From fc2622be8ec2d48b845e280a57d1ac77f0690ebf Mon Sep 17 00:00:00 2001 From: James Antill Date: Mon, 20 Feb 2023 01:59:54 -0500 Subject: [PATCH] Import rpm: 3b6c131308478ebdaa7cc39b275bd860695074ad --- .gitignore | 1 + ...ove-Werror-in-upstream-build-scripts.patch | 31 + 0002-fix-PIDFile-handling.patch | 108 ++ ...port-loading-cert-hardware-token-PKC.patch | 88 ++ ...ler-optimalization-level-O2-for-perl.patch | 26 + 0005-Init-openssl-engine-properly.patch | 41 + 0006-Fix-ALPACA-security-issue.patch | 96 ++ 0007-Enable-TLSv1.3-by-default.patch | 173 +++ 404.html | 120 ++ 50x.html | 120 ++ README.dynamic | 20 + UPGRADE-NOTES-1.6-to-1.10 | 88 ++ gating.yaml | 9 + macros.nginxmods.in | 20 + maxim.key | 69 ++ mdounin.key | 33 + nginx-1.14.0-logs-perm.patch | 13 + nginx-1.14.1-perl-module-hardening.patch | 13 + nginx-1.16.0-pkcs11.patch | 29 + nginx-1.18.0-pkcs11-cert.patch | 76 ++ nginx-1.20.0-enable-tls1v3-by-default.patch | 157 +++ nginx-auto-cc-gcc.patch | 13 + nginx-logo.png | Bin 0 -> 368 bytes nginx-upgrade | 19 + nginx-upgrade.8 | 151 +++ nginx.conf | 84 ++ nginx.logrotate | 14 + nginx.service | 21 + nginx.spec | 1019 +++++++++++++++++ nginxmods.attr | 2 + nginxmods.req | 6 + sb.key | 41 + sources | 1 + 33 files changed, 2702 insertions(+) create mode 100644 .gitignore create mode 100644 0001-remove-Werror-in-upstream-build-scripts.patch create mode 100644 0002-fix-PIDFile-handling.patch create mode 100644 0003-Support-loading-cert-hardware-token-PKC.patch create mode 100644 0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch create mode 100644 0005-Init-openssl-engine-properly.patch create mode 100644 0006-Fix-ALPACA-security-issue.patch create mode 100644 0007-Enable-TLSv1.3-by-default.patch create mode 100644 404.html create mode 100644 50x.html create mode 100644 README.dynamic create mode 100644 UPGRADE-NOTES-1.6-to-1.10 create mode 100644 gating.yaml create mode 100644 macros.nginxmods.in create mode 100644 maxim.key create mode 100644 mdounin.key create mode 100644 nginx-1.14.0-logs-perm.patch create mode 100644 nginx-1.14.1-perl-module-hardening.patch create mode 100644 nginx-1.16.0-pkcs11.patch create mode 100644 nginx-1.18.0-pkcs11-cert.patch create mode 100644 nginx-1.20.0-enable-tls1v3-by-default.patch create mode 100644 nginx-auto-cc-gcc.patch create mode 100644 nginx-logo.png create mode 100644 nginx-upgrade create mode 100644 nginx-upgrade.8 create mode 100644 nginx.conf create mode 100644 nginx.logrotate create mode 100644 nginx.service create mode 100644 nginx.spec create mode 100644 nginxmods.attr create mode 100644 nginxmods.req create mode 100644 sb.key create mode 100644 sources diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4e4f490 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/nginx-1.20.1.tar.gz diff --git a/0001-remove-Werror-in-upstream-build-scripts.patch b/0001-remove-Werror-in-upstream-build-scripts.patch new file mode 100644 index 0000000..2695031 --- /dev/null +++ b/0001-remove-Werror-in-upstream-build-scripts.patch @@ -0,0 +1,31 @@ +From 00cab63102084b89de0a3494a1d023c4b1d4982b Mon Sep 17 00:00:00 2001 +From: Felix Kaechele +Date: Sun, 7 Jun 2020 12:14:02 -0400 +Subject: [PATCH 1/2] remove Werror in upstream build scripts + +removes -Werror in upstream build scripts. -Werror conflicts with +-D_FORTIFY_SOURCE=2 causing warnings to turn into errors. + +Signed-off-by: Felix Kaechele +--- + auto/cc/gcc | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/auto/cc/gcc b/auto/cc/gcc +index a5c5c18..cdbbadb 100644 +--- a/auto/cc/gcc ++++ b/auto/cc/gcc +@@ -166,7 +166,9 @@ esac + + + # stop on warning +-CFLAGS="$CFLAGS -Werror" ++# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx ++# to not compile. ++#CFLAGS="$CFLAGS -Werror" + + # debug + CFLAGS="$CFLAGS -g" +-- +2.31.1 + diff --git a/0002-fix-PIDFile-handling.patch b/0002-fix-PIDFile-handling.patch new file mode 100644 index 0000000..5748b63 --- /dev/null +++ b/0002-fix-PIDFile-handling.patch @@ -0,0 +1,108 @@ +From 62470498cca9a209aa9904668c1949f5229123af Mon Sep 17 00:00:00 2001 +From: Felix Kaechele +Date: Tue, 20 Apr 2021 21:28:18 -0400 +Subject: [PATCH 2/2] fix PIDFile handling + +Corresponding RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1869026 + +Rejected upstream: https://trac.nginx.org/nginx/ticket/1897 + +Taken from: https://git.launchpad.net/ubuntu/+source/nginx/tree/debian/patches/nginx-fix-pidfile.patch + +From original patch: +Author: Tj +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1581864 +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876365 +iLast-Update: 2020-06-24 + +Signed-off-by: Felix Kaechele +--- + src/core/nginx.c | 24 +++++++++++++++++++++--- + src/os/unix/ngx_daemon.c | 8 ++++++-- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/src/core/nginx.c b/src/core/nginx.c +index 48a20e9..32c0afe 100644 +--- a/src/core/nginx.c ++++ b/src/core/nginx.c +@@ -339,14 +339,21 @@ main(int argc, char *const *argv) + ngx_process = NGX_PROCESS_MASTER; + } + ++ /* tell-tale to detect if this is parent or child process */ ++ ngx_int_t child_pid = NGX_BUSY; ++ + #if !(NGX_WIN32) + + if (ngx_init_signals(cycle->log) != NGX_OK) { + return 1; + } + ++ /* tell-tale that this code has been executed */ ++ child_pid--; ++ + if (!ngx_inherited && ccf->daemon) { +- if (ngx_daemon(cycle->log) != NGX_OK) { ++ child_pid = ngx_daemon(cycle->log); ++ if (child_pid == NGX_ERROR) { + return 1; + } + +@@ -359,8 +366,19 @@ main(int argc, char *const *argv) + + #endif + +- if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) { +- return 1; ++ /* If ngx_daemon() returned the child's PID in the parent process ++ * after the fork() set ngx_pid to the child_pid, which gets ++ * written to the PID file, then exit. ++ * For NGX_WIN32 always write the PID file ++ * For others, only write it from the parent process */ ++ if (child_pid < NGX_OK || child_pid > NGX_OK) { ++ ngx_pid = child_pid > NGX_OK ? child_pid : ngx_pid; ++ if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) { ++ return 1; ++ } ++ } ++ if (child_pid > NGX_OK) { ++ exit(0); + } + + if (ngx_log_redirect_stderr(cycle) != NGX_OK) { +diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c +index 385c49b..3719854 100644 +--- a/src/os/unix/ngx_daemon.c ++++ b/src/os/unix/ngx_daemon.c +@@ -7,14 +7,17 @@ + + #include + #include ++#include + + + ngx_int_t + ngx_daemon(ngx_log_t *log) + { + int fd; ++ /* retain the return value for passing back to caller */ ++ pid_t pid_child = fork(); + +- switch (fork()) { ++ switch (pid_child) { + case -1: + ngx_log_error(NGX_LOG_EMERG, log, ngx_errno, "fork() failed"); + return NGX_ERROR; +@@ -23,7 +26,8 @@ ngx_daemon(ngx_log_t *log) + break; + + default: +- exit(0); ++ /* let caller do the exit() */ ++ return pid_child; + } + + ngx_parent = ngx_pid; +-- +2.31.1 + diff --git a/0003-Support-loading-cert-hardware-token-PKC.patch b/0003-Support-loading-cert-hardware-token-PKC.patch new file mode 100644 index 0000000..2d09c16 --- /dev/null +++ b/0003-Support-loading-cert-hardware-token-PKC.patch @@ -0,0 +1,88 @@ +From 4e5f12d6584536ead82d20554d8f3f2ab0107b0b Mon Sep 17 00:00:00 2001 +From: Lubos Uhliarik +Date: Fri, 30 Apr 2021 13:07:45 +0000 +Subject: [PATCH 3/3] Support loading certificates from hardware token (PKCS#11) + +--- + src/event/ngx_event_openssl.c | 65 +++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index d762d6b..270b200 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -617,6 +617,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert, + X509 *x509, *temp; + u_long n; + ++ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) { ++ ++#ifndef OPENSSL_NO_ENGINE ++ ++ u_char *p, *last; ++ ENGINE *engine; ++ ++ p = cert->data + sizeof("engine:") - 1; ++ last = (u_char *) ngx_strchr(p, ':'); ++ ++ if (last == NULL) { ++ *err = "invalid syntax"; ++ return NULL; ++ } ++ ++ *last = '\0'; ++ ++ engine = ENGINE_by_id((char *) p); ++ ++ if (engine == NULL) { ++ *err = "ENGINE_by_id() failed"; ++ return NULL; ++ } ++ ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ *last++ = ':'; ++ ++ struct { ++ const char *cert_id; ++ X509 *cert; ++ } params = { (char *) last, NULL }; ++ ++ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) { ++ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ ENGINE_finish(engine); ++ ENGINE_free(engine); ++ ++ /* set chain to null */ ++ ++ *chain = sk_X509_new_null(); ++ if (*chain == NULL) { ++ *err = "sk_X509_new_null() failed"; ++ X509_free(params.cert); ++ return NULL; ++ } ++ ++ return params.cert; ++ ++#else ++ ++ *err = "loading \"engine:...\" certificate is not supported"; ++ return NULL; ++ ++#endif ++ } ++ + if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) { + + bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1, +-- +2.26.3 + diff --git a/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch b/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch new file mode 100644 index 0000000..e59dd58 --- /dev/null +++ b/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch @@ -0,0 +1,26 @@ +From 80c0ee172cceaef933ff5a451ec2a16213e03996 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 22 Sep 2021 15:55:39 +0200 +Subject: [PATCH] Set proper compiler optimalization level (O2) for perl + module. + +--- + src/http/modules/perl/Makefile.PL | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL +index 7edadcb..2ebb7c4 100644 +--- a/src/http/modules/perl/Makefile.PL ++++ b/src/http/modules/perl/Makefile.PL +@@ -14,7 +14,7 @@ WriteMakefile( + AUTHOR => 'Igor Sysoev', + + CCFLAGS => "$ENV{NGX_PM_CFLAGS}", +- OPTIMIZE => '-O', ++ OPTIMIZE => '-O2', + + LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}", + +-- +2.31.1 + diff --git a/0005-Init-openssl-engine-properly.patch b/0005-Init-openssl-engine-properly.patch new file mode 100644 index 0000000..99dc0a9 --- /dev/null +++ b/0005-Init-openssl-engine-properly.patch @@ -0,0 +1,41 @@ +From a769a35a6197c76390e1dd8f5054d426fbbbda05 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 22 Sep 2021 16:12:58 +0200 +Subject: [PATCH] Init openssl engine properly + +--- + src/event/ngx_event_openssl.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 270b200..f813458 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -798,16 +798,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, + return NULL; + } + ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ + *last++ = ':'; + + pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0); + + if (pkey == NULL) { + *err = "ENGINE_load_private_key() failed"; ++ ENGINE_finish(engine); + ENGINE_free(engine); + return NULL; + } + ++ ENGINE_finish(engine); + ENGINE_free(engine); + + return pkey; +-- +2.31.1 + diff --git a/0006-Fix-ALPACA-security-issue.patch b/0006-Fix-ALPACA-security-issue.patch new file mode 100644 index 0000000..754e8cc --- /dev/null +++ b/0006-Fix-ALPACA-security-issue.patch @@ -0,0 +1,96 @@ +From ee8ea4f1c88a0393206769cd30a545dc3375f868 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 2 Feb 2022 20:14:55 +0100 +Subject: [PATCH] Fix ALPACA security issue + +--- + src/mail/ngx_mail.h | 3 +++ + src/mail/ngx_mail_core_module.c | 10 ++++++++++ + src/mail/ngx_mail_handler.c | 15 ++++++++++++++- + 3 files changed, 27 insertions(+), 1 deletion(-) + +diff --git a/src/mail/ngx_mail.h b/src/mail/ngx_mail.h +index b865a3b..76cae37 100644 +--- a/src/mail/ngx_mail.h ++++ b/src/mail/ngx_mail.h +@@ -115,6 +115,8 @@ typedef struct { + ngx_msec_t timeout; + ngx_msec_t resolver_timeout; + ++ ngx_uint_t max_errors; ++ + ngx_str_t server_name; + + u_char *file_name; +@@ -231,6 +233,7 @@ typedef struct { + ngx_uint_t command; + ngx_array_t args; + ++ ngx_uint_t errors; + ngx_uint_t login_attempt; + + /* used to parse POP3/IMAP/SMTP command */ +diff --git a/src/mail/ngx_mail_core_module.c b/src/mail/ngx_mail_core_module.c +index 4083124..115671c 100644 +--- a/src/mail/ngx_mail_core_module.c ++++ b/src/mail/ngx_mail_core_module.c +@@ -85,6 +85,13 @@ static ngx_command_t ngx_mail_core_commands[] = { + offsetof(ngx_mail_core_srv_conf_t, resolver_timeout), + NULL }, + ++ { ngx_string("max_errors"), ++ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, ++ ngx_conf_set_num_slot, ++ NGX_MAIL_SRV_CONF_OFFSET, ++ offsetof(ngx_mail_core_srv_conf_t, max_errors), ++ NULL }, ++ + ngx_null_command + }; + +@@ -163,6 +170,8 @@ ngx_mail_core_create_srv_conf(ngx_conf_t *cf) + cscf->timeout = NGX_CONF_UNSET_MSEC; + cscf->resolver_timeout = NGX_CONF_UNSET_MSEC; + ++ cscf->max_errors = NGX_CONF_UNSET_UINT; ++ + cscf->resolver = NGX_CONF_UNSET_PTR; + + cscf->file_name = cf->conf_file->file.name.data; +@@ -182,6 +191,7 @@ ngx_mail_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_msec_value(conf->resolver_timeout, prev->resolver_timeout, + 30000); + ++ ngx_conf_merge_uint_value(conf->max_errors, prev->max_errors, 5); + + ngx_conf_merge_str_value(conf->server_name, prev->server_name, ""); + +diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c +index 0aaa0e7..71b8151 100644 +--- a/src/mail/ngx_mail_handler.c ++++ b/src/mail/ngx_mail_handler.c +@@ -871,7 +871,20 @@ ngx_mail_read_command(ngx_mail_session_t *s, ngx_connection_t *c) + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + +- if (rc == NGX_IMAP_NEXT || rc == NGX_MAIL_PARSE_INVALID_COMMAND) { ++ if (rc == NGX_MAIL_PARSE_INVALID_COMMAND) { ++ ++ s->errors++; ++ ++ if (s->errors >= cscf->max_errors) { ++ ngx_log_error(NGX_LOG_INFO, c->log, 0, ++ "client sent too many invalid commands"); ++ s->quit = 1; ++ } ++ ++ return rc; ++ } ++ ++ if (rc == NGX_IMAP_NEXT) { + return rc; + } + +-- +2.31.1 + diff --git a/0007-Enable-TLSv1.3-by-default.patch b/0007-Enable-TLSv1.3-by-default.patch new file mode 100644 index 0000000..c8bac0b --- /dev/null +++ b/0007-Enable-TLSv1.3-by-default.patch @@ -0,0 +1,173 @@ +From cc7b92c61a2833ff9dc2b4dfba4591966769da78 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Tue, 21 Jun 2022 13:55:04 +0200 +Subject: [PATCH] Enable TLSv1.3 by default in nginx + +--- + src/event/ngx_event_openssl.c | 77 ++++++++++++++------------ + src/event/ngx_event_openssl.h | 1 + + src/http/modules/ngx_http_ssl_module.c | 3 +- + src/mail/ngx_mail_ssl_module.c | 3 +- + src/stream/ngx_stream_ssl_module.c | 3 +- + 5 files changed, 46 insertions(+), 41 deletions(-) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index f813458..2e6a6c0 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log) + ngx_int_t + ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + { ++ ngx_uint_t prot = NGX_SSL_NO_PROT; ++ + ssl->ctx = SSL_CTX_new(SSLv23_method()); + + if (ssl->ctx == NULL) { +@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + + SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); + +-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL +- /* only in 0.9.8m+ */ +- SSL_CTX_clear_options(ssl->ctx, +- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1); +-#endif +- +- if (!(protocols & NGX_SSL_SSLv2)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2); +- } +- if (!(protocols & NGX_SSL_SSLv3)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3); +- } +- if (!(protocols & NGX_SSL_TLSv1)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1); +- } +-#ifdef SSL_OP_NO_TLSv1_1 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1); +- if (!(protocols & NGX_SSL_TLSv1_1)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1); +- } ++ if (protocols){ ++#ifdef SSL_OP_NO_TLSv1_3 ++ if (protocols & NGX_SSL_TLSv1_3) { ++ prot = TLS1_3_VERSION; ++ } else + #endif + #ifdef SSL_OP_NO_TLSv1_2 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2); +- if (!(protocols & NGX_SSL_TLSv1_2)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2); +- } ++ if (protocols & NGX_SSL_TLSv1_2) { ++ prot = TLS1_2_VERSION; ++ } else + #endif +-#ifdef SSL_OP_NO_TLSv1_3 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3); +- if (!(protocols & NGX_SSL_TLSv1_3)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3); +- } ++#ifdef SSL_OP_NO_TLSv1_1 ++ if (protocols & NGX_SSL_TLSv1_1) { ++ prot = TLS1_1_VERSION; ++ } else + #endif ++ if (protocols & NGX_SSL_TLSv1) { ++ prot = TLS1_VERSION; ++ } ++ ++ if (prot == NGX_SSL_NO_PROT) { ++ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, ++ "No SSL protocols available [hint: ssl_protocols]"); ++ return NGX_ERROR; ++ } + +-#ifdef SSL_CTX_set_min_proto_version +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION); ++ SSL_CTX_set_max_proto_version(ssl->ctx, prot); ++ ++ /* Now, we have to scan for minimal protocol version, ++ *without allowing holes between min and max*/ ++#ifdef SSL_OP_NO_TLSv1_3 ++ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) { ++ prot = TLS1_2_VERSION; ++ } + #endif + +-#ifdef TLS1_3_VERSION +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION); ++#ifdef SSL_OP_NO_TLSv1_1 ++ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) { ++ prot = TLS1_1_VERSION; ++ } ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 ++ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) { ++ prot = TLS1_VERSION; ++ } + #endif ++ SSL_CTX_set_min_proto_version(ssl->ctx, prot); ++ } + + #ifdef SSL_OP_NO_COMPRESSION + SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); +diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h +index 329760d..5cee113 100644 +--- a/src/event/ngx_event_openssl.h ++++ b/src/event/ngx_event_openssl.h +@@ -152,6 +152,7 @@ typedef struct { + #endif + + ++#define NGX_SSL_NO_PROT 0x0000 + #define NGX_SSL_SSLv2 0x0002 + #define NGX_SSL_SSLv3 0x0004 + #define NGX_SSL_TLSv1 0x0008 +diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c +index a47d696..94f30db 100644 +--- a/src/http/modules/ngx_http_ssl_module.c ++++ b/src/http/modules/ngx_http_ssl_module.c +@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0) + + ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, + NGX_SSL_BUFSIZE); +diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c +index 7eae83e..8328560 100644 +--- a/src/mail/ngx_mail_ssl_module.c ++++ b/src/mail/ngx_mail_ssl_module.c +@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + prev->prefer_server_ciphers, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0); + + ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); + ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); +diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c +index d8c0471..cef590d 100644 +--- a/src/stream/ngx_stream_ssl_module.c ++++ b/src/stream/ngx_stream_ssl_module.c +@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + prev->prefer_server_ciphers, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0); + + ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); + ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); +-- +2.31.1 + diff --git a/404.html b/404.html new file mode 100644 index 0000000..c6014a7 --- /dev/null +++ b/404.html @@ -0,0 +1,120 @@ + + + + + The page is not found + + + + + +

