krb5/krb5.spec

#
# spec file for package krb5 (Version 1.6.3)
#
# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine
# package are under the same license as the package itself.
#
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#

# norootforbuild


Name:           krb5
Version:        1.6.3
Release:        62
BuildRequires:  bison libcom_err-devel ncurses-devel
%if %{suse_version} > 1010
BuildRequires:  keyutils keyutils-devel
%endif
%define srcRoot krb5-1.6.3 
%define vendorFiles %{_builddir}/%{srcRoot}/vendor-files/
%define krb5docdir  %{_defaultdocdir}/%{name}
Provides:       heimdal-lib
Obsoletes:      heimdal-lib
Summary:        MIT Kerberos5 Implementation--Libraries
License:        X11/MIT
Url:            http://web.mit.edu/kerberos/www/
Group:          Productivity/Networking/Security
Source:         krb5-1.6.3.tar.bz2
Source1:        vendor-files.tar.bz2
Source2:        README.Source
Source3:        spx.c
Source4:        EncryptWithMasterKey.c
Source5:        %{name}-%{version}-rpmlintrc
Source10:       krb5-trunk-manpaths.txt
Patch1:         krb5-1.5.1-fix-too-few-arguments.dif
Patch2:         krb5-1.6.1-compile_pie.dif 
Patch3:         krb5-1.4-fix-segfault.dif
Patch6:         trunk-EncryptWithMasterKey.dif
Patch14:        warning-fix-lib-crypto-des.dif
Patch15:        warning-fix-lib-crypto-dk.dif
Patch16:        warning-fix-lib-crypto.dif
Patch17:        warning-fix-lib-crypto-enc_provider.dif
Patch18:        warning-fix-lib-crypto-yarrow_arcfour.dif
Patch20:        kprop-use-mkstemp.dif
Patch21:        krb5-1.5.1-fix-var-used-before-value-set.dif
Patch22:        krb5-1.5.1-fix-ftp-var-used-uninitialized.dif
Patch24:        krb5-1.5.1-fix-strncat-warning.dif
Patch25:        krb5-1.6.1-init-salt-length.dif
Patch30:        trunk-manpaths.dif
Patch31:        krb5-1.6-ldap-man.dif
Patch32:        krb5-1.4.3-enospc.dif
Patch33:        krb5-1.3.3-rcp-markus.dif
Patch34:        gssapi_improve_errormessages.dif
Patch35:        krb5-1.6-fix-CVE-2007-5894.dif
Patch36:        krb5-1.6-fix-CVE-2007-5902.dif
Patch37:        krb5-1.6-fix-CVE-2007-5971.dif
Patch38:        krb5-1.6-fix-CVE-2007-5972.dif
Patch39:        krb5-1.6-MITKRB5-SA-2008-001.dif
Patch40:        krb5-1.6-MITKRB5-SA-2008-002.dif
Patch41:        krb5-trunk-kpasswd_tcp.patch
Patch42:        krb5-trunk-seqnum.patch
Patch43:        krb5-1.6.3-case-insensitive.dif
Patch44:        krb5-1.6.3-ktutil-manpage.dif
Patch45:        krb5-1.6.3-post.dif
BuildRoot:      %{_tmppath}/%{name}-%{version}-build
PreReq:         mktemp, grep, /bin/touch, coreutils
PreReq:         %insserv_prereq %fillup_prereq 

%description
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of clear text passwords.



Authors:
--------
    The MIT Kerberos Team
    Sam Hartman <hartmans@mit.edu>
    Ken Raeburn <raeburn@mit.edu>
    Tom Yu <tlyu@mit.edu>

%package client
License:        X11/MIT
Summary:        MIT Kerberos5 implementation - client programs
Group:          Productivity/Networking/Security
Provides:       heimdal-tools, heimdal-x11
Obsoletes:      heimdal-tools, heimdal-x11

%description client
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords. This package includes some required
client programs, like kinit, kadmin, ...



Authors:
--------
    The MIT Kerberos Team
    Sam Hartman <hartmans@mit.edu>
    Ken Raeburn <raeburn@mit.edu>
    Tom Yu <tlyu@mit.edu>

%package server
License:        X11/MIT
Summary:        MIT Kerberos5 implementation - server
Group:          Productivity/Networking/Security
Provides:       heimdal
Obsoletes:      heimdal
Requires:       perl-Date-Calc
Requires:       logrotate cron
PreReq:         %insserv_prereq %fillup_prereq

%description server
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords. This package includes the kdc, kadmind
and more.



