diff --git a/security/dogtag-pki/Makefile b/security/dogtag-pki/Makefile index 15d0a3dad3be..e8b934a33ea8 100644 --- a/security/dogtag-pki/Makefile +++ b/security/dogtag-pki/Makefile @@ -1,41 +1,330 @@ PORTNAME= dogtag-pki DISTVERSIONPREFIX= v DISTVERSION= 11.7.0 -PORTREVISION= 3 -CATEGORIES= security python +PORTREVISION= 4 +CATEGORIES= security java python MAINTAINER= joneum@FreeBSD.org -COMMENT= Python client and server modules for Dogtag PKI +COMMENT= Dogtag PKI certificate system and server components WWW= https://github.com/dogtagpki/pki LICENSE= GPLv2 LICENSE_FILE= ${WRKSRC}/LICENSE -BUILD_DEPENDS= ${PY_SETUPTOOLS} \ +_JAVA_DEPENDS= ${JAVAJARDIR}/commons-cli.jar:java/apache-commons-cli \ + ${JAVAJARDIR}/commons-codec.jar:java/apache-commons-codec \ + ${JAVAJARDIR}/commons-io.jar:devel/apache-commons-io \ + ${JAVAJARDIR}/commons-lang3.jar:java/apache-commons-lang3 \ + ${JAVAJARDIR}/commons-logging.jar:java/apache-commons-logging \ + ${JAVAJARDIR}/commons-net.jar:net/apache-commons-net \ + ${JAVAJARDIR}/httpclient.jar:www/httpclient \ + ${JAVAJARDIR}/httpcore.jar:www/httpcore \ + ${JAVAJARDIR}/jackson-annotations.jar:devel/jackson-annotations \ + ${JAVAJARDIR}/jackson-core.jar:devel/jackson-core \ + ${JAVAJARDIR}/jackson-databind.jar:devel/jackson-databind \ + ${JAVAJARDIR}/jackson-jaxrs-json-provider.jar:devel/jackson-jaxrs-providers \ + ${JAVAJARDIR}/jackson-module-jaxb-annotations.jar:devel/jackson-module-jaxb-annotations \ + ${JAVAJARDIR}/jakarta.activation-api.jar:devel/jakarta-activation-api \ + ${JAVAJARDIR}/jakarta.annotation-api.jar:devel/jakarta-annotation-api \ + ${JAVAJARDIR}/jakarta.xml.bind-api.jar:devel/jakarta-xml-bind-api \ + ${JAVAJARDIR}/javax.ws.rs-api.jar:devel/javax-ws-rs-api \ + ${JAVAJARDIR}/javax.activation-api.jar:devel/javax-activation-api \ + ${JAVAJARDIR}/jaxb-api.jar:devel/jaxb-api \ + ${JAVAJARDIR}/jboss-logging.jar:devel/jboss-logging \ + dogtag-jss>=5.7.0:security/dogtag-jss \ + ${JAVAJARDIR}/ldapjdk.jar:net/dogtag-ldap-sdk \ + ${JAVAJARDIR}/resteasy-servlet-initializer.jar:devel/resteasy \ + ${JAVAJARDIR}/slf4j-api.jar:devel/slf4j + +BUILD_DEPENDS= ${_JAVA_DEPENDS} \ + ${LOCALBASE}/apache-tomcat-9.0/lib/jaspic-api.jar:www/tomcat9 \ + ${LOCALBASE}/apache-tomcat-9.0/lib/servlet-api.jar:www/tomcat9 \ + ${PY_SETUPTOOLS} \ ${PYTHON_PKGNAMEPREFIX}wheel>0:devel/py-wheel@${PY_FLAVOR} -RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}cryptography>0:security/py-cryptography@${PY_FLAVOR} \ + +LIB_DEPENDS= libapr-1.so:devel/apr1 \ + libldap.so:net/openldap26-client \ + libnspr4.so:devel/nspr \ + libnss3.so:security/nss + +RUN_DEPENDS= ${_JAVA_DEPENDS} \ + ${LOCALBASE}/apache-tomcat-9.0/bin/catalina.sh:www/tomcat9 \ + ${LOCALBASE}/lib/pkcs11/p11-kit-trust.so:security/p11-kit \ + ${PYTHON_PKGNAMEPREFIX}cryptography>0:security/py-cryptography@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}lxml>0:devel/py-lxml@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}python-ldap>0:net/py-python-ldap@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}requests>0:www/py-requests@${PY_FLAVOR} \ - ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR} + ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR} \ + bash:shells/bash -USERS= pkiuser -GROUPS= pkiuser - -USES= python shebangfix +USES= cmake:indirect java:build,run pkgconfig python shebangfix USE_GITHUB= yes GH_ACCOUNT= dogtagpki GH_PROJECT= pki +JAVA_VERSION= 17 +USE_LDCONFIG= yes USE_PYTHON= autoplist pep517 -SHEBANG_FILES= base/common/upgrade/*/*.py base/server/upgrade/*/*.py +SHEBANG_FILES= base/common/upgrade/*/*.py base/server/scripts/operations \ + base/server/scripts/pkidaemon base/server/upgrade/*/*.py + +CMAKE_ARGS= -DAPP_SERVER=tomcat-9.0 \ + -DCOMMONS_CLI_JAR=${JAVAJARDIR}/commons-cli.jar \ + -DCOMMONS_CODEC_JAR=${JAVAJARDIR}/commons-codec.jar \ + -DCOMMONS_IO_JAR=${JAVAJARDIR}/commons-io.jar \ + -DCOMMONS_LANG3_JAR=${JAVAJARDIR}/commons-lang3.jar \ + -DCOMMONS_LOGGING_JAR=${JAVAJARDIR}/commons-logging.jar \ + -DCOMMONS_NET_JAR=${JAVAJARDIR}/commons-net.jar \ + -DHTTPCLIENT_JAR=${JAVAJARDIR}/httpclient.jar \ + -DHTTPCORE_JAR=${JAVAJARDIR}/httpcore.jar \ + -DJACKSON_ANNOTATIONS_JAR=${JAVAJARDIR}/jackson-annotations.jar \ + -DJACKSON_CORE_JAR=${JAVAJARDIR}/jackson-core.jar \ + -DJACKSON_DATABIND_JAR=${JAVAJARDIR}/jackson-databind.jar \ + -DJACKSON_JAXRS_BASE_JAR=${JAVAJARDIR}/jackson-jaxrs-base.jar \ + -DJACKSON_JAXRS_JSON_PROVIDER_JAR=${JAVAJARDIR}/jackson-jaxrs-json-provider.jar \ + -DJACKSON_MODULE_JAXB_ANNOTATIONS_JAR=${JAVAJARDIR}/jackson-module-jaxb-annotations.jar \ + -DJAKARTA_ACTIVATION_API_JAR=${JAVAJARDIR}/jakarta.activation-api.jar \ + -DJAKARTA_ANNOTATION_API_JAR=${JAVAJARDIR}/jakarta.annotation-api.jar \ + -DJASPIC_API_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/jaspic-api.jar \ + -DJAVA_HOME=${JAVA_HOME} \ + -DJAVA_JAR_INSTALL_DIR=${JAVAJARDIR} \ + -DJAVA_LIB_INSTALL_DIR=${JAVAJARDIR} \ + -DJAXB_API_JAR=${JAVAJARDIR}/jakarta.xml.bind-api.jar \ + -DJAXRS_API_JAR=${JAVAJARDIR}/javax.ws.rs-api.jar \ + -DJBOSS_LOGGING_JAR=${JAVAJARDIR}/jboss-logging.jar \ + -DJSS_JAR=${JAVAJARDIR}/jss.jar \ + -DJSS_TOMCAT_9_0_JAR=${JAVAJARDIR}/jss-tomcat-9.0.jar \ + -DJSS_TOMCAT_JAR=${JAVAJARDIR}/jss-tomcat.jar \ + -DLDAPJDK_JAR=${JAVAJARDIR}/ldapjdk.jar \ + -DP11_KIT_TRUST=${LOCALBASE}/lib/pkcs11/p11-kit-trust.so \ + -DPYTHON3_SITE_PACKAGES=${PYTHONPREFIX_SITELIBDIR} \ + -DPYTHON_EXECUTABLE=${PYTHON_CMD} \ + -DRELEASE=${PORTREVISION:U0} \ + -DRESTEASY_JACKSON_PROVIDER_JAR=${JAVAJARDIR}/resteasy-jackson2-provider.jar \ + -DRESTEASY_JAXRS_JAR=${JAVAJARDIR}/resteasy-jaxrs.jar \ + -DRESTEASY_SERVLET_INITIALIZER_JAR=${JAVAJARDIR}/resteasy-servlet-initializer.jar \ + -DSERVLET_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/servlet-api.jar \ + -DSLF4J_API_JAR=${JAVAJARDIR}/slf4j-api.jar \ + -DSLF4J_JDK14_JAR=${JAVASHAREDIR}/slf4j/slf4j-jdk14.jar \ + -DTOMCAT_API_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-api.jar \ + -DTOMCAT_CATALINA_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/catalina.jar \ + -DTOMCAT_COYOTE_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-coyote.jar \ + -DTOMCAT_UTIL_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util.jar \ + -DTOMCAT_UTIL_SCAN_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util-scan.jar \ + -DVERSION=${DISTVERSION} \ + -DWITH_PYTHON_DOCS=OFF + +CMAKE_ON= WITH_CA WITH_JAVA WITH_SERVER + +CMAKE_OFF= RUN_TESTS WITH_ACME WITH_CONSOLE WITH_EST WITH_JAVADOC WITH_KRA \ + WITH_META WITH_OCSP WITH_TESTS WITH_THEME WITH_TKS WITH_TPS \ + WITH_WURST + +CMAKE_SOURCE_PATH= ${WRKSRC} + +DATADIR= ${PREFIX}/share/pki + +SUB_FILES= pki.conf pkidestroy pkispawn tomcat.conf +SUB_LIST+= JAVA_HOME=${JAVA_HOME} \ + JAVALIBDIR=${JAVALIBDIR} \ + PYTHON_CMD=${PYTHON_CMD} + +USERS= pkiuser +GROUPS= pkiuser + +PORTDATA= * + +_JAVA_BUILD_DIR= ${WRKDIR}/java-build + +_JAVA_TARGETS= tps_library java pki-ca-links pki-lib pki-server-common-lib \ + pki-server-lib pki-server-webapp-lib + +_DOGTAG_JARS= pki-ca.jar pki-common.jar pki-server-webapp.jar pki-server.jar \ + pki-tomcat-9.0.jar pki-tomcat.jar pki-tools.jar + +_RLN_PLACEHOLDERS=${JAVAJARDIR}/jss-tomcat.jar \ +${JAVAJARDIR}/jss-tomcat-9.0.jar \ +${JAVAJARDIR}/resteasy-servlet-initializer.jar + +post-build: +# Configure the Java build tree + @${RM} -r ${_JAVA_BUILD_DIR} + @${MKDIR} ${_JAVA_BUILD_DIR} + cd ${_JAVA_BUILD_DIR} && \ + ${SETENVI} ${WRK_ENV} ${CONFIGURE_ENV} \ + JAVA_HOME=${JAVA_HOME} \ + ${CMAKE_BIN} ${CMAKE_ARGS} ${CMAKE_SOURCE_PATH} + +# Build Java archives and runtime link trees + ${SETENVI} ${WRK_ENV} ${MAKE_ENV} \ + JAVA_HOME=${JAVA_HOME} \ + ${CMAKE_BIN} --build ${_JAVA_BUILD_DIR} \ + --parallel ${MAKE_JOBS_NUMBER} \ + --target ${_JAVA_TARGETS} + +post-install: post-install-runtime + +post-install-native: + @${MKDIR} ${STAGEDIR}${PREFIX}/lib + ${INSTALL_LIB} ${_JAVA_BUILD_DIR}/base/tools/src/main/native/tpsclient/src/libpki-tps.so \ + ${STAGEDIR}${PREFIX}/lib/libpki-tps.so + ${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libpki-tps.so + +post-install-java: post-install-native + @${MKDIR} ${STAGEDIR}${JAVAJARDIR}/pki +.for jar in ${_DOGTAG_JARS} + ${INSTALL_DATA} ${_JAVA_BUILD_DIR}/dist/${jar} \ + ${STAGEDIR}${JAVAJARDIR}/pki/${jar} +.endfor + +post-install-tools: post-install-java + @${MKDIR} ${STAGEDIR}${PREFIX}/bin \ + ${STAGEDIR}${PREFIX}/sbin + ${INSTALL_SCRIPT} ${WRKSRC}/base/tools/bin/pki \ + ${STAGEDIR}${PREFIX}/bin/pki + ${INSTALL_SCRIPT} ${WRKSRC}/base/common/sbin/pki-upgrade \ + ${STAGEDIR}${PREFIX}/sbin/pki-upgrade + ${INSTALL_SCRIPT} ${WRKSRC}/base/server/scripts/pkidaemon \ + ${STAGEDIR}${PREFIX}/bin/pkidaemon + ${INSTALL_SCRIPT} ${WRKSRC}/base/server/sbin/pki-server \ + ${STAGEDIR}${PREFIX}/sbin/pki-server + ${INSTALL_SCRIPT} ${WRKDIR}/pkidestroy \ + ${STAGEDIR}${PREFIX}/sbin/pkidestroy + ${INSTALL_SCRIPT} ${WRKDIR}/pkispawn \ + ${STAGEDIR}${PREFIX}/sbin/pkispawn + +post-install-common: post-install-tools + @${MKDIR} ${STAGEDIR}${DATADIR} + ${INSTALL_DATA} ${WRKSRC}/pom.xml ${STAGEDIR}${DATADIR}/pom.xml +.for dir in key upgrade + cd ${WRKSRC}/base/common && \ + ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR} \ + "! -name CMakeLists.txt" +.endfor + +post-install-server: post-install-common + @${MKDIR} ${STAGEDIR}${DATADIR}/deployment \ + ${STAGEDIR}${DATADIR}/server \ + ${STAGEDIR}${DATADIR}/setup + cd ${WRKSRC}/base/server && \ + ${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/server +.for dir in certs database upgrade + cd ${WRKSRC}/base/server && \ + ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/server \ + "! -name CMakeLists.txt" +.endfor + cd ${WRKSRC}/base/server && \ + ${COPYTREE_SHARE} config ${STAGEDIR}${DATADIR}/deployment \ + "! -name CMakeLists.txt" + cd ${WRKSRC}/base/server && \ + ${COPYTREE_SHARE} setup ${STAGEDIR}${DATADIR} \ + "! -name CMakeLists.txt" + cd ${WRKSRC}/base/server/share && \ + ${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/server \ + "! -name CMakeLists.txt ! -path ./lib ! -path ./lib/* ! -path ./etc ! -path ./etc/*" + cd ${WRKSRC}/base/server && \ + ${COPYTREE_SHARE} etc ${STAGEDIR}${DATADIR}/server \ + "! -name CMakeLists.txt" + cd ${WRKSRC}/base/server-webapp && \ + ${COPYTREE_SHARE} webapps ${STAGEDIR}${DATADIR}/server \ + "! -name CMakeLists.txt" + cd ${WRKSRC}/base/tomcat-9.0 && \ + ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/server \ + "! -name CMakeLists.txt" + +post-install-ca: post-install-server + @${MKDIR} ${STAGEDIR}${DATADIR}/ca + cd ${WRKSRC}/base/ca && \ + ${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/ca +.for dir in auth database + cd ${WRKSRC}/base/ca && \ + ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/ca \ + "! -name CMakeLists.txt" +.endfor + cd ${WRKSRC}/base/ca/shared && \ + ${COPYTREE_SHARE} . ${STAGEDIR}${DATADIR}/ca \ + "! -name CMakeLists.txt ! -path ./conf/CS.cfg" + cd ${WRKSRC}/base/ca/tomcat-9.0 && \ + ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/ca \ + "! -name CMakeLists.txt" + +post-install-links: post-install-ca + @${MKDIR} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF \ + ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin \ + ${STAGEDIR}${DATADIR}/server/common \ + ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF + cd ${_JAVA_BUILD_DIR}/base/common && \ + ${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR} + cd ${_JAVA_BUILD_DIR}/base/server && \ + ${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}/server + cd ${_JAVA_BUILD_DIR}/base/server/common && \ + ${COPYTREE_SHARE} lib ${STAGEDIR}${DATADIR}/server/common + cd ${_JAVA_BUILD_DIR}/base/server-webapp/webapp && \ + ${COPYTREE_SHARE} lib \ + ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF + cd ${_JAVA_BUILD_DIR}/base/ca/webapp && \ + ${COPYTREE_SHARE} lib \ + ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF + cd ${_JAVA_BUILD_DIR}/base/ca/webapp/admin && \ + ${COPYTREE_SHARE} . \ + ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin + + # Replace fragile upstream links with FreeBSD relative symlinks. + @${TOUCH} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},} + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat-9.0.