.date2 = std::string((char*)a->data, a->length);
+ v.date1 = std::string((char*)ASN1_STRING_get0_data(b), ASN1_STRING_length(b));
+ v.date2 = std::string((char*)ASN1_STRING_get0_data(a), ASN1_STRING_length(a));
if (valids & VERIFY_DATE) {
time_t ctime, dtime;
@@ -315,8 +315,8 @@
ctime += 300;
dtime = ctime-600;
- if ((a->type != V_ASN1_GENERALIZEDTIME) ||
- (b->type != V_ASN1_GENERALIZEDTIME))
+ if ((ASN1_STRING_type(a) != V_ASN1_GENERALIZEDTIME) ||
+ (ASN1_STRING_type(b) != V_ASN1_GENERALIZEDTIME))
ERROR(AC_ERR_DATES);
if (((X509_cmp_time(b, &vertime) >= 0) &&
@@ -379,7 +379,7 @@
/* put policyAuthority in voms struct */
data = sk_GENERAL_NAME_value(capattr->names, 0);
if (data->type == GEN_URI) {
- v.voname = std::string((char*)data->d.ia5->data, data->d.ia5->length);
+ v.voname = std::string((char*)ASN1_STRING_get0_data(data->d.ia5), ASN1_STRING_length(data->d.ia5));
std::string::size_type point = v.voname.find("://");
if (point != std::string::npos) {
@@ -398,10 +398,10 @@
for (int i=0; i<sk_AC_IETFATTRVAL_num(values); i++) {
capname = sk_AC_IETFATTRVAL_value(values, i);
- if (!(capname->type == V_ASN1_OCTET_STRING))
+ if (!(ASN1_STRING_type(capname) == V_ASN1_OCTET_STRING))
return AC_ERR_ATTRIB_FQAN;
- std::string str = std::string((char*)capname->data, capname->length);
+ std::string str = std::string((char*)ASN1_STRING_get0_data(capname), ASN1_STRING_length(capname));
std::string::size_type top_group_size = top_group.size();
std::string::size_type str_size = str.size();
@@ -556,14 +556,14 @@
if (key->keyid) {
unsigned char hashed[SHA_DIGEST_LENGTH];
- ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss);
- if (!SHA1(pubkey->data,
- pubkey->length,
+ const ASN1_BIT_STRING* pubkey = X509_get0_pubkey_bitstr(iss);
+ if (!SHA1(ASN1_STRING_get0_data(pubkey),
+ ASN1_STRING_length(pubkey),
hashed))
ret = AC_ERR_EXT_KEY;
- if ((memcmp(key->keyid->data, hashed, 20) != 0) &&
- (key->keyid->length == 20))
+ if ((memcmp(ASN1_STRING_get0_data(key->keyid), hashed, 20) != 0) &&
+ (ASN1_STRING_length(key->keyid) == 20))
ret = AC_ERR_EXT_KEY;
}
else {
@@ -574,7 +574,7 @@
(X509_get0_serialNumber(iss))))
ret = AC_ERR_EXT_KEY;
- if (key->serial->type != GEN_DIRNAME)
+ if (ASN1_STRING_type(key->serial) != GEN_DIRNAME)
ret = AC_ERR_EXT_KEY;
if (X509_NAME_cmp(sk_GENERAL_NAME_value((key->issuer), 0)->d.dirn,
@@ -632,15 +632,15 @@
AC_ATTRIBUTE *at = sk_AC_ATTRIBUTE_value(atts, j);
struct attribute a;
- a.name = std::string((char*)at->name->data, at->name->length);
- a.value = std::string((char*)at->value->data, at->value->length);
- a.qualifier = std::string((char*)at->qualifier->data, at->qualifier->length);
+ a.name = std::string((char*)ASN1_STRING_get0_data(at->name), ASN1_STRING_length(at->name));
+ a.value = std::string((char*)ASN1_STRING_get0_data(at->value), ASN1_STRING_length(at->value));
+ a.qualifier = std::string((char*)ASN1_STRING_get0_data(at->qualifier), ASN1_STRING_length(at->qualifier));
