import pki-core-10.9.4-1.module+el8.3.0+8058+d5cd4219

.gitignore

@@ -1 +1 @@
-SOURCES/pki-10.8.3.tar.gz
+SOURCES/pki-10.9.4.tar.gz

.pki-core.metadata

@@ -1 +1 @@
-2c1da3b7d4e5d43a5be3f5f7efd527768e93b94a SOURCES/pki-10.8.3.tar.gz
+dd0b6a1732c36077180769ba58ed11e659c0b621 SOURCES/pki-10.9.4.tar.gz

SOURCES/0002-Patch-ECAdminCertProfile-upgrade-script.patch

@@ -1,134 +0,0 @@
-From dc00a5c3aaf84f8fb2a3c0473e31646b9d57badc Mon Sep 17 00:00:00 2001
-From: Dinesh Prasanth M K <SilleBille@users.noreply.github.com>
-Date: Wed, 25 Mar 2020 16:02:15 -0400
-Subject: [PATCH] Patch ECAdminCertProfile upgrade script
-
-Backport of PR #355
-
-The caECAdminCert profile was added 2 years ago but was never patched
-to be added to the CS.cfg. Hence, when a user tries to upgrade, the path
-did not exist and so, the upgrade failed. This patch adds the missing
-attribute to ensure smooth upgradation process
-
-Move 10.8.2 upgrade script to 10.8.3
-
-Resolves: BZ#1814242
-Upstream: https://pagure.io/dogtagpki/issue/3168
-
-Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
----
- .../10.8.2/01-FixECAdminCertProfile.py        | 39 -------------
- .../10.8.3/01-FixECAdminCertProfile.py        | 55 +++++++++++++++++++
- 2 files changed, 55 insertions(+), 39 deletions(-)
- delete mode 100644 base/server/upgrade/10.8.2/01-FixECAdminCertProfile.py
- create mode 100644 base/server/upgrade/10.8.3/01-FixECAdminCertProfile.py
-
-diff --git a/base/server/upgrade/10.8.2/01-FixECAdminCertProfile.py b/base/server/upgrade/10.8.2/01-FixECAdminCertProfile.py
-deleted file mode 100644
-index ebdb98304..000000000
---- a/base/server/upgrade/10.8.2/01-FixECAdminCertProfile.py
-+++ /dev/null
-@@ -1,39 +0,0 @@
--# Authors:
--#     Endi S. Dewata <edewata@redhat.com>
--#
--# Copyright Red Hat, Inc.
--#
--# SPDX-License-Identifier: GPL-2.0-or-later
--
--from __future__ import absolute_import
--import logging
--import os
--
--import pki
--
--logger = logging.getLogger(__name__)
--
--
--class FixECAdminCertProfile(pki.server.upgrade.PKIServerUpgradeScriptlet):
--
--    def __init__(self):
--        super(FixECAdminCertProfile, self).__init__()
--        self.message = 'Fix EC admin certificate profile'
--
--    def upgrade_subsystem(self, instance, subsystem):
--
--        if subsystem.name != 'ca':
--            return
--
--        self.backup(subsystem.cs_conf)
--
--        path = subsystem.config.get('profile.caECAdminCert.config')
--        logger.info('Current path: %s', path)
--
--        dirname = os.path.dirname(path)
--
--        path = os.path.join(dirname, 'caECAdminCert.cfg')
--        logger.info('New path: %s', path)
--
--        subsystem.config['profile.caECAdminCert.config'] = path
--        subsystem.save()
-diff --git a/base/server/upgrade/10.8.3/01-FixECAdminCertProfile.py b/base/server/upgrade/10.8.3/01-FixECAdminCertProfile.py
-new file mode 100644
-index 000000000..92664d292
---- /dev/null
-+++ b/base/server/upgrade/10.8.3/01-FixECAdminCertProfile.py
-@@ -0,0 +1,55 @@
-+# Authors:
-+#     Endi S. Dewata <edewata@redhat.com>
-+#
-+# Copyright Red Hat, Inc.
-+#
-+# SPDX-License-Identifier: GPL-2.0-or-later
-+
-+from __future__ import absolute_import
-+import logging
-+import os
-+
-+import pki
-+
-+logger = logging.getLogger(__name__)
-+
-+
-+class FixECAdminCertProfile(pki.server.upgrade.PKIServerUpgradeScriptlet):
-+
-+    def __init__(self):
-+        super(FixECAdminCertProfile, self).__init__()
-+        self.message = 'Fix EC admin certificate profile'
-+
-+    def upgrade_subsystem(self, instance, subsystem):
-+
-+        if subsystem.name != 'ca':
-+            return
-+
-+        self.backup(subsystem.cs_conf)
-+
-+        path = subsystem.config.get('profile.caECAdminCert.config')
-+        if path is None:
-+            # Add missing path
-+            logger.info('Missing profile.caECAdminCert.config')
-+
-+            path = "{0}/profiles/{1}/caECAdminCert.cfg".format(
-+                subsystem.base_dir, subsystem.name)
-+
-+        else:
-+            # Fix existing path
-+            logger.info("Fixing profile.caECAdminCert.config")
-+            dirname = os.path.dirname(path)
-+            path = os.path.join(dirname, 'caECAdminCert.cfg')
-+
-+        logger.info('New path: %s', path)
-+        subsystem.config['profile.caECAdminCert.config'] = path
-+
-+        subsystem.config['profile.caECAdminCert.class_id'] = 'caEnrollImpl'
-+
-+        # check if caECAdminCert is part of profile.list
-+        profile_list = subsystem.config['profile.list'].split(',')
-+        if 'caECAdminCert' not in profile_list:
-+            profile_list.append('caECAdminCert')
-+            subsystem.config['profile.list'] = ','.join(profile_list)
-+
-+        subsystem.save()
--- 
-2.23.0
-