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat-9.0.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-tomcat-9.0.jar ${STAGEDIR}${DATADIR}/server/common/lib/pki-tomcat-9.0.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/resteasy-servlet-initializer.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/server/common/lib/resteasy-servlet-initializer.jar + @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-server.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-server.jar + @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-ca.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-ca.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/pki-ca.jar + @${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server.jar + @${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server-webapp.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server-webapp.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/pki-server-webapp.jar + @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/resteasy-servlet-initializer.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF/lib/resteasy-servlet-initializer.jar + @${RM} ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/resteasy-servlet-initializer.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/resteasy-servlet-initializer.jar ${STAGEDIR}${DATADIR}/server/webapps/pki/WEB-INF/lib/resteasy-servlet-initializer.jar + @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console + ${RLN} ${STAGEDIR}${DATADIR}/server/webapps/pki/admin/console ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console + + @${RM} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},} + +post-install-config: post-install-links + @${MKDIR} ${STAGEDIR}${DATADIR}/ca/conf \ + ${STAGEDIR}${DATADIR}/etc \ + ${STAGEDIR}${DATADIR}/scripts + ${INSTALL_DATA} ${_JAVA_BUILD_DIR}/base/ca/shared/conf/CS.cfg \ + ${STAGEDIR}${DATADIR}/ca/conf/CS.cfg -NO_ARCH= yes +# Shared configuration and helper scripts + ${INSTALL_DATA} ${WRKDIR}/pki.conf \ + ${STAGEDIR}${DATADIR}/etc/pki.conf + ${INSTALL_DATA} ${WRKDIR}/tomcat.conf \ + ${STAGEDIR}${DATADIR}/etc/tomcat.conf + ${INSTALL_DATA} ${WRKSRC}/base/common/share/etc/logging.properties \ + ${STAGEDIR}${DATADIR}/etc/logging.properties + ${INSTALL_DATA} ${WRKSRC}/base/common/scripts/config \ + ${STAGEDIR}${DATADIR}/scripts/config + ${INSTALL_SCRIPT} ${WRKSRC}/base/server/scripts/operations \ + ${STAGEDIR}${DATADIR}/scripts/operations -PLIST_FILES= share/pki/VERSION +post-install-version: post-install-config + ${INSTALL_DATA} ${_JAVA_BUILD_DIR}/base/VERSION \ + ${STAGEDIR}${DATADIR}/VERSION + ${ECHO_CMD} "Dogtag Certificate System" > ${WRKDIR}/CS_SERVER_VERSION + ${INSTALL_DATA} ${WRKDIR}/CS_SERVER_VERSION \ + ${STAGEDIR}${DATADIR}/CS_SERVER_VERSION -post-install: - @${MKDIR} ${STAGEDIR}${PREFIX}/share/pki - @${PRINTF} "Specification-Version: ${DISTVERSION}\nImplementation-Version: ${DISTVERSION}\n" > ${STAGEDIR}${PREFIX}/share/pki/VERSION +post-install-runtime: post-install-version + @${MKDIR} ${STAGEDIR}/var/log/pki .include diff --git a/security/dogtag-pki/files/patch-CMakeLists.txt b/security/dogtag-pki/files/patch-CMakeLists.txt new file mode 100644 index 000000000000..0d1c14177db9 --- /dev/null +++ b/security/dogtag-pki/files/patch-CMakeLists.txt @@ -0,0 +1,10 @@ +--- CMakeLists.txt.orig 2026-07-16 18:21:40 UTC ++++ CMakeLists.txt +@@ -52,6 +52,7 @@ option(WITH_JAVADOC "Build Javadoc package" ON) + option(WITH_ACME "Build ACME package" ON) + option(WITH_EST "Build EST package" ON) + option(WITH_JAVADOC "Build Javadoc package" ON) ++option(WITH_PYTHON_DOCS "Build Python documentation" ON) + option(WITH_THEME "Build theme package" ON) + option(WITH_META "Build meta package" ON) + option(WITH_TESTS "Build tests package" ON) diff --git a/security/dogtag-pki/files/patch-base_CMakeLists.txt b/security/dogtag-pki/files/patch-base_CMakeLists.txt new file mode 100644 index 000000000000..76fa631720f5 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_CMakeLists.txt @@ -0,0 +1,270 @@ +--- base/CMakeLists.txt.orig 2025-08-05 19:20:05 UTC ++++ base/CMakeLists.txt +@@ -6,6 +6,7 @@ find_file(SERVLET_JAR + servlet-api-3.1.jar + tomcat9-servlet-api.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/apache-tomcat-9.0/lib + /usr/share/java + ) + +@@ -35,7 +36,7 @@ else() + PATHS + /usr/share/java + ) +- set(JAXRS_API_LINK "../../../..${JAXRS_API_JAR}") ++ set(JAXRS_API_LINK "../../../../..${JAXRS_API_JAR}") + + endif (JAXRS_API_VERSION) + +@@ -43,6 +44,7 @@ find_file(SLF4J_API_JAR + NAMES + slf4j-api.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/slf4j + /usr/share/java + ) +@@ -51,6 +53,7 @@ find_file(SLF4J_JDK14_JAR + NAMES + slf4j-jdk14.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/slf4j + /usr/share/java/slf4j + /usr/share/java + ) +@@ -67,6 +70,7 @@ find_file(COMMONS_CLI_JAR + NAMES + commons-cli.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java + ) + +@@ -74,6 +78,7 @@ find_file(COMMONS_CODEC_JAR + NAMES + commons-codec.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java + ) + +@@ -81,6 +86,7 @@ find_file(COMMONS_IO_JAR + NAMES + commons-io.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java + ) + +@@ -88,6 +94,7 @@ find_file(COMMONS_LANG3_JAR + NAMES + commons-lang3.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java + ) + +@@ -95,6 +102,7 @@ find_file(COMMONS_LOGGING_JAR + NAMES + commons-logging.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java + ) + +@@ -102,6 +110,7 @@ find_file(COMMONS_NET_JAR + NAMES + commons-net.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java + ) + +@@ -117,6 +126,7 @@ find_file(HTTPCLIENT_JAR + NAMES + httpclient.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/httpcomponents + /usr/share/java + ) +@@ -125,6 +135,7 @@ find_file(HTTPCORE_JAR + NAMES + httpcore.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/httpcomponents + /usr/share/java + ) +@@ -168,7 +179,7 @@ else() + PATHS + /usr/share/java + ) +- set(JACKSON_ANNOTATIONS_LINK "../../../..${JACKSON_ANNOTATIONS_JAR}") ++ set(JACKSON_ANNOTATIONS_LINK "../../../../..${JACKSON_ANNOTATIONS_JAR}") + + find_file(JACKSON_CORE_JAR + NAMES +@@ -176,7 +187,7 @@ else() + PATHS + /usr/share/java + ) +- set(JACKSON_CORE_LINK "../../../..${JACKSON_CORE_JAR}") ++ set(JACKSON_CORE_LINK "../../../../..${JACKSON_CORE_JAR}") + + find_file(JACKSON_DATABIND_JAR + NAMES +@@ -184,7 +195,7 @@ else() + PATHS + /usr/share/java + ) +- set(JACKSON_DATABIND_LINK "../../../..${JACKSON_DATABIND_JAR}") ++ set(JACKSON_DATABIND_LINK "../../../../..${JACKSON_DATABIND_JAR}") + + find_file(JACKSON_JAXRS_BASE_JAR + NAMES +@@ -193,7 +204,7 @@ else() + /usr/share/java/jackson-jaxrs-providers + /usr/share/java + ) +- set(JACKSON_JAXRS_BASE_LINK "../../../..${JACKSON_JAXRS_BASE_JAR}") ++ set(JACKSON_JAXRS_BASE_LINK "../../../../..${JACKSON_JAXRS_BASE_JAR}") + + find_file(JACKSON_JAXRS_JSON_PROVIDER_JAR + NAMES +@@ -202,7 +213,7 @@ else() + /usr/share/java/jackson-jaxrs-providers + /usr/share/java + ) +- set(JACKSON_JAXRS_JSON_PROVIDER_LINK "../../../..${JACKSON_JAXRS_JSON_PROVIDER_JAR}") ++ set(JACKSON_JAXRS_JSON_PROVIDER_LINK "../../../../..${JACKSON_JAXRS_JSON_PROVIDER_JAR}") + + find_file(JACKSON_MODULE_JAXB_ANNOTATIONS_JAR + NAMES +@@ -211,7 +222,7 @@ else() + /usr/share/java/jackson-modules + /usr/share/java + ) +- set(JACKSON_MODULE_JAXB_ANNOTATIONS_LINK "../../../..${JACKSON_MODULE_JAXB_ANNOTATIONS_JAR}") ++ set(JACKSON_MODULE_JAXB_ANNOTATIONS_LINK "../../../../..${JACKSON_MODULE_JAXB_ANNOTATIONS_JAR}") + + endif (JACKSON_VERSION) + +@@ -253,12 +264,13 @@ else() + jakarta.xml.bind-api.jar + jaxb-api.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/jaxb-api4 + /usr/share/java/jaxb-api + /usr/share/java + ) + endif(XMVN_RESOLVE) +- set(JAXB_API_LINK "../../../..${JAXB_API_JAR}") ++ set(JAXB_API_LINK "../../../../..${JAXB_API_JAR}") + + endif (JAXB_API_VERSION) + +@@ -295,6 +307,7 @@ else() + javax.activation.jar + javax-activation.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/jakarta-activation + /usr/share/java/jakarta + /usr/share/java/javax-activation +@@ -302,7 +315,7 @@ else() + /usr/share/java + ) + endif(XMVN_RESOLVE) +- set(JAKARTA_ACTIVATION_API_LINK "../../../..${JAKARTA_ACTIVATION_API_JAR}") ++ set(JAKARTA_ACTIVATION_API_LINK "../../../../..${JAKARTA_ACTIVATION_API_JAR}") + + endif (JAKARTA_ACTIVATION_API_VERSION) + +@@ -329,11 +342,12 @@ else() + jakarta.annotation-api.jar + jboss-annotations-api_1.2_spec.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/jakarta-annotations + /usr/share/java/jboss-annotations-1.2-api + /usr/share/java + ) +- set(JAKARTA_ANNOTATION_API_LINK "../../../..${JAKARTA_ANNOTATION_API_JAR}") ++ set(JAKARTA_ANNOTATION_API_LINK "../../../../..${JAKARTA_ANNOTATION_API_JAR}") + + endif (JAKARTA_ANNOTATION_API_VERSION) + +@@ -360,10 +374,11 @@ else() + NAMES + jboss-logging.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/share/java/classes + /usr/share/java/jboss-logging + /usr/share/java + ) +- set(JBOSS_LOGGING_LINK "../../../..${JBOSS_LOGGING_JAR}") ++ set(JBOSS_LOGGING_LINK "../../../../..${JBOSS_LOGGING_JAR}") + + endif (JBOSS_LOGGING_VERSION) + +@@ -470,7 +485,7 @@ else() + /usr/share/java/resteasy + /usr/share/java + ) +- set(RESTEASY_JAXRS_LINK "../../../..${RESTEASY_JAXRS_JAR}") ++ set(RESTEASY_JAXRS_LINK "../../../../..${RESTEASY_JAXRS_JAR}") + + find_file(RESTEASY_JACKSON_PROVIDER_JAR + NAMES +@@ -479,7 +494,7 @@ else() + /usr/share/java/resteasy + /usr/share/java + ) +- set(RESTEASY_JACKSON_PROVIDER_LINK "../../../..${RESTEASY_JACKSON_PROVIDER_JAR}") ++ set(RESTEASY_JACKSON_PROVIDER_LINK "../../../../..${RESTEASY_JACKSON_PROVIDER_JAR}") + + find_file(RESTEASY_SERVLET_INITIALIZER_JAR + NAMES +@@ -506,6 +521,7 @@ find_file(TOMCAT_API_JAR + tomcat-api.jar + tomcat9-api.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/apache-tomcat-9.0/lib + /usr/share/java/tomcat + /usr/share/java + ) +@@ -515,6 +531,7 @@ find_file(TOMCAT_CATALINA_JAR + catalina.jar + tomcat9-catalina.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/apache-tomcat-9.0/lib + /usr/share/java/tomcat + /usr/share/java + ) +@@ -524,6 +541,7 @@ find_file(TOMCAT_COYOTE_JAR + tomcat-coyote.jar + tomcat9-coyote.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/apache-tomcat-9.0/lib + /usr/share/java/tomcat + /usr/share/java + ) +@@ -533,6 +551,7 @@ find_file(TOMCAT_UTIL_JAR + tomcat-util.jar + tomcat9-util.