fac556
#global prever rcX
53fe96
%global _hardened_build 1
53fe96
14d52d
Summary: DNSSEC key and zone management software
14d52d
Name: opendnssec
14d52d
Version: 1.4.0
fac556
Release: 1%{?prever}%{?dist}
14d52d
License: BSD
14d52d
Url: http://www.opendnssec.org/
4ef923
Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz
14d52d
Source1: ods-enforcerd.service
14d52d
Source2: ods-signerd.service
14d52d
Source3: ods.sysconfig
14d52d
Source4: conf.xml
14d52d
Source5: tmpfiles-opendnssec.conf
Paul Wouters ab9e58
Source6: opendnssec.cron
14d52d
Group: Applications/System
14d52d
Requires: opencryptoki, softhsm, systemd-units
14d52d
BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel
14d52d
BuildRequires: libxml2-devel CUnit-devel, doxygen
79ba89
# It tests for pkill/killall and would use /bin/false if not found
79ba89
BuildRequires: procps-ng
79ba89
14d52d
Requires(pre): shadow-utils
14d52d
Requires(post): systemd-units
14d52d
Requires(preun): systemd-units
14d52d
Requires(postun): systemd-units
4ef923
%if 0%{?prever:1}
e682ae
#For building snapshots
4ef923
Buildrequires: autoconf, automake, libtool, java
4ef923
%endif
14d52d
14d52d
%description
14d52d
OpenDNSSEC was created as an open-source turn-key solution for DNSSEC.
14d52d
It secures zone data just before it is published in an authoritative
14d52d
name server. It requires a PKCS#11 crypto module library, such as softhsm
14d52d
14d52d
%prep
4ef923
%setup -q -n %{name}-%{version}%{?prever}
9b8ffb
14d52d
%build
53fe96
export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"
fac556
export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security"
53fe96
export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security"
14d52d
%configure --with-ldns=%{_libdir}
14d52d
make %{?_smp_mflags}
14d52d
14d52d
%check
14d52d
# Requires sample db not shipped with upstream
14d52d
# make check
14d52d
14d52d
%install
14d52d
rm -rf %{buildroot}
14d52d
make DESTDIR=%{buildroot} install
14d52d
mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf}
Paul Wouters ab9e58
install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/
Paul Wouters 388d61
install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec
14d52d
rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample
14d52d
install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig 
14d52d
install -d -m 0755 %{buildroot}%{_unitdir}
14d52d
install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/
14d52d
install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/
14d52d
install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods
14d52d
install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/
14d52d
mkdir -p %{buildroot}%{_sysconfdir}/tmpfiles.d/
14d52d
install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/tmpfiles.d/opendnssec.conf
14d52d
mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec
14d52d
14d52d
%files 
14d52d
%{_unitdir}/ods-enforcerd.service
14d52d
%{_unitdir}/ods-signerd.service
14d52d
%config(noreplace) %{_sysconfdir}/tmpfiles.d/opendnssec.conf
14d52d
%attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec
14d52d
%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec
14d52d
%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp
4ef923
%attr(0775,root,ods) %dir %{_localstatedir}/opendnssec/signed
14d52d
%attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf
14d52d
%attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml
14d52d
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods
14d52d
%attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec
0dc36c
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/cron.d/opendnssec
f49c13
%doc NEWS README LICENSE
14d52d
%{_mandir}/*/*
14d52d
%{_sbindir}/*
14d52d
%{_bindir}/*
4ef923
%attr(0755,root,root) %dir %{_datadir}/%{name}
4ef923
%{_datadir}/%{name}/*
14d52d
14d52d
%pre
14d52d
getent group ods >/dev/null || groupadd -r ods
14d52d
getent passwd ods >/dev/null || \
14d52d
useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \
14d52d
-c "opendnssec daemon account" ods
14d52d
exit 0
14d52d
14d52d
%post
b55d6a
# in case we update any xml conf file
b55d6a
ods-ksmutil update all ||: >/dev/null 2>/dev/null
4ef923
%systemd_post ods-enforcerd.service
4ef923
%systemd_post ods-signerd.service
4ef923
14d52d
# Initialise a slot on the softhsm on first install
14d52d
if [ "$1" -eq 1 ]; then
14d52d
        softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234
14d52d
fi
14d52d
14d52d
%preun
4ef923
%systemd_preun ods-enforcerd.service
4ef923