nginx error!

+ +
+ +

The page you are looking for is not found.

+ +
+

Website Administrator

+
+

Something has triggered missing webpage on your + website. This is the default 404 error page for + nginx that is distributed with + Red Hat Enterprise Linux. It is located + /usr/share/nginx/html/404.html

+ +

You should customize this error page for your own + site or edit the error_page directive in + the nginx configuration file + /etc/nginx/nginx.conf.

+ +

For information on Red Hat Enterprise Linux, please visit the Red Hat, Inc. website. The documentation for Red Hat Enterprise Linux is available on the Red Hat, Inc. website.

+ +
+
+ +
+ [ Powered by nginx ] + [ Powered by Red Hat Enterprise Linux ] +
+
+ + diff --git a/50x.html b/50x.html new file mode 100644 index 0000000..5d8d957 --- /dev/null +++ b/50x.html @@ -0,0 +1,120 @@ + + + + + The page is temporarily unavailable + + + + + +

nginx error!

+ +
+ +

The page you are looking for is temporarily unavailable. Please try again later.

+ +
+

Website Administrator

+
+

Something has triggered missing webpage on your + website. This is the default error page for + nginx that is distributed with + Red Hat Enterprise Linux. It is located + /usr/share/nginx/html/50x.html

+ +

You should customize this error page for your own + site or edit the error_page directive in + the nginx configuration file + /etc/nginx/nginx.conf.

+ +

For information on Red Hat Enterprise Linux, please visit the Red Hat, Inc. website. The documentation for Red Hat Enterprise Linux is available on the Red Hat, Inc. website.