al.attributes.push_back(a);
}
gn = sk_GENERAL_NAME_value(holder->grantor, 0);
- al.grantor = std::string((char*)gn->d.ia5->data, gn->d.ia5->length);
+ al.grantor = std::string((char*)ASN1_STRING_get0_data(gn->d.ia5), ASN1_STRING_length(gn->d.ia5));
rd->attributes->push_back(al);
}
diff -ruN a/src/api/ccapi/api_util.cc b/src/api/ccapi/api_util.cc
--- a/src/api/ccapi/api_util.cc 2025-12-18 13:39:27.000000000 +0100
+++ b/src/api/ccapi/api_util.cc 2026-04-29 16:05:24.239940677 +0200
@@ -139,7 +139,7 @@
int index = X509_get_ext_by_NID(cert, nid, -1);
if (index >= 0)
- return X509_get_ext(cert, index);
+ return const_cast<X509_EXTENSION*>(X509_get_ext(cert, index));
else
return NULL;
}
@@ -157,17 +157,17 @@
ext = get_ext(cert, "incfile");
if (ext) {
- ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
+ const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
assert(value && "X509_EXTENSION_get_data failed");
- extra_data = std::string(reinterpret_cast<char*>(value->data), value->length);
+ extra_data = std::string(reinterpret_cast<const char*>(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value));
found = true;
}
ext = get_ext(cert, "vo");
if (ext) {
- ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
+ const ASN1_OCTET_STRING* value = X509_EXTENSION_get_data(ext);
assert(value && "X509_EXTENSION_get_data failed");
- workvo = std::string(reinterpret_cast<char*>(value->data), value->length);
+ workvo = std::string(reinterpret_cast<const char*>(ASN1_STRING_get0_data(value)), ASN1_STRING_length(value));
}
return found;
@@ -423,7 +423,7 @@
return NULL;
}
- std::string voname((const char *)name->d.ia5->data, 0, name->d.ia5->length);
+ std::string voname((const char *)ASN1_STRING_get0_data(name->d.ia5), 0, ASN1_STRING_length(name->d.ia5));
std::string::size_type cpos = voname.find("://");
std::string hostname;
diff -ruN a/src/api/ccapi/voms_api.cc b/src/api/ccapi/voms_api.cc
--- a/src/api/ccapi/voms_api.cc 2025-12-18 13:39:27.000000000 +0100
+++ b/src/api/ccapi/voms_api.cc 2026-04-29 16:05:14.064784528 +0200
@@ -1025,8 +1025,8 @@
AC_TARGET *name = NULL;
name = sk_AC_TARGET_value(target->targets, i);
if (name->name->type == GEN_URI)
- targets.push_back(std::string((char*)(name->name->d.ia5->data),
- name->name->d.ia5->length));
+ targets.push_back(std::string((char*)ASN1_STRING_get0_data(name->name->d.ia5),
+ ASN1_STRING_length(name->name->d.ia5)));
}
}
AC_TARGETS_free(target);
diff -ruN a/src/include/sslutils.h b/src/include/sslutils.h
--- a/src/include/sslutils.h 2025-12-18 13:39:27.000000000 +0100
+++ b/src/include/sslutils.h 2026-04-29 14:45:17.997509299 +0200
@@ -403,8 +403,8 @@
int
proxy_check_issued(
X509_STORE_CTX * ctx,
- X509 * x,
- X509 * issuer);
+ const X509 * x,
+ const X509 * issuer);
int
proxy_verify_certchain(
diff -ruN a/src/sslutils/proxy.c b/src/sslutils/proxy.c
