source: projects/specs/trunk/k/krb5/krb5-vl.spec @ 12508

Revision 12508, 74.3 KB checked in by tomop, 3 years ago (diff)

updated 14 packages

cups-2.3.3-1

firefox-78.5.0-1

golang-1.15.5-1

kernel-5.4.80-1

krb5-1.18.3-1

mariadb-10.5.8-1

nsd-4.3.4-1

php74-7.4.13-1

postfix-3.5.8-1

postgresql-13.1-1

thunderbird-78.5.1-1

tmux-3.1c-1

unbound-1.13.0-1

webkitgtk4-2.30.3-1

Line 
1%bcond_with systemd
2
3%bcond_with test
4%if %{with test}
5BuildRequires: socket_wrapper
6%endif
7
8%define build_compat32 %{?_with_compat32:1}%{!?_with_compat32:0}
9
10%global WITH_LDAP 1
11%global WITH_OPENSSL 1
12%global WITH_DIRSRV 1
13
14%global WITH_SYSVERTO 0
15
16# This'll be pulled out at some point.
17%define build_static 0
18
19# Set this so that find-lang.sh will recognize the .po files.
20%global gettext_domain mit-krb5
21
22Summary: The Kerberos network authentication system
23Summary(ja): Kerberos ネットワーク認証システム
24Name: krb5
25Version: 1.18.3
26Release: 1%{_dist_release}%{?with_systemd:.systemd}
27Group: system
28Vendor: Project Vine
29Distribution: Vine Linux
30
31License: MIT
32URL: http://web.mit.edu/kerberos/www/
33
34# Maybe we should explode from the now-available-to-everybody tarball instead?
35# http://web.mit.edu/kerberos/dist/krb5/1.11/krb5-1.11.1-signed.tar
36%global  shortver %(echo "%{version}" | perl -p -e 's/^([0-9]+\.[0-9]+).*$/\\1/')
37Source0: https://web.mit.edu/kerberos/dist/krb5/%{shortver}/krb5-%{version}.tar.gz
38# Source1: krb5-%{version}.tar.gz.asc
39
40Source2: kpropd.init
41Source4: kadmind.init
42Source5: krb5kdc.init
43Source6: krb5.conf
44Source10: kdc.conf
45Source11: kadm5.acl
46Source19: krb5kdc.sysconfig
47Source20: kadmin.sysconfig
48Source21: kprop.sysconfig
49Source29: ksu.pamd
50Source30: kerberos-iv.portreserve
51Source31: kerberos-adm.portreserve
52Source32: krb5_prop.portreserve
53Source33: krb5kdc.logrotate
54Source34: kadmind.logrotate
55
56# Carry this locally until it's available in a packaged form.
57Source100: noport.c
58
59Source200: kprop.service
60Source201: kadmin.service
61Source202: krb5kdc.service
62Source203: krb5-krb5kdc.conf
63
64Patch0: downstream-ksu-pam-integration.patch
65Patch1: downstream-SELinux-integration.patch
66Patch2: downstream-Adjust-build-configuration.patch
67Patch3: downstream-netlib-and-dns.patch
68Patch4: downstream-fix-debuginfo-with-y.tab.c.patch
69Patch5: downstream-Remove-3des-support.patch
70#Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch
71Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch
72#Patch8: Fix-AS-REQ-checking-of-KDB-modified-indicators.patch
73Patch9: Allow-certauth-modules-to-set-hw-authent-flag.patch
74#Patch10: Allow-deletion-of-require_auth-with-LDAP-KDB.patch
75Patch11: Refresh-manually-acquired-creds-from-client-keytab.patch
76#Patch12: Document-client-keytab-usage.patch
77Patch13: Add-finalization-safety-check-to-com_err.patch
78#Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch
79Patch15: Correctly-import-service-GSS-host-based-name.patch
80Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch
81Patch17: Pass-gss_localname-through-SPNEGO.patch
82Patch18: Omit-KDC-indicator-check-for-S4U2Self-requests.patch
83Patch19: Fix-typo-in-in-in-the-ksu-man-page.patch
84Patch21: Replace-gssrpc-tests-with-a-Python-script.patch
85Patch22: Default-dns_canonicalize_hostname-to-fallback.patch
86Patch23: Remove-resolver-test-utility.patch
87Patch24: Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch
88Patch25: Improve-negoex_parse_token-code-hygiene.patch
89Patch26: Refactor-krb5-GSS-checksum-handling.patch
90Patch27: Implement-GSS_C_CHANNEL_BOUND_FLAG.patch
91Patch28: Implement-KERB_AP_OPTIONS_CBT-server-side.patch
92Patch29: Add-client_aware_channel_bindings-option.patch
93Patch30: Pass-channel-bindings-through-SPNEGO.patch
94Patch31: Add-channel-bindings-tests.patch
95Patch32: Use-two-queues-for-concurrent-t_otp.py-daemons.patch
96Patch34: Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch
97Patch35: Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch
98Patch37: Add-three-kvno-options-from-Heimdal-kgetcred.patch
99Patch39: Improve-KDC-alias-checking-for-S4U-requests.patch
100Patch40: Adjust-KDC-alias-helper-function-contract.patch
101Patch41: Allow-aliases-when-matching-U2U-second-ticket.patch
102Patch42: Refactor-KDC-authdata-list-management-helpers.patch
103Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch
104Patch44: Minimize-usage-of-tgs_server-in-KDC.patch
105Patch45: Fix-minor-static-analysis-defects.patch
106
107# Vine patch(es)
108
109BuildRoot: %{_tmppath}/%{name}-%{version}-root
110
111BuildRequires: autoconf, bison, flex, gawk
112# BuildRequires: libcom_err-devel, libss-devel
113BuildRequires: e2fsprogs-devel
114# BuildRequires: gzip, ncurses-devel, rsh, texinfo, texinfo-tex, tar
115BuildRequires: gzip, ncurses-devel, texinfo, tar, git
116BuildRequires: python3-sphinx
117# BuildRequires: texlive
118# BuildRequires: texlive-latexrecommended
119# BuildRequires: texlive-fontsrecommended
120BuildRequires: keyutils
121BuildRequires: keyutils-libs-devel
122# BuildRequires: libselinux-devel
123BuildRequires: pam-devel
124BuildRequires: tcl-devel
125%if 0%{?with_systemd}
126BuildRequires: systemd-units
127%endif
128
129%if %{WITH_LDAP}
130BuildRequires: openldap-devel
131%endif
132%if %{WITH_OPENSSL}
133BuildRequires: openssl-devel >= 1.0.0
134%endif
135%if %{WITH_SYSVERTO}
136BuildRequires: libverto-devel
137%endif
138
139%description
140Kerberos V5 is a trusted-third-party network authentication system,
141which can improve your network's security by eliminating the insecure
142practice of cleartext passwords.
143
144
145%package devel
146Summary: Development files needed to compile Kerberos 5 programs
147Group: programming
148Requires: %{name}-libs = %{version}-%{release}
149# Requires: keyutils-libs-devel, libselinux-devel
150Requires: keyutils-libs-devel
151Requires: e2fsprogs-devel
152%if %{WITH_SYSVERTO}
153Requires: libverto-devel
154%endif
155
156%description devel
157Kerberos is a network authentication system. The krb5-devel package
158contains the header files and libraries needed for compiling Kerberos
1595 programs. If you want to develop Kerberos-aware programs, you need
160to install this package.
161
162
163%package libs
164Summary: The shared libraries used by Kerberos 5
165Group: system
166
167%description libs
168Kerberos is a network authentication system. The krb5-libs package
169contains the shared libraries needed by Kerberos 5. If you are using
170Kerberos, you need to install this package.
171
172
173%package server
174Group: servers
175Summary: The KDC and related programs for Kerberos 5
176Requires: %{name}-libs = %{version}-%{release}
177%if %{WITH_SYSVERTO}
178# for run-time, and for parts of the test suite
179BuildRequires: libverto-module-base
180Requires: libverto-module-base
181%endif
182Requires(preun): /sbin/install-info
183Requires(post): /sbin/install-info
184%if 0%{?with_systemd}
185Requires(post): systemd
186Requires(preun): systemd
187Requires(postun): systemd
188%else
189# we need 'status -l' to work, and that option was added in 8.91.3-1vl6
190# portreserve is used by init scripts for kadmind, kpropd, and krb5kdc
191Requires: portreserve
192Requires: initscripts >= 8.91.3-1
193Requires(post): chkconfig
194Requires(preun): chkconfig, initscripts
195Requires(postun): initscripts
196%endif
197
198%description server
199Kerberos is a network authentication system. The krb5-server package
200contains the programs that must be installed on a Kerberos 5 key
201distribution center (KDC).  If you are installing a Kerberos 5 KDC,
202you need to install this package (in other words, most people should
203NOT install this package).
204
205
206%package server-ldap
207Group: servers
208Summary: The LDAP storage plugin for the Kerberos 5 KDC
209Requires: %{name}-server = %{version}-%{release}
210Requires: %{name}-libs = %{version}-%{release}
211
212%description server-ldap
213Kerberos is a network authentication system. The krb5-server package
214contains the programs that must be installed on a Kerberos 5 key
215distribution center (KDC).  If you are installing a Kerberos 5 KDC,
216and you wish to use a directory server to store the data for your
217realm, you need to install this package.
218
219
220%package workstation
221Summary: Kerberos 5 programs for use on workstations
222Group: system
223Requires: %{name}-libs = %{version}-%{release}
224Requires(post): /sbin/install-info
225Requires(preun): /sbin/install-info
226# mktemp is used by krb5-send-pr
227Requires: mktemp
228Obsoletes: krb5-workstation-clients < %{version}-%{release}
229Obsoletes: krb5-workstation-servers < %{version}-%{release}
230
231%description workstation
232Kerberos is a network authentication system. The krb5-workstation
233package contains the basic Kerberos programs (kinit, klist, kdestroy,
234kpasswd). If your network uses Kerberos, this package should be
235installed on every workstation.
236
237
238%package pkinit-openssl
239Summary: The PKINIT module for Kerberos 5
240Group: system
241Requires: %{name}-libs = %{version}-%{release}
242
243%description pkinit-openssl
244Kerberos is a network authentication system. The krb5-pkinit-openssl
245package contains the PKINIT plugin, which uses OpenSSL to allow clients
246to obtain initial credentials from a KDC using a private key and a
247certificate.
248
249
250# compat32
251%package -n compat32-%{name}-devel
252Summary: Development files needed to compile Kerberos 5 programs.
253Summary(ja): Kerberos 5 プログラムをコンパイルするために必要な開発ファイル
254Group: programming
255Requires: compat32-%{name}-libs = %{version}-%{release}
256Requires: %{name}-devel = %{version}-%{release}
257Requires: compat32-e2fsprogs-devel
258
259%description -n compat32-%{name}-devel
260Kerberos is a network authentication system. The krb5-devel package
261contains the header files and libraries needed for compiling Kerberos
2625 programs. If you want to develop Kerberos-aware programs, you need
263to install this package.
264
265
266%package -n compat32-%{name}-libs
267Summary: The shared libraries used by Kerberos 5.
268Summary(ja): Kerberos 5 の共有ライブラリ
269Group: system
270Requires(pre): /sbin/ldconfig
271Requires: %{name}-libs = %{version}-%{release}
272
273%description -n compat32-%{name}-libs
274Kerberos is a network authentication system. The krb5-libs package
275contains the shared libraries needed by Kerberos 5. If you are using
276Kerberos, you need to install this package.
277
278
279%package -n compat32-%{name}-pkinit-openssl
280Summary: The PKINIT module for Kerberos 5.
