Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

Signed-off-by: Björn Esser <besser82@fedoraproject.org>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1,2 @@
-openwsman-2.2.0.tar.bz2
+/openwsmand.8.gz
+/v2.8.1.tar.gz

openwsman-2.4.0-pamsetup.patch

@@ -0,0 +1,13 @@
+diff -up openwsman-2.6.8/etc/pam/openwsman.orig openwsman-2.6.8/etc/pam/openwsman
+--- openwsman-2.6.8/etc/pam/openwsman.orig	2018-11-21 13:51:52.776325243 +0100
++++ openwsman-2.6.8/etc/pam/openwsman	2018-11-21 13:54:17.066351134 +0100
+@@ -2,6 +2,6 @@
+ auth       required	pam_unix.so	nullok
+ auth       required	pam_nologin.so
+ account    required	pam_unix.so
+-password   required	pam_cracklib.so	nullok
+-password   required	pam_unix.so	nullok use_first_pass use_authtok nis shadow
+-session    required	pam_unix.so	none
++password   required	pam_pwquality.so
++password   required	pam_unix.so	nullok use_first_pass use_authtok
++session    required	pam_unix.so

openwsman-2.4.12-ruby-binding-build.patch

@@ -0,0 +1,73 @@
+--- openwsman-2.8.1/bindings/ruby/extconf.rb.orig	2025-11-11 11:49:59.880195434 +0100
++++ openwsman-2.8.1/bindings/ruby/extconf.rb	2025-11-11 11:50:46.870685458 +0100
+@@ -5,20 +5,41 @@
+ require 'mkmf'
+ # $CFLAGS = "#{$CFLAGS} -Werror"
+ 
++# libwsman requires 'int facility' to be defined by the application
++# Add syslog.h for LOG_DAEMON constant
++$CFLAGS = "#{$CFLAGS} -include syslog.h"
++
+ # requires wsman, wsman_client, and libxml2
++# Use CPATH and LIBRARY_PATH environment variables set by the build system
++if ENV['CPATH']
++  ENV['CPATH'].split(':').each do |path|
++    $CPPFLAGS = "#{$CPPFLAGS} -I#{path}"
++  end
++end
++if ENV['LIBRARY_PATH']
++  ENV['LIBRARY_PATH'].split(':').each do |path|
++    $LDFLAGS = "#{$LDFLAGS} -L#{path}"
++  end
++end
+ 
+-unless have_library('wsman', 'wsman_create_doc')
++# Custom test for libwsman that includes facility definition
++unless try_link("#include <syslog.h>\n#include <wsman-soap-envelope.h>\nint facility = LOG_DAEMON;\nint main() {\n  wsman_create_doc(\"test\");\n  return 0;\n}", '-lwsman')
+   STDERR.puts "Cannot find wsman_create_doc() in libwsman"
+   STDERR.puts "Is openwsman-devel installed ?"
+   exit 1
+ end
++# Explicitly add libwsman to linker flags since we used try_link instead of have_library
++$libs = append_library($libs, "wsman")
+ find_header 'wsman-xml-api.h', '/usr/include/openwsman'
+ 
+-unless have_library('wsman_client', 'wsmc_create')
++# Custom test for libwsman_client that includes facility definition
++unless try_link("#include <syslog.h>\n#include <wsman-client-api.h>\nint facility = LOG_DAEMON;\nint main() {\n  wsmc_create(\"localhost\", 80, \"/wsman\", \"http\", \"user\", \"pass\");\n  return 0;\n}", '-lwsman_client -lwsman')
+   STDERR.puts "Cannot find wsmc_create() in libwsman_client"
+   STDERR.puts "Is openwsman-devel installed ?"
+   exit 1
+ end
++# Explicitly add libwsman_client to linker flags since we used try_link instead of have_library
++$libs = append_library($libs, "wsman_client")
+ find_header 'wsman-client-api.h', '/usr/include/openwsman'
+ 
+ unless have_library('xml2', 'xmlNewDoc')
+@@ -28,12 +49,25 @@
+ end
+ find_header 'libxml/parser.h', '/usr/include/libxml2'
+ 
++# Check for Ruby 3.3+ IO types
++have_type('rb_io_t', 'ruby/io.h')
++have_header 'ruby/thread.h'
++
+ swig = find_executable("swig")
+ raise "SWIG not found" unless swig
+ 
+ major, minor, path = RUBY_VERSION.split(".")
+-raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
++
++# Build SWIG include paths from CPATH environment variable
++swig_includes = "-I. -I/usr/include/openwsman"
++if ENV['CPATH']
++  ENV['CPATH'].split(':').each do |path|
++    swig_includes += " -I#{path}"
++  end
++end
++raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} #{swig_includes} -o openwsman_wrap.c openwsman.i")
+ 
+ $CPPFLAGS = "-I/usr/include/openwsman -I.."
+ 
+ create_makefile('_openwsman')
++

