diff --git a/security/dogtag-pki/Makefile b/security/dogtag-pki/Makefile index e8b934a33ea8..0f8a96dd5711 100644 --- a/security/dogtag-pki/Makefile +++ b/security/dogtag-pki/Makefile @@ -1,330 +1,362 @@ PORTNAME= dogtag-pki DISTVERSIONPREFIX= v DISTVERSION= 11.7.0 -PORTREVISION= 4 +PORTREVISION= 5 CATEGORIES= security java python MAINTAINER= joneum@FreeBSD.org COMMENT= Dogtag PKI certificate system and server components WWW= https://github.com/dogtagpki/pki LICENSE= GPLv2 LICENSE_FILE= ${WRKSRC}/LICENSE _JAVA_DEPENDS= ${JAVAJARDIR}/commons-cli.jar:java/apache-commons-cli \ ${JAVAJARDIR}/commons-codec.jar:java/apache-commons-codec \ ${JAVAJARDIR}/commons-io.jar:devel/apache-commons-io \ ${JAVAJARDIR}/commons-lang3.jar:java/apache-commons-lang3 \ ${JAVAJARDIR}/commons-logging.jar:java/apache-commons-logging \ ${JAVAJARDIR}/commons-net.jar:net/apache-commons-net \ ${JAVAJARDIR}/httpclient.jar:www/httpclient \ ${JAVAJARDIR}/httpcore.jar:www/httpcore \ ${JAVAJARDIR}/jackson-annotations.jar:devel/jackson-annotations \ ${JAVAJARDIR}/jackson-core.jar:devel/jackson-core \ ${JAVAJARDIR}/jackson-databind.jar:devel/jackson-databind \ ${JAVAJARDIR}/jackson-jaxrs-json-provider.jar:devel/jackson-jaxrs-providers \ ${JAVAJARDIR}/jackson-module-jaxb-annotations.jar:devel/jackson-module-jaxb-annotations \ ${JAVAJARDIR}/jakarta.activation-api.jar:devel/jakarta-activation-api \ ${JAVAJARDIR}/jakarta.annotation-api.jar:devel/jakarta-annotation-api \ ${JAVAJARDIR}/jakarta.xml.bind-api.jar:devel/jakarta-xml-bind-api \ ${JAVAJARDIR}/javax.ws.rs-api.jar:devel/javax-ws-rs-api \ ${JAVAJARDIR}/javax.activation-api.jar:devel/javax-activation-api \ ${JAVAJARDIR}/jaxb-api.jar:devel/jaxb-api \ ${JAVAJARDIR}/jboss-logging.jar:devel/jboss-logging \ dogtag-jss>=5.7.0:security/dogtag-jss \ ${JAVAJARDIR}/ldapjdk.jar:net/dogtag-ldap-sdk \ ${JAVAJARDIR}/resteasy-servlet-initializer.jar:devel/resteasy \ ${JAVAJARDIR}/slf4j-api.jar:devel/slf4j BUILD_DEPENDS= ${_JAVA_DEPENDS} \ ${LOCALBASE}/apache-tomcat-9.0/lib/jaspic-api.jar:www/tomcat9 \ ${LOCALBASE}/apache-tomcat-9.0/lib/servlet-api.jar:www/tomcat9 \ ${PY_SETUPTOOLS} \ ${PYTHON_PKGNAMEPREFIX}wheel>0:devel/py-wheel@${PY_FLAVOR} LIB_DEPENDS= libapr-1.so:devel/apr1 \ libldap.so:net/openldap26-client \ libnspr4.so:devel/nspr \ libnss3.so:security/nss RUN_DEPENDS= ${_JAVA_DEPENDS} \ ${LOCALBASE}/apache-tomcat-9.0/bin/catalina.sh:www/tomcat9 \ ${LOCALBASE}/lib/pkcs11/p11-kit-trust.so:security/p11-kit \ ${PYTHON_PKGNAMEPREFIX}cryptography>0:security/py-cryptography@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}lxml>0:devel/py-lxml@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}python-ldap>0:net/py-python-ldap@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}requests>0:www/py-requests@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR} \ bash:shells/bash USES= cmake:indirect java:build,run pkgconfig python shebangfix USE_GITHUB= yes GH_ACCOUNT= dogtagpki GH_PROJECT= pki JAVA_VERSION= 17 USE_LDCONFIG= yes USE_PYTHON= autoplist pep517 SHEBANG_FILES= base/common/upgrade/*/*.py base/server/scripts/operations \ base/server/scripts/pkidaemon base/server/upgrade/*/*.py CMAKE_ARGS= -DAPP_SERVER=tomcat-9.0 \ -DCOMMONS_CLI_JAR=${JAVAJARDIR}/commons-cli.jar \ -DCOMMONS_CODEC_JAR=${JAVAJARDIR}/commons-codec.jar \ -DCOMMONS_IO_JAR=${JAVAJARDIR}/commons-io.jar \ -DCOMMONS_LANG3_JAR=${JAVAJARDIR}/commons-lang3.jar \ -DCOMMONS_LOGGING_JAR=${JAVAJARDIR}/commons-logging.jar \ -DCOMMONS_NET_JAR=${JAVAJARDIR}/commons-net.jar \ -DHTTPCLIENT_JAR=${JAVAJARDIR}/httpclient.jar \ -DHTTPCORE_JAR=${JAVAJARDIR}/httpcore.jar \ -DJACKSON_ANNOTATIONS_JAR=${JAVAJARDIR}/jackson-annotations.jar \ -DJACKSON_CORE_JAR=${JAVAJARDIR}/jackson-core.jar \ -DJACKSON_DATABIND_JAR=${JAVAJARDIR}/jackson-databind.jar \ -DJACKSON_JAXRS_BASE_JAR=${JAVAJARDIR}/jackson-jaxrs-base.jar \ -DJACKSON_JAXRS_JSON_PROVIDER_JAR=${JAVAJARDIR}/jackson-jaxrs-json-provider.jar \ -DJACKSON_MODULE_JAXB_ANNOTATIONS_JAR=${JAVAJARDIR}/jackson-module-jaxb-annotations.jar \ -DJAKARTA_ACTIVATION_API_JAR=${JAVAJARDIR}/jakarta.activation-api.jar \ -DJAKARTA_ANNOTATION_API_JAR=${JAVAJARDIR}/jakarta.annotation-api.jar \ -DJASPIC_API_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/jaspic-api.jar \ -DJAVA_HOME=${JAVA_HOME} \ -DJAVA_JAR_INSTALL_DIR=${JAVAJARDIR} \ -DJAVA_LIB_INSTALL_DIR=${JAVAJARDIR} \ -DJAXB_API_JAR=${JAVAJARDIR}/jakarta.xml.bind-api.jar \ -DJAXRS_API_JAR=${JAVAJARDIR}/javax.ws.rs-api.jar \ -DJBOSS_LOGGING_JAR=${JAVAJARDIR}/jboss-logging.jar \ -DJSS_JAR=${JAVAJARDIR}/jss.jar \ -DJSS_TOMCAT_9_0_JAR=${JAVAJARDIR}/jss-tomcat-9.0.jar \ -DJSS_TOMCAT_JAR=${JAVAJARDIR}/jss-tomcat.jar \ -DLDAPJDK_JAR=${JAVAJARDIR}/ldapjdk.jar \ -DP11_KIT_TRUST=${LOCALBASE}/lib/pkcs11/p11-kit-trust.so \ -DPYTHON3_SITE_PACKAGES=${PYTHONPREFIX_SITELIBDIR} \ -DPYTHON_EXECUTABLE=${PYTHON_CMD} \ -DRELEASE=${PORTREVISION:U0} \ -DRESTEASY_JACKSON_PROVIDER_JAR=${JAVAJARDIR}/resteasy-jackson2-provider.jar \ -DRESTEASY_JAXRS_JAR=${JAVAJARDIR}/resteasy-jaxrs.jar \ -DRESTEASY_SERVLET_INITIALIZER_JAR=${JAVAJARDIR}/resteasy-servlet-initializer.jar \ -DSERVLET_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/servlet-api.jar \ -DSLF4J_API_JAR=${JAVAJARDIR}/slf4j-api.jar \ -DSLF4J_JDK14_JAR=${JAVASHAREDIR}/slf4j/slf4j-jdk14.jar \ -DTOMCAT_API_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-api.jar \ -DTOMCAT_CATALINA_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/catalina.jar \ -DTOMCAT_COYOTE_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-coyote.jar \ -DTOMCAT_UTIL_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util.jar \ -DTOMCAT_UTIL_SCAN_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util-scan.jar \ -DVERSION=${DISTVERSION} \ -DWITH_PYTHON_DOCS=OFF -CMAKE_ON= WITH_CA WITH_JAVA WITH_SERVER +CMAKE_ON= WITH_ACME WITH_CA WITH_JAVA WITH_SERVER -CMAKE_OFF= RUN_TESTS WITH_ACME WITH_CONSOLE WITH_EST WITH_JAVADOC WITH_KRA \ +CMAKE_OFF= RUN_TESTS WITH_CONSOLE WITH_EST WITH_JAVADOC WITH_KRA \ WITH_META WITH_OCSP WITH_TESTS WITH_THEME WITH_TKS WITH_TPS \ WITH_WURST CMAKE_SOURCE_PATH= ${WRKSRC} DATADIR= ${PREFIX}/share/pki SUB_FILES= pki.conf pkidestroy pkispawn tomcat.conf SUB_LIST+= JAVA_HOME=${JAVA_HOME} \ JAVALIBDIR=${JAVALIBDIR} \ PYTHON_CMD=${PYTHON_CMD} USERS= pkiuser GROUPS= pkiuser PORTDATA= * _JAVA_BUILD_DIR= ${WRKDIR}/java-build -_JAVA_TARGETS= tps_library java pki-ca-links pki-lib pki-server-common-lib \ +_JAVA_TARGETS= pki-acme-links tps_library java pki-ca-links pki-lib pki-server-common-lib \ pki-server-lib pki-server-webapp-lib -_DOGTAG_JARS= pki-ca.jar pki-common.jar pki-server-webapp.jar pki-server.jar \ +_DOGTAG_JARS= pki-acme.jar pki-ca.jar pki-common.jar pki-server-webapp.jar pki-server.jar \ pki-tomcat-9.0.jar pki-tomcat.jar pki-tools.jar _RLN_PLACEHOLDERS=${JAVAJARDIR}/jss-tomcat.jar \ ${JAVAJARDIR}/jss-tomcat-9.0.jar \ -${JAVAJARDIR}/resteasy-servlet-initializer.jar +${JAVAJARDIR}/resteasy-servlet-initializer.jar \ +${JAVAJARDIR}/jaxb-api.jar \ +${JAVAJARDIR}/javax.activation-api.jar post-build: # Configure the Java build tree @${RM} -r ${_JAVA_BUILD_DIR} @${MKDIR} ${_JAVA_BUILD_DIR} cd ${_JAVA_BUILD_DIR} && \ ${SETENVI} ${WRK_ENV} ${CONFIGURE_ENV} \ JAVA_HOME=${JAVA_HOME} \ ${CMAKE_BIN} ${CMAKE_ARGS} ${CMAKE_SOURCE_PATH} # Build Java archives and runtime link trees ${SETENVI} ${WRK_ENV} ${MAKE_ENV} \ JAVA_HOME=${JAVA_HOME} \ ${CMAKE_BIN} --build ${_JAVA_BUILD_DIR} \ --parallel ${MAKE_JOBS_NUMBER} \ --target ${_JAVA_TARGETS} post-install: post-install-runtime post-install-native: @${MKDIR} ${STAGEDIR}${PREFIX}/lib ${INSTALL_LIB} ${_JAVA_BUILD_DIR}/base/tools/src/main/native/tpsclient/src/libpki-tps.so \ ${STAGEDIR}${PREFIX}/lib/libpki-tps.so ${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libpki-tps.so post-install-java: post-install-native @${MKDIR} ${STAGEDIR}${JAVAJARDIR}/pki .for jar in ${_DOGTAG_JARS} ${INSTALL_DATA} ${_JAVA_BUILD_DIR}/dist/${jar} \ ${STAGEDIR}${JAVAJARDIR}/pki/${jar} .endfor post-install-tools: post-install-java @${MKDIR} ${STAGEDIR}${PREFIX}/bin \ ${STAGEDIR}${PREFIX}/sbin ${INSTALL_SCRIPT} ${WRKSRC}/base/tools/bin/pki \ ${STAGEDIR}${PREFIX}/bin/pki ${INSTALL_SCRIPT} ${WRKSRC}/base/common/sbin/pki-upgrade \ ${STAGEDIR}${PREFIX}/sbin/pki-upgrade ${INSTALL_SCRIPT} ${WRKSRC}/base/server/scripts/pkidaemon \ ${STAGEDIR}${PREFIX}/bin/pkidaemon ${INSTALL_SCRIPT} ${WRKSRC}/base/server/sbin/pki-server \ ${STAGEDIR}${PREFIX}/sbin/pki-server ${INSTALL_SCRIPT} ${WRKDIR}/pkidestroy \ ${STAGEDIR}${PREFIX}/sbin/pkidestroy ${INSTALL_SCRIPT} ${WRKDIR}/pkispawn \ ${STAGEDIR}${PREFIX}/sbin/pkispawn post-install-common: post-install-tools @${MKDIR} ${STAGEDIR}${DATADIR} ${INSTALL_DATA} ${WRKSRC}/pom.xml ${STAGEDIR}${DATADIR}/pom.xml .for dir in key upgrade cd ${WRKSRC}/base/common && \ ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR} \ "! -name CMakeLists.txt" .endfor post-install-server: post-install-common @${MKDIR} ${STAGEDIR}${DATADIR}/deployment \ ${STAGEDIR}${DATADIR}/server \ ${STAGEDIR}${DATADIR}/setup cd ${WRKSRC}/base/server && \ ${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/server .for dir in certs database upgrade cd ${WRKSRC}/base/server && \ ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/server \ "! -name CMakeLists.txt" .endfor cd ${WRKSRC}/base/server && \ ${COPYTREE_SHARE} config ${STAGEDIR}${DATADIR}/deployment \ "! -name CMakeLists.txt" cd ${WRKSRC}/base/server && \ ${COPYTREE_SHARE} setup ${STAGEDIR}${DATADIR} \ "! -name CMakeLists.txt" cd ${WRKSRC}/base/server/share && \ ${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/server \ "! -name CMakeLists.txt ! -path ./lib ! -path ./lib/* ! -path ./etc ! -path ./etc/*" cd ${WRKSRC}/base/server && \ ${COPYTREE_SHARE} etc ${STAGEDIR}${DATADIR}/server \ "! -name CMakeLists.txt" cd ${WRKSRC}/base/server-webapp && \ ${COPYTREE_SHARE} webapps ${STAGEDIR}${DATADIR}/server \ "! -name CMakeLists.txt" cd ${WRKSRC}/base/tomcat-9.0 && \ ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/server \ "! -name CMakeLists.txt" post-install-ca: post-install-server @${MKDIR} ${STAGEDIR}${DATADIR}/ca cd ${WRKSRC}/base/ca && \ ${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/ca .for dir in auth database cd ${WRKSRC}/base/ca && \ ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/ca \ "! -name CMakeLists.txt" .endfor cd ${WRKSRC}/base/ca/shared && \ ${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/ca \ "! -name CMakeLists.txt ! -path ./conf/CS.cfg" cd ${WRKSRC}/base/ca/tomcat-9.0 && \ ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/ca \ "! -name CMakeLists.txt" -post-install-links: post-install-ca +post-install-acme: post-install-ca + @${MKDIR} ${STAGEDIR}${DATADIR}/acme \ + ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF + cd ${WRKSRC}/base/acme && \ + ${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/acme +.for dir in conf database issuer openshift realm webapps + cd ${WRKSRC}/base/acme && \ + ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/acme \ + "! -name CMakeLists.txt" +.endfor + cd ${WRKSRC}/base/acme/tomcat-9.0 && \ + ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/acme \ + "! -name CMakeLists.txt" + cd ${_JAVA_BUILD_DIR}/base/acme/webapp && \ + ${COPYTREE_SHARE} lib \ + ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF + +post-install-links: post-install-acme @${MKDIR} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF \ ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin \ ${STAGEDIR}${DATADIR}/server/common \ ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF cd ${_JAVA_BUILD_DIR}/base/common && \ ${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR} cd ${_JAVA_BUILD_DIR}/base/server && \ ${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}/server cd ${_JAVA_BUILD_DIR}/base/server/common && \ ${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}/server/common cd ${_JAVA_BUILD_DIR}/base/server-webapp/webapp && \ ${COPYTREE_SHARE} lib \ ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF cd ${_JAVA_BUILD_DIR}/base/ca/webapp && \ ${COPYTREE_SHARE} lib \ ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF cd ${_JAVA_BUILD_DIR}/base/ca/webapp/admin && \ ${COPYTREE_SHARE} . \ ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin # Replace fragile upstream links with FreeBSD relative symlinks. @${TOUCH} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},} + @${RM} ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/jaxb-api.jar ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar + @${RM} ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/javax.activation-api.jar ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jaxb-api.jar + ${RLN} ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar ${STAGEDIR}${DATADIR}/server/common/lib/jaxb-api.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/javax.activation-api.jar + ${RLN} ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar ${STAGEDIR}${DATADIR}/server/common/lib/javax.activation-api.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat-9.0.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat-9.0.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-tomcat-9.0.jar ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat-9.0.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/resteasy-servlet-initializer.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/server/common/lib/resteasy-servlet-initializer.jar @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-server.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-server.jar @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-ca.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-ca.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-ca.jar @${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server.jar @${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server-webapp.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server-webapp.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server-webapp.jar @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/resteasy-servlet-initializer.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/resteasy-servlet-initializer.jar @${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/resteasy-servlet-initializer.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/resteasy-servlet-initializer.jar @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console ${RLN} ${STAGEDIR}${DATADIR}/server/webapps/pki/admin/console ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console + @${RM} ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-server.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-server.jar + @${RM} ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-acme.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-acme.jar ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-acme.jar + @${RM} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},} post-install-config: post-install-links @${MKDIR} ${STAGEDIR}${DATADIR}/ca/conf \ ${STAGEDIR}${DATADIR}/etc \ ${STAGEDIR}${DATADIR}/scripts ${INSTALL_DATA} ${_JAVA_BUILD_DIR}/base/ca/shared/conf/CS.cfg \ ${STAGEDIR}${DATADIR}/ca/conf/CS.cfg # Shared configuration and helper scripts ${INSTALL_DATA} ${WRKDIR}/pki.conf \ ${STAGEDIR}${DATADIR}/etc/pki.conf ${INSTALL_DATA} ${WRKDIR}/tomcat.conf \ ${STAGEDIR}${DATADIR}/etc/tomcat.conf ${INSTALL_DATA} ${WRKSRC}/base/common/share/etc/logging.properties \ ${STAGEDIR}${DATADIR}/etc/logging.properties ${INSTALL_DATA} ${WRKSRC}/base/common/scripts/config \ ${STAGEDIR}${DATADIR}/scripts/config ${INSTALL_SCRIPT} ${WRKSRC}/base/server/scripts/operations \ ${STAGEDIR}${DATADIR}/scripts/operations post-install-version: post-install-config ${INSTALL_DATA} ${_JAVA_BUILD_DIR}/base/VERSION \ ${STAGEDIR}${DATADIR}/VERSION ${ECHO_CMD} "Dogtag Certificate System" > ${WRKDIR}/CS_SERVER_VERSION ${INSTALL_DATA} ${WRKDIR}/CS_SERVER_VERSION \ ${STAGEDIR}${DATADIR}/CS_SERVER_VERSION post-install-runtime: post-install-version @${MKDIR} ${STAGEDIR}/var/log/pki .include diff --git a/security/dogtag-pki/files/patch-base_acme_bin_pki-acme-run b/security/dogtag-pki/files/patch-base_acme_bin_pki-acme-run new file mode 100644 index 000000000000..5369129aa7f4 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_bin_pki-acme-run @@ -0,0 +1,26 @@ +--- base/acme/bin/pki-acme-run.orig 2025-08-05 19:20:05 UTC ++++ base/acme/bin/pki-acme-run +@@ -5,7 +5,7 @@ + # SPDX-License-Identifier: GPL-2.0-or-later + # + +-. /usr/share/pki/scripts/config ++. /usr/local/share/pki/scripts/config + + # Allow the owner of the container (who might not be in the root group) + # to manage the config and log files. +@@ -16,7 +16,7 @@ then + if [ -z "$(ls -A /conf 2> /dev/null)" ] + then + echo "INFO: Installing default config files" +- cp -r /var/lib/pki/pki-tomcat/conf.default/* /conf ++ cp -r /var/db/pki/pki-tomcat/conf.default/* /conf + fi + + mkdir -p /conf/acme +@@ -120,4 +120,4 @@ fi + echo "INFO: Using default realm configuration" + fi + +-/usr/share/pki/server/bin/pki-server-run ++/usr/local/share/pki/server/bin/pki-server-run diff --git a/security/dogtag-pki/files/patch-base_acme_conf_configsources.conf b/security/dogtag-pki/files/patch-base_acme_conf_configsources.conf new file mode 100644 index 000000000000..8b68a24e58dc --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_conf_configsources.conf @@ -0,0 +1,8 @@ +--- base/acme/conf/configsources.conf.orig 2025-08-05 19:20:05 UTC ++++ base/acme/conf/configsources.conf +@@ -12,4 +12,4 @@ engine.class=org.dogtagpki.acme.server.ACMEEngineConfi + + # The 'filename' parameter tells the ACMEEngineConfigFileSource + # where to read the engine configuration from. +-engine.filename=/var/lib/pki/pki-tomcat/conf/acme/engine.conf ++engine.filename=/var/db/pki/pki-tomcat/conf/acme/engine.conf diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_database_PostgreSQLDatabase.