Accepting request 455792 from security:dehydrated
Automatic submission by obs-autosubmit OBS-URL: https://build.opensuse.org/request/show/455792 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/dehydrated?expand=0&rev=2
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
parent
10d381b04a
commit
5628f7872c
4
acme-challenge.conf.lighttpd.in
Normal file
4
acme-challenge.conf.lighttpd.in
Normal file
@ -0,0 +1,4 @@
|
||||
server.modules += ("alias")
|
||||
alias.url += (
|
||||
"/.well-known/acme-challenge/" => "@CHALLENGEDIR@",
|
||||
)
|
||||
@ -1,3 +1,66 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 2 15:04:16 UTC 2017 - daniel.molkentin@suse.com
|
||||
|
||||
- More dependency fixes
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 2 13:59:16 UTC 2017 - daniel.molkentin@suse.com
|
||||
|
||||
- Make nginx and lighttpd packages into features
|
||||
Default-disable them on distros where we cannot provide a dependency.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 2 12:32:20 UTC 2017 - daniel.molkentin@suse.com
|
||||
|
||||
- Fix build on Fedora
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 2 11:03:43 UTC 2017 - mrueckert@suse.de
|
||||
|
||||
- make permissions of the lighty and nginx config files tighter
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 2 10:56:58 UTC 2017 - mrueckert@suse.de
|
||||
|
||||
- only own the configuration files and not the whole directory tree
|
||||
- add BR for nginx, lighttpd, apache2 to handle directory
|
||||
ownership
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jan 12 10:24:20 UTC 2017 - mrueckert@suse.de
|
||||
|
||||
- with making the permissions more tight ... dehydrated can not
|
||||
write its lock file anymore to /etc/dehydrated. To fix this we
|
||||
now create /var/run/dehydrated (sysvinit) or /run/dehydrated
|
||||
(systemd) and point the lock file in the default config to that
|
||||
directory.
|
||||
|
||||
Please adapt your local config files accordingly.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jan 12 09:53:06 UTC 2017 - mrueckert@suse.de
|
||||
|
||||
- change permissions of /etc/dehydrated to:
|
||||
root:dehydrated u=rwx,g=rx,o=
|
||||
- create the subdirs that dehydrated would create later anyway:
|
||||
/etc/dehydrated/accounts
|
||||
/etc/dehydrated/certs
|
||||
dehydrated::dehydrated u=rwx,go=
|
||||
- tighten up permissions on
|
||||
/etc/dehydrated/config
|
||||
/etc/dehydrated/domain.txt
|
||||
|
||||
root:root u=rw,go=r -> root:dehydrated u=rw,g=r,o=
|
||||
|
||||
/etc/dehydrated/hook.sh
|
||||
|
||||
root:root u=rw,go=r -> root:dehydrated u=rwx,g=rx,o=
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 23 02:20:53 UTC 2016 - daniel@molkentin.de
|
||||
|
||||
- Add lighttpd configuration via dehydrated-lighttpd
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Nov 14 09:26:41 UTC 2016 - jengelh@inai.de
|
||||
|
||||
|
||||
142
dehydrated.spec
142
dehydrated.spec
@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package dehydrated
|
||||
#
|
||||
# Copyright (c) 2016 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
||||
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@ -15,6 +15,7 @@
|
||||
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
# See also http://en.opensuse.org/openSUSE:Specfile_guidelines
|
||||
|
||||
%if 0%{?suse_version}
|
||||
@ -26,6 +27,24 @@
|
||||
%define _user dehydrated
|
||||
%define _home /etc/dehydrated
|
||||
|
||||
%if 0%{?suse_version} > 1230
|
||||
%bcond_without systemd
|
||||
%define _lock_dir /run/dehydrated
|
||||
%else
|
||||
%bcond_with systemd
|
||||
%define _lock_dir /var/run/dehydrated
|
||||
%endif
|
||||
|
||||