+ +
+
+ +
+ [ Powered by nginx ] + [ Powered by Red Hat Enterprise Linux ] +
+
+ + diff --git a/README.dynamic b/README.dynamic new file mode 100644 index 0000000..59f03f6 --- /dev/null +++ b/README.dynamic @@ -0,0 +1,20 @@ +############### +Dynamic modules +############### + +Dynamic modules are loaded using the "load_modules" directive. The RPM package +for each module has a '.conf' file in the /usr/share/nginx/modules directory. +The '.conf' file contains a single "load_modules" directive. + +This means that whenever a new dynamic module is installed, it will +automatically be enabled and Nginx will be reloaded. + +-------------------------------------------------------- +Prevent dynamic modules from being enabled automatically +-------------------------------------------------------- + +You may want to avoid dynamic modules being enabled automatically. Simply +remove this line from the top of /etc/nginx/nginx.conf: + + include /usr/lib64/nginx/modules/*.conf; + diff --git a/UPGRADE-NOTES-1.6-to-1.10 b/UPGRADE-NOTES-1.6-to-1.10 new file mode 100644 index 0000000..65760bf --- /dev/null +++ b/UPGRADE-NOTES-1.6-to-1.10 @@ -0,0 +1,88 @@ +############# +Upgrade notes +############# + +To resolve numerous security flaws, the nginx package was updated to 1.10.x. + +You should review your configuration files in /etc/nginx to determine if there +are any incompatibilities. Below is a summary of the main incompatible changes. +Some nginx directives have been changed or removed, so you may need to modify +your configuration. + +Please see upstream release notes for a complete list of new features, +bug fixes, and changes: http://nginx.org/en/CHANGES-1.10 +One notable feature is support for HTTP/2. + +Nginx gained support for dynamic modules. As part of this update, dynamic +modules have been split into subpackages. For the time being these are hard +dependencies to aid the upgrade path. When you install nginx, all of these +modules are installed and enabled by default: + - nginx-mod-http-geoip + - nginx-mod-http-image-filter + - nginx-mod-http-perl + - nginx-mod-http-xslt-filter + - nginx-mod-mail + - nginx-mod-stream + +Changes with nginx 1.10.x + + *) Change: non-idempotent requests (POST, LOCK, PATCH) are no longer + passed to the next server by default if a request has been sent to a + backend; the "non_idempotent" parameter of the "proxy_next_upstream" + directive explicitly allows retrying such requests. + + *) Change: now the "output_buffers" directive uses two buffers by + default. + + *) Change: now nginx limits subrequests recursion, not simultaneous + subrequests. + + *) Change: now nginx checks the whole cache key when returning a + response from cache. + Thanks to Gena Makhomed and Sergey Brester. + + *) Change: the "proxy_downstream_buffer" and "proxy_upstream_buffer" + directives of the stream module are replaced with the + "proxy_buffer_size" directive. + + *) Change: duplicate "http", "mail", and "stream" blocks are now + disallowed. + + *) Change: now SSLv3 protocol is disabled by default. + + *) Change: some long deprecated directives are not supported anymore. + + *) Change: obsolete aio and rtsig event methods have been removed. + +Changes with nginx 1.8.x + + *) Change: the "sendfile" parameter of the "aio" directive is + deprecated; now nginx automatically uses AIO to pre-load data for + sendfile if both "aio" and "sendfile" directives are used. + + *) Change: now the "If-Modified-Since", "If-Range", etc. client request + header lines are passed to a backend while caching if nginx knows in + advance that the response will not be cached (e.g., when using + proxy_cache_min_uses). + + *) Change: now after proxy_cache_lock_timeout nginx sends a request to a + backend with caching disabled; the new directives + "proxy_cache_lock_age", "fastcgi_cache_lock_age", + "scgi_cache_lock_age", and "uwsgi_cache_lock_age" specify a time + after which the lock will be released and another attempt to cache a + response will be made. + + *) Change: the "log_format" directive can now be used only at http + level. + + *) Change: now nginx takes into account the "Vary" header line in a + backend response while caching. + + *) Change: the deprecated "limit_zone" directive is not supported + anymore. + + *) Change: now the "stub_status" directive does not require a parameter. + + *) Change: URI escaping now uses uppercase hexadecimal digits. + Thanks to Piotr Sikora. + diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..2e4e68f --- /dev/null +++ b/gating.yaml @@ -0,0 +1,9 @@ +--- !Policy +product_versions: + - rhel-9 +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.acceptance-tier.functional} diff --git a/macros.nginxmods.in b/macros.nginxmods.in new file mode 100644 index 0000000..cd0ec45 --- /dev/null +++ b/macros.nginxmods.in @@ -0,0 +1,20 @@ +%_nginx_abiversion @@NGINX_ABIVERSION@@ +%_nginx_srcdir @@NGINX_SRCDIR@@ +%_nginx_buildsrcdir nginx-src +%_nginx_modsrcdir .. +%_nginx_modbuilddir ../%{_vpath_builddir} +%nginx_moddir @@NGINX_MODDIR@@ +%nginx_modconfdir @@NGINX_MODCONFDIR@@ + +%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion} + +%nginx_modconfigure(:-:) \\\ + %undefine _strict_symbol_defs_build \ + cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \ + cd "%{_nginx_buildsrcdir}" \ + nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \ + ./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\ + --add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \ + cd - + +%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} modules diff --git a/maxim.key b/maxim.key new file mode 100644 index 0000000..479efbe --- /dev/null +++ b/maxim.key @@ -0,0 +1,69 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF4TqFoBEADNbls05thIAYVVKdMDRdtzGk7HXGqx60u/kh4BL9HskUpyYFTp +N07RJ1TyyusfD7I3skuGHvtQhqdTwHPDEPL5qrAnHps9XWUQrtU7hflcIKt43iDe +TvfVVhN0nPir2++C4qvNnrC/UCisyz00H/I9mobl2qzyKyLT8BnUBVuXDfOTlUCY +oF4z5BieOMvg1DZNKFDnK67ZuO4JXgtMlu4Q3tFd7qSWCWGuCuAGgn6eWFYMzCbB +rPyBYwb7xyycQzqmJiD7Qm9OeVHmZj5rG5hGM14MyTSUVJle0U+CJCF9lmfVuR/c +ySy7WmQgIg327x5Y5xa3pKZAvIAycnDabAk/08p59BG7UdAi2S7+2SicAH89/81V +g4BI4mZp+IuxaP+S+ckaRf1CUvRAJuLTqUeBSuOzjag+ibD6rqusuZ1MZqLxnXyu +gAztNDcmEFa/pqp5bgWbrlTF6zKt4cQf+a/JqFGatsfSzmrIyIZ6GEqgb8oXDDIt +Z1AqsTfp6ZBC1vITE9+b0zBw6qq/nGD0Iq47Vp1VxmlxmnoeR4ir8z/oSukPulLU +K3IqkmRNGEilINrtBt5jFbBlx8kwdCYvxEF6ymibBBqvwwv65jrrKheBQm+HrrVS +aMQmo4Qzj/h/ZLL9KENHibNwUypJnvwEvw0YkAyjICvoNzDUsM+92+B/ewARAQAB +tCFNYXhpbSBLb25vdmFsb3YgPG1heGltQG5naW54LmNvbT6JAlcEEwEKAEECGwMF +CwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEWIQRB25JxPTv0v/PukQacXn+i9Ul3 +1AUCXhgw1wUJBagi/QAKCRCcXn+i9Ul31LltD/40KNFPvDaORz35udrm0cyVIgbI +lq7Vswfo5JIr8MyJ+VKJFQ2n2JiQT8QbX52Sy5P80ktSAFqcT3vtWB7bI6RfJ8Jx +YM/w3XKnNMoUt7Q/cqZK5Ra/csmaCWqP4UVUvUBjHvly0MpnE1kxEDUglrcyVKjt +fxB/GXeUpKOELXG44zvW2CP9Mce0FbDxrh8iCai9MK+2oSt1aJV+gONLWscRgsc7 +6q9/4KUXByt0qxScYPRQRIaxpIA8sCno21owcMOf8aQtun6Ytf+UIovl9DmK2pRm +Ifc2JruW1Jx2r7z955ZFNgTA380jEL85dWbgbHF/pYPlwcTCnaAf294kefjrX9DN +rejbZZ3Fh2QGs0tWW5+wncVWndq4jLQTeamUdzw5MPpOh+bZoHT+7z1PDGWe+PIn +DTbfaFYL7MsXwScMUsexKLOoDO6KKpZjcsw9/b5JsJmP73ZEj02BjRudapObiRxm +MtDl8Zmpg7ZUqMHEuUzyEyI5nSWu4njjrWJO0CnsjLpv2UxAbxDn1NGc/DoyxM1l +4SQv4AJuSLo1x7PTRb9V9HkWqxXf+yCkNpV9UjmlrH104gWL6sof6rX8Jo6k+Sz+ +yyQHcVbrJ95Y3hQU7QMMnotzVbL7BRtWMtDYTp7q+gYbZ0s+YRXjaHcA5IuV65tM +tEPwGpOCofQ2avkdqIhdBBARCgAdFiEEZVBsAu/CUPG3o9aU7PDpCywXIIMFAl4T +qXUACgkQ7PDpCywXIIN5CQCgyNFrUBGlUvH9QlDSE/umzoyXW/UAn0ve2/HzpMVN +uPMAAgnHYE2R0eiEtCNNYXhpbSBLb25vdmFsb3YgPG1heGltQEZyZWVCU0Qub3Jn +PokCVAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBEHbknE9O/S/ +8+6RBpxef6L1SXfUBQJeGDDXBQkFqCL9AAoJEJxef6L1SXfUJ/IQALtwaB7mlBUB +NdzqQRIZAVSnJZ2w6+Iul7Ax4gKrqWj6SvL/5jEdZm65D0kjxJIHq+dO+lJIMLzp +rBkfZ0kkxOPQ1rw/QR31qHLAibknrwIQQVtzFvVg4iW7IZefx6WGbJJC5IbjBUBf +HATqbXmMAcLILh9+t4q7Qvwi2b8ZIsC37cktthad7j4kvXqV5BJ4I+PoDT0CcW48 +wgTfMwhib52pLMu3Ghk56kwHBtYSHUDrA4KWRzRHxQ+RoUXLIdtmMRbp8ztwBMJZ ++J/9TLrb3YHUidS3l2nE55l9dJZycCU2EOAhJMbFKbmfW/9we/Sm+vnoALGExepl +FgdGz2NTqPA4ha2y2rBC73TSkfM+4amIrr6kSbeofjQL/w5+fhxAvM5oXuzffPK9 +8IR31d66JUTjeueobguzh9ApeHElmihimRJk0KP+NVAMNCIZmlMuOXHPwnCajcBh +Sh9kFGy6tPPPZYQOHSm5KvyjIJDfmkFfJ5ybazkmsGhZMzQs4ZHItC1jf0vYCqsr +d3eVEQesy5nDlSC2lWK84R+J+qTL82ZbCc/VZMniCBCC9xIvEOU9gtIH+58vF8dq +l/jTmGp2h1/kHlJfn0cnxKJDzn2IG16jqR7VdWQEO5hjEMaZdxhM1jPGRdkM82fB +Wwv8BLBpgBstyQlxJ/NNO5+dCtZYWRcviF0EEBEKAB0WIQRlUGwC78JQ8bej1pTs +8OkLLBcggwUCXhOpbwAKCRDs8OkLLBcgg/jfAKCO7DIiB2DGBfLCFftmyuZJN2A6 +ZgCfV/cclX++mLyiyYqr2BXnrQk4NVG5Ag0EXhOoWgEQAOmkirptbymUR2JP9DrP +e7aELbUw4bcMx4/nQo1QyKxjDhUdgUui4OiqxmhMjT2IlgFvcYsMeLiYGa/EdBkd +Yq4DtEwc++2eybFQA1z6Hrk+sxdd8neN4azUa5sqVvUwenQ7UMPclSQJaE1nVGCZ +KKVyNsK36RJrE0JfdmE1zKZFWmTCTZ/D/hTCq+hjMpCV+VWFaz3h4S+XsZiBgLB4 ++zmyHjyU6E+ecELvAHoXwMbAPiFzzms824Fc1BKHjnc8BBzfUVdIBGhxOVNHDSj3 +oxPsiBnuvSlQMlGx0YNLw/tTfw+CFOot5o/KIq9svUp8W9mdj6kKaqBLNxpjHbhQ +yvVSK7O5uS62emMHkRwgu1tmP98d3bGlXRn+S+2MCuyqdFaK40B6vnkPnXpl5ggE +w8JoH11ahNeJ5tX8/JpX/0aQmapt7CKwcgELJap+Qp8i/MFXef7FK/nE0lFIL95o +l9uthd/beX6dz/EEw61lC17Opd3y0N+Dy+eJ0wbULdgKrblZ0PxsumLeICGLs7/P +O9/3nQHJRjmFaVG10t5bL/77gvQ4l7HcuLS1GGHh+RM6EsFuuiqI+aFcDFyRITli +g0QRq4y/C6nqhTWEyYriIi8Dq6JxXisklC1WvSIgPwq1/msmrbiKcJZFPoNtMVtO +dzL3naM5IWOa290R541GjkEVABEBAAGJAjwEGAEKACYCGwwWIQRB25JxPTv0v/Pu +kQacXn+i9Ul31AUCXhgw/QUJBagjIwAKCRCcXn+i9Ul31MQDEACeO6ZBLEWswuyU +RErntoHkY6wIkpfMiERjgfqbNkrdBgXg8dT7kPsXFEtv3ZccjPbsRecJaXdmwGab +mp9MUDYG3SiqgFNriJTv2WECzgYKrZQg38JVwfl7OHPaV2fwZvG56a4qKpIZ3wIg +4acfEPkHQ2ygpKnEJD4IsEK225PtYq5lmNfntvDhbuTPh2vY8T9w0udGCzp4JS60 +zLeGGat+52PislEtrSa2B7zSMzGmOqDidaDbEfzdzL+IteZHWDGmYNQ8yICIv6Wj +A80k7uhzDWJf5RMQSNybBykrlWSooaVrBWHgDky5ldAQjDtVrMkBpzglH8FQ44i+ +la9caRDfw0Lfxg52vV4eXtpSHAYx3cFREEW9xpTOwOE7Qg0JyHAkUKNb8DJgyehC +BjSeeiMFiZX1plyYFrUAB8dVXi9Z7kqOjTpfYU6kAxDXzQhlqqgYRwoFJQcsQ1Ll +jKptAs6glmDx8dJcjUrK/eH24GGg46eGv2wxY4+sItXfLQ2oeU4uh/vORjvgeeNp +er4z5KLuKxwgpaobavtRZmZSZdGrdC93Si27dpSRiWYn1csoTxG0zZhUVFFW68I4 +I5PIdJwblvxayVKdg0aVW/RwDsOLH0twVxwnOPSjLPEB2IwGnlX6rN38cRnibPXM +yh4LsaVRdhbFe9aNd/O5iNgDcQtCUg== +=/pFc +-----END PGP PUBLIC KEY BLOCK----- diff --git a/mdounin.key b/mdounin.key new file mode 100644 index 0000000..bbf2ca1 --- /dev/null +++ b/mdounin.key @@ -0,0 +1,33 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (FreeBSD) + +mQENBE7SKu8BCADQo6x4ZQfAcPlJMLmL8zBEBUS6GyKMMMDtrTh3Yaq481HB54oR +0cpKL05Ff9upjrIzLD5TJUCzYYM9GQOhguDUP8+ZU9JpSz3yO2TvH7WBbUZ8FADf +hblmmUBLNgOWgLo3W+FYhl3mz1GFS2Fvid6Tfn02L8CBAj7jxbjL1Qj/OA/WmLLc +m6BMTqI7IBlYW2vyIOIHasISGiAwZfp0ucMeXXvTtt14LGa8qXVcFnJTdwbf03AS +ljhYrQnKnpl3VpDAoQt8C68YCwjaNJW59hKqWB+XeIJ9CW98+EOAxLAFszSyGanp +rCqPd0numj9TIddjcRkTA/ZbmCWK+xjpVBGXABEBAAG0IU1heGltIERvdW5pbiA8 +bWRvdW5pbkBtZG91bmluLnJ1PokBOAQTAQIAIgUCTtIq7wIbAwYLCQgHAwIGFQgC +CQoLBBYCAwECHgECF4AACgkQUgqZk6HAUvj+iwf/b4FS6zVzJ5T0v1vcQGD4ZzXe +D5xMC4BJW414wVMU15rfX7aCdtoCYBNiApPxEd7SwiyxWRhRA9bikUq87JEgmnyV +0iYbHZvCvc1jOkx4WR7E45t1Mi29KBoPaFXA9X5adZkYcOQLDxa2Z8m6LGXnlF6N +tJkxQ8APrjZsdrbDvo3HxU9muPcq49ydzhgwfLwpUs11LYkwB0An9WRPuv3jporZ +/XgI6RfPMZ5NIx+FRRCjn6DnfHboY9rNF6NzrOReJRBhXCi6I+KkHHEnMoyg8XET +9lVkfHTOl81aIZqrAloX3/00TkYWyM2zO9oYpOg6eUFCX/Lw4MJZsTcT5EKVxIhG +BBARAgAGBQJO01Y/AAoJEOzw6QssFyCDVyQAn3qwTZlcZgyyzWu9Cs8gJ0CXREaS +AJ92QjGLT9DijTcbB+q9OS/nl16Z/IhGBBARAgAGBQJO02JDAAoJEKk3YTmlJMU+ +P64AnjCKEXFelSVMtgefJk3+vpyt3QX1AKCH9M3MbTWPeDUL+MpULlfdyfvjj7kB +DQRO0irvAQgA0LjCc8S6oZzjiap2MjRNhRFA5BYjXZRZBdKF2VP74avt2/RELq8G +W0n7JWmKn6vvrXabEGLyfkCngAhTq9tJ/K7LPx/bmlO5+jboO/1inH2BTtLiHjAX +vicXZk3oaZt2Sotx5mMI3yzpFQRVqZXsi0LpUTPJEh3oS8IdYRjslQh1A7P5hfCZ +wtzwb/hKm8upODe/ITUMuXeWfLuQj/uEU6wMzmfMHb+jlYMWtb+v98aJa2FODeKP +mWCXLa7bliXp1SSeBOEfIgEAmjM6QGlDx5sZhr2Ss2xSPRdZ8DqD7oiRVzmstX1Y +oxEzC0yXfaefC7SgM0nMnaTvYEOYJ9CH3wARAQABiQEfBBgBAgAJBQJO0irvAhsM +AAoJEFIKmZOhwFL4844H/jo8icCcS6eOWvnen7lg0FcCo1fIm4wW3tEmkQdchSHE +CJDq7pgTloN65pwB5tBoT47cyYNZA9eTfJVgRc74q5cexKOYrMC3KuAqWbwqXhkV +s0nkWxnOIidTHSXvBZfDFA4Idwte94Thrzf8Pn8UESudTiqrWoCBXk2UyVsl03gJ +blSJAeJGYPPeo+Yj6m63OWe2+/S2VTgmbPS/RObn0Aeg7yuff0n5+ytEt2KL51gO +QE2uIxTCawHr12PsllPkbqPk/PagIttfEJqn9b0CrqPC3HREePb2aMJ/Ctw/76CO +wn0mtXeIXLCTvBmznXfaMKllsqbsy2nCJ2P2uJjOntw= +=Tavt +-----END PGP PUBLIC KEY BLOCK----- diff --git a/nginx-1.14.0-logs-perm.patch b/nginx-1.14.0-logs-perm.patch new file mode 100644 index 0000000..4884a84 --- /dev/null +++ b/nginx-1.14.0-logs-perm.patch @@ -0,0 +1,13 @@ +diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c +index aee7a58..bcceecb 100644 +--- a/src/core/ngx_cycle.c ++++ b/src/core/ngx_cycle.c +@@ -1108,7 +1108,7 @@ ngx_reopen_files(ngx_cycle_t *cycle, ngx_uid_t user) + } + + fd = ngx_open_file(file[i].name.data, NGX_FILE_APPEND, +- NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS); ++ NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS | 0220); + + ngx_log_debug3(NGX_LOG_DEBUG_EVENT, cycle->log, 0, + "reopen file \"%s\", old:%d new:%d", diff --git a/nginx-1.14.1-perl-module-hardening.patch b/nginx-1.14.1-perl-module-hardening.patch new file mode 100644 index 0000000..1915ebe --- /dev/null +++ b/nginx-1.14.1-perl-module-hardening.patch @@ -0,0 +1,13 @@ +diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL +index 7edadcb..2ebb7c4 100644 +--- a/src/http/modules/perl/Makefile.PL ++++ b/src/http/modules/perl/Makefile.PL +@@ -14,7 +14,7 @@ WriteMakefile( + AUTHOR => 'Igor Sysoev', + + CCFLAGS => "$ENV{NGX_PM_CFLAGS}", +- OPTIMIZE => '-O', ++ OPTIMIZE => '-O2', + + LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}", + diff --git a/nginx-1.16.0-pkcs11.patch b/nginx-1.16.0-pkcs11.patch new file mode 100644 index 0000000..b367d5b --- /dev/null +++ b/nginx-1.16.0-pkcs11.patch @@ -0,0 +1,29 @@ +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 7be4fb4..ab3865a 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -727,16 +727,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, + return NULL; + } + ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ + *last++ = ':'; + + pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0); + + if (pkey == NULL) { + *err = "ENGINE_load_private_key() failed"; ++ ENGINE_finish(engine); + ENGINE_free(engine); + return NULL; + } + ++ ENGINE_finish(engine); + ENGINE_free(engine); + + return pkey; diff --git a/nginx-1.18.0-pkcs11-cert.patch b/nginx-1.18.0-pkcs11-cert.patch new file mode 100644 index 0000000..c862515 --- /dev/null +++ b/nginx-1.18.0-pkcs11-cert.patch @@ -0,0 +1,76 @@ +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 0a2f260..606b6e2 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -616,6 +616,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert, + X509 *x509, *temp; + u_long n; + ++ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) { ++ ++#ifndef OPENSSL_NO_ENGINE ++ ++ u_char *p, *last; ++ ENGINE *engine; ++ ++ p = cert->data + sizeof("engine:") - 1; ++ last = (u_char *) ngx_strchr(p, ':'); ++ ++ if (last == NULL) { ++ *err = "invalid syntax"; ++ return NULL; ++ } ++ ++ *last = '\0'; ++ ++ engine = ENGINE_by_id((char *) p); ++ ++ if (engine == NULL) { ++ *err = "ENGINE_by_id() failed"; ++ return NULL; ++ } ++ ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ *last++ = ':'; ++ ++ struct { ++ const char *cert_id; ++ X509 *cert; ++ } params = { (char *) last, NULL }; ++ ++ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) { ++ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ ENGINE_finish(engine); ++ ENGINE_free(engine); ++ ++ /* set chain to null */ ++ ++ *chain = sk_X509_new_null(); ++ if (*chain == NULL) { ++ *err = "sk_X509_new_null() failed"; ++ X509_free(params.cert); ++ return NULL; ++ } ++ ++ return params.cert; ++ ++#else ++ ++ *err = "loading \"engine:...\" certificate is not supported"; ++ return NULL; ++ ++#endif ++ } ++ + if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) { + + bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1, diff --git a/nginx-1.20.0-enable-tls1v3-by-default.patch b/nginx-1.20.0-enable-tls1v3-by-default.patch new file mode 100644 index 0000000..4140222 --- /dev/null +++ b/nginx-1.20.0-enable-tls1v3-by-default.patch @@ -0,0 +1,157 @@ +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 2b0c5e6..9278087 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log) + ngx_int_t + ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + { ++ ngx_uint_t prot = NGX_SSL_NO_PROT; ++ + ssl->ctx = SSL_CTX_new(SSLv23_method()); + + if (ssl->ctx == NULL) { +@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + + SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); + +-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL +- /* only in 0.9.8m+ */ +- SSL_CTX_clear_options(ssl->ctx, +- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1); +-#endif +- +- if (!(protocols & NGX_SSL_SSLv2)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2); +- } +- if (!(protocols & NGX_SSL_SSLv3)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3); +- } +- if (!(protocols & NGX_SSL_TLSv1)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1); +- } +-#ifdef SSL_OP_NO_TLSv1_1 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1); +- if (!(protocols & NGX_SSL_TLSv1_1)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1); +- } ++ if (protocols){ ++#ifdef SSL_OP_NO_TLSv1_3 ++ if (protocols & NGX_SSL_TLSv1_3) { ++ prot = TLS1_3_VERSION; ++ } else + #endif + #ifdef SSL_OP_NO_TLSv1_2 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2); +- if (!(protocols & NGX_SSL_TLSv1_2)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2); +- } ++ if (protocols & NGX_SSL_TLSv1_2) { ++ prot = TLS1_2_VERSION; ++ } else + #endif +-#ifdef SSL_OP_NO_TLSv1_3 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3); +- if (!(protocols & NGX_SSL_TLSv1_3)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3); +- } ++#ifdef SSL_OP_NO_TLSv1_1 ++ if (protocols & NGX_SSL_TLSv1_1) { ++ prot = TLS1_1_VERSION; ++ } else + #endif ++ if (protocols & NGX_SSL_TLSv1) { ++ prot = TLS1_VERSION; ++ } ++ ++ if (prot == NGX_SSL_NO_PROT) { ++ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, ++ "No SSL protocols available [hint: ssl_protocols]"); ++ return NGX_ERROR; ++ } + +-#ifdef SSL_CTX_set_min_proto_version +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION); ++ SSL_CTX_set_max_proto_version(ssl->ctx, prot); ++ ++ /* Now, we have to scan for minimal protocol version, ++ *without allowing holes between min and max*/ ++#if SSL_OP_NO_TLSv1_3 ++ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) { ++ prot = TLS1_2_VERSION; ++ } + #endif + +-#ifdef TLS1_3_VERSION +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION); ++#ifdef SSL_OP_NO_TLSv1_1 ++ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) { ++ prot = TLS1_1_VERSION; ++ } ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 ++ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) { ++ prot = TLS1_VERSION; ++ } + #endif ++ SSL_CTX_set_min_proto_version(ssl->ctx, prot); ++ } + + #ifdef SSL_OP_NO_COMPRESSION + SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); +diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h +index 329760d..5cee113 100644 +--- a/src/event/ngx_event_openssl.h ++++ b/src/event/ngx_event_openssl.h +@@ -152,6 +152,7 @@ typedef struct { + #endif + + ++#define NGX_SSL_NO_PROT 0x0000 + #define NGX_SSL_SSLv2 0x0002 + #define NGX_SSL_SSLv3 0x0004 + #define NGX_SSL_TLSv1 0x0008 +diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c +index a47d696..94f30db 100644 +--- a/src/http/modules/ngx_http_ssl_module.c ++++ b/src/http/modules/ngx_http_ssl_module.c +@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0) + + ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, + NGX_SSL_BUFSIZE); +diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c +index 7eae83e..8328560 100644 +--- a/src/mail/ngx_mail_ssl_module.c ++++ b/src/mail/ngx_mail_ssl_module.c +@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + prev->prefer_server_ciphers, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0); + + ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); + ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); +diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c +index d8c0471..cef590d 100644 +--- a/src/stream/ngx_stream_ssl_module.c ++++ b/src/stream/ngx_stream_ssl_module.c +@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + prev->prefer_server_ciphers, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0); + + ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); + ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); diff --git a/nginx-auto-cc-gcc.patch b/nginx-auto-cc-gcc.patch new file mode 100644 index 0000000..ff693dc --- /dev/null +++ b/nginx-auto-cc-gcc.patch @@ -0,0 +1,13 @@ +--- auto/cc/gcc.orig 2007-03-22 08:34:53.000000000 -0600 ++++ auto/cc/gcc 2007-03-22 08:58:47.000000000 -0600 +@@ -172,7 +172,9 @@ + + + # stop on warning +-CFLAGS="$CFLAGS -Werror" ++# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx ++# to not compile. ++#CFLAGS="$CFLAGS -Werror" + + # debug + CFLAGS="$CFLAGS -g" diff --git a/nginx-logo.png b/nginx-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..638b4995def7c1b20d134b658b7329df6769085e GIT binary patch literal 368 zcmeAS@N?(olHy`uVBq!ia0vp^l|Zb($P6TTwz`@EDYgKg5Lbqo4FCWCuRMQi4^V`u zB*-uLKf}}Q23|lOW0JSK3*&z#-FrX|XMsm#F_88EW4Dvpb|AsB0>^Y94K|u#P4&@5 zK+XeC7sn8d^J^~}W*spQV7-vPWkH&wxWK$_osXeK6Il6wB)u!