openwsman-2.6.2-openssl-1.1-fix.patch

@@ -0,0 +1,135 @@
+diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
+--- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/compat_unix.h	2025-02-03 09:11:35.072818890 +0100
+@@ -27,10 +27,6 @@
+ 	pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
+ #endif /* !NO_THREADS */
+ 
+-#ifndef SSL_LIB
+-#define	SSL_LIB				"libssl.so"
+-#endif
+-
+ #define	DIRSEP				'/'
+ #define	IS_DIRSEP_CHAR(c)		((c) == '/')
+ #define	O_BINARY			0
+diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
+--- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/io_ssl.c	2025-02-03 09:12:22.387355905 +0100
+@@ -11,28 +11,6 @@
+ #include "defs.h"
+ 
+ #if !defined(NO_SSL)
+-struct ssl_func	ssl_sw[] = {
+-	{"SSL_free",			{0}},
+-	{"SSL_accept",			{0}},
+-	{"SSL_connect",			{0}},
+-	{"SSL_read",			{0}},
+-	{"SSL_write",			{0}},
+-	{"SSL_get_error",		{0}},
+-	{"SSL_set_fd",			{0}},
+-	{"SSL_new",			{0}},
+-	{"SSL_CTX_new",			{0}},
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+-	{"SSLv23_server_method",	{0}},
+-	{"SSL_library_init",		{0}},
+-#else
+-	{"TLS_server_method",	{0}},
+-	{"OPENSSL_init_ssl",		{0}},
+-#endif
+-	{"SSL_CTX_use_PrivateKey_file",	{0}},
+-	{"SSL_CTX_use_certificate_file",{0}},
+-	{NULL,				{0}}
+-};
+-
+ void
+ _shttpd_ssl_handshake(struct stream *stream)
+ {
+diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
+--- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/shttpd.c	2025-02-03 09:13:43.415562784 +0100
+@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	int		retval = FALSE;
+ 	EC_KEY*		key;
+ 
+-	/* Load SSL library dynamically */
+-	if ((lib = dlopen(SSL_LIB, RTLD_LAZY)) == NULL) {
+-		_shttpd_elog(E_LOG, NULL, "set_ssl: cannot load %s", SSL_LIB);
+-		return (FALSE);
+-	}
+-
+-	for (fp = ssl_sw; fp->name != NULL; fp++)
+-		if ((fp->ptr.v_void = dlsym(lib, fp->name)) == NULL) {
+-			_shttpd_elog(E_LOG, NULL,"set_ssl: cannot find %s", fp->name);
+-			return (FALSE);
+-		}
+-
+ 	/* Initialize SSL crap */
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	SSL_library_init();
+ 	if ((CTX = SSL_CTX_new(SSLv23_server_method())) == NULL)
+ #else
+-        OPENSSL_init_ssl();
++        OPENSSL_init_ssl(0, NULL);
+ 	if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
+ #endif
+ 	        _shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
+diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
+--- openwsman-2.8.1/src/server/shttpd/ssl.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/ssl.h	2025-02-03 09:14:43.142975166 +0100
+@@ -12,55 +12,4 @@
+ 
+ #include <openssl/ssl.h>
+ 
+-#else
+-
+-/*
+- * Snatched from OpenSSL includes. I put the prototypes here to be independent
+- * from the OpenSSL source installation. Having this, shttpd + SSL can be
+- * built on any system with binary SSL libraries installed.
+- */
+-
+-typedef struct ssl_st SSL;
+-typedef struct ssl_method_st SSL_METHOD;
+-typedef struct ssl_ctx_st SSL_CTX;
+-
+-#define	SSL_ERROR_WANT_READ	2
+-#define	SSL_ERROR_WANT_WRITE	3
+-#define	SSL_ERROR_SYSCALL	5
+-#define	SSL_FILETYPE_PEM	1
+-
+-#endif
+-
+-/*
+- * Dynamically loaded SSL functionality
+- */
+-struct ssl_func {
+-	const char	*name;		/* SSL function name	*/
+-	union variant	ptr;		/* Function pointer	*/
+-};
+-
+-extern struct ssl_func	ssl_sw[];
+-
+-#define	FUNC(x)	ssl_sw[x].ptr.v_func
+-
+-#define	SSL_free(x)	(* (void (*)(SSL *)) FUNC(0))(x)
+-#define	SSL_accept(x)	(* (int (*)(SSL *)) FUNC(1))(x)
+-#define	SSL_connect(x)	(* (int (*)(SSL *)) FUNC(2))(x)
+-#define	SSL_read(x,y,z)	(* (int (*)(SSL *, void *, int)) FUNC(3))((x),(y),(z))
+-#define	SSL_write(x,y,z) \
+-	(* (int (*)(SSL *, const void *,int)) FUNC(4))((x), (y), (z))
+-#define	SSL_get_error(x,y)(* (int (*)(SSL *, int)) FUNC(5))((x), (y))
+-#define	SSL_set_fd(x,y)	(* (int (*)(SSL *, int)) FUNC(6))((x), (y))
+-#define	SSL_new(x)	(* (SSL * (*)(SSL_CTX *)) FUNC(7))(x)
+-#define	SSL_CTX_new(x)	(* (SSL_CTX * (*)(const SSL_METHOD *)) FUNC(8))(x)
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+-#define	SSLv23_server_method()	(* (SSL_METHOD * (*)(void)) FUNC(9))()
+-#define	SSL_library_init() (* (int (*)(void)) FUNC(10))()
+-#else
+-#define	TLS_server_method()	(* (SSL_METHOD * (*)(void)) FUNC(9))()
+-#define	OPENSSL_init_ssl() (* (int (*)(void)) FUNC(10))()
+ #endif
+-#define	SSL_CTX_use_PrivateKey_file(x,y,z)	(* (int (*)(SSL_CTX *, \
+-		const char *, int)) FUNC(11))((x), (y), (z))
+-#define	SSL_CTX_use_certificate_file(x,y,z)	(* (int (*)(SSL_CTX *, \
+-		const char *, int)) FUNC(12))((x), (y), (z))

