Changeset 1807

Timestamp:

Apr 16, 2011, 7:59:42 PM (14 years ago)

Author:

achernya

Message:

Necessary changes to build the Scripts RPMs on Fedora 15:

 * Stop scriptsifying 389-ds-base, as it appears to have Mitch's patch
 * Update krb5.spec.patch for krb5-1.9
 * Update the krb5-kuserok-scripts.patch to work with krb5-1.9 (code
   review requested)
 * Update httpd.spec.patch to apply properly to Fedora's newly
   cleaned-up httpd.spec
 * Bump zephyr to version 3.0.1
 

Location:

branches/fc15-dev/server

Files:

• common/patches/krb5-kuserok-scripts.patch (modified) (3 diffs)
• fedora/Makefile (modified) (2 diffs)
• fedora/specs/389-ds-base.spec.patch (deleted)
• fedora/specs/httpd.spec.patch (modified) (4 diffs)
• fedora/specs/krb5.spec.patch (modified) (3 diffs)
• fedora/specs/scripts-base.spec (modified) (1 diff)
• fedora/specs/zephyr.spec (modified) (2 diffs)

branches/fc15-dev/server/common/patches/krb5-kuserok-scripts.patch

@@ -1 +1 @@
 # scripts.mit.edu krb5 kuserok patch
 # Copyright (C) 2006  Tim Abbott <tabbott@mit.edu>
+#               2011  Alexander Chernyakhovsky <achernya@mit.edu>
 #
 # This program is free software; you can redistribute it and/or
@@ -18 +19 @@
 # See /COPYRIGHT in this repository for more information.
 #
---- krb5-1.6.3/src/lib/krb5/os/kuserok.c.old    2009-04-08 06:17:06.000000000 -0400
-+++ krb5-1.6.3/src/lib/krb5/os/kuserok.c        2009-04-08 06:17:18.000000000 -0400
-@@ -31,6 +31,7 @@
- #if !defined(_WIN32)           /* Not yet for Windows */
+--- krb5-1.9/src/lib/krb5/os/kuserok.c.old      2011-04-16 19:09:58.000000000 -0400
++++ krb5-1.9/src/lib/krb5/os/kuserok.c  2011-04-16 19:34:23.000000000 -0400
+@@ -32,6 +32,7 @@
+ #if !defined(_WIN32)            /* Not yet for Windows */
  #include <stdio.h>
  #include <pwd.h>
@@ -28 +29 @@
  #if defined(_AIX) && defined(_IBMR2)
  #include <sys/access.h>
-@@ -71,7 +72,6 @@
- {
+@@ -100,6 +101,7 @@
      struct stat sbuf;
-     struct passwd *pwd;
--    char pbuf[MAXPATHLEN];
-     krb5_boolean isok = FALSE;
-     FILE *fp;
-     char kuser[MAX_USERNAME];
-@@ -79,71 +79,35 @@
-     char linebuf[BUFSIZ];
-     char *newline;
-     int gobble;
+     struct passwd pwx, *pwd;
+     FILE *fp = NULL;
 +    int pid, status;
  
-     /* no account => no access */
-     char pwbuf[BUFSIZ];
-     struct passwd pwx;
+     if (profile_get_boolean(context->profile, KRB5_CONF_LIBDEFAULTS,
+                             KRB5_CONF_K5LOGIN_AUTHORITATIVE, NULL, TRUE,
+@@ -110,41 +112,27 @@
      if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
-        return(FALSE);
--    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
--    pbuf[sizeof(pbuf) - 1] = '\0';
--    (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));
+         goto cleanup;
+ 
+-    if (get_k5login_filename(context, luser, pwd->pw_dir, &filename) != 0)
+-        goto cleanup;
 -
--    if (access(pbuf, F_OK)) {   /* not accessible */
--       /*
--        * if he's trying to log in as himself, and there is no .k5login file,
--        * let him.  To find out, call
--        * krb5_aname_to_localname to convert the principal to a name
--        * which we can string compare. 
--        */
--       if (!(krb5_aname_to_localname(context, principal,
--                                     sizeof(kuser), kuser))
--           && (strcmp(kuser, luser) == 0)) {
--           return(TRUE);
--       }
+-    if (access(filename, F_OK) != 0) {
+-        result = PASS;
+-        goto cleanup;
 -    }
-     if (krb5_unparse_name(context, principal, &princname))
-        return(FALSE);                  /* no hope of matching */
+-
+     if (krb5_unparse_name(context, principal, &princname) != 0)
+         goto cleanup;
  
