|
|
@@ -1,3 +1,5 @@
|
|
|
+%bcond_with systemd
|
|
|
+
|
|
|
%bcond_with test
|
|
|
%if %{with test}
|
|
|
BuildRequires: socket_wrapper
|
|
|
@@ -20,8 +22,14 @@ BuildRequires: socket_wrapper
|
|
|
Summary: The Kerberos network authentication system
|
|
|
Summary(ja): Kerberos ネットワーク認証システム
|
|
|
Name: krb5
|
|
|
-Version: 1.18
|
|
|
-Release: 1%{_dist_release}
|
|
|
+Version: 1.18.3
|
|
|
+Release: 1%{_dist_release}%{?with_systemd:.systemd}
|
|
|
+Group: system
|
|
|
+Vendor: Project Vine
|
|
|
+Distribution: Vine Linux
|
|
|
+
|
|
|
+License: MIT
|
|
|
+URL: http://web.mit.edu/kerberos/www/
|
|
|
|
|
|
# Maybe we should explode from the now-available-to-everybody tarball instead?
|
|
|
# http://web.mit.edu/kerberos/dist/krb5/1.11/krb5-1.11.1-signed.tar
|
|
|
@@ -61,21 +69,43 @@ Patch4: downstream-fix-debuginfo-with-y.tab.c.patch
|
|
|
Patch5: downstream-Remove-3des-support.patch
|
|
|
#Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch
|
|
|
Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
|
|
|
-Patch8: Fix-AS-REQ-checking-of-KDB-modified-indicators.patch
|
|
|
+#Patch8: Fix-AS-REQ-checking-of-KDB-modified-indicators.patch
|
|
|
Patch9: Allow-certauth-modules-to-set-hw-authent-flag.patch
|
|
|
-Patch10: Allow-deletion-of-require_auth-with-LDAP-KDB.patch
|
|
|
+#Patch10: Allow-deletion-of-require_auth-with-LDAP-KDB.patch
|
|
|
Patch11: Refresh-manually-acquired-creds-from-client-keytab.patch
|
|
|
-Patch12: Document-client-keytab-usage.patch
|
|
|
+#Patch12: Document-client-keytab-usage.patch
|
|
|
Patch13: Add-finalization-safety-check-to-com_err.patch
|
|
|
-Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch
|
|
|
+#Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch
|
|
|
Patch15: Correctly-import-service-GSS-host-based-name.patch
|
|
|
Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch
|
|
|
+Patch17: Pass-gss_localname-through-SPNEGO.patch
|
|
|
+Patch18: Omit-KDC-indicator-check-for-S4U2Self-requests.patch
|
|
|
+Patch19: Fix-typo-in-in-in-the-ksu-man-page.patch
|
|
|
+Patch21: Replace-gssrpc-tests-with-a-Python-script.patch
|
|
|
+Patch22: Default-dns_canonicalize_hostname-to-fallback.patch
|
|
|
+Patch23: Remove-resolver-test-utility.patch
|
|
|
+Patch24: Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch
|
|
|
+Patch25: Improve-negoex_parse_token-code-hygiene.patch
|
|
|
+Patch26: Refactor-krb5-GSS-checksum-handling.patch
|
|
|
+Patch27: Implement-GSS_C_CHANNEL_BOUND_FLAG.patch
|
|
|
+Patch28: Implement-KERB_AP_OPTIONS_CBT-server-side.patch
|
|
|
+Patch29: Add-client_aware_channel_bindings-option.patch
|
|
|
+Patch30: Pass-channel-bindings-through-SPNEGO.patch
|
|
|
+Patch31: Add-channel-bindings-tests.patch
|
|
|
+Patch32: Use-two-queues-for-concurrent-t_otp.py-daemons.patch
|
|
|
+Patch34: Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch
|
|
|
+Patch35: Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch
|
|
|
+Patch37: Add-three-kvno-options-from-Heimdal-kgetcred.patch
|
|
|
+Patch39: Improve-KDC-alias-checking-for-S4U-requests.patch
|
|
|
+Patch40: Adjust-KDC-alias-helper-function-contract.patch
|
|
|
+Patch41: Allow-aliases-when-matching-U2U-second-ticket.patch
|
|
|
+Patch42: Refactor-KDC-authdata-list-management-helpers.patch
|
|
|
+Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch
|
|
|
+Patch44: Minimize-usage-of-tgs_server-in-KDC.patch
|
|
|
+Patch45: Fix-minor-static-analysis-defects.patch
|
|
|
|
|
|
# Vine patch(es)
|
|
|
|
|
|
-License: MIT
|
|
|
-URL: http://web.mit.edu/kerberos/www/
|
|
|
-Group: System Environment/Libraries
|
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-root
|
|
|
|
|
|
BuildRequires: autoconf, bison, flex, gawk
|
|
|
@@ -83,7 +113,7 @@ BuildRequires: autoconf, bison, flex, gawk
|
|
|
BuildRequires: e2fsprogs-devel
|
|
|
# BuildRequires: gzip, ncurses-devel, rsh, texinfo, texinfo-tex, tar
|
|
|
BuildRequires: gzip, ncurses-devel, texinfo, tar, git
|
|
|
-BuildRequires: python-sphinx
|
|
|
+BuildRequires: python3-sphinx
|
|
|
# BuildRequires: texlive
|
|
|
# BuildRequires: texlive-latexrecommended
|
|
|
# BuildRequires: texlive-fontsrecommended
|
|
|
@@ -106,17 +136,15 @@ BuildRequires: openssl-devel >= 1.0.0
|
|
|
BuildRequires: libverto-devel
|
|
|
%endif
|
|
|
|
|
|
-Vendor: Project Vine
|
|
|
-Distribution: Vine Linux
|
|
|
-
|
|
|
%description
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
|
|
which can improve your network's security by eliminating the insecure
|
|
|
practice of cleartext passwords.
