%global pkgname   dirsrv

# for a pre-release, define the prerel field e.g. .a1 .rc2 - comment out for official release

# also remove the space between % and global - this space is needed because

# fedpkg verrel stupidly ignores comment lines

#% global prerel .rc3

# also need the relprefix field for a pre-release e.g. .0 - also comment out for official release

#% global relprefix 0.

# If perl-Socket-2.000 or newer is available, set 0 to use_Socket6.

%global use_Socket6 0

# This is used in certain builds to help us know if it has extra features.

%global variant base

%global use_asan 0

%if %{use_asan}

%global use_tcmalloc 0

%global variant base-asan

%else

%if %{_arch} != "s390x" && %{_arch} != "s390"

%global use_tcmalloc 1

%else

%global use_tcmalloc 0

%endif

%endif

# fedora 15 and later uses tmpfiles.d

# otherwise, comment this out

%{!?with_tmpfiles_d: %global with_tmpfiles_d %{_sysconfdir}/tmpfiles.d}

# systemd support

%global groupname %{pkgname}.target

# set PIE flag

%global _hardened_build 1

Summary:          389 Directory Server (%{variant})

Name:             389-ds-base

Version:          1.3.7.5

Release:          %{?relprefix}28%{?prerel}%{?dist}

License:          GPLv3+

URL:              https://www.port389.org/

Group:            System Environment/Daemons

BuildRoot:        %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Conflicts:        selinux-policy-base < 3.9.8

Requires:         %{name}-libs = %{version}-%{release}

Provides:         ldif2ldbm >= 0

BuildRequires:    nspr-devel

BuildRequires:    nss-devel >= 3.34

BuildRequires:    svrcore-devel >= 4.1.3

BuildRequires:    openldap-devel

BuildRequires:    libdb-devel

BuildRequires:    cyrus-sasl-devel

BuildRequires:    icu

BuildRequires:    libicu-devel

BuildRequires:    pcre-devel

BuildRequires:    gcc-c++

# The following are needed to build the snmp ldap-agent

BuildRequires:    net-snmp

BuildRequires:    net-snmp-devel

%ifnarch sparc sparc64 ppc ppc64 s390 s390x

BuildRequires:    lm_sensors-devel

%endif

BuildRequires:    bzip2-devel

BuildRequires:    zlib-devel

BuildRequires:    openssl-devel

BuildRequires:    tcp_wrappers

# the following is for the pam passthru auth plug-in

BuildRequires:    pam-devel

BuildRequires:    systemd-units

BuildRequires:    systemd-devel

%if %{use_asan}

BuildRequires:    libasan

%endif

# Needed to support regeneration of the autotool artifacts.

BuildRequires:    autoconf

BuildRequires:    automake

BuildRequires:    libtool

BuildRequires:    libevent-devel

BuildRequires:    libtalloc-devel

BuildRequires:    libtevent-devel

# For tests!

#BuildRequires:    libcmocka-devel

BuildRequires:    doxygen

# this is needed for using semanage from our setup scripts

Requires:         policycoreutils-python

Requires:         /usr/sbin/semanage

Requires:         libsemanage-python 

Requires:         selinux-policy >= 3.13.1-137

# the following are needed for some of our scripts

Requires:         openldap-clients

# use_openldap assumes perl-Mozilla-LDAP is built with openldap support

Requires:         perl-Mozilla-LDAP

# this is needed to setup SSL if you are not using the

# administration server package

Requires:         nss-tools

# these are not found by the auto-dependency method

# they are required to support the mandatory LDAP SASL mechs

Requires:         cyrus-sasl-gssapi

Requires:         cyrus-sasl-md5

Requires:         cyrus-sasl-plain

# this is needed for verify-db.pl

Requires:         libdb-utils

# This picks up libperl.so as a Requires, so we add this versioned one

Requires:         perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))

# for the init script

Requires(post):   systemd-units

Requires(preun):  systemd-units

Requires(postun): systemd-units

# for setup-ds.pl

Requires:         bind-utils

# for setup-ds.pl to support ipv6 

%if %{use_Socket6}

Requires:         perl-Socket6

%else 

Requires:         perl-Socket

%endif

Requires:         perl-NetAddr-IP

Requires:         systemd-libs

Requires:         svrcore >= 4.1.3

Requires:         python-ldap

# upgrade path from monolithic % {name} (including -libs & -devel) to % {name} + % {name}-snmp

Obsoletes:        %{name} <= 1.3.5.4

%if %{use_tcmalloc}

BuildRequires:    gperftools-devel

Requires:         gperftools-libs

%endif

Source0:          https://releases.pagure.org/389-ds-base/%{name}-%{version}%{?prerel}.tar.bz2