openwsman-2.6.5-http-status-line.patch

@@ -0,0 +1,39 @@
+diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c
+--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig	2016-07-27 16:03:55.000000000 +0200
++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c	2018-01-22 13:05:04.478923300 +0100
+@@ -344,6 +344,35 @@ DONE:
+ 	if (fault_reason == NULL) {
+ 		// this is a way to segfault, investigate
+ 		//fault_reason = shttpd_reason_phrase(status);
++		// ugly workaround follows...
++		switch (status) {
++			case 200:
++				fault_reason = "OK";
++				break;
++			case 400:
++				fault_reason = "Bad request";
++				break;
++			case 401:
++				fault_reason = "Unauthorized";
++				break;
++			case 403:
++				fault_reason = "Forbidden";
++				break;
++			case 404:
++				fault_reason = "Not found";
++				break;
++			case 500:
++				fault_reason = "Internal Error";
++				break;
++			case 501:
++				fault_reason = "Not implemented";
++				break;
++			case 415:
++				fault_reason = "Unsupported Media Type";
++				break;
++			default:
++				fault_reason = "";
++		}
+ 	}
+ 	debug("Response status=%d (%s)", status, fault_reason);
+ 

openwsman-2.6.8-update-ssleay-conf.patch

@@ -0,0 +1,12 @@
+diff -up openwsman-2.7.1/etc/ssleay.cnf.orig openwsman-2.7.1/etc/ssleay.cnf
+--- openwsman-2.7.1/etc/ssleay.cnf.orig	2021-11-09 08:27:48.577749509 +0100
++++ openwsman-2.7.1/etc/ssleay.cnf	2021-11-09 08:28:10.499967010 +0100
+@@ -3,7 +3,7 @@
+ #
+ 
+ [ req ]
+-default_bits            = 1024
++default_bits            = 2048
+ default_keyfile         = privkey.pem
+ distinguished_name      = req_distinguished_name
+ 

openwsman-2.7.2-gcc15-fix.patch

@@ -0,0 +1,24 @@
+diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
+--- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c	2025-02-03 09:30:36.905616375 +0100
+@@ -49,7 +49,7 @@
+  */
+ 
+ static VALUE
+-load_module()
++load_module(VALUE)
+ {
+   ruby_script(PLUGIN_FILE);
+   return rb_require(PLUGIN_FILE);
+diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
+--- openwsman-2.8.1/src/server/CMakeLists.txt.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/CMakeLists.txt	2025-02-03 09:31:15.258241237 +0100
+@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
+   TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
+ ENDIF( HAVE_LIBDL )
+ 
+-INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
++INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
+ 
+ #		
+ #