--- a/src/sslutils/proxy.c 2025-12-18 13:39:27.000000000 +0100
+++ b/src/sslutils/proxy.c 2026-04-29 15:21:22.859426069 +0200
@@ -543,8 +543,9 @@
oct = ASN1_OCTET_STRING_new();
assert(oct != NULL && "ASN1_OCTET_STRING_new failed");
- oct->data = der;
- oct->length = len;
+ ASN1_STRING_set0(oct, der, len);
+
+
ex7 = X509_EXTENSION_create_by_NID(NULL, v3nid, 1 /*critical*/, oct);
ASN1_OCTET_STRING_free(oct);
@@ -683,8 +684,7 @@
goto err;
}
- ex_oct->data = (unsigned char*)data;
- ex_oct->length = datalen;
+ ASN1_STRING_set0(ex_oct, (unsigned char*)data, datalen);
if (!(ex = X509_EXTENSION_create_by_OBJ(NULL, ex_obj, crit, ex_oct))) {
PRXYerr(PRXYERR_F_PROXY_SIGN,PRXYERR_R_CLASS_ADD_EXT);
@@ -694,8 +694,7 @@
if (ex_oct) {
/* avoid spurious free of the contents. */
- ex_oct->length = 0;
- ex_oct->data = NULL;
+ ASN1_STRING_set0(ex_oct, NULL, 0);
ASN1_OCTET_STRING_free(ex_oct);
}
@@ -806,10 +805,10 @@
ASN1_BIT_STRING *usage = X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL);
if (usage) {
- if (usage->length > 0)
- keyusage = usage->data[0];
- if (usage->length > 1)
- keyusage |= usage->data[1] << 8;
+ if (ASN1_STRING_length(usage) > 0)
+ keyusage = ASN1_STRING_get0_data(usage)[0];
+ if (ASN1_STRING_length(usage) > 1)
+ keyusage |= ASN1_STRING_get0_data(usage)[1] << 8;
ASN1_BIT_STRING_free(usage);
}
diff -ruN a/src/sslutils/proxycertinfo.c b/src/sslutils/proxycertinfo.c
--- a/src/sslutils/proxycertinfo.c 2025-12-18 13:39:27.000000000 +0100
+++ b/src/sslutils/proxycertinfo.c 2026-04-29 14:44:27.158966391 +0200
@@ -107,9 +107,9 @@
BIO_printf(out, "%*sPolicy Language: ", indent, "");
i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
BIO_puts(out, "\n");
- if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
+ if (pci->proxyPolicy->policy && ASN1_STRING_get0_data(pci->proxyPolicy->policy))
BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
- pci->proxyPolicy->policy->data);
+ ASN1_STRING_get0_data(pci->proxyPolicy->policy));
return 1;
}
@@ -142,11 +142,11 @@
{
if(policy->policy)
{
- (*length) = policy->policy->length;
- if(*length > 0 && policy->policy->data)
+ (*length) = ASN1_STRING_length(policy->policy);
+ if(*length > 0 && ASN1_STRING_get0_data(policy->policy))
{
unsigned char * copy = malloc(*length);
- memcpy(copy, policy->policy->data, *length);
+ memcpy(copy, ASN1_STRING_get0_data(policy->policy), *length);
return copy;
}
}
diff -ruN a/src/sslutils/sslutils.c b/src/sslutils/sslutils.c
--- a/src/sslutils/sslutils.c 2025-12-18 13:39:27.000000000 +0100
+++ b/src/sslutils/sslutils.c 2026-04-29 14:45:33.014031670 +0200
@@ -404,10 +404,12 @@
void PRIVATE
ERR_set_continue_needed(void)
{
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
ERR_STATE *es;
es = ERR_get_state();
es->err_data_flags[es->top] =
es->err_data_flags[es->top] | ERR_DISPLAY_CONTINUE_NEEDED;
+#endif
}
@@ -1669,8 +1671,8 @@
int PRIVATE
proxy_check_issued(UNUSED(X509_STORE_CTX * ctx),