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_database_PostgreSQLDatabase.java new file mode 100644 index 000000000000..2ea7cc027215 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_database_PostgreSQLDatabase.java @@ -0,0 +1,20 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/database/PostgreSQLDatabase.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/database/PostgreSQLDatabase.java +@@ -70,7 +70,7 @@ public class PostgreSQLDatabase extends ACMEDatabase { + + String statementsFilename = info.getProperty( + "statements", +- "/usr/share/pki/acme/database/postgresql/statements.conf"); ++ "/usr/local/share/pki/acme/database/postgresql/statements.conf"); + + logger.info("Loading statements from " + statementsFilename); + +@@ -153,7 +153,7 @@ public class PostgreSQLDatabase extends ACMEDatabase { + + logger.info("Setting up database"); + +- String filename = "/usr/share/pki/acme/database/postgresql/create.sql"; ++ String filename = "/usr/local/share/pki/acme/database/postgresql/create.sql"; + String content = new String(Files.readAllBytes(Paths.get(filename))); + + String[] statements = content.split(";"); diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_issuer_NSSIssuer.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_issuer_NSSIssuer.java new file mode 100644 index 000000000000..eb0226bd9af6 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_issuer_NSSIssuer.java @@ -0,0 +1,11 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/issuer/NSSIssuer.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/issuer/NSSIssuer.java +@@ -111,7 +111,7 @@ public class NSSIssuer extends ACMEIssuer { + } + + String extensions = config.getParameter("extensions"); +- if (extensions == null) extensions = "/usr/share/pki/acme/issuer/nss/sslserver.conf"; ++ if (extensions == null) extensions = "/usr/local/share/pki/acme/issuer/nss/sslserver.conf"; + logger.info("- extensions: " + extensions); + + Path extPath = instanceDir.resolve(extensions); diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_realm_PostgreSQLRealm.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_realm_PostgreSQLRealm.java new file mode 100644 index 000000000000..7f604a1c5588 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_realm_PostgreSQLRealm.java @@ -0,0 +1,11 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/realm/PostgreSQLRealm.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/realm/PostgreSQLRealm.java +@@ -18,7 +18,7 @@ public class PostgreSQLRealm extends PKIPostgreSQLReal + public void setConfig(RealmConfig config) { + super.setConfig(config); + if(config.getParameter("statements") == null) { +- this.config.setParameter("statements", "/usr/share/pki/acme/realm/postgresql/statements.conf"); ++ this.config.setParameter("statements", "/usr/local/share/pki/acme/realm/postgresql/statements.conf"); + } + } + diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_server_ACMEEngine.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_server_ACMEEngine.java new file mode 100644 index 000000000000..56270457b383 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_server_ACMEEngine.java @@ -0,0 +1,38 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngine.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngine.java +@@ -220,7 +220,7 @@ public class ACMEEngine extends CMSEngine { + File configFile = new File(filename); + + if (!configFile.exists()) { +- configFile = new File("/usr/share/pki/acme/conf/engine.conf"); ++ configFile = new File("/usr/local/share/pki/acme/conf/engine.conf"); + } + + logger.info("Loading ACME engine config from " + configFile); +@@ -261,7 +261,7 @@ public class ACMEEngine extends CMSEngine { + File metadataConfigFile = new File(filename); + + if (!metadataConfigFile.exists()) { +- metadataConfigFile = new File("/usr/share/pki/acme/conf/metadata.conf"); ++ metadataConfigFile = new File("/usr/local/share/pki/acme/conf/metadata.conf"); + } + + logger.info("Loading ACME metadata from " + metadataConfigFile); +@@ -304,7 +304,7 @@ public class ACMEEngine extends CMSEngine { + File validatorsConfigFile = new File(filename); + + if (!validatorsConfigFile.exists()) { +- validatorsConfigFile = new File("/usr/share/pki/acme/conf/validators.conf"); ++ validatorsConfigFile = new File("/usr/local/share/pki/acme/conf/validators.conf"); + } + + logger.info("Loading ACME validators config from " + validatorsConfigFile); +@@ -365,7 +365,7 @@ public class ACMEEngine extends CMSEngine { + File schedulerConfigFile = new File(filename); + + if (!schedulerConfigFile.exists()) { +- schedulerConfigFile = new File("/usr/share/pki/acme/conf/scheduler.conf"); ++ schedulerConfigFile = new File("/usr/local/share/pki/acme/conf/scheduler.conf"); + } + + logger.info("Loading ACME scheduler config from " + schedulerConfigFile); diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py index 47774a8c557a..6287a1e98bc3 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py @@ -1,461 +1,491 @@ --- base/server/python/pki/server/__init__.py.orig 2025-08-05 19:20:05 UTC +++ base/server/python/pki/server/__init__.py @@ -51,9 +51,9 @@ import pki.server.subsystem from pki.keyring import Keyring import