openwsman-2.7.2-ssl-certs-gen-changes.patch

@@ -0,0 +1,102 @@
+diff -up openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig openwsman-2.8.1/etc/owsmangencert.sh.cmake
+--- openwsman-2.8.1/etc/owsmangencert.sh.cmake.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/etc/owsmangencert.sh.cmake	2025-10-17 10:16:34.482996406 +0200
+@@ -1,10 +1,74 @@
+-#!/bin/sh
+-
+ #!/bin/sh -e
+ 
+ CERTFILE=@WSMANCONF_DIR@/servercert.pem
+ KEYFILE=@WSMANCONF_DIR@/serverkey.pem
+ CNFFILE=@WSMANCONF_DIR@/ssleay.cnf
++CAFILE=@WSMANCONF_DIR@/ca.crt
++DAYS=365
++
++function create_ssl_cnf
++{
++    # Get minimum RSA key length at current security level
++    # This workarounds openssl not enforcing min. key length enforced by current security level
++    KEYSIZE=`grep min_rsa_size /etc/crypto-policies/state/CURRENT.pol | cut -d ' ' -f 3`
++
++    # Create OpenSSL configuration files for generating certificates
++    echo "[ req ]" > $CNFFILE
++    echo "default_bits            = $KEYSIZE" >> $CNFFILE
++    echo "default_keyfile         = privkey.pem" >> $CNFFILE
++    echo "distinguished_name      = req_distinguished_name" >> $CNFFILE
++
++    echo "[ req_distinguished_name ]" >> $CNFFILE
++    echo "countryName                     = Country Name (2 letter code)" >> $CNFFILE
++    echo "countryName_default             = GB" >> $CNFFILE
++    echo "countryName_min                 = 2" >> $CNFFILE
++    echo "countryName_max                 = 2" >> $CNFFILE
++
++    echo "stateOrProvinceName             = State or Province Name (full name)" >> $CNFFILE
++    echo "stateOrProvinceName_default     = Some-State" >> $CNFFILE
++
++    echo "localityName                    = Locality Name (eg, city)" >> $CNFFILE
++
++    echo "organizationName                = Organization Name (eg, company; recommended)" >> $CNFFILE
++    echo "organizationName_max            = 64" >> $CNFFILE
++
++    echo "organizationalUnitName          = Organizational Unit Name (eg, section)" >> $CNFFILE
++    echo "organizationalUnitName_max      = 64" >> $CNFFILE
++
++    echo "commonName                      = server name (eg. ssl.domain.tld; required!!!)" >> $CNFFILE
++    echo "commonName_max                  = 80" >> $CNFFILE
++
++    echo "emailAddress                    = Email Address" >> $CNFFILE
++    echo "emailAddress_max                = 85" >> $CNFFILE
++}
++
++function selfsign_sscg()
++{
++    sscg --quiet \
++         --lifetime "$DAYS" \
++         --cert-key-file "$KEYFILE" \
++         --cert-file "$CERTFILE" \
++         --ca-file "$CAFILE"
++}
++
++function selfsign_openssl()
++{
++
++    echo
++    echo creating selfsigned certificate
++    echo "replace it with one signed by a certification authority (CA)"
++    echo
++    echo enter your ServerName at the Common Name prompt
++    echo
++
++    # use special .cnf, because with normal one no valid selfsigned
++    # certificate is created
++
++    openssl req -days $DAYS $@ -config $CNFFILE \
++        -new -x509 -nodes -out $CERTFILE \
++        -keyout $KEYFILE
++    chmod 600 $KEYFILE
++}
+ 
+ if [ "$1" != "--force" -a -f $KEYFILE ]; then
+   echo "$KEYFILE exists!  Use \"$0 --force.\""
+@@ -15,18 +79,7 @@ if [ "$1" = "--force" ]; then
+   shift
+ fi
+ 
+-echo
+-echo creating selfsigned certificate
+-echo "replace it with one signed by a certification authority (CA)"
+-echo
+-echo enter your ServerName at the Common Name prompt
+-echo
+-
+-# use special .cnf, because with normal one no valid selfsigned
+-# certificate is created
+-
+-openssl req -days 365 $@ -config $CNFFILE \
+-  -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
+-  -keyout $KEYFILE
+-chmod 600 $KEYFILE
++create_ssl_cnf
+ 
++# If sscg fails, try openssl
++selfsign_sscg || selfsign_openssl

