7 changed files with 158 additions and 172 deletions
--- a/.booth.metadata
+++ b/.booth.metadata
@ -0,0 +1 @@
+5444fbd98864fee07bc8b7c97a3c579b6ad72190 SOURCES/booth-1.0-251-bfb2f92.tar.gz
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/booth-1.1.tar.gz
+SOURCES/booth-1.0-251-bfb2f92.tar.gz
--- a/SOURCES/RHEL-32613-1-attr-Fix-reading-of-server_reply.patch
+++ b/SOURCES/RHEL-32613-1-attr-Fix-reading-of-server_reply.patch
@ -1,37 +0,0 @@
-From 4bdd96d767fc38239c4fac9e95404da99f61ac65 Mon Sep 17 00:00:00 2001
-From: Jan Friesse <jfriesse@redhat.com>
-Date: Wed, 21 Feb 2024 17:40:11 +0100
-Subject: [PATCH 1/4] attr: Fix reading of server_reply
-
-read_server_reply first reads boothc header and then rest of packet
-which contains hmac info. This should go in memory right after
-boothc_header and not after full length of packet, because full length
-of packet already contains hmac info.
-
-Solution is to simply use length of header and not length of packet.
-
-Longer term and better solution would be to drop read_server_reply
-completely and use recv_auth which is used for everything else but attr
-set and delete.
-
-Signed-off-by: Jan Friesse <jfriesse@redhat.com>
---
- src/attr.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/attr.c b/src/attr.c
-index 44061e3..bc154f0 100644
--- a/src/attr.c
-+++ b/src/attr.c
-@@ -142,7 +142,7 @@ static int read_server_reply(
- 		return -2;
- 	}
- 	len = ntohl(header->length);
-	rv = tpt->recv(site, msg+len, len-sizeof(*header));
-+	rv = tpt->recv(site, msg+sizeof(*header), len-sizeof(*header));
- 	if (rv < 0) {
- 		return -1;
- 	}
-- 
-2.44.0
-
--- a/SOURCES/RHEL-32613-2-auth-Check-result-of-gcrypt-gcry_md_get_algo_dlen.patch
+++ b/SOURCES/RHEL-32613-2-auth-Check-result-of-gcrypt-gcry_md_get_algo_dlen.patch
@ -1,65 +0,0 @@
-From 91fcfb5708f829ecff7d098ed4c0fc8f2da6d599 Mon Sep 17 00:00:00 2001
-From: Jan Friesse <jfriesse@redhat.com>
-Date: Wed, 21 Feb 2024 18:12:28 +0100
-Subject: [PATCH 2/4] auth: Check result of gcrypt gcry_md_get_algo_dlen
-
-When unknown hash is passed to gcry_md_get_algo_dlen 0 is returned. This
-value is then used for memcmp so wrong hmac might be accepted as
-correct.
-
-Signed-off-by: Jan Friesse <jfriesse@redhat.com>
---
- src/auth.c | 16 +++++++++++++---
- 1 file changed, 13 insertions(+), 3 deletions(-)
-
-diff --git a/src/auth.c b/src/auth.c
-index 8f86b9a..a3b3d20 100644
--- a/src/auth.c
-+++ b/src/auth.c
-@@ -28,6 +28,11 @@ int calc_hmac(const void *data, size_t datalen,
