| 1 |
unnilennium |
1.1 |
Name: dehydrated |
| 2 |
jpp |
1.8 |
%define version 0.6.2 |
| 3 |
|
|
%define release 13 |
| 4 |
jpp |
1.3 |
Version: %{version} |
| 5 |
|
|
Release: %{release}%{?dist} |
| 6 |
unnilennium |
1.1 |
Summary: ACME client in bash |
| 7 |
|
|
|
| 8 |
|
|
Group: Application/System |
| 9 |
|
|
License: MIT |
| 10 |
|
|
URL: https://github.com/lukas2511/dehydrated |
| 11 |
jpp |
1.6 |
Source0: dehydrated-%{version}.tar.gz |
| 12 |
jpp |
1.3 |
Source1: integration.tgz |
| 13 |
unnilennium |
1.1 |
|
| 14 |
|
|
BuildArch: noarch |
| 15 |
|
|
BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot |
| 16 |
|
|
|
| 17 |
|
|
BuildRequires: httpd |
| 18 |
|
|
Requires: openssl |
| 19 |
|
|
Requires: sed |
| 20 |
|
|
Requires: /bin/awk |
| 21 |
|
|
Requires: curl |
| 22 |
|
|
Requires: /bin/mktemp |
| 23 |
|
|
|
| 24 |
|
|
Conflicts: letsencrypt.sh |
| 25 |
|
|
Obsoletes: letsencrypt.sh |
| 26 |
|
|
|
| 27 |
|
|
%if 0%{?fedora} >= 11 || 0%{?rhel} >= 5 |
| 28 |
|
|
%global useselinux 1 |
| 29 |
|
|
%else |
| 30 |
|
|
%global useselinux 0 |
| 31 |
|
|
%endif |
| 32 |
|
|
|
| 33 |
|
|
%description |
| 34 |
|
|
This is a client for signing certificates with an ACME server |
| 35 |
|
|
(currently only provided by Let's Encrypt) implemented as a |
| 36 |
|
|
relatively simple bash-script. |
| 37 |
|
|
|
| 38 |
|
|
%prep |
| 39 |
jpp |
1.3 |
#unpack source 1 |
| 40 |
|
|
%setup -n dehydrated-%{version} |
| 41 |
|
|
# unpack integration package aka source 1; do not delete previous -D, and disable default unpacking -T |
| 42 |
|
|
# this wil unpack the integration file in the previous unpacked dehydrated folder |
| 43 |
|
|
%setup -T -D -a 1 |
| 44 |
unnilennium |
1.1 |
|
| 45 |
|
|
%build |
| 46 |
|
|
sed -i -e "s|#BASEDIR=.*|BASEDIR=%{_localstatedir}/lib/%{name}/certificates|" \ |
| 47 |
|
|
-e "s|#WELLKNOWN=.*|WELLKNOWN=%{_localstatedir}/lib/%{name}/challenges|" \ |
| 48 |
|
|
-e "s|#HOOK=.*|HOOK=%{_bindir}/le_hooks.sh|" \ |
| 49 |
|
|
-e "s|#DOMAINS_TXT=.*|DOMAINS_TXT=%{_sysconfdir}/%{name}/domains.txt|" \ |
| 50 |
|
|
docs/examples/config |
| 51 |
|
|
|
| 52 |
|
|
%install |
| 53 |
|
|
install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib/%{name}/challenges |
| 54 |
|
|
install -d $RPM_BUILD_ROOT/%{_localstatedir}/lib/%{name}/certificates |
| 55 |
|
|
install -D dehydrated $RPM_BUILD_ROOT/%{_bindir}/%{name} |
| 56 |
jpp |
1.4 |
install integration/dehydrated_hooks $RPM_BUILD_ROOT/%{_bindir}/dehydrated_hooks |
| 57 |
|
|
install integration/dehydrated_revoke $RPM_BUILD_ROOT/%{_bindir}/dehydrated_revoke |
| 58 |
unnilennium |
1.1 |
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_deploy_cert.d |
| 59 |
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_clean_challenge.d |
| 60 |
jpp |
1.4 |
install -D -m 0644 integration/httpd.sh.sample $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/hooks_deploy_cert.d/10httpd.sh.sample |
| 61 |
unnilennium |
1.1 |
install -D -m 0644 docs/examples/config $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/config |
| 62 |
|
|