SPECS/pki-core.spec

@@ -10,9 +10,11 @@ URL:              http://www.dogtagpki.org/
 # The entire source code is GPLv2 except for 'pki-tps' which is LGPLv2
 License:          GPLv2 and LGPLv2
 
-Version:          10.8.3
+# For development (unsupported) releases, use x.y.z-0.n.unstable with alpha/beta phase.
-Release:          2%{?_timestamp}%{?_commit_id}%{?dist}
+# For official (supported) releases, use x.y.z-r where r >=1 without alpha/beta phase.
-# global          _phase -a1
+Version:          10.9.4
+Release:          1%{?_timestamp}%{?_commit_id}%{?dist}
+#global           _phase -a1
 
 # To create a tarball from a version tag:
 # $ git archive \
@@ -28,8 +30,12 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?_phase}/pki-%{ver
 #     <version tag> \
 #     > pki-VERSION-RELEASE.patch
 # Patch: pki-VERSION-RELEASE.patch
+
+# Do not remove this!! pytest-runner isn't available on RHEL. Removing this
+# patch will break RHEL builds. The error message is:
+# BUILDSTDERR: Download error on https://pypi.org/simple/pytest-runner/:
+#   [Errno 111] Connection refused -- Some packages may not be found!
 Patch1: 0001-Removed-dependency-on-pytest-runner.patch
-Patch2: 0002-Patch-ECAdminCertProfile-upgrade-script.patch
 
 ################################################################################
 # NSS
@@ -51,7 +57,15 @@ Patch2: 0002-Patch-ECAdminCertProfile-upgrade-script.patch
 # Java
 ################################################################################
 
-%define java_home %{_usr}/lib/jvm/jre-1.8.0-openjdk
+%define java_home /usr/lib/jvm/jre-openjdk
+%define java_devel java-devel
+%define java_headless java-headless
+
+%if 0%{?fedora} && 0%{?fedora} >= 33
+%define min_java_version 1:11
+%else
+%define min_java_version 1:1.8.0
+%endif
 
 ################################################################################
 # RESTEasy
@@ -106,6 +120,7 @@ Patch2: 0002-Patch-ECAdminCertProfile-upgrade-script.patch
 # package_option console
 # package_option theme
 # package_option meta
+# package_option tests
 # package_option debug
 %global with_debug 1
 