--    /* open ~/.k5login */
--    if ((fp = fopen(pbuf, "r")) == NULL) {
--       free(princname);
--       return(FALSE);
--    }
+-    fp = fopen(filename, "r");
+-    if (fp == NULL)
++    if ((pid = fork()) == -1)
+         goto cleanup;
 -    set_cloexec_file(fp);
--    /*
--     * For security reasons, the .k5login file must be owned either by
--     * the user himself, or by root.  Otherwise, don't grant access.
--     */
--    if (fstat(fileno(fp), &sbuf)) {
--       fclose(fp);
--       free(princname);
--       return(FALSE);
-+    if ((pid = fork()) == -1) {
-+       free(princname);
-+       return(FALSE);
+-
+-    /* For security reasons, the .k5login file must be owned either by
+-     * the user or by root. */
+-    if (fstat(fileno(fp), &sbuf))
+-        goto cleanup;
+-    if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid))
+-        goto cleanup;
+-
+-    /* Check each line. */
+-    while (result != ACCEPT && (fgets(linebuf, sizeof(linebuf), fp) != NULL)) {
+-        newline = strrchr(linebuf, '\n');
+-        if (newline != NULL)
+-            *newline = '\0';
+-        if (strcmp(linebuf, princname) == 0)
+-            result = ACCEPT;
+-        /* Clean up the rest of the line if necessary. */
+-        if (newline == NULL)
+-            while (((gobble = getc(fp)) != EOF) && gobble != '\n');
++    
++    if (pid == 0) {
++        char *args[4];
++#define ADMOF_PATH "/usr/local/sbin/ssh-admof"
++        args[0] = ADMOF_PATH;
++        args[1] = (char *) luser;
++        args[2] = princname;
++        args[3] = NULL;
++        execv(ADMOF_PATH, args);
++        exit(1);
      }
--    if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) {
--       fclose(fp);
--       free(princname);
--       return(FALSE);
-+    if (pid == 0) {
-+       char *args[4];
-+#define ADMOF_PATH "/usr/local/sbin/ssh-admof"
-+       args[0] = ADMOF_PATH;
-+       args[1] = (char *) luser;
-+       args[2] = princname;
-+       args[3] = NULL;
-+       execv(ADMOF_PATH, args);
-+       exit(1);
-     }
--
--    /* check each line */
--    while (!isok && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
--       /* null-terminate the input string */
--       linebuf[BUFSIZ-1] = '\0';
--       newline = NULL;
--       /* nuke the newline if it exists */
--       if ((newline = strchr(linebuf, '\n')))
--           *newline = '\0';
--       if (!strcmp(linebuf, princname)) {
--           isok = TRUE;
--           continue;
--       }
--       /* clean up the rest of the line if necessary */
--       if (!newline)
--           while (((gobble = getc(fp)) != EOF) && gobble != '\n');
+ 
 +    if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) {
-+       isok=TRUE;
-     }
++        result = ACCEPT;
++    }
 +    
+ cleanup:
      free(princname);
--    fclose(fp);
-     return(isok);
- }
- 
+     free(filename);

branches/fc15-dev/server/fedora/Makefile

@@ -19 +19 @@
 # See /COPYRIGHT in this repository for more information.
 
-upstream_yum    = krb5 krb5.i686 httpd openssh 389-ds-base
+upstream_yum    = krb5 krb5.i686 httpd openssh
 hackage         = MonadCatchIO-mtl-0.3.0.1 cgi-3001.1.8.1 unix-handle-0.0.0
 upstream_hackage = ghc-MonadCatchIO-mtl ghc-cgi ghc-unix-handle
@@ -45 +45 @@
 heartbeat_url   = "http://kojipkgs.fedoraproject.org/packages/heartbeat/3.0.0/0.5.0daab7da36a8.hg.fc12/src/heartbeat-3.0.0-0.5.0daab7da36a8.hg.fc12.src.rpm"
 pacemaker_url   = "http://kojipkgs.fedoraproject.org/packages/pacemaker/1.0.5/5.fc12/src/pacemaker-1.0.5-5.fc12.src.rpm"
-zephyr_url      = "http://zephyr.1ts.org/export/HEAD/distribution/zephyr-3.0.tar.gz"
+zephyr_url      = "http://zephyr.1ts.org/export/HEAD/distribution/zephyr-3.0.1.tar.gz"
 
 PKG             = $(patsubst %.i686,%,$@)

branches/fc15-dev/server/fedora/specs/httpd.spec.patch

@@ -1 +1 @@
 --- httpd.spec.orig     2010-10-27 08:26:15.000000000 -0400
 +++ httpd.spec  2010-11-18 18:20:43.000000000 -0500
-@@ -7,7 +7,7 @@
+@@ -8,7 +8,7 @@
  Summary: Apache HTTP Server
  Name: httpd
  Version: 2.2.17
--Release: 1%{?dist}.1
-+Release: 1%{?dist}.1.scripts.%{scriptsversion}
+-Release: 10%{?dist}.1
++Release: 10%{?dist}.1.scripts.%{scriptsversion}
  URL: http://httpd.apache.org/
  Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
  Source1: index.html
-@@ -55,6 +55,14 @@
- Conflicts: pcre < 4.0
- Requires: httpd-tools = %{version}-%{release}, apr-util-ldap
+@@ -54,6 +54,14 @@
+ Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
+ Requires: httpd-tools = %{version}-%{release}, apr-util-ldap, systemd-units
  