@t!LR;Z1`jOgl#vL za0mW$xHRAX!tcUAjC`@)hl^x(*@@L!t}r;{;cA-8w@%+8JFuvL^LC)e)>-SHEZEyn z-1R1b^Y#?aw`OyX9{j^(p8qU?>+~&;gWt{{J(zibRXL2^_L)*=;bu0=9ro69%B|Hc zPq>@1-(2N7sd;S}vxgnqobNjml)gXTA+()O?(s$LX|@xCd-7Z7DIeufdw;RG=fy4S zDH4Y}Yiqg<_eHg/dev/null` +/bin/kill -s QUIT $oldpid 2>/dev/null +sleep 5 +[ -f /run/nginx.pid.oldbin ] && sleep 10 +if [ -f /run/nginx.pid.oldbin ]; then + echo "Failed to stop old nginx master." + exit 1 +fi diff --git a/nginx-upgrade.8 b/nginx-upgrade.8 new file mode 100644 index 0000000..2a435ab --- /dev/null +++ b/nginx-upgrade.8 @@ -0,0 +1,151 @@ +.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16) +.\" +.\" Standard preamble: +.\" ======================================================================== +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Vb \" Begin verbatim text +.ft CW +.nf +.ne \\$1 +.. +.de Ve \" End verbatim text +.ft R +.fi +.. +.\" Set up some character translations and predefined strings. \*(-- will +.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +.\" double quote, and \*(R" will give a right double quote. \*(C+ will +.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +.\" nothing in troff, for use with C<>. +.tr \(*W- +.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +.ie n \{\ +. ds -- \(*W- +. ds PI pi +. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +. ds L" "" +. ds R" "" +. ds C` "" +. ds C' "" +'br\} +.el\{\ +. ds -- \|\(em\| +. ds PI \(*p +. ds L" `` +. ds R" '' +'br\} +.\" +.\" Escape single quotes in literal strings from groff's Unicode transform. +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" +.\" If the F register is turned on, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. +.ie \nF \{\ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" +.. +. nr % 0 +. rr F +.\} +.el \{\ +. de IX +.. +.\} +.\" +.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +.\" Fear. Run. Save yourself. No user-serviceable parts. +. \" fudge factors for nroff and troff +.if n \{\ +. ds #H 0 +. ds #V .8m +. ds #F .3m +. ds #[ \f1 +. ds #] \fP +.\} +.if t \{\ +. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +. ds #V .6m +. ds #F 0 +. ds #[ \& +. ds #] \& +.\} +. \" simple accents for nroff and troff +.if n \{\ +. ds ' \& +. ds ` \& +. ds ^ \& +. ds , \& +. ds ~ ~ +. ds / +.\} +.if t \{\ +. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' +.\} +. \" troff and (daisy-wheel) nroff accents +.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' +.ds 8 \h'\*(#H'\(*b\h'-\*(#H' +.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] +.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' +.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' +.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] +.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] +.ds ae a\h'-(\w'a'u*4/10)'e +.ds Ae A\h'-(\w'A'u*4/10)'E +. \" corrections for vroff +.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' +.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' +. \" for low resolution devices (crt and lpr) +.if \n(.H>23 .if \n(.V>19 \ +\{\ +. ds : e +. ds 8 ss +. ds o a +. ds d- d\h'-1'\(ga +. ds D- D\h'-1'\(hy +. ds th \o'bp' +. ds Th \o'LP' +. ds ae ae +. ds Ae AE +.\} +.rm #[ #] #H #V #F C +.\" ======================================================================== +.\" +.IX Title "NGINX-UPGRADE 8" +.TH NGINX-UPGRADE 8 "2012-10-28" " " " " +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.if n .ad l +.nh +.SH "NAME" +nginx\-upgrade \- tool to upgrade nginx without any downtime +.SH "SYNOPSIS" +.IX Header "SYNOPSIS" +\&\fInginx-upgrade\fR +.SH "DESCRIPTION" +.IX Header "DESCRIPTION" +This downstream shell script updates nginx without any downtime. After +upgrading nginx via the package manager, running this script will create +a new nginx master. This master takes over all new requests. The old +masters and workers are then gracefully shutdown without breaking any +existing connections. +.PP +For further information, see: +.SH "BUGS" +.IX Header "BUGS" +If you find any bugs, please send an email to the author. +.SH "AUTHOR" +.IX Header "AUTHOR" +Jamie Nguyen diff --git a/nginx.conf b/nginx.conf new file mode 100644 index 0000000..f85920a --- /dev/null +++ b/nginx.conf @@ -0,0 +1,84 @@ +# For more information on configuration, see: +# * Official English Documentation: http://nginx.org/en/docs/ +# * Official Russian Documentation: http://nginx.org/ru/docs/ + +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log; +pid /run/nginx.pid; + +# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. +include /usr/share/nginx/modules/*.conf; + +events { + worker_connections 1024; +} + +http { + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 4096; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + # Load modular configuration files from the /etc/nginx/conf.d directory. + # See http://nginx.org/en/docs/ngx_core_module.html#include + # for more information. + include /etc/nginx/conf.d/*.conf; + + server { + listen 80; + listen [::]:80; + server_name _; + root /usr/share/nginx/html; + + # Load configuration files for the default server block. + include /etc/nginx/default.d/*.conf; + + error_page 404 /404.html; + location = /40x.html { + } + + error_page 500 502 503 504 /50x.html; + location = /50x.html { + } + } + +# Settings for a TLS enabled server. +# +# server { +# listen 443 ssl http2; +# listen [::]:443 ssl http2; +# server_name _; +# root /usr/share/nginx/html; +# +# ssl_certificate "/etc/pki/nginx/server.crt"; +# ssl_certificate_key "/etc/pki/nginx/private/server.key"; +# ssl_session_cache shared:SSL:1m; +# ssl_session_timeout 10m; +# ssl_ciphers PROFILE=SYSTEM; +# ssl_prefer_server_ciphers on; +# +# # Load configuration files for the default server block. +# include /etc/nginx/default.d/*.conf; +# +# error_page 404 /404.html; +# location = /40x.html { +# } +# +# error_page 500 502 503 504 /50x.html; +# location = /50x.html { +# } +# } + +} + diff --git a/nginx.logrotate b/nginx.logrotate new file mode 100644 index 0000000..5ba0ca6 --- /dev/null +++ b/nginx.logrotate @@ -0,0 +1,14 @@ +/var/log/nginx/*log { + create 0664 nginx root + daily + rotate 10 + missingok + notifempty + compress + delaycompress + sharedscripts + postrotate + /bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true + endscript +} + diff --git a/nginx.service b/nginx.service new file mode 100644 index 0000000..8597eb4 --- /dev/null +++ b/nginx.service @@ -0,0 +1,21 @@ +[Unit] +Description=The nginx HTTP and reverse proxy server +After=network.target remote-fs.target nss-lookup.target + +[Service] +Type=forking +PIDFile=/run/nginx.pid +# Nginx will fail to start if /run/nginx.pid already exists but has the wrong +# SELinux context. This might happen when running `nginx -t` from the cmdline. +# https://bugzilla.redhat.com/show_bug.cgi?id=1268621 +ExecStartPre=/usr/bin/rm -f /run/nginx.pid +ExecStartPre=/usr/sbin/nginx -t +ExecStart=/usr/sbin/nginx +ExecReload=/bin/kill -s HUP $MAINPID +KillSignal=SIGQUIT +TimeoutStopSec=5 +KillMode=mixed +PrivateTmp=true + +[Install] +WantedBy=multi-user.target diff --git a/nginx.spec b/nginx.spec new file mode 100644 index 0000000..2a706e4 --- /dev/null +++ b/nginx.spec @@ -0,0 +1,1019 @@ +%global _hardened_build 1 +%global nginx_user nginx + +# Disable strict symbol checks in the link editor. +# See: https://src.fedoraproject.org/rpms/redhat-rpm-config/c/078af19 +%undefine _strict_symbol_defs_build + +%global with_gperftools 0 + +%bcond_with geoip + + +%global with_aio 1 + +%if 0%{?fedora} > 22 +%global with_mailcap_mimetypes 1 +%endif + +# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/ +%global nginx_abiversion %{version} + +%global nginx_moduledir %{_libdir}/nginx/modules +%global nginx_moduleconfdir %{_datadir}/nginx/modules +%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release} + +# Do not generate provides/requires from nginx sources +%global __provides_exclude_from ^%{nginx_srcdir}/.*$ +%global __requires_exclude_from ^%{nginx_srcdir}/.*$ + +Name: nginx +Epoch: 1 +Version: 1.20.1 +Release: 1%{?dist} + +Summary: A high performance web server and reverse proxy server +Group: System Environment/Daemons +# BSD License (two clause) +# http://www.freebsd.org/copyright/freebsd-license.html +License: BSD +URL: http://nginx.org/ + +Source0: https://nginx.org/download/nginx-%{version}.tar.gz +Source10: nginx.service +Source11: nginx.logrotate +Source12: nginx.conf +Source13: nginx-upgrade +Source14: nginx-upgrade.8 +Source15: macros.nginxmods.in +Source16: nginxmods.attr +Source17: nginxmods.req +Source102: nginx-logo.png +Source103: 404.html +Source104: 50x.html +Source200: README.dynamic +Source210: UPGRADE-NOTES-1.6-to-1.10 + +# removes -Werror in upstream build scripts. -Werror conflicts with +# -D_FORTIFY_SOURCE=2 causing warnings to turn into errors. +Patch0: nginx-auto-cc-gcc.patch + +# downstream patch - changing logs permissions to 664 instead +# previous 644 +Patch1: nginx-1.14.0-logs-perm.patch + +# PKCS#11 engine fix +Patch2: nginx-1.16.0-pkcs11.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=1655530 +Patch3: nginx-1.14.1-perl-module-hardening.