243 lines
9.2 KiB
RPMSpec
243 lines
9.2 KiB
RPMSpec
|
Name: dehydrated
|
||
|
|
%define version 0.6.2
|
||
|
|
%define release 13
|
||
|
|
Version: %{version}
|
||
|
|
Release: %{release}%{?dist}
|
||
|
|
Summary: ACME client in bash
|
||
|
|
|
||
|
|
Group: Application/System
|
||
|
|
License: MIT
|
||
|
|
URL: https://github.com/lukas2511/dehydrated
|
||
|
|
#download released zip and prepend dehydrated- to name
|
||
|
|
Source0: dehydrated-%{version}.tar.gz
|
||
|
|
Source1: integration.tgz
|
||
|
|
|
||
|
|
BuildArch: noarch
|
||
|
|
BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
|
||
|
|
|
||
|
|
BuildRequires: httpd
|
||
|
|
Requires: openssl
|
||
|
|
Requires: sed
|
||
|
|
Requires: /bin/awk
|
||
|
|
Requires: curl
|
||
|
|
Requires: /bin/mktemp
|
||
|
|
|
||
|
|
Conflicts: letsencrypt.sh
|
||
|
|
Obsoletes: letsencrypt.sh
|
||
|
|
|
||
|
|
%if 0%{?fedora} >= 11 || 0%{?rhel} >= 5
|
||
|
|
%global useselinux 1
|
||
|
|
%else
|
||
|
|
%global useselinux 0
|
||
|
|
%endif
|
||
|
|
|
||
|
|
%description
|
||
|
|
This is a client for signing certificates with an ACME server
|
||
|
|
(currently only provided by Let's Encrypt) implemented as a
|
||
|
|
relatively simple bash-script.
|
||
|
|
|
||
|
|
%prep
|
||
|
|
#unpack source 1
|
||
|
|
%setup -n dehydrated-%{version}
|
||
|
|
# unpack integration package aka source 1; do not delete previous -D, and disable default unpacking -T
|
||
|
|
# this wil unpack the integration file in the previous unpacked dehydrated folder
|
||
|
|
%setup -T -D -a 1
|
||
|
|
|
||
|
|
%build
|
||
|
|
sed -i -e "s|#BASEDIR=.*|BASEDIR=%{_localstatedir}/lib/%{name}/certificates|" \
|
||
|
|
-e "s|#WELLKNOWN=.*|WELLKNOWN=%{_localstatedir}/lib/%{name}/challenges|" \
|
||
|
|
-e "s|#HOOK=.*|HOOK=%{_bindir}/le_hooks.sh|" \
|
||
|
|
-e "s|#DOMAINS_TXT=.*|DOMAINS_TXT=%{_sysconfdir}/%{name}/domains.txt|" \
|
||
|
|
docs/examples/config
|
||
|
|
|
||
|
|
%install
|
||
|
|
install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib/%{name}/challenges
|
||
|
|
install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib/%{name}/certificates
|
||
|
|
install -D dehydrated $RPM_BUILD_ROOT/%{_bindir}/%{name}
|
||
|
|
install integration/dehydrated_hooks $RPM_BUILD_ROOT/%{_bindir}/dehydrated_hooks
|
||
|
|
install integration/dehydrated_revoke $RPM_BUILD_ROOT/%{_bindir}/dehydrated_revoke
|
||
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_deploy_cert.d
|
||
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_clean_challenge.d
|
||
|
|
install -D -m 0644 integration/httpd.sh.sample $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_deploy_cert.d/10httpd.sh.sample
|
||
|
|
install -D -m 0644 docs/examples/config $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/config
|
||
|
|
install -D -m 0644 docs/examples/domains.txt $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/domains.txt
|
||
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/
|
||
|
|
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/%{name}
|
||
|
|
#!/bin/sh
|
||
|
|
# Uncomment to enable auto-renewal
|
||
|
|
# %{_bindir}/%{name} -c 2>&1 | awk '{ print strftime(), $0; fflush(); }' >> %{_localstatedir}/log/%{name}.log
|
||
|
|
|
||
|
|
# Uncomment this to auto revoke old certs
|
||
|
|
# %{_bindir}/dehydrated_revoke 2>&1 | awk '{ print strftime(), $0; fflush(); }' >> %{_localstatedir}/log/%{name}.log
|
||
|
|
|
||
|
|
_EOF
|
||
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d
|
||
|
|
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d/dehydrated.conf
|
||
|
|
|
||
|
|
Alias /.well-known/acme-challenge/ %{_localstatedir}/lib/%{name}/challenges/
|
||
|
|
|
||
|
|
<Directory %{_localstatedir}/lib/%{name}/challenges>
|
||
|
|
Options None
|
||
|
|
AllowOverride None
|
||
|
|
Header set Content-Type "application/jose+json"
|
||
|
|
<IfModule mod_authz_core.c>
|
||
|
|
# Apache 2.4
|
||
|
|
Require all granted
|
||
|
|
</IfModule>
|
||
|
|
<IfModule !mod_authz_core.c>
|
||
|
|
# Apache 2.2
|
||
|
|
Order deny,allow
|
||
|
|
Allow from all
|
||
|
|
</IfModule>
|
||
|
|
</Directory>
|
||
|
|
_EOF
|
||
|
|
install -d -m 750 $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d
|
||
|
|
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d/%{name}
|
||
|
|
/var/log/%{name}.log {
|
||
|
|
missingok
|
||
|
|
copytruncate
|
||
|
|
rotate 12
|
||
|
|
compress
|
||
|
|
weekly
|
||
|
|
create 0660 root root
|
||
|
|
}
|
||
|
|
_EOF
|
||
|
|
|
||
|
|
%post
|
||
|
|
%if %{useselinux}
|
||
|
|
(
|
||
|
|
# New File context
|
||
|
|
semanage fcontext -a -t var_lib_t "%{_localstatedir}/lib/dehydrated(/.*)?"