281Summary(ja): Kerberos 5 の PKINIT モジュール
282Group: system
283Requires: compat32-%{name}-libs = %{version}-%{release}
284Requires: %{name}-pkinit-openssl = %{version}-%{release}
285
286%description -n compat32-%{name}-pkinit-openssl
287Kerberos is a network authentication system. The krb5-pkinit-openssl
288package contains the PKINIT plugin, which uses OpenSSL to allow clients
289to obtain initial credentials from a KDC using a private key and a
290certificate.
291
292# end of compat32 package
293
294
295%debug_package
296
297
298%prep
299%autosetup -S git -n %{name}-%{version}
300
301ln -s NOTICE LICENSE
302
303# Generate an FDS-compatible LDIF file.
304inldif=src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
305cat > '60kerberos.ldif' << EOF
306# This is a variation on kerberos.ldif which 389 Directory Server will like.
307dn: cn=schema
308EOF
309egrep -iv '(^$|^dn:|^changetype:|^add:)' $inldif | \
310sed -r 's,^             ,                ,g' | \
311sed -r 's,^     ,        ,g' >> 60kerberos.ldif
312touch -r $inldif 60kerberos.ldif
313
314# Rebuild the configure scripts.
315pushd src
316autoreconf -fiv
317popd
318
319# Mess with some of the default ports that we use for testing, so that multiple
320# builds going on the same host don't step on each other.
321cfg="src/kadmin/testing/proto/kdc.conf.proto \
322     src/kadmin/testing/proto/krb5.conf.proto \
323     src/lib/kadm5/unit-test/api.current/init-v2.exp \
324     src/util/k5test.py"
325LONG_BIT=`getconf LONG_BIT`
326PORT=`expr 61000 + $LONG_BIT - 48`
327sed -i -e s,61000,`expr "$PORT" + 0`,g $cfg
328PORT=`expr 1750 + $LONG_BIT - 48`
329sed -i -e s,1750,`expr "$PORT" + 0`,g $cfg
330sed -i -e s,1751,`expr "$PORT" + 1`,g $cfg
331sed -i -e s,1752,`expr "$PORT" + 2`,g $cfg
332PORT=`expr 8888 + $LONG_BIT - 48`
333sed -i -e s,8888,`expr "$PORT" - 0`,g $cfg
334sed -i -e s,8887,`expr "$PORT" - 1`,g $cfg
335sed -i -e s,8886,`expr "$PORT" - 2`,g $cfg
336PORT=`expr 7777 + $LONG_BIT - 48`
337sed -i -e s,7777,`expr "$PORT" + 0`,g $cfg
338sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg
339
340
341%build
342source %{_libdir}/tclConfig.sh
343pushd src
344
345# Set this so that configure will have a value even if the current version of
346# autoconf doesn't set one.
347export runstatedir=%{_localstatedir}/run
348# Work out the CFLAGS and CPPFLAGS which we intend to use.
349INCLUDES=-I%{_includedir}/et
350CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`"
351CPPFLAGS="`echo $DEFINES $INCLUDES`"
352%configure \
353        CC="%{__cc}" \
354        CFLAGS="$CFLAGS" \
355        CPPFLAGS="$CPPFLAGS" \
356        LIBS="-ldl -lz -lpthread" \
357        SS_LIB="-lss" \
358        --with-selinux=no \
359        --enable-shared \
360%if %{build_static}
361        --enable-static \
362%endif
363        --localstatedir=%{_var}/kerberos \
364        --disable-rpath \
365        --without-krb5-config \
366        --with-system-et \
367        --with-system-ss \
368        --with-netlib=-lresolv \
369        --without-tcl \
370        --enable-dns-for-realm \
371%if %{WITH_LDAP}
372        --with-ldap \
373%if %{WITH_DIRSRV}
374        --with-dirsrv-account-locking \
375%endif
376%endif
377%if %{WITH_OPENSSL}
378        --enable-pkinit \
379        --with-crypto-impl=openssl \
380        --with-pkinit-crypto-impl=openssl \
381        --with-tls-impl=openssl \
382%else
383        --disable-pkinit \
384%endif
385%if %{WITH_SYSVERTO}
386        --with-system-verto \
387%else
388        --without-system-verto \
389%endif
390        --with-pam \
391        --with-prng-alg=os \
392        || (cat config.log; exit 1)
393
394# Now build it.
395make %{?_smp_mflags}
396popd
397
398# Sanity check the KDC_RUN_DIR.
399configured_kdcrundir=`grep KDC_RUN_DIR src/include/osconf.h | awk '{print $NF}'`
400configured_kdcrundir=`eval echo $configured_kdcrundir`
401if test "$configured_kdcrundir" != %{_localstatedir}/run/krb5kdc ; then
402        exit 1
403fi
404
405## Build the docs.
406#LANG=C make -C src/doc paths.py version.py
407#cp src/doc/paths.py doc/
408#mkdir -p build-man build-html build-pdf
409#sphinx-build -a -b man   -t pathsubs doc build-man
410#sphinx-build -a -b html  -t pathsubs doc build-html
411#rm -fr build-html/_sources
412#sphinx-build -a -b latex -t pathsubs doc build-pdf
413## Build the PDFs if we didn't have pre-built ones.
414#for pdf in admin appdev basic build plugindev user ; do
415#        test -s build-pdf/$pdf.pdf || make -C build-pdf
416#done
417
418## new krb5-%{version}-pdf
419#tar -cf "krb5-%{version}-pdfs.tar.new" build-pdf/*.pdf
420
421cd src/man
422make -f Makefile.in top_srcdir=.. srcdir=. man
423
424# We need to cut off any access to locally-running nameservers, too.
425%{__cc} -fPIC -shared -o noport.so -Wall -Wextra $RPM_SOURCE_DIR/noport.c
426
427
428%check
429%if %{with test}
430mkdir nss_wrapper
431
432# Set things up to use the test wrappers.
433export NSS_WRAPPER_HOSTNAME=test.example.com
434export NSS_WRAPPER_HOSTS="$PWD/nss_wrapper/fakehosts"
435echo "127.0.0.1 $NSS_WRAPPER_HOSTNAME localhost" > $NSS_WRAPPER_HOSTS
436export NOPORT='53,111'
437export SOCKET_WRAPPER_DIR="$PWD/sockets" ; mkdir -p $SOCKET_WRAPPER_DIR
438export LD_PRELOAD="$PWD/noport.so:libnss_wrapper.so:libsocket_wrapper.so"
439
440# Run the test suite. We can't actually run the whole thing in the build
441# system, but we can at least run more than we used to.  The build system may
442# give us a revoked session keyring, so run affected tests with a new one.
443make -C src runenv.py
444: make -C src check TMPDIR=%{_tmppath}
445keyctl session - make -C src/lib check TMPDIR=%{_tmppath} OFFLINE=yes
446make -C src/kdc check TMPDIR=%{_tmppath}
447keyctl session - make -C src/appl check TMPDIR=%{_tmppath}
448make -C src/clients check TMPDIR=%{_tmppath}
449keyctl session - make -C src/util check TMPDIR=%{_tmppath}
450%endif
451
452
453%install
454[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
455
456# Sample KDC config files (bundled kdc.conf and kadm5.acl).
457mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
458install -pm 600 %{SOURCE10} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
459install -pm 600 %{SOURCE11} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
460
461# Where per-user keytabs live by default.
462mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user
463
464# Default configuration file for everything.
465mkdir -p $RPM_BUILD_ROOT/etc
466install -pm 644 %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf
467
468
469# Default include on this directory
470mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d
471#ln -sv /etc/crypto-policies/back-ends/krb5.config $RPM_BUILD_ROOT/etc/krb5.conf.d/crypto-policies
472
473# Parent of configuration file for list of loadable GSS mechs ("mechs").  This
474# location is not relative to sysconfdir, but is hard-coded in g_initialize.c.
475mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss
476# Parent of groups of configuration files for a list of loadable GSS mechs
477# ("mechs").  This location is not relative to sysconfdir, and is also
478# hard-coded in g_initialize.c.
479mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d
480
481
482# If the default configuration needs to start specifying a default cache
483# location, add it now, then fixup the timestamp so that it looks the same.
484%if 0%{?configure_default_ccache_name}
485export DEFCCNAME="%{configured_default_ccache_name}"
486awk '{print}
487        /^# default_realm/{print " default_ccache_name =", ENVIRON["DEFCCNAME"]}' \
488        %{SOURCE6} > $RPM_BUILD_ROOT/etc/krb5.conf
489touch -r %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf
490grep default_ccache_name $RPM_BUILD_ROOT/etc/krb5.conf
491%endif
492
493
494
495
496# Server init scripts (krb5kdc,kadmind,kpropd) and their sysconfig files.
497%if %{with systemd}
498mkdir -p $RPM_BUILD_ROOT%{_unitdir}
499for unit in \
500     %{SOURCE200} \
501     %{SOURCE201} \
502     %{SOURCE202} ; do
503    # In the past, the init script was supposed to be named after the service
504    # that the started daemon provided.  Changing their names is an
505    # upgrade-time problem I'm in no hurry to deal with.
506    install -pm 644 ${unit} $RPM_BUILD_ROOT%{_unitdir}
507done
508mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir}
509install -pm 644 %{SOURCE203} $RPM_BUILD_ROOT/%{_tmpfilesdir}/
510%else
511mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
512for init in \
513        %{SOURCE5}\
514        %{SOURCE4} \
515        %{SOURCE2} ; do
516        # In the past, the init script was supposed to be named after the
517        # service that the started daemon provided.  Changing their names
518        # is an upgrade-time problem I'm in no hurry to deal with.
519        service=`basename ${init} .init`
520        install -pm 755 ${init} \
521        $RPM_BUILD_ROOT/etc/rc.d/init.d/${service%d}
522done
523%endif
524mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
525for sysconfig in \
526        %{SOURCE19}\
527        %{SOURCE20}\
528        %{SOURCE21} ; do
529        install -pm 644 ${sysconfig} \
530        $RPM_BUILD_ROOT/etc/sysconfig/`basename ${sysconfig} .sysconfig`
531done
532
533%if !%{with systemd}
534# portreserve configuration files.
535mkdir -p $RPM_BUILD_ROOT/etc/portreserve
536for portreserve in \
537        %{SOURCE30} \
538        %{SOURCE31} \
539        %{SOURCE32} ; do
540        install -pm 644 ${portreserve} \
541        $RPM_BUILD_ROOT/etc/portreserve/`basename ${portreserve} .portreserve`
542done
543%endif
544
545# logrotate configuration files
546mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/
547for logrotate in \
548        %{SOURCE33} \
549        %{SOURCE34} ; do
550        install -pm 644 ${logrotate} \
551        $RPM_BUILD_ROOT/etc/logrotate.d/`basename ${logrotate} .logrotate`
552done
553
554# PAM configuration files.
555mkdir -p $RPM_BUILD_ROOT/etc/pam.d/
556for pam in \
557        %{SOURCE29} ; do
558        install -pm 644 ${pam} \
559        $RPM_BUILD_ROOT/etc/pam.d/`basename ${pam} .pamd`
560done
561
562# Plug-in directories.
563install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth
564install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb
565install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata
566
567# The rest of the binaries, headers, libraries, and docs.
568make -C src DESTDIR=$RPM_BUILD_ROOT EXAMPLEDIR=%{_docdir}/krb5-libs-%{version}/examples install
569
570# Munge krb5-config yet again.  This is totally wrong for 64-bit, but chunks