# 389-ds-git.sh should be used to generate the source tarball from git

Source1:          %{name}-git.sh

Source2:          %{name}-devel.README

Patch00:          0000-Ticket-49305-Need-to-wrap-atomic-calls.patch

Patch01:          0001-Ticket-49305-Need-to-wrap-atomic-calls.patch

Patch02:          0002-Ticket-49385-Fix-coverity-warnings.patch 

Patch03:          0003-Ticket-49180-errors-log-filled-with-attrlist_replace.patch

Patch04:          0004-Ticket-49388-repl-monitor-matches-null-string-many-t.patch

Patch05:          0005-Ticket-49389-unable-to-retrieve-specific-cosAttribut.patch

Patch06:          0006-Ticket-49320-Activating-already-active-role-returns-.patch

Patch07:          0007-Ticket-48235-Remove-memberOf-global-lock.patch

Patch08:          0008-Ticket-48235-remove-memberof-lock-cherry-pick-error.patch

Patch09:          0009-Ticket-49394-slapi_pblock_get-may-leave-unchanged-th.patch

Patch10:          0010-Ticket-49402-Adding-a-database-entry-with-the-same-d.patch

Patch11:          0011-Ticket-49064-RFE-allow-to-enable-MemberOf-plugin-in-.patch

Patch12:          0012-Ticket-49378-server-init-fails.patch

Patch13:          0013-Ticket-49392-memavailable-not-available.patch

Patch14:          0014-Ticket-48006-Missing-warning-for-invalid-replica-bac.patch

Patch15:          0015-Ticket-49408-Server-allows-to-set-any-nsds5replicaid.patch

Patch16:          0016-Ticket-49408-Server-allows-to-set-any-nsds5replicaid.patch

Patch17:          0017-Ticket-48681-Use-of-uninitialized-value-in-string-ne.patch

Patch18:          0018-Ticket-49374-server-fails-to-start-because-maxdisksi.patch

Patch19:          0019-Ticket-48681-Use-of-uninitialized-value-in-string-ne.patch

Patch20:          0020-Ticket-49401-improve-valueset-sorted-performance-on-.patch

Patch21:          0021-Ticket-49401-Fix-compiler-incompatible-pointer-types.patch

Patch22:          0022-Ticket-48894-harden-valueset_array_to_sorted_quick-v.patch

Patch23:          0023-Ticket-49424-Resolve-csiphash-alignment-issues.patch

Patch24:          0024-Ticket-49436-double-free-in-COS-in-some-conditions.patch

Patch25:          0025-Ticket-48393-Improve-replication-config-validation.patch  

Patch26:          0026-Ticket-49439-cleanallruv-is-not-logging-information.patch

Patch27:          0027-Ticket-48393-fix-copy-and-paste-error.patch

Patch28:          0028-Ticket-49038-remove-legacy-replication-change-cleanu.patch

Patch29:          0029-Ticket-49454-SSL-Client-Authentication-breaks-in-FIP.patch

Patch30:          0030-Ticket-49435-Fix-NS-race-condition-on-loaded-test-sy.patch

Patch31:          0031-Ticket-49410-opened-connection-can-remain-no-longer-.patch

Patch32:          0032-Ticket-49443-scope-one-searches-in-1.3.7-give-incorr.patch

Patch33:          0033-Ticket-49441-Import-crashes-with-large-indexed-binar.patch

Patch34:          0034-Ticket-49441-Import-crashes-oneline-fix.patch

Patch35:          0035-Ticket-49377-Incoming-BER-too-large-with-TLS-on-plai.patch

Patch36:          0036-Ticket-48118-At-startup-changelog-can-be-erronously-.patch

Patch37:          0037-Ticket-48118-fix-compiler-warning-for-incorrect-retu.patch

Patch38:          0038-Ticket-49298-Correct-error-codes-with-config-restore.patch