@@ -154,16 +169,18 @@ fi;
 BuildRequires:    git
 BuildRequires:    make
 
-BuildRequires:    cmake >= 2.8.9-1
+BuildRequires:    cmake >= 3.0.2
 BuildRequires:    gcc-c++
 BuildRequires:    zip
-BuildRequires:    java-1.8.0-openjdk-devel
+BuildRequires:    %java_devel >= %{min_java_version}
+BuildRequires:    javapackages-tools
 BuildRequires:    redhat-rpm-config
-BuildRequires:    ldapjdk >= 4.21.0
+BuildRequires:    ldapjdk >= 4.22.0
 BuildRequires:    apache-commons-cli
 BuildRequires:    apache-commons-codec
 BuildRequires:    apache-commons-io
 BuildRequires:    apache-commons-lang
+BuildRequires:    apache-commons-net
 BuildRequires:    jakarta-commons-httpclient
 BuildRequires:    glassfish-jaxb-api
 BuildRequires:    slf4j
@@ -195,16 +212,9 @@ BuildRequires:    resteasy-core >= 3.0.17-1
 BuildRequires:    resteasy-jackson2-provider >= 3.0.17-1
 %endif
 
-%if 0%{?rhel}
-# no pylint
-%else
-BuildRequires:    python3-pylint
-BuildRequires:    python3-flake8 >= 2.5.4
-BuildRequires:    python3-pyflakes >= 1.2.3
-%endif
-
 BuildRequires:    python3 >= 3.5
 BuildRequires:    python3-devel
+BuildRequires:    python3-setuptools
 BuildRequires:    python3-cryptography
 BuildRequires:    python3-lxml
 BuildRequires:    python3-ldap
@@ -221,8 +231,8 @@ BuildRequires:    python3-pytest-runner
 
 BuildRequires:    junit
 BuildRequires:    jpackage-utils >= 0:1.7.5-10
-BuildRequires:    jss >= 4.6.0
+BuildRequires:    jss >= 4.7.0
-BuildRequires:    tomcatjss >= 7.4.1
+BuildRequires:    tomcatjss >= 7.5.0
 BuildRequires:    systemd-units
 
 %if 0%{?rhel}
@@ -336,9 +346,9 @@ PKI consists of the following components:
 
 Summary:          PKI Symmetric Key Package
 
-Requires:         java-1.8.0-openjdk-headless
+Requires:         %java_headless >= %{min_java_version}
 Requires:         jpackage-utils >= 0:1.7.5-10
-Requires:         jss >= 4.6.0
+Requires:         jss >= 4.7.0
 Requires:         nss >= 3.38.0
 
 # Ensure we end up with a useful installation
@@ -360,8 +370,8 @@ BuildArch:        noarch
 
 Requires:         nss >= 3.36.1
 
-Requires:         python3-pki = %{version}
+Requires:         python3-pki = %{version}-%{release}
-Requires(post):   python3-pki = %{version}
+Requires(post):   python3-pki = %{version}-%{release}
 
 # Ensure we end up with a useful installation
 Conflicts:        pki-symkey < %{version}
@@ -386,7 +396,7 @@ Provides:         pki-base-python3 = %{version}
 %{?python_provide:%python_provide python3-pki}
 %endif
 
-Requires:         pki-base = %{version}
+Requires:         pki-base = %{version}-%{release}
 Requires:         python3 >= 3.5
 Requires:         python3-cryptography
 Requires:         python3-lxml
@@ -404,20 +414,21 @@ This package contains PKI client library for Python 3.
 Summary:          PKI Base Java Package
 BuildArch:        noarch
 
-Requires:         java-1.8.0-openjdk-headless
+Requires:         %java_headless >= %{min_java_version}
 Requires:         apache-commons-cli
 Requires:         apache-commons-codec
 Requires:         apache-commons-io
 Requires:         apache-commons-lang
 Requires:         apache-commons-logging
+Requires:         apache-commons-net
 Requires:         jakarta-commons-httpclient
 Requires:         glassfish-jaxb-api
 Requires:         slf4j
 Requires:         slf4j-jdk14
 Requires:         jpackage-utils >= 0:1.7.5-10
-Requires:         jss >= 4.6.0
+Requires:         jss >= 4.7.0
-Requires:         ldapjdk >= 4.21.0
+Requires:         ldapjdk >= 4.22.0
-Requires:         pki-base = %{version}
+Requires:         pki-base = %{version}-%{release}
 