|
||
|
|
# files created by app
|
||
|
|
restorecon -R %{_localstatedir}/lib/dehydrated
|
||
|
|
) &>/dev/null || :
|
||
|
|
%endif
|
||
|
|
|
||
|
|
# Migrate from letsencrypt.sh
|
||
|
|
if [ -e %{_sysconfdir}/letsencrypt.sh/config ]; then
|
||
|
|
sed -e 's/letsencrypt.sh/dehydrated/g' \
|
||
|
|
-e 's/le_hooks.sh/dehydrated_hooks/g' \
|
||
|
|
%{_sysconfdir}/letsencrypt.sh/config > %{_sysconfdir}/%{name}/config
|
||
|
|
fi
|
||
|
|
if [ -e %{_sysconfdir}/letsencrypt.sh/domains.txt ]; then
|
||
|
|
cat %{_sysconfdir}/letsencrypt.sh/domains.txt > %{_sysconfdir}/%{name}/domains.txt
|
||
|
|
fi
|
||
|
|
if [ -d %{_localstatedir}/lib/letsencrypt.sh/certificates/certs ]; then
|
||
|
|
mv %{_localstatedir}/lib/letsencrypt.sh/certificates/* %{_localstatedir}/lib/%{name}/certificates/
|
||
|
|
fi
|
||
|
|
sed -i -e 's|%{_localstatedir}/lib/letsencrypt.sh|%{_localstatedir}/lib/%{name}|g' %{_sysconfdir}/httpd/conf.d/ssl.conf
|
||
|
|
if [ -d %{_sysconfdir}/letsencrypt.sh/hooks_deploy_cert.d/ ]; then
|
||
|
|
find %{_sysconfdir}/letsencrypt.sh/hooks_deploy_cert.d/ -type f -perm /111 -exec mv "{}" %{_sysconfdir}/%{name}/hooks_deploy_cert.d/ \;
|
||
|
|
fi
|
||
|
|
if [ -d %{_sysconfdir}/letsencrypt.sh/hooks_clean_challenge.d/ ]; then
|
||
|
|
find %{_sysconfdir}/letsencrypt.sh/hooks_clean_challenge.d/ -type f -perm /111 -exec mv "{}" %{_sysconfdir}/%{name}/hooks_clean_challenge.d/ \;
|
||
|
|
fi
|
||
|
|
|
||
|
|
%postun
|
||
|
|
%if %{useselinux}
|
||
|
|
if [ "$1" -eq "0" ]; then
|
||
|
|
# Remove the File Context
|
||
|
|
(
|
||
|
|
semanage fcontext -d "%{_localstatedir}/lib/dehydrated(/.*)?"
|
||
|
|
) &>/dev/null || :
|
||
|
|
fi
|
||
|
|
%endif
|
||
|
|
|
||
|
|
%files
|
||
|
|
%doc LICENSE README.md docs/examples/hook.sh
|
||
|
|
%dir %attr(0755,root,root) %{_sysconfdir}/%{name}/hooks_clean_challenge.d/
|
||
|
|
%attr(0644, root,root) %{_sysconfdir}/%{name}/hooks_deploy_cert.d/*
|
||
|
|
%config(noreplace) %{_sysconfdir}/%{name}/domains.txt
|
||
|
|
%config(noreplace) %{_sysconfdir}/%{name}/config
|
||
|
|
%config(noreplace) %attr(0755,root,root) %{_sysconfdir}/cron.daily/%{name}
|
||
|
|
%config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf
|
||
|
|
%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
|
||
|
|
%attr(0755,root,root) %{_bindir}/%{name}
|
||
|
|
%attr(0755,root,root) %{_bindir}/dehydrated_hooks
|
||
|
|
%attr(0755,root,root) %{_bindir}/dehydrated_revoke
|
||
|
|
%dir %attr(0750,root,apache) %{_localstatedir}/lib/%{name}/challenges
|
||
|
|
%dir %attr(0750,root,root) %{_localstatedir}/lib/%{name}/certificates
|
||
|
|
|
||
|
|
%changelog
|
||
|
|
* Wed Jul 12 2023 BogusDateBot
|
||
|
|
- Eliminated rpmbuild "bogus date" warnings due to inconsistent weekday,
|
||
|
|
by assuming the date is correct and changing the weekday.
