diff --git a/SOURCES/macros.nginxmods.in b/SOURCES/macros.nginxmods.in
new file mode 100644
index 0000000..cd0ec45
--- /dev/null
+++ b/SOURCES/macros.nginxmods.in
@@ -0,0 +1,20 @@
+%_nginx_abiversion @@NGINX_ABIVERSION@@
+%_nginx_srcdir @@NGINX_SRCDIR@@
+%_nginx_buildsrcdir nginx-src
+%_nginx_modsrcdir ..
+%_nginx_modbuilddir ../%{_vpath_builddir}
+%nginx_moddir @@NGINX_MODDIR@@
+%nginx_modconfdir @@NGINX_MODCONFDIR@@
+
+%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion}
+
+%nginx_modconfigure(:-:) \\\
+ %undefine _strict_symbol_defs_build \
+ cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \
+ cd "%{_nginx_buildsrcdir}" \
+ nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \
+ ./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\
+ --add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \
+ cd -
+
+%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} modules
diff --git a/SOURCES/nginx.logrotate b/SOURCES/nginx.logrotate
index 353da6e..5ba0ca6 100644
--- a/SOURCES/nginx.logrotate
+++ b/SOURCES/nginx.logrotate
@@ -5,6 +5,7 @@
missingok
notifempty
compress
+ delaycompress
sharedscripts
postrotate
/bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true
diff --git a/SOURCES/nginxmods.attr b/SOURCES/nginxmods.attr
new file mode 100644
index 0000000..a2cebad
--- /dev/null
+++ b/SOURCES/nginxmods.attr
@@ -0,0 +1,2 @@
+%__nginxmods_requires %{_rpmconfigdir}/nginxmods.req
+%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$
diff --git a/SOURCES/nginxmods.req b/SOURCES/nginxmods.req
new file mode 100644
index 0000000..db26431
--- /dev/null
+++ b/SOURCES/nginxmods.req
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+# Generate Requires: nginx(abi) = VERSION
+echo "nginx(abi) = $(rpm --eval '%{_nginx_abiversion}')"
+
+exit 0
diff --git a/SPECS/nginx.spec b/SPECS/nginx.spec
index 7e5bdd5..2a706e4 100644
--- a/SPECS/nginx.spec
+++ b/SPECS/nginx.spec
@@ -16,6 +16,17 @@
%global with_mailcap_mimetypes 1
%endif
+# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/
+%global nginx_abiversion %{version}
+
+%global nginx_moduledir %{_libdir}/nginx/modules
+%global nginx_moduleconfdir %{_datadir}/nginx/modules
+%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release}
+
+# Do not generate provides/requires from nginx sources
+%global __provides_exclude_from ^%{nginx_srcdir}/.*$
+%global __requires_exclude_from ^%{nginx_srcdir}/.*$
+
Name: nginx
Epoch: 1
Version: 1.20.1
@@ -34,6 +45,9 @@ Source11: nginx.logrotate
Source12: nginx.conf
Source13: nginx-upgrade
Source14: nginx-upgrade.8
+Source15: macros.nginxmods.in
+Source16: nginxmods.attr
+Source17: nginxmods.req
Source102: nginx-logo.png
Source103: 404.html
Source104: 50x.html
@@ -87,6 +101,8 @@ BuildRequires: systemd
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
+# For external nginx modules
+Provides: nginx(abi) = %{nginx_abiversion}
%description
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
@@ -126,7 +142,7 @@ directories.