 %if 0%{?rhel}
 Requires:         resteasy >= 3.0.26
@@ -429,6 +440,11 @@ Requires:         resteasy-core >= 3.0.17-1
 Requires:         resteasy-jackson2-provider >= 3.0.17-1
 %endif
 
+%if 0%{?fedora} && 0%{?fedora} >= 33
+Requires:         jaxb-impl >= 2.3.3
+Requires:         jakarta-activation >= 1.2.2
+%endif
+
 Requires:         xalan-j2
 Requires:         xerces-j2
 Requires:         xml-commons-apis
@@ -446,7 +462,7 @@ Summary:          PKI Tools Package
 
 Requires:         openldap-clients
 Requires:         nss-tools >= 3.36.1
-Requires:         pki-base-java = %{version}
+Requires:         pki-base-java = %{version}-%{release}
 Requires:         p11-kit-trust
 
 # PKICertImport depends on certutil and openssl
@@ -475,8 +491,8 @@ Requires:         policycoreutils
 Requires:         procps-ng
 Requires:         openldap-clients
 Requires:         openssl
-Requires:         pki-symkey = %{version}
+Requires:         pki-symkey = %{version}-%{release}
-Requires:         pki-tools = %{version}
+Requires:         pki-tools = %{version}-%{release}
 
 Requires:         keyutils
 
@@ -496,11 +512,13 @@ Requires:         tomcat >= 1:9.0.7
 %endif
 
 Requires:         velocity
+Requires:         sudo
+Requires:         systemd
 Requires(post):   systemd-units
 Requires(preun):  systemd-units
 Requires(postun): systemd-units
 Requires(pre):    shadow-utils
-Requires:         tomcatjss >= 7.4.1
+Requires:         tomcatjss >= 7.5.0
 
 # pki-healthcheck depends on the following library
 %if 0%{?rhel}
@@ -516,6 +534,13 @@ Conflicts:        ipa-server < 4.7.1
 Conflicts:        freeipa-server < 4.7.1
 %endif
 
+Provides:         bundled(js-backbone) = 1.4.0
+Provides:         bundled(js-bootstrap) = 3.4.1
+Provides:         bundled(js-jquery) = 3.5.1
+Provides:         bundled(js-jquery-i18n-properties) = 1.2.7
+Provides:         bundled(js-patternfly) = 3.59.2
+Provides:         bundled(js-underscore) = 1.9.2
+
 %description -n   pki-server
 The PKI Server Package contains libraries and utilities needed by the
 following PKI subsystems:
@@ -537,7 +562,7 @@ following PKI subsystems:
 Summary:          PKI CA Package
 BuildArch:        noarch
 
-Requires:         pki-server = %{version}
+Requires:         pki-server = %{version}-%{release}
 Requires(post):   systemd-units
 Requires(preun):  systemd-units
 Requires(postun): systemd-units
@@ -562,7 +587,7 @@ where it obtains its own signing certificate from a public CA.
 Summary:          PKI KRA Package
 BuildArch:        noarch
 
-Requires:         pki-server = %{version}
+Requires:         pki-server = %{version}-%{release}
 Requires(post):   systemd-units
 Requires(preun):  systemd-units
 Requires(postun): systemd-units
@@ -778,6 +803,20 @@ This PKI Console Theme Package contains
 # with theme
 %endif
 
+%if %{with tests}
+################################################################################
+%package -n       pki-tests
+################################################################################
+
+Summary:          PKI Tests
+BuildArch:        noarch
+
+%description -n   pki-tests
+This package contains PKI test suite.
+
+# with tests
+%endif
+
 ################################################################################
 %prep
 ################################################################################
@@ -788,6 +827,13 @@ This PKI Console Theme Package contains
 %build
 ################################################################################
 
+# get Java <major>.<minor> version number
+java_version=`%{java_home}/bin/java -XshowSettings:properties -version 2>&1 | sed -n 's/ *java.version *= *\([0-9]\+\.[0-9]\+\).*/\1/p'`
+
+# if <major> == 1, get <minor> version number
+# otherwise get <major> version number
+java_version=`echo $java_version | sed -e 's/^1\.//' -e 's/\..*$//'`
+
 # get Tomcat <major>.<minor> version number
 tomcat_version=`/usr/sbin/tomcat version | sed -n 's/Server number: *\([0-9]\+\.[0-9]\+\).*/\1/p'`
 