571# of the buildconf patch already conspire to strip out /usr/<anything> from the
572# list of link flags, and it helps prevent file conflicts on multilib systems.
573sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bindir}/krb5-config
574
575# Temporay workaround for krb5-config reading too much from LDFLAGS.
576# Upstream: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8159
577sed -r -i -e "s/-specs=\/.+?\/redhat-hardened-ld//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config
578
579if [[ "$(< $RPM_BUILD_ROOT%{_bindir}/krb5-config )" == *redhat-hardened-ld* ]] ; then
580        printf '# redhat-hardened-ld for krb5-config failed' 1>&2
581        exit 1
582fi
583
584# Install processed man pages.
585for section in 1 5 8 ; do
586        install -m 644 src/man/rst_man/*.${section} \
587                $RPM_BUILD_ROOT/%{_mandir}/man${section}/
588done
589
590# Move specific libraries from %{_libdir} to /%{_lib}, and fixup the symlinks.
591touch $RPM_BUILD_ROOT/rootfile
592rellibdir=..
593while ! test -r $RPM_BUILD_ROOT/%{_libdir}/${rellibdir}/rootfile ; do
594        rellibdir=../${rellibdir}
595done
596rm -f $RPM_BUILD_ROOT/rootfile
597mkdir -p $RPM_BUILD_ROOT/%{_lib}
598for library in libgssapi_krb5 libgssrpc libk5crypto libkrb5 libkrb5support ; do
599        mv $RPM_BUILD_ROOT/%{_libdir}/${library}.so.* $RPM_BUILD_ROOT/%{_lib}/
600        pushd $RPM_BUILD_ROOT/%{_libdir}
601        ln -fs ${rellibdir}/%{_lib}/${library}.so.*.* ${library}.so
602        popd
603done
604
605# This script just tells you to send bug reports to krb5-bugs@mit.edu, but
606# since we don't have a man page for it, just drop it.
607rm -- "$RPM_BUILD_ROOT/%{_sbindir}/krb5-send-pr"
608
609# These files are already packaged elsewhere
610rm -f -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/kdc.conf"
611rm -f -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/krb5.conf"
612rm -f -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/services.append"
613
614# This is only needed for tests
615rm -f -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so"
616
617%find_lang %{gettext_domain}
618
619
620%clean
621[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
622
623
624%post libs -p /sbin/ldconfig
625%postun libs -p /sbin/ldconfig
626
627%post server-ldap -p /sbin/ldconfig
628%postun server-ldap -p /sbin/ldconfig
629
630%post server
631# Remove the init script for older servers.
632%if %{with systemd}
633%systemd_post krb5kdc.service kadmin.service kprop.service
634# assert sanity.  A cleaner solution probably exists but it is opaque
635/bin/systemctl daemon-reload
636%else
637[ -x /etc/rc.d/init.d/krb5server ] && /sbin/chkconfig --del krb5server
638# Install the new ones.
639/sbin/chkconfig --add krb5kdc
640/sbin/chkconfig --add kadmin
641/sbin/chkconfig --add kprop
642%endif
643exit 0
644
645%preun server
646%if %{with systemd}
647%systemd_preun krb5kdc.service kadmin.service kprop.service
648%else
649if [ "$1" -eq "0" ] ; then
650        /sbin/chkconfig --del krb5kdc
651        /sbin/chkconfig --del kadmin
652        /sbin/chkconfig --del kprop
653        /sbin/service krb5kdc stop > /dev/null 2>&1 || :
654        /sbin/service kadmin stop > /dev/null 2>&1 || :
655        /sbin/service kprop stop > /dev/null 2>&1 || :
656fi
657%endif
658exit 0
659
660%postun server
661%if %{with systemd}
662%systemd_postun_with_restart krb5kdc.service kadmin.service kprop.service
663%else
664if [ "$1" -ge 1 ] ; then
665        /sbin/service krb5kdc condrestart > /dev/null 2>&1 || :
666        /sbin/service kadmin condrestart > /dev/null 2>&1 || :
667        /sbin/service kprop condrestart > /dev/null 2>&1 || :
668fi
669%endif
670exit 0
671
672%triggerun server -- krb5-server < 1.6.3-100
673%if !%{with systemd}
674if [ "$2" -eq "0" ] ; then
675        /sbin/install-info --delete %{_infodir}/krb425.info.gz %{_infodir}/dir
676        /sbin/service krb524 stop > /dev/null 2>&1 || :
677        /sbin/chkconfig --del krb524 > /dev/null 2>&1 || :
678fi
679exit 0
680%endif
681
682%triggerun libs -- krb5-libs < 1.16-2
683if grep -q '^includedir /etc/krb5.conf.d' /etc/krb5.conf ; then
684        perl -pi \
685                -e 's|^includedir /etc/krb5.conf.d|#includedir /etc/krb5.conf.d|' \
686                /etc/krb5.conf
687fi
688exit 0
689
690%post -n compat32-%{name}-libs -p /sbin/ldconfig
691%postun -n compat32-%{name}-libs -p /sbin/ldconfig
692
693
694%files workstation
695%defattr(-,root,root,-)
696%doc src/config-files/services.append
697%doc src/config-files/krb5.conf
698%attr(0755,root,root) %doc src/config-files/convert-config-files
699
700# Clients of the KDC, including tools you're likely to need if you're running
701# app servers other than those built from this source package.
702%{_bindir}/kdestroy
703%{_mandir}/man1/kdestroy.1*
704%{_bindir}/kinit
705%{_mandir}/man1/kinit.1*
706%{_bindir}/klist
707%{_mandir}/man1/klist.1*
708%{_bindir}/kpasswd
709%{_mandir}/man1/kpasswd.1*
710%{_bindir}/kswitch
711%{_mandir}/man1/kswitch.1*
712
713%{_bindir}/kvno
714%{_mandir}/man1/kvno.1*
715%{_bindir}/kadmin
716%{_mandir}/man1/kadmin.1*
717%{_bindir}/k5srvutil
718%{_mandir}/man1/k5srvutil.1*
719%{_bindir}/ktutil
720%{_mandir}/man1/ktutil.1*
721
722# Doesn't really fit anywhere else.
723%attr(4755,root,root) %{_bindir}/ksu
724%{_mandir}/man1/ksu.1*
725%config(noreplace) /etc/pam.d/ksu
726
727%files server
728%defattr(-,root,root,-)
729%docdir %{_mandir}
730%doc src/config-files/kdc.conf
731
732%if %{with systemd}
733%{_unitdir}/krb5kdc.service
734%{_unitdir}/kadmin.service
735%{_unitdir}/kprop.service
736%{_tmpfilesdir}/krb5-krb5kdc.conf
737%else
738/etc/rc.d/init.d/krb5kdc
739/etc/rc.d/init.d/kadmin
740/etc/rc.d/init.d/kprop
741%dir /etc/portreserve
742%config(noreplace) /etc/portreserve/kerberos-iv
743%config(noreplace) /etc/portreserve/kerberos-adm
744%config(noreplace) /etc/portreserve/krb5_prop
745%endif
746%config(noreplace) /etc/sysconfig/krb5kdc
747%config(noreplace) /etc/sysconfig/kadmin
748%config(noreplace) /etc/sysconfig/kprop
749%config(noreplace) /etc/logrotate.d/krb5kdc
750%config(noreplace) /etc/logrotate.d/kadmind
751
752%dir %{_var}/kerberos
753%dir %{_var}/kerberos/krb5kdc
754%config(noreplace) %{_var}/kerberos/krb5kdc/kdc.conf
755%config(noreplace) %{_var}/kerberos/krb5kdc/kadm5.acl
756
757%dir %{_libdir}/krb5
758%dir %{_libdir}/krb5/plugins
759%dir %{_libdir}/krb5/plugins/kdb
760%dir %{_libdir}/krb5/plugins/preauth
761%dir %{_libdir}/krb5/plugins/authdata
762%{_libdir}/krb5/plugins/preauth/otp.so
763%{_libdir}/krb5/plugins/kdb/db2.so
764
765# KDC binaries and configuration.
766%{_mandir}/man5/kadm5.acl.5*
767%{_mandir}/man5/kdc.conf.5*
768%{_sbindir}/kadmin.local
769%{_mandir}/man8/kadmin.local.8*
770%{_sbindir}/kadmind
771%{_mandir}/man8/kadmind.8*
772%{_sbindir}/kdb5_util
773%{_mandir}/man8/kdb5_util.8*
774%{_sbindir}/kprop
775%{_mandir}/man8/kprop.8*
776%{_sbindir}/kpropd
777%{_mandir}/man8/kpropd.8*
778%{_sbindir}/kproplog
779%{_mandir}/man8/kproplog.8*
780%{_sbindir}/krb5kdc
781%{_mandir}/man8/krb5kdc.8*
782
783# This is here for people who want to test their server, and also
784# included in devel package for similar reasons.
785%{_bindir}/sclient
786%{_mandir}/man1/sclient.1*
787%{_sbindir}/sserver
788%{_mandir}/man8/sserver.8*
789
790%if %{WITH_LDAP}
791%files server-ldap
792%defattr(-,root,root,-)
793%docdir %{_mandir}
794%doc src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
795%doc src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema
796%doc 60kerberos.ldif
797%dir %{_libdir}/krb5
798%dir %{_libdir}/krb5/plugins
799%dir %{_libdir}/krb5/plugins/kdb
800%{_libdir}/krb5/plugins/kdb/kldap.so
801%{_libdir}/libkdb_ldap.so
802%{_libdir}/libkdb_ldap.so.*
803%{_mandir}/man8/kdb5_ldap_util.8.gz
804%{_sbindir}/kdb5_ldap_util
805%endif
806
807%files libs -f %{gettext_domain}.lang
808%defattr(-,root,root,-)
809%doc README NOTICE LICENSE
810%docdir %{_mandir}
811%dir /etc/gss
812%dir /etc/gss/mech.d
813%dir /etc/krb5.conf.d
814%config(noreplace) /etc/krb5.conf
815/%{_mandir}/man5/.k5identity.5*
816/%{_mandir}/man5/.k5login.5*
817/%{_mandir}/man5/k5identity.5*
818/%{_mandir}/man5/k5login.5*
819/%{_mandir}/man5/krb5.conf.5*
820/%{_mandir}/man7/kerberos.7*
821/%{_lib}/libgssapi_krb5.so.*
822/%{_lib}/libgssrpc.so.*
823/%{_lib}/libk5crypto.so.*
824%{_libdir}/libkadm5clnt_mit.so.*
825%{_libdir}/libkadm5srv_mit.so.*
826%{_libdir}/libkdb5.so.*
827%{_libdir}/libkrad.so.*
828/%{_lib}/libkrb5.so.*
829/%{_lib}/libkrb5support.so.*
830%dir %{_libdir}/krb5
831%dir %{_libdir}/krb5/plugins
832%dir %{_libdir}/krb5/plugins/*
833%{_libdir}/krb5/plugins/tls/k5tls.so
834%{_libdir}/krb5/plugins/preauth/spake.so
835%dir %{_var}/kerberos
836%dir %{_var}/kerberos/krb5
837%dir %{_var}/kerberos/krb5/user
838%if ! %{WITH_SYSVERTO}
839%{_libdir}/libverto.so
840%{_libdir}/libverto.so.*
841%endif
842
843%if %{WITH_OPENSSL}
844%files pkinit-openssl
845%defattr(-,root,root,-)
846%dir %{_libdir}/krb5
847%dir %{_libdir}/krb5/plugins
848%dir %{_libdir}/krb5/plugins/preauth
849%{_libdir}/krb5/plugins/preauth/pkinit.so
850%endif
851
852%files devel
853%defattr(-,root,root,-)
854%docdir %{_mandir}
855
856%{_includedir}/*
857%{_libdir}/libgssapi_krb5.so
858%{_libdir}/libgssrpc.so
859%{_libdir}/libk5crypto.so
860%{_libdir}/libkadm5clnt.so
861%{_libdir}/libkadm5clnt_mit.so
862%{_libdir}/libkadm5srv.so
863%{_libdir}/libkadm5srv_mit.so
864%{_libdir}/libkdb5.so
865%{_libdir}/libkrad.so
866%{_libdir}/libkrb5.so
867%{_libdir}/libkrb5support.so
868%if %{build_static}
869%{_libdir}/*.a
870%endif
871%{_libdir}/pkgconfig/*
872
873%{_bindir}/krb5-config
874%{_mandir}/man1/krb5-config.1*
875%{_bindir}/sclient
876%{_mandir}/man1/sclient.1*
877%{_mandir}/man8/sserver.8*
878%{_sbindir}/sserver
879
880# Protocol test clients.
881%{_bindir}/sim_client
882%{_bindir}/gss-client
883%{_bindir}/uuclient
884
885# Protocol test servers.
886%{_sbindir}/sim_server
887%{_sbindir}/gss-server
888%{_sbindir}/uuserver
889
890# compat32
891%if %{build_compat32}
892%files -n compat32-%{name}-libs
893%defattr(-,root,root)
894/%{_lib}/libgssapi_krb5.so.*
895/%{_lib}/libgssrpc.so.*
896/%{_lib}/libk5crypto.so.*
897%{_libdir}/libkadm5clnt_mit.so.*
898%{_libdir}/libkadm5srv_mit.so.*
899%{_libdir}/libkdb5.so.*
900/%{_lib}/libkrb5.so.*
901/%{_lib}/libkrb5support.so.*
902%dir %{_libdir}/krb5
903%dir %{_libdir}/krb5/plugins
904%dir %{_libdir}/krb5/plugins/*
905%{_libdir}/krb5/plugins/tls/k5tls.so
906%{_libdir}/krb5/plugins/preauth/spake.so
907
908%if %{WITH_OPENSSL}
909%files -n compat32-%{name}-pkinit-openssl
910%defattr(-,root,root)
911%dir %{_libdir}/krb5
912%dir %{_libdir}/krb5/plugins