%if (0%{?suse_version} < 1200 && !0%{?is_opensuse}) || 0%{?centos_version} || 0%{?rhel_version}
|
||||
%bcond_with nginx
|
||||
%bcond_with lighttpd
|
||||
%else
|
||||
%bcond_without nginx
|
||||
%bcond_without lighttpd
|
||||
%endif
|
||||
|
||||
%{!?_tmpfilesdir: %global _tmpfilesdir /usr/lib/tmpfiles.d }
|
||||
|
||||
Name: dehydrated
|
||||
Version: 0.3.1
|
||||
Release: 0
|
||||
@ -36,10 +55,23 @@ Url: https://github.com/lukas2511/dehydrated
|
||||
Source0: %{name}-%{version}.tar.gz
|
||||
Source1: acme-challenge.conf.in
|
||||
Source2: acme-challenge.in
|
||||
Source3: dehydrated.cron.in
|
||||
Source3: acme-challenge.conf.lighttpd.in
|
||||
Source4: dehydrated.cron.in
|
||||
Source5: dehydrated.tmpfiles.d
|
||||
BuildRequires: %{_apache}
|
||||
%if %{with lighttpd}
|
||||
BuildRequires: lighttpd
|
||||
%endif
|
||||
%if %{with nginx}
|
||||
BuildRequires: nginx
|
||||
%endif
|
||||
%if 0%{?fedora_version}
|
||||
BuildRequires: generic-logos
|
||||
BuildRequires: generic-logos-httpd
|
||||
%endif
|
||||
Requires: coreutils
|
||||
Requires: curl
|
||||
Requires: openssl
|
||||
Requires: coreutils
|
||||
%if 0%{?suse_version}
|
||||
Requires: cron
|
||||
%endif
|
||||
@ -50,11 +82,15 @@ Requires(pre): /usr/bin/getent
|
||||
%if 0%{?suse_version} >= 1230
|
||||
BuildRequires: shadow
|
||||
%endif
|
||||
%if %{with systemd}
|
||||
BuildRequires: pkgconfig(systemd)
|
||||
%{?systemd_requires}
|
||||
%endif
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
BuildArch: noarch
|
||||
|
||||
Obsoletes: letsencrypt.sh < %{version}
|
||||
Provides: letsencrypt.sh = %{version}
|
||||
Obsoletes: letsencrypt.sh < %{version}
|
||||
Provides: letsencrypt.sh = %{version}
|
||||
|
||||
%description
|
||||
This is a client for signing certificates with an ACME server
|
||||
@ -75,31 +111,42 @@ Current features:
|
||||
* Certificate revocation
|
||||
|
||||
%package %{_apache}
|
||||
Group: Productivity/Networking/Security
|
||||
License: MIT
|
||||
Requires: %{name}
|
||||
Requires: %{_apache}
|
||||
Requires: %{_apache}
|
||||
Requires: %{name}
|
||||
%if ! 0%{?suse_version}
|
||||
Requires: mod_ssl
|
||||
Requires: mod_ssl
|
||||
%endif
|
||||
Obsoletes: letsencrypt.sh-%{_apache} < %{version}
|
||||
Provides: letsencrypt.sh-%{_apache} = %{version}
|
||||
Summary: Apache Integration for dehydrated
|
||||
Obsoletes: letsencrypt.sh-%{_apache} < %{version}
|
||||
Provides: letsencrypt.sh-%{_apache} = %{version}
|
||||
Summary: Apache Integration for dehydrated
|
||||
Group: Productivity/Networking/Security
|
||||
|
||||
%description %{_apache}
|
||||
This adds a configuration file for dehydrated's acme-challenge to Apache.
|
||||
|
||||
%if %{with nginx}
|
||||
%package nginx
|
||||
Group: Productivity/Networking/Security
|
||||
License: MIT
|
||||
Requires: %{name}
|
||||
Requires: nginx
|
||||
Obsoletes: letsencrypt.sh-nginx < %{version}
|
||||
Provides: letsencrypt.sh-nginx = %{version}
|
||||
Summary: Nginx Integration for dehydrated
|
||||
Requires: %{name}
|
||||
Requires: nginx
|
||||
Obsoletes: letsencrypt.sh-nginx < %{version}
|
||||
Provides: letsencrypt.sh-nginx = %{version}
|
||||
Summary: Nginx Integration for dehydrated
|
||||
Group: Productivity/Networking/Security
|
||||
|
||||
%description nginx
|
||||
This adds a configuration file for dehydrated's acme-challenge to nginx.
|
||||
%endif #with nginx
|
||||
|
||||
%if %{with lighttpd}
|
||||
%package lighttpd
|
||||
Requires: %{name}
|
||||
Requires: lighttpd
|
||||
Summary: Lighttpd Integration for dehydrated
|
||||
Group: Productivity/Networking/Security
|
||||
|
||||
%description lighttpd
|
||||
This adds a configuration file for dehydrated's acme-challenge to lighttpd.
