#

# Red Hat BIND package .spec file

#

#%%global PATCHVER P2

#%%global PREVER rc2

#%%global VERSION %{version}%{PREVER}

%global VERSION %{version}

#%%global VERSION %{version}-%{PATCHVER}

%{?!SDB:       %global SDB       1}

%{?!test:      %global test      0}

%{?!bind_uid:  %global bind_uid  25}

%{?!bind_gid:  %global bind_gid  25}

%{?!GSSTSIG:   %global GSSTSIG   1}

%{?!PKCS11:    %global PKCS11    1}

%{?!DEVEL:     %global DEVEL     1}

%global        bind_dir          /var/named

%global        chroot_prefix     %{bind_dir}/chroot

%if %{SDB}

%global        chroot_sdb_prefix %{bind_dir}/chroot_sdb

%endif

#

Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server

Name:     bind

License:  ISC

Version:  9.9.4

Release:  61%{?PATCHVER}%{?PREVER}%{?dist}

Epoch:    32

Url:      http://www.isc.org/products/BIND/

Buildroot:%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Group:    System Environment/Daemons

#

Source:   https://ftp.isc.org/isc/bind9/%{VERSION}/bind-%{VERSION}.tar.gz

Source1:  named.sysconfig

Source3:  named.logrotate

Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in

Source8:  dnszone.schema

Source12: README.sdb_pgsql

Source25: named.conf.sample

Source28: config-15.tar.bz2

# Up-to-date bind.keys from upstream

# Fetch a new one from page https://www.isc.org/bind-keys

Source29: bind.keys

Source30: ldap2zone.c

Source31: ldap2zone.1

Source32: named-sdb.8

Source33: zonetodb.1

Source34: zone2sqlite.1

Source35: bind.tmpfiles.d

Source36: trusted-key.key

Source37: named.service

Source38: named-chroot.service

Source39: named-sdb.service

Source40: named-sdb-chroot.service

Source41: setup-named-chroot.sh

Source42: generate-rndc-key.sh

Source43: named.rwtab

Source44: named-chroot-setup.service

Source45: named-sdb-chroot-setup.service

Source46: named-setup-rndc.service

Source47: named-pkcs11.service

# added due to GeoIP functionality tests

# patch tool does not support binary patches

Source48: geoip-testing-data.tar.xz

# Common patches

Patch5:  bind-nonexec.patch

Patch10: bind-9.5-PIE.patch

Patch16: bind-9.3.2-redhat_doc.patch

Patch72: bind-9.5-dlz-64bit.patch

Patch87: bind-9.5-parallel-build.patch

Patch101:bind-96-old-api.patch

Patch102:bind-95-rh452060.patch

Patch106:bind93-rh490837.patch

Patch109:bind97-rh478718.patch

Patch110:bind97-rh570851.patch

Patch111:bind97-exportlib.patch

Patch112:bind97-rh645544.patch

Patch119:bind97-rh693982.patch

Patch123:bind98-rh735103.patch

Patch124:bind93-rh726120.patch

# FIXME: This disables dlzexternal, which I will enable later again

# Make tests on all architectures and disable it

Patch127:bind99-forward.patch

Patch130:bind-9.9.1-P2-dlz-libdb.patch

Patch131:bind-9.9.1-P2-multlib-conflict.patch

Patch133:bind99-rh640538.patch

Patch134:bind97-rh669163.patch

Patch137:bind99-rrl.patch

# Install dns/update.h header for bind-dyndb-ldap plugin

Patch138:bind-9.9.3-include-update-h.patch

Patch139:bind99-ISC-Bugs-34738.patch

Patch140:bind99-ISC-Bugs-34870-v3.patch

Patch141:bind99-ISC-Bugs-35073.patch

Patch142:bind99-ISC-Bugs-35080.patch

