unbound/contrib/unbound.spec_fedora

   1 # not ready yet
   2 %{?!with_python:      %global with_python      1}
   3
   4 %if %{with_python}
   5 %{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
   6 %{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
   7 %endif
   8
   9 Summary: Validating, recursive, and caching DNS(SEC) resolver
  10 Name: unbound
  11 Version: 1.4.13
  12 Release: 1%{?dist}
  13 License: BSD
  14 Url: http://www.nlnetlabs.nl/unbound/
  15 Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
  16 Source1: unbound.init
  17 Source2: unbound.conf
  18 Source3: unbound.munin
  19 Source4: unbound_munin_
  20 Source5: root.key
  21 Source6: dlv.isc.org.key
  22 Patch1: unbound-1.2-glob.patch
  23
  24 Group: System Environment/Daemons
  25 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
  26 BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0,
  27 BuildRequires: libevent-devel expat-devel
  28 %if %{with_python}
  29 BuildRequires:  python-devel swig
  30 %endif
  31 # Required for SVN versions
  32 # BuildRequires: bison
  33
  34 Requires(post): chkconfig
  35 Requires(preun): chkconfig
  36 Requires(preun): initscripts
  37 Requires(postun): initscripts
  38 Requires: ldns >= 1.5.0
  39 Requires(pre): shadow-utils
  40
  41 Obsoletes:      dnssec-conf < 1.27-2
  42 Provides:       dnssec-conf = 1.27-1
  43
  44 %description
  45 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
  46
  47 The C implementation of Unbound is developed and maintained by NLnet
  48 Labs. It is based on ideas and algorithms taken from a java prototype
  49 developed by Verisign labs, Nominet, Kirei and ep.net.
  50
  51 Unbound is designed as a set of modular components, so that also
  52 DNSSEC (secure DNS) validation and stub-resolvers (that do not run
  53 as a server, but are linked into an application) are easily possible.
  54
  55 %package munin
  56 Summary: Plugin for the munin / munin-node monitoring package
  57 Group:     System Environment/Daemons
  58 Requires: munin-node
  59 Requires: %{name} = %{version}-%{release}, bc
  60
  61 %description munin
  62 Plugin for the munin / munin-node monitoring package
  63
  64 %package devel
  65 Summary: Development package that includes the unbound header files
  66 Group: Development/Libraries
  67 Requires: %{name}-libs = %{version}-%{release}, openssl-devel, ldns-devel
  68
  69 %description devel
  70 The devel package contains the unbound library and the include files
  71
  72 %package libs
  73 Summary: Libraries used by the unbound server and client applications
  74 Group: Applications/System
  75 Requires(post): /sbin/ldconfig
  76 Requires(postun): /sbin/ldconfig
  77 Requires: openssl
  78
  79 %description libs
  80 Contains libraries used by the unbound server and client applications
  81
  82 %if %{with_python}
  83 %package python
  84 Summary: Python modules and extensions for unbound
  85 Group: Applications/System
  86 Requires: %{name}-libs = %{version}-%{release}
  87
  88 %description python
  89 Python modules and extensions for unbound
  90 %endif
  91
  92 %prep
  93 %setup -q
  94 %patch1 -p1
  95
  96 %build
  97 %configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
  98             --disable-rpath --disable-static \
  99             --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
 100             --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
 101 %if %{with_python}
 102             --with-pythonmodule --with-pyunbound \
 103 %endif
 104             --enable-sha2 --disable-gost
 105 %{__make} %{?_smp_mflags}
 106
 107 %install
 108 rm -rf %{buildroot}
 109 %{__make} DESTDIR=%{buildroot} install
 110 install -d 0755 %{buildroot}%{_initrddir}
 111 install -m 0755 %{SOURCE1} %{buildroot}%{_initrddir}/unbound
 112 install -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound
 113 # Install munin plugin and its softlinks
 114 install -d 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
 115 install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound
 116 install -d 0755 %{buildroot}%{_datadir}/munin/plugins/
 117 install -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound
 118 for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do
 119     ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
 120 done
 121
 122 # install root and DLV key
 123 install -m 0644 %{SOURCE5} %{SOURCE6} %{buildroot}%{_sysconfdir}/unbound/
 124
 125 # remove static library from install (fedora packaging guidelines)