Patch39:          0039-Ticket-49474-sasl-allow-mechs-does-not-operate-corre.patch

Patch40:          0040-Ticket-49470-overflow-in-pblock_get.patch

Patch41:          0041-Ticket-49471-heap-buffer-overflow-in-ss_unescape.patch

Patch42:          0042-Ticket-49298-fix-complier-warn.patch

Patch43:          0043-Ticket-49495-Fix-memory-management-is-vattr.patch

Patch44:          0044-Ticket-48184-close-connections-at-shutdown-cleanly.patch

Patch45:          0045-Ticket-49509-Indexing-of-internationalized-matching-.patch

Patch46:          0046-Ticket-49493-heap-use-after-free-in-csn_as_string.patch

Patch47:          0047-Ticket-49524-Password-policy-minimum-token-length-fa.patch

Patch48:          0048-Ticket-49446-cleanallruv-should-ignore-cleaned-repli.patch

Patch49:          0049-Ticket-49413-Changelog-trimming-ignores-disabled-rep.patch

Patch50:          0050-Ticket-49278-GetEffectiveRights-gives-false-negative.patch

Patch51:          0051-Ticket-49531-coverity-issues-fix-memory-leaks.patch

Patch52:          0052-Ticket-49529-Fix-Coverity-warnings-invalid-deference.patch

Patch53:          0053-Ticket-49463-After-cleanALLruv-there-is-a-flow-of-ke.patch

Patch54:          0054-Ticket-49532-coverity-issues-fix-compiler-warnings-c.patch

Patch55:          0055-Ticket-49523-memberof-schema-violation-error-message.patch

Patch56:          0056-Ticket-49534-Fix-coverity-issues-and-regression.patch

Patch57:          0057-Ticket-49370-Add-all-the-password-policy-defaults-to.patch

Patch58:          0058-Ticket-49541-repl-config-should-not-allow-rid-65535-.patch

Patch59:          0059-CVE-2017-15134-crash-in-slapi_filter_sprintf.patch

Patch60:          0060-Ticket-49534-Fix-coverity-regression.patch

Patch61:          0061-Ticket-49541-Replica-ID-config-validation-fix.patch

Patch62:          0062-Ticket-49370-Crash-when-using-a-global-and-local-pw.patch

Patch63:          0063-Ticket-49557-Add-config-option-for-checking-CRL-on-o.patch

Patch64:          0064-Ticket-49560-nsslapd-extract-pemfiles-should-be-enab.patch

Patch65:          0065-Ticket-bz1525628-invalid-password-migration-causes-u.patch

Patch66:          0066-Ticket-49545-final-substring-extended-filter-search-.patch

Patch67:          0067-Ticket-49551-v3-correct-handling-of-numsubordinates-.patch

Patch68:          0068-Ticket-49551-fix-memory-leak-found-by-coverity.patch

Patch69:          0069-Ticket-48184-revert-previous-patch-around-nunc-stans.patch

Patch70:          0070-Ticket-49619-adjustment-of-csn_generator-can-fail-so.patch

Patch71:          0071-Ticket-49161-memberof-fails-if-group-is-moved-into-s.patch

Patch72:          0072-Ticket-49296-Fix-race-condition-in-connection-code-w.patch

Patch73:          0073-Ticket-49540-Indexing-task-is-reported-finished-too-.patch

Patch74:          0074-Ticket-49566-ds-replcheck-needs-to-work-with-hidden-.patch

Patch75:          0075-Ticket-49460-replica_write_ruv-log-a-failure-even-wh.patch  

Patch76:          0076-Ticket-49631-same-csn-generated-twice.patch

Patch77:          0077-CVE-2018-1089-Crash-from-long-search-filter.patch

Patch78:          0078-Ticket-49649.patch

Patch79:          0079-Ticket-49665-Upgrade-script-doesn-t-enable-PBKDF2-pa.patch

Patch80:          0080-Ticket-49665-Upgrade-script-doesn-t-enable-CRYPT-pas.patch

Patch81:          0081-Ticket-49671-Readonly-replicas-should-not-write-inte.patch

Patch82:          0082-Ticket-49696-replicated-operations-should-be-seriali.patch

Patch83:          0083-Ticket-48184-clean-up-and-delete-connections-at-shut.patch

