knot/knot.spec

%global _hardened_build 1
%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}

Summary: High-performance authoritative DNS server
Name: knot
Version: 2.4.1
Release: 2%{?dist}
License: GPLv3
Group: System Environment/Daemons
URL: http://www.knot-dns.cz
Source0: http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz
Source1: http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz.asc
Source2: %{name}.init
Source3: %{name}.conf

Patch0: sphinx_theme_default.patch

# Required dependencies
BuildRequires: gnutls30-devel >= 3.3
BuildRequires: pkgconfig(liburcu) pkgconfig(jansson) lmdb-devel pkgconfig(libedit)
# Optional dependencies
BuildRequires: pkgconfig(libcap-ng) pkgconfig(libidn)
# fstrm is not available in EPEL6 so Dnstap support cannot be built

Requires(post): /bin/su

Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Obsoletes: %{name} < 2.0.0

%description
Knot DNS is a high-performance authoritative DNS server implementation.

%package libs
Summary: Libraries used by the Knot DNS server and client applications
Obsoletes: %{name} < 2.0.0
Conflicts: %{name} < 2.0.0

%description libs
The package contains shared libraries used by the Knot DNS server and
utilities.

%package devel
Summary: Development header files for the Knot DNS libraries
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Obsoletes: %{name} < 2.0.0

%description devel
The package contains development header files for the Knot DNS libraries
included in knot-libs package.

%package utils
Summary: DNS client utilities shipped with the Knot DNS server
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Obsoletes: %{name} < 2.0.0

%description utils
The package contains DNS client utilities shipped with the Knot DNS server.

%package doc
Summary: Documentation for the Knot DNS server
License: GPLv3 and BSD and MIT
Obsoletes: %{name} < 2.0.0
BuildArch: noarch
%if 0%{?rhel}
BuildRequires: python-sphinx
%else
BuildRequires: python3-sphinx
%endif
Provides: bundled(jquery)

%description doc
The package contains documentation for the Knot DNS server.

%prep
%setup -q

%patch0 -p1

# make sure embedded LMDB library is not used
rm -vr src/contrib/lmdb

%build
# disable debug code (causes unused warnings)
CFLAGS="%{optflags} -DNDEBUG -Wno-unused"

%ifarch armv7hl i686
# 32-bit architectures sometimes do not have sufficient amount of
# contiguous address space to handle default values
%define configure_db_sizes --with-conf-mapsize=64 --with-timer-mapsize=16
%endif

export PKG_CONFIG_PATH=%{_libdir}/gnutls30/pkgconfig
%configure %{configure_db_sizes}
make %{?_smp_mflags}
make html

%install
make install DESTDIR=%{buildroot}

# install documentation
mkdir -p %{buildroot}%{_pkgdocdir}
cp -av doc/_build/html %{buildroot}%{_pkgdocdir}
[ -r %{buildroot}%{_pkgdocdir}/html/index.html ] || exit 1
rm -f %{buildroot}%{_pkgdocdir}/html/.buildinfo

# install shell completion scripts
install -p -m 0644 -D samples/keymgr-completion.sh %{buildroot}%{_datadir}/bash-completion/completions/keymgr
install -p -m 0644 -D samples/keymgr-completion.zsh %{buildroot}%{_datadir}/zsh/site-functions/_keymgr

# install customized configuration file
rm %{buildroot}%{_sysconfdir}/%{name}/*
install -p -m 0644 -D %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf

# install service file and create rundir
install -p -m 0755 -D %{SOURCE2} %{buildroot}%{_initddir}/%{name}
install -d -m 0755 %{buildroot}%{_localstatedir}/run/%{name}

# create storage dir and key dir
mkdir -p %{buildroot}%{_sharedstatedir}
install -d -m 0775 %{buildroot}%{_sharedstatedir}/%{name}
install -d -m 0770 %{buildroot}%{_sharedstatedir}/%{name}/keys