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/apache-tomcat-9.0/lib + /usr/share/java/tomcat + /usr/share/java + ) +@@ -542,6 +561,7 @@ find_file(TOMCAT_UTIL_SCAN_JAR + tomcat-util-scan.jar + tomcat9-util-scan.jar + PATHS ++ ${CMAKE_INSTALL_PREFIX}/apache-tomcat-9.0/lib + /usr/share/java/tomcat + /usr/share/java + ) diff --git a/security/dogtag-pki/files/patch-base_acme_tomcat-9.0_conf_Catalina_localhost_acme.xml b/security/dogtag-pki/files/patch-base_acme_tomcat-9.0_conf_Catalina_localhost_acme.xml new file mode 100644 index 000000000000..c47a8764b50e --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_tomcat-9.0_conf_Catalina_localhost_acme.xml @@ -0,0 +1,11 @@ +--- base/acme/tomcat-9.0/conf/Catalina/localhost/acme.xml.orig 2025-08-05 19:20:05 UTC ++++ base/acme/tomcat-9.0/conf/Catalina/localhost/acme.xml +@@ -4,7 +4,7 @@ --> + + SPDX-License-Identifier: GPL-2.0-or-later + --> +- ++ + + + diff --git a/security/dogtag-pki/files/patch-base_ca_tomcat-9.0_conf_Catalina_localhost_ca.xml b/security/dogtag-pki/files/patch-base_ca_tomcat-9.0_conf_Catalina_localhost_ca.xml new file mode 100644 index 000000000000..83c6243a9626 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_ca_tomcat-9.0_conf_Catalina_localhost_ca.xml @@ -0,0 +1,11 @@ +--- base/ca/tomcat-9.0/conf/Catalina/localhost/ca.xml.orig 2025-08-05 19:20:05 UTC ++++ base/ca/tomcat-9.0/conf/Catalina/localhost/ca.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-base_common_CMakeLists.txt b/security/dogtag-pki/files/patch-base_common_CMakeLists.txt new file mode 100644 index 000000000000..acfac3c6ee48 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_common_CMakeLists.txt @@ -0,0 +1,50 @@ +--- base/common/CMakeLists.txt.orig 2026-07-16 20:05:45 UTC ++++ base/common/CMakeLists.txt +@@ -117,14 +117,14 @@ add_custom_command( + TARGET pki-lib POST_BUILD + COMMAND ${CMAKE_COMMAND} -E make_directory lib + COMMAND test ! -d ${CMAKE_SOURCE_DIR}/base/common/lib || cp ${CMAKE_SOURCE_DIR}/base/common/lib/* lib +- COMMAND ln -sf ../../../..${COMMONS_CLI_JAR} lib/commons-cli.jar +- COMMAND ln -sf ../../../..${COMMONS_CODEC_JAR} lib/commons-codec.jar +- COMMAND ln -sf ../../../..${COMMONS_IO_JAR} lib/commons-io.jar +- COMMAND ln -sf ../../../..${COMMONS_LANG3_JAR} lib/commons-lang3.jar +- COMMAND ln -sf ../../../..${COMMONS_LOGGING_JAR} lib/commons-logging.jar +- COMMAND ln -sf ../../../..${COMMONS_NET_JAR} lib/commons-net.jar +- COMMAND ln -sf ../../../..${HTTPCLIENT_JAR} lib/httpclient.jar +- COMMAND ln -sf ../../../..${HTTPCORE_JAR} lib/httpcore.jar ++ COMMAND ln -sf ../../../../..${COMMONS_CLI_JAR} lib/commons-cli.jar ++ COMMAND ln -sf ../../../../..${COMMONS_CODEC_JAR} lib/commons-codec.jar ++ COMMAND ln -sf ../../../../..${COMMONS_IO_JAR} lib/commons-io.jar ++ COMMAND ln -sf ../../../../..${COMMONS_LANG3_JAR} lib/commons-lang3.jar ++ COMMAND ln -sf ../../../../..${COMMONS_LOGGING_JAR} lib/commons-logging.jar ++ COMMAND ln -sf ../../../../..${COMMONS_NET_JAR} lib/commons-net.jar ++ COMMAND ln -sf ../../../../..${HTTPCLIENT_JAR} lib/httpclient.jar ++ COMMAND ln -sf ../../../../..${HTTPCORE_JAR} lib/httpcore.jar + COMMAND ln -sf ${JACKSON_ANNOTATIONS_LINK} lib/jackson-annotations.jar + COMMAND ln -sf ${JACKSON_CORE_LINK} lib/jackson-core.jar + COMMAND ln -sf ${JACKSON_DATABIND_LINK} lib/jackson-databind.jar +@@ -136,16 +136,16 @@ add_custom_command( + COMMAND ln -sf ${JAXB_API_LINK} lib/jakarta.xml.bind-api.jar + COMMAND ln -sf ${JAXRS_API_LINK} lib/jboss-jaxrs-api_2.0_spec.jar + COMMAND ln -sf ${JBOSS_LOGGING_LINK} lib/jboss-logging.jar +- COMMAND ln -sf ../../../..${JSS_JAR} lib/jss.jar +- COMMAND ln -sf ../../../..${LDAPJDK_JAR} lib/ldapjdk.jar +- COMMAND ln -sf ../../../..${P11_KIT_TRUST} lib/p11-kit-trust.so +- COMMAND ln -sf ../../../..${JAVA_JAR_INSTALL_DIR}/pki/pki-common.jar lib/pki-common.jar +- COMMAND ln -sf ../../../..${JAVA_JAR_INSTALL_DIR}/pki/pki-tools.jar lib/pki-tools.jar ++ COMMAND ln -sf ../../../../..${JSS_JAR} lib/jss.jar ++ COMMAND ln -sf ../../../../..${LDAPJDK_JAR} lib/ldapjdk.jar ++ COMMAND ln -sf ../../../../..${P11_KIT_TRUST} lib/p11-kit-trust.so ++ COMMAND ln -sf ../../../../..${JAVA_JAR_INSTALL_DIR}/pki/pki-common.jar lib/pki-common.jar ++ COMMAND ln -sf ../../../../..${JAVA_JAR_INSTALL_DIR}/pki/pki-tools.jar lib/pki-tools.jar + COMMAND ln -sf ${RESTEASY_JACKSON_PROVIDER_LINK} lib/resteasy-jackson2-provider.jar + COMMAND ln -sf ${RESTEASY_JAXRS_LINK} lib/resteasy-jaxrs.jar +- COMMAND ln -sf ../../../..${SERVLET_JAR} lib/servlet.jar +- COMMAND ln -sf ../../../..${SLF4J_API_JAR} lib/slf4j-api.jar +- COMMAND ln -sf ../../../..${SLF4J_JDK14_JAR} lib/slf4j-jdk14.jar ++ COMMAND ln -sf ../../../../..${SERVLET_JAR} lib/servlet.jar ++ COMMAND ln -sf ../../../../..${SLF4J_API_JAR} lib/slf4j-api.jar ++ COMMAND ln -sf ../../../../..${SLF4J_JDK14_JAR} lib/slf4j-jdk14.jar + ) + + add_custom_target(pki-man ALL diff --git a/security/dogtag-pki/files/patch-base_common_python_CMakeLists.txt b/security/dogtag-pki/files/patch-base_common_python_CMakeLists.txt new file mode 100644 index 000000000000..947f6eaeaa23 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_common_python_CMakeLists.txt @@ -0,0 +1,32 @@ +--- base/common/python/CMakeLists.txt.orig 2026-07-16 18:21:40 UTC ++++ base/common/python/CMakeLists.txt +@@ -1,3 +1,5 @@ ++if(WITH_PYTHON_DOCS) ++ + find_package(Sphinx REQUIRED) + + if(NOT DEFINED SPHINX_THEME) +@@ -39,6 +41,8 @@ add_custom_target(dogtag_python_client_man_docs ALL + ${CMAKE_CURRENT_SOURCE_DIR} + COMMENT "Building Python Client Library manual pages") + ++endif(WITH_PYTHON_DOCS) ++ + install( + DIRECTORY + pki +@@ -48,6 +52,8 @@ install( + *.py + ) + ++if(WITH_PYTHON_DOCS) ++ + install( + DIRECTORY + ${CMAKE_CURRENT_BINARY_DIR}/html +@@ -69,3 +75,5 @@ install( + PATTERN + .doctrees EXCLUDE + ) ++ ++endif(WITH_PYTHON_DOCS) diff --git a/security/dogtag-pki/files/patch-base_common_python_pki_____init____.py b/security/dogtag-pki/files/patch-base_common_python_pki_____init____.py index acef7d3cb039..d19f766d4c15 100644 --- a/security/dogtag-pki/files/patch-base_common_python_pki_____init____.py +++ b/security/dogtag-pki/files/patch-base_common_python_pki_____init____.py @@ -1,11 +1,13 @@ ---- base/common/python/pki/__init__.py.orig 2026-07-11 15:10:19.775439000 +0200 -+++ base/common/python/pki/__init__.py 2026-07-11 15:10:19.780457000 +0200 -@@ -41,7 +41,7 @@ +--- base/common/python/pki/__init__.py.orig 2025-08-05 19:20:05 UTC ++++ base/common/python/pki/__init__.py +@@ -40,8 +40,8 @@ import requests + import six - CONF_DIR = '/etc/pki' +-CONF_DIR = '/etc/pki' -SHARE_DIR = '/usr/share/pki' ++CONF_DIR = '/usr/local/etc/pki' +SHARE_DIR = '/usr/local/share/pki' BASE_DIR = '/var/lib' LOG_DIR = '/var/log/pki' diff --git a/security/dogtag-pki/files/patch-base_common_python_pki_nssdb.py b/security/dogtag-pki/files/patch-base_common_python_pki_nssdb.py new file mode 100644 index 000000000000..1b6c3be2eed5 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_common_python_pki_nssdb.py @@ -0,0 +1,34 @@ +--- base/common/python/pki/nssdb.py.orig 2025-08-05 19:20:05 UTC ++++ base/common/python/pki/nssdb.py +@@ -312,14 +312,14 @@ class NSSDatabase(object): + + logger.debug('Command: %s', ' '.join(cmd)) + ++ subprocess_kwargs = {} ++ + if runas and self.user is not None: +- runuser = [ +- 'runuser', +- '-u', +- self.user, +- '--', +- ] +- cmd = runuser + cmd ++ subprocess_kwargs.update({ ++ 'user': self.uid, ++ 'group': self.gid, ++ 'extra_groups': os.getgrouplist(self.user, self.gid) ++ }) + + if capture_output: + stdout = subprocess.PIPE +@@ -335,7 +335,8 @@ class NSSDatabase(object): + stdout=stdout, + stderr=stderr, + check=check, +- universal_newlines=text) ++ universal_newlines=text, ++ **subprocess_kwargs) + + if capture_output: + logger.debug('stdout:\n%s', result.stdout.decode('utf-8')) diff --git a/security/dogtag-pki/files/patch-base_common_sbin_pki-upgrade b/security/dogtag-pki/files/patch-base_common_sbin_pki-upgrade new file mode 100644 index 000000000000..81d73c0a2dd5 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_common_sbin_pki-upgrade @@ -0,0 +1,11 @@ +--- base/common/sbin/pki-upgrade.orig 2026-07-16 17:50:06 UTC ++++ base/common/sbin/pki-upgrade +@@ -21,7 +21,7 @@ + + # load default, system-wide, and user-specific PKI configuration and + # set NSS_DEFAULT_DB_TYPE. +-. /usr/share/pki/scripts/config ++. /usr/local/share/pki/scripts/config + + ${PYTHON_EXECUTABLE} -I -m pki.cli.upgrade "$@" + diff --git a/security/dogtag-pki/files/patch-base_common_scripts_config b/security/dogtag-pki/files/patch-base_common_scripts_config new file mode 100644 index 000000000000..865edf28f1b3 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_common_scripts_config @@ -0,0 +1,20 @@ +--- base/common/scripts/config.orig 2026-07-12 09:03:13 UTC ++++ base/common/scripts/config +@@ -19,14 +19,14 @@ + # + + # default PKI configuration +-. /usr/share/pki/etc/pki.conf ++. /usr/local/share/pki/etc/pki.conf + + # safe NSS_DEFAULT_DB_TYPE + _PKI_NSS_DEFAULT_DB_TYPE=${NSS_DEFAULT_DB_TYPE} + + # system-wide PKI configuration +-if [ -f /etc/pki/pki.conf ]; then +- . /etc/pki/pki.conf ++if [ -f /usr/local/etc/pki/pki.conf ]; then ++ . /usr/local/etc/pki/pki.conf + fi + + # user-specific PKI configuration diff --git a/security/dogtag-pki/files/patch-base_est_tomcat-9.0_conf_Catalina_localhost_est.xml b/security/dogtag-pki/files/patch-base_est_tomcat-9.0_conf_Catalina_localhost_est.xml new file mode 100644 index 000000000000..33918e5bb3a8 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_est_tomcat-9.0_conf_Catalina_localhost_est.xml @@ -0,0 +1,11 @@ +--- base/est/tomcat-9.0/conf/Catalina/localhost/est.xml.orig 2025-08-05 19:20:05 UTC ++++ base/est/tomcat-9.0/conf/Catalina/localhost/est.xml +@@ -4,7 +4,7 @@ --> + + SPDX-License-Identifier: GPL-2.0-or-later + --> +- ++ + + + diff --git a/security/dogtag-pki/files/patch-base_kra_tomcat-9.0_conf_Catalina_localhost_kra.xml b/security/dogtag-pki/files/patch-base_kra_tomcat-9.0_conf_Catalina_localhost_kra.xml new file mode 100644 index 000000000000..3b7a8d95fdc6 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_kra_tomcat-9.0_conf_Catalina_localhost_kra.xml @@ -0,0 +1,11 @@ +--- base/kra/tomcat-9.0/conf/Catalina/localhost/kra.xml.orig 2025-08-05 19:20:05 UTC ++++ base/kra/tomcat-9.0/conf/Catalina/localhost/kra.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-base_ocsp_tomcat-9.0_conf_Catalina_localhost_ocsp.xml b/security/dogtag-pki/files/patch-base_ocsp_tomcat-9.0_conf_Catalina_localhost_ocsp.xml new file mode 100644 index 000000000000..55828c25621a --- /dev/null +++ b/security/dogtag-pki/files/patch-base_ocsp_tomcat-9.0_conf_Catalina_localhost_ocsp.xml @@ -0,0 +1,11 @@ +--- base/ocsp/tomcat-9.0/conf/Catalina/localhost/ocsp.xml.orig 2025-08-05 19:20:05 UTC ++++ base/ocsp/tomcat-9.0/conf/Catalina/localhost/ocsp.