New upstream release - v11

Resolves rhbz#2008204

.gitignore

@@ -1,2 +1,4 @@
 /tang-7.tar.bz2
 /tang-8.tar.xz
+/tang-10.tar.xz
+/tang-11.tar.xz

sources

@@ -1 +1 @@
-SHA512 (tang-8.tar.xz) = 880ff63d373ff9a7c27d766fb34c36daa24cc59d1506f38696f2d9f511648517d559529babddacab0ffd6be40fdab1055870614c7a4e2ba527751f4de6e935ea
+SHA512 (tang-11.tar.xz) = 332ff8bca33afef17cb86a77780f34499659ee0576b36b111a0a57996836b6770d89c5f5fa5da9c6095f17c731db6ad1e261bf6d97b6daa109565e8e294e3b87

tang.spec

@@ -1,6 +1,6 @@
 Name:           tang
-Version:        8
-Release:        2%{?dist}
+Version:        11
+Release:        1%{?dist}
 Summary:        Network Presence Binding Daemon
 
 License:        GPLv3+
@@ -25,6 +25,7 @@ BuildRequires:  curl
 BuildRequires:  asciidoc
 BuildRequires:  coreutils
 BuildRequires:  grep
+BuildRequires:  socat
 BuildRequires:  sed
 
 %{?systemd_requires}
@@ -47,7 +48,6 @@ Tang is a small daemon for binding data to the presence of a third party.
 
 %install
 %meson_install
-echo "User=%{name}" >> $RPM_BUILD_ROOT/%{_unitdir}/%{name}d@.service
 %{__mkdir_p} $RPM_BUILD_ROOT/%{_localstatedir}/db/%{name}
 
 %check
@@ -63,6 +63,20 @@ exit 0
 %post
 %systemd_post %{name}d.socket
 
+# Let's make sure any existing keys are readable only
+# by the owner/group.
+if [ -d /var/db/tang ]; then
+    for k in /var/db/tang/*.jwk; do
+        test -e "${k}" || continue
+        chmod 0440 -- "${k}"
+    done
+    for k in /var/db/tang/.*.jwk; do
+        test -e "${k}" || continue
+        chmod 0440 -- "${k}"
+    done
+    chown tang:tang -R /var/db/tang
+fi
+
 %preun
 %systemd_preun %{name}d.socket
 
@@ -75,12 +89,29 @@ exit 0
 %{_unitdir}/%{name}d@.service
 %{_unitdir}/%{name}d.socket
 %{_libexecdir}/%{name}d-keygen
+%{_libexecdir}/%{name}d-rotate-keys
 %{_libexecdir}/%{name}d
 %{_mandir}/man8/tang.8*
 %{_bindir}/%{name}-show-keys
 %{_mandir}/man1/tang-show-keys.1*
+%{_mandir}/man1/tangd-rotate-keys.1.*
 
 %changelog
+* Tue Dec 14 2021 Sergio Correia <scorreia@redhat.com> - 11-1
+- New upstream release - v11.
+  Resolves: CVE-2021-4076
+
+* Mon Oct 04 2021 Sergio Arroutbi <sarroutb@redhat.com> - 10-3
+- Keys are created with 0440 mode
+  Resolves rhbz#2008204
+
+* Thu May 20 2021 Sergio Correia <scorreia@redhat.com> - 10-2
+- Fix issues reported by shellcheck and a possible NULL pointer
+  dereference reported by gcc static analyzer (3d770c6, 262d98f)
+
+* Wed May 05 2021 Sergio Correia <scorreia@redhat.com> - 10-1
+- New upstream release - v10.
+
 * Tue Feb 09 2021 Sergio Correia <scorreia@redhat.com> - 8-2
 - Remove extra patches as they are already included in v8 release