Authors:
--------
    The MIT Kerberos Team
    Sam Hartman <hartmans@mit.edu>
    Ken Raeburn <raeburn@mit.edu>
    Tom Yu <tlyu@mit.edu>

%package devel
License:        X11/MIT
Summary:        MIT Kerberos5 - Include Files and Libraries
Group:          Development/Libraries/C and C++
PreReq:         %{name} = %{version}
Requires:       libcom_err-devel 
%if %{suse_version} > 1010
Requires:       keyutils-devel
%endif
Provides:       heimdal-tools-devel, heimdal-devel
Obsoletes:      heimdal-tools-devel, heimdal-devel

%description devel
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords. This package includes Libraries and
Include Files for Development



Authors:
--------
    The MIT Kerberos Team
    Sam Hartman <hartmans@mit.edu>
    Ken Raeburn <raeburn@mit.edu>
    Tom Yu <tlyu@mit.edu>

%package apps-servers
License:        X11/MIT
Summary:        MIT Kerberos5 server applications
Group:          Productivity/Networking/Security

%description apps-servers
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords. This package includes some kerberos
compatible server applications like ftpd, klogind, telnetd, ...



Authors:
--------
    The MIT Kerberos Team
    Sam Hartman <hartmans@mit.edu>
    Ken Raeburn <raeburn@mit.edu>
    Tom Yu <tlyu@mit.edu>

%package apps-clients
License:        X11/MIT
Summary:        MIT Kerberos5 client applications
Group:          Productivity/Networking/Security

%description apps-clients
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords. This package includes some kerberos
compatible client applications like ftp, rpc, rlogin, telnet, ...



Authors:
--------
    The MIT Kerberos Team
    Sam Hartman <hartmans@mit.edu>
    Ken Raeburn <raeburn@mit.edu>
    Tom Yu <tlyu@mit.edu>

%prep
%setup -q -n %{srcRoot} 
%setup -a 1 -T -D -n %{srcRoot}
if [ -e %{_builddir}/%{srcRoot}/src/appl/telnet/libtelnet/spx.c ]
then
 echo "spx.c contains potential legal risks."
 exit 1;
else
 cp %{_sourcedir}/spx.c %{_builddir}/%{srcRoot}/src/appl/telnet/libtelnet/spx.c
fi
%patch1
%patch2
%patch3
%patch6
%patch14
%patch15
%patch16
%patch17
%patch18
%patch20
%patch21
%patch22
%patch24
%patch25
%patch30 -p1
%patch31
%patch32 -p1
%patch33 -p1
%patch34 -p1
%patch35 
%patch36
%patch37
%patch38
%patch39 -p1
%patch40
%patch41 
%patch42
%patch43
%patch44 -p1
%patch45
cp %{_sourcedir}/EncryptWithMasterKey.c %{_builddir}/%{srcRoot}/src/kadmin/dbutil/EncryptWithMasterKey.c
# Rename the man pages so that they'll get generated correctly.
pushd src
cat $RPM_SOURCE_DIR/krb5-trunk-manpaths.txt | while read manpage ; do
        mv "$manpage" "$manpage".in
done
popd

%build
cd src
%{?suse_update_config:%{suse_update_config -f}}
./util/reconf
CFLAGS="$RPM_OPT_FLAGS -I/usr/include/et -fno-strict-aliasing -D_GNU_SOURCE -D__CI_PRINC__ -fPIC " \
./configure \
	--prefix=/usr/lib/mit \
	--sysconfdir=%{_sysconfdir} \
	--mandir=%{_mandir} \
	--infodir=%{_infodir} \
	--libexecdir=/usr/lib/mit/sbin \
	--libdir=%{_libdir} \
	--includedir=%{_includedir} \
        --localstatedir=%{_localstatedir}/lib/kerberos \
	--enable-shared \
	--disable-static \
	--enable-dns \
        --with-system-et \
        --with-system-ss
make %{?jobs:-j%jobs} 
#make check