 126 rm %{buildroot}%{_libdir}/*.la
 127 %if %{with_python}
 128 rm %{buildroot}%{python_sitearch}/*.la
 129 %endif
 130
 131 mkdir -p %{buildroot}%{_localstatedir}/run/unbound
 132
 133 %clean
 134 rm -rf ${RPM_BUILD_ROOT}
 135
 136 %files
 137 %defattr(-,root,root,-)
 138 %doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
 139 %attr(0755,root,root) %{_initrddir}/%{name}
 140 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
 141 %ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 142 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 143 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
 144 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
 145 %{_sbindir}/*
 146 %{_mandir}/*/*
 147
 148 %if %{with_python}
 149 %files python
 150 %defattr(-,root,root,-)
 151 %{python_sitearch}/*
 152 %doc libunbound/python/examples/*
 153 %doc pythonmod/examples/*
 154 %endif
 155
 156 %files munin
 157 %defattr(-,root,root,-)
 158 %config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound
 159 %{_datadir}/munin/plugins/unbound*
 160
 161 %files devel
 162 %defattr(-,root,root,-)
 163 %{_libdir}/libunbound.so
 164 %{_includedir}/unbound.h
 165 %doc README
 166
 167 %files libs
 168 %defattr(-,root,root,-)
 169 %{_libdir}/libunbound.so.*
 170 %doc doc/README doc/LICENSE
 171
 172 %pre
 173 getent group unbound >/dev/null || groupadd -r unbound
 174 getent passwd unbound >/dev/null || \
 175 useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \
 176 -c "Unbound DNS resolver" unbound
 177 exit 0
 178
 179 %post
 180 /sbin/chkconfig --add %{name}
 181 # dnssec-conf used to contain our DLV key, but now we include it via unbound
 182 # If unbound had previously been configured with dnssec-configure, we need
 183 # to migrate the location of the DLV key file (to keep DLV enabled, and because
 184 # unbound won't start with a bad location for a DLV key file.
 185 sed -i "s:/etc/pki/dnssec-keys[/]*dlv:/etc/unbound:" %{_sysconfdir}/unbound/unbound.conf
 186
 187 %post libs -p /sbin/ldconfig
 188
 189 %preun
 190 if [ "$1" -eq 0 ]; then
 191         /sbin/service %{name} stop >/dev/null 2>&1
 192         /sbin/chkconfig --del %{name}
 193 fi
 194
 195 %postun
 196 if [ "$1" -ge "1" ]; then
 197   /sbin/service %{name} condrestart >/dev/null 2>&1 || :
 198 fi
 199
 200 %postun libs -p /sbin/ldconfig
 201
 202 %changelog
 203 * Tue Sep 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-1
 204 - Updated to 1.4.13
 205 - Fix install location of pythonmod from sitelib to sitearch
 206 - Removed patches merged in by upstream
 207 - Removed versioned openssl dep, it differs per branch
 208
 209 * Mon Aug 08 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-3
 210 - Added pythonmod docs and examples
 211 - Fix for python module load in the server (Tom Hendrikx)
 212 - No longer enable --enable-debug as it causes degraded  performance
 213   under load.
 214
 215 * Mon Jul 18 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-1
 216 - Updated to 1.4.12
 217
 218 * Sun Jul 03 2011 Paul Wouters <paul@xelerance.com> - 1.4.11-1
 219 - Updated to 1.4.11
 220 - removed integrated CVE patch
 221 - updated stock unbound.conf for new options introduced
 222
 223 * Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.10-1
 224 - Added ghost for /var/run/unbound (bz#656710)
 225
 226 * Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-3
 227 - rebuilt
 228
 229 * Wed May 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-2
 230 - Applied patch for CVE-2011-1922 DoS vulnerability
 231
 232 * Sun Mar 27 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-1
 233 - Updated to 1.4.9
 234
 235 * Sat Feb 12 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-2
 236 - rebuilt
 237
 238 * Tue Jan 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-1
 239 - Updated to 1.4.8
 240 - Enable root key for DNSSEC
 241 - Fix unbound-munin to use proper file (could cause excessive logging)
 242 - Build unbound-python per default
 243 - Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl
 244
 245 * Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-4
 246 - Revert last build - it was on the wrong branch
 247
 248 * Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-3
 249 - Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines
 250   (see comments in inbound.conf)
 251
 252 * Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-2
 253 - Bump release - forgot to upload the new tar ball.
