Hello community, here is the log from the commit of package 389-ds for openSUSE:Factory checked in at 2019-02-24 17:11:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/389-ds (Old) and /work/SRC/openSUSE:Factory/.389-ds.new.28833 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "389-ds" Sun Feb 24 17:11:24 2019 rev:17 rq:670926 version:1.4.1.1~git0.af9bb7206 Changes: -------- --- /work/SRC/openSUSE:Factory/389-ds/389-ds.changes 2018-10-25 08:12:10.600194517 +0200 +++ /work/SRC/openSUSE:Factory/.389-ds.new.28833/389-ds.changes 2019-02-24 17:11:30.508492148 +0100 @@ -1,0 +2,211 @@ +Wed Jan 30 23:00:28 UTC 2019 - [email protected] + +- Updates to 389-ds.spec + - Make lib389 a requirement of 389-ds installs + - Disable shell script wrappers that have be replaced by dsctl/dsconf + - Disable perl in spec file build. For replacement tools see: + http://www.port389.org/docs/389ds/FAQ/legacy-command-changes.html + - Remove patches that have been merged by upstream + - Removed: 0001-init_fhs.patch - merged by upstream + - Removed: 0002-use-python2-for-selinux-detection.patch - merged + by upstream + - Removed: drop-caps.patch - merged by upstream + - Commented requires and recommendes in 389-ds.spec + - cyrus-sasl-plain added as a requirement as it is the only plaintext + or start TLS secure method for password auth (LDAPS is always secure) + - cyrus-sasl-gssapi moved to recommends as it is not always required + - cyrus-sasl-digestmd5 moved to recommends, as it is insecure and not + always required + - openldap2-client moved to recommends on lib389 as a supplement to + ldap command line tools that we provide, but not necessary + - python3-selinux and python3-policycoreutils moved to recommends + as they are not required, and only give "nice to have" features + during install of an instance +- Update to version 1.4.1.1~git0.af9bb7206: + * Bump version to 1.4.1.1 + * Ticket 50151 - lib389 support cli add/replace/delete on objects + * Issue 50041 - CLI and WebUI - Add memberOf plugin functionality + * Bump version to 1.4.1.0 + * Ticket 50125 - perl fix ups for tmpfiles + * Ticket 50164 - Add test for dscreate + * Fix for ticket 50059: If an object is nsds5replica, it must be cn=replica + * Ticket 50169 - lib389 changed hardcoded systemctl path + * Ticket 50165 - Fix dscreate issues + * Issue 50152 - Replace os.getenv('HOME') with os.path.expanduser + * Fix compiler warning in snmp main() + * Ticket - Fix compiler warning in init.c + * Ticket 49540 - FIx compiler warning in ldif2ldbm + * Ticket 50169 - lib389 changed hardcoded systemctl path + * Ticket 50165 - Fix dscreate issues + * Issue 50152 - Replace os.getenv('HOME') with os.path.expanduser + * Ticket 49540 - FIx compiler warning in ldif2ldbm + * Ticket 50077 - Fix compiler warnings in automember rebuild task + * Ticket 49972 - use-after-free in case of several parallel krb + * authentication + * Ticket 50161 - Fixed some descriptions in "dsconf backend --help" + * Ticket 50153 - Increase default max logs + * Ticket 50123 - with_tmpfiles_d is associated to systemd + * Ticket 49984 - python installer add option to create suffix entry + * Ticket 49984 - python installer add option to create suffix entry + * Ticket 50077 - RFE - improve automember plugin to work with + * modify ops + * Ticket 50136 - Allow resetting passwords on the CLI + * Ticket 49994 - Adjust dsconf backend usage + * Ticket 50138 - db2bak.pl -P LDAPS does not work when + * nsslapd-securePort is missing + * Ticket 50122 - Fix incorrect path spec + * Issue 50145 - Add a verbose option to the backup tools + * Ticket 50056 - dsctl db2ldif throws an exception + * Ticket 50078 - cannot add cenotaph in read only consumer + * Ticket 50126 - Incorrect usage of sudo in test + * Issue 50130 - Building RPMs on RHEL8 fails + * Ticket 50134 - fixup-memberof.pl does not respect protocol requested + * Issue 50122 - Selinux test for presence + * Issue 50101 - Port fourwaymmr Test TET suit to python3 + * Issue 50091 - shadowWarning is not generated if passwordWarning + * is lower than 86400 seconds (1 day). + * Ticket 50128 - NS Stress fails without ipv6 + * Issue 49618 - Set nsslapd-cachememsize to custom value + * Ticket 50117 - after certain failed import operation, impossible + * to replay an import operation + * Ticket 49999 - rpm.mk dist-bz2 should clean cockpit_dist first + * Issue 48064 - Fix various issues in disk monitoring test suite + * Issue 49938 - lib389 - Clean up CLI logging + * Issue 49761 - Fix CI test suite issues + * Ticket 50056 - Fix UI bugs (part 2) + * Issue: 48064 - CI test - disk_monitoring + * Ticket 50099 - extend error messages + * Ticket 50099 - In FIPS mode, the server can select an unsupported + * password storage scheme + * Issue 50041 - Add basic plugin UI/CLI wrappers + * Issue 50082 - Port state test suite + * Ticket 49574 - remove index subsystem + * Issue 49588 - Add py3 support for tickets : part-5 + * Ticket 50095 - cleanup deprecated key.h includes + +------------------------------------------------------------------- +Thu Jan 24 18:19:03 UTC 2019 - Marcus Rueckert <[email protected]> + +- use lib389 on 15.0 and up. now that we do not hardrequire the + python selinux bindings anymore + +------------------------------------------------------------------- +Mon Jan 7 15:00:07 UTC 2019 - Marcus Rueckert <[email protected]> + +- update to 1.4.0.20 + - Ticket 49994 - Add test for backend/suffix CLI functions + - Ticket 50090 - refactor fetch_attr() to slapi_fetch_attr() + - Ticket 50091 - shadowWarning is not generated if + passwordWarning is lower than 86400 seconds (1 day) + - Ticket 50056 - Fix CLI/UI bugs + - Ticket 49864 - Revised replication status messages for + transient errors + - Ticket 50071 - Set ports in local_simple_allocate function + - Ticket 50065 - lib389 aci parsing is too strict + - Ticket 50061 - Improve schema loading in UI + - Ticket 50063 - Crash after attempting to restore a single + backend + - Ticket 50062 - Replace error by warning in the state machine + defined in repl5_inc_run + - Ticket 50041 - Set the React dataflow foundation and add basic + plugin UI + - Ticket 50028 - Revise ds-replcheck usage + - Ticket 50057 - Pass argument into hashtable_new + - Ticket 50053 - improve testcase + - Ticket 50053 - Subtree password policy overrides a user-defined + password policy + - Ticket 49974 - lib389 - List instances with initconfig_dir + instead of sysconf_dir + - Ticket 49984 - Add an empty domain creation to the dscreate + - Ticket 49950 - PassSync not setting pwdLastSet attribute in + Active Directory after Pw update from LDAP sync for normal user + - Ticket 50046 - Remove irrelevant debug-log messages from CLI + tools + - Ticket 50022, 50012, 49956, and 49800: Various dsctl/dscreate + fixes + - Ticket 49927 - dsctl db2index does not work + - Ticket 