%install
cd src
make DESTDIR=%{buildroot} install 
cd ..
# Munge the krb5-config script to remove rpaths and CFLAGS.
sed "s|^CC_LINK=.*|CC_LINK='\$(CC) \$(PROG_LIBPATH)'|g" src/krb5-config > $RPM_BUILD_ROOT/usr/lib/mit/bin/krb5-config
# install sample config files
# I'll probably do something about this later on
mkdir -p %{buildroot}%{_sysconfdir} %{buildroot}%{_localstatedir}/lib/kerberos/krb5kdc
mkdir -p %{buildroot}%{_sysconfdir}
mkdir -p %{buildroot}/etc/profile.d/
mkdir -p %{buildroot}/var/log/krb5
mkdir -p %{buildroot}/etc/sysconfig/SuSEfirewall2.d/services/
# create plugin directories
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/kdb
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/preauth
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/libkrb5
install -m 644 %{vendorFiles}/krb5.conf %{buildroot}%{_sysconfdir}
install -m 600 %{vendorFiles}/kdc.conf %{buildroot}%{_localstatedir}/lib/kerberos/krb5kdc/
install -m 600 %{vendorFiles}/kadm5.acl %{buildroot}%{_localstatedir}/lib/kerberos/krb5kdc/
install -m 600 %{vendorFiles}/kadm5.dict %{buildroot}%{_localstatedir}/lib/kerberos/krb5kdc/
install -m 644 %{vendorFiles}/krb5.csh.profile %{buildroot}/etc/profile.d/krb5.csh
install -m 644 %{vendorFiles}/krb5.sh.profile %{buildroot}/etc/profile.d/krb5.sh
install -m 644 %{vendorFiles}/SuSEFirewall.kdc %{buildroot}/etc/sysconfig/SuSEfirewall2.d/services/kdc
install -m 644 %{vendorFiles}/SuSEFirewall.kadmind %{buildroot}/etc/sysconfig/SuSEfirewall2.d/services/kadmind
for n in ftpd.8 telnetd.8; do
	mv %{buildroot}%{_mandir}/man8/${n} %{buildroot}%{_mandir}/man8/k${n}
done
for n in ftp.1 rlogin.1 rcp.1 rsh.1 telnet.1; do
	mv %{buildroot}%{_mandir}/man1/${n} %{buildroot}%{_mandir}/man1/k${n}
done
# all libs must have permissions 0755 
for lib in `find %{buildroot}/%{_libdir}/ -type f -name "*.so*"`
do 
  chmod 0755 ${lib} 
done
# and binaries too
chmod 0755 %{buildroot}/usr/lib/mit/bin/v4rcp
chmod 0755 %{buildroot}/usr/lib/mit/bin/ksu
# install init scripts
mkdir -p %{buildroot}%{_sysconfdir}/init.d
install -m 755 %{vendorFiles}/kadmind.init %{buildroot}%{_sysconfdir}/init.d/kadmind
install -m 755 %{vendorFiles}/krb5kdc.init %{buildroot}%{_sysconfdir}/init.d/krb5kdc
install -m 755 %{vendorFiles}/kpropd.init  %{buildroot}%{_sysconfdir}/init.d/kpropd
install -m 755 %{vendorFiles}/krb524d.init %{buildroot}%{_sysconfdir}/init.d/krb524d
# install xinetd files
mkdir -p %{buildroot}%{_sysconfdir}/xinetd.d
install -m 644 %{vendorFiles}/klogin.xinetd %{buildroot}%{_sysconfdir}/xinetd.d/klogin
install -m 644 %{vendorFiles}/eklogin.xinetd %{buildroot}%{_sysconfdir}/xinetd.d/eklogin
install -m 644 %{vendorFiles}/krb5-telnet.xinetd %{buildroot}%{_sysconfdir}/xinetd.d/ktelnet
install -m 644 %{vendorFiles}/kshell.xinetd %{buildroot}%{_sysconfdir}/xinetd.d/kshell
# install logrotate files
mkdir -p %{buildroot}%{_sysconfdir}/logrotate.d
install -m 644 %{vendorFiles}/krb5-server.logrotate %{buildroot}%{_sysconfdir}/logrotate.d/krb5-server
find . -type f -name '*.ps' -exec gzip -9 {} \;
# create rc* links 
mkdir -p %{buildroot}/usr/bin/
ln -sf ../../etc/init.d/kadmind %{buildroot}/usr/bin/rckadmind
ln -sf ../../etc/init.d/krb5kdc %{buildroot}/usr/bin/rckrb5kdc
ln -sf ../../etc/init.d/kpropd %{buildroot}/usr/bin/rckpropd
ln -sf ../../etc/init.d/krb524d %{buildroot}/usr/bin/rckrb524d
# create links for kinit and klist, because of the java ones
ln -sf ../../usr/lib/mit/bin/kinit   %{buildroot}/usr/bin/kinit
ln -sf ../../usr/lib/mit/bin/klist   %{buildroot}/usr/bin/klist
# install helper scripts
install -d -m 755 %{buildroot}/usr/lib/mit/helper
install -m 744 %{vendorFiles}/heimdal2mit-DumpConvert.pl %{buildroot}/usr/lib/mit/helper/heimdal2mit-DumpConvert.pl
install -m 744 %{vendorFiles}/simple_convert_krb5conf.pl %{buildroot}/usr/lib/mit/helper/simple_convert_krb5conf.pl
# install doc
install -d -m 755 %{buildroot}/%{krb5docdir}
install -m 644 %{vendorFiles}/README.ConvertHeimdalMIT %{buildroot}/%{krb5docdir}/README.ConvertHeimdalMIT
install -m 644 %{_builddir}/%{srcRoot}/README %{buildroot}/%{krb5docdir}/README
# cleanup
rm -f  %{buildroot}/usr/share/man/man1/tmac.doc*
rm -f  /usr/share/man/man1/tmac.doc*
rm -rf /usr/lib/mit/share
rm -rf %{buildroot}/usr/lib/mit/share
#####################################################
# krb5 pre/post/postun
#####################################################

%pre
# test update from heimdal-lib
if `ls usr/lib/libotp.so* 2>/dev/null 1>/dev/null`
then
  # we update from heimdal
  echo "backup /etc/krb5.conf to /etc/krb5.conf.heimdal"
  mv etc/krb5.conf etc/krb5.conf.heimdal
  touch var/adm/fillup-templates/heimdal-update
  if [ -e etc/krb5.keytab ]
  then
    echo "backup /etc/krb5.keytab to /etc/krb5.keytab.heimdal"
    mv etc/krb5.keytab etc/krb5.keytab.heimdal
  fi
fi

