From 4541500fa5d9a9b049d172601af98e10b8cc9bfc Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 3 Nov 2020 06:59:32 -0500 Subject: [PATCH] import mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611 --- .gitignore | 1 - .mod_md.metadata | 1 - SOURCES/a2md.xml | 418 ++++++++++++++++++ .../mod_md-2.0.8-tolerate-missing-res.patch | 22 + SPECS/mod_md.spec | 8 +- 5 files changed, 447 insertions(+), 3 deletions(-) create mode 100644 SOURCES/a2md.xml create mode 100644 SOURCES/mod_md-2.0.8-tolerate-missing-res.patch diff --git a/.gitignore b/.gitignore index 7bff8e6..6333b36 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -SOURCES/a2md.xml SOURCES/mod_md-2.0.8.tar.gz diff --git a/.mod_md.metadata b/.mod_md.metadata index b258a33..083e09c 100644 --- a/.mod_md.metadata +++ b/.mod_md.metadata @@ -1,2 +1 @@ -c3e8fe59d72b01e93a40c7c53f18f9da6343876b SOURCES/a2md.xml 6cec32070c6fd83701be0874a2d8b4f30d929d03 SOURCES/mod_md-2.0.8.tar.gz diff --git a/SOURCES/a2md.xml b/SOURCES/a2md.xml new file mode 100644 index 0000000..0f74182 --- /dev/null +++ b/SOURCES/a2md.xml @@ -0,0 +1,418 @@ + + + + + + + a2md + mod_md + AuthorEissingStefanstefan.eissing@greenbytes.de + DocumentationUhliarikLubosluhliari@redhat.com + + + + a2md + 1 + + + + a2md + Show and manipulate Apache Managed Domains + + + + + a2md + options + + acme + add + update + drive + list + store + + cmd options + args + + + + + Description + + The a2md utility can be used to configure and update managed domains with + the mod_md module for Apache HTTP Server. Managed Domains are virtual hosts + which automatically obtain and renew TLS certificates from an ACME server. + + + + + Options + + + + + arg, + arg + + The url of the ACME server directory + + + + + arg, + arg + + Directory for file data + + + + + , + + + Print usage information + + + + + , + + + Produce JSON output + + + + + arg, + arg + + Use the HTTP proxy url + + + + + , + + + Produce less output + + + + + arg, + arg + + You agree to the terms of services (url) + + + + + , + + + Produce more output + + + + + , + + + Print version + + + + + ACME server commands + + a2md acme + + newreg + delreg + agree + authz + validate + + opts + args + + + + Play with the ACME server. For most of the commands you need to specify + the url of the ACME server directory. + + + + newreg + + newreg + contact-uri + contact-uri... + + Register a new account at ACME server with given contact-uri (email) + + + + delreg + + delreg + account + + Delete an existing ACME account + + + + agree + + agree + account + + Agree to ACME terms of service + + + + authz + + authz + account + domain + + Request a new authorization for an account and + domain + + + + validate + + validate + account + + Validate account existence + + + + + Managed domain addition + + a2md add + opts + domain + domain... + + + + Adds a new managed domain. Must not overlap with existing domains. + + + + + Updating managed domain + + a2md update + name + opts + + domains + ca + account + contacts + agreement + + + + + Update a managed domain's properties, where name belongs to managed domain which + will be updated. + + + URL of ACME server can be also updated if | + option is present. + + + domains + + domains + dname + dname... + + Update domain where dname is domain name which will be updated. + + + + ca + + ca + url + proto + + The URL where the CA offers its service. + Currently only ACME (LetsEncrypt) proto is implemented. + + + + account + + account + + Account name on corresponding ACME server. + + + + contacts + + contacts + email + email... + + Contact address which will be used by ACME server to inform about renewals or changed terms of service. + + + + agreement + + agreement + URI + + URI pointing to terms of service of ACME server. + + + + + Drive managed