913%dir %{_libdir}/krb5/plugins/preauth
914%{_libdir}/krb5/plugins/preauth/pkinit.so
915%endif
916
917%files -n compat32-%{name}-devel
918%defattr(-,root,root)
919%{_libdir}/libgssapi_krb5.so
920%{_libdir}/libgssrpc.so
921%{_libdir}/libk5crypto.so
922%{_libdir}/libkadm5clnt.so
923%{_libdir}/libkadm5clnt_mit.so
924%{_libdir}/libkadm5srv.so
925%{_libdir}/libkadm5srv_mit.so
926%{_libdir}/libkdb5.so
927%{_libdir}/libkrad.so
928%{_libdir}/libkrb5.so
929%{_libdir}/libkrb5support.so
930%if %{build_static}
931%{_libdir}/*.a
932%endif
933%{_libdir}/pkgconfig/*
934
935%endif
936
937
938%changelog
939* Thu Nov 26 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.18.3-1
940- updated to 1.18.3.
941- dropped all patches.
942- imported patches from rawhide.
943
944* Wed Apr 08 2020 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.18-1
945- updated to 1.18.
946- added systemd support (disabled as default).
947- dropped all patches.
948- imported patches from rawhide.
949
950* Thu Nov 01 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.16.1-1
951- updated to 1.16.1.
952
953* Wed Feb 28 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.16-2
954- fixed /etc/krb5.conf.
955
956* Wed Feb 28 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.16-1
957- updated to 1.16.
958
959* Mon Aug  1 2016 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.14.3-1
960- updated to 1.14.3.
961
962* Wed May 25 2016 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 1.14.2-1
963- updated to 1.14.2.
964
965* Tue Mar 19 2013 Daisuke SUZUKI <daisuke@linux.or.jp> 1.11.1-1
966- update to 1.11.1
967
968* Thu Sep 20 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.8.2-7
969- add patch83 for fix CVE-2012-1015 (MITKRB5-SA-2012-001)
970- add patch84 for fix CVE-2012-1013 (kadmind)
971
972* Thu Jan  5 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.8.2-6
973- add patch82 for fix CVE-2011-1528,29 and CVE-2011-4151
974- add Vendor/Distribution tags
975
976* Wed Apr 20 2011 IWAI, Masaharu <iwai@alib.jp> 1.8.2-5
977- add MITKRB5SA-2011-004 patch (Patch81, CVE-2011-0285)
978
979* Wed Mar 23 2011 Daisuke SUZUKI <daisuke@linux.or.jp> 1.8.2-4
980- add BR: e2fsprogs-devel
981- add R: e2fsprogs-devel to -devel subpackage
982- fix krb5-server dependency
983  - R: initscripts >= 8.91.3-1
984
985* Mon Mar 21 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.8.2-3
986- fix compat32-devel package missing...
987
988* Mon Mar 21 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.8.2-2
989- add Obsoletes: krb5-workstation-clients, krb5-workstation-servers into workstation pkg
990
991* Sun Mar 20 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.8.2-1
992- new upstream release 1.8
993- this package based on rhel6
994
995   * Mon Mar 14 2011 Nalin Dahyabhai <nalin@redhat.com> 1.8.2-3.6
996   - add revised upstream patch to fix double-free in KDC while returning
997   typed-data with errors (CVE-2011-0284, #681564)
998
999* Mon Jan 10 2011 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.6.3-8
1000- rebuild with openssl-1.0.0c
1001- add Patch500 (krb5-1.6.3-openssl-1.0.0-vine.patch)
1002- change BuildRequires: texlive instead of tetex-latex
1003
1004* Fri May 21 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.6.3-7
1005- add patch87 for fix CVE-2010-1321 (GSS API Null pointer def)
1006
1007* Sat Apr 10 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.6.3-6
1008- add patch86 for fix CVE-2010-0629 (kadmind DoS)
1009- add Vendor/Distribution tags
1010
1011* Thu Jan 14 2010 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.6.3-5
1012- add Patch85 for fix CVE-2009-4212 (AES and RC4 Decryption)
1013
1014* Sat Jun 27 2009 NAKAMURA Kenta <kenta@vinelinux.org> 1.6.3-4
1015- added compat32 package for x86_64 arch support
1016
1017* Wed Apr 22 2009 Daisuke SUZUKI <daisuke@linux.or.jp> 1.6.3-3
1018- add Patch80: update backport of the preauth module interface
1019- add Patch82: fix CVE-2009-0844,0845
1020- add Patch83: fix CVE-2009-0846
1021- add Patch84: fix CVE-2009-0847
1022
1023* Sat Apr 04 2009 Daisuke SUZUKI <daisuke@linux.or.jp> 1.6.3-2
1024- rebuild with openldap-2.4.11
1025
1026* Thu Oct 02 2008 Daisuke SUZUKI <daisuke@linux.or.jp> 1.6.3-1
1027- initial build for Vine Linux
1028
1029* Tue Aug  5 2008 Tom "spot" Callaway <tcallawa@redhat.com> 1.6.3-16
1030- fix license tag
1031
1032* Wed Jul 16 2008 Nalin Dahyabhai <nalin@redhat.com>
1033- clear fuzz out of patches, dropping a man page patch which is no longer
1034  necessary
1035- quote %%{__cc} where needed because it includes whitespace now
1036- define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building
1037
1038* Fri Jul 11 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-15
1039- build with -fno-strict-aliasing, which is needed because the library
1040  triggers these warnings
1041- don't forget to label principal database lock files
1042- fix the labeling patch so that it doesn't break bootstrapping
1043
1044* Sat Jun 14 2008 Tom "spot" Callaway <tcallawa@redhat.com> 1.6.3-14
1045- generate src/include/krb5/krb5.h before building
1046- fix conditional for sparcv9
1047
1048* Wed Apr 16 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-13
1049- ftp: use the correct local filename during mget when the 'case' option is
1050  enabled (#442713)
1051
1052* Fri Apr  4 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-12
1053- stop exporting kadmin keys to a keytab file when kadmind starts -- the
1054  daemon's been able to use the database directly for a long long time now
1055- belatedly add aes128,aes256 to the default set of supported key types
1056
1057* Tue Apr  1 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-11
1058- libgssapi_krb5: properly export the acceptor subkey when creating a lucid
1059  context (Kevin Coffman, via the nfs4 mailing list)
1060
1061* Tue Mar 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-10
1062- add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
1063  when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
1064  #432620, #432621)
1065- add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
1066  high-numbered descriptors are used (CVE-2008-0947, #433596)
1067- add backport bug fix for an attempt to free non-heap memory in
1068  libgssapi_krb5 (CVE-2007-5901, #415321)
1069- add backport bug fix for a double-free in out-of-memory situations in
1070  libgssapi_krb5 (CVE-2007-5971, #415351)
1071
1072* Tue Mar 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-9
1073- rework file labeling patch to not depend on fragile preprocessor trickery,
1074  in another attempt at fixing #428355 and friends
1075
1076* Tue Feb 26 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-8
1077- ftp: add patch to fix "runique on" case when globbing fixes applied
1078- stop adding a redundant but harmless call to initialize the gssapi internals
1079
1080* Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
1081- add patch to suppress double-processing of /etc/krb5.conf when we build
1082  with --sysconfdir=/etc, thereby suppressing double-logging (#231147)
1083
1084* Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
1085- remove a patch, to fix problems with interfaces which are "up" but which
1086  have no address assigned, which conflicted with a different fix for the same
1087  problem in 1.5 (#200979)
1088
1089* Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
1090- ftp: don't lose track of a descriptor on passive get when the server fails to
1091  open a file
1092
1093* Mon Feb 25 2008 Nalin Dahyabhai <nalin@redhat.com>
1094- in login, allow PAM to interact with the user when they've been strongly
1095  authenticated
1096- in login, signal PAM when we're changing an expired password that it's an
1097  expired password, so that when cracklib flags a password as being weak it's
1098  treated as an error even if we're running as root
1099
1100* Mon Feb 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7
1101- drop netdb patch
1102- kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
1103  the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
1104  Netscape, Red Hat Directory Server (Simo Sorce)
1105
1106* Wed Feb 13 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-6
1107- patch to avoid depending on <netdb.h> to define NI_MAXHOST and NI_MAXSERV
1108
1109* Tue Feb 12 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-5
1110- enable patch for key-expiration reporting
1111- enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
1112- enable patch to make kpasswd use the right sequence number on retransmit
1113- enable patch to allow mech-specific creds delegated under spnego to be found
1114  when searching for creds
1115
1116* Wed Jan  2 2008 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-4
1117- some init script cleanups
1118  - drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
1119  - krb524: don't barf on missing database if it looks like we're using kldap,
1120    same as for kadmin
1121  - return non-zero status for missing files which cause startup to
1122    fail (#242502)
1123
1124* Tue Dec 18 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-3
1125- allocate space for the nul-terminator in the local pathname when looking up
1126  a file context, and properly free a previous context (Jose Plans, #426085)
1127
1128* Wed Dec  5 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-2
1129- rebuild
1130
1131* Tue Oct 23 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-1
1132- update to 1.6.3, dropping now-integrated patches for CVE-2007-3999
1133  and CVE-2007-4000 (the new pkinit module is built conditionally and goes
1134  into the -pkinit-openssl package, at least for now, to make a buildreq
1135  loop with openssl avoidable)
1136
1137* Wed Oct 17 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-10
1138- make proper use of pam_loginuid and pam_selinux in rshd and ftpd
1139
1140* Fri Oct 12 2007 Nalin Dahyabhai <nalin@redhat.com>
1141- make krb5.conf %%verify(not md5 size mtime) in addition to
1142  %%config(noreplace), like /etc/nsswitch.conf (#329811)
1143
1144* Mon Oct  1 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-9
1145- apply the fix for CVE-2007-4000 instead of the experimental patch for
1146  setting ok-as-delegate flags
1147
1148* Tue Sep 11 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-8
1149- move the db2 kdb plugin from -server to -libs, because a multilib libkdb
1150  might need it
1151
1152* Tue Sep 11 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-7
1153- also perform PAM session and credential management when ftpd accepts a