Patch143:bind99-CVE-2014-0591.patch

Patch144:bind99-rh1067424.patch

Patch145:bind99-rh1072379.patch

Patch146:bind99-rh1098959.patch

Patch147:bind99-CVE-2014-8500.patch

Patch148:bind99-CVE-2015-1349.patch

Patch149:bind99-rh1215687-limits.patch

Patch154:bind99-rh1215164.patch

Patch155:bind99-rh1214827.patch

Patch156:bind99-CVE-2015-4620.patch

Patch157:bind99-CVE-2015-5477.patch

Patch158:bind-99-socket-maxevents.patch

Patch159:bind99-CVE-2015-5722.patch

Patch160:bind99-CVE-2015-8000.patch

Patch161:bind99-CVE-2015-8704.patch

Patch162:bind99-CVE-2016-1285-CVE-2016-1286.patch

Patch163:bind99-rh1291185.patch

Patch164:bind99-rh1259514.patch

Patch165:bind99-rh1306610.patch

Patch166:bind99-rh1220594-geoip.patch

Patch167:bind99-automatic-interface-scanning-rh1294506.patch

# commit 51bcc28543ce205f7af238ef2f3889ef020a0961 ISC 4467

patch168:bind99-CVE-2016-2776.patch

# commit bbb7c613b3e41495db627909660334695b48e60b ISC 4489

patch169:bind99-CVE-2016-8864.patch

# commit d372472f604d45f85b3bbae5d6f523fb561a8823 ISC 4508

patch170:bind99-CVE-2016-9131.patch

# commit a14b7f0187315767a1fa855f116fe937a7b402e3 ISC 4510

patch171:bind99-CVE-2016-9147.patch

# commit 69cb8ebf157183d9c36a9813f945348dd81b521f ISC 4517

Patch172:bind99-CVE-2016-9444.patch

# commit 2c74ad28efe5710ad04562c6f9902bc48d3be0ed ISC 4530

Patch173:bind99-rt43779.patch

# commit 062b04898be720ed0855efc192847fcbc667b3e1 ISC 4406

Patch174:bind99-CVE-2016-2775.patch

# ISC 4557

Patch175:bind99-CVE-2017-3135.patch

# ISC 4558

Patch176:bind99-rt44318.patch

# commit c550e75ade4ceb4ece96f660292799519a5c3183 ISC 4567

Patch177:bind99-rh1392362.patch

# commit 1f3ac11cb4ecfab52f517ebf78493b0f05318be2

Patch178:bind99-coverity-fixes2.patch

# ISC 4575

Patch179:bind99-CVE-2017-3136.patch

# ISC 4578

Patch180:bind99-CVE-2017-3137.patch

# commit 5e746ab61ed8158f784b86111fef95581a08b7dd ISC 3905

Patch181:bind99-rh1416304.patch

# ISC 4643

Patch182: bind99-CVE-2017-3142+3143.patch

# commit e3894cd3a92be79a64072835008ec589b17c601a

Patch183: bind99-rh1472862.patch

# commit 2fc1b8102d4bf02162012c27ab95e98a7438bd8f ISC 4647

Patch184: bind99-rh1476013.patch

# commit 51aed1827453f40ee56b165d45c5d58d96838d94

Patch185: bind99-rh1470637-tests.patch

# commit 51b00c6c783ccf5dca86119ff8f4f8b994298ca4 ISC 4712

Patch186: bind99-rh1470637.patch

# commit 6a3fa181d1253db5191139e20231512eebaddeeb ISC 3745

Patch187: bind99-rh1464850.patch

# commit 871f3c8beeb2134b17414ec167b90a57adb8e122 ISC 3980

Patch188: bind99-rh1464850-2.patch

# commit 4eb998928b9aef0ceda42d7529980d658138698a ISC 3525

Patch189: bind99-rh1501531.patch

# ISC 4858

Patch190: bind99-CVE-2017-3145.patch

# Native PKCS#11 functionality from 9.10

Patch150:bind-9.9-allow_external_dnskey.patch

Patch151:bind-9.9-native-pkcs11.patch

Patch152:bind-9.9-dist-native-pkcs11.patch

Patch153:bind99-coverity-fixes.patch

# SDB patches

Patch11: bind-9.3.2b2-sdbsrc.patch

Patch12: bind-9.5-sdb.patch

Patch62: bind-9.5-sdb-sqlite-bld.patch

# needs inpection

Patch17: bind-9.3.2b1-fix_sdb_ldap.patch

Patch104: bind99-dyndb.patch

# IDN paches

Patch73: bind-9.5-libidn.patch