%post 
/sbin/ldconfig
if [ -e var/adm/fillup-templates/heimdal-update ]
then
  /usr/lib/mit/helper/simple_convert_krb5conf.pl
  rm -f /var/adm/fillup-templates/heimdal-update
fi
if [ ! -e etc/krb5.conf -a -e etc/krb5.conf.rpmnew ]
then
  echo "moving /etc/krb5.conf.rpmnew to /etc/krb5.conf"
  mv etc/krb5.conf.rpmnew etc/krb5.conf
fi

%postun 
/sbin/ldconfig
#####################################################
# krb5-server preun/postun
#####################################################

%preun server
%stop_on_removal krb5kdc kadmind kpropd krb524d

%postun server
%restart_on_update krb5kdc kadmind kpropd krb524d
%{insserv_cleanup}

%clean
rm -rf %{buildroot}
########################################################
# files sections
########################################################

%files
%defattr(-,root,root)
%dir %{krb5docdir}
# add plugin directories
%dir %{_libdir}/krb5
%dir %{_libdir}/krb5/plugins
%dir %{_libdir}/krb5/plugins/kdb
%dir %{_libdir}/krb5/plugins/preauth
%dir %{_libdir}/krb5/plugins/libkrb5
%dir /usr/lib/mit/helper
# add log directory
%attr(0700,root,root) %dir /var/log/krb5
%doc %{krb5docdir}/README 
/usr/lib/mit/helper/simple_convert_krb5conf.pl
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/krb5.conf
%attr(0644,root,root) %config /etc/profile.d/krb5*
%{_libdir}/lib*.so.*
%{_libdir}/libgssapi_krb5.so

%files server
%defattr(-,root,root)
%config(noreplace) %{_sysconfdir}/logrotate.d/krb5-server
%{_sysconfdir}/init.d/kadmind
%{_sysconfdir}/init.d/krb5kdc
%{_sysconfdir}/init.d/kpropd
%{_sysconfdir}/init.d/krb524d
%dir %{krb5docdir}
%dir /usr/lib/mit
%dir /usr/lib/mit/sbin
%dir /usr/lib/mit/helper
%dir %{_localstatedir}/lib/kerberos/
%dir %{_localstatedir}/lib/kerberos/krb5kdc
%dir %{_libdir}/krb5
%dir %{_libdir}/krb5/plugins
%dir %{_libdir}/krb5/plugins/kdb
%doc %{krb5docdir}/README.ConvertHeimdalMIT
%attr(0600,root,root) %config(noreplace) %{_localstatedir}/lib/kerberos/krb5kdc/kdc.conf
%attr(0600,root,root) %config(noreplace) %{_localstatedir}/lib/kerberos/krb5kdc/kadm5.acl
%attr(0600,root,root) %config(noreplace) %{_localstatedir}/lib/kerberos/krb5kdc/kadm5.dict
/usr/bin/rc*
/usr/lib/mit/sbin/kadmin.local
/usr/lib/mit/sbin/kadmind
/usr/lib/mit/sbin/kpropd
/usr/lib/mit/sbin/kprop
/usr/lib/mit/sbin/kdb5_util
/usr/lib/mit/sbin/krb5kdc
/usr/lib/mit/sbin/krb524d
/usr/lib/mit/sbin/EncryptWithMasterKey
/usr/lib/mit/helper/heimdal2mit-DumpConvert.pl
%{_libdir}/krb5/plugins/kdb/*.so
%{_mandir}/man5/kdc.conf.5*
%{_mandir}/man8/kadmind.8*
%{_mandir}/man8/kadmin.local.8*
%{_mandir}/man8/kpropd.8*
%{_mandir}/man8/kprop.8*
%{_mandir}/man8/kdb5_util.8*
%{_mandir}/man8/krb5kdc.8*
%{_mandir}/man8/krb524d.8*
/etc/sysconfig/SuSEfirewall2.d/services/k*

%files client
%defattr(-,root,root)
%dir /usr/lib/mit
%dir /usr/lib/mit/bin
%dir /usr/lib/mit/sbin
/usr/lib/mit/bin/kvno
/usr/lib/mit/bin/kinit
/usr/lib/mit/bin/kdestroy
/usr/lib/mit/bin/kpasswd
/usr/lib/mit/bin/klist
/usr/lib/mit/bin/krb524init
/usr/lib/mit/sbin/kadmin
/usr/lib/mit/sbin/ktutil
/usr/lib/mit/sbin/k5srvutil
/usr/bin/kinit
/usr/bin/klist
%{_mandir}/man1/kvno.1*
%{_mandir}/man1/kinit.1*
%{_mandir}/man1/krb524init.1*
%{_mandir}/man1/kdestroy.1*
%{_mandir}/man1/kpasswd.1*
%{_mandir}/man1/klist.1*
%{_mandir}/man1/kerberos.1*
%{_mandir}/man5/krb5.conf.5*
%{_mandir}/man5/.k5login.5*
%{_mandir}/man8/kadmin.8*
%{_mandir}/man8/ktutil.8*
%{_mandir}/man8/k5srvutil.8*