domains + + a2md drive + md... + options... + + + + Drive all or the mentioned managed domains toward completeness + + + Options + + + + arg, + arg + + Which challenge type to use + + + + , + + + Force driving the managed domain, even when it seems valid + + + + , + + + Reset any staging data for the managed domain + + + + + + + List managed domamins + + a2md list + + + + List all managed domains + + + + + Manipulating MD store + + a2md store + + add + remove + list + update + + opts + args + + + + Manipulate the MD store + + + + add + + add + dns + dns2... + + Add a new managed domain dns with all the additional domain names + + + + remove + + remove + -f | --force + name + name... + + Remove the managed domains name from the store + When or option is specified, force managed domain removal - be silent about missing domains + + + list + + list + + List all managed domains in the store + + + update + + update + name + + domains + dname + dname... + + + If cmd is specified followed by one or + more domains, MD store will be updated with those domains. + URL of ACME server can be also updated if | + option is present. + + + + + + + diff --git a/SOURCES/mod_md-2.0.8-tolerate-missing-res.patch b/SOURCES/mod_md-2.0.8-tolerate-missing-res.patch new file mode 100644 index 0000000..37819cc --- /dev/null +++ b/SOURCES/mod_md-2.0.8-tolerate-missing-res.patch @@ -0,0 +1,22 @@ +diff --git a/src/md_acme.c b/src/md_acme.c +index d2cc00a..005a387 100644 +--- a/src/md_acme.c ++++ b/src/md_acme.c +@@ -728,8 +728,15 @@ static apr_status_t update_directory(const md_http_response_t *res) + acme->api.v2.revoke_cert = md_json_dups(acme->p, json, "revokeCert", NULL); + acme->api.v2.key_change = md_json_dups(acme->p, json, "keyChange", NULL); + acme->api.v2.new_nonce = md_json_dups(acme->p, json, "newNonce", NULL); +- if (acme->api.v2.new_account && acme->api.v2.new_order +- && acme->api.v2.revoke_cert && acme->api.v2.key_change ++ /* RFC 8555 only requires "directory" and "newNonce" resources. ++ * mod_md uses "newAccount" and "newOrder" so check for them. ++ * But mod_md does not use the "revokeCert" or "keyChange" ++ * resources, so tolerate the absense of those keys. In the ++ * future if mod_md implements revocation or key rollover then ++ * the use of those features should be predicated on the ++ * server's advertised capabilities. */ ++ if (acme->api.v2.new_account ++ && acme->api.v2.new_order + && acme->api.v2.new_nonce) { + acme->version = MD_ACME_VERSION_2; + } diff --git a/SPECS/mod_md.spec b/SPECS/mod_md.spec index 59ddb4b..299efa1 100644 --- a/SPECS/mod_md.spec +++ b/SPECS/mod_md.spec @@ -3,7 +3,7 @@ Name: mod_md Version: 2.0.8 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Certificate provisioning using ACME for the Apache HTTP Server License: ASL 2.0 URL: https://icing.github.io/mod_md/ @@ -12,6 +12,7 @@ Source0: https://github.com/icing/mod_md/releases/download/v%{version}/mo Source10: a2md.xml Patch1: mod_md-2.0.8-state_dir.patch Patch2: mod_md-2.0.8-duptrim-seg.patch +Patch3: mod_md-2.0.8-tolerate-missing-res.patch BuildRequires: gcc BuildRequires: pkgconfig, httpd-devel >= 2.4.37, openssl-devel >= 1.1.0, jansson-devel, libcurl-devel BuildRequires: xmlto @@ -29,6 +30,7 @@ domains and their virtual hosts automatically, including at renewal. %setup -q %patch1 -p1 -b .state_dir %patch2 -p1 -b .dup_trim +%patch3 -p1 -b .tol_missing_res xmlto man $RPM_SOURCE_DIR/a2md.xml @@ -68,6 +70,10 @@ install -m 644 -p a2md.1 $RPM_BUILD_ROOT%{_mandir}/man1 %{_mandir}/man1/* %changelog +* Thu May 28 2020 Lubos Uhliarik - 1:2.0.8-8 +- Resolves: #1832844 - mod_md does not work with ACME server that does not + provide keyChange or revokeCert resources + * Wed Jan 22 2020 Lubos Uhliarik - 1:2.0.8-7 - Resolves: #1747912 - add a2md(1) documentation