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=1643647 +Patch4: nginx-1.20.0-enable-tls1v3-by-default.patch + +# https://bugzilla.redhat.com/show_bug.cgi?id=1668717 +Patch5: nginx-1.18.0-pkcs11-cert.patch + +%if 0%{?with_gperftools} +BuildRequires: gperftools-devel +%endif +BuildRequires: openssl-devel +BuildRequires: pcre-devel +BuildRequires: zlib-devel + +Requires: nginx-filesystem = %{epoch}:%{version}-%{release} +Requires: system-logos-httpd >= 82.0 + +%if 0%{?rhel} > 0 && 0%{?rhel} < 8 +# Introduced at 1:1.10.0-1 to ease upgrade path. To be removed later. +Requires: nginx-all-modules = %{epoch}:%{version}-%{release} +%endif + +Requires: openssl +Requires: pcre +Requires(pre): nginx-filesystem +%if 0%{?with_mailcap_mimetypes} +Requires: nginx-mimetypes +%endif +Provides: webserver + +BuildRequires: systemd +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +# For external nginx modules +Provides: nginx(abi) = %{nginx_abiversion} + +%description +Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and +IMAP protocols, with a strong focus on high concurrency, performance and low +memory usage. + +%package all-modules +Group: System Environment/Daemons +Summary: A meta package that installs all available Nginx modules +BuildArch: noarch + +%if %{with geoip} +Requires: nginx-mod-http-geoip = %{epoch}:%{version}-%{release} +%endif +Requires: nginx-mod-http-image-filter = %{epoch}:%{version}-%{release} +Requires: nginx-mod-http-perl = %{epoch}:%{version}-%{release} +Requires: nginx-mod-http-xslt-filter = %{epoch}:%{version}-%{release} +Requires: nginx-mod-mail = %{epoch}:%{version}-%{release} +Requires: nginx-mod-stream = %{epoch}:%{version}-%{release} + +%description all-modules +A meta package that installs all available Nginx modules. + +%package filesystem +Group: System Environment/Daemons +Summary: The basic directory layout for the Nginx server +BuildArch: noarch +Requires(pre): shadow-utils + +%description filesystem +The nginx-filesystem package contains the basic directory layout +for the Nginx server including the correct permissions for the +directories. + +%if %{with geoip} +%package mod-http-geoip +Group: System Environment/Daemons +Summary: Nginx HTTP geoip module +BuildRequires: GeoIP-devel +Requires: nginx(abi) = %{nginx_abiversion} +Requires: GeoIP + +%description mod-http-geoip +%{summary}. +%endif + +%package mod-http-image-filter +Group: System Environment/Daemons +Summary: Nginx HTTP image filter module +BuildRequires: gd-devel +Requires: nginx(abi) = %{nginx_abiversion} +Requires: gd + +%description mod-http-image-filter +%{summary}. + +%package mod-http-perl +Group: System Environment/Daemons +Summary: Nginx HTTP perl module +BuildRequires: perl-devel +%if 0%{?fedora} >= 24 +BuildRequires: perl-generators +%endif +BuildRequires: perl(ExtUtils::Embed) +Requires: nginx(abi) = %{nginx_abiversion} +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) +Requires: perl(constant) + +%description mod-http-perl +%{summary}. + +%package mod-http-xslt-filter +Group: System Environment/Daemons +Summary: Nginx XSLT module +BuildRequires: libxslt-devel +Requires: nginx(abi) = %{nginx_abiversion} + +%description mod-http-xslt-filter +%{summary}. + +%package mod-mail +Group: System Environment/Daemons +Summary: Nginx mail modules +Requires: nginx(abi) = %{nginx_abiversion} + +%description mod-mail +%{summary}. + +%package mod-stream +Group: System Environment/Daemons +Summary: Nginx stream modules +Requires: nginx(abi) = %{nginx_abiversion} + +%description mod-stream +%{summary}. + +%package mod-devel +Summary: Nginx module development files +Requires: nginx = %{epoch}:%{version}-%{release} +Requires: make +Requires: gcc +Requires: gd-devel +%if 0%{?with_gperftools} +Requires: gperftools-devel +%endif +%if %{with geoip} +Requires: GeoIP-devel +%endif +Requires: libxslt-devel +Requires: openssl-devel +Requires: pcre-devel +Requires: perl-devel +Requires: perl(ExtUtils::Embed) +Requires: zlib-devel + +%description mod-devel +%{summary}. + + +%prep +%setup -q +%patch0 -p0 +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 + +cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} . + +%if 0%{?rhel} > 0 && 0%{?rhel} < 8 +sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service +sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf +%endif + +# Prepare sources for installation +cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src +mv ../%{name}-%{version}-%{release}-src . + + +%build +# nginx does not utilize a standard configure script. It has its own +# and the standard configure options cause the nginx configure script +# to error out. This is is also the reason for the DESTDIR environment +# variable. +export DESTDIR=%{buildroot} +./configure \ + --prefix=%{_datadir}/nginx \ + --sbin-path=%{_sbindir}/nginx \ + --modules-path=%{nginx_moduledir} \ + --conf-path=%{_sysconfdir}/nginx/nginx.conf \ + --error-log-path=%{_localstatedir}/log/nginx/error.log \ + --http-log-path=%{_localstatedir}/log/nginx/access.log \ + --http-client-body-temp-path=%{_localstatedir}/lib/nginx/tmp/client_body \ + --http-proxy-temp-path=%{_localstatedir}/lib/nginx/tmp/proxy \ + --http-fastcgi-temp-path=%{_localstatedir}/lib/nginx/tmp/fastcgi \ + --http-uwsgi-temp-path=%{_localstatedir}/lib/nginx/tmp/uwsgi \ + --http-scgi-temp-path=%{_localstatedir}/lib/nginx/tmp/scgi \ + --pid-path=/run/nginx.pid \ + --lock-path=/run/lock/subsys/nginx \ + --user=%{nginx_user} \ + --group=%{nginx_user} \ +%if 0%{?with_aio} + --with-file-aio \ +%endif + --with-ipv6 \ + --with-http_ssl_module \ + --with-http_v2_module \ + --with-http_realip_module \ + --with-stream_ssl_preread_module \ + --with-http_addition_module \ + --with-http_xslt_module=dynamic \ + --with-http_image_filter_module=dynamic \ +%if %{with geoip} + --with-http_geoip_module=dynamic \ +%endif + --with-http_sub_module \ + --with-http_dav_module \ + --with-http_flv_module \ + --with-http_mp4_module \ + --with-http_gunzip_module \ + --with-http_gzip_static_module \ + --with-http_random_index_module \ + --with-http_secure_link_module \ + --with-http_degradation_module \ + --with-http_slice_module \ + --with-http_stub_status_module \ + --with-http_perl_module=dynamic \ + --with-http_auth_request_module \ + --with-mail=dynamic \ + --with-mail_ssl_module \ + --with-pcre \ + --with-pcre-jit \ + --with-stream=dynamic \ + --with-stream_ssl_module \ +%if 0%{?with_gperftools} + --with-google_perftools_module \ +%endif + --with-debug \ + --with-cc-opt="%{optflags} $(pcre-config --cflags)" \ + --with-compat \ + --with-ld-opt="$RPM_LD_FLAGS -Wl,-E" # so the perl module finds its symbols + +make %{?_smp_mflags} + + +%install +make install DESTDIR=%{buildroot} INSTALLDIRS=vendor + +find %{buildroot} -type f -name .packlist -exec rm -f '{}' \; +find %{buildroot} -type f -name perllocal.pod -exec rm -f '{}' \; +find %{buildroot} -type f -empty -exec rm -f '{}' \; +find %{buildroot} -type f -iname '*.so' -exec chmod 0755 '{}' \; + +install -p -D -m 0644 ./nginx.service \ + %{buildroot}%{_unitdir}/nginx.service +install -p -D -m 0644 %{SOURCE11} \ + %{buildroot}%{_sysconfdir}/logrotate.d/nginx + +install -p -d -m 0755 %{buildroot}%{_sysconfdir}/systemd/system/nginx.service.d +install -p -d -m 0755 %{buildroot}%{_unitdir}/nginx.service.d + +install -p -d -m 0755 %{buildroot}%{_sysconfdir}/nginx/conf.d +install -p -d -m 0755 %{buildroot}%{_sysconfdir}/nginx/default.d + +install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx +install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp +install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx + +install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html +install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir} +install -p -d -m 0755 %{buildroot}%{nginx_moduledir} + +install -p -m 0644 ./nginx.conf \ + %{buildroot}%{_sysconfdir}/nginx + +rm -f %{buildroot}%{_datadir}/nginx/html/index.html +ln -s ../../testpage/index.html \ + %{buildroot}%{_datadir}/nginx/html/index.html +install -p -m 0644 %{SOURCE102} \ + %{buildroot}%{_datadir}/nginx/html +ln -s nginx-logo.png %{buildroot}%{_datadir}/nginx/html/poweredby.png +mkdir -p %{buildroot}%{_datadir}/nginx/html/icons + +# Symlink for the powered-by-$DISTRO image: +ln -s ../../../pixmaps/poweredby.png \ + %{buildroot}%{_datadir}/nginx/html/icons/poweredby.png + +install -p -m 0644 %{SOURCE103} %{SOURCE104} \ + %{buildroot}%{_datadir}/nginx/html + +%if 0%{?with_mailcap_mimetypes} +rm -f %{buildroot}%{_sysconfdir}/nginx/mime.types +%endif + +install -p -D -m 0644 %{_builddir}/nginx-%{version}/objs/nginx.8 \ + %{buildroot}%{_mandir}/man8/nginx.8 + +install -p -D -m 0755 %{SOURCE13} %{buildroot}%{_bindir}/nginx-upgrade +install -p -D -m 0644 %{SOURCE14} %{buildroot}%{_mandir}/man8/nginx-upgrade.8 + +for i in ftdetect indent syntax; do + install -p -D -m644 contrib/vim/${i}/nginx.vim \ + %{buildroot}%{_datadir}/vim/vimfiles/${i}/nginx.vim +done + +%if %{with geoip} +echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf +%endif +echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf +echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf +echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf + +# Install files for supporting nginx module builds +## Install source files +mkdir -p %{buildroot}%{_usrsrc} +mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir} +## Install rpm macros +mkdir -p %{buildroot}%{_rpmmacrodir} +sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \ + -e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \ + -e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \ + -e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \ + %{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods +## Install dependency generator +install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16} +install -Dpm0755 -t %{buildroot}%{_rpmconfigdir} %{SOURCE17} + + +%pre filesystem +getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user} +getent passwd %{nginx_user} > /dev/null || \ + useradd -r -d %{_localstatedir}/lib/nginx -g %{nginx_user} \ + -s /sbin/nologin -c "Nginx web server" %{nginx_user} +exit 0 + +%post +%systemd_post nginx.service + +%if %{with geoip} +%post mod-http-geoip +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi +%endif + +%post mod-http-image-filter +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-http-perl +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-http-xslt-filter +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-mail +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-stream +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%preun +%systemd_preun nginx.service + +%postun +%systemd_postun nginx.service +if [ $1 -ge 1 ]; then + /usr/bin/nginx-upgrade >/dev/null 2>&1 || : +fi + +%files +%license LICENSE +%doc CHANGES README README.dynamic +%if 0%{?rhel} == 7 +%doc UPGRADE-NOTES-1.6-to-1.10 +%endif +%{_datadir}/nginx/html/* +%{_bindir}/nginx-upgrade +%{_sbindir}/nginx +%{_datadir}/vim/vimfiles/ftdetect/nginx.vim +%{_datadir}/vim/vimfiles/syntax/nginx.vim +%{_datadir}/vim/vimfiles/indent/nginx.vim +%{_mandir}/man3/nginx.3pm* +%{_mandir}/man8/nginx.8* +%{_mandir}/man8/nginx-upgrade.8* +%{_unitdir}/nginx.service +%config(noreplace) %{_sysconfdir}/nginx/fastcgi.conf +%config(noreplace) %{_sysconfdir}/nginx/fastcgi.conf.default +%config(noreplace) %{_sysconfdir}/nginx/fastcgi_params +%config(noreplace) %{_sysconfdir}/nginx/fastcgi_params.default +%config(noreplace) %{_sysconfdir}/nginx/koi-utf +%config(noreplace) %{_sysconfdir}/nginx/koi-win +%if ! 