@@ -797,14 +843,19 @@ else
     app_server=tomcat-$tomcat_version
 fi
 
+%if 0%{?rhel}
 %{__mkdir_p} build
 cd build
+%endif
+
 %cmake \
     --no-warn-unused-cli \
     -DVERSION=%{version}-%{release} \
     -DVAR_INSTALL_DIR:PATH=/var \
     -DP11_KIT_TRUST=/etc/alternatives/libnssckbi.so.%{_arch} \
-    -DJAVA_HOME=%{java_home} \
+    -DJAVA_VERSION=%{java_version} \
+    -DJAVA_HOME=%java_home \
+    -DPKI_JAVA_PATH=%java \
     -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
     -DSYSTEMD_LIB_INSTALL_DIR=%{_unitdir} \
     -DAPP_SERVER=$app_server \
@@ -820,13 +871,15 @@ cd build
     -DWITH_JAVADOC:BOOL=%{?with_javadoc:ON}%{!?with_javadoc:OFF} \
     -DBUILD_PKI_CONSOLE:BOOL=%{?with_console:ON}%{!?with_console:OFF} \
     -DTHEME=%{?with_theme:%{vendor_id}} \
+%if 0%{?rhel}
     ..
+%else
+    -B %{_vpath_builddir}
+%endif
 
-################################################################################
+%if 0%{?fedora}
-%install
+cd %{_vpath_builddir}
-################################################################################
+%endif
-
-cd build
 
 # Do not use _smp_mflags to preserve build order
 %{__make} \
@@ -835,7 +888,25 @@ cd build
     DESTDIR=%{buildroot} \
     INSTALL="install -p" \
     --no-print-directory \
-    all install
+    all
+
+################################################################################
+%install
+################################################################################
+
+%if 0%{?rhel}
+cd build
+%else
+cd %{_vpath_builddir}
+%endif
+
+%{__make} \
+    VERBOSE=%{?_verbose} \
+    CMAKE_NO_VERBOSE=1 \
+    DESTDIR=%{buildroot} \
+    INSTALL="install -p" \
+    --no-print-directory \
+    install
 
 %if %{with_test}
 ctest --output-on-failure
@@ -863,32 +934,6 @@ ln -sf %{jaxrs_api_jar} %{buildroot}%{_datadir}/pki/server/common/lib/jboss-jaxr
 ln -sf /usr/share/java/jboss-logging/jboss-logging.jar %{buildroot}%{_datadir}/pki/server/common/lib/jboss-logging.jar
 ln -sf /usr/share/java/jboss-annotations-1.2-api/jboss-annotations-api_1.2_spec.jar %{buildroot}%{_datadir}/pki/server/common/lib/jboss-annotations-api_1.2_spec.jar
 
-%if 0%{?rhel}
-# no pylint
-%else
-
-################################################################################
-echo "Scanning Python code with pylint"
-################################################################################
-
-%{python_executable} -I ../tools/pylint-build-scan.py rpm --prefix %{buildroot}
-if [ $? -ne 0 ]; then
-    echo "pylint for Python 3 failed. RC: $?"
-    exit 1
-fi
-
-################################################################################
-echo "Scanning Python code with flake8"
-################################################################################
-
-python3-flake8 --config ../tox.ini %{buildroot}
-if [ $? -ne 0 ]; then
-    echo "flake8 for Python 3 failed. RC: $?"
-    exit 1
-fi
-
-%endif
-
 # with server
 %endif
 
@@ -915,9 +960,9 @@ then
 
 else
     # On RPM upgrade run system upgrade
-    echo "Upgrading PKI system configuration at `/bin/date`." >> /var/log/pki/pki-upgrade-%{version}.log 2>&1
+    echo "Upgrading PKI system configuration at `/bin/date`." >> /var/log/pki/pki-upgrade-%{version}.log
-    /sbin/pki-upgrade --silent >> /var/log/pki/pki-upgrade-%{version}.log 2>&1
+    /sbin/pki-upgrade 2>&1 | tee -a /var/log/pki/pki-upgrade-%{version}.log
-    echo >> /var/log/pki/pki-upgrade-%{version}.log 2>&1
+    echo >> /var/log/pki/pki-upgrade-%{version}.log
 fi
 
