|
 |
0e3a23 |
%global _hardened_build 1
|
|
|
0e3a23 |
|
|
|
9d5aef |
Summary: NetworkManager plugin to update/reconfigure DNSSEC resolving
|
|
|
9d5aef |
Name: dnssec-trigger
|
|
|
9d5aef |
Version: 0.11
|
|
|
0e3a23 |
Release: 22%{?dist}
|
|
|
9d5aef |
License: BSD
|
|
|
9d5aef |
Url: http://www.nlnetlabs.nl/downloads/dnssec-trigger/
|
|
|
9d5aef |
Source: http://www.nlnetlabs.nl/downloads/dnssec-trigger/%{name}-%{version}.tar.gz
|
|
|
9d5aef |
Source1:dnssec-triggerd.service
|
|
|
9d5aef |
Source2: dnssec-triggerd-keygen.service
|
|
|
9d5aef |
Source3: dnssec-trigger.conf
|
|
|
0c84e1 |
# Latest NM dispatcher Python hook from upstream SVN
|
|
|
0c84e1 |
# http://www.nlnetlabs.nl/svn/dnssec-trigger/trunk/contrib/01-dnssec-trigger-hook-new_nm
|
|
|
9d5aef |
Source4: 01-dnssec-trigger-hook
|
|
|
9d5aef |
Source5: dnssec-trigger.tmpfiles.d
|
|
|
0c84e1 |
Source6: dnssec-triggerd-resolvconf-handle.sh
|
|
|
0c84e1 |
Source7: dnssec-triggerd-resolvconf-handle.service
|
|
|
0c84e1 |
# http://www.nlnetlabs.nl/svn/dnssec-trigger/trunk/contrib/dnssec.conf.sample
|
|
|
0c84e1 |
Source8: dnssec.conf.sample
|
|
|
0c84e1 |
Patch1: dnssec-trigger-0.11-improve_dialog_texts.patch
|
|
|
9d5aef |
Patch2: dnssec-trigger-842455.patch
|
|
|
9d5aef |
# https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=489
|
|
|
9d5aef |
Patch3: dnssec-trigger-0.11-nl489.patch
|
|
|
9d5aef |
Patch4: dnssec-trigger-0.11-coverity_scan.patch
|
|
|
0e3a23 |
Patch5: dnssec-trigger-rh1254473.patch
|
|
|
9d5aef |
|
|
|
9d5aef |
Requires(postun): initscripts
|
|
|
0c84e1 |
Requires: ldns >= 1.6.10, NetworkManager, NetworkManager-glib, unbound, xdg-utils
|
|
|
9d5aef |
Requires(pre): shadow-utils
|
|
|
9d5aef |
BuildRequires: desktop-file-utils systemd-units, openssl-devel, ldns-devel
|
|
|
9d5aef |
BuildRequires: gtk2-devel, NetworkManager-devel
|
|
|
9d5aef |
|
|
|
0c84e1 |
BuildRequires: systemd
|
|
|
0c84e1 |
Requires(post): systemd
|
|
|
0c84e1 |
Requires(preun): systemd
|
|
|
0c84e1 |
Requires(postun): systemd
|
|
|
9d5aef |
|
|
|
9d5aef |
%description
|
|
|
9d5aef |
dnssec-trigger reconfigures the local unbound DNS server. This unbound DNS
|
|
|
9d5aef |
server performs DNSSEC validation, but dnssec-trigger will signal it to
|
|
|
9d5aef |
use the DHCP obtained forwarders if possible, and fallback to doing its
|
|
|
9d5aef |
own AUTH queries if that fails, and if that fails prompt the user via
|
|
|
9d5aef |
dnssec-trigger-applet the option to go with insecure DNS only.