openwsman-2.8.1-fix-ruby-io.patch

@@ -0,0 +1,33 @@
+diff -up openwsman-2.8.1/bindings/openwsman.i.orig openwsman-2.8.1/bindings/openwsman.i
+--- openwsman-2.8.1/bindings/openwsman.i.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/bindings/openwsman.i	2025-10-21 16:56:01.025576984 +0200
+@@ -105,15 +105,8 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
+ #if HAVE_RUBY_THREAD_H /* New threading model */
+ #include <ruby/thread.h>
+ #endif
+-#if RUBY_VERSION > 18
+-  #if HAVE_RB_IO_T
+-    #define rb_fptr_t rb_io_t
+-  #else
+-    #define rb_fptr_t struct rb_io
+-  #endif
+-#else
+-  #define rb_fptr_t struct OpenFile
+-#endif
++/* Use rb_io_t for Ruby 1.9+ */
++#define rb_fptr_t rb_io_t
+ %}
+ 
+ %typemap(in) FILE* {
+@@ -122,11 +115,7 @@ SWIGINTERNINLINE SV *SWIG_From_double  S
+   Check_Type($input, T_FILE);
+   GetOpenFile($input, fptr);
+   /*rb_io_check_writable(fptr);*/
+-#if RUBY_VERSION > 18
+   $1 = rb_io_stdio_file(fptr);
+-#else
+-  $1 = GetReadFile(fptr);
+-#endif
+ }
+ 
+ #endif /* SWIGRUBY */

openwsman-2.8.1-post-quantum.patch

@@ -0,0 +1,101 @@
+diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
+--- openwsman-2.7.2/etc/openwsman.conf.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/etc/openwsman.conf	2025-05-27 08:03:57.890057721 +0200
+@@ -32,8 +32,12 @@ ipv6 = yes
+ 
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
++# the openwsman server certificate fallback file, in .pem format
++#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
++# the openwsman server private key fallback, in .pem format
++#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
+--- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig	2025-05-21 10:07:40.404532496 +0200
++++ openwsman-2.7.2/src/server/shttpd/shttpd.c	2025-06-12 12:27:44.785904555 +0200
+@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
+ 	char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
+ 	int		retval = FALSE;
+-	EC_KEY*		key;
+ 
+ 	/* Initialize SSL crap */
+ 
+@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	else
+ 		retval = TRUE;
+ 
+-	/* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
+-	key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+-	if (key != NULL) {
+-		SSL_CTX_set_tmp_ecdh(CTX, key);
+-		EC_KEY_free(key);
++	/* Add fall back certificate/key pair */
++	if (wsmand_options_get_ssl_cert_fallback_file() &&
++                    wsmand_options_get_ssl_key_fallback_file()) {
++		if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
++		else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
++		else
++			retval = TRUE;
+ 	}
+ 
+ 	while (ssl_disabled_protocols) {
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
+--- openwsman-2.7.2/src/server/wsmand-daemon.c.orig	2025-05-27 07:18:16.878974761 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.c	2025-05-27 07:22:06.832235764 +0200
+@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
+ #endif
+ static int use_digest = 0;
+ static char *ssl_key_file = NULL;
++static char *ssl_key_fallback_file = NULL;
+ static char *service_path = DEFAULT_SERVICE_PATH;
+ static char *ssl_cert_file = NULL;
++static char *ssl_cert_fallback_file = NULL;
+ static char *ssl_disabled_protocols = NULL;
+ static char *ssl_cipher_list = NULL;
+ static char *pid_file = DEFAULT_PID_PATH;
+@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
+ 	service_path =
+ 	    iniparser_getstring(ini, "server:service_path", "/wsman");
+ 	ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
++	ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
+ 	ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
++	ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
+         ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
+         ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
+ 	use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
+@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
+ 	return ssl_cert_file;
+ }
+ 
++char *wsmand_options_get_ssl_key_fallback_file(void)
++{
++	return ssl_key_fallback_file;
++}
++
++char *wsmand_options_get_ssl_cert_fallback_file(void)
++{
++	return ssl_cert_fallback_file;
++}
++
+ char *wsmand_options_get_ssl_disabled_protocols(void)
+ {
+ 	return ssl_disabled_protocols;
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
+--- openwsman-2.7.2/src/server/wsmand-daemon.h.orig	2025-05-27 07:15:56.869002037 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.h	2025-05-27 07:18:06.429846617 +0200
+@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
+ int wsmand_options_get_server_ssl_port(void);
+ char *wsmand_options_get_ssl_key_file(void);
+ char *wsmand_options_get_ssl_cert_file(void);
++char *wsmand_options_get_ssl_key_fallback_file(void);
++char *wsmand_options_get_ssl_cert_fallback_file(void);
+ char *wsmand_options_get_ssl_disabled_protocols(void);
+ char *wsmand_options_get_ssl_cipher_list(void);
+ int wsmand_options_get_digest(void);