Patch84:          0084-Ticket-49576-Update-ds-replcheck-for-new-conflict-en.patch

Patch85:          0085-Ticket-49576-Add-support-of-deletedattribute-in-ds-r.patch

Patch86:          0086-Ticket-49726-DS-only-accepts-RSA-and-Fortezza-cipher.patch

Patch87:          0087-Ticket-48184-clean-up-and-delete-connections-at-shut.patch

Patch88:          0088-Ticket-49736-Hardening-of-active-connection-list.patch

Patch89:          0089-Ticket-49652-DENY-aci-s-are-not-handled-properly.patch

Patch90:          0090-Ticket-49576-ds-replcheck-fix-certificate-directory-.patch

Patch91:          0091-Ticket-49765-Async-operations-can-hang-when-the-serv.patch

Patch92:          0092-Ticket-49765-compiler-warning.patch

Patch93:          0093-Ticket-49893-disable-nunc-stans-by-default.patch

Patch94:          0094-Ticket-49890-ldapsearch-with-server-side-sort-crashe.patch

Patch95:          0095-Ticket-49742-Fine-grained-password-policy-can-impact.patch

Patch96:          0096-Bug-1623247-Crash-in-vslapd_log_emergency_error.patch

Patch97:          0097-Ticket-49768-Under-network-intensive-load-persistent.patch

Patch98:          0098-Ticket-49932-Crash-in-delete_passwdPolicy-when-persi.patch

%description

389 Directory Server is an LDAPv3 compliant server.  The base package includes

the LDAP server and command line utilities for server administration.

%package          libs

Summary:          Core libraries for 389 Directory Server

Group:            System Environment/Daemons

BuildRequires:    nspr-devel

BuildRequires:    nss-devel >= 3.34

BuildRequires:    svrcore-devel >= 4.1.3

BuildRequires:    openldap-devel

BuildRequires:    libdb-devel

BuildRequires:    cyrus-sasl-devel

BuildRequires:    libicu-devel

BuildRequires:    pcre-devel

BuildRequires:    libtalloc-devel

BuildRequires:    libevent-devel

BuildRequires:    libtevent-devel

BuildRequires:    systemd-devel

%if %{use_asan}

Requires:    libasan

%endif

%description      libs

Core libraries for the 389 Directory Server base package.  These libraries

are used by the main package and the -devel package.  This allows the -devel

package to be installed with just the -libs package and without the main package.

%package          devel

Summary:          Development libraries for 389 Directory Server

Group:            Development/Libraries

Requires:         %{name}-libs = %{version}-%{release}

Requires:         pkgconfig

Requires:         nspr-devel

Requires:         nss-devel >= 3.34

Requires:         svrcore-devel >= 4.1.3

Requires:         openldap-devel

Requires:         libtalloc

Requires:         libevent

Requires:         libtevent

Requires:         systemd-libs

%description      devel

Development Libraries and headers for the 389 Directory Server base package.

%package          snmp

Summary:          SNMP Agent for 389 Directory Server

Group:            System Environment/Daemons

Requires:         %{name} = %{version}-%{release}

Obsoletes:        %{name} <= 1.3.6.0

%description      snmp

SNMP Agent for the 389 Directory Server base package.

%package          tests

Summary:          The lib389 Continuous Integration Tests

Group:            Development/Libraries

Requires:         python-lib389

BuildArch:        noarch

%description      tests

The lib389 CI tests that can be run against the Directory Server.

%prep

%autosetup -p1 -n %{name}-%{version}%{?prerel}

cp %{SOURCE2} README.devel

%build

OPENLDAP_FLAG="--with-openldap"

%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}

# hack hack hack https://bugzilla.redhat.com/show_bug.cgi?id=833529

NSSARGS="--with-svrcore-inc=%{_includedir} --with-svrcore-lib=%{_libdir} --with-nss-lib=%{_libdir} --with-nss-inc=%{_includedir}/nss3"

%if %{use_tcmalloc}

TCMALLOC_FLAGS="--enable-tcmalloc"

%endif

%if %{use_asan}

ASAN_FLAGS="--enable-asan --enable-debug"