install -D -m 0644 docs/examples/domains.txt $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/domains.txt |
| 63 |
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/ |
| 64 |
|
|
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/%{name} |
| 65 |
jpp |
1.4 |
|
| 66 |
unnilennium |
1.1 |
#!/bin/sh |
| 67 |
|
|
# Uncomment to enable auto-renewal |
| 68 |
|
|
# %{_bindir}/%{name} -c 2>&1 | awk '{ print strftime(), $0; fflush(); }' >> %{_localstatedir}/log/%{name}.log |
| 69 |
|
|
|
| 70 |
|
|
# Uncomment this to auto revoke old certs |
| 71 |
|
|
# %{_bindir}/dehydrated_revoke 2>&1 | awk '{ print strftime(), $0; fflush(); }' >> %{_localstatedir}/log/%{name}.log |
| 72 |
|
|
|
| 73 |
|
|
_EOF |
| 74 |
|
|
install -d $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d |
| 75 |
|
|
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/httpd/conf.d/dehydrated.conf |
| 76 |
|
|
|
| 77 |
|
|
Alias /.well-known/acme-challenge/ %{_localstatedir}/lib/%{name}/challenges/ |
| 78 |
|
|
|
| 79 |
|
|
<Directory %{_localstatedir}/lib/%{name}/challenges> |
| 80 |
|
|
Options None |
| 81 |
|
|
AllowOverride None |
| 82 |
|
|
Header set Content-Type "application/jose+json" |
| 83 |
|
|
<IfModule mod_authz_core.c> |
| 84 |
|
|
# Apache 2.4 |
| 85 |
|
|
Require all granted |
| 86 |
|
|
</IfModule> |
| 87 |
|
|
<IfModule !mod_authz_core.c> |
| 88 |
|
|
# Apache 2.2 |
| 89 |
|
|
Order deny,allow |
| 90 |
|
|
Allow from all |
| 91 |
|
|
</IfModule> |
| 92 |
|
|
</Directory> |
| 93 |
|
|
_EOF |
| 94 |
|
|
install -d -m 750 $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d |
| 95 |
|
|
cat <<"_EOF" > $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d/%{name} |
| 96 |
|
|
/var/log/%{name}.log { |
| 97 |
|
|
missingok |
| 98 |
|
|
copytruncate |
| 99 |
|
|
rotate 12 |
| 100 |
|
|
compress |
| 101 |
|
|
weekly |
| 102 |
|
|
create 0660 root root |
| 103 |
|
|
} |
| 104 |
|
|
_EOF |
| 105 |
|
|
|
| 106 |
|
|
%post |
| 107 |
|
|
%if %{useselinux} |
| 108 |
|
|
( |
| 109 |
|
|
# New File context |
| 110 |
|
|
semanage fcontext -a -t var_lib_t "%{_localstatedir}/lib/dehydrated(/.*)?" |
| 111 |
|
|
# files created by app |
| 112 |
|
|
restorecon -R %{_localstatedir}/lib/dehydrated |
| 113 |
|
|
) &>/dev/null || : |
| 114 |
|
|
%endif |
| 115 |
|
|
|
| 116 |
|
|
# Migrate from letsencrypt.sh |
| 117 |
|
|
if [ -e %{_sysconfdir}/letsencrypt.sh/config ]; then |
| 118 |
|
|
sed -e 's/letsencrypt.sh/dehydrated/g' \ |
| 119 |
|
|
-e 's/le_hooks.sh/dehydrated_hooks/g' \ |
| 120 |
|
|
%{_sysconfdir}/letsencrypt.sh/config > %{_sysconfdir}/%{name}/config |
| 121 |
|
|
fi |
| 122 |
|
|
if [ -e %{_sysconfdir}/letsencrypt.sh/domains.txt ]; then |
| 123 |
|
|
cat %{_sysconfdir}/letsencrypt.sh/domains.txt > %{_sysconfdir}/%{name}/domains.txt |
| 124 |
|
|
fi |
| 125 |
|
|
if [ -d %{_localstatedir}/lib/letsencrypt.sh/certificates/certs ]; then |
| 126 |
|
|
mv %{_localstatedir}/lib/letsencrypt.sh/certificates/* %{_localstatedir}/lib/%{name}/certificates/ |
| 127 |
|
|
fi |
| 128 |
|
|
sed -i -e 's|%{_localstatedir}/lib/letsencrypt.sh|%{_localstatedir}/lib/%{name}|g' %{_sysconfdir}/httpd/conf.d/ssl.conf |