- X509 * x,
- X509 * issuer)
+ const X509 * x,
+ const X509 * issuer)
{
int return_value;
int return_code = 1;
@@ -3268,7 +3270,7 @@
struct tm tm;
int size = 0;
- switch (ctm->type) {
+ switch (ASN1_STRING_type(ctm)) {
case V_ASN1_UTCTIME:
size=10;
break;
@@ -3277,8 +3279,8 @@
break;
}
p = buff1;
- i = ctm->length;
- str = (char *)ctm->data;
+ i = ASN1_STRING_length(ctm);
+ str = (char *)ASN1_STRING_get0_data(ctm);
if ((i < 11) || (i > 17)) {
return 0;
}
@@ -3311,7 +3313,7 @@
tm.tm_isdst = 0;
int index = 0;
- if (ctm->type == V_ASN1_UTCTIME) {
+ if (ASN1_STRING_type(ctm) == V_ASN1_UTCTIME) {
tm.tm_year = (buff1[index++]-'0')*10;
tm.tm_year += (buff1[index++]-'0');
}
diff -ruN a/src/sslutils/voms_cert_type.c b/src/sslutils/voms_cert_type.c
--- a/src/sslutils/voms_cert_type.c 2025-12-18 13:39:27.000000000 +0100
+++ b/src/sslutils/voms_cert_type.c 2026-04-29 15:05:46.737365952 +0200
@@ -256,11 +256,11 @@
ne_data = X509_NAME_ENTRY_get_data(ne);
- if (ne_data->length == 5 && !memcmp(ne_data->data,"proxy",5))
+ if (ASN1_STRING_length(ne_data) == 5 && !memcmp(ASN1_STRING_get0_data(ne_data),"proxy",5))
{
*cert_type = VOMS_CERT_TYPE_GSI_2_PROXY;
}
- else if (ne_data->length == 13 && !memcmp(ne_data->data,"limited proxy",13))
+ else if (ASN1_STRING_length(ne_data) == 13 && !memcmp(ASN1_STRING_get0_data(ne_data),"limited proxy",13))
{
*cert_type = VOMS_CERT_TYPE_GSI_2_LIMITED_PROXY;
}
@@ -293,7 +293,7 @@
ne_data = X509_NAME_ENTRY_get_data(ne);
if ((new_ne = X509_NAME_ENTRY_create_by_NID( NULL, NID_commonName,
- ne_data->type, ne_data->data, -1)) == NULL){
+ ASN1_STRING_type(ne_data), ASN1_STRING_get0_data(ne_data), -1)) == NULL){
result = voms_validation_error(
PRXYERR_R_ERROR_BUILDING_SUBJECT,
diff -ruN a/src/utils/voms_proxy_info.cc b/src/utils/voms_proxy_info.cc
--- a/src/utils/voms_proxy_info.cc 2025-12-18 13:39:27.000000000 +0100
+++ b/src/utils/voms_proxy_info.cc 2026-04-29 16:06:20.035319031 +0200
@@ -466,18 +466,10 @@
static ASN1_TIME *
convtime(std::string data)
{
- ASN1_TIME *t= ASN1_TIME_new();
-
- t->data = (unsigned char*)strdup(data.data());
- t->length = data.size();
- switch(t->length) {
- case 10:
- t->type = V_ASN1_UTCTIME;
- break;
- case 15:
- t->type = V_ASN1_GENERALIZEDTIME;
- break;
- default:
+ ASN1_TIME *t = ASN1_TIME_new();
+ if (!t)
+ return NULL;
+ if (!ASN1_TIME_set_string(t, data.c_str())) {
ASN1_TIME_free(t);
return NULL;
}

View file

@ -1,2 +0,0 @@
# Name ID GECOS Home directory Shell
u voms - "VOMS Server Account" /etc/voms -

207
voms.spec
View file

@ -1,19 +1,32 @@
%global _hardened_build 1
%if %{?fedora}%{!?fedora:0} >= 25 || %{?rhel}%{!?rhel:0} >= 8
%global use_systemd 1
%else
%global use_systemd 0
%endif
Name: voms
Version: 2.1.3
Release: 7%{?dist}
Version: 2.1.0
Release: 0.27.rc3%{?dist}
Summary: Virtual Organization Membership Service
License: Apache-2.0
License: ASL 2.0