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-base_server_etc_default.cfg b/security/dogtag-pki/files/patch-base_server_etc_default.cfg new file mode 100644 index 000000000000..ac4c7c3904ca --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_etc_default.cfg @@ -0,0 +1,20 @@ +--- base/server/etc/default.cfg.orig 2026-07-12 08:09:27 UTC ++++ base/server/etc/default.cfg +@@ -192,7 +192,7 @@ pki_client_admin_cert=%(pki_client_dir)s/%(pki_subsyst + pki_client_pkcs12_password_conf=%(pki_client_subsystem_dir)s/pkcs12_password.conf + pki_client_admin_cert=%(pki_client_dir)s/%(pki_subsystem_type)s_admin.cert + +-pki_instance_path=/var/lib/pki/%(pki_instance_name)s ++pki_instance_path=/var/db/pki/%(pki_instance_name)s + + ############################################################################### + ## Tomcat Configuration: ## +@@ -254,7 +254,7 @@ pki_systemd_service_create=True + # + pki_systemd_service_create=True + +-CATALINA_HOME=/usr/share/tomcat ++CATALINA_HOME=/usr/local/apache-tomcat-9.0 + pki_tomcat_bin_path=%(CATALINA_HOME)s/bin + pki_tomcat_lib_path=%(CATALINA_HOME)s/lib + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py new file mode 100644 index 000000000000..47774a8c557a --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py @@ -0,0 +1,461 @@ +--- base/server/python/pki/server/__init__.py.orig 2025-08-05 19:20:05 UTC ++++ base/server/python/pki/server/__init__.py +@@ -51,9 +51,9 @@ import pki.server.subsystem + from pki.keyring import Keyring + import pki.server.subsystem + +-SYSCONFIG_DIR = '/etc/sysconfig' +-ETC_SYSTEMD_DIR = '/etc/systemd' +-LIB_SYSTEMD_DIR = '/lib/systemd' ++SYSCONFIG_DIR = '/usr/local/etc' ++RC_CONF_DIR = '/etc/rc.conf.d' ++RC_DIR = '/usr/local/etc/rc.d' + + SUBSYSTEM_TYPES = ['ca', 'kra', 'ocsp', 'tks', 'tps', 'acme', 'est'] + +@@ -62,7 +62,7 @@ SCHEMA_FILES = [ + DEFAULT_LINK_MODE = 0o0777 + + SCHEMA_FILES = [ +- '/usr/share/pki/server/database/ds/schema.ldif' ++ '/usr/local/share/pki/server/database/ds/schema.ldif' + ] + + logger = logging.getLogger(__name__) +@@ -72,14 +72,14 @@ class Tomcat(object): + + class Tomcat(object): + +- BASE_DIR = '/var/lib/tomcats' +- CONF_DIR = '/etc/tomcat' +- LIB_DIR = '/usr/share/java/tomcat' +- SHARE_DIR = '/usr/share/tomcat' +- EXECUTABLE = '/usr/sbin/tomcat' +- UNIT_FILE = '/lib/systemd/system/tomcat@.service' ++ BASE_DIR = '/var/db/tomcats' ++ CONF_DIR = '/usr/local/apache-tomcat-9.0/conf' ++ LIB_DIR = '/usr/local/apache-tomcat-9.0/lib' ++ SHARE_DIR = '/usr/local/apache-tomcat-9.0' ++ EXECUTABLE = '/usr/local/apache-tomcat-9.0/bin/catalina.sh' ++ UNIT_FILE = '/usr/local/etc/rc.d/tomcat9' + SERVER_XML = CONF_DIR + '/server.xml' +- TOMCAT_CONF = CONF_DIR + '/tomcat.conf' ++ TOMCAT_CONF = '/usr/local/share/pki/etc/tomcat.conf' + + @classmethod + def get_version(cls): +@@ -104,10 +104,10 @@ class PKIServer(object): + @functools.total_ordering + class PKIServer(object): + +- BASE_DIR = '/var/lib/pki' +- CONFIG_DIR = '/etc/pki' ++ BASE_DIR = '/var/db/pki' ++ CONFIG_DIR = '/usr/local/etc/pki' + LOG_DIR = '/var/log/pki' +- SHARE_DIR = '/usr/share/pki' ++ SHARE_DIR = '/usr/local/share/pki' + REGISTRY_DIR = SYSCONFIG_DIR + '/pki' + TOMCAT_CONF = SHARE_DIR + '/etc/tomcat.conf' + +@@ -122,11 +122,11 @@ class PKIServer(object): + self.user = user + self.group = group + +- # The standard conf dir at /var/lib/pki//conf ++ # The standard conf dir at /var/db/pki//conf + # will be an actual folder (i.e. not a link). + self._conf_dir = None + +- # The standard logs dir at /var/lib/pki//logs ++ # The standard logs dir at /var/db/pki//logs + # will be an actual folder (i.e. not a link). + self._logs_dir = None + +@@ -243,9 +243,43 @@ class PKIServer(object): + return '%s@%s' % (self.type, self.name) + + @property ++ def rc_service_name(self): ++ return ''.join( ++ char if char.isalnum() or char == '_' else '_' ++ for char in self.service_name) ++ ++ @property ++ def rc_script(self): ++ return os.path.join(RC_DIR, self.rc_service_name) ++ ++ @property + def service_conf(self): +- return os.path.join(SYSCONFIG_DIR, self.service_name) ++ return os.path.join(RC_CONF_DIR, self.rc_service_name) + ++ def create_rc_service(self, exist_ok=False): ++ os.makedirs(RC_CONF_DIR, mode=0o755, exist_ok=True) ++ ++ if not os.path.exists(self.service_conf) or not exist_ok: ++ prefix = self.rc_service_name ++ java_home = os.environ["JAVA_HOME"] ++ ++ with open(self.service_conf, "w", encoding="utf-8") as f: ++ print("%s_enable=\"YES\"" % prefix, file=f) ++ print("%s_catalina_home=\"%s\"" % (prefix, Tomcat.SHARE_DIR), file=f) ++ print("%s_catalina_base=\"%s\"" % (prefix, self.base_dir), file=f) ++ print("%s_catalina_user=\"%s\"" % (prefix, self.user), file=f) ++ print("%s_java_home=\"%s\"" % (prefix, java_home), file=f) ++ print("%s_env_file=\"%s\"" % (prefix, self.tomcat_conf), file=f) ++ ++ os.chmod(self.service_conf, 0o644) ++ ++ if os.path.lexists(self.rc_script): ++ if exist_ok: ++ return ++ raise FileExistsError(self.rc_script) ++ ++ os.symlink(os.path.join(RC_DIR, "tomcat9"), self.rc_script) ++ + @property + def uid(self): + return pwd.getpwnam(self.user).pw_uid +@@ -295,7 +329,7 @@ class PKIServer(object): + raise pki.PKIException('Invalid instance: ' + self.name, None) + + def is_active(self): +- cmd = ['systemctl', '--quiet', 'is-active', '%s.service' % self.service_name] ++ cmd = ['/usr/sbin/service', self.rc_service_name, 'onestatus'] + logger.debug('Command: %s', ' '.join(cmd)) + rc = subprocess.call(cmd) + return rc == 0 +@@ -362,13 +396,13 @@ class PKIServer(object): + logger.info('Creating catalina.policy') + + # add "do not edit" warning +- filename = '/usr/share/pki/server/conf/catalina.policy' ++ filename = '/usr/local/share/pki/server/conf/catalina.policy' + logger.info('Appending %s', filename) + with open(filename, 'r', encoding='utf-8') as f: + content = f.read() + + # add Tomcat's default policy +- filename = '/usr/share/tomcat/conf/catalina.policy' ++ filename = '/usr/local/apache-tomcat-9.0/conf/catalina.policy' + logger.info('Appending %s', filename) + with open(filename, 'r', encoding='utf-8') as f: + content += f.read() +@@ -376,7 +410,7 @@ class PKIServer(object): + content += '\n\n' + + # add PKI's default policy +- filename = '/usr/share/pki/server/conf/pki.policy' ++ filename = '/usr/local/share/pki/server/conf/pki.policy' + logger.info('Appending %s', filename) + with open(filename, 'r', encoding='utf-8') as f: + content += f.read() +@@ -450,7 +484,7 @@ grant codeBase "file:%s" { + + def start(self, wait=False, max_wait=60, timeout=None): + +- cmd = ['systemctl', 'start', '%s.service' % self.service_name] ++ cmd = ['/usr/sbin/service', self.rc_service_name, 'onestart'] + logger.debug('Command: %s', ' '.join(cmd)) + subprocess.check_call(cmd) + +@@ -490,7 +524,11 @@ grant codeBase "file:%s" { + + def stop(self, wait=False, max_wait=60, timeout=None): + +- cmd = ['systemctl', 'stop', '%s.service' % self.service_name] ++ if not self.is_active(): ++ logger.info("PKI server already stopped") ++ return ++ ++ cmd = ['/usr/sbin/service', self.rc_service_name, 'onestop'] + logger.debug('Command: %s', ' '.join(cmd)) + subprocess.check_call(cmd) + +@@ -536,12 +574,17 @@ grant codeBase "file:%s" { + self.start(wait=wait, max_wait=max_wait, timeout=timeout) + + def enable(self): +- cmd = ['systemctl', 'enable', '%s.service' % self.service_name] ++ cmd = ['/usr/sbin/service', self.rc_service_name, 'enable'] + logger.debug('Command: %s', ' '.join(cmd)) + subprocess.check_call(cmd) + + def disable(self): +- cmd = ['systemctl', 'disable', '%s.service' % self.service_name] ++ ++ if not os.path.exists(self.rc_script): ++ logger.info("PKI server already disabled") ++ return ++ ++ cmd = ['/usr/sbin/service', self.rc_service_name, 'disable'] + logger.debug('Command: %s', ' '.join(cmd)) + subprocess.check_call(cmd) + +@@ -581,16 +624,20 @@ grant codeBase "file:%s" { + for name in self.config: + logger.debug('- %s: %s', name, self.config[name]) + +- prefix = [] ++ subprocess_kwargs = {} + +- # by default run PKI server as systemd user ++ # by default run PKI server as service user + if not as_current_user: + + current_user = pwd.getpwuid(os.getuid()).pw_name + +- # switch to systemd user if different from current user ++ # switch to service user if different from current user + if current_user != self.user: +- prefix.extend(['/usr/sbin/runuser', '-u', self.user, '--']) ++ subprocess_kwargs.update({ ++ 'user': self.user, ++ 'group': self.group, ++ 'extra_groups': os.getgrouplist(self.user, self.gid) ++ }) + + java_home = self.config.get('JAVA_HOME') + java_opts = self.config.get('JAVA_OPTS') +@@ -599,12 +646,12 @@ grant codeBase "file:%s" { + classpath = [ + Tomcat.SHARE_DIR + '/bin/bootstrap.jar', + Tomcat.SHARE_DIR + '/bin/tomcat-juli.jar', +- '/usr/share/java/ant.jar', +- '/usr/share/java/ant-launcher.jar', ++ '/usr/local/share/java/apache-ant/lib/ant.jar', ++ '/usr/local/share/java/apache-ant/lib/ant-launcher.jar', + '/usr/lib/jvm/java/lib/tools.jar' + ] + +- cmd = prefix ++ cmd = [] + + if with_valgrind: + cmd.extend(['valgrind', '--trace-children=yes', '--tool=massif']) +@@ -618,7 +665,7 @@ grant codeBase "file:%s" { + else: + cmd.extend([java_home + '/bin/java']) + +- # add JVM options as in /etc/tomcat/conf.d/java-9-start-up-parameters.conf ++ # add JVM options as in /usr/local/apache-tomcat-9.0/conf/conf.d/java-9-start-up-parameters.conf + cmd.extend([ + '--add-opens', 'java.base/java.lang=ALL-UNNAMED', + '--add-opens', 'java.base/java.io=ALL-UNNAMED', +@@ -661,7 +708,7 @@ grant codeBase "file:%s" { + + logger.debug('Command: %s', ' '.join(cmd)) + +- return subprocess.Popen(cmd, env=self.config) ++ return subprocess.Popen(cmd, env=self.config, **subprocess_kwargs) + + def chown(self, path): + +@@ -787,8 +834,8 @@ grant codeBase "file:%s" { + self.create_logging_properties(exist_ok=True) + self.create_web_xml(exist_ok=True) + +- # copy /etc/tomcat/tomcat.conf +- # to /var/lib/pki//conf/tomcat.conf ++ # copy /usr/local/apache-tomcat-9.0/conf/tomcat.conf ++ # to /var/db/pki//conf/tomcat.conf + self.copy( + Tomcat.TOMCAT_CONF, + self.tomcat_conf, +@@ -798,7 +845,7 @@ grant codeBase "file:%s" { + tomcat_conf = pki.PropertyFile(self.tomcat_conf, quote='"') + tomcat_conf.read() + +- # store JAVA_HOME from /usr/share/pki/etc/pki.conf ++ # store JAVA_HOME from /usr/local/share/pki/etc/pki.conf + java_home = os.getenv('JAVA_HOME') + tomcat_conf.set('JAVA_HOME', java_home) + +@@ -810,27 +857,21 @@ grant codeBase "file:%s" { + + tomcat_conf.write() + +- # copy /var/lib/pki//conf/tomcat.conf +- # to /etc/sysconfig/@ +- self.copy( +- self.tomcat_conf, +- self.service_conf, +- exist_ok=True, +- force=force) ++ self.create_rc_service(exist_ok=True) + + def create_conf_dir(self, exist_ok=False): + + if self._conf_dir: + +- # Create /etc/pki/ ++ # Create /usr/local/etc/pki/ + self.makedirs(self._conf_dir, exist_ok=exist_ok) + +- # Link /var/lib/pki//conf to /etc/pki/ ++ # Link /var/db/pki//conf to /usr/local/etc/pki/ + self.symlink(self._conf_dir, self.conf_dir, exist_ok=exist_ok) + + return + +- # Create /var/lib/pki//conf ++ # Create /var/db/pki//conf + self.makedirs(self.conf_dir, exist_ok=exist_ok) + + def create_logs_dir(self, exist_ok=False): +@@ -844,15 +885,15 @@ grant codeBase "file:%s" { + backup_dir = os.path.join(self._logs_dir, 'backup') + self.makedirs(backup_dir, exist_ok=exist_ok) + +- # Link /var/lib/pki//logs to /var/log/pki/ ++ # Link /var/db/pki//logs to /var/log/pki/ + self.symlink(self._logs_dir, self.logs_dir, exist_ok=exist_ok) + + return + +- # Create /var/lib/pki//logs ++ # Create /var/db/pki//logs + self.makedirs(self.logs_dir, exist_ok=exist_ok) + +- # Create /var/lib/pki//logs/backup ++ # Create /var/db/pki//logs/backup + backup_dir = os.path.join(self.logs_dir, 'backup') + self.makedirs(backup_dir, exist_ok=exist_ok) + +@@ -868,8 +909,8 @@ grant codeBase "file:%s" { + + def create_catalina_properties(self, exist_ok=False): + +- # Link /var/lib/pki//conf/catalina.properties +- # to /usr/share/pki/server/conf/catalina.properties. ++ # Link /var/db/pki//conf/catalina.properties ++ # to /usr/local/share/pki/server/conf/catalina.properties. + + catalina_properties = os.path.join( + PKIServer.SHARE_DIR, 'server', 'conf', 'catalina.properties') +@@ -877,16 +918,16 @@ grant codeBase "file:%s" { + + def create_context_xml(self, exist_ok=False): + +- # Link /var/lib/pki//conf/context.xml +- # to /etc/tomcat/context.xml. ++ # Link /var/db/pki//conf/context.xml ++ # to /usr/local/apache-tomcat-9.0/conf/context.xml. + + context_xml = os.path.join(Tomcat.CONF_DIR, 'context.xml') + self.symlink(context_xml, self.context_xml, exist_ok=exist_ok) + + def create_logging_properties(self, exist_ok=False): + +- # Copy /etc/tomcat/logging.properties +- # to /var/lib/pki//conf/logging.properties. ++ # Copy /usr/local/apache-tomcat-9.0/conf/logging.properties ++ # to /var/db/pki//conf/logging.properties. + + logging_properties = os.path.join(Tomcat.CONF_DIR, 'logging.properties') + self.copy( +@@ -896,7 +937,7 @@ grant codeBase "file:%s" { + + def create_server_xml(self, exist_ok=False): + +- # Copy /etc/tomcat/server.xml to /conf/server.xml ++ # Copy /usr/local/apache-tomcat-9.0/conf/server.xml to /conf/server.xml + + self.copy( + pki.server.Tomcat.SERVER_XML, +@@ -973,7 +1014,7 @@ grant codeBase "file:%s" { + self.makedirs(host_dir, exist_ok=exist_ok) + + # Link /conf///rewrite.config +- # to /usr/share/pki/server/conf/Catalina/localhost/rewrite.config ++ # to /usr/local/share/pki/server/conf/Catalina/localhost/rewrite.config + + link = os.path.join(host_dir, 'rewrite.config') + self.symlink(target, link, exist_ok=exist_ok) +@@ -982,8 +1023,8 @@ grant codeBase "file:%s" { + + def create_web_xml(self, exist_ok=False): + +- # Link /var/lib/pki//conf/web.xml +- # to /etc/tomcat/web.xml. ++ # Link /var/db/pki//conf/web.xml ++ # to /usr/local/apache-tomcat-9.0/conf/web.xml. + + self.symlink( + os.path.join(Tomcat.CONF_DIR, 'web.xml'), +@@ -1327,7 +1368,7 @@ grant codeBase "file:%s" { + logger.info('Removing %s', self.bin_dir) + pki.util.unlink(self.bin_dir, force=force) + +- # remove /var/lib/pki//alias if exists ++ # remove /var/db/pki//alias if exists + if os.path.islink(self.nssdb_link): + logger.info('Removing %s', self.nssdb_link) + pki.util.unlink(self.nssdb_link) +@@ -1356,7 +1397,7 @@ grant codeBase "file:%s" { + # Get the actual folder in case it has changed + _logs_dir = os.readlink(self.logs_dir) + +- # Remove /var/lib/pki//logs ++ # Remove /var/db/pki//logs + logger.info('Removing %s', self.logs_dir) + pki.util.unlink(self.logs_dir, force=force) + +@@ -1366,7 +1407,7 @@ grant codeBase "file:%s" { + + return + +- # Remove /var/lib/pki//logs ++ # Remove /var/db/pki//logs + logger.info('Removing %s', self.logs_dir) + pki.util.rmtree(self.logs_dir, force=force) + +@@ -1377,17 +1418,17 @@ grant codeBase "file:%s" { + # Get the actual folder in case it has changed + _conf_dir = os.readlink(self.conf_dir) + +- # Remove /var/lib/pki//conf ++ # Remove /var/db/pki//conf + logger.info('Removing %s', self.conf_dir) + pki.util.unlink(self.conf_dir, force=force) + +- # Remove /etc/pki/ ++ # Remove /usr/local/etc/pki/ + logger.info('Removing %s', _conf_dir) + pki.util.rmtree(_conf_dir, force=force) + + return + +- # Remove /var/lib/pki//conf ++ # Remove /var/db/pki//conf + logger.info('Removing %s', self.conf_dir) + pki.util.rmtree(self.conf_dir, force=force) + +@@ -1468,11 +1509,11 @@ grant codeBase "file:%s" { + + subsystem_dir = os.path.join(self.base_dir, subsystem_name) + +- # ensure /var/lib/pki// exists ++ # ensure /var/db/pki// exists + if not os.path.exists(subsystem_dir): + continue + +- # ensure /var/lib/pki// is not empty ++ # ensure /var/db/pki// is not empty + # https://issues.redhat.com/browse/RHEL-21568 + if not os.listdir(subsystem_dir): + # Directory exists but it is empty +@@ -2398,7 +2439,11 @@ class PKIServerFactory(object): + instance_type = parts[0] + instance_name = parts[1] + +- sysconfig_file = os.path.join('/etc/sysconfig', instance_name) ++ rc_service_name = "".join( ++ char if char.isalnum() or char == "_" else "_" ++ for char in "%s@%s" % (instance_type, instance_name)) ++ ++ sysconfig_file = os.path.join(RC_CONF_DIR, rc_service_name) + + if os.path.isfile(sysconfig_file): + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_____init____.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_____init____.py index 486a7823f209..c03d65d556bc 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_____init____.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_____init____.py @@ -1,23 +1,37 @@ ---- base/server/python/pki/server/deployment/__init__.py.orig 2026-07-04 19:39:15 UTC +--- base/server/python/pki/server/deployment/__init__.py.orig 2025-08-05 19:20:05 UTC +++ base/server/python/pki/server/deployment/__init__.py @@ -28,7 +28,10 @@ import re import os import pathlib import re -import selinux +try: + import selinux +except ImportError: + selinux = None import shutil import socket import struct @@ -69,7 +72,7 @@ seobject = None from . import pkimessages as log - + seobject = None -if selinux.is_selinux_enabled(): +if selinux is not None and selinux.is_selinux_enabled(): try: import seobject except ImportError: +@@ -123,7 +126,12 @@ class PKIDeployer: + self.hostname = socket.getfqdn() + + # Retrieve DNS domainname +- self.dns_domainname = subprocess.check_output(["dnsdomainname"]) ++ try: ++ self.dns_domainname = subprocess.check_output(["dnsdomainname"]) ++ except (FileNotFoundError, subprocess.CalledProcessError): ++ fqdn = socket.getfqdn() ++ domain = fqdn.split(".", 1)[1] if "." in fqdn else "" ++ self.dns_domainname = domain.encode("utf-8") + self.dns_domainname = self.dns_domainname.decode('ascii').rstrip('\n') + + if not len(self.dns_domainname): diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkiconfig.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkiconfig.py new file mode 100644 index 000000000000..4260de61b346 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkiconfig.py @@ -0,0 +1,11 @@ +--- base/server/python/pki/server/deployment/pkiconfig.py.orig 2025-08-05 19:20:05 UTC ++++ base/server/python/pki/server/deployment/pkiconfig.py +@@ -47,7 +47,7 @@ PKI_DEPLOYMENT_INTERRUPT_BANNER = "-+-+-+-+-+-+-+-+-+- + PKI_DEPLOYMENT_INTERRUPT_BANNER = "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"\ + "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-" + +-PKI_DEPLOYMENT_SOURCE_ROOT = "/usr/share/pki" ++PKI_DEPLOYMENT_SOURCE_ROOT = "/usr/local/share/pki" + # NOTE: Top-level "/etc/pki" is owned by the "filesystem" package! + PKI_DEPLOYMENT_CONFIGURATION_ROOT = "/etc/pki" + PKI_DEPLOYMENT_LOG_ROOT = "/var/log/pki" diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkihelper.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkihelper.py index 3b508c0a62be..0992f8bddc7d 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkihelper.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkihelper.py @@ -1,17 +1,17 @@ ---- base/server/python/pki/server/deployment/pkihelper.py.orig 2026-07-04 19:39:15 UTC +--- base/server/python/pki/server/deployment/pkihelper.py.orig 2025-08-05 19:20:05 UTC +++ base/server/python/pki/server/deployment/pkihelper.py @@ -44,9 +44,12 @@ import pki.util import pki.util - + # special care for SELinux -import selinux +try: + import selinux +except ImportError: + selinux = None seobject = None -if selinux.is_selinux_enabled(): +if selinux is not None and selinux.is_selinux_enabled(): try: import seobject except ImportError: diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkiparser.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkiparser.py new file mode 100644 index 000000000000..e474796e7864 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_pkiparser.py @@ -0,0 +1,30 @@ +--- base/server/python/pki/server/deployment/pkiparser.py.orig 2026-07-12 14:03:09 UTC ++++ base/server/python/pki/server/deployment/pkiparser.py +@@ -36,6 +36,7 @@ import pki + + # PKI Imports + import pki ++import pki.server + import pki.upgrade + import pki.account + import pki.client +@@ -818,11 +819,16 @@ class PKIConfigParser: + @staticmethod + def read_existing_deployment_data(instance_name): + data = {} +- instance_root = os.path.join('/var/lib/pki', instance_name) ++ instance_root = os.path.join( ++ pki.server.PKIServer.BASE_DIR, ++ instance_name) + if not os.path.exists(instance_root): + return data +- deployment_root = os.path.join('/etc/sysconfig/pki/tomcat', +- instance_name) ++ ++ deployment_root = os.path.join( ++ pki.server.PKIServer.REGISTRY_DIR, ++ 'tomcat', ++ instance_name) + + for root, _dirs, names in os.walk(deployment_root): + if 'deployment.cfg' in names: diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_configuration.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_configuration.py new file mode 100644 index 000000000000..8ee3743317a0 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_configuration.py @@ -0,0 +1,30 @@ +--- base/server/python/pki/server/deployment/scriptlets/configuration.py.orig 2026-07-12 17:21:04 UTC ++++ base/server/python/pki/server/deployment/scriptlets/configuration.py +@@ -20,12 +20,14 @@ import logging + + from __future__ import absolute_import + import logging ++import os + + # PKI Deployment Imports + from .. import pkiconfig as config + from .. import pkiscriptlet + + import pki.nssdb ++import pki.server + + logger = logging.getLogger(__name__) + +@@ -90,7 +92,11 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl + + if not clone and subsystem.type == 'CA': + subsystem.import_profiles( +- input_folder='/usr/share/pki/ca/profiles/ca') ++ input_folder=os.path.join( ++ pki.server.PKIServer.SHARE_DIR, ++ 'ca', ++ 'profiles', ++ 'ca')) + + subsystem.load() + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py new file mode 100644 index 000000000000..3f3d693f9fb7 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py @@ -0,0 +1,75 @@ +--- base/server/python/pki/server/deployment/scriptlets/instance_layout.py.orig 2026-07-12 10:34:10 UTC ++++ base/server/python/pki/server/deployment/scriptlets/instance_layout.py +@@ -160,15 +160,6 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl + + deployer.create_server_nssdb() + +- # Copy /usr/share/pki/server/conf/tomcat.conf +- # to /etc/sysconfig/ +- +- instance.copyfile( +- os.path.join(shared_conf_path, 'tomcat.conf'), +- instance.service_conf, +- params=deployer.mdict, +- exist_ok=True) +- + # Copy /usr/share/pki/server/conf/tomcat.conf to + # /var/lib/pki//conf/tomcat.conf. + +@@ -211,31 +202,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl + return + + if config.str2bool(deployer.mdict['pki_systemd_service_create']): ++ instance.create_rc_service(exist_ok=True) + +- user = deployer.mdict['pki_user'] +- group = deployer.mdict['pki_group'] +- +- if