- {
- 	static gcry_md_hd_t digest;
- 	gcry_error_t err;
-+	int hlen;
-+
-+	hlen = gcry_md_get_algo_dlen(hid);
-+	if (!hlen)
-+		return -1;
- 
- 	if (!digest) {
- 		err = gcry_md_open(&digest, hid, GCRY_MD_FLAG_HMAC);
-@@ -42,7 +47,7 @@ int calc_hmac(const void *data, size_t datalen,
- 		}
- 	}
- 	gcry_md_write(digest, data, datalen);
-	memcpy(result, gcry_md_read(digest, 0), gcry_md_get_algo_dlen(hid));
-+	memcpy(result, gcry_md_read(digest, 0), hlen);
- 	gcry_md_reset(digest);
- 	return 0;
- }
-@@ -54,15 +59,20 @@ int verify_hmac(const void *data, size_t datalen,
- {
- 	unsigned char *our_hmac;
- 	int rc;
-+	int hlen;
-+
-+	hlen = gcry_md_get_algo_dlen(hid);
-+	if (!hlen)
-+		return -1;
- 
-	our_hmac = malloc(gcry_md_get_algo_dlen(hid));
-+	our_hmac = malloc(hlen);
- 	if (!our_hmac)
- 		return -1;
- 
- 	rc = calc_hmac(data, datalen, hid, our_hmac, key, keylen);
- 	if (rc)
- 		goto out_free;
-	rc = memcmp(our_hmac, hmac, gcry_md_get_algo_dlen(hid));
-+	rc = memcmp(our_hmac, hmac, hlen);
- 
- out_free:
- 	if (our_hmac)
-- 
-2.44.0
-
--- a/SOURCES/bz2111669-1-Revert-Refactor-main-substitute-is_auth_req-macro.patch
+++ b/SOURCES/bz2111669-1-Revert-Refactor-main-substitute-is_auth_req-macro.patch
@ -0,0 +1,30 @@
+From 35bf0b7b048d715f671eb68974fb6b4af6528c67 Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Mon, 4 Jul 2022 09:39:47 +0200
+Subject: [PATCH] Revert "Refactor: main: substitute is_auth_req macro"
+
+This reverts commit da79b8ba28ad4837a0fee13e5f8fb6f89fe0e24c.
+
+authfile != authkey
+
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+---
+ src/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/main.c b/src/main.c
+index b50a883..b4a174f 100644
+--- a/src/main.c
+++ b/src/main.c
+@@ -364,7 +364,7 @@ static int setup_config(int type)
+ 	if (rv < 0)
+ 		goto out;
+ 
+-	if (is_auth_req()) {
+	if (booth_conf->authfile[0] != '\0') {
+ 		rv = read_authkey();
+ 		if (rv < 0)
+ 			goto out;
+-- 
+2.37.1
+
--- a/SOURCES/rhel-specific-0001-config-Add-enable-authfile-option.patch
+++ b/SOURCES/rhel-specific-0001-config-Add-enable-authfile-option.patch
@ -1,6 +1,6 @@
-From 87c8545816cca03d19c2f3ef54031940f7e19d50 Mon Sep 17 00:00:00 2001
+From 466246c2fa8ea1bcc06593fbf7b900d0665606b1 Mon Sep 17 00:00:00 2001
 From: Jan Friesse <jfriesse@redhat.com>
-Date: Fri, 18 Nov 2022 11:57:46 +0100
+Date: Tue, 26 Jul 2022 18:39:38 +0200
 Subject: [PATCH] config: Add enable-authfile option