1154  client using strong authentication, missed earlier
1155- also label kadmind log files and files created by the db2 plugin
1156
1157* Thu Sep  6 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-6
1158- incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
1159- fix incorrect call to "test" in the kadmin init script (#252322,#287291)
1160
1161* Tue Sep  4 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-5
1162- incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000)
1163
1164* Sat Aug 25 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-4
1165- cover more cases in labeling files on creation
1166- add missing gawk build dependency
1167
1168* Thu Aug 23 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-3
1169- rebuild
1170
1171* Thu Jul 26 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-2
1172- kdc.conf: default to listening for TCP clients, too (#248415)
1173
1174* Thu Jul 19 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.2-1
1175- update to 1.6.2
1176- add "buildrequires: texinfo-tex" to get texi2pdf
1177
1178* Wed Jun 27 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-8
1179- incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
1180  and MITKRB5-SA-2007-005 (CVE-2007-2798)
1181
1182* Mon Jun 25 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-7
1183- reintroduce missing %%postun for the non-split_workstation case
1184
1185* Mon Jun 25 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-6
1186- rebuild
1187
1188* Mon Jun 25 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-5.1
1189- rebuild
1190
1191* Sun Jun 24 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-5
1192- add missing pam-devel build requirement, force selinux-or-fail build
1193
1194* Sun Jun 24 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-4
1195- rebuild
1196
1197* Sun Jun 24 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-3
1198- label all files at creation-time according to the SELinux policy (#228157)
1199
1200* Fri Jun 22 2007 Nalin Dahyabhai <nalin@redhat.com>
1201- perform PAM account / session management in krshd (#182195,#195922)
1202- perform PAM authentication and account / session management in ftpd
1203- perform PAM authentication, account / session management, and password-
1204  changing in login.krb5 (#182195,#195922)
1205
1206* Fri Jun 22 2007 Nalin Dahyabhai <nalin@redhat.com>
1207- preprocess kerberos.ldif into a format FDS will like better, and include
1208  that as a doc file as well
1209
1210* Fri Jun 22 2007 Nalin Dahyabhai <nalin@redhat.com>
1211- switch man pages to being generated with the right paths in them
1212- drop old, incomplete SELinux patch
1213- add patch from Greg Hudson to make srvtab routines report missing-file errors
1214  at same point that keytab routines do (#241805)
1215
1216* Thu May 24 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-2
1217- pull patch from svn to undo unintentional chattiness in ftp
1218- pull patch from svn to handle NULL krb5_get_init_creds_opt structures
1219  better in a couple of places where they're expected
1220
1221* Wed May 23 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6.1-1
1222- update to 1.6.1
1223  - drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
1224  - drop patch for sendto bug in 1.6, fixed in 1.6.1
1225
1226* Fri May 18 2007 Nalin Dahyabhai <nalin@redhat.com>
1227- kadmind.init: don't fail outright if the default principal database
1228  isn't there if it looks like we might be using the kldap plugin
1229- kadmind.init: attempt to extract the key for the host-specific kadmin
1230  service when we try to create the keytab
1231
1232* Wed May 16 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-6
1233- omit dependent libraries from the krb5-config --libs output, as using
1234  shared libraries (no more static libraries) makes them unnecessary and
1235  they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
1236  (strips out libkeyutils, libresolv, libdl)
1237
1238* Fri May  4 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-5
1239- pull in keyutils as a build requirement to get the "KEYRING:" ccache type,
1240  because we've merged
1241
1242* Fri May  4 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-4
1243- fix an uninitialized length value which could cause a crash when parsing
1244  key data coming from a directory server
1245- correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")
1246
1247* Fri Apr 13 2007 Nalin Dahyabhai <nalin@redhat.com>
1248- move the default acl_file, dict_file, and admin_keytab settings to
1249  the part of the default/example kdc.conf where they'll actually have
1250  an effect (#236417)
1251
1252* Thu Apr  5 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-24
1253- merge security fixes from RHSA-2007:0095
1254
1255* Tue Apr  3 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-3
1256- add patch to correct unauthorized access via krb5-aware telnet
1257  daemon (#229782, CVE-2007-0956)
1258- add patch to fix buffer overflow in krb5kdc and kadmind
1259  (#231528, CVE-2007-0957)
1260- add patch to fix double-free in kadmind (#231537, CVE-2007-1216)
1261
1262* Thu Mar 22 2007 Nalin Dahyabhai <nalin@redhat.com>
1263- back out buildrequires: keyutils-libs-devel for now
1264
1265* Thu Mar 22 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-2
1266- add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
1267  dragging keyutils-libs in as a dependency
1268
1269* Mon Mar 19 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-23
1270- fix bug ID in changelog
1271
1272* Thu Mar 15 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-22
1273
1274* Thu Mar 15 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-21
1275- add preliminary patch to fix buffer overflow in krb5kdc and kadmind
1276  (#231528, CVE-2007-0957)
1277- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)
1278
1279* Wed Feb 28 2007 Nalin Dahyabhai <nalin@redhat.com>
1280- add patch to build semi-useful static libraries, but don't apply it unless
1281  we need them
1282
1283* Tue Feb 27 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-20
1284- temporarily back out %%post changes, fix for #143289 for security update
1285- add preliminary patch to correct unauthorized access via krb5-aware telnet
1286
1287* Mon Feb 19 2007 Nalin Dahyabhai <nalin@redhat.com>
1288- make profile.d scriptlets mode 644 instead of 755 (part of #225974)
1289
1290* Tue Jan 30 2007 Nalin Dahyabhai <nalin@redhat.com> 1.6-1
1291- clean up quoting of command-line arguments passed to the krsh/krlogin
1292  wrapper scripts
1293
1294* Mon Jan 22 2007 Nalin Dahyabhai <nalin@redhat.com>
1295- initial update to 1.6, pre-package-reorg
1296- move workstation daemons to a new subpackage (#81836, #216356, #217301), and
1297  make the new subpackage require xinetd (#211885)
1298
1299* Mon Jan 22 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-18
1300- make use of install-info more failsafe (Ville Skyttä, #223704)
1301- preserve timestamps on shell scriptlets at %%install-time
1302
1303* Tue Jan 16 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-17
1304- move to using pregenerated PDF docs to cure multilib conflicts (#222721)
1305
1306* Fri Jan 12 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-16
1307- update backport of the preauth module interface (part of #194654)
1308
1309* Tue Jan  9 2007 Nalin Dahyabhai <nalin@redhat.com> - 1.5-14
1310- apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
1311- apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)
1312
1313* Wed Dec 20 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-12
1314- update backport of the preauth module interface
1315
1316* Mon Oct 30 2006 Nalin Dahyabhai <nalin@redhat.com>
1317- update backport of the preauth module interface
1318- add proposed patches 4566, 4567
1319- add proposed edata reporting interface for KDC
1320- add temporary placeholder for module global context fixes
1321
1322* Mon Oct 23 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-11
1323- don't bail from the KDC init script if there's no database, it may be in
1324  a different location than the default (fenlason)
1325- remove the [kdc] section from the default krb5.conf -- doesn't seem to have
1326  been applicable for a while
1327
1328* Wed Oct 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-10
1329- rename krb5.sh and krb5.csh so that they don't overlap (#210623)
1330- way-late application of added error info in kadmind.init (#65853)
1331 
1332* Wed Oct 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-9.pal_18695
1333- add backport of in-development preauth module interface (#208643)
1334
1335* Mon Oct  9 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-9
1336- provide docs in PDF format instead of as tex source (Enrico Scholz, #209943)
1337
1338* Wed Oct  4 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-8
1339- add missing shebang headers to krsh and krlogin wrapper scripts (#209238)
1340
1341* Wed Sep  6 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-7
1342- set SS_LIB at configure-time so that libss-using apps get working readline
1343  support (#197044)
1344
1345* Fri Aug 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-6
1346- switch to the updated patch for MITKRB-SA-2006-001
1347
1348* Tue Aug  8 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-5
1349- apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084)
1350
1351* Mon Aug  7 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-4
1352- ensure that the gssapi library's been initialized before walking the
1353  internal mechanism list in gss_release_oid(), needed if called from
1354  gss_release_name() right after a gss_import_name() (#198092)
1355
1356* Tue Jul 25 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-3
1357- rebuild
1358
1359* Tue Jul 25 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-2
1360- pull up latest revision of patch to reduce lockups in rsh/rshd
1361
1362* Mon Jul 17 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-1.2
1363- rebuild
1364
1365* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.5-1.1
1366- rebuild
1367
1368* Thu Jul  6 2006 Nalin Dahyabhai <nalin@redhat.com> 1.5-1
1369- build
1370
1371* Wed Jul  5 2006 Nalin Dahyabhai <nalin@redhat.com> 1.5-0
1372- update to 1.5
1373
1374* Fri Jun 23 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-9
1375- mark profile.d config files noreplace (Laurent Rineau, #196447)
1376
1377* Thu Jun  8 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-8