0%{?with_mailcap_mimetypes} +%config(noreplace) %{_sysconfdir}/nginx/mime.types +%endif +%config(noreplace) %{_sysconfdir}/nginx/mime.types.default +%config(noreplace) %{_sysconfdir}/nginx/nginx.conf +%config(noreplace) %{_sysconfdir}/nginx/nginx.conf.default +%config(noreplace) %{_sysconfdir}/nginx/scgi_params +%config(noreplace) %{_sysconfdir}/nginx/scgi_params.default +%config(noreplace) %{_sysconfdir}/nginx/uwsgi_params +%config(noreplace) %{_sysconfdir}/nginx/uwsgi_params.default +%config(noreplace) %{_sysconfdir}/nginx/win-utf +%config(noreplace) %{_sysconfdir}/logrotate.d/nginx +%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx +%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp +%attr(770,%{nginx_user},root) %dir %{_localstatedir}/log/nginx +%dir %{nginx_moduledir} +%dir %{nginx_moduleconfdir} + +%files all-modules + +%files filesystem +%dir %{_datadir}/nginx +%dir %{_datadir}/nginx/html +%dir %{_sysconfdir}/nginx +%dir %{_sysconfdir}/nginx/conf.d +%dir %{_sysconfdir}/nginx/default.d +%dir %{_sysconfdir}/systemd/system/nginx.service.d +%dir %{_unitdir}/nginx.service.d + +%if %{with geoip} +%files mod-http-geoip +%{nginx_moduleconfdir}/mod-http-geoip.conf +%{nginx_moduledir}/ngx_http_geoip_module.so +%endif + +%files mod-http-image-filter +%{nginx_moduleconfdir}/mod-http-image-filter.conf +%{nginx_moduledir}/ngx_http_image_filter_module.so + +%files mod-http-perl +%{nginx_moduleconfdir}/mod-http-perl.conf +%{nginx_moduledir}/ngx_http_perl_module.so +%dir %{perl_vendorarch}/auto/nginx +%{perl_vendorarch}/nginx.pm +%{perl_vendorarch}/auto/nginx/nginx.so + +%files mod-http-xslt-filter +%{nginx_moduleconfdir}/mod-http-xslt-filter.conf +%{nginx_moduledir}/ngx_http_xslt_filter_module.so + +%files mod-mail +%{nginx_moduleconfdir}/mod-mail.conf +%{nginx_moduledir}/ngx_mail_module.so + +%files mod-stream +%{nginx_moduleconfdir}/mod-stream.conf +%{nginx_moduledir}/ngx_stream_module.so + + +%files mod-devel +%{_rpmmacrodir}/macros.nginxmods +%{_fileattrsdir}/nginxmods.attr +%{_rpmconfigdir}/nginxmods.req +%{nginx_srcdir}/ + +%changelog +* Tue Dec 21 2021 Joe Orton - 1:1.20.1-1 +- rebase to 1.20.1 (addressing CVE-2021-23017) + +* Wed Dec 1 2021 Joe Orton - 1:1.20.0-4 +- add delaycompress to logrotate config (#2015243) + +* Fri Sep 10 2021 Luboš Uhliarik - 1:1.20.0-3 +- Add -mod-devel subpackage for building external nginx modules (Neal Gompa) + Resolves: #1991787 + +* Fri Aug 20 2021 Luboš Uhliarik - 1:1.20.0-2 +- Resolves: #1991796 - build nginx with --with-compat + +* Wed May 05 2021 Lubos Uhliarik - 1:1.20.0-1 +- new version 1.20.0 +- Resolves: #1945671 - RFE: add nginx:1.20 module stream + +* Thu Nov 12 2020 Lubos Uhliarik - 1:1.18.0-3 +- Resolves: #1651377 - centralizing default index.html on nginx +- Resolves: #1825683 - Outdated Red Hat branding used in nginx default pages + +* Wed Apr 22 2020 Lubos Uhliarik - 1:1.18.0-2 +- new version 1.18.0 +- Resolves: #1668717 - [RFE] Support loading certificates from hardware token + (PKCS#11) +- Increased types_hash_max_size to 4096 in default config +- Drop location / from default config (rhbz#1564768) +- Drop default_sever from default config (rhbz#1373822) + +* Thu Aug 29 2019 Lubos Uhliarik - 1:1.16.1-1 +- update to 1.16.1 +- Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount + of data request leads to denial of service +- Resolves: #1745690 - CVE-2019-9513 nginx:1.16/nginx: HTTP/2: flood using + PRIORITY frames resulting in excessive resource consumption +- Resolves: #1745645 - CVE-2019-9516 nginx:1.16/nginx: HTTP/2: 0-length + headers leads to denial of service + +* Wed Jun 26 2019 Lubos Uhliarik - 1:1.16.0-2 +- Resolves: #1718929 - ssl_protocols config option has faulty behavior + in nginx:1.16 + +* Mon May 06 2019 Lubos Uhliarik - 1:1.16.0-1 +- new version 1.16.0 +- enable ngx_stream_ssl_preread module +- main package does NOT require all-modules package + +* Wed Dec 12 2018 Lubos Uhliarik - 1:1.14.1-8 +- enable TLS 1.3 by default (#1643647) +- TLSv1.0 and TLSv1.1 can be enabled now (#1644746) + +* Tue Dec 11 2018 Joe Orton - 1:1.14.1-3 +- fix unexpanded paths in nginx(8) (#1643069) + +* Mon Dec 03 2018 Lubos Uhliarik - 1:1.14.1-2 +- Resolves: #1655530 - Hardening tests fail for nginx + +* Mon Nov 19 2018 Lubos Uhliarik - 1:1.14.1-1 +- new version 1.14.1 +- Resolves: #1647257 - CVE-2018-16845 nginx: Denial of service and + memory disclosure via mp4 module +- Resolves: #1647262 - CVE-2018-16844 nginx: Excessive CPU usage + via flaw in HTTP/2 implementation +- Resolves: #1647263 - CVE-2018-16843 nginx: Excessive memory consumption + via flaw in HTTP/2 implementation + +* Wed Aug 8 2018 Joe Orton - 1:1.14.0-3 +- fix PKCS#11 support (Anderson Sasaki, #1545526) + +* Mon Aug 06 2018 Lubos Uhliarik - 1:1.14.0-2 +- add dependency on perl(constant) + +* Mon Jul 30 2018 Luboš Uhliarik - 1:1.14.0-1 +- Resolves: #1558420 - directory permissions are now correct after processing + USR1 signal +- Resolves: #1601414 - nginx: drop GeoIP support + +* Thu Jul 19 2018 Joe Orton - 1:1.12.1-12 +- add build conditional for geoip support + +* Thu May 03 2018 Luboš Uhliarik - 1:1.14.0-1 +- new version 1.14.0 + +* Wed Apr 25 2018 Luboš Uhliarik - 1:1.12.1-9 +- changed directory permissions (#1558420) + +* Fri Mar 23 2018 Joe Orton - 1:1.12.1-8 +- disable gperftools (#1496868) + +* Thu Mar 22 2018 Joe Orton - 1:1.12.1-7 +- update branding (#1512565) + +* Thu Feb 08 2018 Fedora Release Engineering - 1:1.12.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Wed Jan 24 2018 Björn Esser - 1:1.12.1-5 +- Add patch to apply glibc bugfix if really needed only +- Disable strict symbol checks in the link editor + +* Sat Jan 20 2018 Björn Esser - 1:1.12.1-4 +- Rebuilt for switch to libxcrypt + +* Tue Oct 24 2017 Joe Orton - 1:1.12.1-3 +- rebuild + +* Tue Sep 19 2017 Remi Collet - 1:1.12.1-2 +- own system drop-in directories #1493036 + +* Tue Aug 15 2017 Joe Orton - 1:1.12.1-1 +- update to 1.12.1 (#1469924) +- enable http_auth_request_module (Tim Niemueller, #1471106) + +* Thu Aug 03 2017 Fedora Release Engineering - 1:1.12.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1:1.12.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jun 04 2017 Jitka Plesnikova - 1:1.12.0-2 +- Perl 5.26 rebuild + +* Tue May 30 2017 Luboš Uhliarik - 1:1.12.0-1 +- new version 1.12.0 + +* Wed Feb 8 2017 Joe Orton - 1:1.10.3-1 +- update to upstream release 1.10.3 + +* Mon Oct 31 2016 Jamie Nguyen - 1:1.10.2-1 +- update to upstream release 1.10.2 + +* Tue May 31 2016 Jamie Nguyen - 1:1.10.1-1 +- update to upstream release 1.10.1 + +* Sun May 15 2016 Jitka Plesnikova - 1:1.10.0-4 +- Perl 5.24 rebuild + +* Sun May 8 2016 Peter Robinson 1:1.10.0-3 +- Enable AIO on aarch64 (rhbz 1258414) + +* Wed Apr 27 2016 Jamie Nguyen - 1:1.10.0-2 +- only Require nginx-all-modules for EPEL and current Fedora releases + +* Wed Apr 27 2016 Jamie Nguyen - 1:1.10.0-1 +- update to upstream release 1.10.0 +- split dynamic modules into subpackages +- spec file cleanup + +* Thu Feb 04 2016 Fedora Release Engineering - 1:1.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Tue Jan 26 2016 Jamie Nguyen - 1:1.8.1-1 +- update to upstream release 1.8.1 +- CVE-2016-0747: Insufficient limits of CNAME resolution in resolver +- CVE-2016-0746: Use-after-free during CNAME response processing in resolver +- CVE-2016-0742: Invalid pointer dereference in resolver + +* Sun Oct 04 2015 Jamie Nguyen - 1:1.8.0-14 +- consistently use '%%global with_foo' style of logic +- remove PID file before starting nginx (#1268621) + +* Fri Sep 25 2015 Ville Skyttä - 1:1.8.0-13 +- Use nginx-mimetypes from mailcap (#1248736) +- Mark LICENSE as %%license + +* Thu Sep 10 2015 Jamie Nguyen - 1:1.8.0-12 +- also build with gperftools on aarch64 (#1258412) + +* Wed Aug 12 2015 Nikos Mavrogiannopoulos - 1:1.8.0-11 +- nginx.conf: added commented-out SSL configuration directives (#1179232) + +* Fri Jul 03 2015 Jamie Nguyen - 1:1.8.0-10 +- switch back to /bin/kill in logrotate script due to SELinux denials + +* Tue Jun 16 2015 Jamie Nguyen - 1:1.8.0-9 +- fix path to png in error pages (#1232277) +- optimize png images with optipng + +* Sun Jun 14 2015 Jamie Nguyen - 1:1.8.0-8 +- replace /bin/kill with /usr/bin/systemctl kill in logrotate script (#1231543) +- remove After=syslog.target in nginx.service (#1231543) +- replace ExecStop with KillSignal=SIGQUIT in nginx.service (#1231543) + +* Wed Jun 03 2015 Jitka Plesnikova - 1:1.8.0-7 +- Perl 5.22 rebuild + +* Sun May 10 2015 Jamie Nguyen - 1:1.8.0-6 +- revert previous change + +* Sun May 10 2015 Jamie Nguyen - 1:1.8.0-5 +- move default server to default.conf (#1220094) + +* Sun May 10 2015 Jamie Nguyen - 1:1.8.0-4 +- add TimeoutStopSec=5 and KillMode=mixed to nginx.service +- set worker_processes to auto +- add some common options to the http block in nginx.conf +- run nginx-upgrade on package update +- remove some redundant scriptlet commands +- listen on ipv6 for default server (#1217081) + +* Wed Apr 22 2015 Jamie Nguyen - 1:1.8.0-3 +- improve nginx-upgrade script + +* Wed Apr 22 2015 Jamie Nguyen - 1:1.8.0-2 +- add --with-pcre-jit + +* Wed Apr 22 2015 Jamie Nguyen - 1:1.8.0-1 +- update to upstream release 1.8.0 + +* Thu Apr 09 2015 Jamie Nguyen - 1:1.7.12-1 +- update to upstream release 1.7.12 + +* Sun Feb 15 2015 Jamie Nguyen - 1:1.7.10-1 +- update to upstream release 1.7.10 +- remove systemd conditionals + +* Wed Oct 22 2014 Jamie Nguyen - 1:1.6.2-4 +- fix package ownership of directories + +* Wed Oct 22 2014 Jamie Nguyen - 1:1.6.2-3 +- add vim files (#1142849) + +* Mon Sep 22 2014 Jamie Nguyen - 1:1.6.2-2 +- create nginx-filesystem subpackage (patch from Remi Collet) +- create /etc/nginx/default.d as a drop-in directory for configuration files + for the default server block +- clean up nginx.conf + +* Wed Sep 17 2014 Jamie Nguyen - 1:1.6.2-1 +- update to upstream release 1.6.2 +- CVE-2014-3616 nginx: virtual host confusion (#1142573) + +* Wed Aug 27 2014 Jitka Plesnikova - 1:1.6.1-4 +- Perl 5.20 rebuild + +* Sun Aug 17 2014 Fedora Release Engineering - 1:1.6.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Tue Aug 05 2014 Jamie Nguyen - 1:1.6.1-2 +- add logic for EPEL 7 + +* Tue Aug 05 2014 Jamie Nguyen - 1:1.6.1-1 +- update to upstream release 1.6.1 +- (#1126891) CVE-2014-3556: SMTP STARTTLS plaintext injection flaw + +* Wed Jul 02 2014 Yaakov Selkowitz - 1:1.6.0-3 +- Fix FTBFS on aarch64 (#1115559) + +* Sat Jun 07 2014 Fedora Release Engineering - 1:1.6.