|
|
|
9d5aef |
|
|
|
9d5aef |
%prep
|
|
|
9d5aef |
%setup -q
|
|
|
9d5aef |
# Fixup the name to not include "panel" in the menu item or name
|
|
|
9d5aef |
sed -i "s/ Panel//" panel/dnssec-trigger-panel.desktop.in
|
|
|
9d5aef |
sed -i "s/-panel//" panel/dnssec-trigger-panel.desktop.in
|
|
|
9d5aef |
# change some text in the popups
|
|
|
9d5aef |
%patch1 -p1
|
|
|
9d5aef |
%patch2 -p1
|
|
|
9d5aef |
%patch3 -p1
|
|
|
9d5aef |
%patch4 -p1
|
|
|
0e3a23 |
%patch5 -p1
|
|
|
9d5aef |
|
|
|
9d5aef |
%build
|
|
|
9d5aef |
%configure --with-keydir=/etc/dnssec-trigger
|
|
|
9d5aef |
%{__make} %{?_smp_mflags}
|
|
|
9d5aef |
|
|
|
9d5aef |
%install
|
|
|
9d5aef |
rm -rf %{buildroot}
|
|
|
9d5aef |
%{__make} DESTDIR=%{buildroot} install
|
|
|
9d5aef |
install -d 0755 %{buildroot}%{_unitdir}
|
|
|
9d5aef |
install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/%{name}d.service
|
|
|
9d5aef |
install -m 0644 %{SOURCE2} %{buildroot}%{_unitdir}/%{name}d-keygen.service
|
|
|
9d5aef |
install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/
|
|
|
9d5aef |
|
|
|
0c84e1 |
mkdir -p %{buildroot}%{_libexecdir}
|
|
|
0c84e1 |
install -m 0755 %{SOURCE6} %{buildroot}%{_libexecdir}/%{name}d-resolvconf-handle.sh
|
|
|
0c84e1 |
install -m 0644 %{SOURCE7} %{buildroot}%{_unitdir}/%{name}d-resolvconf-handle.service
|
|
|
0c84e1 |
|
|
|
9d5aef |
desktop-file-install --dir=%{buildroot}%{_datadir}/applications dnssec-trigger-panel.desktop
|
|
|
9d5aef |
|
|
|
0c84e1 |
# overwrite the stock NM hook since there is new one in upstream SVN that is not used by default
|
|
|
0c84e1 |
install -p -m 0755 %{SOURCE4} %{buildroot}/%{_sysconfdir}/NetworkManager/dispatcher.d/01-dnssec-trigger-hook
|
|
|
0c84e1 |
#install the /etc/dnssec.conf configuration file
|
|
|
0c84e1 |
install -p -m 0644 %{SOURCE8} %{buildroot}/%{_sysconfdir}/dnssec.conf
|
|
|
9d5aef |
|
|
|
9d5aef |
# install the configuration for /var/run/dnssec-trigger into tmpfiles.d dir
|
|
|
9d5aef |
mkdir -p %{buildroot}%{_tmpfilesdir}
|
|
|
9d5aef |
install -m 644 %{SOURCE5} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf
|
|
|
9d5aef |
# we must create the /var/run/dnssec-trigger directory
|
|
|
9d5aef |
mkdir -p %{buildroot}%{_localstatedir}/run
|
|
|
9d5aef |
install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name}
|
|
|
9d5aef |
|
|
|
9d5aef |
# supress the panel name everywhere including the gnome3 panel at the bottom
|
|
|
9d5aef |
ln -s dnssec-trigger-panel %{buildroot}%{_bindir}/dnssec-trigger
|
|
|
9d5aef |
|
|
|
9d5aef |
# Make dnssec-trigger.8 manpage available under names of all dnssec-trigger-*
|
|
|
9d5aef |
# executables
|
|
|
9d5aef |
for all in dnssec-trigger-control dnssec-trigger-control-setup dnssec-triggerd; do
|
|
|
9d5aef |
ln -s %{_mandir}/man8/dnssec-trigger.8 %{buildroot}/%{_mandir}/man8/"$all".8
|
|
|
9d5aef |
done
|
|
|
9d5aef |
ln -s %{_mandir}/man8/dnssec-trigger.8 %{buildroot}/%{_mandir}/man8/dnssec-trigger.conf.8