1378- add buildprereq for autoconf
1379
1380* Mon May 22 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-7
1381- further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
1382  architectures, to avoid multilib conflicts; other changes will conspire to
1383  strip out the -L flag which uses this, so it should be harmless (#192692)
1384
1385* Fri Apr 28 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-6
1386- adjust the patch which removes the use of rpath to also produce a
1387  krb5-config which is okay in multilib environments (#190118)
1388- make the name-of-the-tempfile comment which compile_et adds to error code
1389  headers always list the same file to avoid conflicts on multilib installations
1390- strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
1391- strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
1392  boxes
1393
1394* Fri Apr 14 2006 Stepan Kasal <skasal@redhat.com> 1.4.3-5
1395- Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch)
1396
1397* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> 1.4.3-4.1
1398- bump again for double-long bug on ppc(64)
1399
1400* Mon Feb  6 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-4
1401- give a little bit more information to the user when kinit gets the catch-all
1402  I/O error (#180175)
1403
1404* Thu Jan 19 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
1405- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
1406  declared, such as with recent glibc when _GNU_SOURCE isn't being used
1407
1408* Thu Jan 19 2006 Matthias Clasen <mclasen@redhat.com> 1.4.3-2
1409- Use full paths in krb5.sh to avoid path lookups
1410
1411* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
1412- rebuilt
1413
1414* Thu Dec  1 2005 Nalin Dahyabhai <nalin@redhat.com>
1415- login: don't truncate passwords before passing them into crypt(), in
1416  case they're significant (#149476)
1417
1418* Thu Nov 17 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-1
1419- update to 1.4.3
1420- make ksu setuid again (#137934, others)
1421
1422* Tue Sep 13 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-4
1423- mark %%{krb5prefix}/man so that files which are packaged within it are
1424  flagged as %%doc (#168163)
1425
1426* Tue Sep  6 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-3
1427- add an xinetd configuration file for encryption-only telnetd, parallelling
1428  the kshell/ekshell pair (#167535)
1429
1430* Wed Aug 31 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-2
1431- change the default configured encryption type for KDC databases to the
1432  compiled-in default of des3-hmac-sha1 (#57847)
1433
1434* Thu Aug 11 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-1
1435- update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and
1436  MIT-KRB5-SA-2005-003
1437
1438* Wed Jun 29 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-6
1439- rebuild
1440
1441* Wed Jun 29 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-5
1442- fix telnet client environment variable disclosure the same way NetKit's
1443  telnet client did (CAN-2005-0488) (#159305)
1444- keep apps which call krb5_principal_compare() or krb5_realm_compare() with
1445  malformed or NULL principal structures from crashing outright (Thomas Biege)
1446  (#161475)
1447
1448* Tue Jun 28 2005 Nalin Dahyabhai <nalin@redhat.com>
1449- apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
1450  (#157104)
1451- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)
1452
1453* Fri Jun 24 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-4
1454- fix double-close in keytab handling
1455- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)
1456
1457* Fri May 13 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-3
1458- prevent spurious EBADF in krshd when stdin is closed by the client while
1459  the command is running (#151111)
1460
1461* Fri May 13 2005 Martin Stransky <stransky@redhat.com> 1.4.1-2
1462- add deadlock patch, removed old patch
1463
1464* Fri May  6 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
1465- update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
1466- when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
1467  file for the service, pass it as an argument for the -r flag
1468
1469* Wed Mar 23 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4-3
1470- drop krshd patch for now
1471
1472* Thu Mar 17 2005 Nalin Dahyabhai <nalin@redhat.com>
1473- add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
1474- add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)
1475
1476* Wed Mar 16 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4-2
1477- don't include <term.h> into the telnet client when we're not using curses
1478
1479* Thu Feb 24 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4-1
1480- update to 1.4
1481  - v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
1482    flag to specify that it should communicate with the server using the older
1483    protocol
1484  - new libkrb5support library
1485  - v5passwdd and kadmind4 are gone
1486  - versioned symbols
1487- pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
1488  it on to krb5kdc
1489- pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
1490  it on to kadmind
1491- pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
1492  it on to krb524d *instead of* "-m"
1493- set "forwardable" in [libdefaults] in the default krb5.conf to match the
1494  default setting which we supply for pam_krb5
1495- set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
1496  compiled-in default
1497
1498* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.6-3
1499- rebuild
1500
1501* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.6-2
1502- rebuild
1503
1504* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.6-1
1505- update to 1.3.6, which includes the previous fix
1506
1507* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-8
1508- apply fix from Tom Yu for MITKRB5-SA-2004-004 (CAN-2004-1189)
1509
1510* Fri Dec 17 2004 Martin Stransky <stransky@redhat.com> 1.3.5-7
1511- fix deadlock during file transfer via rsync/krsh
1512- thanks goes to James Antill for hint
1513
1514* Fri Nov 26 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-6
1515- rebuild
1516
1517* Mon Nov 22 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-3
1518- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
1519
1520* Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com>
1521- silence compiler warning in kprop by using an in-memory ccache with a fixed
1522  name instead of an on-disk ccache with a name generated by tmpnam()
1523
1524* Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-2
1525- fix globbing patch port mode (#139075)
1526
1527* Mon Nov  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-1
1528- fix segfault in telnet due to incorrect checking of gethostbyname_r result
1529  codes (#129059)
1530
1531* Fri Oct 15 2004 Nalin Dahyabhai <nalin@redhat.com>
1532- remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
1533  supported keytypes in kdc.conf -- they produce exactly the same keys as
1534  rc4-hmac:normal because rc4 string-to-key ignores salts
1535- nuke kdcrotate -- there are better ways to balance the load on KDCs, and
1536  the SELinux policy for it would have been scary-looking
1537- update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003
1538
1539* Tue Aug 31 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-7
1540- rebuild
1541
1542* Tue Aug 24 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-6
1543- rebuild
1544
1545* Tue Aug 24 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-5
1546- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
1547  CAN-2004-0772
1548
1549* Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-4
1550- rebuild
1551
1552* Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
1553- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
1554  (MITKRB5-SA-2004-002, #130732)
1555- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)
1556
1557* Tue Jul 27 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-2
1558- fix indexing error in server sorting patch (#127336)
1559
1560* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
1561- rebuilt
1562
1563* Mon Jun 14 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-0.1
1564- update to 1.3.4 final
1565
1566* Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-0
1567- update to 1.3.4 beta1
1568- remove MITKRB5-SA-2004-001, included in 1.3.4
1569
1570* Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-8
1571- rebuild
1572
1573* Fri Jun  4 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-7
1574- rebuild
1575
1576* Fri Jun  4 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-6
1577- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
1578
1579* Tue Jun  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-5
1580- rebuild
1581
1582* Tue Jun  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-4
1583- apply patch from MITKRB5-SA-2004-001 (#125001)
1584
1585* Wed May 12 2004 Thomas Woerner <twoerner@redhat.com> 1.3.3-3
1586- removed rpath
1587
1588* Thu Apr 15 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
1589- re-enable large file support, fell out in 1.3-1
1590- patch rcp to use long long and %%lld format specifiers when reporting file
1591  sizes on large files
1592
1593* Tue Apr 13 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-1
1594- update to 1.3.3
1595
1596* Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.2-1
1597- update to 1.3.2
1598
1599* Mon Mar  8 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-12
1600- rebuild
1601
1602* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com> 1.3.1-11.1
1603- rebuilt
1604
1605* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com> 1.3.1-11
1606- rebuilt
1607
1608* Mon Feb  9 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-10
1609- catch krb4 send_to_kdc cases in kdc preference patch
1610
1611* Mon Feb  2 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
1612- remove patch to set TERM in klogind which, combined with the upstream fix in
1613  1.3.1, actually produces the bug now (#114762)
1614
1615* Mon Jan 19 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
1616- when iterating over lists of interfaces which are "up" from getifaddrs(),
1617  skip over those which have no address (#113347)
1618
1619* Mon Jan 12 2004 Nalin Dahyabhai <nalin@redhat.com>
1620- prefer the kdc which last replied to a request when sending requests to kdcs
1621
1622* Mon Nov 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-7