%files apps-servers
%defattr(-,root,root)
%config(noreplace) %{_sysconfdir}/xinetd.d/klogin
%config(noreplace) %{_sysconfdir}/xinetd.d/eklogin
%config(noreplace) %{_sysconfdir}/xinetd.d/kshell
%config(noreplace) %{_sysconfdir}/xinetd.d/ktelnet
%dir /usr/lib/mit
%dir /usr/lib/mit/sbin
/usr/lib/mit/sbin/ftpd
/usr/lib/mit/sbin/klogind
/usr/lib/mit/sbin/kshd
/usr/lib/mit/sbin/telnetd
/usr/lib/mit/sbin/uuserver
/usr/lib/mit/sbin/sserver
/usr/lib/mit/sbin/gss-server
/usr/lib/mit/sbin/sim_server
/usr/lib/mit/sbin/login.krb5
%{_mandir}/man8/kftpd.8*
%{_mandir}/man8/klogind.8*
%{_mandir}/man8/kshd.8*
%{_mandir}/man8/ktelnetd.8*
%{_mandir}/man8/sserver.8*
%{_mandir}/man8/login.krb5.8*

%files apps-clients
%defattr(-,root,root)
%dir /usr/lib/mit
%dir /usr/lib/mit/bin
/usr/lib/mit/bin/ftp
/usr/lib/mit/bin/rlogin
# removed SUID bit, we will rely on su + pam_krb
%attr(0755,root,root) /usr/lib/mit/bin/ksu
/usr/lib/mit/bin/rcp
/usr/lib/mit/bin/rsh
/usr/lib/mit/bin/telnet
/usr/lib/mit/bin/uuclient
/usr/lib/mit/bin/sclient
/usr/lib/mit/bin/gss-client
/usr/lib/mit/bin/sim_client
# removed SUID bit
%attr(0755,root,root)/usr/lib/mit/bin/v4rcp
%{_mandir}/man1/kftp.1*
%{_mandir}/man1/krlogin.1*
%{_mandir}/man1/krsh.1*
%{_mandir}/man1/ktelnet.1*
%{_mandir}/man1/ksu.1*
%{_mandir}/man1/krcp.1*
%{_mandir}/man1/v4rcp.1*
%{_mandir}/man1/sclient.1*

%files devel
%defattr(-,root,root)
%dir /usr/lib/mit
%dir /usr/lib/mit/bin
%dir /usr/lib/mit/sbin
/usr/lib/mit/bin/krb5-config
%{_libdir}/libdes425.so
%{_libdir}/libgssrpc.so
%{_libdir}/libk5crypto.so
%{_libdir}/libkadm5clnt.so
%{_libdir}/libkadm5srv.so
%{_libdir}/libkdb5.so
%{_libdir}/libkrb4.so
%{_libdir}/libkrb5.so
%{_libdir}/libkrb5support.so
%{_includedir}/*
/usr/lib/mit/sbin/krb5-send-pr
%{_mandir}/man1/krb5-send-pr.1*
%{_mandir}/man1/krb5-config.1*