 This option enables (or disables) usage of authfile. Can be 'yes' or 'no'.
@ -31,28 +31,28 @@ Signed-off-by: Jan Friesse <jfriesse@redhat.com>
 4 files changed, 26 insertions(+), 1 deletion(-)

 diff --git a/docs/boothd.8.txt b/docs/boothd.8.txt
-index 0f3d2c1..c7a8413 100644
+index f58f27e..12f66f9 100644
 --- a/docs/boothd.8.txt
 +++ b/docs/boothd.8.txt
@@ -230,6 +230,13 @@ will always bind and listen to both UDP and TCP ports.
 	parameter to a higher value. The time skew test is performed
 	only in concert with authentication.
 
-+'enable-authfile'::
+*'enable-authfile'*::
 +	Enables (or disables) usage of authfile. Can be 'yes' or 'no'.
 +	Default is 'no'.
 +	This is non-upstream option used to allow use of authfile without
 +	breaking compatibility for clusters consisting of mixed
 +	versions of booth.
 +
- 'debug'::
- 	Specifies the debug output level. Alternative to
- 	command line argument. Effective only for 'daemon'
+ *'site'*::
+ 	Defines a site Raft member with the given IP. Sites can
+ 	acquire tickets. The sites' IP should be managed by the cluster.
 diff --git a/src/config.c b/src/config.c
-index f0ca4aa..e1f25f0 100644
+index 8e41553..b9df3e3 100644
 --- a/src/config.c
 +++ b/src/config.c
-@@ -732,6 +732,23 @@ no_value:
+@@ -729,6 +729,23 @@ no_value:
 			booth_conf->maxtimeskew = atoi(val);
 			continue;
 		}
@ -102,5 +102,5 @@ index b4a174f..0fdb295 100644
 		if (rv < 0)
 			goto out;
 -- 
-2.27.0
+2.37.1

--- a/SPECS/booth.spec
+++ b/SPECS/booth.spec
@ -22,7 +22,23 @@
 %bcond_with html_man
 %bcond_with glue
 %bcond_with run_build_tests
-%bcond_without include_unit_test
+%bcond_with include_unit_test
+
+# set following to the result of  `git describe --abbrev=128 $commit`
+# This will be used to fill booth_ver, booth_numcomm and booth_sha1.
+# It is important to keep abbrev to get full length sha1! When updating source use
+# `spectool -g booth.spec` to download source.
+%global git_describe_str v1.0-251-gbfb2f924c07db823f5c934d1aafbc5181bb25148
+
+# Set this to 1 when rebasing (changing git_describe_str) and increase otherwise
+%global release 4
+
+# Run shell script to parse git_describe str into version, numcomm and sha1 hash
+%global booth_ver %(s=%{git_describe_str}; vver=${s%%%%-*}; echo ${vver:1})
+%global booth_numcomm %(s=%{git_describe_str}; t=${s#*-}; echo ${t%%%%-*})
+%global booth_sha1 %(s=%{git_describe_str}; t=${s##*-}; echo ${t:1})
+%global booth_short_sha1 %(s=%{booth_sha1}; echo ${s:0:7})
+%global booth_archive_name %{name}-%{booth_ver}-%{booth_numcomm}-%{booth_short_sha1}

 ## User and group to use for nonprivileged services (should be in sync with pacemaker)
 %global uname hacluster
@ -40,15 +56,14 @@
 %global test_path   %{_datadir}/booth/tests

 Name:           booth
-Version:        1.1
-Release:        1%{?dist}.1
+Version:        %{booth_ver}
+Release:        %{booth_numcomm}.%{release}.%{booth_short_sha1}.git%{?dist}
 Summary:        Ticket Manager for Multi-site Clusters
 License:        GPLv2+
 Url:            https://github.com/%{github_owner}/%{name}
-Source0:        https://github.com/%{github_owner}/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.gz
-Patch0:         rhel-specific-0001-config-Add-enable-authfile-option.patch
-Patch1:         RHEL-32613-1-attr-Fix-reading-of-server_reply.patch
-Patch2:         RHEL-32613-2-auth-Check-result-of-gcrypt-gcry_md_get_algo_dlen.patch
+Source0:        https://github.com/%{github_owner}/%{name}/archive/%{booth_short_sha1}/%{booth_archive_name}.tar.gz
+Patch0:         bz2111669-1-Revert-Refactor-main-substitute-is_auth_req-macro.patch
+Patch1:         bz2111669-2-config-Add-enable-authfile-option.patch