| 129 |
|
|
if [ -d %{_sysconfdir}/letsencrypt.sh/hooks_deploy_cert.d/ ]; then |
| 130 |
|
|
find %{_sysconfdir}/letsencrypt.sh/hooks_deploy_cert.d/ -type f -perm /111 -exec mv "{}" %{_sysconfdir}/%{name}/hooks_deploy_cert.d/ \; |
| 131 |
|
|
fi |
| 132 |
|
|
if [ -d %{_sysconfdir}/letsencrypt.sh/hooks_clean_challenge.d/ ]; then |
| 133 |
|
|
find %{_sysconfdir}/letsencrypt.sh/hooks_clean_challenge.d/ -type f -perm /111 -exec mv "{}" %{_sysconfdir}/%{name}/hooks_clean_challenge.d/ \; |
| 134 |
|
|
fi |
| 135 |
|
|
|
| 136 |
|
|
%postun |
| 137 |
|
|
%if %{useselinux} |
| 138 |
|
|
if [ "$1" -eq "0" ]; then |
| 139 |
|
|
# Remove the File Context |
| 140 |
|
|
( |
| 141 |
|
|
semanage fcontext -d "%{_localstatedir}/lib/dehydrated(/.*)?" |
| 142 |
|
|
) &>/dev/null || : |
| 143 |
|
|
fi |
| 144 |
|
|
%endif |
| 145 |
|
|
|
| 146 |
|
|
%files |
| 147 |
|
|
%doc LICENSE README.md docs/examples/hook.sh |
| 148 |
unnilennium |
1.2 |
%dir %attr(0755,root,root) %{_sysconfdir}/%{name}/hooks_clean_challenge.d/ |
| 149 |
|
|
%attr(0644, root,root) %{_sysconfdir}/%{name}/hooks_deploy_cert.d/* |
| 150 |
|
|
%config(noreplace) %{_sysconfdir}/%{name}/domains.txt |
| 151 |
|
|
%config(noreplace) %{_sysconfdir}/%{name}/config |
| 152 |
unnilennium |
1.1 |
%config(noreplace) %attr(0755,root,root) %{_sysconfdir}/cron.daily/%{name} |
| 153 |
|
|
%config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf |
| 154 |
|
|
%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} |
| 155 |
|
|
%attr(0755,root,root) %{_bindir}/%{name} |
| 156 |
|
|
%attr(0755,root,root) %{_bindir}/dehydrated_hooks |
| 157 |
|
|
%attr(0755,root,root) %{_bindir}/dehydrated_revoke |
| 158 |
|
|
%dir %attr(0750,root,apache) %{_localstatedir}/lib/%{name}/challenges |
| 159 |
|
|
%dir %attr(0750,root,root) %{_localstatedir}/lib/%{name}/certificates |
| 160 |
|
|
|
| 161 |
|
|
%changelog |
| 162 |
jpp |
1.8 |
* Thu May 03 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.6.2-13.sme |
| 163 |
|
|
- upgrade to upstream version [SME: 10577] |
| 164 |
|
|
|
| 165 |
jpp |
1.7 |
* Wed Apr 11 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.6.1-12.sme |
| 166 |
jpp |
1.6 |
- upgrade to upstream version [SME: 10565] |
| 167 |
|
|
|
| 168 |
jpp |
1.5 |
* Fri Feb 16 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.5.0-3.sme |
| 169 |
jpp |
1.4 |
- fix Dehydrated caused rate limits to be reached [SME: 10521] patch0 |
| 170 |
|
|
|
| 171 |
jpp |
1.3 |
* Fri Feb 16 2018 Jean-Philipe Pialasse <tests@pialasse.com> 0.5.0-1.sme |
| 172 |
|
|
- upgrade to upstream version [SME: 10521] |
| 173 |
jpp |
1.4 |
- update architecture of sources and release/version number |
| 174 |
|
|
according to Charlie Brady recomendations see [SME 9901] |
| 175 |
jpp |
1.3 |
|
| 176 |
unnilennium |
1.2 |
* Mon Feb 06 2017 Jean-Philipe Pialasse <tests@pialasse.com> - 0.4.0.20170205.git1163864.sme |
| 177 |
|
|
- update dehydrated to 0.4 [SME: 10080] |
| 178 |
|
|
- see https://github.com/lukas2511/dehydrated/releases/tag/v0.4.0 |
| 179 |
|
|
|
| 180 |
unnilennium |
1.1 |