# install config samples into docdir
install -d -m 0755 %{buildroot}%{_pkgdocdir}/samples
for sample_file in knot.sample.conf example.com.zone; do
    install -p -m 0644 samples/${sample_file} %{buildroot}%{_pkgdocdir}/samples
done

# remove static libraries and libarchive files
rm %{buildroot}%{_libdir}/*.a
rm %{buildroot}%{_libdir}/*.la

%check
make check

%pre
getent group knot >/dev/null || groupadd -r knot
getent passwd knot >/dev/null || useradd -r -g knot -d %{_sysconfdir}/knot -s /sbin/nologin -c "Knot DNS server" knot
if [ $1 -gt 1 ] ; then  # upgrade, try to detect versions 1.x
	if rpm -q --qf=%%{version} knot | grep -q "^1\." ; then
		touch %{_localstatedir}/lib/knot/knot.1x.upgrade
	fi
fi
exit 0

%post
/sbin/ldconfig
/sbin/chkconfig --add %{name}
# initialize/upgrade KASP database
/bin/su --login -s /bin/sh knot -c "%{_sbindir}/keymgr --dir %{_sharedstatedir}/%{name}/keys --legacy init"

if [ -e %{_localstatedir}/lib/knot/knot.1x.upgrade ] ; then
	# upgrading from Knot 1.x, convert config file
	cp /etc/knot/knot.conf /etc/knot/knot.conf.1x.rpmsave
	rm %{_localstatedir}/lib/knot/knot.1x.upgrade
	%{_libexecdir}/knot1to2 -i /etc/knot/knot.conf.1x.rpmsave -o /etc/knot/knot.conf
fi

%preun
if [ $1 -eq 0 ] ; then
	/sbin/service %{name} stop >/dev/null 2>&1
	/sbin/chkconfig --del %{name}
fi

%postun
/sbin/ldconfig
if [ "$1" -ge "1" ] ; then
	/sbin/service %{name} condrestart >/dev/null 2>&1 || :
fi

%files
%{_initddir}/%{name}
%{_pkgdocdir}/samples
%dir %attr(750,root,knot) %{_sysconfdir}/%{name}
%config(noreplace) %attr(640,root,knot) %{_sysconfdir}/%{name}/%{name}.conf
%dir %attr(775,root,knot) %{_sharedstatedir}/%{name}
%dir %attr(770,root,knot) %{_sharedstatedir}/%{name}/keys
%dir %attr(-,knot,knot) %{_localstatedir}/run/%{name}
%{_libexecdir}/knot1to2
%{_bindir}/kjournalprint
%{_bindir}/kzonecheck
%{_sbindir}/keymgr
%{_sbindir}/knotc
%{_sbindir}/knotd
%{_mandir}/man1/knot1to2.*
%{_mandir}/man1/kjournalprint.*
%{_mandir}/man1/kzonecheck.*
%{_mandir}/man5/knot.conf.*
%{_mandir}/man8/keymgr.*
%{_mandir}/man8/knotc.*
%{_mandir}/man8/knotd.*
%{_datadir}/bash-completion/completions/keymgr
%{_datadir}/zsh/site-functions/_keymgr

%files utils
%{_bindir}/kdig
%{_bindir}/khost
%{_bindir}/knsec3hash
%{_bindir}/knsupdate
%{_mandir}/man1/kdig.*
%{_mandir}/man1/khost.*
%{_mandir}/man1/knsec3hash.*
%{_mandir}/man1/knsupdate.*

%files libs
%doc COPYING AUTHORS NEWS THANKS
%{_libdir}/libdnssec.so.*
%{_libdir}/libknot.so.*
%{_libdir}/libzscanner.so.*

%files devel
%{_includedir}/dnssec
%{_includedir}/libknot
%{_includedir}/zscanner
%{_libdir}/libdnssec.so
%{_libdir}/libknot.so
%{_libdir}/libzscanner.so
%{_libdir}/pkgconfig/libdnssec.pc
%{_libdir}/pkgconfig/libknot.pc
%{_libdir}/pkgconfig/libzscanner.pc

%files doc
%dir %{_pkgdocdir}
%{_pkgdocdir}/html

%changelog
* Wed Mar 15 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-2
- fix build on 32 bit architectures

* Mon Feb 27 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-1
- new upstream release 2.4.1 replaces old 1.6.x series which is not supported
- configuration should be upgraded automatically using knot1to2 tool
- make sure you reviewed the new configuration in /etc/knot directory!

