#global prever rcX %global _hardened_build 1 Summary: DNSSEC key and zone management software Name: opendnssec Version: 1.4.0 Release: 1%{?prever}%{?dist} License: BSD Url: http://www.opendnssec.org/ Source0: http://www.opendnssec.org/files/source/%{?prever:testing/}%{name}-%{version}%{?prever}.tar.gz Source1: ods-enforcerd.service Source2: ods-signerd.service Source3: ods.sysconfig Source4: conf.xml Source5: tmpfiles-opendnssec.conf Source6: opendnssec.cron Group: Applications/System Requires: opencryptoki, softhsm, systemd-units BuildRequires: ldns-devel >= 1.6.12, sqlite-devel , openssl-devel BuildRequires: libxml2-devel CUnit-devel, doxygen # It tests for pkill/killall and would use /bin/false if not found BuildRequires: procps-ng Requires(pre): shadow-utils Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units %if 0%{?prever:1} #For building snapshots Buildrequires: autoconf, automake, libtool, java %endif %description OpenDNSSEC was created as an open-source turn-key solution for DNSSEC. It secures zone data just before it is published in an authoritative name server. It requires a PKCS#11 crypto module library, such as softhsm %prep %setup -q -n %{name}-%{version}%{?prever} %build export LDFLAGS="-Wl,-z,relro,-z,now -pie -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" export CFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wextra -Wformat -Wformat-nonliteral -Wformat-security" export CXXFLAGS="$RPM_OPT_FLAGS -fPIE -pie -Wformat-nonliteral -Wformat-security" %configure --with-ldns=%{_libdir} make %{?_smp_mflags} %check # Requires sample db not shipped with upstream # make check %install rm -rf %{buildroot} make DESTDIR=%{buildroot} install mkdir -p %{buildroot}/var/opendnssec/{tmp,signed,signconf} install -d -m 0755 %{buildroot}%{_initrddir} %{buildroot}%{_sysconfdir}/cron.d/ install -m 0644 %{SOURCE6} %{buildroot}/%{_sysconfdir}/cron.d/opendnssec rm -f %{buildroot}/%{_sysconfdir}/opendnssec/*.sample install -d -m 0755 %{buildroot}/%{_sysconfdir}/sysconfig install -d -m 0755 %{buildroot}%{_unitdir} install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/ install -m 0644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/sysconfig/ods install -m 0644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/opendnssec/ mkdir -p %{buildroot}%{_sysconfdir}/tmpfiles.d/ install -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/tmpfiles.d/opendnssec.conf mkdir -p %{buildroot}%{_localstatedir}/run/opendnssec %files %{_unitdir}/ods-enforcerd.service %{_unitdir}/ods-signerd.service %config(noreplace) %{_sysconfdir}/tmpfiles.d/opendnssec.conf %attr(0750,root,ods) %dir %{_sysconfdir}/opendnssec %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/tmp %attr(0775,root,ods) %dir %{_localstatedir}/opendnssec/signed %attr(0770,root,ods) %dir %{_localstatedir}/opendnssec/signconf %attr(0660,root,ods) %config(noreplace) %{_sysconfdir}/opendnssec/*.xml %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/ods %attr(0770,root,ods) %dir %{_localstatedir}/run/opendnssec %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/cron.d/opendnssec %doc NEWS README LICENSE %{_mandir}/*/* %{_sbindir}/* %{_bindir}/* %attr(0755,root,root) %dir %{_datadir}/%{name} %{_datadir}/%{name}/* %pre getent group ods >/dev/null || groupadd -r ods getent passwd ods >/dev/null || \ useradd -r -g ods -d /etc/opendnssec -s /sbin/nologin \ -c "opendnssec daemon account" ods exit 0 %post # in case we update any xml conf file