 # direct build process dependencies
 BuildRequires:  autoconf
@ -58,7 +73,7 @@ BuildRequires:  make
 ## ./autogen.sh
 BuildRequires:  /bin/sh
 # general build dependencies
-BuildRequires:  asciidoc
+BuildRequires:  asciidoctor
 BuildRequires:  gcc
 BuildRequires:  pkgconfig
 # linking dependencies
@ -85,8 +100,8 @@ BuildRequires:  systemd
 ## for autosetup
 BuildRequires:  git
 %if 0%{?with_run_build_tests}
-# check scriptlet (for perl and netstat)
-BuildRequires:  perl-interpreter net-tools
+# check scriptlet (for perl and ss)
+BuildRequires:  perl-interpreter iproute
 %endif

 # this is for a composite-requiring-its-components arranged
@ -170,8 +185,8 @@ Requires:       %{__python3}
 %if 0%{?with_include_unit_test}
 Requires:       python3-pexpect
 %endif
-# runtests.py suite (for perl and netstat)
-Requires:       perl-interpreter net-tools
+# runtests.py suite (for perl and ss)
+Requires:       perl-interpreter iproute

 %description    test
 Automated tests for running Booth, ticket manager for multi-site clusters.
@ -179,7 +194,7 @@ Automated tests for running Booth, ticket manager for multi-site clusters.
 # BUILD #

 %prep
-%autosetup -n %{name}-%{version} -S git_am
+%autosetup -n %{name}-%{booth_sha1} -S git_am

 %build
 ./autogen.sh
@ -297,78 +312,120 @@ VERBOSE=1 make check
 %{_usr}/lib/ocf/resource.d/booth/sharedrsc

 %changelog
-* Tue Apr 30 2024 Jan Friesse <jfriesse@redhat.com> - 1.1-1.1
- Resolves: RHEL-32613
+* Tue Aug 09 2022 Jan Friesse <jfriesse@redhat.com> - 1.0-251.4.bfb2f92.git
+- Related: rhbz#2111669

- attr: Fix reading of server_reply
- auth: Check result of gcrypt gcry_md_get_algo_dlen (fixes CVE-2024-3049)
+- Remove template unit from systemd_(post|preun|postun_with_restart) macro

-* Thu Nov 23 2023 Jan Friesse <jfriesse@redhat.com> - 1.1-1
- Resolves: RHEL-15265
-
- New upstream release (RHEL-15265)
- Upstream releases should now be released regularly, so convert spec
-  to use them instead of git snapshots (RHEL-15265)
-
-* Mon Nov 21 2022 Jan Friesse <jfriesse@redhat.com> - 1.0-283.1.9d4029a.git
- Resolves: rhbz#2135865
-
- Update to current snapshot (commit 9d4029a) (rhbz#2135865)
-
-* Wed Aug 03 2022 Jan Friesse <jfriesse@redhat.com> - 1.0-199.2.ac1d34c.git
- Resolves: rhbz#2111668
+* Wed Aug 03 2022 Jan Friesse <jfriesse@redhat.com> - 1.0-251.3.bfb2f92.git
+- Resolves: rhbz#2111669

 - Fix authfile directive handling in booth config file
  (fixes CVE-2022-2553)
 - Add enable-authfile option

+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.0-251.2.bfb2f92.git
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Thu May 20 2021 Jan Friesse <jfriesse@redhat.com> - 1.0-251.1.bfb2f92.git
+- Related: rhbz#1961216
+
+- Rebase to newest upstream snapshot
+
+* Tue May 18 2021 Jan Friesse <jfriesse@redhat.com> - 1.0-249.1.977726e.git
+- Resolves: rhbz#1961216
+
+- Do not include unit-test by default
+- Rebase to newest upstream snapshot
+
+* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.0-239.3.52ec255.git
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-239.2.52ec255.git
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Nov 23 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-239.1.52ec255.git
+- Rebase to newest upstream snapshot
+
+* Thu Oct 15 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-237.2.dd88847.git
+- Fix dist macro
+
+* Thu Oct 15 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-237.1.dd88847.git
+- Rebase to newest upstream snapshot
+
 * Thu Oct 15 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-199.1.ac1d34c.git
- Resolves: rhbz#1873948
- Resolves: rhbz#1768172
+- Implement new versioning scheme