pki.server.subsystem -SYSCONFIG_DIR = '/etc/sysconfig' -ETC_SYSTEMD_DIR = '/etc/systemd' -LIB_SYSTEMD_DIR = '/lib/systemd' +SYSCONFIG_DIR = '/usr/local/etc' +RC_CONF_DIR = '/etc/rc.conf.d' +RC_DIR = '/usr/local/etc/rc.d' SUBSYSTEM_TYPES = ['ca', 'kra', 'ocsp', 'tks', 'tps', 'acme', 'est'] @@ -62,7 +62,7 @@ SCHEMA_FILES = [ DEFAULT_LINK_MODE = 0o0777 SCHEMA_FILES = [ - '/usr/share/pki/server/database/ds/schema.ldif' + '/usr/local/share/pki/server/database/ds/schema.ldif' ] logger = logging.getLogger(__name__) @@ -72,14 +72,14 @@ class Tomcat(object): class Tomcat(object): - BASE_DIR = '/var/lib/tomcats' - CONF_DIR = '/etc/tomcat' - LIB_DIR = '/usr/share/java/tomcat' - SHARE_DIR = '/usr/share/tomcat' - EXECUTABLE = '/usr/sbin/tomcat' - UNIT_FILE = '/lib/systemd/system/tomcat@.service' + BASE_DIR = '/var/db/tomcats' + CONF_DIR = '/usr/local/apache-tomcat-9.0/conf' + LIB_DIR = '/usr/local/apache-tomcat-9.0/lib' + SHARE_DIR = '/usr/local/apache-tomcat-9.0' + EXECUTABLE = '/usr/local/apache-tomcat-9.0/bin/catalina.sh' + UNIT_FILE = '/usr/local/etc/rc.d/tomcat9' SERVER_XML = CONF_DIR + '/server.xml' - TOMCAT_CONF = CONF_DIR + '/tomcat.conf' + TOMCAT_CONF = '/usr/local/share/pki/etc/tomcat.conf' @classmethod def get_version(cls): @@ -104,10 +104,10 @@ class PKIServer(object): @functools.total_ordering class PKIServer(object): - BASE_DIR = '/var/lib/pki' - CONFIG_DIR = '/etc/pki' + BASE_DIR = '/var/db/pki' + CONFIG_DIR = '/usr/local/etc/pki' LOG_DIR = '/var/log/pki' - SHARE_DIR = '/usr/share/pki' + SHARE_DIR = '/usr/local/share/pki' REGISTRY_DIR = SYSCONFIG_DIR + '/pki' TOMCAT_CONF = SHARE_DIR + '/etc/tomcat.conf' @@ -122,11 +122,11 @@ class PKIServer(object): self.user = user self.group = group - # The standard conf dir at /var/lib/pki//conf + # The standard conf dir at /var/db/pki//conf # will be an actual folder (i.e. not a link). self._conf_dir = None - # The standard logs dir at /var/lib/pki//logs + # The standard logs dir at /var/db/pki//logs # will be an actual folder (i.e. not a link). self._logs_dir = None -@@ -243,9 +243,43 @@ class PKIServer(object): +@@ -243,9 +243,63 @@ class PKIServer(object): return '%s@%s' % (self.type, self.name) @property + def rc_service_name(self): + return ''.join( + char if char.isalnum() or char == '_' else '_' + for char in self.service_name) + + @property + def rc_script(self): + return os.path.join(RC_DIR, self.rc_service_name) + + @property def service_conf(self): - return os.path.join(SYSCONFIG_DIR, self.service_name) + return os.path.join(RC_CONF_DIR, self.rc_service_name) + def create_rc_service(self, exist_ok=False): + os.makedirs(RC_CONF_DIR, mode=0o755, exist_ok=True) + + if not os.path.exists(self.service_conf) or not exist_ok: + prefix = self.rc_service_name + java_home = os.environ["JAVA_HOME"] + + with open(self.service_conf, "w", encoding="utf-8") as f: + print("%s_enable=\"YES\"" % prefix, file=f) + print("%s_catalina_home=\"%s\"" % (prefix, Tomcat.SHARE_DIR), file=f) + print("%s_catalina_base=\"%s\"" % (prefix, self.base_dir), file=f) + print("%s_catalina_user=\"%s\"" % (prefix, self.user), file=f) + print("%s_java_home=\"%s\"" % (prefix, java_home), file=f) -+ print("%s_env_file=\"%s\"" % (prefix, self.tomcat_conf), file=f) ++ tomcat_config = {} ++ pki.util.load_properties(self.tomcat_conf, tomcat_config) ++ java_opts = tomcat_config.get("JAVA_OPTS", "").strip(chr(34)) ++ pki_version = tomcat_config.get("PKI_VERSION", "").strip(chr(34)) ++ print('%s_java_opts="%s"' % (prefix, java_opts), file=f) ++ print('%s_env="PKI_VERSION=%s"' % (prefix, pki_version), file=f) + + os.chmod(self.service_conf, 0o644) + + if os.path.lexists(self.rc_script): + if exist_ok: + return + raise FileExistsError(self.rc_script) + + os.symlink(os.path.join(RC_DIR, "tomcat9"), self.rc_script) ++ ++ def remove_rc_service(self, force=False): ++ logger.info("Removing %s", self.rc_script) ++ pki.util.unlink(self.rc_script, force=force) ++ ++ logger.info("Removing %s", self.service_conf) ++ pki.util.remove(self.service_conf, force=force) ++ ++ rcvar = "%s_enable" % self.rc_service_name ++ logger.info("Removing %s from rc.conf", rcvar) ++ subprocess.run( ++ ["/usr/sbin/sysrc", "-x", rcvar], ++ stdout=subprocess.DEVNULL, ++ stderr=subprocess.DEVNULL, ++ check=False) + @property def uid(self): return pwd.getpwnam(self.user).pw_uid -@@ -295,7 +329,7 @@ class PKIServer(object): +@@ -295,7 +347,7 @@ class PKIServer(object): raise pki.PKIException('Invalid instance: ' + self.name, None) def is_active(self): - cmd = ['systemctl', '--quiet', 'is-active', '%s.service' % self.service_name] + cmd = ['/usr/sbin/service', self.rc_service_name, 'onestatus'] logger.debug('Command: %s', ' '.join(cmd)) rc = subprocess.call(cmd) return rc == 0 -@@ -362,13 +396,13 @@ class PKIServer(object): +@@ -362,13 +414,13 @@ class PKIServer(object): logger.info('Creating catalina.policy') # add "do not edit" warning - filename = '/usr/share/pki/server/conf/catalina.policy' + filename = '/usr/local/share/pki/server/conf/catalina.policy' logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content = f.read() # add Tomcat's default policy - filename = '/usr/share/tomcat/conf/catalina.policy' + filename = '/usr/local/apache-tomcat-9.0/conf/catalina.policy' logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content += f.read() -@@ -376,7 +410,7 @@ class PKIServer(object): +@@ -376,7 +428,7 @@ class PKIServer(object): content += '\n\n' # add PKI's default policy - filename = '/usr/share/pki/server/conf/pki.policy' + filename = '/usr/local/share/pki/server/conf/pki.policy' logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content += f.read() -@@ -450,7 +484,7 @@ grant codeBase "file:%s" { +@@ -450,7 +502,7 @@ grant codeBase "file:%s" { def start(self, wait=False, max_wait=60, timeout=None): - cmd = ['systemctl', 'start', '%s.service' % self.service_name] + cmd = ['/usr/sbin/service', self.rc_service_name, 'onestart'] logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -490,7 +524,11 @@ grant codeBase "file:%s" { +@@ -490,7 +542,11 @@ grant codeBase "file:%s" { def stop(self, wait=False, max_wait=60, timeout=None): - cmd = ['systemctl', 'stop', '%s.service' % self.service_name] + if not self.is_active(): + logger.info("PKI server already stopped") + return + + cmd = ['/usr/sbin/service', self.rc_service_name, 'onestop'] logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -536,12 +574,17 @@ grant codeBase "file:%s" { +@@ -536,12 +592,17 @@ grant codeBase "file:%s" { self.start(wait=wait, max_wait=max_wait, timeout=timeout) def enable(self): - cmd = ['systemctl', 'enable', '%s.service' % self.service_name] + cmd = ['/usr/sbin/service', self.rc_service_name, 'enable'] logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) def disable(self): - cmd = ['systemctl', 'disable', '%s.service' % self.service_name] + + if not os.path.exists(self.rc_script): + logger.info("PKI server already disabled") + return + + cmd = ['/usr/sbin/service', self.rc_service_name, 'disable'] logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -581,16 +624,20 @@ grant codeBase "file:%s" { +@@ -581,16 +642,20 @@ grant codeBase "file:%s" { for name in self.config: logger.debug('- %s: %s', name, self.config[name]) - prefix = [] + subprocess_kwargs = {} - # by default run PKI server as systemd user + # by default run PKI server as service user if not as_current_user: current_user = pwd.getpwuid(os.getuid()).pw_name - # switch to systemd user if different from current user + # switch to service user if different from current user if current_user != self.user: - prefix.extend(['/usr/sbin/runuser', '-u', self.user, '--']) + subprocess_kwargs.update({ + 'user': self.user, + 'group': self.group, + 'extra_groups': os.getgrouplist(self.user, self.gid) + }) java_home = self.config.get('JAVA_HOME') java_opts = self.config.get('JAVA_OPTS') -@@ -599,12 +646,12 @@ grant codeBase "file:%s" { +@@ -599,12 +664,12 @@ grant codeBase "file:%s" { classpath = [ Tomcat.SHARE_DIR + '/bin/bootstrap.jar', Tomcat.SHARE_DIR + '/bin/tomcat-juli.jar', - '/usr/share/java/ant.jar', - '/usr/share/java/ant-launcher.jar', + '/usr/local/share/java/apache-ant/lib/ant.jar', + '/usr/local/share/java/apache-ant/lib/ant-launcher.jar', '/usr/lib/jvm/java/lib/tools.jar' ] - cmd = prefix + cmd = [] if with_valgrind: cmd.extend(['valgrind', '--trace-children=yes', '--tool=massif']) -@@ -618,7 +665,7 @@ grant codeBase "file:%s" { +@@ -618,7 +683,7 @@ grant codeBase "file:%s" { else: cmd.extend([java_home + '/bin/java']) - # add JVM options as in /etc/tomcat/conf.d/java-9-start-up-parameters.conf + # add JVM options as in /usr/local/apache-tomcat-9.0/conf/conf.d/java-9-start-up-parameters.conf cmd.extend([ '--add-opens', 'java.base/java.lang=ALL-UNNAMED', '--add-opens', 'java.base/java.io=ALL-UNNAMED', -@@ -661,7 +708,7 @@ grant codeBase "file:%s" { +@@ -661,7 +726,7 @@ grant codeBase "file:%s" { logger.debug('Command: %s', ' '.join(cmd)) - return subprocess.Popen(cmd, env=self.config) + return subprocess.Popen(cmd, env=self.config, **subprocess_kwargs) def chown(self, path): -@@ -787,8 +834,8 @@ grant codeBase "file:%s" { +@@ -787,8 +852,8 @@ grant codeBase "file:%s" { self.create_logging_properties(exist_ok=True) self.create_web_xml(exist_ok=True) - # copy /etc/tomcat/tomcat.conf - # to /var/lib/pki//conf/tomcat.conf + # copy /usr/local/apache-tomcat-9.0/conf/tomcat.conf + # to /var/db/pki//conf/tomcat.conf self.copy( Tomcat.TOMCAT_CONF, self.tomcat_conf, -@@ -798,7 +845,7 @@ grant codeBase "file:%s" { +@@ -798,7 +863,7 @@ grant codeBase "file:%s" { tomcat_conf = pki.PropertyFile(self.tomcat_conf, quote='"') tomcat_conf.read() - # store JAVA_HOME from /usr/share/pki/etc/pki.conf + # store JAVA_HOME from /usr/local/share/pki/etc/pki.conf java_home = os.getenv('JAVA_HOME') tomcat_conf.set('JAVA_HOME', java_home) -@@ -810,27 +857,21 @@ grant codeBase "file:%s" { +@@ -810,27 +875,21 @@ grant codeBase "file:%s" { tomcat_conf.write() - # copy /var/lib/pki//conf/tomcat.conf - # to /etc/sysconfig/@ - self.copy( - self.tomcat_conf, - self.service_conf, - exist_ok=True, - force=force) + self.create_rc_service(exist_ok=True) def create_conf_dir(self, exist_ok=False): if self._conf_dir: - # Create /etc/pki/ + # Create /usr/local/etc/pki/ self.makedirs(self._conf_dir, exist_ok=exist_ok) - # Link /var/lib/pki//conf to /etc/pki/ + # Link /var/db/pki//conf to /usr/local/etc/pki/ self.symlink(self._conf_dir, self.conf_dir, exist_ok=exist_ok) return - # Create /var/lib/pki//conf + # Create /var/db/pki//conf self.makedirs(self.conf_dir, exist_ok=exist_ok) def create_logs_dir(self, exist_ok=False): -@@ -844,15 +885,15 @@ grant codeBase "file:%s" { +@@ -844,15 +903,15 @@ grant codeBase "file:%s" { backup_dir = os.path.join(self._logs_dir, 'backup') self.makedirs(backup_dir, exist_ok=exist_ok) - # Link /var/lib/pki//logs to /var/log/pki/ + # Link /var/db/pki//logs to /var/log/pki/ self.symlink(self._logs_dir, self.logs_dir, exist_ok=exist_ok) return - # Create /var/lib/pki//logs + # Create /var/db/pki//logs self.makedirs(self.logs_dir, exist_ok=exist_ok) - # Create /var/lib/pki//logs/backup + # Create /var/db/pki//logs/backup backup_dir = os.path.join(self.logs_dir, 'backup') self.makedirs(backup_dir, exist_ok=exist_ok) -@@ -868,8 +909,8 @@ grant codeBase "file:%s" { +@@ -868,8 +927,8 @@ grant codeBase "file:%s" { def create_catalina_properties(self, exist_ok=False): - # Link /var/lib/pki//conf/catalina.properties - # to /usr/share/pki/server/conf/catalina.properties. + # Link /var/db/pki//conf/catalina.properties + # to /usr/local/share/pki/server/conf/catalina.properties. catalina_properties = os.path.join( PKIServer.SHARE_DIR, 'server', 'conf', 'catalina.properties') -@@ -877,16 +918,16 @@ grant codeBase "file:%s" { +@@ -877,16 +936,16 @@ grant codeBase "file:%s" { def create_context_xml(self, exist_ok=False): - # Link /var/lib/pki//conf/context.xml - # to /etc/tomcat/context.xml. + # Link /var/db/pki//conf/context.xml + # to /usr/local/apache-tomcat-9.0/conf/context.xml. context_xml = os.path.join(Tomcat.CONF_DIR, 'context.xml') self.symlink(context_xml, self.context_xml, exist_ok=exist_ok) def create_logging_properties(self, exist_ok=False): - # Copy /etc/tomcat/logging.properties - # to /var/lib/pki//conf/logging.properties. + # Copy /usr/local/apache-tomcat-9.0/conf/logging.properties + # to /var/db/pki//conf/logging.properties. logging_properties = os.path.join(Tomcat.CONF_DIR, 'logging.properties') self.copy( -@@ -896,7 +937,7 @@ grant codeBase "file:%s" { +@@ -896,7 +955,7 @@ grant codeBase "file:%s" { def create_server_xml(self, exist_ok=False): - # Copy /etc/tomcat/server.xml to /conf/server.xml + # Copy /usr/local/apache-tomcat-9.0/conf/server.xml to /conf/server.xml self.copy( pki.server.Tomcat.SERVER_XML, -@@ -973,7 +1014,7 @@ grant codeBase "file:%s" { +@@ -973,7 +1032,7 @@ grant codeBase "file:%s" { self.makedirs(host_dir, exist_ok=exist_ok) # Link /conf///rewrite.config - # to /usr/share/pki/server/conf/Catalina/localhost/rewrite.config + # to /usr/local/share/pki/server/conf/Catalina/localhost/rewrite.config link = os.path.join(host_dir, 'rewrite.config') self.symlink(target, link, exist_ok=exist_ok) -@@ -982,8 +1023,8 @@ grant codeBase "file:%s" { +@@ -982,8 +1041,8 @@ grant codeBase "file:%s" { def create_web_xml(self, exist_ok=False): - # Link /var/lib/pki//conf/web.xml - # to /etc/tomcat/web.xml. + # Link /var/db/pki//conf/web.xml + # to /usr/local/apache-tomcat-9.0/conf/web.xml. self.symlink( os.path.join(Tomcat.CONF_DIR, 'web.xml'), -@@ -1327,7 +1368,7 @@ grant codeBase "file:%s" { +@@ -1304,8 +1363,7 @@ grant codeBase "file:%s" { + + def remove(self, remove_conf=False, remove_logs=False, force=False): + +- logger.info('Removing %s', self.service_conf) +- pki.util.remove(self.service_conf, force=force) ++ self.remove_rc_service(force=force) + + logger.info('Removing %s', self.work_dir) + pki.util.rmtree(self.work_dir, force=force) +@@ -1327,7 +1385,7 @@ grant codeBase "file:%s" { logger.info('Removing %s', self.bin_dir) pki.util.unlink(self.bin_dir, force=force) - # remove /var/lib/pki//alias if exists + # remove /var/db/pki//alias if exists if os.path.islink(self.nssdb_link): logger.info('Removing %s', self.nssdb_link) pki.util.unlink(self.nssdb_link) -@@ -1356,7 +1397,7 @@ grant codeBase "file:%s" { +@@ -1356,7 +1414,7 @@ grant codeBase "file:%s" { # Get the actual folder in case it has changed _logs_dir = os.readlink(self.logs_dir) - # Remove /var/lib/pki//logs + # Remove /var/db/pki//logs logger.info('Removing %s', self.logs_dir) pki.util.unlink(self.logs_dir, force=force) -@@ -1366,7 +1407,7 @@ grant codeBase "file:%s" { +@@ -1366,7 +1424,7 @@ grant codeBase "file:%s" { return - # Remove /var/lib/pki//logs + # Remove /var/db/pki//logs logger.info('Removing %s', self.logs_dir) pki.util.rmtree(self.logs_dir, force=force) -@@ -1377,17 +1418,17 @@ grant codeBase "file:%s" { +@@ -1377,17 +1435,17 @@ grant codeBase "file:%s" { # Get the actual folder in case it has changed _conf_dir = os.readlink(self.conf_dir) - # Remove /var/lib/pki//conf + # Remove /var/db/pki//conf logger.info('Removing %s', self.conf_dir) pki.util.unlink(self.conf_dir, force=force) - # Remove /etc/pki/ + # Remove /usr/local/etc/pki/ logger.info('Removing %s', _conf_dir) pki.util.rmtree(_conf_dir, force=force) return - # Remove /var/lib/pki//conf + # Remove /var/db/pki//conf logger.info('Removing %s', self.conf_dir) pki.util.rmtree(self.conf_dir, force=force) -@@ -1468,11 +1509,11 @@ grant codeBase "file:%s" { +@@ -1468,11 +1526,11 @@ grant codeBase "file:%s" { subsystem_dir = os.path.join(self.base_dir, subsystem_name) - # ensure /var/lib/pki// exists + # ensure /var/db/pki// exists if not os.path.exists(subsystem_dir): continue - # ensure /var/lib/pki// is not empty + # ensure /var/db/pki// is not empty # https://issues.redhat.com/browse/RHEL-21568 if not os.listdir(subsystem_dir): # Directory exists but it is empty -@@ -2398,7 +2439,11 @@ class PKIServerFactory(object): +@@ -2398,7 +2456,11 @@ class PKIServerFactory(object): instance_type = parts[0] instance_name = parts[1] - sysconfig_file = os.path.join('/etc/sysconfig', instance_name) + rc_service_name = "".join( + char if char.isalnum() or char == "_" else "_" + for char in "%s@%s" % (instance_type, instance_name)) + + sysconfig_file = os.path.join(RC_CONF_DIR, rc_service_name) if os.path.isfile(sysconfig_file): diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_cli_acme.