pool/dehydrated
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7743484cd7
dehydrated/dehydrated.changes

541 lines
20 KiB
Plaintext
Raw Normal View History

- Target should not PartOf on itself. OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=78
2022-07-08 13:40:34 +02:00
-------------------------------------------------------------------
Fri Jul 8 11:38:36 UTC 2022 - Marcus Rueckert <mrueckert@suse.de>
- Target should not PartOf on itself.
Accepting request 987889 from home:darix:branches:security:dehydrated - Copy the changes entry into README.postrun-hooks to make it easier for users to find the information how to restore the postrun-hooks after the split. OBS-URL: https://build.opensuse.org/request/show/987889 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=77
2022-07-08 13:28:23 +02:00
-------------------------------------------------------------------
Fri Jul 8 11:24:13 UTC 2022 - Marcus Rueckert <mrueckert@suse.de>
- Copy the changes entry into README.postrun-hooks to make it
easier for users to find the information how to restore the
postrun-hooks after the split.
Accepting request 882188 from home:darix:playground - Enable instantiated services (boo#1184165) - Prepare instantiated service/timer support but not enable it: This seems to fail due to missing systemd support right now. So the only option at the moment is to copy the timer and unit file for a 2nd instance. Mark all files as part of dehydrated.target - Rework support for /etc/dehydrated/postrun-hooks.d/: dehydrated.service nolonger starts them directly, the support was moved to a separate unit file. Please run: systemctl enable dehydrated-postrun-hooks.service to restore this functionality - Run dehydrated as dehydrated user again OBS-URL: https://build.opensuse.org/request/show/882188 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=74
2021-03-30 16:53:39 +02:00
-------------------------------------------------------------------
Tue Mar 30 14:20:42 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- Enable instantiated services (boo#1184165)
-------------------------------------------------------------------
Mon Mar 29 16:18:57 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- Prepare instantiated service/timer support but not enable it:
This seems to fail due to missing systemd support right now.
So the only option at the moment is to copy the timer and unit
file for a 2nd instance. Mark all files as part of dehydrated.target
-------------------------------------------------------------------
Mon Mar 29 16:18:27 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- Rework support for /etc/dehydrated/postrun-hooks.d/:
dehydrated.service nolonger starts them directly, the support was
moved to a separate unit file. Please run:
systemctl enable dehydrated-postrun-hooks.service
to restore this functionality
- Run dehydrated as dehydrated user again
Accepting request 882014 from home:darix:playground - Do not use the full path for config.d in the config files, which will simplify implementing multi instance support. - Added more-examples.patch: Explain how we can have per certificate key algorithms OBS-URL: https://build.opensuse.org/request/show/882014 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=73
2021-03-29 18:26:11 +02:00
-------------------------------------------------------------------
Mon Mar 29 16:08:09 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- Do not use the full path for config.d in the config files, which
will simplify implementing multi instance support.
-------------------------------------------------------------------
Mon Mar 29 16:07:44 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- Added more-examples.patch:
Explain how we can have per certificate key algorithms
Accepting request 879078 from home:oreinert:branches:security:dehydrated Add directory where cleanup can archive unused certificates OBS-URL: https://build.opensuse.org/request/show/879078 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=72
2021-03-29 16:02:51 +02:00
-------------------------------------------------------------------
Sun Mar 14 22:29:06 UTC 2021 - Olav Reinert <seroton10@gmail.com>
- Add directory where cleanup can archive unused certificates
- Update to dehydrated 0.7.0 Added Support for external account bindings Special support for ZeroSSL Support presets for some CAs instead of requiring URLs Allow requesting preferred chain (--preferred-chain) Added method to show CAs current terms of service (--display-terms) Allow setting path to domains.txt using cli arguments (--domains-txt) Added new cli command --cleanupdelete which deletes old files instead of archiving them Fixed No more silent failures on broken hook-scripts Better error-handling with KEEP_GOING enabled Check actual order status instead of assuming it's valid Don't include keyAuthorization in challenge validation (RFC compliance) Changed Using EC secp384r1 as default certificate type Use JSON.sh to parse JSON Use account URL instead of account ID (RFC compliance) Dehydrated now has a new home: https://github.com/dehydrated-io/dehydrated Added OCSP_FETCH and OCSP_DAYS to per-certificate configurable options Cleanup now also removes dangling symlinks OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=66
2020-12-10 17:05:04 +01:00
-------------------------------------------------------------------
- Clarified new default settings. KEY_ALGO=secp384r1. Please consult README.maintainer for details and how to return to RSA-based certificate issuance. (jsc#ECO-3435, jsc#SLE-15909) - Added a note about ACMEv1 deprecation - Added a note on new ACME providers and the new non-URL provider syntax See README.maintainer for details. OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=69
2021-03-03 18:15:11 +01:00
Wed Mar 3 15:42:18 UTC 2021 - Daniel Molkentin <daniel.molkentin@suse.com>
- Clarified new default settings. KEY_ALGO=secp384r1. Please consult
README.maintainer for details and how to return to RSA-based certificate
issuance. (jsc#ECO-3435, jsc#SLE-15909)
- Added a note about ACMEv1 deprecation
- Added a note on new ACME providers and the new non-URL provider syntax
See README.maintainer for details.