* Fri Jan 06 2017 Jean-Philipe Pialasse <tests@pialasse.com> - 0.3.0.20160914.gitcaeed7d-4.sme |
| 181 |
|
|
- Initial import in SME Server Buildsys |
| 182 |
|
|
|
| 183 |
|
|
* Mon Oct 24 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-3 |
| 184 |
|
|
- Fix warning when installing dehydrated without upgrading from letsencrypt.sh |
| 185 |
|
|
|
| 186 |
|
|
* Mon Sep 19 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-2 |
| 187 |
|
|
- Fix find command to work with older find versions (on el5), replace -executable with -perm /111 |
| 188 |
|
|
|
| 189 |
|
|
* Wed Sep 14 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.3.0.20160914.gitcaeed7d-1 |
| 190 |
|
|
- Renamed to dehydrated |
| 191 |
|
|
|
| 192 |
|
|
* Wed Aug 24 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160803.gitafabfff-2 |
| 193 |
|
|
- Set var_lib_t context to files |
| 194 |
|
|
|
| 195 |
|
|
* Wed Aug 3 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160803.gitafabfff-1 |
| 196 |
|
|
- Update to git afabfff |
| 197 |
|
|
|
| 198 |
|
|
* Mon Jun 6 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-4 |
| 199 |
|
|
- Default to enable HOOK in config |
| 200 |
|
|
|
| 201 |
|
|
* Fri Jun 3 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-3 |
| 202 |
|
|
- Add missing exec permission on daily cronjob script |
| 203 |
|
|
|
| 204 |
|
|
* Wed Jun 1 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-2 |
| 205 |
|
|
- Fix le_revoke.sh script to use config instead of config.sh |
| 206 |
|
|
|
| 207 |
|
|
* Tue May 31 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160531.gitec48906-1 |
| 208 |
|
|
- Update to git ec48906 |
| 209 |
|
|
|
| 210 |
|
|
* Fri May 13 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160513.gita286741-1 |
| 211 |
|
|
- Update to git a286741 |
| 212 |
|
|
|
| 213 |
|
|
* Wed Mar 30 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160330.gitdca25e8-1 |
| 214 |
|
|
- Update to git dca25e8 |
| 215 |
|
|
- Fix arg shifting in le_hooks script |
| 216 |
|
|
|
| 217 |
|
|
* Tue Feb 23 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160223.git2099c77-1 |
| 218 |
|
|
- Update to GIT git2099c77 |
| 219 |
|
|
|
| 220 |
|
|
* Sat Jan 30 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160127.git79ff846-2 |
| 221 |
|
|
- Rename httpd.sh hook to 10httpd.sh |
| 222 |
|
|
- Provide le_revoke.sh script to revoke old certificates |
| 223 |
|
|
- Add timestamp to logs using awk |
| 224 |
|
|
|
| 225 |
|
|
* Fri Jan 29 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.20160127.git79ff846-1 |
| 226 |
|
|
- Use date based version number |
| 227 |
|
|
|
| 228 |
|
|
* Wed Jan 27 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.3.git79ff846-1 |
| 229 |
|
|
- Update to git 79ff846 |
| 230 |
|
|
|
| 231 |
|
|
* Mon Jan 25 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.2.git3432f60-1 |
| 232 |
|
|
- Add hooks directory |
| 233 |
|
|
|
| 234 |
|
|
* Mon Jan 25 2016 Daniel Berteaud <daniel@firewall-services.com> - 0.0.1.git3432f60-1 |
| 235 |
|
|
- First package |
Parent Directory
| 
Revision Log
| 
Revision Graph