|
||
|
|
|
||
|
|
* Thu May 03 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.6.2-13.sme
|
||
|
|
- upgrade to upstream version [SME: 10577]
|
||
|
|
|
||
|
|
* Wed Apr 11 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.6.1-12.sme
|
||
|
|
- upgrade to upstream version [SME: 10565]
|
||
|
|
|
||
|
|
* Fri Feb 16 2018 Jean-Philipe Pialasse <tests@pialasse.com> Version: 0.5.0-3.sme
|
||
|
|
- fix Dehydrated caused rate limits to be reached [SME: 10521]
|
||
|
|
|
||
|
|
* Fri Feb 16 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.5.0-1.sme
|
||
|
|
- upgrade to upstream version [SME: 10521]
|
||
|
|
|
||
|
|
* Fri Feb 10 2017 Jean-Philipe Pialasse <tests@pialasse.com> - 0.4.0-1.sme
|
||
|
|
- update architecture of sources and release/version number
|
||
|
|
- according to Charlie Brady recomendations
|
||
|
|
- see [SME 9901]
|
||
|
|
* Mon Feb 06 2017 Jean-Philipe Pialasse <tests@pialasse.com> - 0.4.0.20170205.git1163864.sme
|
||
|
|
- update dehydrated to 0.4 [SME: 10080]
|
||
|
|
- see https://github.com/lukas2511/dehydrated/releases/tag/v0.4.0
|
||
|
|
- upstream release Version 0.4.0 commit 116386486b3749e4c5e1b4da35904f30f8b2749b
|
||
|
|
|
||
|
|
* Fri Jan 06 2017 Jean-Philipe Pialasse <tests@pialasse.com> - 0.3.0.20160914.gitcaeed7d-4.sme
|
||
|
|
- Initial import in SME Server Buildsys [SME: 9901]
|
||
|
|
|
||
|
|
* Mon Oct 24 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-3
|
||
|
|
- Fix warning when installing dehydrated without upgrading from letsencrypt.sh
|
||
|
|
|
||
|
|
* Mon Sep 19 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-2
|
||
|
|
- Fix find command to work with older find versions (on el5), replace -executable with -perm /111
|
||
|
|
|
||
|
|
* Wed Sep 14 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-1
|
||
|
|
- Renamed to dehydrated
|
||
|
|
|
||
|
|
* Wed Aug 24 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160803.gitafabfff-2
|
||
|
|
- Set var_lib_t context to files
|
||
|
|
|
||
|
|
* Wed Aug 3 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160803.gitafabfff-1
|
||
|
|
- Update to git afabfff
|
||
|
|
|
||
|
|
* Mon Jun 6 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-4
|
||
|
|
- Default to enable HOOK in config
|
||
|
|
|
||
|
|
* Fri Jun 3 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-3
|
||
|
|
- Add missing exec permission on daily cronjob script
|
||
|
|
|
||
|
|
* Wed Jun 1 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-2
|
||
|
|
- Fix le_revoke.sh script to use config instead of config.sh
|
||
|
|
|
||
|
|
* Tue May 31 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-1
|
||
|
|
- Update to git ec48906
|
||
|
|
|
||
|
|
* Fri May 13 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160513.gita286741-1
|
||
|
|
- Update to git a286741
|
||
|
|
|
||
|
|
* Wed Mar 30 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160330.gitdca25e8-1
|
||
|
|
- Update to git dca25e8
|
||
|
|
- Fix arg shifting in le_hooks script
|
||
|
|
|
||
|
|
* Tue Feb 23 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160223.git2099c77-1
|
||
|
|
- Update to GIT git2099c77
|
||
|
|
|
||
|
|
* Sat Jan 30 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160127.git79ff846-2
|
||
|
|
- Rename httpd.sh hook to 10httpd.sh
|
||
|
|
- Provide le_revoke.sh script to revoke old certificates
|
||
|
|
- Add timestamp to logs using awk
|
||
|
|
|
||
|
|
* Fri Jan 29 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160127.git79ff846-1
|
||
|
|
- Use date based version number
|
||
|
|
|
||
|
|
* Wed Jan 27 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.3.git79ff846-1
|
||
|
|
- Update to git 79ff846
|
||
|
|
|
||
|
|
* Mon Jan 25 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.2.git3432f60-1
|
||
|
|
- Add hooks directory
|
||
|
|
|
||
|
|
* Mon Jan 25 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.1.git3432f60-1
|
||
|
|
- First package
|