- Fix versioning scheme to handle updates better
- Handle updated exit code of crm_ticket
+* Tue Sep 29 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.5
+- Remove net-tools (netstat) dependency and replace it with iproute (ss)
+- Disable running tests during build by default (conditional run_build_tests)

-* Wed Jun 3 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.2
- Related: rhbz#1835831
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-6.ac1d34c.git.4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

+* Wed Jun 3 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.3
 - Do not link with the pcmk libraries
 - Generate runtests.py and boothtestenv.py with -Es as make check does

-* Tue Jun 2 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.1
- Resolves: rhbz#1602455
- Resolves: rhbz#1682122
- Resolves: rhbz#1768369
- Resolves: rhbz#1835831
+* Tue Jun 2 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.2
+- Require the Python interpreter directly instead of using the package name

- Update to current snapshot (commit ac1d34c) to fix test suite,
-  build warnings and build with gcc10
- Fix hardcoded-library-path
- Package /var/lib/booth where booth can chroot
- Add '?dist' macro to release field
- Pass full path of Python3 to configure
+* Tue Jun 2 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.1
+- Update to current snapshot (commit ac1d34c) to fix test suite
+
+* Mon Jun 1 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-5.385cc25.git.3
 - Add CI tests
 - Enable gating
+- Fix hardcoded-library-path

-* Wed Sep 19 2018 Tomas Orsava <torsava@redhat.com> - 1.0-5.f2d38ce.git
- Require the Python interpreter directly instead of using the package name
- Related: rhbz#1619153
+* Mon Jun 1 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-5.385cc25.git.2
+- Package /var/lib/booth where booth can chroot

-* Thu Jul 19 2018 Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-4.f2d38ce.git
- revert back to using asciidoc instead of asciidoctor for generating man pages
-  (rhbz#1603119)
- fix some issues in the shell scripts (rhbz#1602455)
+* Thu May 28 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-5.385cc25.git.1
+- Fix test subpackage generating

-* Mon Jul 16 2018 Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-3.f2d38ce.git
+* Wed May 27 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-5.385cc25.git
+- Update to current snapshot (commit 385cc25) to fix build warnings
+
+* Wed May 13 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-4.5d837d2.git.2
+- Rebuild for the new libqb
+
+* Mon May 4 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-4.5d837d2.git.1
+- Add '?dist' macro to release field
+
+* Mon May 4 2020 Jan Friesse <jfriesse@redhat.com> - 1.0-4.5d837d2.git
+- Update to current snapshot (commit 5d837d2) to build with gcc10
+- Pass full path of Python3 to configure
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-3.f2d38ce.git.3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-3.f2d38ce.git.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-3.f2d38ce.git.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jul 13 2018 Jan Pokorný <jpokorny+rpm-booth@fedoraproject.org> - 1.0-3.f2d38ce.git
 - update for another, current snapshot beyond booth-1.0
  (commit f2d38ce), including:
  . support for solely manually managed tickets (9a365f9)
  . use asciidoctor instead of asciidoc for generating man pages (65e6a6b)
 - switch to using Python 3 for the tests instead of Python 2
-  (behind unversioned "python" references; rhbz#1590856)
+  (behind unversioned "python" references; rhbz#1555651)

-* Thu Jun 21 2018 Troy Dawson <tdawson@redhat.com> - 1.0-2.570876d.git.3
- Fix python shebangs (#1580601)
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-2.570876d.git.6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-2.570876d.git.5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-2.570876d.git.4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-2.570876d.git.3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-2.570876d.git.2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
				`@ -0,0 +1 @@`
				`5444fbd98864fee07bc8b7c97a3c579b6ad72190 SOURCES/booth-1.0-251-bfb2f92.tar.gz`