-------------------------------------------------------------------
- Update to dehydrated 0.7.0 Added Support for external account bindings Special support for ZeroSSL Support presets for some CAs instead of requiring URLs Allow requesting preferred chain (--preferred-chain) Added method to show CAs current terms of service (--display-terms) Allow setting path to domains.txt using cli arguments (--domains-txt) Added new cli command --cleanupdelete which deletes old files instead of archiving them Fixed No more silent failures on broken hook-scripts Better error-handling with KEEP_GOING enabled Check actual order status instead of assuming it's valid Don't include keyAuthorization in challenge validation (RFC compliance) Changed Using EC secp384r1 as default certificate type Use JSON.sh to parse JSON Use account URL instead of account ID (RFC compliance) Dehydrated now has a new home: https://github.com/dehydrated-io/dehydrated Added OCSP_FETCH and OCSP_DAYS to per-certificate configurable options Cleanup now also removes dangling symlinks OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=66
2020-12-10 17:05:04 +01:00
Thu Dec 10 16:01:01 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- Update to dehydrated 0.7.0 (JSC#SLE-15909) OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=67
2020-12-10 17:32:35 +01:00
- Update to dehydrated 0.7.0 (JSC#SLE-15909)
- Update to dehydrated 0.7.0 Added Support for external account bindings Special support for ZeroSSL Support presets for some CAs instead of requiring URLs Allow requesting preferred chain (--preferred-chain) Added method to show CAs current terms of service (--display-terms) Allow setting path to domains.txt using cli arguments (--domains-txt) Added new cli command --cleanupdelete which deletes old files instead of archiving them Fixed No more silent failures on broken hook-scripts Better error-handling with KEEP_GOING enabled Check actual order status instead of assuming it's valid Don't include keyAuthorization in challenge validation (RFC compliance) Changed Using EC secp384r1 as default certificate type Use JSON.sh to parse JSON Use account URL instead of account ID (RFC compliance) Dehydrated now has a new home: https://github.com/dehydrated-io/dehydrated Added OCSP_FETCH and OCSP_DAYS to per-certificate configurable options Cleanup now also removes dangling symlinks OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=66
2020-12-10 17:05:04 +01:00
Added
Support for external account bindings
Special support for ZeroSSL
Support presets for some CAs instead of requiring URLs
Allow requesting preferred chain (--preferred-chain)
Added method to show CAs current terms of service (--display-terms)
Allow setting path to domains.txt using cli arguments (--domains-txt)
Added new cli command --cleanupdelete which deletes old files instead of archiving them
Fixed
No more silent failures on broken hook-scripts
Better error-handling with KEEP_GOING enabled
Check actual order status instead of assuming it's valid
Don't include keyAuthorization in challenge validation (RFC compliance)
Changed
Using EC secp384r1 as default certificate type
Use JSON.sh to parse JSON
Use account URL instead of account ID (RFC compliance)
Dehydrated now has a new home: https://github.com/dehydrated-io/dehydrated
Added OCSP_FETCH and OCSP_DAYS to per-certificate configurable options
Cleanup now also removes dangling symlinks
- dehydrated-apache2: Check for mod_compat (bsc#1178927) OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=64
2020-11-19 12:29:46 +01:00
-------------------------------------------------------------------
Thu Nov 19 11:20:18 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- dehydrated-apache2: Check for mod_compat (bsc#1178927)
- Reenable nginx subpackage for factory OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=62
2020-09-14 15:43:34 +02:00
-------------------------------------------------------------------
Mon Sep 14 13:42:19 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- Reenable nginx subpackage for factory
- Update maintainer file and package description, remove features that are better described in the (maintained) man page. OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=60
2020-06-29 14:45:22 +02:00
-------------------------------------------------------------------
Mon Jun 29 12:41:48 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- Update maintainer file and package description, remove features
that are better described in the (upstream maintained) man page.
- Remove potentially harmful scriptlet (bsc#1154167). Documented transition case in the maintainer README. Unlikely enough. The versions that have not transitioned yet would be broken for more than two years now. OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=59
2020-06-29 14:40:34 +02:00
-------------------------------------------------------------------
Mon Jun 29 12:38:31 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- Remove potentially harmful scriptlet (bsc#1154167). Documented
transition case in the maintainer README. Unlikely enough. The
versions that have not transitioned yet would be broken for more
than two years now.
- Removed lighttpd 1.x integration package. If you still would like to use lighttpd with dehydrated, follow the instructions in the README.maintainers file. OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=57
2020-05-06 17:00:46 +02:00
-------------------------------------------------------------------
Wed May 6 12:34:56 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- Removed lighttpd 1.x integration package. If you still would like
to use lighttpd with dehydrated, follow the instructions in the
README.maintainers file.