|
||||
%endif #with lighttpd
|
||||
|
||||
%pre
|
||||
getent group %{_user} >/dev/null || /usr/sbin/groupadd -r %{_user}
|
||||
@ -108,6 +155,11 @@ getent passwd %{_user} >/dev/null || /usr/sbin/useradd -g %{_user} \
|
||||
if [ -d /etc/letsencrypt.sh ]; then mv /etc/letsencrypt.sh /etc/dehydrated; chown -R %{_user} /etc/dehydrated; fi
|
||||
if [ -e /etc/dehydrated/config.sh ]; then mv /etc/dehydrated/config.sh /etc/dehydrated/config; fi
|
||||
|
||||
%if %{with systemd}
|
||||
%post
|
||||
systemd-tmpfiles --create %{_tmpfilesdir}/%{name}.conf ||:
|
||||
%endif
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
|
||||
@ -115,7 +167,7 @@ if [ -e /etc/dehydrated/config.sh ]; then mv /etc/dehydrated/config.sh /etc/dehy
|
||||
|
||||
%install
|
||||
# sensitive keys
|
||||
mkdir -p %{buildroot}%{_home}
|
||||
mkdir -p %{buildroot}%{_home}/{accounts,certs}
|
||||
|
||||
sed -i "s,#WELLKNOWN=.*,WELLKNOWN=%{_challengedir},g" docs/examples/config
|
||||
install -m 0644 docs/examples/* %{buildroot}%{_home}
|
||||
@ -126,31 +178,63 @@ install -m 0755 -d %{buildroot}%{_challengedir}
|
||||
install -m 0755 -d %{buildroot}/etc/%{_apache}/conf.d
|
||||
sed "s,@CHALLENGEDIR@,%{_challengedir},g" %{SOURCE1} > acme-challenge.conf
|
||||
install -m 0644 acme-challenge.conf %{buildroot}/etc/%{_apache}/conf.d
|
||||
|
||||
%if %{with nginx}
|
||||
install -m 0755 -d %{buildroot}/etc/nginx
|
||||
sed "s,@CHALLENGEDIR@,%{_challengedir},g" %{SOURCE2} > acme-challenge
|
||||
install -m 0644 acme-challenge %{buildroot}/etc/nginx
|
||||
%endif #with nginx
|
||||
|
||||
%if %{with lighttpd}
|
||||
install -m 0755 -d %{buildroot}/etc/lighttpd/conf.d
|
||||
sed "s,@CHALLENGEDIR@,%{_challengedir},g" %{SOURCE3} > acme-challenge
|
||||
install -m 0644 acme-challenge %{buildroot}/etc/lighttpd/conf.d
|
||||
%endif #with lighttpd
|
||||
|
||||
install -m 0755 -d %{buildroot}/etc/cron.d
|
||||
sed "s,@USER@,%{_user},g" %{SOURCE3} > dehydrated.cron
|
||||
sed "s,@USER@,%{_user},g" %{SOURCE4} > dehydrated.cron
|
||||
install -m 0644 dehydrated.cron %{buildroot}/etc/cron.d/dehydrated
|
||||
%if %{with systemd}
|
||||
install -D -m 0644 %{S:5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
|
||||
%else
|
||||
install -D -d -m 0750 %{buildroot}%{_lock_dir}
|
||||
%endif
|
||||
perl -p -i -e 's|#LOCKFILE="\${BASEDIR}/lock"|LOCKFILE="%{_lock_dir}/lock"|' %{buildroot}%{_home}/config
|
||||
diff -urN docs/examples/config %{buildroot}%{_home}/config ||:
|
||||
|
||||
%files
|
||||
%defattr(-,root,root)
|
||||
%attr(750,%{_user},root) %dir %{_sysconfdir}/dehydrated
|
||||
%config %{_sysconfdir}/dehydrated/config
|
||||
%config %{_sysconfdir}/dehydrated/domains.txt
|
||||
%config %{_sysconfdir}/dehydrated/hook.sh
|
||||
%attr(750,root,%{_user}) %dir %{_sysconfdir}/dehydrated
|
||||
%attr(700,%{_user},%{_user}) %dir %{_sysconfdir}/dehydrated/accounts
|
||||
%attr(700,%{_user},%{_user}) %dir %{_sysconfdir}/dehydrated/certs
|
||||
%config(noreplace) %attr(640,root,%{_user}) %{_sysconfdir}/dehydrated/config
|
||||
%config(noreplace) %attr(640,root,%{_user}) %{_sysconfdir}/dehydrated/domains.txt
|
||||
%config(noreplace) %attr(750,root,%{_user}) %{_sysconfdir}/dehydrated/hook.sh
|
||||
%config %{_sysconfdir}/cron.d/dehydrated
|
||||
%{_bindir}/dehydrated
|
||||
%attr(-,%{_user},root) %dir %{_localstatedir}/lib/acme-challenge
|
||||
%doc LICENSE README.md docs/*.md docs/*.jpg
|
||||
%if %{with systemd}
|
||||
%{_tmpfilesdir}/%{name}.conf
|
||||
%ghost %attr(700,%{_user},%{_user}) %dir %{_lock_dir}
|
||||
%else
|
||||
%attr(700,%{_user},%{_user}) %dir %{_lock_dir}
|
||||
%endif
|
||||
|
||||
%files %{_apache}
|
||||
%defattr(-,root,root,-)
|
||||
%config %{_sysconfdir}/%{_apache}
|
||||
%config %{_sysconfdir}/%{_apache}/conf.d/acme-challenge.conf
|
||||
|
||||
%if %{with nginx}
|
||||
%files nginx
|
||||
%defattr(-,root,root,-)
|
||||
%config %{_sysconfdir}/nginx
|
||||
%config %attr(640,root,nginx) %{_sysconfdir}/nginx/acme-challenge
|
||||
%endif #with nginx
|
||||
|
||||
%if %{with lighttpd}
|
||||
%files lighttpd
|
||||
%defattr(-,root,root,-)
|
||||
%config %attr(640,root,lighttpd) %{_sysconfdir}/lighttpd/conf.d/acme-challenge
|
||||
%endif #with lighttpd
|
||||
|
||||
%changelog
|
||||
|
||||
|
||||
2
dehydrated.tmpfiles.d
Normal file
2
dehydrated.tmpfiles.d
Normal file
@ -0,0 +1,2 @@
|
||||
# Type Path Mode UID GID Age Argument
|
||||
d /run/dehydrated 0700 dehydrated dehydrated - -
|
||||
Loading…
Reference in New Issue
Block a user