URL: https://italiangrid.github.io/voms/
Source0: https://github.com/italiangrid/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
Source0: https://github.com/italiangrid/%{name}/archive/v%{version}-rc3/%{name}-%{version}-rc3.tar.gz
# Post-install setup instructions:
Source1: %{name}.INSTALL
# System user creation config
Source2: %{name}-sysusers.conf
Patch0: voms-openssl4.patch
# https://github.com/italiangrid/voms/pull/105
Patch0: 0001-Catch-exception-by-reference.patch
# https://github.com/italiangrid/voms/pull/106
Patch1: 0002-Fix-warning-about-possible-use-after-free.patch
# https://github.com/italiangrid/voms/pull/107
Patch2: 0003-Fix-doxygen-warning.patch
# https://github.com/italiangrid/voms/pull/108
Patch3: 0004-Fix-warning-about-possible-string-truncation.patch
# https://github.com/italiangrid/voms/pull/104
Patch4: 0005-config.h-must-not-be-included-in-public-header-file.patch
Patch5: 0006-Include-config.h-before-other-header-files.patch
BuildRequires: make
BuildRequires: gcc-c++
@ -25,7 +38,9 @@ BuildRequires: pkgconfig
BuildRequires: libxslt
BuildRequires: docbook-style-xsl
BuildRequires: doxygen
%if %{use_systemd}
BuildRequires: systemd-rpm-macros
%endif
%description
The Virtual Organization Membership Service (VOMS) is an attribute authority
@ -58,15 +73,7 @@ Summary: Virtual Organization Membership Service Documentation
BuildArch: noarch
%description doc
The Virtual Organization Membership Service (VOMS) is an attribute authority
which serves as central repository for VO user authorization information,
providing support for sorting users into group hierarchies, keeping track of
their roles and other attributes in order to issue trusted attribute
certificates and SAML assertions used in the Grid environment for
authorization purposes.
This package provides documentation for the Virtual Organization Membership
Service.
Documentation for the Virtual Organization Membership Service.
%package clients-cpp
Summary: Virtual Organization Membership Service Clients
@ -75,7 +82,7 @@ Provides: voms-clients = %{version}-%{release}
Obsoletes: voms-clients < 2.0.12-3
Requires(post): %{_sbindir}/update-alternatives
Requires(preun): %{_sbindir}/update-alternatives
Requires(postun): %{_sbindir}/update-alternatives
%description clients-cpp
The Virtual Organization Membership Service (VOMS) is an attribute authority
@ -91,8 +98,16 @@ services.
%package server
Summary: Virtual Organization Membership Service Server
Requires: %{name}%{?_isa} = %{version}-%{release}
%{?sysusers_requires_compat}
Requires(pre): shadow-utils
%if %{use_systemd}
%{?systemd_requires}
%else
Requires(post): chkconfig
Requires(preun): chkconfig
Requires(preun): initscripts
Requires(postun): initscripts
%endif
%description server
The Virtual Organization Membership Service (VOMS) is an attribute authority
@ -105,8 +120,13 @@ authorization purposes.
This package provides the VOMS service.