- Fix lighttpd config file (boo#1169834) - Provide nginx subpackage for SLE 15+ (jsc#11756) OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=53
2020-04-20 12:44:17 +02:00
-------------------------------------------------------------------
Mon Apr 20 00:37:26 UTC 2020 - Daniel Molkentin <daniel.molkentin@suse.com>
- Fix lighttpd config file (boo#1169834)
- Provide nginx subpackage for SLE 15+ (jsc#SLE-11727) OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=55
2020-04-23 13:16:38 +02:00
- Provide nginx subpackage for SLE 15+ (jsc#SLE-11727)
- Fix lighttpd config file (boo#1169834) - Provide nginx subpackage for SLE 15+ (jsc#11756) OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=53
2020-04-20 12:44:17 +02:00
Accepting request 740571 from home:RBrownSUSE:branches:security:dehydrated Remove obsolete Groups tag (fate#326485) OBS-URL: https://build.opensuse.org/request/show/740571 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=50
2019-10-17 19:28:18 +02:00
-------------------------------------------------------------------
Accepting request 769563 from home:dimstar:Factory Shortcut through -mini OBS-URL: https://build.opensuse.org/request/show/769563 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=51
2020-02-03 17:29:03 +01:00
Mon Feb 3 12:25:00 UTC 2020 - Dominique Leuenberger <dimstar@opensuse.org>
- Drop systemd BuildRequires: pkgconfig(systemd) is already in
place and is synonymous.
-------------------------------------------------------------------
Accepting request 740571 from home:RBrownSUSE:branches:security:dehydrated Remove obsolete Groups tag (fate#326485) OBS-URL: https://build.opensuse.org/request/show/740571 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=50
2019-10-17 19:28:18 +02:00
Thu Oct 17 17:23:53 UTC 2019 - Richard Brown <rbrown@suse.com>
- Remove obsolete Groups tag (fate#326485)
- Behavioral change: Use cron only for older RHEL/CentOS versions (along with openSUSE < 12.3). Everything else now uses systemd. Please adopt accordingly! Refer to README.md for OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=43
2019-08-10 19:30:39 +02:00
-------------------------------------------------------------------
Sat Aug 10 17:18:25 UTC 2019 - Daniel Molkentin <daniel.molkentin@suse.com>
- Behavioral change: Use cron only for older RHEL/CentOS versions
Fix version conditions OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=44
2019-08-10 19:43:44 +02:00
(along with SLE < 12.0). Everything else now uses systemd.
- Behavioral change: Use cron only for older RHEL/CentOS versions (along with openSUSE < 12.3). Everything else now uses systemd. Please adopt accordingly! Refer to README.md for OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=43
2019-08-10 19:30:39 +02:00
Please adopt accordingly! Refer to README.md for
Accepting request 712111 from home:dmolkentin:branches:security:dehydrated - Update to dehydrated 0.6.5 * Fixed broken APIv1 compatibility from last update OBS-URL: https://build.opensuse.org/request/show/712111 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=41
2019-06-26 13:06:19 +02:00
-------------------------------------------------------------------
Wed Jun 26 11:03:27 UTC 2019 - Daniel Molkentin <daniel.molkentin@suse.com>
- Update to dehydrated 0.6.5
* Fixed broken APIv1 compatibility from last update
Accepting request 711919 from home:dmolkentin:branches:security:dehydrated - Update to dehydrated 0.6.4 * Fetch account ID from Location header instead of account json - Update to dehydrated 0.6.3 * OCSP refresh interval is now configurable * Implemented POST-as-GET * Call exit_hook on errors (with error-message as first parameter) * Initial support for tls-alpn-01 validation * New hook: sync_cert (for syncing certificate files to disk, see example hook description) * Fetch account information after registration to avoid missing account id OBS-URL: https://build.opensuse.org/request/show/711919 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=38
2019-06-25 19:34:27 +02:00
-------------------------------------------------------------------
Tue Jun 25 17:29:10 UTC 2019 - Daniel Molkentin <daniel.molkentin@suse.com>
- Update to dehydrated 0.6.4
Accepting request 712102 from home:dmolkentin:branches:security:dehydrated * Fetch account ID from Location header instead of account json (bsc#1139408) OBS-URL: https://build.opensuse.org/request/show/712102 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=40
2019-06-26 11:46:46 +02:00
* Fetch account ID from Location header instead of account json (bsc#1139408)
Accepting request 711919 from home:dmolkentin:branches:security:dehydrated - Update to dehydrated 0.6.4 * Fetch account ID from Location header instead of account json - Update to dehydrated 0.6.3 * OCSP refresh interval is now configurable * Implemented POST-as-GET * Call exit_hook on errors (with error-message as first parameter) * Initial support for tls-alpn-01 validation * New hook: sync_cert (for syncing certificate files to disk, see example hook description) * Fetch account information after registration to avoid missing account id OBS-URL: https://build.opensuse.org/request/show/711919 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=38
2019-06-25 19:34:27 +02:00
- Update to dehydrated 0.6.3
* OCSP refresh interval is now configurable
* Implemented POST-as-GET
* Call exit_hook on errors (with error-message as first parameter)
* Initial support for tls-alpn-01 validation
* New hook: sync_cert (for syncing certificate files to disk, see example
hook description)
* Fetch account information after registration to avoid missing account id