openwsman-2.8.1-rdoc-6_16.patch

@@ -0,0 +1,18 @@
+diff -urp '--exclude=*~' openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb
+--- openwsman-2.8.1.orig/bindings/ruby/rdoc_parser_swig.rb	2026-01-02 23:43:41.804273994 +0900
++++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2026-01-02 23:56:06.991238037 +0900
+@@ -377,7 +377,13 @@ class RDoc::Parser::SWIG < RDoc::Parser
+       find_modifiers comment, meth_obj if comment
+ 
+       #meth_obj.params = params
+-      meth_obj.start_collecting_tokens
++      # https://github.com/ruby/rdoc/pull/1471 changes the parameter for
++      # RDoc::TokenStream.start_collecting_tokens
++      if meth_obj.method(:start_collecting_tokens).arity == 1
++        meth_obj.start_collecting_tokens :ruby
++      else
++        meth_obj.start_collecting_tokens
++      end
+       begin
+         RDoc::const_get "RubyToken"
+         tk = RDoc::RubyToken::Token.new nil, 1, 1

openwsman-2.8.1-rdoc-ruby34.patch

@@ -0,0 +1,29 @@
+--- openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/bindings/ruby/rdoc_parser_swig.rb	2025-11-10 15:00:00.000000000 +0100
+@@ -108,10 +108,24 @@ class RDoc::Parser::SWIG < RDoc::Parser
+   ##
+   # Prepare to parse a SWIG file
+ 
+-  def initialize(top_level, file_name, content, options, stats)
+-    super
++  def initialize(top_level, file_name, content, options, stats = nil)
++    # RDoc 6.6+ (Ruby 3.3+) removed the stats parameter from Parser.initialize
++    # Check the arity of the parent class initialize method to determine which API we're using
++    parent_arity = RDoc::Parser.instance_method(:initialize).arity
++    
++    if parent_arity == 4 || parent_arity == -5
++      # RDoc 6.6+: only pass 4 arguments to super
++      super(top_level, file_name, content, options)
++      # Create a dummy stats object for compatibility
++      @stats = Object.new
++      def @stats.method_missing(m, *args); end
++    else
++      # Older RDoc: pass all 5 arguments including stats
++      super(top_level, file_name, content, options, stats)
++      @stats = stats
++    end
+ 
+     @known_classes = RDoc::KNOWN_CLASSES.dup
+     @content = handle_tab_width handle_ifdefs_in(@content)
+     @renames = {} # maps old_name => [ new_name, args ]
+     @aliases = {} # maps name => [ alias_name, args ]

openwsman-initscript.patch

@@ -1,28 +0,0 @@
---- openwsman-2.0.0/etc/init/openwsmand.sh.in.orig	2008-09-07 00:01:29.000000000 -0500
-+++ openwsman-2.0.0/etc/init/openwsmand.sh.in	2008-09-07 00:34:57.000000000 -0500
-@@ -4,15 +4,13 @@
- # Provides: openwsmand
- # Required-Start: $remote_fs
- # Required-Stop: $network
--# Default-Start: 2 3 4 5
--# Default-Stop: 0 1 6 
- # Short-Description: Openwsman Daemon
- # Description: openwsmand
- #       Start/Stop the Openwsman Daemon
- ### END INIT INFO
- #
- #
--# chkconfig: 2345 36 64
-+# chkconfig: - 36 64
- # description: Openwsman Daemon
- # processname: openwsmand
- 
-@@ -57,7 +55,7 @@ case "$1" in
-             if [ "x${FQDN}" = "x" ]; then
-                 FQDN=localhost.localdomain
-             fi
--cat << EOF | sh @SYSCONFDIR@/owsmangencert.sh > /dev/null 2>&1
-+cat << EOF | sh @libexecdir@/openwsman/owsmangencert.sh > /dev/null 2>&1
- --
- SomeState
- SomeCity

openwsman.fc

@@ -0,0 +1,7 @@
+/usr/lib/systemd/system/openwsmand.*		--	gen_context(system_u:object_r:openwsman_unit_file_t,s0)
+
+/usr/sbin/openwsmand		--	gen_context(system_u:object_r:openwsman_exec_t,s0)
+
+/var/log/wsmand.*	--	gen_context(system_u:object_r:openwsman_log_t,s0)
+
+/var/run/wsmand.*	--	gen_context(system_u:object_r:openwsman_run_t,s0)