user != 'pkiuser' or group != 'pkiuser': +- deployer.set_systemd_override( +- 'Service', 'User', user, 'user.conf') +- deployer.set_systemd_override( +- 'Service', 'Group', group, 'user.conf') +- +- deployer.write_systemd_overrides() +- deployer.systemd.daemon_reload() +- +- # Link /etc/systemd/system/pki-tomcatd.target.wants/pki-tomcatd@.service +- # to /lib/systemd/system/pki-tomcatd@.service +- +- systemd_service_link = os.path.join( +- pki.server.instance.PKIInstance.TARGET_WANTS, +- instance.service_name + '.service') +- +- instance.symlink( +- pki.server.instance.PKIInstance.UNIT_FILE, +- systemd_service_link, +- exist_ok=True) +- + def destroy(self, deployer): + + instance = self.instance +@@ -246,21 +214,9 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl + + logger.info('Removing %s instance', instance.name) + +- logger.info('Removing %s', deployer.systemd.systemd_link) +- pki.util.unlink(link=deployer.systemd.systemd_link, ++ logger.info('Removing %s', instance.rc_script) ++ pki.util.unlink(link=instance.rc_script, + force=deployer.force) +- +- if os.path.exists(deployer.systemd.base_override_dir): +- logger.info('Removing %s', deployer.systemd.base_override_dir) +- pki.util.rmtree(path=deployer.systemd.base_override_dir, +- force=deployer.force) +- +- if os.path.exists(deployer.systemd.nuxwdog_override_dir): +- logger.info('Removing %s', deployer.systemd.nuxwdog_override_dir) +- pki.util.rmtree(path=deployer.systemd.nuxwdog_override_dir, +- force=deployer.force) +- +- deployer.systemd.daemon_reload() + + if config.str2bool(deployer.mdict['pki_registry_enable']): + instance.remove_registry(force=deployer.force) diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_selinux__setup.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_selinux__setup.py index 46de139c95dd..71d4f520b8cf 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_selinux__setup.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_selinux__setup.py @@ -1,40 +1,41 @@ ---- base/server/python/pki/server/deployment/scriptlets/selinux_setup.py.orig 2026-07-04 19:39:16 UTC +--- base/server/python/pki/server/deployment/scriptlets/selinux_setup.py.orig 2025-08-05 19:20:05 UTC +++ base/server/python/pki/server/deployment/scriptlets/selinux_setup.py @@ -20,7 +20,10 @@ import logging - + from __future__ import absolute_import import logging -import selinux +try: + import selinux +except ImportError: + selinux = None import sys import time - + @@ -30,7 +33,7 @@ seobject = None from .. import pkiscriptlet - + seobject = None -if selinux.is_selinux_enabled(): +if selinux is not None and selinux.is_selinux_enabled(): try: import seobject except ImportError: @@ -51,7 +54,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl logger.info('Skipping SELinux setup') return - + - if not selinux.is_selinux_enabled() or seobject is None: + if selinux is None or not selinux.is_selinux_enabled() or seobject is None: logger.info('SELinux disabled') return - + @@ -96,7 +99,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl - + instance = self.instance - + - if not bool(selinux.is_selinux_enabled()): + if selinux is None or not selinux.is_selinux_enabled(): logger.info('SELinux disabled') return + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_instance.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_instance.py new file mode 100644 index 000000000000..a7897fec1937 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_instance.py @@ -0,0 +1,157 @@ +--- base/server/python/pki/server/instance.py.orig 2025-08-05 19:20:05 UTC ++++ base/server/python/pki/server/instance.py +@@ -50,9 +50,6 @@ class PKIInstance(pki.server.PKIServer): + class PKIInstance(pki.server.PKIServer): + + REGISTRY_FILE = pki.server.PKIServer.SHARE_DIR + '/setup/pkidaemon_registry' +- UNIT_FILE = pki.server.LIB_SYSTEMD_DIR + '/system/pki-tomcatd@.service' +- TARGET_FILE = pki.server.LIB_SYSTEMD_DIR + '/system/pki-tomcatd.target' +- TARGET_WANTS = pki.server.ETC_SYSTEMD_DIR + '/system/pki-tomcatd.target.wants' + + def __init__(self, + name, +@@ -147,9 +144,6 @@ class PKIInstance(pki.server.PKIServer): + return os.path.join(pki.BASE_DIR, self.name) + return os.path.join(pki.server.PKIServer.BASE_DIR, self.name) + +- @property +- def service_conf(self): +- return os.path.join(pki.server.SYSCONFIG_DIR, self.name) + + @property + def server_cert_nick_conf(self): +@@ -175,10 +169,6 @@ class PKIInstance(pki.server.PKIServer): + def registry_file(self): + return os.path.join(self.registry_dir, self.name) + +- @property +- def unit_file(self): +- return PKIInstance.TARGET_WANTS + '/%s.service' % self.service_name +- + def execute( + self, command, + as_current_user=False, +@@ -196,20 +186,24 @@ class PKIInstance(pki.server.PKIServer): + else: + instance_id = '%s@%s' % (self.type, self.name) + +- prefix = [] ++ subprocess_kwargs = {} + +- # by default run pkidaemon as systemd user ++ # by default run commands as service user + if not as_current_user: + + current_user = pwd.getpwuid(os.getuid()).pw_name + +- # switch to systemd user if different from current user ++ # switch to service user if different from current user + if current_user != self.user: +- prefix.extend(['/usr/sbin/runuser', '-u', self.user, '--']) ++ subprocess_kwargs.update({ ++ 'user': self.user, ++ 'group': self.group, ++ 'extra_groups': os.getgrouplist(self.user, self.gid) ++ }) + + if not skip_upgrade: + # run pki-server upgrade +- cmd = prefix + ['/usr/sbin/pki-server', 'upgrade'] ++ cmd = ['/usr/local/sbin/pki-server', 'upgrade'] + + if logger.isEnabledFor(logging.DEBUG): + cmd.append('--debug') +@@ -220,11 +214,11 @@ class PKIInstance(pki.server.PKIServer): + cmd.append(instance_id) + + logger.debug('Command: %s', ' '.join(cmd)) +- subprocess.run(cmd, env=self.config, check=True) ++ subprocess.run(cmd, env=self.config, check=True, **subprocess_kwargs) + + if not skip_migration: + # run pki-server migrate +- cmd = prefix + ['/usr/sbin/pki-server', 'migrate'] ++ cmd = ['/usr/local/sbin/pki-server', 'migrate'] + + if logger.isEnabledFor(logging.DEBUG): + cmd.append('--debug') +@@ -235,13 +229,13 @@ class PKIInstance(pki.server.PKIServer): + cmd.append(instance_id) + + logger.debug('Command: %s', ' '.join(cmd)) +- subprocess.run(cmd, env=self.config, check=True) ++ subprocess.run(cmd, env=self.config, check=True, **subprocess_kwargs) + + # run pkidaemon start +- cmd = prefix + ['/usr/bin/pkidaemon', 'start', instance_id] ++ cmd = ['/usr/local/bin/pkidaemon', 'start', instance_id] + + logger.debug('Command: %s', ' '.join(cmd)) +- subprocess.run(cmd, env=self.config, check=True) ++ subprocess.run(cmd, env=self.config, check=True, **subprocess_kwargs) + + return super().execute( + command, +@@ -257,8 +251,6 @@ class PKIInstance(pki.server.PKIServer): + + self.create_registry() + +- self.symlink(PKIInstance.UNIT_FILE, self.unit_file, exist_ok=True) +- + def create_libs(self, force=False): + + if not self.with_maven_deps: +@@ -400,9 +392,6 @@ class PKIInstance(pki.server.PKIServer): + + def remove(self, remove_conf=False, remove_logs=False, force=False): + +- logger.info('Removing %s', self.unit_file) +- pki.util.unlink(self.unit_file, force=force) +- + self.remove_registry(force=force) + + super().remove( +@@ -776,8 +765,6 @@ class PKIInstance(pki.server.PKIServer): + csr_file = self.csr_file(cert_id) + + cmd = [ +- '/usr/sbin/runuser', +- '-u', self.user, '--', + 'pki', + '-d', self.nssdb_dir, + '-f', self.password_conf +@@ -803,7 +790,11 @@ class PKIInstance(pki.server.PKIServer): + + logger.debug('Command: %s', ' '.join(cmd)) + +- subprocess.check_call(cmd) ++ subprocess.check_call( ++ cmd, ++ user=self.user, ++ group=self.group, ++ extra_groups=os.getgrouplist(self.user, self.gid)) + + def cert_create( + self, cert_id=None, +@@ -870,8 +861,6 @@ class PKIInstance(pki.server.PKIServer): + cert_file = self.cert_file(cert_id) + + cmd = [ +- '/usr/sbin/runuser', +- '-u', self.user, '--', + 'pki', + '-d', self.nssdb_dir, + '-f', self.password_conf +@@ -900,7 +889,11 @@ class PKIInstance(pki.server.PKIServer): + + logger.debug('Command: %s', ' '.join(cmd)) + +- subprocess.check_call(cmd) ++ subprocess.check_call( ++ cmd, ++ user=self.user, ++ group=self.group, ++ extra_groups=os.getgrouplist(self.user, self.gid)) + + return + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_subsystem.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_subsystem.py new file mode 100644 index 000000000000..df47d0d1a22c --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_subsystem.py @@ -0,0 +1,67 @@ +--- base/server/python/pki/server/subsystem.py.orig 2026-07-12 13:46:52 UTC ++++ base/server/python/pki/server/subsystem.py +@@ -910,9 +910,14 @@ class PKISubsystem(object): + + try: + # export audit-events.properties from pki-server.jar +- server_jar = \ +- '/usr/share/pki/%s/webapps/%s/WEB-INF/lib/pki-server.jar' \ +- % (self.name, self.name) ++ server_jar = os.path.join( ++ pki.server.PKIServer.SHARE_DIR, ++ self.name, ++ 'webapps', ++ self.name, ++ 'WEB-INF', ++ 'lib', ++ 'pki-server.jar') + + cmd = [ + 'jar', +@@ -2218,23 +2223,31 @@ class PKISubsystem(object): + + classpath = [ + pki.server.Tomcat.SHARE_DIR + '/bin/tomcat-juli.jar', +- '/usr/share/java/tomcat-servlet-api.jar', ++ pki.server.Tomcat.SHARE_DIR + '/lib/servlet-api.jar', + pki.server.PKIServer.SHARE_DIR + '/' + + self.name + '/webapps/' + self.name + '/WEB-INF/lib/*', + self.instance.common_lib_dir + '/*', + pki.server.PKIServer.SHARE_DIR + '/lib/*' + ] + +- cmd = [] ++ subprocess_kwargs = {} + +- # by default run command as systemd user ++ # by default run command as service user + if not as_current_user: + +- # switch to systemd user if different from current user ++ # switch to service user if different from current user + username = pwd.getpwuid(os.getuid()).pw_name + if username != self.instance.user: +- cmd.extend(['/usr/sbin/runuser', '-u', self.instance.user, '--']) ++ subprocess_kwargs.update({ ++ 'user': self.instance.user, ++ 'group': self.instance.group, ++ 'extra_groups': os.getgrouplist( ++ self.instance.user, ++ self.instance.gid) ++ }) + ++ cmd = [] ++ + cmd.extend([java_home + '/bin/java']) + + cmd.extend([ +@@ -2270,7 +2283,8 @@ class PKISubsystem(object): + input=input, + stdout=stdout, + stderr=stderr, +- check=True) ++ check=True, ++ **subprocess_kwargs) + + except KeyboardInterrupt: + logger.debug('Server stopped') diff --git a/security/dogtag-pki/files/patch-base_server_sbin_pki-server b/security/dogtag-pki/files/patch-base_server_sbin_pki-server new file mode 100644 index 000000000000..579c6efccb5b --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_sbin_pki-server @@ -0,0 +1,11 @@ +--- base/server/sbin/pki-server.orig 2026-07-12 08:56:51 UTC ++++ base/server/sbin/pki-server +@@ -21,7 +21,7 @@ + + # load default, system-wide, and user-specific PKI configuration and + # set NSS_DEFAULT_DB_TYPE. +-. /usr/share/pki/scripts/config ++. /usr/local/share/pki/scripts/config + + ${PYTHON_EXECUTABLE} -I -m pki.server.pkiserver "$@" + diff --git a/security/dogtag-pki/files/patch-base_server_scripts_operations b/security/dogtag-pki/files/patch-base_server_scripts_operations new file mode 100644 index 000000000000..96ae599fa4df --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_scripts_operations @@ -0,0 +1,74 @@ +--- base/server/scripts/operations.orig 2026-07-14 06:22:12 UTC ++++ base/server/scripts/operations +@@ -1,4 +1,4 @@ +-#!