Patch83: bind-9.5-libidn2.patch

Patch85: bind-9.5-libidn3.patch

Patch94: bind95-rh461409.patch

Patch135:bind99-libidn4.patch

#

Requires(preun):  systemd

Requires(postun): systemd

Requires:       coreutils

Requires:       systemd-units

Requires(post): grep, systemd

Requires(pre):  shadow-utils

Requires:       bind-libs = %{epoch}:%{version}-%{release}

Obsoletes:      bind-config < 30:9.3.2-34.fc6

Provides:       bind-config = 30:9.3.2-34.fc6

Obsoletes:      caching-nameserver < 31:9.4.1-7.fc8

Provides:       caching-nameserver = 31:9.4.1-7.fc8

Obsoletes:      dnssec-conf < 1.27-2

Provides:       dnssec-conf = 1.27-1

BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel

BuildRequires:  libidn-devel, libxml2-devel, GeoIP-devel

BuildRequires:  systemd-units

%if %{SDB}

BuildRequires:  openldap-devel, postgresql-devel, sqlite-devel, mysql-devel

BuildRequires:  libdb-devel

%endif

%if %{test}

BuildRequires:  net-tools

%endif

%if %{GSSTSIG}

BuildRequires:  krb5-devel

%endif

# Needed to regenerate dig.1 manpage

BuildRequires: docbook-style-xsl, libxslt

%description

BIND (Berkeley Internet Name Domain) is an implementation of the DNS

(Domain Name System) protocols. BIND includes a DNS server (named),

which resolves host names to IP addresses; a resolver library

(routines for applications to use when interfacing with DNS); and

tools for verifying that the DNS server is operating properly.

%if %{PKCS11}

%package pkcs11

Summary: Bind with native PKCS#11 functionality for crypto

Group:   System Environment/Daemons

Requires: bind = %{epoch}:%{version}-%{release}

Requires: bind-libs = %{epoch}:%{version}-%{release}

Requires: bind-pkcs11-libs = %{epoch}:%{version}-%{release}

%description pkcs11

This is a version of BIND server built with native PKCS#11 functionality.

It is important to have SoftHSM v2+ installed and some token initialized.

For other supported HSM modules please check the BIND documentation.

This version of BIND binary is supported only in setup with the IPA server.

%package pkcs11-utils

Summary: Bind tools with native PKCS#11 for using DNSSEC

Group:   System Environment/Daemons

Requires: bind-pkcs11-libs = %{epoch}:%{version}-%{release}

%description pkcs11-utils

This is a set of PKCS#11 utilities that when used together create rsa

keys in a PKCS11 keystore. Also utilities for working with DNSSEC

compiled with native PKCS#11 functionality are included.

%package pkcs11-libs

Summary: Bind libraries compiled with native PKCS#11

Group:   System Environment/Daemons

Requires: bind-license = %{epoch}:%{version}-%{release}

Requires: bind-libs = %{epoch}:%{version}-%{release}

%description pkcs11-libs

This is a set of BIND libraries (dns, isc) compiled with native PKCS#11

functionality.

%package pkcs11-devel

Summary: Development files for Bind libraries compiled with native PKCS#11

Group:   System Environment/Daemons

Requires: bind-pkcs11-libs = %{epoch}:%{version}-%{release}

%description pkcs11-devel

This a set of development files for BIND libraries (dns, isc) compiled

with native PKCS#11 functionality.