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_cli_acme.py new file mode 100644 index 000000000000..67fa55fd50a9 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_cli_acme.py @@ -0,0 +1,47 @@ +--- base/server/python/pki/server/cli/acme.py.orig 2025-08-05 19:20:05 UTC ++++ base/server/python/pki/server/cli/acme.py +@@ -437,7 +437,7 @@ class ACMEMetadataShowCLI(pki.cli.CLI): + config = {} + + if not os.path.exists(metadata_conf): +- source = '/usr/share/pki/acme/conf/metadata.conf' ++ source = '/usr/local/share/pki/acme/conf/metadata.conf' + else: + source = metadata_conf + +@@ -524,7 +524,7 @@ class ACMEMetadataModifyCLI(pki.cli.CLI): + config = {} + + if not os.path.exists(metadata_conf): +- source = '/usr/share/pki/acme/conf/metadata.conf' ++ source = '/usr/local/share/pki/acme/conf/metadata.conf' + else: + source = metadata_conf + +@@ -810,7 +810,7 @@ class ACMEDatabaseModifyCLI(pki.cli.CLI): + pki.server.subsystem.ACME_DATABASE_CLASSES.get(database_type)) + + if orig_database_type != database_type: +- source = '/usr/share/pki/acme/database/{0}/database.conf'.format(database_type) ++ source = '/usr/local/share/pki/acme/database/{0}/database.conf'.format(database_type) + logger.info('Loading %s', source) + pki.util.load_properties(source, config) + +@@ -1143,7 +1143,7 @@ class ACMEIssuerModifyCLI(pki.cli.CLI): + pki.server.subsystem.ACME_ISSUER_CLASSES.get(issuer_type)) + + if orig_issuer_type != issuer_type: +- source = '/usr/share/pki/acme/issuer/{0}/issuer.conf'.format(issuer_type) ++ source = '/usr/local/share/pki/acme/issuer/{0}/issuer.conf'.format(issuer_type) + logger.info('Loading %s', source) + pki.util.load_properties(source, config) + +@@ -1488,7 +1488,7 @@ class ACMERealmModifyCLI(pki.cli.CLI): + pki.server.subsystem.ACME_REALM_CLASSES.get(realm_type)) + + if orig_realm_type != realm_type: +- source = '/usr/share/pki/acme/realm/{0}/realm.conf'.format(realm_type) ++ source = '/usr/local/share/pki/acme/realm/{0}/realm.conf'.format(realm_type) + logger.info('Loading %s', source) + pki.util.load_properties(source, config) + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py index 3f3d693f9fb7..714e7b1965f6 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py @@ -1,75 +1,80 @@ ---- base/server/python/pki/server/deployment/scriptlets/instance_layout.py.orig 2026-07-12 10:34:10 UTC +--- base/server/python/pki/server/deployment/scriptlets/instance_layout.py.orig 2025-08-05 19:20:05 UTC +++ base/server/python/pki/server/deployment/scriptlets/instance_layout.py @@ -160,15 +160,6 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl deployer.create_server_nssdb() - # Copy /usr/share/pki/server/conf/tomcat.conf - # to /etc/sysconfig/ - - instance.copyfile( - os.path.join(shared_conf_path, 'tomcat.conf'), - instance.service_conf, - params=deployer.mdict, - exist_ok=True) - # Copy /usr/share/pki/server/conf/tomcat.conf to # /var/lib/pki//conf/tomcat.conf. @@ -211,31 +202,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl return if config.str2bool(deployer.mdict['pki_systemd_service_create']): + instance.create_rc_service(exist_ok=True) - user = deployer.mdict['pki_user'] - group = deployer.mdict['pki_group'] - - if user != 'pkiuser' or group != 'pkiuser': - deployer.set_systemd_override( - 'Service', 'User', user, 'user.conf') - deployer.set_systemd_override( - 'Service', 'Group', group, 'user.conf') - - deployer.write_systemd_overrides() - deployer.systemd.daemon_reload() - - # Link /etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd@.service - # to /lib/systemd/system/pki-tomcatd@.service - - systemd_service_link = os.path.join( - pki.server.instance.PKIInstance.TARGET_WANTS, - instance.service_name + '.service') - - instance.symlink( - pki.server.instance.PKIInstance.UNIT_FILE, - systemd_service_link, - exist_ok=True) - def destroy(self, deployer): instance = self.instance -@@ -246,21 +214,9 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl +@@ -246,27 +214,11 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl logger.info('Removing %s instance', instance.name) - logger.info('Removing %s', deployer.systemd.systemd_link) - pki.util.unlink(link=deployer.systemd.systemd_link, -+ logger.info('Removing %s', instance.rc_script) -+ pki.util.unlink(link=instance.rc_script, - force=deployer.force) -- +- force=deployer.force) ++ instance.remove_rc_service(force=deployer.force) + - if os.path.exists(deployer.systemd.base_override_dir): - logger.info('Removing %s', deployer.systemd.base_override_dir) - pki.util.rmtree(path=deployer.systemd.base_override_dir, - force=deployer.force) - - if os.path.exists(deployer.systemd.nuxwdog_override_dir): - logger.info('Removing %s', deployer.systemd.nuxwdog_override_dir) - pki.util.rmtree(path=deployer.systemd.nuxwdog_override_dir, - force=deployer.force) - - deployer.systemd.daemon_reload() - +- if config.str2bool(deployer.mdict['pki_registry_enable']): instance.remove_registry(force=deployer.force) + +- logger.info('Removing %s', instance.service_conf) +- pki.util.remove(instance.service_conf, force=deployer.force) + + logger.info('Removing %s', instance.work_dir) + pki.util.rmtree(instance.work_dir, force=deployer.force) diff --git a/security/dogtag-pki/files/patch-base_server_share_conf_tomcat.conf b/security/dogtag-pki/files/patch-base_server_share_conf_tomcat.conf new file mode 100644 index 000000000000..8b33ebe68f74 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_share_conf_tomcat.conf @@ -0,0 +1,11 @@ +--- base/server/share/conf/tomcat.conf.orig 2025-08-05 19:20:05 UTC ++++ base/server/share/conf/tomcat.conf +@@ -27,7 +27,7 @@ CATALINA_TMPDIR="[pki_instance_path]/temp" + # -Djava.library.path=/usr/lib + # - parameters to run a java debugger (e. g. - 'eclipse') + # -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=n -Djava.awt.headless=true -Xmx128M +-JAVA_OPTS="-Dcom.redhat.fips=false" ++JAVA_OPTS="-Dcom.redhat.fips=false -Djava.net.preferIPv4Stack=false" + + # What user should run tomcat + TOMCAT_USER="[pki_user]" diff --git a/security/dogtag-pki/pkg-plist b/security/dogtag-pki/pkg-plist index 4259e4883cad..1119cbaa262f 100644 --- a/security/dogtag-pki/pkg-plist +++ b/security/dogtag-pki/pkg-plist @@ -1,15 +1,16 @@ bin/pki bin/pkidaemon sbin/pki-server sbin/pki-upgrade sbin/pkidestroy sbin/pkispawn +%%JAVAJARDIR%%/pki/pki-acme.jar %%JAVAJARDIR%%/pki/pki-ca.jar %%JAVAJARDIR%%/pki/pki-common.jar %%JAVAJARDIR%%/pki/pki-server-webapp.jar %%JAVAJARDIR%%/pki/pki-server.jar %%JAVAJARDIR%%/pki/pki-tomcat-9.0.jar %%JAVAJARDIR%%/pki/pki-tomcat.jar %%JAVAJARDIR%%/pki/pki-tools.jar @dir /var/log/pki lib/libpki-tps.so