49814 - dscreate should handle selinux ports that are in + a range + - Ticket 49543 - fix certmap dn comparison + - Ticket 49994 - comment out dev paths + - Ticket 49994 - Add backend features to CLI + - Ticket 48081 - Add new CI tests for password + +------------------------------------------------------------------- +Thu Dec 20 10:34:55 UTC 2018 - Marcus Rueckert <[email protected]> + +- no longer build on ix86 because upstream dropped 32-bit intel + support in 1.4 + +------------------------------------------------------------------- +Thu Dec 20 10:32:04 UTC 2018 - Marcus Rueckert <[email protected]> + +- limit lib389 to TW until we fixed the selinux python bindings on + leap 15 + +------------------------------------------------------------------- +Tue Nov 20 13:16:46 UTC 2018 - Marcus Rueckert <[email protected]> + +- added drop-caps.patch (boo#1111564) + +------------------------------------------------------------------- +Tue Nov 20 12:38:42 UTC 2018 - Marcus Rueckert <[email protected]> + +- remove caps again and add %verify not mode/caps instead + - fixes the build until we revert the permissions change + +------------------------------------------------------------------- +Tue Nov 20 06:09:31 UTC 2018 - Marcus Rueckert <[email protected]> + +- add back the fscaps in the filelist again. we need to cleanup the + permissions package and this package at the same time. + +------------------------------------------------------------------- +Mon Nov 19 16:11:21 UTC 2018 - Marcus Rueckert <[email protected]> + +- update to 1.4.19 + - Ticket 50026 - audit logs does not capture the operation where + nsslapd-lookthroughlimit is modified + - Ticket 50020 - during MODRDN referential integrity can fail + erronously while updating large groups + - Ticket 49999 - Finish up the transfer to React + - Ticket 50004 - lib389 - improve X-ORIGIN schema parsing + - Ticket 50013 - Log warn instead of ERR when aci target does not + exist. + - Ticket 49975 - followup for broken prefix deployment + - Ticket 49999 - Add dist-bz2 target for Koji build system + - Ticket 49814 - Add specfile requirements for python3-libselinux + - Ticket 49814 - Add specfile requirements for python3-selinux + - Ticket 49999 - Integrate React structure into cockpit-389-ds + - Ticket 49995 - Fix issue with internal op logging + - Ticket 49997 - RFE: ds-replcheck could validate suffix exists + and it’s replicated + - Ticket 49985 - memberof may silently fails to update a member + - Ticket 49967 - entry cache corruption after failed MODRDN + - Ticket 49975 - Add missing include file to main.c + - Ticket 49814 - skip standard ports for selinux labelling + - Ticket 49814 - dscreate should set the port selinux labels + - Ticket 49856 - Remove backend option from bak2db + - Ticket 49926 - Fix various issues with replication UI + - Ticket 49975 - SUSE rpmlint issues + - Ticket 49939 - Fix ldapi path in lib389 + - Ticket 49978 - Add CLI logging function for UI + - Ticket 49929 - Modifications required for the Test Case + Management System + - Ticket 49979 - Fix regression in last commit + - Ticket 49979 - Remove dirsrv tests subpackage + - Ticket 49928 - Fix various small WebUI schema issues ++++ 14 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/389-ds/389-ds.changes ++++ and /work/SRC/openSUSE:Factory/.389-ds.new.28833/389-ds.changes Old: ---- 0001-init_fhs.patch 0002-use-python2-for-selinux-detection.patch 