%endif

# Rebuild the autotool artifacts now.

autoreconf -fiv

%configure --enable-autobind --with-selinux $OPENLDAP_FLAG $TMPFILES_FLAG \

           --with-systemdsystemunitdir=%{_unitdir} \

           --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \

           --with-perldir=/usr/bin \

           --with-systemdgroupname=%{groupname} $NSSARGS \

           --with-systemd $TCMALLOC_FLAGS $ASAN_FLAGS

# Generate symbolic info for debuggers

export XCFLAGS=$RPM_OPT_FLAGS

%ifarch x86_64 ppc64 ia64 s390x sparc64

export USE_64=1

%endif

make %{?_smp_mflags}

%install

rm -rf $RPM_BUILD_ROOT

make DESTDIR="$RPM_BUILD_ROOT" install

# Copy in our docs from doxygen.

cp -r %{_builddir}/%{name}-%{version}%{?prerel}/man/man3 $RPM_BUILD_ROOT/%{_mandir}/man3

mkdir -p $RPM_BUILD_ROOT/var/log/%{pkgname}

mkdir -p $RPM_BUILD_ROOT/var/lib/%{pkgname}

mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname}

# for systemd

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants

#remove libtool archives and static libs

find %{buildroot} -type f -name "*.la" -delete

find %{buildroot} -type f -name "*.a" -delete

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.a

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/*.la

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.a

#rm -f $RPM_BUILD_ROOT%{_libdir}/%{pkgname}/plugins/*.la

# Why are we not making this a proper python package?

pushd ../%{name}-%{version}%{?prerel}

cp -r dirsrvtests $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}

find $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}/dirsrvtests -type f -name '*.pyc' -delete

find $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}/dirsrvtests -type f -name '*.pyo' -delete

find $RPM_BUILD_ROOT/%{_sysconfdir}/%{pkgname}/dirsrvtests -type d -name '__pycache__' -delete

popd

# make sure perl scripts have a proper shebang

sed -i -e 's|#{{PERL-EXEC}}|#!/usr/bin/perl|' $RPM_BUILD_ROOT%{_datadir}/%{pkgname}/script-templates/template-*.pl

## exclude 32-bit platforms from running tests

%if %{_arch} != "s390x" && %{_arch} != "s390" && %{_arch} != "i386" && %{_arch} != "ppc"

%check

## This checks the code, if it fails it prints why, then re-raises the fail to shortcircuit the rpm build#.

if ! make DESTDIR="$RPM_BUILD_ROOT" check; then cat ./test-suite.log && false; fi

%endif

%clean

rm -rf $RPM_BUILD_ROOT

%post

output=/dev/null

output2=/dev/null

# reload to pick up any changes to systemd files

/bin/systemctl daemon-reload >$output 2>&1 || :

# reload to pick up any shared lib changes

/sbin/ldconfig

# find all instances

instances="" # instances that require a restart after upgrade

ninst=0 # number of instances found in total

if [ -n "$DEBUGPOSTTRANS" ] ; then

   output=$DEBUGPOSTTRANS

   output2=${DEBUGPOSTTRANS}.upgrade

fi

# Soft static allocation for UID and GID

USERNAME="dirsrv"

ALLOCATED_UID=389

GROUPNAME="dirsrv"

ALLOCATED_GID=389

HOMEDIR="/usr/share/dirsrv"

getent group $GROUPNAME >/dev/null || /usr/sbin/groupadd -f -g $ALLOCATED_GID -r $GROUPNAME

if ! getent passwd $USERNAME >/dev/null ; then

    /usr/sbin/useradd -r -u $ALLOCATED_UID -g $GROUPNAME -d $HOMEDIR -s /sbin/nologin -c "user for 389-ds-base" $USERNAME

fi

# Reload our sysctl before we restart (if we can)

sysctl --system &> $output; true

echo looking for instances in %{_sysconfdir}/%{pkgname} > $output 2>&1 || :

instbase="%{_sysconfdir}/%{pkgname}"

for dir in $instbase/slapd-* ; do

    echo dir = $dir >> $output 2>&1 || :

    if [ ! -d "$dir" ] ; then continue ; fi

    case "$dir" in *.removed) continue ;; esac

    basename=`basename $dir`

    inst="%{pkgname}@`echo $basename | sed -e 's/slapd-//g'`"

    echo found instance $inst - getting status  >> $output 2>&1 || :

    if /bin/systemctl -q is-active $inst ; then

       echo instance $inst is running >> $output 2>&1 || :

       instances="$instances $inst"

    else

       echo instance $inst is not running >> $output 2>&1 || :

    fi

    ninst=`expr $ninst + 1`

done

if [ $ninst -eq 0 ] ; then

    echo no instances to upgrade >> $output 2>&1 || :

    exit 0 # have no instances to upgrade - just skip the rest

fi

# shutdown all instances

echo shutting down all instances . . . >> $output 2>&1 || :

for inst in $instances ; do

    echo stopping instance $inst >> $output 2>&1 || :