%prep
%setup -q
%patch 0 -p1 -b .openssl4
%setup -q -n %{name}-%{version}-rc3
%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
./autogen.sh
@ -122,13 +142,21 @@ install -m 644 -p %{SOURCE1} README.Fedora
rm %{buildroot}%{_libdir}/*.la
%if %{use_systemd}
mkdir -p %{buildroot}%{_unitdir}
install -m 644 -p systemd/%{name}@.service %{buildroot}%{_unitdir}
rm %{buildroot}%{_initrddir}/%{name}
rm %{buildroot}%{_sysconfdir}/sysconfig/%{name}
%else
# Turn off default enabling of the service
sed -e 's/\(chkconfig: \)\w*/\1-/' \
-e '/Default-Start/d' \
-e 's/\(Default-Stop:\s*\).*/\10 1 2 3 4 5 6/' \
-i %{buildroot}%{_initrddir}/%{name}
%endif
mkdir -p %{buildroot}%{_sysusersdir}
install -m 644 -p %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
mkdir -p %{buildroot}%{_pkgdocdir}
install -m 644 -p AUTHORS README.md %{buildroot}%{_pkgdocdir}
mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_C_API
cp -pr doc/apidoc/api/VOMS_C_API/html %{buildroot}%{_pkgdocdir}/VOMS_C_API
@ -138,18 +166,18 @@ mkdir -p %{buildroot}%{_pkgdocdir}/VOMS_CC_API
cp -pr doc/apidoc/api/VOMS_CC_API/html %{buildroot}%{_pkgdocdir}/VOMS_CC_API
rm -f %{buildroot}%{_pkgdocdir}/VOMS_CC_API/html/installdox
mkdir -p %{buildroot}%{_sysconfdir}/alternatives
for b in voms-proxy-init voms-proxy-info voms-proxy-destroy; do
## Rename client binaries
mv %{buildroot}%{_bindir}/${b} %{buildroot}%{_bindir}/${b}2
ln -s %{_bindir}/${b}2 %{buildroot}%{_sysconfdir}/alternatives/${b}
ln -s %{_sysconfdir}/alternatives/${b} %{buildroot}%{_bindir}/${b}
touch %{buildroot}/%{_bindir}/${b}
chmod 755 %{buildroot}/%{_bindir}/${b}
## and man pages
mv %{buildroot}%{_mandir}/man1/${b}.1 %{buildroot}%{_mandir}/man1/${b}2.1
ln -s %{_mandir}/man1/${b}2.1.gz %{buildroot}%{_sysconfdir}/alternatives/${b}.1.gz
ln -s %{_sysconfdir}/alternatives/${b}.1.gz %{buildroot}%{_mandir}/man1/${b}.1.gz
touch %{buildroot}%{_mandir}/man1/${b}.1
done
%ldconfig_scriptlets
%posttrans
# Recover /etc/vomses...
if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then
@ -157,7 +185,17 @@ if [ -r %{_sysconfdir}/vomses.rpmsave -a ! -r %{_sysconfdir}/vomses ] ; then
fi
%pre server
%sysusers_create_compat %{SOURCE2}
getent group %{name} >/dev/null || groupadd -r %{name}
getent passwd %{name} >/dev/null || useradd -r -g %{name} \
-d %{_sysconfdir}/%{name} -s /sbin/nologin -c "VOMS Server Account" %{name}
%if %{use_systemd}
# Remove old init config when systemd is used
/sbin/service voms stop >/dev/null 2>&1 || :
/sbin/chkconfig --del voms >/dev/null 2>&1 || :
%endif
%if %{use_systemd}
%post server
if [ $1 -eq 1 ] ; then
@ -180,6 +218,26 @@ if [ $1 -ge 1 ] ; then
done
fi
%else
%post server
if [ $1 = 1 ]; then
/sbin/chkconfig --add %{name}
fi
%preun server
if [ $1 = 0 ]; then
/sbin/service %{name} stop >/dev/null 2>&1 || :
/sbin/chkconfig --del %{name}
fi
%postun server
if [ $1 -ge 1 ]; then
/sbin/service %{name} condrestart >/dev/null 2>&1 || :
fi
%endif
%pre clients-cpp
if [ $1 -gt 1 ]; then
for c in voms-proxy-init voms-proxy-info voms-proxy-destroy; do
@ -206,7 +264,7 @@ fi
--slave %{_mandir}/man1/voms-proxy-destroy.1.gz voms-proxy-destroy-man \
%{_mandir}/man1/voms-proxy-destroy2.1.gz
%preun clients-cpp
%postun clients-cpp
if [ $1 -eq 0 ] ; then
%{_sbindir}/update-alternatives --remove voms-proxy-init \
%{_bindir}/voms-proxy-init2
@ -238,8 +296,9 @@ fi
%dir %{_sysconfdir}/grid-security/vomsdir
%dir %{_datadir}/%{name}
%{_datadir}/%{name}/vomses.template
%doc AUTHORS
%doc README.md
%doc %dir %{_pkgdocdir}
%doc %{_pkgdocdir}/AUTHORS
%doc %{_pkgdocdir}/README.md
%license LICENSE
%files devel
@ -251,9 +310,9 @@ fi
%files doc
%doc %dir %{_pkgdocdir}
%doc %{_pkgdocdir}/AUTHORS
%doc %{_pkgdocdir}/VOMS_C_API
%doc %{_pkgdocdir}/VOMS_CC_API
%doc AUTHORS