 254
 255 * Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-1
 256 - Upgraded to 1.4.5
 257
 258 * Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-2
 259 - Added accidentally omitted svn patches to cvs
 260
 261 * Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-1
 262 - Upgraded to 1.4.4 with svn patches
 263 - Obsolete dnssec-conf to ensure it is de-installed
 264
 265 * Thu Mar 11 2010 Paul Wouters <paul@xelerance.com> - 1.4.3-1
 266 - Update to 1.4.3 that fixes 64bit crasher
 267
 268 * Tue Mar 09 2010 Paul Wouters <paul@xelerance.com> - 1.4.2-1
 269 - Updated to 1.4.2
 270 - Updated unbound.conf with new options
 271 - Enabled pre-fetching DNSKEY records (DNSSEC speedup)
 272 - Enabled re-fetching popular records before they expire
 273 - Enabled logging of DNSSEC validation errors
 274
 275 * Mon Mar 01 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-5
 276 - Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues
 277   with pthreads
 278
 279 * Wed Feb 24 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-3
 280 - Change make/configure lines to attempt to fix -lphtread linking issue
 281
 282 * Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
 283 - Removed dependancy for dnssec-conf
 284 - Added ISC DLV key (formerly in dnssec-conf)
 285 - Fixup old DLV locations in unbound.conf file via %%post
 286 - Fix parent child disagreement handling and no-ipv6 present [svn r1953]
 287
 288 * Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
 289 - Updated to 1.4.1
 290 - Changed %%define to %%global
 291
 292 * Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-2
 293 - Bump version
 294
 295 * Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-1
 296 - Upgraded to 1.3.4. Security fix with validating NSEC3 records
 297
 298 * Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.3.3-2
 299 - rebuilt with new openssl
 300
 301 * Mon Aug 17 2009 Paul Wouters <paul@xelerance.com> - 1.3.3-1
 302 - Updated to 1.3.3
 303
 304 * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.0-3
 305 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
 306
 307 * Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
 308 - Added missing glob patch to cvs
 309 - Place python macros within the %%with_python check
 310
 311 * Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-1
 312 - Updated to 1.3.0
 313 - Added unbound-python sub package. disabled for now
 314 - Patch from svn to fix DLV lookups
 315 - Patches from svn to detect wrong truncated response from BIND 9.6.1 with
 316   minimal-responses)
 317 - Added Default-Start and Default-Stop to unbound.init
 318 - Re-enabled --enable-sha2
 319 - Re-enabled glob.patch
 320
 321 * Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
 322 - unbound-iterator.patch was not commited
 323
 324 * Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
 325 - Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
 326
 327 * Tue Mar 17 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-5
 328 - Use --nocheck to avoid giving an error on missing unbound-remote certs/keys
 329
 330 * Tue Mar 10 2009 Adam Tkac <atkac redhat com> - 1.2.1-4
 331 - enable DNSSEC only if it is enabled in sysconfig/dnssec
 332
 333 * Mon Mar 09 2009 Adam Tkac <atkac redhat com> - 1.2.1-3
 334 - add DNSSEC support to initscript and enabled it per default
 335 - add requires dnssec-conf
 336
 337 * Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.1-2
 338 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
 339
 340 * Tue Feb 10 2009 Paul Wouters <paul@xelerance.com - 1.2.1-1
 341 - updated to 1.2.1
 342
 343 * Sun Jan 18 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.0-2
 344 - rebuild with new openssl
 345
 346 * Wed Jan 14 2009 Paul Wouters <paul@xelerance.com - 1.2.0-1
 347 - Updated to 1.2.0
 348 - Added dependancy on minimum SSL for CVE-2008-5077
 349 - Added dependancy on bc for unbound-munin
 350 - Added minimum requirement of libevent 1.4.5. Crashes with older versions
 351   (note: libevent is stale in EL-4 and not in EL-5, needs fixing there)
 352 - Removed dependancy on selinux-policy (will get used when available)
 353 - Enable options as per draft-wijngaards-dnsext-resolver-side-mitigation-00.txt
 354 - Enable unwanted-reply-threshold to mitigate against a Kaminsky attack
 355 - Enable val-clean-additional to drop addition unsigned data from signed
 356   response.