%changelog
* Mon Jul 28 2008 mc@suse.de
- add new fixes to post 1.6.3 patch
  * fix mem leak in krb5_gss_accept_sec_context()
  * keep minor_status
  * kadm5_decrypt_key: A ktype of -1 is documented as meaning
  "to be ignored"
  * Reject socket fds > FD_SETSIZE
* Fri Jul 25 2008 mc@suse.de
- add patches from SVN post 1.6.3
  * krb5_string_to_keysalts: Fix an infinite loop
  * fix some mutex issues
  * better recovery from corrupt rcache files
  * some more small fixes
* Wed Jun 18 2008 mc@suse.de
- add case-insensitive.dif (FATE#300771)
- minor fixes for ktutil man page
- reduce rpmlint warnings
* Wed May 14 2008 mc@suse.de
- Fall back to TCP on kdc-unresolvable/unreachable errors.
- restore valid sequence number before generating requests
  (fix changing passwords in mixed ipv4/ipv6 enviroments)
* Thu Apr 10 2008 ro@suse.de
- added baselibs.conf file to build xxbit packages
  for multilib support
* Wed Apr 09 2008 mc@suse.de
- modify krb5-config to not output rpath and cflags in --libs
  (bnc#378270)
* Fri Mar 14 2008 mc@suse.de
- fix two security bugs:
  * MITKRB5-SA-2008-001(CVE-2008-0062, CVE-2008-0063)
  fix double free [bnc#361373]
  * MITKRB5-SA-2008-002(CVE-2008-0947, CVE-2008-0948)
  Memory corruption while too many open file descriptors
  [bnc#363151]
- change default config file. Comment out the examples.
* Fri Dec 14 2007 mc@suse.de
- fix several security bugs:
  * CVE-2007-5894 apparent uninit length
  * CVE-2007-5902 integer overflow
  * CVE-2007-5971 free of non-heap pointer and double-free
  * CVE-2007-5972 double fclose()
  [#346745, #346748, #346746, #346749, #346747]
* Tue Dec 04 2007 mc@suse.de
- improve GSSAPI error messages
* Tue Nov 06 2007 mc@suse.de
- add coreutils to PreReq
* Tue Oct 23 2007 mc@suse.de
- update to krb5 version 1.6.3
  * fix CVE-2007-3999, CVE-2007-4743 svc_auth_gss.c buffer overflow
  * fix CVE-2007-4000 modify_policy vulnerability
  * Add PKINIT support
- remove patches which are upstream now
- enhance init scripts and xinetd profiles
* Fri Sep 14 2007 mc@suse.de
- update krb5-1.6.2-post.dif
  * If a KDC returns KDC_ERR_SVC_UNAVAILABLE, it appears that
  that the client library will not failover to the next KDC.
  [#310540]
* Tue Sep 11 2007 mc@suse.de
- update krb5-1.6.2-post.dif
  * new -S sname option for kvno
  * read_entropy_from_device on partial read will not fill buffer
  * Bail out if encoded "ticket" doesn't decode correctly.
  * patch for referrals loop
* Thu Sep 06 2007 mc@suse.de
- fix a problem with the originally published patch
  for MITKRB5-SA-2007-006 - CVE-2007-3999
  [#302377]
* Wed Sep 05 2007 mc@suse.de
- fix execute arbitrary code
  (MITKRB5-SA-2007-006 - CVE-2007-3999,2007-4000)
  [#302377]
* Tue Aug 07 2007 mc@suse.de
- add krb5-1.6.2-post.dif
  * during the referrals loop, check to see if the
  session key enctype of a returned credential for the final
  service is among the enctypes explicitly selected by the
  application, and retry with old_use_conf_ktypes if it is not.
  * If mkstemp() is available, the new ccache file gets created but
  the subsequent open(O_CREAT|O_EXCL) call fails because the file
  was already created by mkstemp(). Apply patch from Apple to keep
  the file descriptor open.
* Thu Jul 12 2007 mc@suse.de
- update to version 1.6.2
- remove krb5-1.6.1-post.dif all fixes are included in this release
* Thu Jul 05 2007 mc@suse.de
- change requires to libcom_err-devel
* Mon Jul 02 2007 mc@suse.de
- update krb5-1.6.1-post.dif
  * fix leak in krb5_walk_realm_tree
  * rd_req_decoded needs to deal with referral realms
  * fix buffer overflow in kadmind
  (MITKRB5-SA-2007-005 - CVE-2007-2798)
  [#278689]
  * fix kadmind code execution bug
  (MITKRB5-SA-2007-004 - CVE-2007-2442 - CVE-2007-2443)
  [#271191]
* Thu Jun 14 2007 mc@suse.de
- fix unstripped-binary-or-object rpmlint warning
* Mon Jun 11 2007 sschober@suse.de
- fixing rpmlint warnings and errors:
  * merged logrotate scripts kadmin and krb5kdc into a single file
  krb5-server.
  * moved heimdal2mit-DumpConvert.pl and simple_convert_krb5conf.pl
  from /usr/share/doc/packages/krb5 to /usr/lib/mit/helper.
  adapted krb5.spec and README.ConvertHeimdalMIT accordingly.
  * added surpression filter for
  "devel-file-in-non-devel-package /usr/lib/libgssapi_krb5.so"
  (see [#147912]).
  * set default runlevel of init scripts in chkconfig line to 3 and
  5
* Wed May 09 2007 mc@suse.de