 %postun -n pki-base
@@ -938,10 +983,6 @@ fi
 ##        from EITHER 'sysVinit' OR previous 'systemd' processes to the new
 ##        PKI deployment process
 
-echo "Upgrading PKI server configuration on `/bin/date`." >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
-/sbin/pki-server upgrade --silent >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
-echo >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
-
 # Reload systemd daemons on upgrade only
 if [ "$1" == "2" ]
 then
@@ -981,7 +1022,7 @@ fi
 %files -n pki-symkey
 ################################################################################
 
-%doc base/symkey/LICENSE
+%license base/symkey/LICENSE
 %{_jnidir}/symkey.jar
 %{_libdir}/symkey/
 
@@ -989,8 +1030,8 @@ fi
 %files -n pki-base
 ################################################################################
 
-%doc base/common/LICENSE
+%license base/common/LICENSE
-%doc base/common/LICENSE.LESSER
+%license base/common/LICENSE.LESSER
 %doc %{_datadir}/doc/pki-base/html
 %dir %{_datadir}/pki
 %{_datadir}/pki/VERSION
@@ -1015,21 +1056,20 @@ fi
 %files -n pki-base-java
 ################################################################################
 
-%doc base/common/LICENSE
+%license base/common/LICENSE
-%doc base/common/LICENSE.LESSER
+%license base/common/LICENSE.LESSER
 %{_datadir}/pki/examples/java/
 %{_datadir}/pki/lib/*.jar
 %dir %{_javadir}/pki
 %{_javadir}/pki/pki-cmsutil.jar
-%{_javadir}/pki/pki-nsutil.jar
 %{_javadir}/pki/pki-certsrv.jar
 
 ################################################################################
 %files -n python3-pki
 ################################################################################
 
-%doc base/common/LICENSE
+%license base/common/LICENSE
-%doc base/common/LICENSE.LESSER
+%license base/common/LICENSE.LESSER
 %if %{with server}
 %exclude %{python3_sitelib}/pki/server
 %endif
@@ -1039,7 +1079,8 @@ fi
 %files -n pki-tools
 ################################################################################
 
-%doc base/native-tools/LICENSE base/native-tools/doc/README
+%license base/native-tools/LICENSE
+%doc base/native-tools/doc/README
 %{_bindir}/p7tool
 %{_bindir}/pistool
 %{_bindir}/pki
@@ -1113,8 +1154,8 @@ fi
 %files -n pki-server
 ################################################################################
 
-%doc base/common/THIRD_PARTY_LICENSES
+%license base/common/THIRD_PARTY_LICENSES
-%doc base/server/LICENSE
+%license base/server/LICENSE
 %doc base/server/README
 %attr(755,-,-) %dir %{_sysconfdir}/sysconfig/pki
 %attr(755,-,-) %dir %{_sysconfdir}/sysconfig/pki/tomcat
@@ -1151,6 +1192,7 @@ fi
 %{_mandir}/man8/pkidestroy.8.gz
 %{_mandir}/man8/pkispawn.8.gz
 %{_mandir}/man8/pki-server.8.gz
+%{_mandir}/man8/pki-server-acme.8.gz
 %{_mandir}/man8/pki-server-instance.8.gz
 %{_mandir}/man8/pki-server-subsystem.8.gz
 %{_mandir}/man8/pki-server-nuxwdog.8.gz
@@ -1175,7 +1217,7 @@ fi
 %files -n pki-ca
 ################################################################################
 
-%doc base/ca/LICENSE
+%license base/ca/LICENSE
 %{_javadir}/pki/pki-ca.jar
 %dir %{_datadir}/pki/ca
 %{_datadir}/pki/ca/conf/
@@ -1192,7 +1234,7 @@ fi
 %files -n pki-kra
 ################################################################################
 