* Tue Aug 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 1.6.8-1
- new upstream release:
  + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)

* Wed Feb 10 2016 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.7-1
- new upstream release:
  + improvement: Log change of the zone serial number after IXFR transfer
  + improvement: Document operational impact of various RRL settings
  + improvement: Add support for rate-limit-slip zero
  + improvement: Add 'timer-db' configuration option

* Wed Nov 25 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.6-1
- new upstream release:
  + security fix: out-of-bound read in packet parser for malformed NAPTR record
  + fix: systemd startup notifications

* Wed Sep 02 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.5-1
- new upstream release:
  + fix: don't load expired zones on reload and startup
  + fix: remove race condition in scheduling causing delaying of events
  + fix: NSEC proof construction in zones with many delegations
  + fix: TC flag setting in RRL slipped answers
  + fix: disable domain name compression for root label
  + fix: check if executed under systemd before using journald log sink
  + feature: write persistent timers on server shutdown for better performance
  + feature: support time unit specification for 'max-conn-idle',
    'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options
  + feature: add 'request-edns-config' config option

* Thu Jun 18 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.4-1
- new upstream release:
  + fix: lost NOTIFY message if received during zone transfer
  + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP
  + fix: kdig, hide TSIG section with +noall
  + fix: do not set AA flag for AXFR/IXFR queries
  + feature: zone scanner, split long TXT/SPF strings into multiple strings
  + feature: kdig, add +generic dump style option
  + feature: try all servers on failure in multi-master environment
  + improvement: zone dump, do not print class for SOA record for consistency

* Wed Apr 08 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.3-1
- new upstream release:
  + fix: performance drop for NSEC-signed zones
  + fix: proper handling of TCP short-writes
  + fix: possible out-of-bound reads in zone parser and packet parser
  + feature: CDS and CDNSKEY support in zone parser
  + improvement: add defaults for TCP config options into documentation
  + improvement: detailed error message if zone reload fails

* Thu Feb 19 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.2-1
- new upstream release:
  + new config option 'max-tcp-clients'
  + fix possible resource leak when terminating inactive TCP clients

* Tue Jan 20 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.1-3
- service file changes:
  + remove dependency on network.target
  + remove bounding capabilities (breaks reload)

* Sat Dec 13 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.1-2
- new upstream release:
  + DNSSEC: support for Single-Type Signing Scheme
  + fix: journal file growing over configured limit
- service file changes:
  + run as 'knot' user and group
  + set security bounding capabilities
  + change Type to 'notify'

* Thu Oct 30 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.0-2
- default config: run server as unprivileged user
- service file: remove useless startup dependencies
- service file: add bounding capabilities

* Thu Oct 23 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.0-1
- new upstream release:
  + support for persistent zone timers (expire, refresh, and flush)
  + DNSSEC: RFC-compliant processing of letter case in RDATA domain names
  + EDNS: return minimal response for queries with unsupported version
  + EDNS: fix interpretation of Extended RCODE
  + transfers: fix forced zone retransfer
  + timers: properly expire zone when transfer is being refused by master

* Mon Sep 15 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.3-1
- new upstream release:
  + fix crash on specific incoming IXFR message
  + fix rare synchronization error during server reload
  + fix crash in reverse record synthesis module on DNSSEC signed zones
  + fix message ID and opcode for AXFR-style IXFR responses
  + fix sending of large responses to remote control commands