 357 - Removed patches (got merged into upstream)
 358
 359 * Mon Jan  5 2009 Paul Wouters <paul@xelerance.com> - 1.1.1-7
 360 - Modified scandir patch to silently fail when wildcard matches nothing
 361 - Patch to allow unbound-checkconf to find empty wildcard matches
 362
 363 * Mon Jan  5 2009 Paul Wouters <paul@xelerance.com> - 1.1.1-6
 364 - Added scandir patch for trusted-keys-file: option, which
 365   is used to load multiple dnssec keys in bind file format
 366
 367 * Mon Dec  8 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-4
 368 - Added Requires: for selinux-policy >= 3.5.13-33 for proper SElinux rules.
 369
 370 * Mon Dec  1 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-3
 371 - We did not own the /etc/unbound directory (#474020)
 372 - Fixed cvs anomalies
 373
 374 * Fri Nov 28 2008 Adam Tkac <atkac redhat com> - 1.1.1-2
 375 - removed all obsolete chroot related stuff
 376 - label control certs after generation correctly
 377
 378 * Thu Nov 20 2008 Paul Wouters <paul@xelerance.com> - 1.1.1-1
 379 - Updated to unbound 1.1.1 which fixes a crasher and
 380   addresses nlnetlabs bug #219
 381
 382 * Wed Nov 19 2008 Paul Wouters <paul@xelerance.com> - 1.1.0-3
 383 - Remove the chroot, obsoleted by SElinux
 384 - Add additional munin plugin links supported by unbound plugin
 385 - Move configuration directory from /var/lib/unbound to /etc/unbound
 386 - Modified unbound.init and unbound.conf to account for chroot changes
 387 - Updated unbound.conf with new available options
 388 - Enabled dns-0x20 protection per default
 389
 390 * Wed Nov 19 2008 Adam Tkac <atkac redhat com> - 1.1.0-2
 391 - unbound-1.1.0-log_open.patch
 392   - make sure log is opened before chroot call
 393   - tracked as http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=219
 394 - removed /dev/log and /var/run/unbound and /etc/resolv.conf from
 395   chroot, not needed
 396 - don't mount files in chroot, it causes problems during updates
 397 - fixed typo in default config file
 398
 399 * Fri Nov 14 2008 Paul Wouters <paul@xelerance.com> - 1.1.0-1
 400 - Updated to version 1.1.0
 401 - Updated unbound.conf's statistics options and remote-control
 402   to work properly for munin
 403 - Added unbound-munin package
 404 - Generate unbound remote-control  key/certs on first startup
 405 - Required ldns is now 1.4.0
 406
 407 * Wed Oct 22 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-5
 408 - Only call ldconfig in -libs package
 409 - Move configure into build section
 410 - devel subpackage should only depend on libs subpackage
 411
 412 * Tue Oct 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-4
 413 - Fix CFLAGS getting lost in build
 414 - Don't enable interface-automatic:yes because that
 415   causes unbound to listen on 0.0.0.0 instead of 127.0.0.1
 416
 417 * Sun Oct 19 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-3
 418 - Split off unbound-libs, make build verbose
 419
 420 * Thu Oct  9 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-2
 421 - FSB compliance, chroot fixes, initscript fixes
 422
 423 * Thu Sep 11 2008 Paul Wouters <paul@xelerance.com> - 1.0.2-1
 424 - Upgraded to 1.0.2
 425
 426 * Wed Jul 16 2008 Paul Wouters <paul@xelerance.com> - 1.0.1-1
 427 - upgraded to new release
 428
 429 * Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-2
 430 - Build against ldns-1.3.0
 431
 432 * Wed May 21 2008 Paul Wouters <paul@xelerance.com> - 1.0.0-1
 433 - Split of -devel package, fixed dependancies, make rpmlint happy
 434
 435 * Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
 436 - Using parts from ports collection entry by Jaap Akkerhuis.
 437 - Using Fedoraproject wiki guidelines.
 438
 439 * Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
 440 - Initial version.