- fix uninitialized salt length
- add extra check for keytab file
* Thu May 03 2007 mc@suse.de
- adding krb5-1.6.1-post.dif
  * fix segfault in krb5_get_init_creds_password
  * remove debug output in ftp client
  * profile stores empty string values without double quotes
* Mon Apr 23 2007 mc@suse.de
- update to final 1.6.1 version
* Wed Apr 18 2007 mc@suse.de
- add plugin directories to main package
* Mon Apr 16 2007 mc@suse.de
- update to version 1.6.1 Beta1
- remove obsolete patches
  (krb5-1.6-post.dif, krb5-1.6-patchlevel.dif)
- rework compile_pie patch
* Wed Apr 11 2007 mc@suse.de
- update krb5-1.6-post.dif
  * fix kadmind stack overflow in krb5_klog_syslog
  (MITKRB5-SA-2007-002 - CVE-2007-0957)
  [#253548]
  * fix double free attack in the RPC library
  (MITKRB5-SA-2007-003 - CVE-2007-1216)
  [#252487]
  * fix krb5 telnetd login injection
  (MIT-SA-2007-001 - CVE-2007-0956)
  [#247765]
* Thu Mar 29 2007 mc@suse.de
- add ncurses-devel and bison to BuildRequires
- rework some patches
* Mon Mar 05 2007 mc@suse.de
- move SuSEFirewall service definitions to
  /etc/sysconfig/SuSEfirewall2.d/services
* Thu Feb 22 2007 mc@suse.de
- add firewall definition to krb5-server, FATE #300687
* Mon Feb 19 2007 mc@suse.de
- update krb5-1.6-post.dif
- move some applications into the right package
* Fri Feb 09 2007 mc@suse.de
- update krb5-1.6-post.dif
* Mon Jan 29 2007 mc@suse.de
- krb5-1.6-fix-passwd-tcp.dif and krb5-1.6-fix-sendto_kdc-memset.dif
  are now upstream. Remove patches.
- fix leak in krb5_kt_resolve and krb5_kt_wresolve
* Tue Jan 23 2007 mc@suse.de
- fix "local variable used before set" in ftp.c
  [#237684]
* Mon Jan 22 2007 mc@suse.de
- krb5-devel should require keyutils-devel
* Mon Jan 22 2007 mc@suse.de
- update to version 1.6
  * Major changes in 1.6 include
  * Partial client implementation to handle server name referrals.
  * Pre-authentication plug-in framework, donated by Red Hat.
  * LDAP KDB plug-in, donated by Novell.
- remove obsolete patches
* Wed Jan 10 2007 mc@suse.de
- fix for
  kadmind (via RPC library) calls uninitialized function pointer
  (CVE-2006-6143)(Bug #225990)
  krb5-1.5-MITKRB5-SA-2006-002-fix-code-exec.dif
- fix for
  kadmind (via GSS-API mechglue) frees uninitialized pointers
  (CVE-2006-6144)(Bug #225992)
  krb5-1.5-MITKRB5-SA-2006-003-fix-free-of-uninitialized-pointer.dif
* Tue Jan 02 2007 mc@suse.de
- Fix Requires in krb5-devel
  [Bug #231008]
* Mon Nov 06 2006 mc@suse.de
- fix "local variable used before set" [#217692]
- fix strncat warning
* Fri Oct 27 2006 mc@suse.de
- add a default kadm5.dict file
- require $network on daemon start
* Wed Sep 13 2006 mc@suse.de
- fix function call with too few arguments [#203837]
* Thu Aug 24 2006 mc@suse.de
- update to version 1.5.1
- remove obsolete patches which are now included upstream
  * krb5-1.4.3-MITKRB5-SA-2006-001-setuid-return-checks.dif
  * trunk-fix-uninitialized-vars.dif
* Fri Aug 11 2006 mc@suse.de
- krb5 setuid return check fixes
  krb5-1.4.3-MITKRB5-SA-2006-001-setuid-return-checks.dif
  [#182351]
* Mon Aug 07 2006 mc@suse.de
- remove update-messages
* Mon Jul 24 2006 mc@suse.de
- add check for krb5_prop in services to kpropd init script.
  [#192446]
* Mon Jul 03 2006 mc@suse.de
- update to version 1.5
  * KDB abstraction layer, donated by Novell.
  * plug-in architecture, allowing for extension modules to be
  loaded at run-time.
  * multi-mechanism GSS-API implementation ("mechglue"),
  donated by Sun Microsystems
  * Simple and Protected GSS-API negotiation mechanism ("SPNEGO")
  implementation, donated by Sun Microsystems
- remove obsolete patches and add some new
* Fri May 26 2006 ro@suse.de
- libcom is not in e2fsck-devel but in its own package now, change
  Requires accordingly.
* Mon Mar 27 2006 mc@suse.de
- add all daemons to %%stop_on_removal and %%restart_on_update
- add reload to kpropd init script
- add force-reload to all init scripts
* Mon Mar 13 2006 mc@suse.de
- add libgssapi_krb5.so link to main package [#147912]
* Fri Feb 03 2006 mc@suse.de
- fix logging section for kadmind in convert script
* Wed Jan 25 2006 mls@suse.de
- converted neededforbuild to BuildRequires
* Fri Jan 13 2006 mc@suse.de
- change the logging defaults
* Wed Jan 11 2006 mc@suse.de
- add tools and README for heimdal => MIT update
* Mon Jan 09 2006 mc@suse.de
- fix build problems, define _GNU_SOURCE
  (krb5-1.4.3-set_gnu_source.dif )