Group: System Environment/Daemons
Summary: Nginx HTTP geoip module
BuildRequires: GeoIP-devel
-Requires: nginx
+Requires: nginx(abi) = %{nginx_abiversion}
Requires: GeoIP
%description mod-http-geoip
@@ -137,7 +153,7 @@ Requires: GeoIP
Group: System Environment/Daemons
Summary: Nginx HTTP image filter module
BuildRequires: gd-devel
-Requires: nginx
+Requires: nginx(abi) = %{nginx_abiversion}
Requires: gd
%description mod-http-image-filter
@@ -151,7 +167,7 @@ BuildRequires: perl-devel
BuildRequires: perl-generators
%endif
BuildRequires: perl(ExtUtils::Embed)
-Requires: nginx
+Requires: nginx(abi) = %{nginx_abiversion}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
Requires: perl(constant)
@@ -162,7 +178,7 @@ Requires: perl(constant)
Group: System Environment/Daemons
Summary: Nginx XSLT module
BuildRequires: libxslt-devel
-Requires: nginx
+Requires: nginx(abi) = %{nginx_abiversion}
%description mod-http-xslt-filter
%{summary}.
@@ -170,7 +186,7 @@ Requires: nginx
%package mod-mail
Group: System Environment/Daemons
Summary: Nginx mail modules
-Requires: nginx
+Requires: nginx(abi) = %{nginx_abiversion}
%description mod-mail
%{summary}.
@@ -178,11 +194,33 @@ Requires: nginx
%package mod-stream
Group: System Environment/Daemons
Summary: Nginx stream modules
-Requires: nginx
+Requires: nginx(abi) = %{nginx_abiversion}
%description mod-stream
%{summary}.
+%package mod-devel
+Summary: Nginx module development files
+Requires: nginx = %{epoch}:%{version}-%{release}
+Requires: make
+Requires: gcc
+Requires: gd-devel
+%if 0%{?with_gperftools}
+Requires: gperftools-devel
+%endif
+%if %{with geoip}
+Requires: GeoIP-devel
+%endif
+Requires: libxslt-devel
+Requires: openssl-devel
+Requires: pcre-devel
+Requires: perl-devel
+Requires: perl(ExtUtils::Embed)
+Requires: zlib-devel
+
+%description mod-devel
+%{summary}.
+
%prep
%setup -q
@@ -200,6 +238,10 @@ sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service
sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf
%endif
+# Prepare sources for installation
+cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src
+mv ../%{name}-%{version}-%{release}-src .
+
%build
# nginx does not utilize a standard configure script. It has its own
@@ -210,7 +252,7 @@ export DESTDIR=%{buildroot}
./configure \
--prefix=%{_datadir}/nginx \
--sbin-path=%{_sbindir}/nginx \
- --modules-path=%{_libdir}/nginx/modules \
+ --modules-path=%{nginx_moduledir} \
--conf-path=%{_sysconfdir}/nginx/nginx.conf \
--error-log-path=%{_localstatedir}/log/nginx/error.log \
--http-log-path=%{_localstatedir}/log/nginx/access.log \
@@ -291,8 +333,8 @@ install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp
install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html
-install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/modules
-install -p -d -m 0755 %{buildroot}%{_libdir}/nginx/modules
+install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir}
+install -p -d -m 0755 %{buildroot}%{nginx_moduledir}
install -p -m 0644 ./nginx.conf \
%{buildroot}%{_sysconfdir}/nginx
@@ -328,19 +370,35 @@ for i in ftdetect indent syntax; do
done
%if %{with geoip}
-echo 'load_module "%{_libdir}/nginx/modules/ngx_http_geoip_module.so";' \
- > %{buildroot}%{_datadir}/nginx/modules/mod-http-geoip.conf
+echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \
+ > %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf
%endif
-echo 'load_module "%{_libdir}/nginx/modules/ngx_http_image_filter_module.so";' \
- > %{buildroot}%{_datadir}/nginx/modules/mod-http-image-filter.conf
-echo 'load_module "%{_libdir}/nginx/modules/ngx_http_perl_module.so";' \
- > %{buildroot}%{_datadir}/nginx/modules/mod-http-perl.conf
-echo 'load_module "%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so";' \
- > %{buildroot}%{_datadir}/nginx/modules/mod-http-xslt-filter.conf