* Mon Sep 08 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.2-1
- new upstream release:
  + CVE-2014-0486: remote crash using crafted DNS message
  + transfers: do not refuse AXFR answers to IXFR queries
  + fix storing of hash character '#' in zone file

* Tue Aug 19 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.1-1
- new upstream release:
  + logging: unified logging messages
  + logging: support for systemd journal
  + DDNS: processing updates in bulk
  + DDNS: fix signing of responses with TSIG
  + DDNS: fix prerequisites checking in apex node
  + DNSSEC: fix domain names conversion to canonical format before signing
  + DNSSEC: semantic checks for signing keys
  + EDNS: fix inclusion of OPT record into some packets
  + knsupdate: fix use of zone origin for deletions

* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

* Thu Jul 10 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.5.0-1
- update to 1.5.0
  + reimplemented DDNS forwarding
  + transfer sizes logged in bytes
  + logging of outgoing/incoming NOTIFY messages
  + zone flush planning after bootstrap
  + DDNS signing changes freeing
  + knotc key handling
- update to 1.5.0-rc2
  + edns-client-subnet support in kdig
  + optional asynchronous startup (config 'asynchronous-start')
  + preempt task queue for faster reload
  + lazy zone file write after zone transfer (config 'zonefile-sync')
  + close zone transfer after SERVFAIL response
  + incremental to full zone transfer fallback, wrong log message
  + zone events corner cases, reload replanning
- update to 1.5.0-rc1
  + Pluggable query processing modules
  + Synthetic IPv4/IPv6 reverse/forward records (optional module)
  + Dnstap support in both utilities & server (optional module)
  + NOTIFY message support and new TSIG section in kdig
  + Multi-master support
  + Query processing and core functionality overhaul
  + Performance and reduced memory footprint
  + Faster zone events scheduling
  + RFC compliant queries/responses in some corner cases
  + Log messages
  + New documentation (Sphinx)
- enabled dynamic linking
- removed info pages

* Wed Jun 18 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.7-1
- update to 1.4.7
  + Fixed DDNS corner cases
  + Fixed zone EXPIRE timer
  + Fixed semantic checks false positives
  + Fixed sending malformed IXFR with automatic DNSSEC
  + Fixed NAPTR record serialization

* Thu May 22 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.6-2
- update to 1.4.6
  + DNSSEC: fix possible signing loop when doing key rollover
  + RRL: fixed sending of malformed UDP empty responses

* Mon Apr 14 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.5-1
- update to 1.4.5
  + fix weakness in TSIG digest checking

* Thu Mar 27 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.4-1
- update to 1.4.4
  + server is logging remote control commands
  + 'knotc reload' doesn't refresh unchanged zones
  + 'knotc -f refresh' forces zone retransfer
  + missing notifications after DDNS/automatic resign
  + zone is rebootstrapped if the zone file is unreadable
  + progressive bootstrap retry backoff
  + zone file parser allows asterisk as part of the label
  + journal maximum entry size fixes
  + sign DNSKEYs in non-apex nodes as regular RR sets
  + various spelling and typo fixes

* Tue Feb 18 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.3-1
- update to 1.4.3
  + DNSSEC: fixes in authenticated denial proofs
  + zone parser: case insensitive comparison of $ORIGIN
  + journal: fix corruption if zone loading fails
  + config: add support for includes of directories

* Wed Feb 12 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.2-3
- rebuild with new userspace-rcu

* Mon Jan 27 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.2-2
- enable IDN support in domain names

* Mon Jan 27 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.2-1
- update to 1.4.2

* Mon Jan 13 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.1-1
- update to 1.4.1

* Mon Jan 06 2014 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.0-1
- update to 1.4.0

* Fri Dec 13 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.0-0.2.rc2
- update to 1.4.0-rc2

* Tue Nov 26 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.4.0-0.1.rc1
- update to 1.4.0-rc1

* Tue Oct 08 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.3.2-2
- fix failing wire reading/writing tests on big endian (#1015976)