/usr/local/bin/bash -X ++#!/usr/bin/env bash + + # From "http://fedoraproject.org/wiki/FCNewInit/Initscripts": + # +@@ -32,7 +32,7 @@ + + # load default, system-wide, and user-specific PKI configuration and + # set NSS_DEFAULT_DB_TYPE. +-. /usr/share/pki/scripts/config ++. /usr/local/share/pki/scripts/config + + default_error=0 + +@@ -41,7 +41,7 @@ else + SYSCONFIG_PKI=/etc/dogtag + else + debian=false +- SYSCONFIG_PKI=/etc/sysconfig/pki ++ SYSCONFIG_PKI=/usr/local/etc/pki + fi + + case $command in +@@ -78,7 +78,7 @@ usage() + + usage() + { +- echo "Usage: /usr/bin/pkidaemon start " ++ echo "Usage: /usr/local/bin/pkidaemon start " + echo + } + +@@ -211,7 +211,7 @@ backup_instance_configuration_files() + # + if [ -f ${backup_file} ] ; then + # 'CS.cfg.bak' is a regular file or a symlink +- cmp --silent ${pki_instance_configuration_file} ${backup_file} ++ cmp -s ${pki_instance_configuration_file} ${backup_file} + rv=$? + if [ $rv -eq 0 ] ; then + # 'CS.cfg' is identical to 'CS.cfg.bak'; +@@ -260,7 +260,7 @@ backup_instance_configuration_files() + # Backup 'CS.cfg' + if [ "${archive_configuration_file}" != "true" ] ; then + # Always backup 'CS.cfg' to 'CS.cfg.bak' +- cp -b ${pki_instance_configuration_file} ${backup_file} ++ cp ${pki_instance_configuration_file} ${backup_file} + else + # Archive parameters + archive_dir=${config_dir}/archives +@@ -272,7 +272,7 @@ backup_instance_configuration_files() + fi + + # Archive 'CS.cfg' to 'CS.cfg.bak.${timestamp}' +- cp -a ${pki_instance_configuration_file} ${archived_file} ++ cp -p ${pki_instance_configuration_file} ${archived_file} + if [ ! -s ${archived_file} ] ; then + # Issue a warning that the archived backup failed + echo "WARNING: Failed to archive '${pki_instance_configuration_file}' to '${archived_file}'!" +@@ -312,9 +312,9 @@ check_deprecated_algorithms() { + # Exclude NSS database files and links to Tomcat standard config files. + # The result will appear in systemd journal when the server is started. + +- FILES=$(find /etc/pki/${pki_instance_id} -type f -not -path "/etc/pki/${pki_instance_id}/alias/*") ++ FILES=$(find /usr/local/etc/pki/${pki_instance_id} -type f ! -path "/usr/local/etc/pki/${pki_instance_id}/alias/*") + +- grep -n -E "SHA\s*$|SHA\s*,|SHAwith|SHA1|SHA-1|SHA_1" $FILES | awk -F: '{ print "WARNING: Deprecated algorithm in " $1 ":" $2 ": " $3 }' ++ grep -n -E "SHA[[:space:]]*$|SHA[[:space:]]*,|SHAwith|SHA1|SHA-1|SHA_1" $FILES | awk -F: '{ print "WARNING: Deprecated algorithm in " $1 ":" $2 ": " $3 }' + } + + start_instance() diff --git a/security/dogtag-pki/files/patch-base_server_scripts_pkidaemon b/security/dogtag-pki/files/patch-base_server_scripts_pkidaemon new file mode 100644 index 000000000000..73e6ee76fa25 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_scripts_pkidaemon @@ -0,0 +1,44 @@ +--- base/server/scripts/pkidaemon.orig 2026-07-12 08:50:33 UTC ++++ base/server/scripts/pkidaemon +@@ -1,4 +1,4 @@ +-#!/bin/sh ++#!/usr/bin/env bash + # + # --- BEGIN COPYRIGHT BLOCK --- + # This program is free software; you can redistribute it and/or modify +@@ -20,7 +20,7 @@ + # + + # The following variables are referenced in the sourced script +-# /usr/share/pki/scripts/operations, to the error is invalid ++# /usr/local/share/pki/scripts/operations, to the error is invalid + + # shellcheck disable=SC2034 + PROG_NAME=`basename $0` +@@ -42,11 +42,11 @@ fi + pki_instance_name=$pki_instance_id + fi + +-PKI_REGISTRY="/etc/sysconfig/pki/tomcat" ++PKI_REGISTRY="/usr/local/etc/pki/tomcat" + PKI_SYSTEMD_TARGET="pki-tomcatd" + + # Source the PKI function library +-. /usr/share/pki/scripts/operations ++. /usr/local/share/pki/scripts/operations + + print_usage() + { +@@ -71,10 +71,10 @@ if [[ "$pki_instance_type" = "tomcat" ]]; then + # issue. + + if [[ "$pki_instance_type" = "tomcat" ]]; then +- cd /var/lib/tomcats/${pki_instance_name} ++ cd /var/db/tomcats/${pki_instance_name} + + else # pki-tomcatd +- cd /var/lib/pki/${pki_instance_name} ++ cd /var/db/pki/${pki_instance_name} + fi + + # See how we were called. diff --git a/security/dogtag-pki/files/patch-base_server_share_conf_pki.policy b/security/dogtag-pki/files/patch-base_server_share_conf_pki.policy new file mode 100644 index 000000000000..905f7da824a8 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_share_conf_pki.policy @@ -0,0 +1,11 @@ +--- base/server/share/conf/pki.policy.orig 2025-08-05 19:20:05 UTC ++++ base/server/share/conf/pki.policy +@@ -20,7 +20,7 @@ grant codeBase "file:${catalina.home}/bin/tomcat-juli. + grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { + + // Allow Tomcat JULI to read shared PKI files including logging.properties. +- permission java.io.FilePermission "/usr/share/pki/-", "read"; ++ permission java.io.FilePermission "/usr/local/share/pki/-", "read"; + + // Allow Tomcat JULI to generate subsystem log files. + permission java.io.FilePermission "${catalina.base}/logs/-", "read,write"; diff --git a/security/dogtag-pki/files/patch-base_server_src_main_java_com_netscape_cms_servlet_csadmin_LDAPConfigurator.java b/security/dogtag-pki/files/patch-base_server_src_main_java_com_netscape_cms_servlet_csadmin_LDAPConfigurator.java new file mode 100644 index 000000000000..0bfb2070e55c --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_src_main_java_com_netscape_cms_servlet_csadmin_LDAPConfigurator.java @@ -0,0 +1,79 @@ +--- base/server/src/main/java/com/netscape/cms/servlet/csadmin/LDAPConfigurator.java.orig 2025-08-05 19:20:05 UTC ++++ base/server/src/main/java/com/netscape/cms/servlet/csadmin/LDAPConfigurator.java +@@ -97,34 +97,34 @@ public class LDAPConfigurator { + + public void configureServer() throws Exception { + logger.info("Configuring DS server"); +- importLDIF("/usr/share/pki/server/database/ds/config.ldif", true); ++ importLDIF("/usr/local/share/pki/server/database/ds/config.ldif", true); + } + + public void setupSchema() throws Exception { + logger.info("Setting up PKI schema"); +- importSchemaFile("/usr/share/pki/server/database/ds/schema.ldif"); ++ importSchemaFile("/usr/local/share/pki/server/database/ds/schema.ldif"); + } + + public void createContainers(String subsystem) throws Exception { + logger.info("Creating container entries"); +- importLDIF("/usr/share/pki/" + subsystem + "/database/ds/create.ldif", true); ++ importLDIF("/usr/local/share/pki/" + subsystem + "/database/ds/create.ldif", true); + } + + public void setupACL(String subsystem) throws Exception { + logger.info("Setting up ACL"); +- importLDIF("/usr/share/pki/" + subsystem + "/database/ds/acl.ldif", true); ++ importLDIF("/usr/local/share/pki/" + subsystem + "/database/ds/acl.ldif", true); + } + + public void createIndexes(String subsystem) throws Exception { + logger.info("Creating indexes"); +- importLDIF("/usr/share/pki/" + subsystem + "/database/ds/index.ldif", true); ++ importLDIF("/usr/local/share/pki/" + subsystem + "/database/ds/index.ldif", true); + } + + public void rebuildIndexes(String subsystem) throws Exception { + + logger.info("Rebuilding indexes"); + +- File file = new File("/usr/share/pki/" + subsystem + "/database/ds/indextasks.ldif"); ++ File file = new File("/usr/local/share/pki/" + subsystem + "/database/ds/indextasks.ldif"); + File tmpFile = File.createTempFile("pki-" + subsystem + "-reindex-", ".ldif"); + + try { +@@ -151,7 +151,7 @@ public class LDAPConfigurator { + Map params = new HashMap<>(); + params.put("dbuser", dn); + +- importLDIF("/usr/share/pki/server/database/ds/db-access-grant.ldif", true, params); ++ importLDIF("/usr/local/share/pki/server/database/ds/db-access-grant.ldif", true, params); + } + + public void revokeDatbaseAccess(String dn) throws Exception { +@@ -161,7 +161,7 @@ public class LDAPConfigurator { + Map params = new HashMap<>(); + params.put("dbuser", dn); + +- importLDIF("/usr/share/pki/server/database/ds/db-access-revoke.ldif", true, params); ++ importLDIF("/usr/local/share/pki/server/database/ds/db-access-revoke.ldif", true, params); + } + + public List findVLVs() throws Exception { +@@ -190,7 +190,7 @@ public class LDAPConfigurator { + + public void addVLVs(String subsystem) throws Exception { + logger.info("Add VLVs"); +- importLDIF("/usr/share/pki/" + subsystem + "/database/ds/vlv.ldif", true); ++ importLDIF("/usr/local/share/pki/" + subsystem + "/database/ds/vlv.ldif", true); + } + + public void deleteVLVs() throws Exception { +@@ -211,7 +211,7 @@ public class LDAPConfigurator { + logger.info("Reindex VLVs"); + + Collection records = importLDIF( +- "/usr/share/pki/" + subsystem + "/database/ds/vlvtasks.ldif", false); ++ "/usr/local/share/pki/" + subsystem + "/database/ds/vlvtasks.ldif", false); + + for (LDIFRecord record : records) { + String dn = record.getDN(); diff --git a/security/dogtag-pki/files/patch-base_server_src_main_java_com_netscape_cmscore_apps_CMS.java b/security/dogtag-pki/files/patch-base_server_src_main_java_com_netscape_cmscore_apps_CMS.java new file mode 100644 index 000000000000..a96e11e0ddb9 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_src_main_java_com_netscape_cmscore_apps_CMS.java @@ -0,0 +1,20 @@ +--- base/server/src/main/java/com/netscape/cmscore/apps/CMS.java.orig 2025-08-05 19:20:05 UTC ++++ base/server/src/main/java/com/netscape/cmscore/apps/CMS.java +@@ -44,7 +44,7 @@ public final class CMS { + public static final Logger logger = LoggerFactory.getLogger(CMS.class); + + // product name is provided by the server theme package +- private static final String PRODUCT_NAME_FILE = "/usr/share/pki/CS_SERVER_VERSION"; ++ private static final String PRODUCT_NAME_FILE = "/usr/local/share/pki/CS_SERVER_VERSION"; + + public static final int DEBUG_OBNOXIOUS = 1; + public static final int DEBUG_VERBOSE = 5; +@@ -56,7 +56,7 @@ public final class CMS { + public static final int RUNNING_MODE = 1; + + /** +- * Return the product name from /usr/share/pki/CS_SERVER_VERSION ++ * Return the product name from /usr/local/share/pki/CS_SERVER_VERSION + * which is provided by the server theme package. + */ + public static String getProductName() throws Exception { diff --git a/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v1_ACLInterceptor.java b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v1_ACLInterceptor.java new file mode 100644 index 000000000000..1787381cbcda --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v1_ACLInterceptor.java @@ -0,0 +1,11 @@ +--- base/server/src/main/java/org/dogtagpki/server/rest/v1/ACLInterceptor.java.orig 2025-08-05 19:20:05 UTC ++++ base/server/src/main/java/org/dogtagpki/server/rest/v1/ACLInterceptor.java +@@ -89,7 +89,7 @@ public class ACLInterceptor implements ContainerReques + String subsystem = context.startsWith("/") ? context.substring(1) : context; + + // load default mapping +- String defaultMapping = "/usr/share/pki/" + subsystem + "/conf/acl.properties"; ++ String defaultMapping = "/usr/local/share/pki/" + subsystem + "/conf/acl.properties"; + logger.debug("ACLInterceptor: loading " + defaultMapping); + try (FileReader in = new FileReader(defaultMapping)) { + properties.load(in); diff --git