Accepting request 667787 from home:dmolkentin:branches:security:dehydrated - Remove RandomizedDelaySec attribute for distros with older systemd (boo#1110697) OBS-URL: https://build.opensuse.org/request/show/667787 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=36
2019-01-22 13:52:01 +01:00
-------------------------------------------------------------------
Tue Jan 22 11:52:00 UTC 2019 - Daniel Molkentin <daniel.molkentin@suse.com>
- Remove RandomizedDelaySec attribute for distros with older systemd
(boo#1110697)
Accepting request 601877 from home:dmolkentin:branches:security:dehydrated - Update to dehydrated 0.6.2 Added * New deploy_ocsp hook * Allow account registration with custom key Changed * Don't walk certificate chain for ACMEv2 (certificate contains chain by default) * Improved documentation on wildcards Fixes * Added workaround for compatibility with filesystem ACLs * Close unwanted external file-descriptors * Fixed JSON parsing on force-renewal (bsc#1091216) * Fixed cleanup of challenge files/dns-entries on validation errors * A few more minor fixes OBS-URL: https://build.opensuse.org/request/show/601877 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=33
2018-04-27 13:50:28 +02:00
-------------------------------------------------------------------
Fri Apr 27 11:14:45 UTC 2018 - daniel.molkentin@suse.com
- Update to dehydrated 0.6.2
Accepting request 601881 from home:dmolkentin:branches:security:dehydrated * removes 0001-fixed-CA-url-in-example-config.patch * removes 0002-don-t-walk-certificate-chain-for-ACMEv2-certificate-.patch OBS-URL: https://build.opensuse.org/request/show/601881 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=34
2018-04-27 13:56:07 +02:00
* removes 0001-fixed-CA-url-in-example-config.patch
* removes 0002-don-t-walk-certificate-chain-for-ACMEv2-certificate-.patch
Accepting request 601877 from home:dmolkentin:branches:security:dehydrated - Update to dehydrated 0.6.2 Added * New deploy_ocsp hook * Allow account registration with custom key Changed * Don't walk certificate chain for ACMEv2 (certificate contains chain by default) * Improved documentation on wildcards Fixes * Added workaround for compatibility with filesystem ACLs * Close unwanted external file-descriptors * Fixed JSON parsing on force-renewal (bsc#1091216) * Fixed cleanup of challenge files/dns-entries on validation errors * A few more minor fixes OBS-URL: https://build.opensuse.org/request/show/601877 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=33
2018-04-27 13:50:28 +02:00
Added
* New deploy_ocsp hook
* Allow account registration with custom key
Changed
* Don't walk certificate chain for ACMEv2 (certificate contains chain by default)
* Improved documentation on wildcards
Fixes
* Added workaround for compatibility with filesystem ACLs
* Close unwanted external file-descriptors
* Fixed JSON parsing on force-renewal (bsc#1091216)
* Fixed cleanup of challenge files/dns-entries on validation errors
* A few more minor fixes
Accepting request 587474 from home:dmolkentin:branches:security:dehydrated - Don't add intermediate certificates twice when using ACMEv2 (bsc#1085305) * Adds 0002-don-t-walk-certificate-chain-for-ACMEv2-certificate-.patch OBS-URL: https://build.opensuse.org/request/show/587474 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=31
2018-03-15 12:01:55 +01:00
-------------------------------------------------------------------
Thu Mar 15 10:52:56 UTC 2018 - daniel.molkentin@suse.com
- Don't add intermediate certificates twice when using ACMEv2 (bsc#1085305)
* Adds 0002-don-t-walk-certificate-chain-for-ACMEv2-certificate-.patch
Accepting request 587013 from home:dmolkentin:branches:security:dehydrated - Properly install man page again (bsc#1085305) OBS-URL: https://build.opensuse.org/request/show/587013 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=29
2018-03-14 17:53:11 +01:00
-------------------------------------------------------------------
Wed Mar 14 16:51:29 UTC 2018 - daniel.molkentin@suse.com
Accepting request 587022 from home:dmolkentin:branches:security:dehydrated - Fix issues introduced by 0.6.1 (bsc#1085305) * bring back man page * reflect new endpoint in (commented out) config file section (adds 0001-fixed-CA-url-in-example-config.patch, backported from upstream's master branch) OBS-URL: https://build.opensuse.org/request/show/587022 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=30
2018-03-14 18:34:36 +01:00
- Fix issues introduced by 0.6.1 (bsc#1085305)
* bring back man page
* reflect new endpoint in (commented out) config file section
(adds 0001-fixed-CA-url-in-example-config.patch, backported
from upstream's master branch)
Accepting request 587013 from home:dmolkentin:branches:security:dehydrated - Properly install man page again (bsc#1085305) OBS-URL: https://build.opensuse.org/request/show/587013 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=29
2018-03-14 17:53:11 +01:00
Accepting request 586503 from home:dmolkentin:branches:security:dehydrated - Updated dehydrated to 0.6.1 (bsc#1084854) * Use new ACME v2 endpoint by default - Updated dehydrated to 0.6.0 (bsc#1084854) OBS-URL: https://build.opensuse.org/request/show/586503 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=28
2018-03-13 21:36:22 +01:00
-------------------------------------------------------------------
Tue Mar 13 20:21:49 UTC 2018 - daniel.molkentin@suse.com
- Updated dehydrated to 0.6.1 (bsc#1084854)
* Use new ACME v2 endpoint by default