|
|
|
9d5aef |
|
|
|
9d5aef |
%clean
|
|
|
9d5aef |
rm -rf ${RPM_BUILD_ROOT}
|
|
|
9d5aef |
|
|
|
9d5aef |
%files
|
|
|
9d5aef |
%defattr(-,root,root,-)
|
|
|
9d5aef |
%doc README LICENSE
|
|
|
9d5aef |
%{_unitdir}/%{name}d.service
|
|
|
9d5aef |
%{_unitdir}/%{name}d-keygen.service
|
|
|
0c84e1 |
%{_unitdir}/%{name}d-resolvconf-handle.service
|
|
|
9d5aef |
|
|
|
9d5aef |
%attr(0755,root,root) %dir %{_sysconfdir}/%{name}
|
|
|
9d5aef |
%attr(0755,root,root) %{_sysconfdir}/NetworkManager/dispatcher.d/01-dnssec-trigger-hook
|
|
|
0c84e1 |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/dnssec.conf
|
|
|
9d5aef |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dnssec-trigger.conf
|
|
|
9d5aef |
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/xdg/autostart/dnssec-trigger-panel.desktop
|
|
|
9d5aef |
%dir %{_localstatedir}/run/%{name}
|
|
|
9d5aef |
%{_tmpfilesdir}/%{name}.conf
|
|
|
9d5aef |
%{_bindir}/dnssec-trigger-panel
|
|
|
9d5aef |
%{_bindir}/dnssec-trigger
|
|
|
9d5aef |
%{_sbindir}/dnssec-trigger*
|
|
|
0c84e1 |
%{_libexecdir}/%{name}d-resolvconf-handle.sh
|
|
|
9d5aef |
%{_mandir}/*/*
|
|
|
9d5aef |
%attr(0755,root,root) %dir %{_datadir}/%{name}
|
|
|
9d5aef |
%attr(0644,root,root) %{_datadir}/%{name}/*
|
|
|
9d5aef |
%attr(0644,root,root) %{_datadir}/applications/dnssec-trigger-panel.desktop
|
|
|
9d5aef |
|
|
|
9d5aef |
|
|
|
9d5aef |
%post
|
|
|
0c84e1 |
%systemd_post %{name}d.service
|
|
|
9d5aef |
|
|
|
9d5aef |
|
|
|
9d5aef |
%preun
|
|
|
0c84e1 |
%systemd_preun %{name}d.service
|
|
|
9d5aef |
if [ "$1" -eq "0" ] ; then
|
|
|
9d5aef |
# dnssec-triggerd makes /etc/resolv.conf immutable, undo that on removal
|
|
|
9d5aef |
chattr -i /etc/resolv.conf
|
|
|
9d5aef |
fi
|
|
|
9d5aef |
|
|
|
0c84e1 |
%postun
|
|
|
0c84e1 |
%systemd_postun_with_restart %{name}d.service
|
|
|
0c84e1 |
|
|
|
9d5aef |
|
|
|
9d5aef |
%changelog
|
|
|
0e3a23 |
* Wed May 18 2016 Tomas Hozza <thozza@redhat.com> - 0.11-22
|
|
|
0e3a23 |
- Improved text in the GUI panel in Hotspot sign-on mode (#1254473)
|
|
|
0e3a23 |
- Build all binaries with PIE hardening (#1092526)
|
|
|
0e3a23 |
|
|
|
0c84e1 |
* Tue Feb 11 2014 Tomas Hozza <thozza@redhat.com> - 0.11-21
|
|
|
0c84e1 |
- handle IndexError exception in NM script until NM provides better API (#1063735)
|
|
|
0c84e1 |
- restart NM when stopping dnssec-trigger daemon instead of handling
|
|
|
0c84e1 |
resolv.conf by ourself. (#1061370)
|
|
|
0c84e1 |
|
|
|
0c84e1 |
* Wed Jan 29 2014 Tomas Hozza <thozza@redhat.com> - 0.11-20
|
|
|
0c84e1 |
- use systemd macros instead of directly using systemctl (#1058773)
|
|
|
0c84e1 |
- Replace the "Fedora /EPEL" comment in dnssec-trigger.conf (#1055949)
|
|
|
0c84e1 |
- Use more newer and more advanced dispatcher script (#1034813)
|
|
|
0c84e1 |
|
|
|
0c84e1 |
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 0.11-19
|
|
|
0c84e1 |