%endif

%if %{SDB}

%package sdb

Summary: BIND server with database backends and DLZ support

Group:   System Environment/Daemons

Requires: bind

Requires: bind-libs = %{epoch}:%{version}-%{release}

Requires: systemd-units

%description sdb

BIND (Berkeley Internet Name Domain) is an implementation of the DNS

(Domain Name System) protocols. BIND includes a DNS server (named-sdb)

which has compiled-in SDB (Simplified Database Backend) which includes

support for using alternative Zone Databases stored in an LDAP server

(ldapdb), a postgreSQL database (pgsqldb), an sqlite database (sqlitedb),

or in the filesystem (dirdb), in addition to the standard in-memory RBT

(Red Black Tree) zone database. It also includes support for DLZ

(Dynamic Loadable Zones)

%endif

%package libs-lite

Summary:  Libraries for working with the DNS protocol

Group:    Applications/System

Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7

Provides: bind-libbind-devel = 31:9.3.3-4.fc7

Requires: bind-license = %{epoch}:%{version}-%{release}

%description libs-lite

Contains lite version of BIND suite libraries which are used by various

programs to work with DNS protocol.

%package libs

Summary: Libraries used by the BIND DNS packages

Group:    Applications/System

Requires: bind-license = %{epoch}:%{version}-%{release}

%description libs

Contains heavyweight version of BIND suite libraries used by both named DNS

server and utilities in bind-utils package.

%package license

Summary:  License of the BIND DNS suite

Group:    Applications/System

BuildArch:noarch

%description license

Contains license of the BIND DNS suite.

%package utils

Summary: Utilities for querying DNS name servers

Group:   Applications/System

Requires: bind-libs = %{epoch}:%{version}-%{release}

%description utils

Bind-utils contains a collection of utilities for querying DNS (Domain

Name System) name servers to find out information about Internet

hosts. These tools will provide you with the IP addresses for given

host names, as well as other information about registered domains and

network addresses.

You should install bind-utils if you need to get information from DNS name

servers.

%if %{DEVEL}

%package devel

Summary:  Header files and libraries needed for BIND DNS development

Group:    Development/Libraries

Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7

Provides: bind-libbind-devel = 31:9.3.3-4.fc7

Requires: bind-libs = %{epoch}:%{version}-%{release}

%description devel

The bind-devel package contains full version of the header files and libraries

required for development with ISC BIND 9

%endif

%package lite-devel

Summary:  Lite version of header files and libraries needed for BIND DNS development

Group:    Development/Libraries

Requires: bind-libs-lite = %{epoch}:%{version}-%{release}

%description lite-devel

The bind-lite-devel package contains lite version of the header

files and libraries required for development with ISC BIND 9

%package chroot

Summary:        A chroot runtime environment for the ISC BIND DNS server, named(8)

Group:          System Environment/Daemons

Prefix:         %{chroot_prefix}

Requires(post): grep

Requires(preun):grep

Requires:       bind = %{epoch}:%{version}-%{release}

Requires:       systemd-units

%description chroot

This package contains a tree of files which can be used as a

chroot(2) jail for the named(8) program from the BIND package.

Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>

%if %{SDB}

%package sdb-chroot

Summary:        A chroot runtime environment for the ISC BIND DNS server, named-sdb(8)

Group:          System Environment/Daemons

Prefix:         %{chroot_prefix}

Requires:       bind-sdb

Requires:       systemd-units

%description sdb-chroot

This package contains a tree of files which can be used as a

chroot(2) jail for the named-sdb(8) program from the BIND package.

Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>

%endif

%prep

%setup -q -n %{name}-%{VERSION}

# Common patches

%patch5 -p1 -b .nonexec

%patch10 -p1 -b .PIE

%patch16 -p1 -b .redhat_doc

%ifnarch alpha ia64

%patch72 -p1 -b .64bit

%endif

%patch73 -p1 -b .libidn

%patch83 -p1 -b .libidn2

%patch85 -p1 -b .libidn3

%patch87 -p1 -b .parallel

%patch94 -p1 -b .rh461409

%patch102 -p1 -b .rh452060

%patch106 -p0 -b .rh490837

%patch109 -p1 -b .rh478718

%patch110 -p1 -b .rh570851

%patch111 -p1 -b .exportlib

%patch112 -p1 -b .rh645544

%patch119 -p1 -b .rh693982

%patch123 -p1 -b .rh735103

%patch124 -p1 -b .rh726120

%patch127 -p1 -b .forward

%patch130 -p1 -b .libdb

%patch131 -p1 -b .multlib-conflict

%patch137 -p1 -b .rrl

%patch138 -p1 -b .update

%patch139 -p1 -b .journal

%patch140 -p1 -b .send_buffers

%patch141 -p1 -b .leak_35073

%patch142 -p1 -b .rbt_crash

%patch143 -p1 -b .CVE-2014-059

%patch144 -p1 -b .rh1067424

%patch145 -p1 -b .rh1072379

%patch146 -p1 -b .rh1098959

%patch147 -p1 -b .CVE-2014-8500

%patch148 -p1 -b .CVE-2015-1349

%patch149 -p1 -b .rh1215687-limits

%patch150 -p1 -b .external_key

%patch151 -p1 -b .native_pkcs11

# http://cov01.lab.eng.brq.redhat.com/covscanhub/waiving/9377/

%patch153 -p1 -b .coverity_9377

%patch154 -p1 -b .rh1215164

%patch155 -p1 -b .nsupdate_realm

%patch156 -p1 -b .CVE-2015-4620

%patch157 -p1 -b .CVE-2015-5477

%patch158 -p1 -b .sock-maxevents

%patch159 -p1 -b .CVE-2015-5722

%patch160 -p1 -b .CVE-2015-8000

%patch161 -p1 -b .CVE-2015-8704

%patch162 -p1 -b .CVE-2016-1285-CVE-2016-1286

%patch163 -p1 -b .rh1291185

%patch164 -p1 -b .rh1259514

%patch165 -p1 -b .rh1306610-caa

%patch104 -p1 -b .dyndb

# GeoIP support

%patch166 -p1 -b .rh1220594-geoip

# extract the binary testing data

tar -xf %{SOURCE48} -C bin/tests/system/geoip/data

%patch167 -p1 -b .rh1294506

%patch168 -p1 -b .CVE-2016-2776

%patch169 -p1 -b .CVE-2016-8864

%patch170 -p1 -b .CVE-2016-9131

%patch171 -p1 -b .CVE-2016-9147

%patch172 -p1 -b .CVE-2016-9444

%patch173 -p1 -b .rt43779

%patch174 -p1 -b .CVE-2016-2775

%patch175 -p1 -b .CVE-2017-3135

%patch176 -p1 -b .rt44318

%patch177 -p1 -b .rh1392362

%patch178 -p1 -b .coverity2

%patch179 -p1 -b .CVE-2017-3136

%patch180 -p1 -b .CVE-2017-3137

%patch181 -p1 -b .rh1416304

%patch182 -p1 -b .CVE-2017-3142+3143

%patch183 -p1 -b .rh1472862

%patch184 -p1 -b .rh1476013

%patch185 -p1 -b .rh1470637-tests

%patch186 -p1 -b .rh1470637

%patch187 -p1 -b .rh1464850

%patch188 -p1 -b .rh1464850

%patch189 -p1 -b .rh1501531

%patch190 -p1 -b .CVE-2017-3145

# Override upstream builtin keys

cp -fp %{SOURCE29} bind.keys

%if %{PKCS11}

cp -r bin/named{,-pkcs11}

cp -r bin/dnssec{,-pkcs11}

cp -r lib/isc{,-pkcs11}

cp -r lib/dns{,-pkcs11}

cp -r lib/export/isc{,-pkcs11}

cp -r lib/export/dns{,-pkcs11}

%patch152 -p1 -b .dist_pkcs11

%endif

%if %{SDB}