%systemd_preun ods-signerd.service
14d52d
14d52d
%postun
4ef923
%systemd_postun_with_restart ods-enforcerd.service
4ef923
%systemd_postun_with_restart ods-signerd.service
14d52d
14d52d
%changelog
fac556
* Sat May 11 2013 Paul Wouters <pwouters@redhat.com> - 1.4.0-1
fac556
- Updated to 1.4.0
fac556
53fe96
* Fri Apr 12 2013 Paul Wouters <pwouters@redhat.com> - 1.4.20-0.8.rc3
53fe96
- Updated to 1.4.0rc3
53fe96
- Enabled hardened compile, full relzo/pie
53fe96
Patrick Uiterwijk af979b
* Fri Jan 25 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.4.0-0.7.rc2
c9c32a
- Updated to 1.4.0rc2, which includes svn r6952
Patrick Uiterwijk af979b
Patrick Uiterwijk ebc1d5
* Fri Jan 18 2013 Patrick Uiterwijk <puiterwijk@gmail.com> - 1.4.0-0.6.rc1
Patrick Uiterwijk ebc1d5
- Updated to 1.4.0rc1
Patrick Uiterwijk ebc1d5
- Applied opendnssec-ksk-premature-retirement.patch (svn r6952)
Patrick Uiterwijk ebc1d5
d55852
* Tue Dec 18 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.5.b2
d55852
- Updated to 1.4.0b2
d55852
- All patches have been merged upstream
0dc36c
- cron job should be marked as config file
d55852
b55d6a
* Tue Oct 30 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.4.b1
79ba89
- Added BuildRequires: procps-ng for bug OPENDNSSEC-345
b55d6a
- Change RRSIG inception offset to -2h to avoid possible
b55d6a
  daylight saving issues on resolvers
b55d6a
- Patch to prevent removal of occluded data
79ba89
4ef923
* Wed Sep 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.3.b1
599e63
- Just an EVR fix to the proper standard
4ef923
- Cleanup of spec file
4ef923
- Introduce new systemd-rpm macros (rhbz#850242)
599e63
Paul Wouters ab9e58
* Wed Sep 12 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.b1.1
Paul Wouters ab9e58
- Updated to 1.4.0b1
Paul Wouters ab9e58
- Patch for NSEC3PARAM TTL
Paul Wouters ab9e58
- Cron job to assist narrowing ods-enforcerd timing differences
Paul Wouters ab9e58
Paul Wouters ab9e58
* Wed Aug 29 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a3.1
Paul Wouters ab9e58
- Updated to 1.4.0a3
Paul Wouters ab9e58
- Patch to more aggressively try to resign
Paul Wouters ab9e58
- Patch to fix locking issue eating up cpu
Paul Wouters ab9e58
c51d9b
* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-0.a2.2
c51d9b
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
c51d9b
9b8ffb
* Tue Jun 12 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a2.1
9b8ffb
- Updated to 1.4.0a2
9b8ffb
- ksm-utils patch for ods-ksmutil to die sooner when it can't lock
9b8ffb
  the HSM.
9b8ffb
5a22ec
* Wed May 16 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.3
5a22ec
- Patch for crasher with deleted RRsets and NSEC3/OPTOUT chains
5a22ec
14d52d
* Mon Mar 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.2
14d52d
- Added opendnssec LICENSE file from trunk (Thanks Jakob!) 
14d52d
14d52d
* Mon Mar 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.1
14d52d
- Fix macros in comment
14d52d
- Added missing -m to install target
14d52d
14d52d
* Sun Mar 25 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1
14d52d
- The 1.4.x branch no longer needs ruby, as the auditor has been removed
14d52d
- Added missing openssl-devel BuildRequire
14d52d
- Comment out <skippublickey/> so keys generated by ods can be used by bind
14d52d
14d52d
* Fri Feb 24 2012 Paul Wouters <pwouters@redhat.com> - 1.3.6-3
14d52d
- Requires rubygem-soap4r when using ruby-1.9
14d52d
- Don't ghost /var/run/opendnssec
14d52d
- Converted initd to systemd
14d52d
14d52d
* Thu Nov 24 2011 root - 1.3.2-6
14d52d
- Added rubygem-dnsruby requires as rpm does not pick it up automatically
14d52d
14d52d
* Tue Nov 22 2011 root - 1.3.2-5
14d52d
- Added /var/opendnssec/signconf/ /as this temp dir is needed
14d52d
14d52d
* Mon Nov 21 2011 Paul Wouters <paul@xelerance.com> - 1.3.2-4
14d52d
- Added /var/opendnssec/signed/ as this is the default output dir
14d52d
14d52d
* Sun Nov 20 2011 Paul Wouters <paul@xelerance.com> - 1.3.2-3
14d52d
- Add ods user for opendnssec tasks
14d52d
- Added initscripts and services for ods-signerd and ods-enforcerd
14d52d
- Initialise OpenDNSSEC softhsm token on first install
14d52d
14d52d
* Wed Oct 05 2011 Paul Wouters <paul@xelerance.com> - 1.3.2-1
14d52d
- Updated to 1.3.2
14d52d
- Added dependancies on opencryptoki and softhsm
14d52d
- Don't install duplicate unreadable .sample files
14d52d
- Fix upstream conf.xml to point to actually used library paths
14d52d
14d52d
* Thu Mar  3 2011 Paul Wouters <paul@xelerance.com> - 1.2.0-1
14d52d
- Initial package for Fedora