    /bin/systemctl stop $inst >> $output 2>&1 || :

done

echo remove pid files . . . >> $output 2>&1 || :

/bin/rm -f /var/run/%{pkgname}*.pid /var/run/%{pkgname}*.startpid

# do the upgrade

echo upgrading instances . . . >> $output 2>&1 || :

DEBUGPOSTSETUPOPT=`/usr/bin/echo $DEBUGPOSTSETUP | /usr/bin/sed -e "s/[^d]//g"`

if [ -n "$DEBUGPOSTSETUPOPT" ] ; then

    %{_sbindir}/setup-ds.pl -l $output2 -$DEBUGPOSTSETUPOPT -u -s General.UpdateMode=offline >> $output 2>&1 || :

else

    %{_sbindir}/setup-ds.pl -l $output2 -u -s General.UpdateMode=offline >> $output 2>&1 || :

fi

# restart instances that require it

for inst in $instances ; do

    echo restarting instance $inst >> $output 2>&1 || :

    /bin/systemctl start $inst >> $output 2>&1 || :

done

exit 0

%preun

if [ $1 -eq 0 ]; then # Final removal

    # remove instance specific service files/links

    rm -rf %{_sysconfdir}/systemd/system/%{groupname}.wants/* > /dev/null 2>&1 || :

fi

%postun

/sbin/ldconfig

if [ $1 = 0 ]; then # Final removal

    rm -rf /var/run/%{pkgname}

fi

%post snmp

%systemd_post %{pkgname}-snmp.service

%preun snmp

%systemd_preun %{pkgname}-snmp.service %{groupname}

%postun snmp

%systemd_postun_with_restart %{pkgname}-snmp.service

%files

%defattr(-,root,root,-)

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl

%dir %{_sysconfdir}/%{pkgname}

%dir %{_sysconfdir}/%{pkgname}/schema

%config(noreplace)%{_sysconfdir}/%{pkgname}/schema/*.ldif

%dir %{_sysconfdir}/%{pkgname}/config

%dir %{_sysconfdir}/systemd/system/%{groupname}.wants

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/slapd-collations.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/certmap.conf