Accepting request 585800 from home:dmolkentin:branches:security:dehydrated - Updated dehydrated to 0.6.0 (osc#1084854) Changed * Challenge validation loop has been modified to loop over authorization identifiers instead of altnames (ACMEv2 + wildcard support) * Removed LICENSE parameter from config (terms of service is now acquired directly from the CA directory) Added * Support for ACME v02 (including wildcard certificates!) * New hook: generate_csr (see example hook script for more information) * Calling random hook on startup to make it clear to hook script authors that unknown hooks should just be ignored... OBS-URL: https://build.opensuse.org/request/show/585800 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=26
2018-03-12 10:53:49 +01:00
-------------------------------------------------------------------
Mon Mar 12 08:16:13 UTC 2018 - daniel.molkentin@suse.com
Accepting request 586503 from home:dmolkentin:branches:security:dehydrated - Updated dehydrated to 0.6.1 (bsc#1084854) * Use new ACME v2 endpoint by default - Updated dehydrated to 0.6.0 (bsc#1084854) OBS-URL: https://build.opensuse.org/request/show/586503 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=28
2018-03-13 21:36:22 +01:00
- Updated dehydrated to 0.6.0 (bsc#1084854)
Accepting request 585800 from home:dmolkentin:branches:security:dehydrated - Updated dehydrated to 0.6.0 (osc#1084854) Changed * Challenge validation loop has been modified to loop over authorization identifiers instead of altnames (ACMEv2 + wildcard support) * Removed LICENSE parameter from config (terms of service is now acquired directly from the CA directory) Added * Support for ACME v02 (including wildcard certificates!) * New hook: generate_csr (see example hook script for more information) * Calling random hook on startup to make it clear to hook script authors that unknown hooks should just be ignored... OBS-URL: https://build.opensuse.org/request/show/585800 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=26
2018-03-12 10:53:49 +01:00
Changed
* Challenge validation loop has been modified to loop over authorization identifiers instead of altnames (ACMEv2 + wildcard support)
* Removed LICENSE parameter from config (terms of service is now acquired directly from the CA directory)
Added
* Support for ACME v02 (including wildcard certificates!)
* New hook: generate_csr (see example hook script for more information)
* Calling random hook on startup to make it clear to hook script authors that unknown hooks should just be ignored...
Accepting request 564525 from home:dmolkentin:branches:security:dehydrated - Updated dehydrated to 0.5.0 This removes the following patches and files, which are now part of the upstream package: * 0001-Add-optional-user-and-group-configuration.patch * 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch * dehydrated.1: the man page has been adopted by upstream Starting with this version, upstream introduced signed releases, which is now being used for source validation. Upstream changes: Changed * Certificate chain is now cached (CHAINCACHE) * OpenSSL binary path is now configurable (OPENSSL) * Cleanup now also moves revoked certificates Added * New feature for updating contact information (--account) * Allow automatic cleanup on exit (AUTO_CLEANUP) * Initial support for fetching OCSP status to be used for OCSP stapling (OCSP_FETCH) * Certificates can now have aliases to create multiple certificates with identical set of domains (see --alias and domains.txt documentation) * Allow dehydrated to run as specified user (/group). This was already available previously as a patch to this package. OBS-URL: https://build.opensuse.org/request/show/564525 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=21
2018-01-15 12:59:16 +01:00
-------------------------------------------------------------------
Accepting request 564949 from home:dmolkentin:branches:security:dehydrated - Remove redundant noarch entries. They cause an error in RPM 4.14. OBS-URL: https://build.opensuse.org/request/show/564949 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=22
2018-01-15 13:19:24 +01:00
Mon Jan 15 12:15:07 UTC 2018 - daniel.molkentin@suse.com
- Remove redundant noarch entries. They cause an error in RPM 4.14.
-------------------------------------------------------------------
Accepting request 564525 from home:dmolkentin:branches:security:dehydrated - Updated dehydrated to 0.5.0 This removes the following patches and files, which are now part of the upstream package: * 0001-Add-optional-user-and-group-configuration.patch * 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch * dehydrated.1: the man page has been adopted by upstream Starting with this version, upstream introduced signed releases, which is now being used for source validation. Upstream changes: Changed * Certificate chain is now cached (CHAINCACHE) * OpenSSL binary path is now configurable (OPENSSL) * Cleanup now also moves revoked certificates Added * New feature for updating contact information (--account) * Allow automatic cleanup on exit (AUTO_CLEANUP) * Initial support for fetching OCSP status to be used for OCSP stapling (OCSP_FETCH) * Certificates can now have aliases to create multiple certificates with identical set of domains (see --alias and domains.txt documentation) * Allow dehydrated to run as specified user (/group). This was already available previously as a patch to this package. OBS-URL: https://build.opensuse.org/request/show/564525 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=21
2018-01-15 12:59:16 +01:00
Mon Jan 15 11:29:11 UTC 2018 - daniel.molkentin@suse.com
- Updated dehydrated to 0.5.0
This removes the following patches and files, which are now part of the
upstream package:
* 0001-Add-optional-user-and-group-configuration.patch
* 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch
* dehydrated.1: the man page has been adopted by upstream
Starting with this version, upstream introduced signed releases, which
is now being used for source validation.