* Tue Oct 01 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.3.2-1
- update to 1.3.2
  + possibility to set max UDP payload in EDNS0
  + fixed bug limiting payload size in some TCP responses
  + fixed closing of file descriptors for included files in config

* Sun Sep 01 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.3.1-1
- update to 1.3.1

* Mon Jul 29 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.3.0-0.4.rc5
- update to 1.3.0-rc5

* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 1.3.0-0.3.rc4
- Added Alias=knotd.service alias to service file
- Added ExecStartPre=/usr/sbin/knotc checkconf to service file

* Mon Jul 15 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.3.0-0.2.rc4
- update to 1.3.0-rc4

* Wed Jul 03 2013 Jan Vcelak <jvcelak@fedoraproject.org> 1.3.0-0.1.rc3
- update to 1.3.0-rc3
- update configuration
- disable assertions in the code (define NDEBUG)
- enable unit tests as a part of RPM build process
- enable fast zone parser
- fix wrong dates in changelog

* Fri Apr 05 2013 Paul Wouters <pwouters@redhat.com> - 1.2.0-1
- Updated to 1.2.0-1
- Enabled hardening/relro/pie protection

* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.1.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

* Thu Dec 20 2012 Paul Wouters <pwouters@redhat.com> - 1.1.3-2
- Use new systemd macros

* Thu Dec 20 2012 Paul Wouters <pwouters@redhat.com> - 1.1.3-1
- Initial build for Fedora

* Thu Nov 22 2012 Ondřej Surý <ondrej@sury.org> - 1.1.2-1
- Update to 1.1.2

* Wed Nov 7 2012 Stanislav Petr <glux@glux.org> - 1.1.1-1
- Fixed build problem
- Update to 1.1.1
- Add man5 directory
- Add knot.info.gz to infodir

* Mon Aug 27 2012 Stanislav Petr <glux@glux.org> - 1.1.0-1
- Update to 1.1.0-rc2
- Fix default knot.conf
- Add build dependency to texinfo

* Tue May 15 2012 Stanislav Petr <glux@glux.org> - 1.0.6-2
- Try to fix compilation problem on some systems - force add -lgcc_eh to gcc flags

* Sun May 13 2012 Stanislav Petr <glux@glux.org> - 1.0.6-1
- Update to versio 1.0.6
- Change attrs to 750 on /etc/knot - only for root (knot configuration can contain DNS keys for zone updates)
- Clean content in /etc/knot

* Tue May 1 2012 Stanislav Petr <glux@glux.org> - 1.0.5-1
- Update to version 1.0.5

* Wed Apr 18 2012 Stanislav Petr <glux@glux.org> - 1.0.3-1
- Fixed knot directory ownership.
- Update to version 1.0.3
- Merget changes from Paul Wouters <pwouters@redhat.com>
- Removed unnecessary commands pro %%post script
- Add knot user
- More configuration samples in /usr/share/doc/knot

* Thu Mar 1 2012 Stanislav Petr <glux@glux.org> - 1.0.0-4
- Update to upstream version 1.0.0
- Fix %%{_sharedstatedir} usage in .spec.
- Fix file and directories ownership
- Fix service upgrade in postun in rpm.
- Do not install unittests.

* Wed Jan 25 2012 Stanislav Petr <glux@glux.org> - 0.9.1-3
- Update to upstream version 0.9.1

* Mon Dec 12 2011 Stanislav Petr <glux@glux.org> - 0.8.1-3
- Add docs (COPYING AUTHORS RELNOTES KNOWN_ISSUES)
- Update rpm building options.
  Use %%{_sharedstatedir} instead of %%{_var}/lib,
  dafault value for %%{buildroot} path
- Remove ldconfig from post and postun in rpm.
- Update licence to GPLv3+

* Wed Dec 07 2011 Stanislav Petr <glux@glux.org> - 0.8.1-2
- RPM build fix

* Mon Dec 05 2011 Stanislav Petr <glux@glux.org> - 0.8.1-1
- Create