* Tue Jan 03 2006 mc@suse.de
- added "make %%{?jobs:-j%%jobs}"
* Fri Nov 18 2005 mc@suse.de
- update to version 1.4.3
  * some memmory leaks fixed
  * fix for "AS_REP padata has wrong enctype"
  * fix for "AS_REP padata missing PA-ETYPE-INFO"
  * ... and more
* Wed Nov 02 2005 dmueller@suse.de
- don't build as root
* Tue Oct 11 2005 mc@suse.de
- update to version 1.4.2
- remove some obsolet patches
* Mon Aug 08 2005 mc@suse.de
- build with --disable-static
* Thu Aug 04 2005 ro@suse.de
- remove devel-static subpackage
* Thu Jun 30 2005 mc@suse.de
- better patch for princ_comp problem
* Mon Jun 27 2005 mc@suse.de
- update to version 1.4.1
- remove obsolet patches
  - krb5-1.4-gcc4.dif
  - krb5-1.4-reduce-namespace-polution.dif
  - krb5-1.4-VUL-0-telnet.dif
* Thu Jun 23 2005 mc@suse.de
- fixed krb5 KDC heap corruption by random free
  [#80574, CAN-2005-1174, MITKRB5-SA-2005-002]
- fixed krb5 double free()
  [#86768, CAN-2005-1689, MITKRB5-SA-2005-003]
- fix krb5 NULL pointer reference while comparing principals
  [#91600]
* Fri Jun 17 2005 mc@suse.de
- fix uninitialized variables
- compile with -fPIE/ link with -pie
* Wed Apr 20 2005 mc@suse.de
- fixed wrong xinetd files [#77149]
* Fri Apr 08 2005 mt@suse.de
- removed krb5-1.4-fix-error_tables.dif patch obsoleted
  by libcom_err locking patches
* Thu Apr 07 2005 mc@suse.de
- fixed missing descriptions in init files
  [#76164, #76165, #76166, #76169]
* Wed Mar 30 2005 mc@suse.de
- enhance $PATH via /etc/profile.d/ [#74018]
- remove the "links to important programs"
* Fri Mar 18 2005 mc@suse.de
- fixed not running converter script [#72854]
* Thu Mar 17 2005 mc@suse.de
- Fix CAN-2005-0469: Multiple Telnet Client slc_add_reply() Buffer
  Overflow
- Fix CAN-2005-0468: Multiple Telnet Client env_opt_add() Buffer
  Overflow
  [#73618]
* Wed Mar 16 2005 mc@suse.de
- fixed wrong PreReqs [#73020]
* Tue Mar 15 2005 mc@suse.de
- add a simple krb5.conf converter [#72854]
* Mon Mar 14 2005 mc@suse.de
- fixed: rckrb5kdc restart gives wrong status with non-running service
  [#72446]
* Thu Mar 10 2005 mc@suse.de
- add requires: e2fsprogs-devel to krb5-devel package [#71732]
* Fri Feb 25 2005 mc@suse.de
- fix double free [#66534]
  krb5-1.4-fix-error_tables.dif
* Fri Feb 11 2005 mc@suse.de
- change mode for shared libraries to 755
* Fri Feb 04 2005 mc@suse.de
- remove spx.c from tarball because of legal risk
- add README.Source which tell the user about this
  action.
- add a check for spx.c in the spec-file
- use rich-text for update-messages [#50250]
* Tue Feb 01 2005 mc@suse.de
- add krb5-1.4-reduce-namespace-polution.dif
  reduce namespace polution in gssapi.h [#50356]
* Fri Jan 28 2005 mc@suse.de
- update to version 1.4
- Add implementation of the RPCSEC_GSS authentication flavor to the
  RPC library.
- Thread safety for krb5 libraries.
- Merged Athena telnetd changes for creating a new option for
  requiring encryption.
- The kadmind4 backwards-compatibility admin server and the v5passwdd
  backwards-compatibility password-changing server have been removed.
- Yarrow code now uses AES.
- Merged Athena changes to allow ftpd to require encrypted passwords.
- Incorporate gss_krb5_set_allowable_enctypes() and
  gss_krb5_export_lucid_sec_context(), which are needed for NFSv4.
- remove obsolet patches
* Mon Jan 17 2005 mc@suse.de
- add proofreaded update-messages
* Fri Jan 14 2005 mc@suse.de
- remove Conflicts: and add Provides:
- add some insserv stuff
* Thu Jan 13 2005 mc@suse.de
- move vendor files to vendor-files.tar.bz2
- add obsoletes: heimdal
- add %%pre and %%post sections to detect update
  from heimdal and backup invalid configuration files
- add update-messages for heimdal update
* Mon Jan 10 2005 mc@suse.de
- update to version 1.3.6
- fix for: heap buffer overflow in libkadm5srv
  [CAN-2004-1189 / MITKRB5-SA-2004-004]
* Tue Dec 14 2004 mc@suse.de
- build doc subpackage in an own specfile
- removed unnecessary neededforbuild requirements
* Wed Nov 24 2004 coolo@suse.de
- fix build with gcc 4
* Mon Nov 15 2004 mc@suse.de
- added Conflicts with heimdal*
- rename some manpages to avoid conflicts
* Thu Nov 04 2004 mc@suse.de
- new init scripts
- fix logrotate scripts
- add some 64Bit fixes
- add default krb5.conf, kdc.conf and kadm5.acl
* Wed Nov 03 2004 mc@suse.de
- add e2fsprogs to NFB
- use system-et and system-ss
- fix includes of com_err.h
* Thu Oct 28 2004 mc@suse.de
- Initital checkin