1623- fix combination of --with-netlib and --enable-dns (#82176)
1624
1625* Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>
1626- remove libdefault ticket_lifetime option from the default krb5.conf, it is
1627  ignored by libkrb5
1628
1629* Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-6
1630- fix bug in patch to make rlogind start login with a clean environment a la
1631  netkit rlogin, spotted and fixed by Scott McClung
1632
1633* Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-5
1634- include profile.d scriptlets in krb5-devel so that krb5-config will be in
1635  the path if krb5-workstation isn't installed, reported by Kir Kolyshkin
1636
1637* Mon Sep  8 2003 Nalin Dahyabhai <nalin@redhat.com>
1638- add more etypes (arcfour) to the default enctype list in kdc.conf
1639- don't apply previous patch, refused upstream
1640
1641* Fri Sep  5 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-4
1642- fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials
1643
1644* Wed Sep 3 2003 Dan Walsh <dwalsh@redhat.com> 1.3.1-3
1645- Don't check for write access on /etc/krb5.conf if SELinux
1646
1647* Tue Aug 26 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-2
1648- fixup some int/pointer varargs wackiness
1649
1650* Tue Aug  5 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-1
1651- rebuild
1652
1653* Mon Aug  4 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-0
1654- update to 1.3.1
1655
1656* Thu Jul 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-2
1657- pull fix for non-compliant encoding of salt field in etype-info2 preauth
1658  data from 1.3.1 beta 1, until 1.3.1 is released.
1659
1660* Mon Jul 21 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-1
1661- update to 1.3
1662
1663* Mon Jul  7 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.8-4
1664- correctly use stdargs
1665
1666* Wed Jun 18 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-0.beta.4
1667- test update to 1.3 beta 4
1668- ditch statglue build option
1669- krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err
1670
1671* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
1672- rebuilt
1673
1674* Wed May 21 2003 Jeremy Katz <katzj@redhat.com> 1.2.8-2
1675- gcc 3.3 doesn't implement varargs.h, include stdarg.h instead
1676
1677* Wed Apr  9 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.8-1
1678- update to 1.2.8
1679
1680* Mon Mar 31 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-14
1681- fix double-free of enc_part2 in krb524d
1682
1683* Fri Mar 21 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-13
1684- update to latest patch kit for MITKRB5-SA-2003-004
1685
1686* Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-12
1687- add patch included in MITKRB5-SA-2003-003 (CAN-2003-0028)
1688
1689* Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-11
1690- add patches from patchkit from MITKRB5-SA-2003-004 (CAN-2003-0138 and
1691  CAN-2003-0139)
1692
1693* Thu Mar  6 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-10
1694- rebuild
1695
1696* Thu Mar  6 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-9
1697- fix buffer underrun in unparsing certain principals (CAN-2003-0082)
1698
1699* Tue Feb  4 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-8
1700- add patch to document the reject-bad-transited option in kdc.conf
1701
1702* Mon Feb  3 2003 Nalin Dahyabhai <nalin@redhat.com>
1703- add patch to fix server-side crashes when principals have no
1704  components (CAN-2003-0072)
1705
1706* Thu Jan 23 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-7
1707- add patch from Mark Cox for exploitable bugs in ftp client
1708
1709* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
1710- rebuilt
1711
1712* Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-5
1713- use PICFLAGS when building code from the ktany patch
1714
1715* Thu Jan  9 2003 Bill Nottingham <notting@redhat.com> 1.2.7-4
1716- debloat
1717
1718* Tue Jan  7 2003 Jeremy Katz <katzj@redhat.com> 1.2.7-3
1719- include .so.* symlinks as well as .so.*.*
1720
1721* Mon Dec  9 2002 Jakub Jelinek <jakub@redhat.com> 1.2.7-2
1722- always #include <errno.h> to access errno, never do it directly
1723- enable LFS on a bunch of other 32-bit arches
1724
1725* Wed Dec  4 2002 Nalin Dahyabhai <nalin@redhat.com>
1726- increase the maximum name length allowed by kuserok() to the higher value
1727  used in development versions
1728
1729* Mon Dec  2 2002 Nalin Dahyabhai <nalin@redhat.com>
1730- install src/krb524/README as README.krb524 in the -servers package,
1731  includes information about converting for AFS principals
1732
1733* Fri Nov 15 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-1
1734- update to 1.2.7
1735- disable use of tcl
1736
1737* Mon Nov 11 2002 Nalin Dahyabhai <nalin@redhat.com>
1738- update to 1.2.7-beta2 (internal only, not for release), dropping dnsparse
1739  and kadmind4 fixes
1740
1741* Wed Oct 23 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-5
1742- add patch for buffer overflow in kadmind4 (not used by default)
1743
1744* Fri Oct 11 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-4
1745- drop a hunk from the dnsparse patch which is actually redundant (thanks to
1746  Tom Yu)
1747
1748* Wed Oct  9 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-3
1749- patch to handle truncated dns responses
1750
1751* Mon Oct  7 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-2
1752- remove hashless key types from the default kdc.conf, they're not supposed to
1753  be there, noted by Sam Hartman on krbdev
1754
1755* Fri Sep 27 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-1
1756- update to 1.2.6
1757
1758* Fri Sep 13 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-7
1759- use %%{_lib} for the sake of multilib systems
1760
1761* Fri Aug  2 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-6
1762- add patch from Tom Yu for exploitable bugs in rpc code used in kadmind
1763
1764* Tue Jul 23 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-5
1765- fix bug in krb5.csh which would cause the path check to always succeed
1766
1767* Fri Jul 19 2002 Jakub Jelinek <jakub@redhat.com> 1.2.5-4
1768- build even libdb.a with -fPIC and $RPM_OPT_FLAGS.
1769
1770* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
1771- automated rebuild
1772
1773* Sun May 26 2002 Tim Powers <timp@redhat.com>
1774- automated rebuild
1775
1776* Wed May  1 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-1
1777- update to 1.2.5
1778- disable statglue
1779
1780* Fri Mar  1 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.4-1
1781- update to 1.2.4
1782
1783* Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-5
1784- rebuild in new environment
1785- reenable statglue
1786
1787* Sat Jan 26 2002 Florian La Roche <Florian.LaRoche@redhat.de>
1788- prereq chkconfig for the server subpackage
1789
1790* Wed Jan 16 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-3
1791- build without -g3, which gives us large static libraries in -devel
1792
1793* Tue Jan 15 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-2
1794- reintroduce ld.so.conf munging in the -libs %%post
1795
1796* Thu Jan 10 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-1
1797- rename the krb5 package back to krb5-libs; the previous rename caused
1798  something of an uproar
1799- update to 1.2.3, which includes the FTP and telnetd fixes
1800- configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
1801  the default behavior instead of enabling the feature (the feature is enabled
1802  by --enable-dns, which we still use)
1803- reenable optimizations on Alpha
1804- support more encryption types in the default kdc.conf (heads-up from post
1805  to comp.protocols.kerberos by Jason Heiss)
1806
1807* Fri Aug  3 2001 Nalin Dahyabhai <nalin@redhat.com> 1.2.2-14
1808- rename the krb5-libs package to krb5 (naming a subpackage -libs when there
1809  is no main package is silly)
1810- move defaults for PAM to the appdefaults section of krb5.conf -- this is
1811  the area where the krb5_appdefault_* functions look for settings)
1812- disable statglue (warning: breaks binary compatibility with previous
1813  packages, but has to be broken at some point to work correctly with
1814  unpatched versions built with newer versions of glibc)
1815
1816* Fri Aug  3 2001 Nalin Dahyabhai <nalin@redhat.com> 1.2.2-13
1817- bump release number and rebuild
1818
1819* Wed Aug  1 2001 Nalin Dahyabhai <nalin@redhat.com>
1820- add patch to fix telnetd vulnerability
1821
1822* Fri Jul 20 2001 Nalin Dahyabhai <nalin@redhat.com>
1823- tweak statglue.c to fix stat/stat64 aliasing problems
1824- be cleaner in use of gcc to build shlibs
1825
1826* Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com>
1827- use gcc to build shared libraries
1828
1829* Wed Jun 27 2001 Nalin Dahyabhai <nalin@redhat.com>
1830- add patch to support "ANY" keytab type (i.e.,
1831  "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
1832  patch from Gerald Britton, #42551)
1833- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
1834- patch ftpd to use long long and %%lld format specifiers to support the SIZE
1835  command on large files (also #30697)
1836- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
1837- implement reload in krb5kdc and kadmind init scripts (#41911)
1838- lose the krb5server init script (not using it any more)
1839
1840* Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
1841- Bump release + rebuild.
1842
1843* Tue May 29 2001 Nalin Dahyabhai <nalin@redhat.com>
1844- pass some structures by address instead of on the stack in krb5kdc
1845
1846* Tue May 22 2001 Nalin Dahyabhai <nalin@redhat.com>
1847- rebuild in new environment
1848
1849* Thu Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
1850- add patch from Tom Yu to fix ftpd overflows (#37731)
1851
1852* Wed Apr 18 2001 Than Ngo <than@redhat.com>
1853- disable optimizations on the alpha again
1854
1855* Fri Mar 30 2001 Nalin Dahyabhai <nalin@redhat.com>
1856- add in glue code to make sure that libkrb5 continues to provide a
1857  weak copy of stat()
1858
1859* Thu Mar 15 2001 Nalin Dahyabhai <nalin@redhat.com>
1860- build alpha with -O0 for now
1861
1862* Thu Mar  8 2001 Nalin Dahyabhai <nalin@redhat.com>
1863- fix the kpropd init script
1864
1865* Mon Mar  5 2001 Nalin Dahyabhai <nalin@redhat.com>
1866- update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
1867- re-enable optimization on Alpha
1868
1869* Thu Feb  8 2001 Nalin Dahyabhai <nalin@redhat.com>
1870- build alpha with -O0 for now
1871- own %{_var}/kerberos
1872
1873* Tue Feb  6 2001 Nalin Dahyabhai <nalin@redhat.com>