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/template-initconfig

%config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}

%config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}.systemd

%{_datadir}/%{pkgname}

%{_datadir}/gdb/auto-load/*

%{_unitdir}

%{_bindir}/*

# We have to seperate this from being a glob to ensure the caps are applied.

%{_sbindir}/ns-slapd

%{_sbindir}/bak2db

%{_sbindir}/bak2db.pl

%{_sbindir}/cleanallruv.pl

%{_sbindir}/db2bak

%{_sbindir}/db2bak.pl

%{_sbindir}/db2index

%{_sbindir}/db2index.pl

%{_sbindir}/db2ldif

%{_sbindir}/db2ldif.pl

%{_sbindir}/dbmon.sh

%{_sbindir}/dbverify

%{_sbindir}/dn2rdn

%{_sbindir}/ds_selinux_enabled

%{_sbindir}/ds_selinux_port_query

%{_sbindir}/ds_systemd_ask_password_acl

%{_sbindir}/fixup-linkedattrs.pl

%{_sbindir}/fixup-memberof.pl

%{_sbindir}/ldif2db

%{_sbindir}/ldif2db.pl

%{_sbindir}/ldif2ldap

%{_sbindir}/migrate-ds.pl

%{_sbindir}/monitor

%{_sbindir}/ns-accountstatus.pl

%{_sbindir}/ns-activate.pl

%{_sbindir}/ns-inactivate.pl

%{_sbindir}/ns-newpwpolicy.pl

%{_sbindir}/remove-ds.pl

%{_sbindir}/restart-dirsrv

%{_sbindir}/restoreconfig

%{_sbindir}/saveconfig

%{_sbindir}/schema-reload.pl

%{_sbindir}/setup-ds.pl

%{_sbindir}/start-dirsrv

%{_sbindir}/status-dirsrv

%{_sbindir}/stop-dirsrv

%{_sbindir}/suffix2instance

%{_sbindir}/syntax-validate.pl

%{_sbindir}/upgradedb

%{_sbindir}/upgradednformat

%{_sbindir}/usn-tombstone-cleanup.pl

%{_sbindir}/verify-db.pl

%{_sbindir}/vlvindex

%{_libdir}/%{pkgname}/perl

%{_libdir}/%{pkgname}/python

%dir %{_libdir}/%{pkgname}/plugins

%{_libdir}/%{pkgname}/plugins/*.so

%{_prefix}/lib/sysctl.d/*

%dir %{_localstatedir}/lib/%{pkgname}

%dir %{_localstatedir}/log/%{pkgname}

%ghost %dir %{_localstatedir}/lock/%{pkgname}

%{_mandir}/man1/*

%{_mandir}/man8/*

%exclude %{_sbindir}/ldap-agent*

%exclude %{_mandir}/man1/ldap-agent.1.gz

%exclude %{_unitdir}/%{pkgname}-snmp.service

%files devel

%defattr(-,root,root,-)

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel

%{_includedir}/%{pkgname}

%{_libdir}/%{pkgname}/libslapd.so

%{_libdir}/%{pkgname}/libns-dshttpd.so

%{_mandir}/man3/*

%{_libdir}/%{pkgname}/libnunc-stans.so

%{_libdir}/%{pkgname}/libsds.so

%{_libdir}/%{pkgname}/libldaputil.so

%{_libdir}/pkgconfig/*

%files libs

%defattr(-,root,root,-)

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel

%dir %{_libdir}/%{pkgname}

%{_libdir}/%{pkgname}/libslapd.so.*

%{_libdir}/%{pkgname}/libns-dshttpd-*.so

%{_libdir}/%{pkgname}/libnunc-stans.so.*

%{_libdir}/%{pkgname}/libsds.so.*

%{_libdir}/%{pkgname}/libldaputil.so.*

%files snmp

%defattr(-,root,root,-)

%doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel

%config(noreplace)%{_sysconfdir}/%{pkgname}/config/ldap-agent.conf

%{_sbindir}/ldap-agent*

%{_mandir}/man1/ldap-agent.1.gz

%{_unitdir}/%{pkgname}-snmp.service

%files tests

%defattr(-,root,root,-)

%doc LICENSE LICENSE.GPLv3+

%{_sysconfdir}/%{pkgname}/dirsrvtests

%changelog

* Thu Sep 13 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-28

- Bump version to 1.3.7.5-28

- Resolves: Bug 1628676 - 389-ds-base: race condition on reference counter leads to DoS using persistent search

- Resolves: Bug 1628677 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly 

* Wed Aug 29 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-27

- Bump version to 1.3.7.5-27

- Resolves: Bug 1623247 - Crash in vslapd_log_emergency_error

* Tue Aug 14 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-26

- Bump version to 1.3.7.5-26

- Resolves: Bug 1615924 - Fine grained password policy can impact search performance

- Resolves: Bug 1614836 - Disable nunc-stans by default

- Resolves: Bug 1614861 - ldapsearch with server side sort crashes the ldap server

* Tue Jul 3 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-25

- Bump version to 1.3.7.5-25

- Resolves: Bug 1597530 - Async operations can hang when the server is running nunc-stans

* Wed Jun 13 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-24

- Bump version to 1.3.7.5-24

- Resolves: Bug 1580257 - Fix certificate directory verification

* Fri Jun 1 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-23

- Bump version to 1.3.7.5-23

- Resolves: Bug 1581588 - ACI deny rules do not work correctly

- Resolves: Bug 1582747 - DS only accepts RSA and Fortezza cipher families

* Mon May 21 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-22

- Bump version to 1.3.5.7-22

- Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received

- Resolves: Bug 1579702 - Replication stops working when MemberOf plugin is enabled on hub and consumer

- Resolves: Bug 1579698 - replicated operations should be serialized

- Resolves: Bug 1579700 - Upgrade script doesn't enable PBKDF password storage plug-in