%patch101 -p1 -b .old-api

mkdir bin/named-sdb

cp -r bin/named/* bin/named-sdb

%patch11 -p1 -b .sdbsrc

# SDB ldap

cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named-sdb

# SDB postgreSQL

cp -fp contrib/sdb/pgsql/pgsqldb.[ch] bin/named-sdb

# SDB sqlite

cp -fp contrib/sdb/sqlite/sqlitedb.[ch] bin/named-sdb

# SDB Berkeley DB - needs to be ported to DB4!

#cp -fp contrib/sdb/bdb/bdb.[ch] bin/named_sdb

# SDB dir

cp -fp contrib/sdb/dir/dirdb.[ch] bin/named-sdb

# SDB tools

mkdir -p bin/sdb_tools

cp -fp %{SOURCE30} bin/sdb_tools/ldap2zone.c

cp -fp %{SOURCE7} bin/sdb_tools/Makefile.in

#cp -fp contrib/sdb/bdb/zone2bdb.c bin/sdb_tools

cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/sdb_tools

cp -fp contrib/sdb/pgsql/zonetodb.c bin/sdb_tools

cp -fp contrib/sdb/sqlite/zone2sqlite.c bin/sdb_tools

%patch12 -p1 -b .sdb

%endif

%if %{SDB}

%patch17 -p1 -b .fix_sdb_ldap

%endif

%if %{SDB}

%patch62 -p1 -b .sdb-sqlite-bld

%endif

%patch133 -p1 -b .rh640538

%patch134 -p1 -b .rh669163

%patch135 -p1 -b .libidn4

# Sparc and s390 arches need to use -fPIE

%ifarch sparcv9 sparc64 s390 s390x

for i in bin/named{,-sdb}/{,unix}/Makefile.in; do

  sed -i 's|fpie|fPIE|g' $i

done

%endif

:;

%build

export CFLAGS="$CFLAGS $RPM_OPT_FLAGS"

export CPPFLAGS="$CPPFLAGS -DDIG_SIGCHASE"

export STD_CDEFINES="$CPPFLAGS"

sed -i -e \

's/RELEASEVER=\(.*\)/RELEASEVER=\1-RedHat-%{version}-%{release}/' \

version

libtoolize -c -f; aclocal -I libtool.m4 --force; autoconf -f

%configure \

  --with-libtool \

  --localstatedir=/var \

  --enable-threads \

  --with-geoip \

  --enable-ipv6 \

  --enable-filter-aaaa \

  --enable-rrl \

  --with-pic \

  --disable-static \

  --disable-openssl-version-check \

  --enable-exportlib \

  --with-export-libdir=%{_libdir} \

  --with-export-includedir=%{_includedir} \

  --includedir=%{_includedir}/bind9 \

%if %{PKCS11}

  --enable-native-pkcs11 \

  --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \

%endif

%if %{SDB}

  --with-dlopen=yes \

  --with-dlz-ldap=yes \

  --with-dlz-postgres=yes \

  --with-dlz-mysql=yes \

  --with-dlz-filesystem=yes \

  --with-dlz-bdb=yes \

%endif

%if %{GSSTSIG}

  --with-gssapi=yes \

  --disable-isc-spnego \

%endif

  --enable-fixed-rrset \

  --with-tuning=large \

  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-stylesheets \

;

make %{?_smp_mflags}

# Regenerate dig.1 manpage

pushd bin/dig

make man

popd

pushd bin/python

make man

popd

%if %{test}

%check

if [ "`whoami`" = 'root' ]; then

  set -e

  chmod -R a+rwX .

  pushd bin/tests

  pushd system

  ./ifconfig.sh up

  popd

  make test

  e=$?

  pushd system

  ./ifconfig.sh down

  popd

  popd

  if [ "$e" -ne 0 ]; then

    echo "ERROR: this build of BIND failed 'make test'. Aborting."

    exit $e;

  fi;

else

  echo 'only root can run the tests (they require an ifconfig).'