openwsman.if

@@ -0,0 +1,79 @@
+## <summary>WS-Management Server</summary>
+
+########################################
+## <summary>
+##	Execute openwsman in the openwsman domin.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`openwsman_domtrans',`
+	gen_require(`
+		type openwsman_t, openwsman_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, openwsman_exec_t, openwsman_t)
+')
+########################################
+## <summary>
+##	Execute openwsman server in the openwsman domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`openwsman_systemctl',`
+	gen_require(`
+		type openwsman_t;
+		type openwsman_unit_file_t;
+	')
+
+	systemd_exec_systemctl($1)
+	init_reload_services($1)
+    systemd_read_fifo_file_passwd_run($1)
+	allow $1 openwsman_unit_file_t:file read_file_perms;
+	allow $1 openwsman_unit_file_t:service manage_service_perms;
+
+	ps_process_pattern($1, openwsman_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an openwsman environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`openwsman_admin',`
+	gen_require(`
+		type openwsman_t;
+	    type openwsman_unit_file_t;
+	')
+
+	allow $1 openwsman_t:process { signal_perms };
+	ps_process_pattern($1, openwsman_t)
+
+    tunable_policy(`deny_ptrace',`',`
+        allow $1 openwsman_t:process ptrace;
+    ')
+
+	openwsman_systemctl($1)
+	admin_pattern($1, openwsman_unit_file_t)
+	allow $1 openwsman_unit_file_t:service all_service_perms;
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')

openwsman.te

@@ -0,0 +1,74 @@
+policy_module(openwsman, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type openwsman_t;
+type openwsman_exec_t;
+init_daemon_domain(openwsman_t, openwsman_exec_t)
+
+type openwsman_tmp_t;
+files_tmp_file(openwsman_tmp_t)
+
+type openwsman_tmpfs_t;
+files_tmpfs_file(openwsman_tmpfs_t)
+
+type openwsman_log_t;
+logging_log_file(openwsman_log_t)
+
+type openwsman_run_t;
+files_pid_file(openwsman_run_t)
+
+type openwsman_unit_file_t;
+systemd_unit_file(openwsman_unit_file_t)
+
+########################################
+#
+# openwsman local policy
+#
+
+allow openwsman_t self:capability setuid;
+
+allow openwsman_t self:process { fork };
+allow openwsman_t self:fifo_file rw_fifo_file_perms;
+allow openwsman_t self:unix_stream_socket create_stream_socket_perms;
+allow openwsman_t self:tcp_socket { accept create_socket_perms listen };
+
+manage_files_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t)
+manage_dirs_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t)
+files_tmp_filetrans(openwsman_t, openwsman_tmp_t, { dir file })
+
+manage_files_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t)
+manage_dirs_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t)
+fs_tmpfs_filetrans(openwsman_t, openwsman_tmpfs_t, { dir file })
+
+manage_files_pattern(openwsman_t, openwsman_log_t, openwsman_log_t)
+logging_log_filetrans(openwsman_t, openwsman_log_t, { file })
+
+manage_files_pattern(openwsman_t, openwsman_run_t, openwsman_run_t)
+files_pid_filetrans(openwsman_t, openwsman_run_t, { file })
+
+auth_use_nsswitch(openwsman_t)
+auth_domtrans_chkpwd(openwsman_t)
+
+corenet_tcp_connect_pegasus_https_port(openwsman_t)
+corenet_tcp_bind_vnc_port(openwsman_t)
+corenet_tcp_bind_http_port(openwsman_t)
+
+dev_read_urand(openwsman_t)
+
+logging_send_syslog_msg(openwsman_t)
+logging_send_audit_msgs(openwsman_t)
+
+optional_policy(`
+    sblim_stream_connect_sfcbd(openwsman_t)
+    sblim_rw_semaphores_sfcbd(openwsman_t)
+    sblim_getattr_exec_sfcbd(openwsman_t)
+')
+
+optional_policy(`
+    unconfined_domain(openwsman_t)
+')
+

openwsmand.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Openwsman WS-Management Service
+After=syslog.target
+
+[Service]
+Type=forking
+ExecStart=/usr/sbin/openwsmand -S
+ExecStartPre=/etc/openwsman/owsmantestcert.sh
+PIDFile=/run/wsmand.pid
+
+[Install]
+WantedBy=multi-user.target

owsmantestcert.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+if [ ! -f "/etc/openwsman/serverkey.pem" ]; then
+  if [ -f "/etc/ssl/servercerts/servercert.pem" \
+       -a -f "/etc/ssl/servercerts/serverkey.pem" ]; then
+    echo "Using common server certificate /etc/ssl/servercerts/servercert.pem"
+    ln -s /etc/ssl/servercerts/server{cert,key}.pem /etc/openwsman
+    exit 0
+  else
+    echo "FAILED: Starting openwsman server"
+    echo "There is no ssl server key available for openwsman server to use."
+    echo -e "Please generate one with the following script and start the openwsman service again:\n"
+    echo "##################################"
+    echo "/etc/openwsman/owsmangencert.sh"
+    echo "================================="
+    
+    echo "NOTE: The script uses /dev/random device for generating some random bits while generating the server key."
+    echo "      If this takes too long, you can replace the value of \"RANDFILE\" in /etc/openwsman/ssleay.cnf with /dev/urandom. Please understand the implications of replacing the RNADFILE."
+    exit 1
+  fi
+fi