|
|
|
|
|
|
+
|
|
|
%package devel
|
|
|
Summary: Development files needed to compile Kerberos 5 programs
|
|
|
-Group: Development/Libraries
|
|
|
+Group: programming
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
# Requires: keyutils-libs-devel, libselinux-devel
|
|
|
Requires: keyutils-libs-devel
|
|
|
@@ -131,17 +159,19 @@ contains the header files and libraries needed for compiling Kerberos
|
|
|
5 programs. If you want to develop Kerberos-aware programs, you need
|
|
|
to install this package.
|
|
|
|
|
|
+
|
|
|
%package libs
|
|
|
Summary: The shared libraries used by Kerberos 5
|
|
|
-Group: System Environment/Libraries
|
|
|
+Group: system
|
|
|
|
|
|
%description libs
|
|
|
Kerberos is a network authentication system. The krb5-libs package
|
|
|
contains the shared libraries needed by Kerberos 5. If you are using
|
|
|
Kerberos, you need to install this package.
|
|
|
|
|
|
+
|
|
|
%package server
|
|
|
-Group: System Environment/Daemons
|
|
|
+Group: servers
|
|
|
Summary: The KDC and related programs for Kerberos 5
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
%if %{WITH_SYSVERTO}
|
|
|
@@ -172,8 +202,9 @@ distribution center (KDC). If you are installing a Kerberos 5 KDC,
|
|
|
you need to install this package (in other words, most people should
|
|
|
NOT install this package).
|
|
|
|
|
|
+
|
|
|
%package server-ldap
|
|
|
-Group: System Environment/Daemons
|
|
|
+Group: servers
|
|
|
Summary: The LDAP storage plugin for the Kerberos 5 KDC
|
|
|
Requires: %{name}-server = %{version}-%{release}
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
@@ -185,9 +216,10 @@ distribution center (KDC). If you are installing a Kerberos 5 KDC,
|
|
|
and you wish to use a directory server to store the data for your
|
|
|
realm, you need to install this package.
|
|
|
|
|
|
+
|
|
|
%package workstation
|
|
|
Summary: Kerberos 5 programs for use on workstations
|
|
|
-Group: System Environment/Base
|
|
|
+Group: system
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
Requires(post): /sbin/install-info
|
|
|
Requires(preun): /sbin/install-info
|
|
|
@@ -202,9 +234,10 @@ package contains the basic Kerberos programs (kinit, klist, kdestroy,
|
|
|
kpasswd). If your network uses Kerberos, this package should be
|
|
|
installed on every workstation.
|
|
|
|
|
|
+
|
|
|
%package pkinit-openssl
|
|
|
Summary: The PKINIT module for Kerberos 5
|
|
|
-Group: System Environment/Libraries
|
|
|
+Group: system
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
|
|
|
%description pkinit-openssl
|
|
|
@@ -213,11 +246,12 @@ package contains the PKINIT plugin, which uses OpenSSL to allow clients
|
|
|
to obtain initial credentials from a KDC using a private key and a
|
|
|
certificate.
|
|
|
|
|
|
+
|
|
|
# compat32
|
|
|
%package -n compat32-%{name}-devel
|
|
|
Summary: Development files needed to compile Kerberos 5 programs.
|
|
|
Summary(ja): Kerberos 5 プログラムをコンパイルするために必要な開発ファイル
|
|
|
-Group: Development/Libraries
|
|
|
+Group: programming
|
|
|
Requires: compat32-%{name}-libs = %{version}-%{release}
|
|
|
Requires: %{name}-devel = %{version}-%{release}
|
|
|
Requires: compat32-e2fsprogs-devel
|
|
|
@@ -228,10 +262,11 @@ contains the header files and libraries needed for compiling Kerberos
|
|
|
5 programs. If you want to develop Kerberos-aware programs, you need
|
|
|
to install this package.