ods-ksmutil update all ||: >/dev/null 2>/dev/null %systemd_post ods-enforcerd.service %systemd_post ods-signerd.service # Initialise a slot on the softhsm on first install if [ "$1" -eq 1 ]; then softhsm --init-token --slot 0 --label "OpenDNSSEC" --pin 1234 --so-pin 1234 fi %preun %systemd_preun ods-enforcerd.service %systemd_preun ods-signerd.service %postun %systemd_postun_with_restart ods-enforcerd.service %systemd_postun_with_restart ods-signerd.service %changelog * Sat May 11 2013 Paul Wouters - 1.4.0-1 - Updated to 1.4.0 * Fri Apr 12 2013 Paul Wouters - 1.4.20-0.8.rc3 - Updated to 1.4.0rc3 - Enabled hardened compile, full relzo/pie * Fri Jan 25 2013 Patrick Uiterwijk - 1.4.0-0.7.rc2 - Updated to 1.4.0rc2, which includes svn r6952 * Fri Jan 18 2013 Patrick Uiterwijk - 1.4.0-0.6.rc1 - Updated to 1.4.0rc1 - Applied opendnssec-ksk-premature-retirement.patch (svn r6952) * Tue Dec 18 2012 Paul Wouters - 1.4.0-0.5.b2 - Updated to 1.4.0b2 - All patches have been merged upstream - cron job should be marked as config file * Tue Oct 30 2012 Paul Wouters - 1.4.0-0.4.b1 - Added BuildRequires: procps-ng for bug OPENDNSSEC-345 - Change RRSIG inception offset to -2h to avoid possible daylight saving issues on resolvers - Patch to prevent removal of occluded data * Wed Sep 26 2012 Paul Wouters - 1.4.0-0.3.b1 - Just an EVR fix to the proper standard - Cleanup of spec file - Introduce new systemd-rpm macros (rhbz#850242) * Wed Sep 12 2012 Paul Wouters - 1.4.0-0.b1.1 - Updated to 1.4.0b1 - Patch for NSEC3PARAM TTL - Cron job to assist narrowing ods-enforcerd timing differences * Wed Aug 29 2012 Paul Wouters - 1.4.0-0.a3.1 - Updated to 1.4.0a3 - Patch to more aggressively try to resign - Patch to fix locking issue eating up cpu * Fri Jul 20 2012 Fedora Release Engineering - 1.4.0-0.a2.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Tue Jun 12 2012 Paul Wouters - 1.4.0-0.a2.1 - Updated to 1.4.0a2 - ksm-utils patch for ods-ksmutil to die sooner when it can't lock the HSM. * Wed May 16 2012 Paul Wouters - 1.4.0-0.a1.3 - Patch for crasher with deleted RRsets and NSEC3/OPTOUT chains * Mon Mar 26 2012 Paul Wouters - 1.4.0-0.a1.2 - Added opendnssec LICENSE file from trunk (Thanks Jakob!) * Mon Mar 26 2012 Paul Wouters - 1.4.0-0.a1.1 - Fix macros in comment - Added missing -m to install target * Sun Mar 25 2012 Paul Wouters - 1.4.0-0.a1 - The 1.4.x branch no longer needs ruby, as the auditor has been removed - Added missing openssl-devel BuildRequire - Comment out so keys generated by ods can be used by bind * Fri Feb 24 2012 Paul Wouters - 1.3.6-3 - Requires rubygem-soap4r when using ruby-1.9 - Don't ghost /var/run/opendnssec - Converted initd to systemd * Thu Nov 24 2011 root - 1.3.2-6 - Added rubygem-dnsruby requires as rpm does not pick it up automatically * Tue Nov 22 2011 root - 1.3.2-5 - Added /var/opendnssec/signconf/ /as this temp dir is needed * Mon Nov 21 2011 Paul Wouters - 1.3.2-4 - Added /var/opendnssec/signed/ as this is the default output dir * Sun Nov 20 2011 Paul Wouters - 1.3.2-3 - Add ods user for opendnssec tasks - Added initscripts and services for ods-signerd and ods-enforcerd - Initialise OpenDNSSEC softhsm token on first install * Wed Oct 05 2011 Paul Wouters - 1.3.2-1 - Updated to 1.3.2 - Added dependancies on opencryptoki and softhsm - Don't install duplicate unreadable .sample files - Fix upstream conf.xml to point to actually used library paths * Thu Mar 3 2011 Paul Wouters - 1.2.0-1 - Initial package for Fedora