Upstream changes:
Changed
* Certificate chain is now cached (CHAINCACHE)
* OpenSSL binary path is now configurable (OPENSSL)
* Cleanup now also moves revoked certificates
Added
* New feature for updating contact information (--account)
* Allow automatic cleanup on exit (AUTO_CLEANUP)
* Initial support for fetching OCSP status to be used for OCSP stapling
(OCSP_FETCH)
* Certificates can now have aliases to create multiple certificates with
identical set of domains (see --alias and domains.txt documentation)
* Allow dehydrated to run as specified user (/group). This was already
available previously as a patch to this package.
- actually try to find the real path to bash and don't hardcode /usr/bin/bash OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=19
2017-10-20 13:02:37 +02:00
-------------------------------------------------------------------
Fri Oct 20 11:02:24 UTC 2017 - mrueckert@suse.de
- revert accidental change to the service file
- actually try to find the real path to bash and don't hardcode /usr/bin/bash OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=18
2017-10-20 12:57:53 +02:00
-------------------------------------------------------------------
Fri Oct 20 10:55:26 UTC 2017 - mrueckert@suse.de
- actually try to find the real path to bash and don't hardcode
/usr/bin/bash
Accepting request 535146 from home:dmolkentin:branches:security:dehydrated - Use /usr/bin/bash directly, rather than via env - Use sudo instead of su to allow for argument handling, also works in all cases when no login shell is assigned to the dehydrated user * updates 0001-Add-optional-user-and-group-configuration.patch OBS-URL: https://build.opensuse.org/request/show/535146 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=17
2017-10-20 11:54:53 +02:00
-------------------------------------------------------------------
Thu Oct 19 08:11:20 UTC 2017 - daniel.molkentin@suse.com
- Use /usr/bin/bash directly, rather than via env
-------------------------------------------------------------------
Wed Oct 18 16:42:31 UTC 2017 - daniel.molkentin@suse.com
- Use sudo instead of su to allow for argument handling, also
works in all cases when no login shell is assigned to the
dehydrated user
* updates 0001-Add-optional-user-and-group-configuration.patch
Accepting request 534491 from home:dmolkentin:branches:security:dehydrated - Commands in service files need some escaping after all. Fix ExecStartPost. OBS-URL: https://build.opensuse.org/request/show/534491 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=16
2017-10-17 16:48:54 +02:00
-------------------------------------------------------------------
Tue Oct 17 14:46:16 UTC 2017 - daniel.molkentin@suse.com
- Commands in service files need some escaping after all. Fix ExecStartPost.
Accepting request 534175 from home:dmolkentin:branches:security:dehydrated - In the timer service, execute root post run hooks in ExecStartPost - Fix run of root hooks - Simplify root hook execution, this is also more robust OBS-URL: https://build.opensuse.org/request/show/534175 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=15
2017-10-17 04:03:39 +02:00
-------------------------------------------------------------------
Mon Oct 16 09:27:28 UTC 2017 - daniel.molkentin@suse.com
- In the timer service, execute root post run hooks in ExecStartPost
-------------------------------------------------------------------
Mon Oct 16 04:43:22 UTC 2017 - daniel.molkentin@suse.com
- Fix run of root hooks
- Simplify root hook execution, this is also more robust
Accepting request 531761 from home:dmolkentin:branches:security:dehydrated - Remove unused hooks directory - Introduced a directory for custom post-run hooks executed as root, see README.SUSE for details. (not to be confused with the native hooks run as dehyrated user) - Clarify necessity of enabling dehydrated.timer in README.SUSE - Submit to SLE15 as per fate#323377 - Add optional post run hook directory, executed by cron/systemd after dehydrated --cron has run - Remove hook directory intended for packaging other native hooks. Will be approach differently OBS-URL: https://build.opensuse.org/request/show/531761 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=13
2017-10-06 12:52:01 +02:00
-------------------------------------------------------------------
Thu Oct 5 13:36:39 UTC 2017 - daniel.molkentin@suse.com
- Remove unused hooks directory
- Introduced a directory for custom post-run hooks executed as root,
see README.SUSE for details. (not to be confused with the native hooks
run as dehyrated user)
-------------------------------------------------------------------
Fri Sep 29 15:14:29 UTC 2017 - daniel.molkentin@suse.com
- Clarify necessity of enabling dehydrated.timer in README.SUSE
- Submit to SLE15 as per fate#323377
- Add optional post run hook directory, executed by cron/systemd
after dehydrated --cron has run
- Remove hook directory intended for packaging other native hooks.