|
|
|
|
|
|
+
|
|
|
%package -n compat32-%{name}-libs
|
|
|
Summary: The shared libraries used by Kerberos 5.
|
|
|
Summary(ja): Kerberos 5 の共有ライブラリ
|
|
|
-Group: System Environment/Libraries
|
|
|
+Group: system
|
|
|
Requires(pre): /sbin/ldconfig
|
|
|
Requires: %{name}-libs = %{version}-%{release}
|
|
|
|
|
|
@@ -240,10 +275,11 @@ Kerberos is a network authentication system. The krb5-libs package
|
|
|
contains the shared libraries needed by Kerberos 5. If you are using
|
|
|
Kerberos, you need to install this package.
|
|
|
|
|
|
+
|
|
|
%package -n compat32-%{name}-pkinit-openssl
|
|
|
Summary: The PKINIT module for Kerberos 5.
|
|
|
Summary(ja): Kerberos 5 の PKINIT モジュール
|
|
|
-Group: System Environment/Libraries
|
|
|
+Group: system
|
|
|
Requires: compat32-%{name}-libs = %{version}-%{release}
|
|
|
Requires: %{name}-pkinit-openssl = %{version}-%{release}
|
|
|
|
|
|
@@ -255,6 +291,10 @@ certificate.
|
|
|
|
|
|
# end of compat32 package
|
|
|
|
|
|
+
|
|
|
+%debug_package
|
|
|
+
|
|
|
+
|
|
|
%prep
|
|
|
%autosetup -S git -n %{name}-%{version}
|
|
|
|
|
|
@@ -297,6 +337,7 @@ PORT=`expr 7777 + $LONG_BIT - 48`
|
|
|
sed -i -e s,7777,`expr "$PORT" + 0`,g $cfg
|
|
|
sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg
|
|
|
|
|
|
+
|
|
|
%build
|
|
|
source %{_libdir}/tclConfig.sh
|
|
|
pushd src
|
|
|
@@ -380,10 +421,10 @@ fi
|
|
|
cd src/man
|
|
|
make -f Makefile.in top_srcdir=.. srcdir=. man
|
|
|
|
|
|
-
|
|
|
# We need to cut off any access to locally-running nameservers, too.
|
|
|
%{__cc} -fPIC -shared -o noport.so -Wall -Wextra $RPM_SOURCE_DIR/noport.c
|
|
|
|
|
|
+
|
|
|
%check
|
|
|
%if %{with test}
|
|
|
mkdir nss_wrapper
|
|
|
@@ -408,6 +449,7 @@ make -C src/clients check TMPDIR=%{_tmppath}
|
|
|
keyctl session - make -C src/util check TMPDIR=%{_tmppath}
|
|
|
%endif
|
|
|
|
|
|
+
|
|
|
%install
|
|
|
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
|
|
|
|
|
|
@@ -574,15 +616,15 @@ rm -f -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so"
|
|
|
|
|
|
%find_lang %{gettext_domain}
|
|
|
|
|
|
+
|
|
|
%clean
|
|
|
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
|
|
|
|
|
|
-%post libs -p /sbin/ldconfig
|
|
|
|
|
|
+%post libs -p /sbin/ldconfig
|
|
|
%postun libs -p /sbin/ldconfig
|
|
|
|
|
|
%post server-ldap -p /sbin/ldconfig
|
|
|
-
|
|
|
%postun server-ldap -p /sbin/ldconfig
|
|
|
|
|
|
%post server
|
|
|
@@ -646,9 +688,9 @@ fi
|
|
|
exit 0
|
|
|
|
|
|
%post -n compat32-%{name}-libs -p /sbin/ldconfig
|
|
|
-
|
|
|
%postun -n compat32-%{name}-libs -p /sbin/ldconfig
|
|
|
|
|
|
+
|
|
|
%files workstation
|
|
|
%defattr(-,root,root,-)
|
|
|
%doc src/config-files/services.append
|
|
|
@@ -691,6 +733,7 @@ exit 0
|
|
|
%{_unitdir}/krb5kdc.service
|
|
|
%{_unitdir}/kadmin.service
|
|
|
%{_unitdir}/kprop.service
|
|
|
+%{_tmpfilesdir}/krb5-krb5kdc.conf
|
|
|
%else
|
|
|
/etc/rc.d/init.d/krb5kdc
|
|
|
/etc/rc.d/init.d/kadmin
|
|
|
@@ -891,7 +934,13 @@ exit 0
|
|
|
|
|
|
%endif
|
|
|
|
|
|
+
|
|
|
%changelog
|
|
|
+* Thu Nov 26 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.18.3-1
|
|
|
+- updated to 1.18.3.
|
|
|
+- dropped all patches.
|
|
|
+- imported patches from rawhide.
|
|
|
+
|
|
|
* Wed Apr 08 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.18-1
|
|
|
- updated to 1.18.
|
|
|
- added systemd support (disabled as default).
|
tomop