-echo 'load_module "%{_libdir}/nginx/modules/ngx_mail_module.so";' \
- > %{buildroot}%{_datadir}/nginx/modules/mod-mail.conf
-echo 'load_module "%{_libdir}/nginx/modules/ngx_stream_module.so";' \
- > %{buildroot}%{_datadir}/nginx/modules/mod-stream.conf
+echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \
+ > %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf
+echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \
+ > %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf
+echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \
+ > %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf
+echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \
+ > %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf
+echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \
+ > %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf
+
+# Install files for supporting nginx module builds
+## Install source files
+mkdir -p %{buildroot}%{_usrsrc}
+mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir}
+## Install rpm macros
+mkdir -p %{buildroot}%{_rpmmacrodir}
+sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \
+ -e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \
+ -e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \
+ -e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \
+ %{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods
+## Install dependency generator
+install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16}
+install -Dpm0755 -t %{buildroot}%{_rpmconfigdir} %{SOURCE17}
+
%pre filesystem
getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user}
@@ -430,7 +488,8 @@ fi
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/log/nginx
-%dir %{_libdir}/nginx/modules
+%dir %{nginx_moduledir}
+%dir %{nginx_moduleconfdir}
%files all-modules
@@ -445,38 +504,51 @@ fi
%if %{with geoip}
%files mod-http-geoip
-%{_datadir}/nginx/modules/mod-http-geoip.conf
-%{_libdir}/nginx/modules/ngx_http_geoip_module.so
+%{nginx_moduleconfdir}/mod-http-geoip.conf
+%{nginx_moduledir}/ngx_http_geoip_module.so
%endif
%files mod-http-image-filter
-%{_datadir}/nginx/modules/mod-http-image-filter.conf
-%{_libdir}/nginx/modules/ngx_http_image_filter_module.so
+%{nginx_moduleconfdir}/mod-http-image-filter.conf
+%{nginx_moduledir}/ngx_http_image_filter_module.so
%files mod-http-perl
-%{_datadir}/nginx/modules/mod-http-perl.conf
-%{_libdir}/nginx/modules/ngx_http_perl_module.so
+%{nginx_moduleconfdir}/mod-http-perl.conf
+%{nginx_moduledir}/ngx_http_perl_module.so
%dir %{perl_vendorarch}/auto/nginx
%{perl_vendorarch}/nginx.pm
%{perl_vendorarch}/auto/nginx/nginx.so
%files mod-http-xslt-filter
-%{_datadir}/nginx/modules/mod-http-xslt-filter.conf
-%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so
+%{nginx_moduleconfdir}/mod-http-xslt-filter.conf
+%{nginx_moduledir}/ngx_http_xslt_filter_module.so
%files mod-mail
-%{_datadir}/nginx/modules/mod-mail.conf
-%{_libdir}/nginx/modules/ngx_mail_module.so
+%{nginx_moduleconfdir}/mod-mail.conf
+%{nginx_moduledir}/ngx_mail_module.so
%files mod-stream
-%{_datadir}/nginx/modules/mod-stream.conf
-%{_libdir}/nginx/modules/ngx_stream_module.so
+%{nginx_moduleconfdir}/mod-stream.conf
+%{nginx_moduledir}/ngx_stream_module.so
+%files mod-devel
+%{_rpmmacrodir}/macros.nginxmods
+%{_fileattrsdir}/nginxmods.attr
+%{_rpmconfigdir}/nginxmods.req
+%{nginx_srcdir}/
+
%changelog
* Tue Dec 21 2021 Joe Orton <jorton@redhat.com> - 1:1.20.1-1
- rebase to 1.20.1 (addressing CVE-2021-23017)
+* Wed Dec 1 2021 Joe Orton <jorton@redhat.com> - 1:1.20.0-4
+- add delaycompress to logrotate config (#2015243)
+
+* Fri Sep 10 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-3
+- Add -mod-devel subpackage for building external nginx modules (Neal Gompa)
+ Resolves: #1991787
+
* Fri Aug 20 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-2
- Resolves: #1991796 - build nginx with --with-compat