1874- own the directories which are created for each package (#26342)
1875
1876* Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com>
1877- gettextize init scripts
1878
1879* Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com>
1880- add some comments to the ksu patches for the curious
1881- re-enable optimization on alphas
1882
1883* Mon Jan 15 2001 Nalin Dahyabhai <nalin@redhat.com>
1884- fix krb5-send-pr (#18932) and move it from -server to -workstation
1885- buildprereq libtermcap-devel
1886- temporariliy disable optimization on alphas
1887- gettextize init scripts
1888
1889* Tue Dec  5 2000 Nalin Dahyabhai <nalin@redhat.com>
1890- force -fPIC
1891
1892* Fri Dec  1 2000 Nalin Dahyabhai <nalin@redhat.com>
1893- rebuild in new environment
1894
1895* Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
1896- add bison as a BuildPrereq (#20091)
1897
1898* Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com>
1899- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000)
1900
1901* Thu Oct  5 2000 Nalin Dahyabhai <nalin@redhat.com>
1902- apply kpasswd bug fixes from David Wragg
1903
1904* Wed Oct  4 2000 Nalin Dahyabhai <nalin@redhat.com>
1905- make krb5-libs obsolete the old krb5-configs package (#18351)
1906- don't quit from the kpropd init script if there's no principal database so
1907  that you can propagate the first time without running kpropd manually
1908- don't complain if /etc/ld.so.conf doesn't exist in the -libs %post
1909
1910* Tue Sep 12 2000 Nalin Dahyabhai <nalin@redhat.com>
1911- fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
1912  (#11588)
1913- fix heap corruption bug in FTP client (#14301)
1914
1915* Wed Aug 16 2000 Nalin Dahyabhai <nalin@redhat.com>
1916- fix summaries and descriptions
1917- switched the default transfer protocol from PORT to PASV as proposed on
1918  bugzilla (#16134), and to match the regular ftp package's behavior
1919
1920* Wed Jul 19 2000 Jeff Johnson <jbj@redhat.com>
1921- rebuild to compress man pages.
1922
1923* Sat Jul 15 2000 Bill Nottingham <notting@redhat.com>
1924- move initscript back
1925
1926* Fri Jul 14 2000 Nalin Dahyabhai <nalin@redhat.com>
1927- disable servers by default to keep linuxconf from thinking they need to be
1928  started when they don't
1929
1930* Thu Jul 13 2000 Prospector <bugzilla@redhat.com>
1931- automatic rebuild
1932
1933* Mon Jul 10 2000 Nalin Dahyabhai <nalin@redhat.com>
1934- change cleanup code in post to not tickle chkconfig
1935- add grep as a Prereq: for -libs
1936
1937* Thu Jul  6 2000 Nalin Dahyabhai <nalin@redhat.com>
1938- move condrestarts to postun
1939- make xinetd configs noreplace
1940- add descriptions to xinetd configs
1941- add /etc/init.d as a prereq for the -server package
1942- patch to properly truncate $TERM in krlogind
1943
1944* Fri Jun 30 2000 Nalin Dahyabhai <nalin@redhat.com>
1945- update to 1.2.1
1946- back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
1947- start using the official source tarball instead of its contents
1948
1949* Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
1950- Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
1951- pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
1952  compatible with other stuff in 6.2, so no need)
1953
1954* Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
1955- tweak graceful start/stop logic in post and preun
1956
1957* Mon Jun 26 2000 Nalin Dahyabhai <nalin@redhat.com>
1958- update to the 1.2 release
1959- ditch a lot of our patches which went upstream
1960- enable use of DNS to look up things at build-time
1961- disable use of DNS to look up things at run-time in default krb5.conf
1962- change ownership of the convert-config-files script to root.root
1963- compress PS docs
1964- fix some typos in the kinit man page
1965- run condrestart in server post, and shut down in preun
1966
1967* Mon Jun 19 2000 Nalin Dahyabhai <nalin@redhat.com>
1968- only remove old krb5server init script links if the init script is there
1969
1970* Sat Jun 17 2000 Nalin Dahyabhai <nalin@redhat.com>
1971- disable kshell and eklogin by default
1972
1973* Thu Jun 15 2000 Nalin Dahyabhai <nalin@redhat.com>
1974- patch mkdir/rmdir problem in ftpcmd.y
1975- add condrestart option to init script
1976- split the server init script into three pieces and add one for kpropd
1977
1978* Wed Jun 14 2000 Nalin Dahyabhai <nalin@redhat.com>
1979- make sure workstation servers are all disabled by default
1980- clean up krb5server init script
1981
1982* Fri Jun  9 2000 Nalin Dahyabhai <nalin@redhat.com>
1983- apply second set of buffer overflow fixes from Tom Yu
1984- fix from Dirk Husung for a bug in buffer cleanups in the test suite
1985- work around possibly broken rev binary in running test suite
1986- move default realm configs from /var/kerberos to %{_var}/kerberos
1987
1988* Tue Jun  6 2000 Nalin Dahyabhai <nalin@redhat.com>
1989- make ksu and v4rcp owned by root
1990
1991* Sat Jun  3 2000 Nalin Dahyabhai <nalin@redhat.com>
1992- use %%{_infodir} to better comply with FHS
1993- move .so files to -devel subpackage
1994- tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
1995- fix package descriptions again
1996
1997* Wed May 24 2000 Nalin Dahyabhai <nalin@redhat.com>
1998- change a LINE_MAX to 1024, fix from Ken Raeburn
1999- add fix for login vulnerability in case anyone rebuilds without krb4 compat
2000- add tweaks for byte-swapping macros in krb.h, also from Ken
2001- add xinetd config files
2002- make rsh and rlogin quieter
2003- build with debug to fix credential forwarding
2004- add rsh as a build-time req because the configure scripts look for it to
2005  determine paths
2006
2007* Wed May 17 2000 Nalin Dahyabhai <nalin@redhat.com>
2008- fix config_subpackage logic
2009
2010* Tue May 16 2000 Nalin Dahyabhai <nalin@redhat.com>
2011- remove setuid bit on v4rcp and ksu in case the checks previously added
2012  don't close all of the problems in ksu
2013- apply patches from Jeffrey Schiller to fix overruns Chris Evans found
2014- reintroduce configs subpackage for use in the errata
2015- add PreReq: sh-utils
2016
2017* Mon May 15 2000 Nalin Dahyabhai <nalin@redhat.com>
2018- fix double-free in the kdc (patch merged into MIT tree)
2019- include convert-config-files script as a documentation file
2020
2021* Wed May 03 2000 Nalin Dahyabhai <nalin@redhat.com>
2022- patch ksu man page because the -C option never works
2023- add access() checks and disable debug mode in ksu
2024- modify default ksu build arguments to specify more directories in CMD_PATH
2025  and to use getusershell()
2026
2027* Wed May 03 2000 Bill Nottingham <notting@redhat.com>
2028- fix configure stuff for ia64
2029
2030* Mon Apr 10 2000 Nalin Dahyabhai <nalin@redhat.com>
2031- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
2032- change Requires: for/in subpackages to include %{version}
2033
2034* Wed Apr 05 2000 Nalin Dahyabhai <nalin@redhat.com>
2035- add man pages for kerberos(1), kvno(1), .k5login(5)
2036- add kvno to -workstation
2037
2038* Mon Apr 03 2000 Nalin Dahyabhai <nalin@redhat.com>
2039- Merge krb5-configs back into krb5-libs.  The krb5.conf file is marked as
2040  a %%config file anyway.
2041- Make krb5.conf a noreplace config file.
2042
2043* Thu Mar 30 2000 Nalin Dahyabhai <nalin@redhat.com>
2044- Make klogind pass a clean environment to children, like NetKit's rlogind does.
2045
2046* Wed Mar 08 2000 Nalin Dahyabhai <nalin@redhat.com>
2047- Don't enable the server by default.
2048- Compress info pages.
2049- Add defaults for the PAM module to krb5.conf
2050
2051* Mon Mar 06 2000 Nalin Dahyabhai <nalin@redhat.com>
2052- Correct copyright: it's exportable now, provided the proper paperwork is
2053  filed with the government.
2054
2055* Fri Mar 03 2000 Nalin Dahyabhai <nalin@redhat.com>
2056- apply Mike Friedman's patch to fix format string problems
2057- don't strip off argv[0] when invoking regular rsh/rlogin
2058
2059* Thu Mar 02 2000 Nalin Dahyabhai <nalin@redhat.com>
2060- run kadmin.local correctly at startup
2061
2062* Mon Feb 28 2000 Nalin Dahyabhai <nalin@redhat.com>
2063- pass absolute path to kadm5.keytab if/when extracting keys at startup
2064
2065* Sat Feb 19 2000 Nalin Dahyabhai <nalin@redhat.com>
2066- fix info page insertions
2067
2068* Wed Feb  9 2000 Nalin Dahyabhai <nalin@redhat.com>
2069- tweak server init script to automatically extract kadm5 keys if
2070  /var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
2071- adjust package descriptions
2072
2073* Thu Feb  3 2000 Nalin Dahyabhai <nalin@redhat.com>
2074- fix for potentially gzipped man pages
2075
2076* Fri Jan 21 2000 Nalin Dahyabhai <nalin@redhat.com>
2077- fix comments in krb5-configs
2078
2079* Fri Jan  7 2000 Nalin Dahyabhai <nalin@redhat.com>
2080- move /usr/kerberos/bin to end of PATH
2081
2082* Tue Dec 28 1999 Nalin Dahyabhai <nalin@redhat.com>
2083- install kadmin header files
2084
2085* Tue Dec 21 1999 Nalin Dahyabhai <nalin@redhat.com>
2086- patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
2087- add installation of info docs
2088- remove krb4 compat patch because it doesn't fix workstation-side servers
2089
2090* Mon Dec 20 1999 Nalin Dahyabhai <nalin@redhat.com>
2091- remove hesiod dependency at build-time
2092
2093* Sun Dec 19 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2094- rebuild on 1.1.1
2095
2096* Thu Oct  7 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2097- clean up init script for server, verify that it works [jlkatz]
2098- clean up rotation script so that rc likes it better
2099- add clean stanza
2100
2101* Mon Oct  4 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2102- backed out ncurses and makeshlib patches
2103- update for krb5-1.1
2104- add KDC rotation to rc.boot, based on ideas from Michael's C version
2105
2106* Sun Sep 26 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2107- added -lncurses to telnet and telnetd makefiles
2108
2109* Mon Jul  5 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2110- added krb5.csh and krb5.sh to /etc/profile.d
2111
2112* Tue Jun 22 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2113- broke out configuration files
2114
2115* Mon Jun 14 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2116- fixed server package so that it works now
2117
2118* Sat May 15 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
2119- started changelog (previous package from zedz.net)
2120- updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
2121- added --force to makeinfo commands to skip errors during build
Note: See TracBrowser for help on using the repository browser.