-%doc base/kra/LICENSE
+%license base/kra/LICENSE
 %{_javadir}/pki/pki-kra.jar
 %dir %{_datadir}/pki/kra
 %{_datadir}/pki/kra/conf/
@@ -1207,7 +1249,7 @@ fi
 %files -n pki-ocsp
 ################################################################################
 
-%doc base/ocsp/LICENSE
+%license base/ocsp/LICENSE
 %{_javadir}/pki/pki-ocsp.jar
 %dir %{_datadir}/pki/ocsp
 %{_datadir}/pki/ocsp/conf/
@@ -1222,7 +1264,7 @@ fi
 %files -n pki-tks
 ################################################################################
 
-%doc base/tks/LICENSE
+%license base/tks/LICENSE
 %{_javadir}/pki/pki-tks.jar
 %dir %{_datadir}/pki/tks
 %{_datadir}/pki/tks/conf/
@@ -1237,7 +1279,7 @@ fi
 %files -n pki-tps
 ################################################################################
 
-%doc base/tps/LICENSE
+%license base/tps/LICENSE
 %{_javadir}/pki/pki-tps.jar
 %dir %{_datadir}/pki/tps
 %{_datadir}/pki/tps/applets/
@@ -1273,7 +1315,7 @@ fi
 %files -n pki-console
 ################################################################################
 
-%doc base/console/LICENSE
+%license base/console/LICENSE
 %{_bindir}/pkiconsole
 %{_javadir}/pki/pki-console.jar
 
@@ -1285,7 +1327,7 @@ fi
 %files -n %{vendor_id}-pki-server-theme
 ################################################################################
 
-%doc themes/%{vendor_id}/common-ui/LICENSE
+%license themes/%{vendor_id}/common-ui/LICENSE
 %dir %{_datadir}/pki
 %{_datadir}/pki/CS_SERVER_VERSION
 %{_datadir}/pki/common-ui/
@@ -1303,16 +1345,64 @@ fi
 %files -n %{vendor_id}-pki-console-theme
 ################################################################################
 
-%doc themes/%{vendor_id}/console-ui/LICENSE
+%license themes/%{vendor_id}/console-ui/LICENSE
 %{_javadir}/pki/pki-console-theme.jar
 
 # with theme
 %endif
 
+%if %{with tests}
+################################################################################
+%files -n pki-tests
+################################################################################
+
+%{_datadir}/pki/tests/
+
+# with tests
+%endif
+
 ################################################################################
 %changelog
-* Tue Apr 14 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.3-2
+* Fri Sep 11 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.4-1
-- Bug #1822404 - Upgrade to 10.8.3 breaks PKI Tomcat Server
+- Rebased to PKI 10.9.4
+- Red Hat Bugzilla #1873235 - Fix SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT in pki ca-user-cert-add
+
+* Thu Sep 03 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.3-1
+- Rebased to PKI 10.9.3
+- Bug #1869893 - Common certificates are missing in CS.cfg on shared PKI instance
+
+* Tue Aug 18 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.2-2
+- Bug #1871064 - Replica install failing during pki-ca component configuration
+
+* Tue Aug 18 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.2-1
+- Rebased to PKI 10.9.2
+
+* Wed Aug 12 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.1-2
+- Bug #1857933 - CA Installation is failing with ncipher v12.30 HSM
+- Bug #1868233 - Disabling AIA and cert policy extensions in ACME examples
+
+* Thu Aug 06 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.1-1
+- Rebased to PKI 10.9.1
+- Bug #1426572 - Fix Secure connection issue when server is down
+
+* Fri Jul 31 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-1
+- Rebased to PKI 10.9.0
+
+* Fri Jul 14 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.7
+- Fixed pki kra-key-generate failure
+- Fixed error handling in PKIRealm
+
+* Fri Jul 10 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.6
+- Rebased to PKI 10.9.0-b4
+
+* Thu Jun 25 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.4
+- Rebased to PKI 10.9.0-b2
+
+* Mon Jun 22 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.3
+- Rebased to PKI 10.9.0-b1
+
+* Tue May 26 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.1
+- Rebased to PKI 10.9.0-a1
 
 * Tue Mar 03 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.3-1
 - Rebased to PKI 10.8.3