plans/basic.fmf

@@ -0,0 +1,9 @@
+summary: Basic test plan
+prepare:
+    how: install
+    package:
+        - openwsman-server
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -0,0 +1,5 @@
+---
+badfuncs:
+    allowed:
+        /usr/sbin/openwsmand:
+            - inet_ntoa

sources

@@ -1 +1,2 @@
-62b4eaf752171058bf0036e049ca01d0  openwsman-2.2.0.tar.bz2
+SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
+SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972

tests/post-quantum-cryptography/main.fmf

@@ -0,0 +1,6 @@
+summary: Post-quantum cryptography support test
+author: Vitezslav Crhonek <vcrhonek@redhat.com>
+contact: Vitezslav Crhonek <vcrhonek@redhat.com>
+require: patch
+duration: 10m
+test: ./runtest.sh

tests/post-quantum-cryptography/runtest.sh

@@ -0,0 +1,92 @@
+#!/bin/sh -eux
+
+function check_key_and_cert()
+{
+  echo -e "\n===== key info"
+  ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
+  file /etc/openwsman/serverkey.pem
+  echo -e "\n\n\n"
+
+  echo -e "\n===== cert info"
+  openssl x509 -in /etc/openwsman/servercert.pem --text --noout
+  echo -e "\n\n\n"
+}
+
+function test_key_exchange()
+{
+  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
+  echo -e "\n\n\n"
+  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
+  echo -e "\n\n\n"
+}
+
+function test_cert_support()
+{
+  echo -e "\n===== check that TLS certificate using ML-DSA works"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: mldsa65" cert-mldsa.out
+  echo -e "\n\n\n"
+  # simulate lack of ML-DSA support
+  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
+    tee cert-classic.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
+  echo -e "\n\n\n"
+}
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+systemctl start openwsmand
+check_key_and_cert
+test_key_exchange
+systemctl stop openwsmand
+
+# keep RSA certificate and key
+cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
+cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
+# remove previously generated certificates/keys
+rm -rf /etc/openwsman/{servercert,serverkey}.pem
+
+# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
+# and issue a self-signed certificate for localhost using this key
+patch /etc/openwsman/owsmangencert.sh << 'EOF'
+--- owsmangencert.sh.orig	2026-01-08 03:50:31.852413993 -0500
++++ owsmangencert.sh	2026-01-08 03:52:41.883088457 -0500
+@@ -65,7 +65,7 @@
+     # certificate is created
+ 
+     openssl req -days $DAYS $@ -config $CNFFILE \
+-        -new -x509 -nodes -out $CERTFILE \
++        -newkey mldsa65 -x509 -nodes -out $CERTFILE \
+         -keyout $KEYFILE
+     chmod 600 $KEYFILE
+ }
+EOF
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+
+# update config file
+patch /etc/openwsman/openwsman.conf << 'EOF'
+--- openwsman.conf.orig	2025-06-05 07:50:30.285822838 -0400
++++ openwsman.conf	2025-06-05 07:50:38.609822838 -0400
+@@ -33,11 +33,11 @@
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
+ # the openwsman server certificate fallback file, in .pem format
+-#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
++ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
+ # the openwsman server private key fallback, in .pem format
+-#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
++ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+EOF
+
+systemctl start openwsmand
+check_key_and_cert
+test_cert_support

tests/sscg-generated-certificates/main.fmf

@@ -0,0 +1,6 @@
+summary: Service works with 'sscg' generated SSL certificates
+author: Vitezslav Crhonek <vcrhonek@redhat.com>
+contact: Vitezslav Crhonek <vcrhonek@redhat.com>
+require: sscg
+duration: 10m
+test: ./runtest.sh

tests/sscg-generated-certificates/runtest.sh

@@ -0,0 +1,17 @@
+#!/bin/sh -ux
+
+# remove previously generated SSL files
+rm -rf /etc/openwsman/{servercert,serverkey}*.pem /etc/openwsman/ca.crt
+
+# remove SSL fallback to relly really just on sscg
+cp /etc/openwsman/owsmangencert.sh /etc/openwsman/test-script.sh
+sed -i 's/^selfsign_sscg ||.*/selfsign_sscg/' /etc/openwsman/test-script.sh
+
+# generate new SSL files using sscg
+/etc/openwsman/test-script.sh
+
+# check that SSL files were generated
+[ -f /etc/openwsman/servercert.pem ] && [ -f /etc/openwsman/serverkey.pem ] || { echo "Error: SSL files missing"; exit 1; }
+
+# try to start the service
+systemctl start openwsmand