 +Provides: scripts-httpd
@@ -25 +25 @@
  The Apache HTTP Server is a powerful, efficient, and extensible
  web server.
-@@ -65,6 +73,7 @@
+@@ -64,6 +72,7 @@
  Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel
  Requires: apr-devel, apr-util-devel, pkgconfig
@@ -33 +33 @@
  %description devel
  The httpd-devel package contains the APXS binary and other files
-@@ -103,6 +112,7 @@
- Requires(post): openssl >= 0.9.7f-4, /bin/cat
+@@ -102,6 +102,7 @@
+ Requires(post): openssl, /bin/cat
  Requires(pre): httpd
- Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmn}
+ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 +Provides: scripts-mod_ssl
  Obsoletes: stronghold-mod_ssl
  
  %description -n mod_ssl
-@@ -130,6 +140,13 @@
+@@ -129,6 +139,13 @@
  # Patch in vendor/release string
  sed "s/@RELEASE@/%{vstring}/" < %{PATCH20} | patch -p1
@@ -55 +55 @@
  vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
  if test "x${vmmn}" != "x%{mmn}"; then
-@@ -177,10 +194,12 @@
+@@ -176,10 +193,12 @@
          --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
         --enable-suexec --with-suexec \

branches/fc15-dev/server/fedora/specs/krb5.spec.patch

@@ -1 +1 @@
 --- krb5.spec.orig      2011-03-25 17:29:24.000000000 -0400
 +++ krb5.spec   2011-03-25 17:31:15.000000000 -0400
-@@ -10,7 +10,7 @@
+@@ -6,7 +6,7 @@
  Summary: The Kerberos network authentication system
  Name: krb5
- Version: 1.7.1
--Release: 18%{?dist}
-+Release: 18%{?dist}.scripts.%{scriptsversion}
+ Version: 1.9
+-Release: 6%{?dist}
++Release: 6%{?dist}.scripts.%{scriptsversion}
  # Maybe we should explode from the now-available-to-everybody tarball instead?
- # http://web.mit.edu/kerberos/dist/krb5/1.7/krb5-1.7.1-signed.tar
+ # http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9-signed.tar
  Source0: krb5-%{version}.tar.gz
-@@ -96,6 +96,8 @@
- Patch107: http://web.mit.edu/kerberos/advisories/2011-002-patch.txt
- Patch108: http://web.mit.edu/kerberos/advisories/2011-003-patch.txt
+@@ -53,6 +53,8 @@
+ Patch74: http://web.mit.edu/kerberos/advisories/2011-002-patch.txt
+ Patch75: http://web.mit.edu/kerberos/advisories/2011-003-patch.txt
  
 +Patch1000: krb5-kuserok-scripts.patch
@@ -19 +19 @@
  URL: http://web.mit.edu/kerberos/www/
  Group: System Environment/Libraries
-@@ -140,6 +142,7 @@
+@@ -97,6 +99,7 @@
  %package libs
  Summary: The shared libraries used by Kerberos 5
@@ -27 +27 @@
  %description libs
  Kerberos is a network authentication system. The krb5-libs package
-@@ -1684,6 +1687,7 @@
- %patch106 -p1 -b .2011-001
- %patch107 -p1 -b .2011-002
- %patch108 -p1 -b .2011-003
+@@ -192,6 +195,7 @@
+ %patch73 -p1 -b .2011-001
+ %patch74 -p1 -b .2011-002
+ %patch75 -p1 -b .2011-003
 +%patch1000 -p1 -b .kuserok
  gzip doc/*.ps

branches/fc15-dev/server/fedora/specs/scripts-base.spec

@@ -31 +31 @@
 Requires: httpdmods
 Requires: %{all_archs nss_nonlocal}
-Requires: scripts-389-ds
 %define debug_package %{nil}
 

branches/fc15-dev/server/fedora/specs/zephyr.spec

@@ -1 +1 @@
 Name:           zephyr
-Version:        3.0
+Version:        3.0.1
 Release:        0.%{scriptsversion}%{?dist}
 Summary:        Client programs for the Zephyr real-time messaging system
@@ -139 +139 @@
 
 %changelog
+* Sat Apr 16 2011 Alexander Chernyakhovsky <achernya@mit.edu> 3.0.1-0
+- Zephyr 3.0.1
+
 * Sun Sep 19 2010 Anders Kaseorg <andersk@mit.edu> - 3.0-0
 - Decrease version below a hypothetical Fedora package.