Will be approach differently
Accepting request 528993 from home:dmolkentin:branches:security:dehydrated - No longer require nginx or lighttpd for SLE - Never go as far as to require acmeresponder, it might not be available - Drop -update from dehydrated-update.{timer,socket} for consistency - Add distro specific README.SUSE / README.Fedora - Ran spec-cleaner OBS-URL: https://build.opensuse.org/request/show/528993 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=12
2017-09-27 18:31:31 +02:00
-------------------------------------------------------------------
Wed Sep 27 10:09:16 UTC 2017 - daniel.molkentin@suse.com
- No longer require nginx or lighttpd for SLE
- Never go as far as to require acmeresponder, it might not be available
- Drop -update from dehydrated-update.{timer,socket} for consistency
- Add distro specific README.SUSE / README.Fedora
- Ran spec-cleaner
Accepting request 528299 from home:dmolkentin:branches:security:dehydrated - Add man page - Ensure dehydrated is always run as designated user * adds 0001-Add-optional-user-and-group-configuration.patch - Introduce config.d directory for user configuration - Avoid warning about empty config.d directory * adds 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch - Fix sed warning about unescaped curly braces in regex - Use timer instead of cron for systemd-enabled distros Note: Timer must be explicitly enabled! OBS-URL: https://build.opensuse.org/request/show/528299 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=11
2017-09-22 15:35:31 +02:00
-------------------------------------------------------------------
Fri Sep 22 11:18:55 UTC 2017 - daniel.molkentin@suse.com
- Add man page
- Ensure dehydrated is always run as designated user
* adds 0001-Add-optional-user-and-group-configuration.patch
- Introduce config.d directory for user configuration
- Avoid warning about empty config.d directory
* adds 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch
- Fix sed warning about unescaped curly braces in regex
- Drop the (undocumented) dependeny for mod_headers OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=8
2017-02-21 14:13:43 +01:00
-------------------------------------------------------------------
Accepting request 527349 from home:dmolkentin:branches:security:dehydrated - Swap statements in post: installing services requires tmp.d - (Weak) dependency on dehydrated-acmeresponder. - systemd update service: ConditionPathExists goes into [Unit] section - Use timer instead of cron for systemd-enabled distros OBS-URL: https://build.opensuse.org/request/show/527349 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=10
2017-09-19 17:42:45 +02:00
Tue Sep 19 15:40:46 UTC 2017 - daniel.molkentin@suse.com
- Swap statements in post: installing services requires tmp.d
-------------------------------------------------------------------
Tue Sep 19 14:52:25 UTC 2017 - daniel.molkentin@suse.com
- (Weak) dependency on dehydrated-acmeresponder.
-------------------------------------------------------------------
Thu Sep 14 13:47:06 UTC 2017 - daniel.molkentin@suse.com
- systemd update service: ConditionPathExists goes into [Unit] section
-------------------------------------------------------------------
Wed Sep 13 15:27:08 UTC 2017 - daniel.molkentin@suse.com
Accepting request 528299 from home:dmolkentin:branches:security:dehydrated - Add man page - Ensure dehydrated is always run as designated user * adds 0001-Add-optional-user-and-group-configuration.patch - Introduce config.d directory for user configuration - Avoid warning about empty config.d directory * adds 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch - Fix sed warning about unescaped curly braces in regex - Use timer instead of cron for systemd-enabled distros Note: Timer must be explicitly enabled! OBS-URL: https://build.opensuse.org/request/show/528299 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=11
2017-09-22 15:35:31 +02:00
- Use timer instead of cron for systemd-enabled distros
Note: Timer must be explicitly enabled!
Accepting request 527349 from home:dmolkentin:branches:security:dehydrated - Swap statements in post: installing services requires tmp.d - (Weak) dependency on dehydrated-acmeresponder. - systemd update service: ConditionPathExists goes into [Unit] section - Use timer instead of cron for systemd-enabled distros OBS-URL: https://build.opensuse.org/request/show/527349 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=10
2017-09-19 17:42:45 +02:00
-------------------------------------------------------------------
- Drop the (undocumented) dependeny for mod_headers OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=8
2017-02-21 14:13:43 +01:00
Tue Feb 21 13:12:19 UTC 2017 - daniel.molkentin@suse.com
- Drop the (undocumented) dependeny for mod_headers
Accepting request 459171 from home:danimo:branches:security:dehydrated - Unify configuration file source names - Bump to 0.4.0 OBS-URL: https://build.opensuse.org/request/show/459171 OBS-URL: https://build.opensuse.org/package/show/security:dehydrated/dehydrated?expand=0&rev=7
2017-02-21 13:11:20 +01:00
-------------------------------------------------------------------
Sat Feb 18 16:51:10 UTC 2017 - daniel@molkentin.de
- Unify configuration file source names
-------------------------------------------------------------------
Sat Feb 18 14:08:02 UTC 2017 - daniel@molkentin.de
- Bump to 0.4.0
Accepting request 455792 from security:dehydrated Automatic submission by obs-autosubmit OBS-URL: https://build.opensuse.org/request/show/455792 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/dehydrated?expand=0&rev=2
2017-02-13 07:49:05 +01:00
-------------------------------------------------------------------
Thu Feb 2 15:04:16 UTC 2017 - daniel.molkentin@suse.com
- More dependency fixes
-------------------------------------------------------------------
Thu Feb 2 13:59:16 UTC 2017 - daniel.molkentin@suse.com
- Make nginx and lighttpd packages into features
Default-disable them on distros where we cannot provide a dependency.