%license LICENSE
%files clients-cpp
@ -266,9 +325,6 @@ fi
%ghost %{_bindir}/voms-proxy-destroy
%ghost %{_bindir}/voms-proxy-info
%ghost %{_bindir}/voms-proxy-init
%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy
%ghost %{_sysconfdir}/alternatives/voms-proxy-info
%ghost %{_sysconfdir}/alternatives/voms-proxy-init
%{_mandir}/man1/voms-proxy-destroy2.1*
%{_mandir}/man1/voms-proxy-info2.1*
%{_mandir}/man1/voms-proxy-init2.1*
@ -277,13 +333,15 @@ fi
%ghost %{_mandir}/man1/voms-proxy-destroy.1*
%ghost %{_mandir}/man1/voms-proxy-info.1*
%ghost %{_mandir}/man1/voms-proxy-init.1*
%ghost %{_sysconfdir}/alternatives/voms-proxy-destroy.1*
%ghost %{_sysconfdir}/alternatives/voms-proxy-info.1*
%ghost %{_sysconfdir}/alternatives/voms-proxy-init.1*
%files server
%{_sbindir}/%{name}
%if %{use_systemd}
%{_unitdir}/%{name}@.service
%else
%{_initrddir}/%{name}
%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
%endif
%attr(-,voms,voms) %dir %{_sysconfdir}/%{name}
%dir %{_sysconfdir}/grid-security/%{name}
%attr(-,voms,voms) %dir %{_localstatedir}/log/%{name}
@ -295,80 +353,9 @@ fi
%{_datadir}/%{name}/voms_replica_master_setup.sh
%{_datadir}/%{name}/voms_replica_slave_setup.sh
%{_mandir}/man8/voms.8*
%{_sysusersdir}/%{name}.conf
%doc README.Fedora
%changelog
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Mon Jun 15 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.3-6
- Rebuilt for gsoap 2.8.142
* Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.3-5
- Rebuilt for openssl 4.0
* Wed Apr 29 2026 Dmitry Belyavskiy <beldmit@gmail.com> - 2.1.3-4
- Fix build with OpenSSL 4.0 (opaque ASN1_STRING, const X509, removed ERR_STATE)
* Tue Jan 20 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.3-3
- Rebuild for gsoap 2.8.139 (Fedora 44)
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Sat Dec 20 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.3-1
- Update to version 2.1.3
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Thu Mar 27 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.2-1
- Update to version 2.1.2
- Drop patch accepted upstream
* Sat Mar 08 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-5
- Move user/group creation logic to sysusers.d fragment
* Sun Jan 19 2025 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-4
- Fix compilation with GCC 15
* Thu Oct 31 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-3
- Rebuild for gsoap 2.8.135 (Fedora 42)
- Add additional ghost files to package (rpmlint)
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Fri Jul 05 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-1
- Update to version 2.1.0
- Drop EPEL 7 support from spec file (EOL)
* Tue Jun 18 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.35.rc5
- Update to version 2.1.0-rc5
* Fri May 03 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.34.rc4
- Update to version 2.1.0-rc4
- Drop patches accepted upstream
* Wed Apr 10 2024 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.33.rc3
- Fix problem with newer gsoap versions
* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.32.rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Thu Sep 14 2023 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.31.rc3
- More patches from upstream
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.30.rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Thu Feb 09 2023 Florian Weimer <fweimer@redhat.com> - 2.1.0-0.29.rc3
- Port lexer/parser integration to C99 (#2168585)
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.28.rc3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Mon Jan 02 2023 Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
- Update to version 2.1.0-rc3
- Drop patches accepted upstream