a/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v1_AuthMethodInterceptor.java b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v1_AuthMethodInterceptor.java new file mode 100644 index 000000000000..85e410a40e3e --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v1_AuthMethodInterceptor.java @@ -0,0 +1,11 @@ +--- base/server/src/main/java/org/dogtagpki/server/rest/v1/AuthMethodInterceptor.java.orig 2025-08-05 19:20:05 UTC ++++ base/server/src/main/java/org/dogtagpki/server/rest/v1/AuthMethodInterceptor.java +@@ -71,7 +71,7 @@ public class AuthMethodInterceptor implements Containe + String subsystem = context.startsWith("/") ? context.substring(1) : context; + + // load default mapping +- String defaultMapping = "/usr/share/pki/" + subsystem + "/conf/auth-method.properties"; ++ String defaultMapping = "/usr/local/share/pki/" + subsystem + "/conf/auth-method.properties"; + logger.debug("AuthMethodInterceptor: loading " + defaultMapping); + try (FileReader in = new FileReader(defaultMapping)) { + properties.load(in); diff --git a/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v2_filters_ACLFilter.java b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v2_filters_ACLFilter.java new file mode 100644 index 000000000000..cb27839cc549 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v2_filters_ACLFilter.java @@ -0,0 +1,11 @@ +--- base/server/src/main/java/org/dogtagpki/server/rest/v2/filters/ACLFilter.java.orig 2025-08-05 19:20:05 UTC ++++ base/server/src/main/java/org/dogtagpki/server/rest/v2/filters/ACLFilter.java +@@ -136,7 +136,7 @@ public abstract class ACLFilter extends HttpFilter { + String subsystem = context.startsWith("/") ? context.substring(1) : context; + + // load default mapping +- Path defaultMappingACL = Paths.get("/usr/share/pki", subsystem, "conf", "acl.properties"); ++ Path defaultMappingACL = Paths.get("/usr/local/share/pki", subsystem, "conf", "acl.properties"); + File defaultMapping = defaultMappingACL.toFile(); + logger.debug("ACLFilter: loading {}", defaultMappingACL); + try (FileReader in = new FileReader(defaultMapping)) { diff --git a/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v2_filters_AuthMethodFilter.java b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v2_filters_AuthMethodFilter.java new file mode 100644 index 000000000000..f2b12d8ab35a --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_src_main_java_org_dogtagpki_server_rest_v2_filters_AuthMethodFilter.java @@ -0,0 +1,11 @@ +--- base/server/src/main/java/org/dogtagpki/server/rest/v2/filters/AuthMethodFilter.java.orig 2025-08-05 19:20:05 UTC ++++ base/server/src/main/java/org/dogtagpki/server/rest/v2/filters/AuthMethodFilter.java +@@ -116,7 +116,7 @@ public abstract class AuthMethodFilter extends HttpFil + String subsystem = context.startsWith("/") ? context.substring(1) : context; + + // load default mapping +- Path defaultMappingAuth = Paths.get("/usr/share/pki", subsystem, "conf", "auth-method.properties"); ++ Path defaultMappingAuth = Paths.get("/usr/local/share/pki", subsystem, "conf", "auth-method.properties"); + File defaultMapping = defaultMappingAuth.toFile(); + logger.debug("AuthMethodFilter: loading {}", defaultMapping); + try (FileReader in = new FileReader(defaultMapping)) { diff --git a/security/dogtag-pki/files/patch-base_tks_tomcat-9.0_conf_Catalina_localhost_tks.xml b/security/dogtag-pki/files/patch-base_tks_tomcat-9.0_conf_Catalina_localhost_tks.xml new file mode 100644 index 000000000000..78649d2d43ea --- /dev/null +++ b/security/dogtag-pki/files/patch-base_tks_tomcat-9.0_conf_Catalina_localhost_tks.xml @@ -0,0 +1,11 @@ +--- base/tks/tomcat-9.0/conf/Catalina/localhost/tks.xml.orig 2025-08-05 19:20:05 UTC ++++ base/tks/tomcat-9.0/conf/Catalina/localhost/tks.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-base_tomcat-9.0_conf_Catalina_localhost_ROOT.xml b/security/dogtag-pki/files/patch-base_tomcat-9.0_conf_Catalina_localhost_ROOT.xml new file mode 100644 index 000000000000..f6a960a2ecc6 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_tomcat-9.0_conf_Catalina_localhost_ROOT.xml @@ -0,0 +1,11 @@ +--- base/tomcat-9.0/conf/Catalina/localhost/ROOT.xml.orig 2025-08-05 19:20:05 UTC ++++ base/tomcat-9.0/conf/Catalina/localhost/ROOT.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-base_tomcat-9.0_conf_Catalina_localhost_pki.xml b/security/dogtag-pki/files/patch-base_tomcat-9.0_conf_Catalina_localhost_pki.xml new file mode 100644 index 000000000000..89534d49b027 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_tomcat-9.0_conf_Catalina_localhost_pki.xml @@ -0,0 +1,11 @@ +--- base/tomcat-9.0/conf/Catalina/localhost/pki.xml.orig 2025-08-05 19:20:05 UTC ++++ base/tomcat-9.0/conf/Catalina/localhost/pki.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-base_tools_bin_pki b/security/dogtag-pki/files/patch-base_tools_bin_pki new file mode 100644 index 000000000000..2a0b27b20ec6 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_tools_bin_pki @@ -0,0 +1,11 @@ +--- base/tools/bin/pki.orig 2026-07-16 17:50:06 UTC ++++ base/tools/bin/pki +@@ -21,7 +21,7 @@ + + # load default, system-wide, and user-specific PKI configuration and + # set NSS_DEFAULT_DB_TYPE. +-. /usr/share/pki/scripts/config ++. /usr/local/share/pki/scripts/config + + ${PYTHON_EXECUTABLE} -I -m pki.cli.main "$@" + diff --git a/security/dogtag-pki/files/patch-base_tps_tomcat-9.0_conf_Catalina_localhost_tps.xml b/security/dogtag-pki/files/patch-base_tps_tomcat-9.0_conf_Catalina_localhost_tps.xml new file mode 100644 index 000000000000..bfb990ab17b4 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_tps_tomcat-9.0_conf_Catalina_localhost_tps.xml @@ -0,0 +1,11 @@ +--- base/tps/tomcat-9.0/conf/Catalina/localhost/tps.xml.orig 2025-08-05 19:20:05 UTC ++++ base/tps/tomcat-9.0/conf/Catalina/localhost/tps.xml +@@ -22,7 +22,7 @@ --> + See the License for the specific language governing permissions and + limitations under the License. + --> +- ++ + + diff --git a/security/dogtag-pki/files/patch-setup.py b/security/dogtag-pki/files/patch-setup.py index 561a9be19cbb..25a749999388 100644 --- a/security/dogtag-pki/files/patch-setup.py +++ b/security/dogtag-pki/files/patch-setup.py @@ -1,13 +1,22 @@ ---- setup.py.orig 2026-07-04 19:34:11 UTC +--- setup.py.orig 2025-08-05 19:20:05 UTC +++ setup.py @@ -48,8 +48,8 @@ setup( setup( author='Dogtag Certificate System Team', author_email='devel@lists.dogtagpki.org', - name='Dogtag PKI', - version='10', + name='dogtag-pki', + version='11.7.0', description='Dogtag Certificate System', license='GPL', keywords='pki', +@@ -66,7 +66,7 @@ setup( + 'pki.server.deployment', + 'pki.server.deployment.scriptlets', + ], +- data_files=list(upgrades.items()), ++ data_files=[], + classifiers=[ + 'Development Status :: 5 - Production/Stable', + 'Environment :: Web Environment', diff --git a/security/dogtag-pki/files/pki.conf.in b/security/dogtag-pki/files/pki.conf.in new file mode 100644 index 000000000000..05c0cea2131c --- /dev/null +++ b/security/dogtag-pki/files/pki.conf.in @@ -0,0 +1,63 @@ +# +# default PKI configuration +# + +# Python executable +PYTHON_EXECUTABLE=%%PYTHON_CMD%% +export PYTHON_EXECUTABLE + +# Java home +JAVA_HOME=%%JAVA_HOME%% +export JAVA_HOME + +# JVM options +# +# Command switch we want to tell java to observer fips mode +# For the moment we want this to be false even if we really are +# in fips mode, because we want the jss prover instead of the sun +# fips provider to be selected. +JAVA_FIPS_ENABLED="-Dcom.redhat.fips=false" # Disable FIPS mode + +export JAVA_FIPS_ENABLED + +# JNI jar file location +JNI_JAR_DIR=%%JAVALIBDIR%% +export JNI_JAR_DIR + +# PKI library +PKI_LIB=%%PREFIX%%/share/pki/lib +export PKI_LIB + +# NSS database format +NSS_DEFAULT_DB_TYPE="sql" +export NSS_DEFAULT_DB_TYPE + +# logging configuration location +PKI_LOGGING_CONFIG=%%PREFIX%%/share/pki/etc/logging.properties +export PKI_LOGGING_CONFIG + +# PKI CLI options +PKI_CLI_OPTIONS= +export PKI_CLI_OPTIONS + +# Key wrapping parameter set +# This parameter specifies the encryption and key wrapping algorithms to use +# when storing secrets in the KRA, or creating CRMF data using CRMFPopClient. +# +# Parameter sets are: +# O: (legacy, for interacting with pre-10.4 servers) +# Encryption Algorithm: DES3_CBC +# Padding: PKCS#1.5 Padding +# Key Wrapping: DES3_CBC_PAD +# 1: AES (default for 10.4+ servers) +# Encryption Algorithm: AES_128_CBC +# Padding: PKCS#1.5 Padding +# Key Wrapping: AES KeyWrap with Padding +KEY_WRAP_PARAMETER_SET=1 +export KEY_WRAP_PARAMETER_SET + +# Auto-enable subsystems +# This boolean parameter determines whether to automatically enable all +# subsystems on startup. +PKI_SERVER_AUTO_ENABLE_SUBSYSTEMS="true" +export PKI_SERVER_AUTO_ENABLE_SUBSYSTEMS diff --git a/security/dogtag-pki/files/pkidestroy.in b/security/dogtag-pki/files/pkidestroy.in new file mode 100644 index 000000000000..14d078274991 --- /dev/null +++ b/security/dogtag-pki/files/pkidestroy.in @@ -0,0 +1,6 @@ +#!/bin/sh +: ${NSS_DEFAULT_DB_TYPE:=sql} +export NSS_DEFAULT_DB_TYPE +: ${JAVA_HOME:=%%JAVA_HOME%%} +export JAVA_HOME +exec %%PYTHON_CMD%% -m pki.server.pkidestroy "$@" diff --git a/security/dogtag-pki/files/pkispawn.in b/security/dogtag-pki/files/pkispawn.in new file mode 100644 index 000000000000..94ce0d894d30 --- /dev/null +++ b/security/dogtag-pki/files/pkispawn.in @@ -0,0 +1,6 @@ +#!/bin/sh +: ${NSS_DEFAULT_DB_TYPE:=sql} +export NSS_DEFAULT_DB_TYPE +: ${JAVA_HOME:=%%JAVA_HOME%%} +export JAVA_HOME +exec %%PYTHON_CMD%% -m pki.server.pkispawn "$@" diff --git a/security/dogtag-pki/files/tomcat.conf.in b/security/dogtag-pki/files/tomcat.conf.in new file mode 100644 index 000000000000..1d6593a4bfc9 --- /dev/null +++ b/security/dogtag-pki/files/tomcat.conf.in @@ -0,0 +1,4 @@ +# systemd environment file for pki-tomcatd and pki-tomcatd-nuxwdog services + +# NSS database format +NSS_DEFAULT_DB_TYPE="sql" diff --git a/security/dogtag-pki/pkg-descr b/security/dogtag-pki/pkg-descr index a1586f938c0f..db43568bccb6 100644 --- a/security/dogtag-pki/pkg-descr +++ b/security/dogtag-pki/pkg-descr @@ -1,2 +1,8 @@ -Dogtag PKI provides Python client and server modules for interacting with -and administering Dogtag PKI certificate services. +Dogtag PKI is an enterprise-class open source Certificate Authority (CA). +It supports all aspects of certificate lifecycle management, including key +archival, OCSP, and smartcard management. + +This port provides the Certificate Authority (CA) subsystem running on +Apache Tomcat, the pki command line interface, the pkispawn/pkidestroy +deployment tools, and the Python client and server modules for +administering Dogtag PKI certificate services. diff --git a/security/dogtag-pki/pkg-plist b/security/dogtag-pki/pkg-plist new file mode 100644 index 000000000000..4259e4883cad --- /dev/null +++ b/security/dogtag-pki/pkg-plist @@ -0,0 +1,15 @@ +bin/pki +bin/pkidaemon +sbin/pki-server +sbin/pki-upgrade +sbin/pkidestroy +sbin/pkispawn +%%JAVAJARDIR%%/pki/pki-ca.jar +%%JAVAJARDIR%%/pki/pki-common.jar +%%JAVAJARDIR%%/pki/pki-server-webapp.jar +%%JAVAJARDIR%%/pki/pki-server.jar +%%JAVAJARDIR%%/pki/pki-tomcat-9.0.jar +%%JAVAJARDIR%%/pki/pki-tomcat.jar +%%JAVAJARDIR%%/pki/pki-tools.jar +@dir /var/log/pki +lib/libpki-tps.so