-------------------------------------------------------------------
Thu Feb 2 12:32:20 UTC 2017 - daniel.molkentin@suse.com
- Fix build on Fedora
-------------------------------------------------------------------
Thu Feb 2 11:03:43 UTC 2017 - mrueckert@suse.de
- make permissions of the lighty and nginx config files tighter
-------------------------------------------------------------------
Thu Feb 2 10:56:58 UTC 2017 - mrueckert@suse.de
- only own the configuration files and not the whole directory tree
- add BR for nginx, lighttpd, apache2 to handle directory
ownership
-------------------------------------------------------------------
Thu Jan 12 10:24:20 UTC 2017 - mrueckert@suse.de
- with making the permissions more tight ... dehydrated can not
write its lock file anymore to /etc/dehydrated. To fix this we
now create /var/run/dehydrated (sysvinit) or /run/dehydrated
(systemd) and point the lock file in the default config to that
directory.
Please adapt your local config files accordingly.
-------------------------------------------------------------------
Thu Jan 12 09:53:06 UTC 2017 - mrueckert@suse.de
- change permissions of /etc/dehydrated to:
root:dehydrated u=rwx,g=rx,o=
- create the subdirs that dehydrated would create later anyway:
/etc/dehydrated/accounts
/etc/dehydrated/certs
dehydrated::dehydrated u=rwx,go=
- tighten up permissions on
/etc/dehydrated/config
/etc/dehydrated/domain.txt
root:root u=rw,go=r -> root:dehydrated u=rw,g=r,o=
/etc/dehydrated/hook.sh
root:root u=rw,go=r -> root:dehydrated u=rwx,g=rx,o=
-------------------------------------------------------------------
Wed Nov 23 02:20:53 UTC 2016 - daniel@molkentin.de
- Add lighttpd configuration via dehydrated-lighttpd
Accepting request 441496 from security Lightweight LE client (formally known as letsencrypt.sh). I'll maintain in in TW. OBS-URL: https://build.opensuse.org/request/show/441496 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/dehydrated?expand=0&rev=1
2017-01-27 11:00:22 +01:00
-------------------------------------------------------------------
Mon Nov 14 09:26:41 UTC 2016 - jengelh@inai.de
- Test for user/group before adding them and don't suppress errors
-------------------------------------------------------------------
Thu Nov 10 10:41:09 UTC 2016 - daniel@molkentin.de
- Fix MIN HOUR order in crontab (boo#1009452)
-------------------------------------------------------------------
Tue Sep 13 18:57:09 UTC 2016 - danimo@owncloud.com
- Bump to v0.3.1
- Rename to dehydrated
-------------------------------------------------------------------
Sun May 22 20:23:58 UTC 2016 - danimo@owncloud.com
- Bump to v0.2.0
- This version fixes a json-parsing bug which made letsencrypt.sh
incompatible with up-to-date ACME servers.
- PRIVATE_KEY config parameter has been renamed to ACCOUNT_KEY to avoid
confusion with certificate keys
- deploy_cert hook now also has the certificates timestamp as standalone
parameter
- Temporary files are now identifiable (template: letsencrypt.sh-XXXXXX)
- Private keys are now regenerated by default
- Added documentation to repository
- Fixed bug with uppercase names in domains.txt (script now converts everything
to lowercase)
- mktemp no longer uses the deprecated -t parameter.
- Compatibility with "pretty" json
-------------------------------------------------------------------
Wed Apr 20 01:03:52 UTC 2016 - danimo@owncloud.com
- Explicitly add group and license, required for SLES 11
-------------------------------------------------------------------
Wed Apr 20 00:57:18 UTC 2016 - danimo@owncloud.com
- Add nginx integration package
- Proper dir permissions for apache package (755, not 644)
-------------------------------------------------------------------
Mon Apr 18 18:25:44 UTC 2016 - draht@schaltsekun.de
- fix build requirement for shadow (>=openSUSE-12.3) and pwdutils
(before 12.3).
- missing changelog for last change by danimo: do not require mod_ssl for
suse distrbutions.
-------------------------------------------------------------------
Mon Mar 28 17:05:02 UTC 2016 - danimo@owncloud.com
- Add alias to /.well-known/acme-challenge by default
-------------------------------------------------------------------
Sat Mar 26 09:33:25 UTC 2016 - danimo@owncloud.com
- Add cron, do not remove letsencrypt user, adjust permissions
-------------------------------------------------------------------
Fri Mar 25 18:42:00 UTC 2016 - danimo@owncloud.com
- Initial commit
Reference in New Issue Copy Permalink