- Mass rebuild 2014-01-24
|
|
|
0c84e1 |
|
|
|
0c84e1 |
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 0.11-18
|
|
|
0c84e1 |
- Mass rebuild 2013-12-27
|
|
|
0c84e1 |
|
|
|
0c84e1 |
* Tue Nov 26 2013 Tomas Hozza <thozza@redhat.com> - 0.11-17
|
|
|
0c84e1 |
- Add script to backup and restore resolv.conf on dnssec-trigger start/stop (#1031648)
|
|
|
0c84e1 |
|
|
|
0c84e1 |
* Mon Nov 18 2013 Tomas Hozza <thozza@redhat.com> - 0.11-16
|
|
|
0c84e1 |
- Improve GUI dialogs texts (#1029889)
|
|
|
0c84e1 |
|
|
|
0c84e1 |
* Mon Nov 11 2013 Tomas Hozza <thozza@redhat.com> - 0.11-15
|
|
|
0c84e1 |
- Fix the dispatcher script to use new nmcli syntax (#1028003)
|
|
|
0c84e1 |
|
|
|
9d5aef |
* Mon Aug 26 2013 Tomas Hozza <thozza@redhat.com> - 0.11-14
|
|
|
9d5aef |
- Fix errors found by static analysis of source
|
|
|
9d5aef |
|
|
|
9d5aef |
* Fri Aug 09 2013 Tomas Hozza <thozza@redhat.com> - 0.11-13
|
|
|
9d5aef |
- Use improved NM dispatcher script from upstream (#980036)
|
|
|
9d5aef |
- Added tmpfiles.d config due to improved NM dispatcher script
|
|
|
9d5aef |
|
|
|
9d5aef |
* Mon Jul 22 2013 Tomas Hozza <thozza@redhat.com> - 0.11-12
|
|
|
9d5aef |
- Removed Fedora infrastructure from dnssec-trigger.conf (#955149)
|
|
|
9d5aef |
|
|
|
9d5aef |
* Mon Mar 04 2013 Adam Tkac <atkac redhat com> - 0.11-11
|
|
|
9d5aef |
- link dnssec-trigger.conf.8 to dnssec-trigger.8
|
|
|
9d5aef |
- build dnssec-triggerd with full RELRO
|
|
|
9d5aef |
|
|
|
9d5aef |
* Mon Mar 04 2013 Adam Tkac <atkac redhat com> - 0.11-10
|
|
|
9d5aef |
- remove deprecated "Application" keyword from desktop file
|
|
|
9d5aef |
|
|
|
9d5aef |
* Mon Mar 04 2013 Adam Tkac <atkac redhat com> - 0.11-9
|
|
|
9d5aef |
- install various dnssec-trigger-* symlinks to dnssec-trigger.8 manpage
|
|
|
9d5aef |
|
|
|
9d5aef |
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.11-8
|
|
|
9d5aef |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
|
|
9d5aef |
|
|
|
9d5aef |
* Tue Jan 08 2013 Paul Wouters <pwouters@redhat.com> - 0.11-7
|
|
|
9d5aef |
- Use full path for systemd (rhbz#842455)
|
|
|
9d5aef |
|
|
|
9d5aef |
* Tue Jul 24 2012 Paul Wouters <pwouters@redhat.com> - 0.11-6
|
|
|
9d5aef |
- Patched daemon to remove immutable attr (rhbz#842455) as the
|
|
|
9d5aef |
systemd ExecStopPost= target does not seem to work
|
|
|
9d5aef |
|
|
|
9d5aef |
* Tue Jul 24 2012 Paul Wouters <pwouters@redhat.com> - 0.11-5
|
|
|
9d5aef |
- On service stop, remove immutable attr from resolv.conf (rhbz#842455)
|
|
|
9d5aef |
|
|
|
9d5aef |
* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.11-4
|
|
|
9d5aef |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
|
|
|
9d5aef |
|
|
|
9d5aef |
* Thu Jun 28 2012 Paul Wouters <pwouters@redhat.com> - 0.11-3
|
|
|
9d5aef |
- Fix DHCP hook for f17+ version of nmcli (rhbz#835298)
|
|
|
9d5aef |
|
|
|
9d5aef |
* Sun Jun 17 2012 Paul Wouters <pwouters@redhat.com> - 0.11-2