%endif

%install

rm -rf ${RPM_BUILD_ROOT}

# Build directory hierarchy

mkdir -p ${RPM_BUILD_ROOT}/etc/logrotate.d

mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/bind

mkdir -p ${RPM_BUILD_ROOT}/var/named/{slaves,data,dynamic}

mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/{man1,man5,man8}

mkdir -p ${RPM_BUILD_ROOT}/run/named

mkdir -p ${RPM_BUILD_ROOT}/var/log

#chroot

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/{dev,etc,var,run/named}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/var/{log,named,tmp}

# create symlink as it is on real filesystem

pushd ${RPM_BUILD_ROOT}/%{chroot_prefix}/var

ln -s ../run run

popd

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/{pki/dnssec-keys,named}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_prefix}/%{_libdir}/bind

# these are required to prevent them being erased during upgrade of previous

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/null

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/random

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/dev/zero

touch ${RPM_BUILD_ROOT}/%{chroot_prefix}/etc/named.conf

#end chroot

#sdb-chroot

%if %{SDB}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/{dev,etc,var,run/named}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var/{log,named,tmp}

# create symlink as it is on real filesystem

pushd ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/var

ln -s ../run run

popd

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/{pki/dnssec-keys,named}

mkdir -p ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/%{_libdir}/bind

# these are required to prevent them being erased during upgrade of previous

touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/dev/null

touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/dev/random

touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/dev/zero

touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}/etc/named.conf

%endif

#end sdb-chroot

make DESTDIR=${RPM_BUILD_ROOT} install

# Remove unwanted files

rm -f ${RPM_BUILD_ROOT}/etc/bind.keys

# Systemd unit files

mkdir -p ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}

%if %{SDB}

install -m 644 %{SOURCE39} ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE40} ${RPM_BUILD_ROOT}%{_unitdir}

install -m 644 %{SOURCE45} ${RPM_BUILD_ROOT}%{_unitdir}

%endif

%if %{PKCS11}

install -m 644 %{SOURCE47} ${RPM_BUILD_ROOT}%{_unitdir}

%endif

mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}

install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh

install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh

install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named

mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig

install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named

%if %{SDB}

mkdir -p ${RPM_BUILD_ROOT}/etc/openldap/schema

install -m 644 %{SOURCE8} ${RPM_BUILD_ROOT}/etc/openldap/schema/dnszone.schema

install -m 644 %{SOURCE12} contrib/sdb/pgsql/

%endif

# Install isc/errno2result.h header

install -m 644 lib/isc/unix/errno2result.h ${RPM_BUILD_ROOT}%{_includedir}/isc

# Files required to run test-suite outside of build tree:

cp -fp config.h ${RPM_BUILD_ROOT}/%{_includedir}/bind9

cp -fp lib/dns/include/dns/forward.h ${RPM_BUILD_ROOT}/%{_includedir}/dns

cp -fp lib/isc/unix/include/isc/keyboard.h ${RPM_BUILD_ROOT}/%{_includedir}/isc

# Remove libtool .la files:

find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';

# Remove -devel files out of buildroot if not needed

%if !%{DEVEL}

rm -f ${RPM_BUILD_ROOT}/%{_libdir}/bind9/*so

rm -rf ${RPM_BUILD_ROOT}/%{_includedir}/bind9

rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man1/isc-config.sh.1*

rm -f ${RPM_BUILD_ROOT}/%{_mandir}/man3/lwres*

rm -f ${RPM_BUILD_ROOT}/%{_bindir}/isc-config.sh

%endif

# SDB manpages

%if %{SDB}

install -m 644 %{SOURCE31} ${RPM_BUILD_ROOT}%{_mandir}/man1/ldap2zone.1

install -m 644 %{SOURCE32} ${RPM_BUILD_ROOT}%{_mandir}/man8/named-sdb.8

install -m 644 %{SOURCE33} ${RPM_BUILD_ROOT}%{_mandir}/man1/zonetodb.1

install -m 644 %{SOURCE34} ${RPM_BUILD_ROOT}%{_mandir}/man1/zone2sqlite.1

%endif

# PKCS11 versions manpages

%if %{PKCS11}