389-ds-base-1.4.0.18.tar.bz2 New: ---- 389-ds-base-1.4.1.1~git0.af9bb7206.tar.bz2 389-ds-base.obsinfo _service _servicedata ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ 389-ds.spec ++++++ --- /var/tmp/diff_new_pack.j0hogJ/_old 2019-02-24 17:11:31.296492008 +0100 +++ /var/tmp/diff_new_pack.j0hogJ/_new 2019-02-24 17:11:31.300492007 +0100 @@ -1,7 +1,7 @@ # # spec file for package 389-ds # -# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,7 +12,7 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # @@ -22,7 +22,11 @@ %endif %bcond_with rust +%if 0%{?suse_version} >= 1500 +%bcond_without lib389 +%else %bcond_with lib389 +%endif %define use_python python3 %define skip_python2 1 %{?!python_module:%define python_module() python-%{**} python3-%{**}} @@ -44,19 +48,17 @@ %define svrcorelib libsvrcore0 Name: 389-ds -Version: 1.4.0.18 +Version: 1.4.1.1~git0.af9bb7206 Release: 0 Summary: 389 Directory Server License: GPL-2.0-only AND MPL-2.0 Group: Productivity/Networking/LDAP/Servers Url: https://pagure.io/389-ds-base -Source: https://releases.pagure.org/389-ds-base/389-ds-base-%{version}.tar.bz2 +Source: 389-ds-base-%{version}.tar.bz2 Source1: extra-schema.tgz Source2: LICENSE.openldap Source9: %{name}-rpmlintrc -# PATCH-FIX-SLES -- Make init scripts LSB conform -Patch1: 0001-init_fhs.patch -Patch2: 0002-use-python2-for-selinux-detection.patch +ExcludeArch: %ix86 BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: autoconf BuildRequires: automake @@ -92,6 +94,7 @@ BuildRequires: python-rpm-macros BuildRequires: pkgconfig(icu-i18n) BuildRequires: pkgconfig(icu-uc) +BuildRequires: pkgconfig(libcap) BuildRequires: pkgconfig(libpcre) BuildRequires: pkgconfig(libsystemd) BuildRequires: pkgconfig(nspr) @@ -108,13 +111,15 @@ %endif Requires: %{_sbindir}/service Requires: acl -Requires: bind-utils -Requires: cyrus-sasl-digestmd5 -Requires: cyrus-sasl-gssapi +# This is a requirement as it's the only known "safe" method of +# plaintext password authentication to ldap, beside the use of +# ldaps. +Requires: cyrus-sasl-plain Requires: db-utils -Requires: mozilla-nss-tools -Requires: openldap2-client -Requires: python-selinux +%if %{with lib389} +Requires: lib389 = %{version} +%else +Requires: bind-utils Requires: perl(Mozilla::LDAP::API) Requires: perl(Mozilla::LDAP::Conn) Requires: perl(Mozilla::LDAP::Entry) @@ -122,6 +127,18 @@ Requires: perl(Mozilla::LDAP::Utils) Requires: perl(NetAddr::IP) Requires: perl(Socket6) +%endif +# Needed for creating the ccache and some GSSAPI steps in sasl +Requires: krb5 +# 389-ds does not directly require gssapi, but it is needed for +# ldap gssapi auth, so we recommend it. +# This used to be a requirement, but it's actually optional. +Recommends: cyrus-sasl-gssapi +# This is required by rfc2831, however it's also horribly insecure +# and requires insecure password storage. We really should remove +# it. +Recommends: cyrus-sasl-digestmd5 + Requires(post): fillup Requires(pre): shadow Obsoletes: 389-ds-base < %{version}-%{release} @@ -173,7 +190,7 @@ %if %{with lib389} %package -n lib389 -Summary: Python library for interacting with the 389 Directory Server +Summary: 389 Directory Server administration tools and library License: GPL-2.0-only AND MPL-2.0 Group: Development/Languages/Python Requires: %{use_python}-argcomplete @@ -183,16 +200,24 @@ Requires: %{use_python}-pyasn1-modules Requires: %{use_python}-python-dateutil