|
|
|
9d5aef |
- Small textual changes to some popup windows
|
|
|
9d5aef |
|
|
|
9d5aef |
* Fri Jun 15 2012 Paul Wouters <pwouters@redhat.com> - 0.11-1
|
|
|
9d5aef |
- Updated to 0.11
|
|
|
9d5aef |
- http Hotspot detection via fedoraproject.org/static/hotspot.html
|
|
|
9d5aef |
- http Hotspot Login page via uses hotspot-nocache.fedoraproject.org
|
|
|
9d5aef |
|
|
|
9d5aef |
* Thu Feb 23 2012 Paul Wouters <pwouters@redhat.com> - 0.10-4
|
|
|
9d5aef |
- Require: unbound
|
|
|
9d5aef |
|
|
|
9d5aef |
* Wed Feb 22 2012 Paul Wouters <pwouters@redhat.com> - 0.10-3
|
|
|
9d5aef |
- Fix the systemd startup to require unbound
|
|
|
9d5aef |
- dnssec-triggerd no longer forks, giving systemd more control
|
|
|
9d5aef |
- Fire NM dispatcher in ExecStartPost of dnssec-triggerd.service
|
|
|
9d5aef |
- Fix tcp80 entries in dnssec-triggerd.conf
|
|
|
9d5aef |
- symlink dnssec-trigger-panel to dnssec-trigger to supress the
|
|
|
9d5aef |
"-panel" in the applet name shown in gnome3
|
|
|
9d5aef |
|
|
|
9d5aef |
|
|
|
9d5aef |
* Wed Feb 22 2012 Paul Wouters <pwouters@redhat.com> - 0.10-2
|
|
|
9d5aef |
- The NM hook was not modified at the right time during build
|
|
|
9d5aef |
|
|
|
9d5aef |
* Wed Feb 22 2012 Paul Wouters <pwouters@redhat.com> - 0.10-1
|
|
|
9d5aef |
- Updated to 0.10
|
|
|
9d5aef |
- The NM hook lacks /usr/sbin in path, resulting in empty resolv.conf on hotspot
|
|
|
9d5aef |
|
|
|
9d5aef |
* Wed Feb 08 2012 Paul Wouters <pwouters@redhat.com> - 0.9-4
|
|
|
9d5aef |
- Updated tls443 / tls80 resolver instances supplied by Fedora Hosted
|
|
|
9d5aef |
|
|
|
9d5aef |
* Mon Feb 06 2012 Paul Wouters <pwouters@redhat.com> - 0.9-3
|
|
|
9d5aef |
- Convert from SysV to systemd for initial Fedora release
|
|
|
9d5aef |
- Moved configs and pem files to /etc/dnssec-trigger/
|
|
|
9d5aef |
- No more /var/run/dnssec-triggerd/
|
|
|
9d5aef |
- Fix Build-requires
|
|
|
9d5aef |
- Added commented tls443 port80 entries of pwouters resolvers
|
|
|
9d5aef |
- On uninstall ensure there is no immutable bit on /etc/resolv.conf
|
|
|
9d5aef |
|
|
|
9d5aef |
* Sat Jan 07 2012 Paul Wouters <paul@xelerance.com> - 0.9-2
|
|
|
9d5aef |
- Added LICENCE to doc section
|
|
|
9d5aef |
|
|
|
9d5aef |
* Mon Dec 19 2011 Paul Wouters <paul@xelerance.com> - 0.9-1
|
|
|
9d5aef |
- Upgraded to 0.9
|
|
|
9d5aef |
|
|
|
9d5aef |
* Fri Oct 28 2011 Paul Wouters <paul@xelerance.com> - 0.7-1
|
|
|
9d5aef |
- Upgraded to 0.7
|
|
|
9d5aef |
|
|
|
9d5aef |
* Fri Sep 23 2011 Paul Wouters <paul@xelerance.com> - 0.4-1
|
|
|
9d5aef |
- Upgraded to 0.4
|
|
|
9d5aef |
|
|
|
9d5aef |
* Sat Sep 17 2011 Paul Wouters <paul@xelerance.com> - 0.3-5
|
|
|
9d5aef |
- Start 01-dnssec-trigger-hook in daemon start
|
|
|
9d5aef |
- Ensure dnssec-triggerd starts after NetworkManager
|
|
|
9d5aef |
|
|
|
9d5aef |
* Fri Sep 16 2011 Paul Wouters <paul@xelerance.com> - 0.3-4
|
|
|
9d5aef |
- Initial package
|