- Resolves: Bug 1580257 - ds-replcheck LDIF comparision fails when checking for conflicts

- Resolves: Bug 1580523 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired

* Thu Apr 5 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-21

- Bump version to 1.3.7.5-21

- Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch

* Wed Apr 4 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-20

- Bump version to 1.3.7.5-20

- Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received 

- Resolves: Bug 1559764 - memberof fails if group is moved into scope

- Resolves: Bug 1554720 - "Truncated search results" pop-up appears in user details in WebUI 

- Resolves: Bug 1553605 - ipa-server-install fails with Error: Upgrade failed with no such entry

- Resolves: Bug 1559760 - ds-replcheck: add -W option to ask for the password from stdin instead of passing it on command line

- Resolves: Bug 1559464 - replica_write_ruv log a failure even when it succeeds

* Tue Apr 3 2018 Matus Honek <mhonek@redhat.com> - 1.3.7.5-19

- Bump version to 1.3.7.5-19

- Resolves: Bug 1563107 - IPA server is not responding, all authentication and admin tests failed [rhel-7.5.z]

* Mon Feb 12 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-18

- Bump version to 1.3.7.5-18

- Resolves: Bug 1539082 - Fix memory leak

* Mon Feb 12 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5.17

- Bump version to 1.3.7.5.17

- Resolves: Bug 1539082 - Child entry cenotaphs should not prevent the deletion of the parent

- Resolves: Bug 1540106 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 

- Resolves: Bug 1535538 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp 

* Tue Feb 6 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-16

- Bump version to 1.3.7.5-16

- Resolves: Bug 1542645 - Outgoing secure connection is failing with recent OpenLDAP

* Tue Feb 6 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-15

- Bump version to 1.3.7.5-15

- Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry

- Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy

- Resolves: Bug 1541108 - Allow CRL handling to be configurable for outgoing connections

* Fri Jan 26 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-14

- Bump version to 1.3.7.5-14

- Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7 (fix regression in -13)

* Thu Jan 18 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-13

- Bump version to 1.3.7.5-13

- Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry

- Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7

- Resolves: Bug 1534379 - CVE-2017-15134: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c 

- Resolves: Bug 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry

- Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy

* Fri Jan 12 2018 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-12

- Bump version to 1.3.7.5-12

- Resolves: Bug 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter

- Resolves: Bug 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica

- Resolves: Bug 1517788 - password policy: minimum token length fails when the token length is equal to attribute length

- Resolves: Bug 1518287 - heap-use-after-free in csn_as

- Resolves: Bug 1531153 - Indexing of internationalized matching rules is failing

- Resolves: Bug 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired

- Resolves: Bug 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate

- Resolves: Bug 1457315 - cmocka tests are not executed during rpm build

- Resolves: Bug 1516309 - After cleanALLruv, replication is looping on keep alive DEL

* Fri Dec 8 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-11

- Bump version to 1.3.7.5-11

- Resolves: Bug 1518069 - heap-buffer-overflow in ss_unescape

- Resolves: Bug 1516676 - gssapi authentication fails after upgrading 389-ds-base

- Resolves: Bug 1511885 - Automatically load /usr/lib/sysctl.d/70-dirsrv.conf after installing 389-ds-base

- Resolves: Bug 1517980 - stack-buffer-overflow in slapi_pblock_get

* Thu Nov 16 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-10

- Bump version to 1.3.7.5-10

- Resolves: Bug 1464463 - Replication fails to start with CBCA (Certificate-Based Client Authentication) while FIPS mode is enabled.

- Resolves: Bug 1465383 - Segmentation fault in valueset_array_to_sorted_quick

- Resolves: Bug 1510865 - python-ldap is not a dependency of 389-ds-base

- Resolves: Bug 1513467 - IPA upgrade fails for latest ipa package

- Resolves: Bug 1192099 - IPA server replication broken, after DS stop-start, due to changelog reset

- Resolves: Bug 1445188 - Misleading error message - Incoming BER Element was 3 bytes 

- Resolves: Bug 1498980 - heap corruption during import

- Resolves: Bug 1511462 - scope one searches give incorrect results

- Resolves: Bug 1514033 - opened connection are hanging, no longer poll

* Fri Nov 3 2017 Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-9