Requires: %{use_python}-six -Requires: krb5 Requires: krb5-client +Requires: mozilla-nss-tools +# We recommend this here as a supplementary tool for ldap +# server interaction, but it's in no way required. +Recommends: openldap2-client +# These are recommended if you have selinux on your system +# to allow some supplementary automated interactions during +# setup, but it's not required. +Recommends: python3-selinux +Recommends: python3-policycoreutils -Provides: python-lib389 = %{version}-%{release} Provides: python3-lib389 = %{version}-%{release} Obsoletes: python-lib389 < %{version}-%{release} Obsoletes: python3-lib389 < %{version}-%{release} %description -n lib389 -Python library for interacting with the 389 Directory Server +Python library for interacting with and administering 389 +Directory Server instances locally or remotely. %endif %package -n %{svrcorelib} @@ -208,8 +233,6 @@ %prep %setup -q -a 1 -n %{name}-base-%{version} -%patch1 -p1 -%patch2 -p1 %build # Make sure python3 is used in shebangs @@ -237,7 +260,11 @@ %if %{with rust} --enable-rust \ %endif + %if %{with lib389} + --disable-perl \ + %else --with-perldir=%{_bindir} \ + %endif --libexecdir=%{_prefix}/lib/dirsrv/ \ --with-pythonexec="%{_bindir}/%{use_python}" \ --with-systemd \ @@ -249,7 +276,7 @@ export XCFLAGS="$CFLAGS" make %{?_smp_mflags} -make setup.py +#make setup.py %if %{with lib389} pushd src/lib389 %python_build @@ -278,7 +305,9 @@ find %{buildroot} -type f -name "*.la" -delete -print # make sure perl scripts have a proper shebang +%if ! %{with lib389} sed -i -e 's|#{{PERL-EXEC}}|#!%{_bindir}/perl|' %{buildroot}%{_datadir}/%{pkgname}/script-templates/template-*.pl +%endif # install extra schema files cp -R extra-schema "%{buildroot}/%{_datadir}/dirsrv/" @@ -292,6 +321,7 @@ done rm -rv %{buildroot}/usr/share/cockpit/ +rm -rv %{buildroot}/usr/share/metainfo/389-console/ mv src/svrcore/README{,.svrcore} mv src/svrcore/LICENSE{,.svrcore} @@ -397,7 +427,9 @@ %dir %{_sysconfdir}/dirsrv/config %dir %{_sysconfdir}/dirsrv/schema %{_libdir}/dirsrv/libns-dshttpd-*.so +%if ! %{with lib389} %{_libdir}/dirsrv/perl/*.pm +%endif %{_libdir}/dirsrv/plugins/*.so %{_libdir}/dirsrv/python/*.py %{_libdir}/dirsrv/*.so.* @@ -408,12 +440,59 @@ %exclude %{_mandir}/man1/ldap-agent* %{_mandir}/man1/* %{_mandir}/man5/* +%{_mandir}/man8/ns-slapd.8.gz +%if %{with lib389} +# With lib389 we don't package all the man pages for deprecated commands. Upstream needs to remove +# these from the build with --disable-perl flag set. +# These are excluded now +%exclude %{_mandir}/man8/bak2db.8.gz +%exclude %{_mandir}/man8/bak2db.pl.8.gz +%exclude %{_mandir}/man8/cleanallruv.pl.8.gz +%exclude %{_mandir}/man8/db2bak.8.gz +%exclude %{_mandir}/man8/db2bak.pl.8.gz +%exclude %{_mandir}/man8/db2index.8.gz +%exclude %{_mandir}/man8/db2index.pl.8.gz +%exclude %{_mandir}/man8/db2ldif.8.gz +%exclude %{_mandir}/man8/db2ldif.pl.8.gz +%exclude %{_mandir}/man8/dbmon.sh.8.gz +%exclude %{_mandir}/man8/dbverify.8.gz +%exclude %{_mandir}/man8/dn2rdn.8.gz +%exclude %{_mandir}/man8/fixup-linkedattrs.pl.8.gz +%exclude %{_mandir}/man8/fixup-memberof.pl.8.gz +%exclude %{_mandir}/man8/ldif2db.8.gz +%exclude %{_mandir}/man8/ldif2db.pl.8.gz +%exclude %{_mandir}/man8/ldif2ldap.8.gz +%exclude %{_mandir}/man8/migrate-ds.pl.8.gz +%exclude %{_mandir}/man8/monitor.8.gz +%exclude %{_mandir}/man8/ns-accountstatus.pl.8.gz +%exclude %{_mandir}/man8/ns-activate.pl.8.gz +%exclude %{_mandir}/man8/ns-inactivate.pl.8.gz +%exclude %{_mandir}/man8/ns-newpwpolicy.pl.8.gz +%exclude %{_mandir}/man8/remove-ds.pl.8.gz +%exclude %{_mandir}/man8/restart-dirsrv.8.gz +%exclude %{_mandir}/man8/restoreconfig.8.gz +%exclude %{_mandir}/man8/saveconfig.8.gz +%exclude %{_mandir}/man8/schema-reload.pl.8.gz +%exclude %{_mandir}/man8/setup-ds.pl.8.gz +%exclude %{_mandir}/man8/start-dirsrv.8.gz +%exclude %{_mandir}/man8/status-dirsrv.8.gz +%exclude %{_mandir}/man8/stop-dirsrv.8.gz +%exclude %{_mandir}/man8/suffix2instance.8.gz +%exclude %{_mandir}/man8/syntax-validate.pl.8.gz +%exclude %{_mandir}/man8/upgradedb.8.gz +%exclude %{_mandir}/man8/upgradednformat.8.gz +%exclude %{_mandir}/man8/usn-tombstone-cleanup.pl.8.gz +%exclude %{_mandir}/man8/verify-db.pl.8.gz +%exclude %{_mandir}/man8/vlvindex.8.gz +%else %{_mandir}/man8/* +%endif %{_bindir}/* # TODO: audit bug running https://bugzilla.opensuse.org/show_bug.cgi?id=1111564 # This also needs a lot more work on the service file -#%attr(750,root,dirsrv) %caps(CAP_NET_BIND_SERVICE=pe) %{_sbindir}/ns-slapd -%{_sbindir}/ns-slapd +#attr(750,root,dirsrv) #caps(CAP_NET_BIND_SERVICE=pe) #{_sbindir}/ns-slapd +%verify(not mode caps) %attr(750,root,dirsrv) %{_sbindir}/ns-slapd +%if ! %{with lib389} %{_sbindir}/bak2db %{_sbindir}/bak2db.pl %{_sbindir}/cleanallruv.pl @@ -453,6 +532,7 @@ %{_sbindir}/usn-tombstone-cleanup.pl %{_sbindir}/verify-db.pl %{_sbindir}/vlvindex +%endif %{_unitdir}/[email protected] %{_unitdir}/dirsrv.target %{_prefix}/lib/dirsrv/ @@ -505,6 +585,10 @@ %{_sbindir}/dscreate %{_sbindir}/dsctl %{_sbindir}/dsidm +%{_mandir}/man8/dsconf.8.gz +%{_mandir}/man8/dscreate.8.gz +%{_mandir}/man8/dsctl.8.gz +%{_mandir}/man8/dsidm.8.gz /usr/lib/python*/site-packages/lib389* %endif ++++++ 389-ds-base.obsinfo ++++++ name: 389-ds-base version: 1.4.1.1~git0.af9bb7206 mtime: 1548878932 commit: af9bb7206aa39bb0c4c6fdbaa2653391f120671f ++++++ _service ++++++ <!-- the file should only be named _service, but i named it _service.xml to trigger gitlab syntax highlighting --> <services> <!-- configuration for the tar service --> <service name="obs_scm" mode="disabled"> <param name="url">https://pagure.io/389-ds-base.git</param> <param name="versionformat">@PARENT_TAG@~git@TAG_OFFSET@.%h</param> <param name="scm">git</param> <!-- use 1.4 branch --> <param name="revision">389-ds-base-1.4.1.1</param> <!-- use 1.4.0.20 tag as base --> <param name="match-tag">389-ds-base-1.4.1.1</param> <!-- remove the extra prefix from the tag again it looks so funny because the service removed "-" from the string before--> <param name="versionrewrite-pattern">389dsbase(.*)</param> <param name="versionrewrite-replacement">\1</param> <!-- run osc vc for us with the git changes --> <param name="changesgenerate">enable</param> <!-- email address for the changes entry --> <param name="changesauthor">[email protected]</param> </service> <service mode="disabled" name="tar" /> <service mode="disabled" name="recompress"> <param name="file">*.tar</param> <param name="compression">bz2</param> </service> <!-- update version field in the spec file --> <service mode="disabled" name="set_version" /> </services> ++++++ _servicedata ++++++ <servicedata> <service name="tar_scm"> <param name="url">https://pagure.io/389-ds-base.git</param> <param name="changesrevision">af9bb7206aa39bb0c4c6fdbaa2653391f120671f</param></service></servicedata>