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sat Apr 26 2014 Jamie Nguyen - 1:1.6.0-1 +- update to upstream release 1.6.0 + +* Tue Mar 18 2014 Jamie Nguyen - 1:1.4.7-1 +- update to upstream release 1.4.7 + +* Wed Mar 05 2014 Jamie Nguyen - 1:1.4.6-1 +- update to upstream release 1.4.6 + +* Sun Feb 16 2014 Jamie Nguyen - 1:1.4.5-2 +- avoid multiple index directives (#1065488) + +* Sun Feb 16 2014 Jamie Nguyen - 1:1.4.5-1 +- update to upstream release 1.4.5 + +* Wed Nov 20 2013 Peter Borsa - 1:1.4.4-1 +- Update to upstream release 1.4.4 +- Security fix BZ 1032267 + +* Sun Nov 03 2013 Jamie Nguyen - 1:1.4.3-1 +- update to upstream release 1.4.3 + +* Fri Aug 09 2013 Jonathan Steffan - 1:1.4.2-3 +- Add in conditionals to build for non-systemd targets + +* Sat Aug 03 2013 Petr Pisar - 1:1.4.2-2 +- Perl 5.18 rebuild + +* Fri Jul 19 2013 Jamie Nguyen - 1:1.4.2-1 +- update to upstream release 1.4.2 + +* Wed Jul 17 2013 Petr Pisar - 1:1.4.1-3 +- Perl 5.18 rebuild + +* Tue Jun 11 2013 Remi Collet - 1:1.4.1-2 +- rebuild for new GD 2.1.0 + +* Tue May 07 2013 Jamie Nguyen - 1:1.4.1-1 +- update to upstream release 1.4.1 (#960605, #960606): + CVE-2013-2028 stack-based buffer overflow when handling certain chunked + transfer encoding requests + +* Sun Apr 28 2013 Dan Horák - 1:1.4.0-2 +- gperftools exist only on selected arches + +* Fri Apr 26 2013 Jamie Nguyen - 1:1.4.0-1 +- update to upstream release 1.4.0 +- enable SPDY module (new in this version) +- enable http gunzip module (new in this version) +- enable google perftools module and add gperftools-devel to BR +- enable debugging (#956845) +- trim changelog + +* Tue Apr 02 2013 Jamie Nguyen - 1:1.2.8-1 +- update to upstream release 1.2.8 + +* Fri Feb 22 2013 Jamie Nguyen - 1:1.2.7-2 +- make sure nginx directories are not world readable (#913724, #913735) + +* Sat Feb 16 2013 Jamie Nguyen - 1:1.2.7-1 +- update to upstream release 1.2.7 +- add .asc file + +* Tue Feb 05 2013 Jamie Nguyen - 1:1.2.6-6 +- use 'kill' instead of 'systemctl' when rotating log files to workaround + SELinux issue (#889151) + +* Wed Jan 23 2013 Jamie Nguyen - 1:1.2.6-5 +- uncomment "include /etc/nginx/conf.d/*.conf by default but leave the + conf.d directory empty (#903065) + +* Wed Jan 23 2013 Jamie Nguyen - 1:1.2.6-4 +- add comment in nginx.conf regarding "include /etc/nginf/conf.d/*.conf" + (#903065) + +* Wed Dec 19 2012 Jamie Nguyen - 1:1.2.6-3 +- use correct file ownership when rotating log files + +* Tue Dec 18 2012 Jamie Nguyen - 1:1.2.6-2 +- send correct kill signal and use correct file permissions when rotating + log files (#888225) +- send correct kill signal in nginx-upgrade + +* Tue Dec 11 2012 Jamie Nguyen - 1:1.2.6-1 +- update to upstream release 1.2.6 + +* Sat Nov 17 2012 Jamie Nguyen - 1:1.2.5-1 +- update to upstream release 1.2.5 + +* Sun Oct 28 2012 Jamie Nguyen - 1:1.2.4-1 +- update to upstream release 1.2.4 +- introduce new systemd-rpm macros (#850228) +- link to official documentation not the community wiki (#870733) +- do not run systemctl try-restart after package upgrade to allow the + administrator to run nginx-upgrade and avoid downtime +- add nginx man page (#870738) +- add nginx-upgrade man page and remove README.fedora +- remove chkconfig from Requires(post/preun) +- remove initscripts from Requires(preun/postun) +- remove separate configuration files in "/etc/nginx/conf.d" directory + and revert to upstream default of a centralized nginx.conf file + (#803635) (#842738) + +* Fri Sep 21 2012 Jamie Nguyen - 1:1.2.3-1 +- update to upstream release 1.2.3 + +* Fri Jul 20 2012 Fedora Release Engineering - 1:1.2.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Thu Jun 28 2012 Petr Pisar - 1:1.2.1-2 +- Perl 5.16 rebuild + +* Sun Jun 10 2012 Jamie Nguyen - 1:1.2.1-1 +- update to upstream release 1.2.1 + +* Fri Jun 08 2012 Petr Pisar - 1:1.2.0-2 +- Perl 5.16 rebuild + +* Wed May 16 2012 Jamie Nguyen - 1:1.2.0-1 +- update to upstream release 1.2.0 + +* Wed May 16 2012 Jamie Nguyen - 1:1.0.15-4 +- add nginx-upgrade to replace functionality from the nginx initscript + that was lost after migration to systemd +- add README.fedora to describe usage of nginx-upgrade +- nginx.logrotate: use built-in systemd kill command in postrotate script +- nginx.service: start after syslog.target and network.target +- nginx.service: remove unnecessary references to config file location +- nginx.service: use /bin/kill instead of "/usr/sbin/nginx -s" following + advice from nginx-devel +- nginx.service: use private /tmp + +* Mon May 14 2012 Jamie Nguyen - 1:1.0.15-3 +- fix incorrect postrotate script in nginx.logrotate + +* Thu Apr 19 2012 Jamie Nguyen - 1:1.0.15-2 +- renable auto-cc-gcc patch due to warnings on rawhide + +* Sat Apr 14 2012 Jamie Nguyen - 1:1.0.15-1 +- update to upstream release 1.0.15 +- no need to apply auto-cc-gcc patch +- add %%global _hardened_build 1 + +* Thu Mar 15 2012 Jamie Nguyen - 1:1.0.14-1 +- update to upstream release 1.0.14 +- amend some %%changelog formatting + +* Tue Mar 06 2012 Jamie Nguyen - 1:1.0.13-1 +- update to upstream release 1.0.13 +- amend --pid-path and --log-path + +* Sun Mar 04 2012 Jamie Nguyen - 1:1.0.12-5 +- change pid path in nginx.conf to match systemd service file + +* Sun Mar 04 2012 Jamie Nguyen - 1:1.0.12-3 +- fix %%pre scriptlet + +* Mon Feb 20 2012 Jamie Nguyen - 1:1.0.12-2 +- update upstream URL +- replace %%define with %%global +- remove obsolete BuildRoot tag, %%clean section and %%defattr +- remove various unnecessary commands +- add systemd service file and update scriptlets +- add Epoch to accommodate %%triggerun as part of systemd migration + +* Sun Feb 19 2012 Jeremy Hinegardner - 1.0.12-1 +- Update to 1.0.12 + +* Thu Nov 17 2011 Keiran "Affix" Smith - 1.0.10-1 +- Bugfix: a segmentation fault might occur in a worker process if resolver got a big DNS response. Thanks to Ben Hawkes. +- Bugfix: in cache key calculation if internal MD5 implementation wasused; the bug had appeared in 1.0.4. +- Bugfix: the module ngx_http_mp4_module sent incorrect "Content-Length" response header line if the "start" argument was used. Thanks to Piotr Sikora. + +* Thu Oct 27 2011 Keiran "Affix" Smith - 1.0.8-1 +- Update to new 1.0.8 stable release + +* Fri Aug 26 2011 Keiran "Affix" Smith - 1.0.5-1 +- Update nginx to Latest Stable Release + +* Fri Jun 17 2011 Marcela Mašláňová - 1.0.0-3 +- Perl mass rebuild + +* Thu Jun 09 2011 Marcela Mašláňová - 1.0.0-2 +- Perl 5.14 mass rebuild + +* Wed Apr 27 2011 Jeremy Hinegardner - 1.0.0-1 +- Update to 1.0.0 + +* Tue Feb 08 2011 Fedora Release Engineering - 0.8.53-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Sun Dec 12 2010 Jeremy Hinegardner - 0.8.53.5 +- Extract out default config into its own file (bug #635776) + +* Sun Dec 12 2010 Jeremy Hinegardner - 0.8.53-4 +- Revert ownership of log dir + +* Sun Dec 12 2010 Jeremy Hinegardner - 0.8.53-3 +- Change ownership of /var/log/nginx to be 0700 nginx:nginx +- update init script to use killproc -p +- add reopen_logs command to init script +- update init script to use nginx -q option + +* Sun Oct 31 2010 Jeremy Hinegardner - 0.8.53-2 +- Fix linking of perl module + +* Sun Oct 31 2010 Jeremy Hinegardner - 0.8.53-1 +- Update to new stable 0.8.53 + +* Sat Jul 31 2010 Jeremy Hinegardner - 0.7.67-2 +- add Provides: webserver (bug #619693) + +* Sun Jun 20 2010 Jeremy Hinegardner - 0.7.67-1 +- Update to new stable 0.7.67 +- fix bugzilla #591543 + +* Tue Jun 01 2010 Marcela Maslanova - 0.7.65-2 +- Mass rebuild with perl-5.12.0 + +* Mon Feb 15 2010 Jeremy Hinegardner - 0.7.65-1 +- Update to new stable 0.7.65 +- change ownership of logdir to root:root +- add support for ipv6 (bug #561248) +- add random_index_module +- add secure_link_module + +* Fri Dec 04 2009 Jeremy Hinegardner - 0.7.64-1 +- Update to new stable 0.7.64 diff --git a/nginxmods.attr b/nginxmods.attr new file mode 100644 index 0000000..a2cebad --- /dev/null +++ b/nginxmods.attr @@ -0,0 +1,2 @@ +%__nginxmods_requires %{_rpmconfigdir}/nginxmods.req +%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$ diff --git a/nginxmods.req b/nginxmods.req new file mode 100644 index 0000000..db26431 --- /dev/null +++ b/nginxmods.req @@ -0,0 +1,6 @@ +#!/bin/sh + +# Generate Requires: nginx(abi) = VERSION +echo "nginx(abi) = $(rpm --eval '%{_nginx_abiversion}')" + +exit 0 diff --git a/sb.key b/sb.key new file mode 100644 index 0000000..16c68c9 --- /dev/null +++ b/sb.key @@ -0,0 +1,41 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (FreeBSD) + +mQENBE5E4vkBCADPkWWzk7W5cXOqeZ1ULNSj8nt5azbYjfQ8OyR2AaDW8J7oazYH +reIHKid5uZVJxwr1uLoMloGiYTdy4XYIF2WcOfDnjNGumrAT0Nd4Kdax/pHr5Pdp +jFsO4BkHyWk/5/zDCijyoGYLBR6I8hqn+WDuLG/sTtVuTWkUeOlfxb2eZdLyZ3oP +5T5FXtWTpKvr2y7RGshmS6EJnjiVvvErdbNItFXghqvBBaFOJaS2PRBEO9RfKpti +i+eS/cmlrm+Tjv44EPfQyLtAmCQ8uqfL50uIKEp6/dsC/OVJ6JlJOYl4j90DX7vB +TJaOyUm4s+BLF2BK+Ow8+s+B6jQ5noa/o16NABEBAAG0IFNlcmdleSBCdWRuZXZp +dGNoIDxzYkBuZ2lueC5jb20+iQE+BBMBAgAoBQJOROQ6AhsDBQkJZgGABgsJCAcD +AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCmT9Wxets5qEQgB/43Mxmiy7DjXEbxIYkC +9xPC4kf1X+bHkJ9BtAgaYDQewjtQ7vS98TKJBibm3l4egmBjFWjCpL8845n966+u +XDqrDWJtOPUXvSEQNXGlijDGSxxpdK2dxDOKIOC8nIlZq/Xz/Uqjb2ZrszmYK2LD +IHI1mN9HdI6aTt41QbtG0nkaPPgv3MEvxSMVCzVddroyPXvf/ErT4OSYU+dqJhH+ +SBIezuF0suzH/siCksbSBZHIst5rggpjsZvijP5YFH/hpEsR+tKXo9EFk49xn9Ou +WdmpOEs7CKDbTApkh9XN/Pk5nJQ/HIDuW8pkgzf2wxNWlMSYw6xnozDkeIqpJcDD +4niqiEYEEBECAAYFAk5OYocACgkQ7PDpCywXIIMKtQCfaAl2rvbEImu6MnDR32KG +HTDH2TEAoNeWrSlavyFzbSQka53E9Gs6gF63tCBTZXJnZXkgQnVkbmV2aXRjaCA8 +c2JAd2FlbWUubmV0PokBQQQTAQIAKwIbAwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYC +AwECHgECF4AFAk5OR38CGQEACgkQpk/VsXrbOagPmAf/QmIEDkkiovc1MgQ81lh4 +eeHfvtptb+U4GVCu07DQUR9kEtN6Jqi65gKb95fEztI14PpX+euiWrc/RlnsxWc0 +jYF0UmyacWLN6oHPoxlCK5+7zyoz5UTNrYGkTfWfcNtTU509CEZRClBNjMZOTZjP +QhdR+Ce6tngRcQvMGNaLjJkKuY7vPh6FjT5oqxpnEIRTsWq6bUaeCXm7j9x0as1Z +w1E5D5it3Ug3VlAe58jFJmRgatOsWznKuNoLRjQ2Chp2ce+dLgXriuJMrvEsn5S4 +dImUGL5DVYWDVZNG+r85XnOhMfKG308pZby1uzFvD+j3P6yMj1tpaCAAi5lUkHh6 +bIhGBBARAgAGBQJOTmJ/AAoJEOzw6QssFyCDH50AoMyJPvPDTYXK5KHOlPYPZQ5M +OuCAAJ9zQ/3hKedm3xCLGl4Y6hjxJNlUTbkBDQROROL5AQgAuGIfx9aVOOXVdj8b +XvjBQt+UkBURYGACHFQ69w71Aupsg9pZ7FgwgVKxnoNlmRag8sInjQbs3M/lS0sB +dg75zZ7Ph7aPev8RAqdtX5+xxvujv1cmkFBExFuC5Wp/Yfzk/lPWZR4vXZrTpRiF +PLMlRu0CEJFqoqPPygGFar02Q7rO+da35pxAuYrOWGM7MNr8H/vk13+GiqniBQCa +uSoWwZQzaEdG5VGgm/vAwPzO+Cbam3r+Hs7OieykAy8fv+B+qhHn8Vc/520iGvdO +IAKpxl6oZrkbNL/wozOOLZni7iWl30C43ujxPiGRlg/YotHmhlnMic85QKyakXCS +WXI/JQARAQABiQElBBgBAgAPBQJOROL5AhsMBQkJZgGAAAoJEKZP1bF62zmoGCwH +/2a6zlu4Jwmv21vuroaAzECV8gp1luBeagn23EgMMukYhkbwLtL/0twAHmZlkpzl +atfq/EH2PgOasl2biJixqp7o9V7Uw6PS5JoY+1IrLEurG+FU2TN/Ysp12al4Z0Hh +p4yBRSEikISO9gkeUThixDPX1PjCpx8G/ZYqk+8jRCcDgWsUc/WV3VGPht68oDd7 +56/hfQYc/V3eJmm5WYLVGV7Q69tGtp6D09SpoeqCD2K77auEBRVJ4jaT4B2/EfSb +x6y7Dy4Oxm8TBOQ2EZw2vEixKxtEt86/oBtLUkqVockPq/Ek9AL+KzT6VR1xU+Cm +CoHAyoqJeb/xLBwuKWg0/4U= +=iFlP +-----END PGP PUBLIC KEY BLOCK----- diff --git a/sources b/sources new file mode 100644 index 0000000..92054b8 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA1 (nginx-1.20.1.tar.gz) = 6b4ab4eff3c617e133819f43fdfc14708e593a79