Rebuilt for Python 3.14.0rc3 bytecode

Signed-off-by: Björn Esser <besser82@fedoraproject.org>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,2 +1,2 @@
 /openwsmand.8.gz
-/v2.7.0.tar.gz
+/v2.8.1.tar.gz

openwsman-2.4.12-ruby-binding-build.patch

@@ -1,12 +1,12 @@
-diff -up openwsman-2.4.12/bindings/ruby/extconf.rb.orig openwsman-2.4.12/bindings/ruby/extconf.rb
---- openwsman-2.4.12/bindings/ruby/extconf.rb.orig	2015-02-09 09:28:58.232581263 +0100
-+++ openwsman-2.4.12/bindings/ruby/extconf.rb	2015-02-09 09:38:22.836772879 +0100
+diff -up openwsman-2.7.2/bindings/ruby/extconf.rb.orig openwsman-2.7.2/bindings/ruby/extconf.rb
+--- openwsman-2.7.2/bindings/ruby/extconf.rb.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/bindings/ruby/extconf.rb	2023-08-09 12:50:21.361216733 +0200
 @@ -32,7 +32,7 @@ swig = find_executable("swig")
  raise "SWIG not found" unless swig
  
  major, minor, path = RUBY_VERSION.split(".")
 -raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
-+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.7.0/include/ -o openwsman_wrap.c openwsman.i")
++raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.8.1-build/openwsman-2.8.1/include -o openwsman_wrap.c openwsman.i")
  
  $CPPFLAGS = "-I/usr/include/openwsman -I.."
  

openwsman-2.6.2-openssl-1.1-fix.patch

@@ -1,6 +1,6 @@
-diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/src/server/shttpd/compat_unix.h
---- openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/compat_unix.h	2021-03-09 09:15:26.750942006 +0100
+diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
+--- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/compat_unix.h	2025-02-03 09:11:35.072818890 +0100
 @@ -27,10 +27,6 @@
  	pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
  #endif /* !NO_THREADS */
@@ -12,9 +12,9 @@ diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/sr
  #define	DIRSEP				'/'
  #define	IS_DIRSEP_CHAR(c)		((c) == '/')
  #define	O_BINARY			0
-diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/server/shttpd/io_ssl.c
---- openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/io_ssl.c	2021-03-09 09:15:26.750942006 +0100
+diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
+--- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/io_ssl.c	2025-02-03 09:12:22.387355905 +0100
 @@ -11,28 +11,6 @@
  #include "defs.h"
  
@@ -44,10 +44,10 @@ diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/ser
  void
  _shttpd_ssl_handshake(struct stream *stream)
  {
-diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/server/shttpd/shttpd.c
---- openwsman-2.7.0/src/server/shttpd/shttpd.c.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/shttpd.c	2021-03-09 09:16:58.843241510 +0100
-@@ -1489,25 +1489,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
+--- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/shttpd.c	2025-02-03 09:13:43.415562784 +0100
+@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
  	int		retval = FALSE;
  	EC_KEY*		key;
  
@@ -73,10 +73,10 @@ diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/ser
 +        OPENSSL_init_ssl(0, NULL);
  	if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
  #endif
- 		_shttpd_elog(E_LOG, NULL, "SSL_CTX_new error");
-diff -up openwsman-2.7.0/src/server/shttpd/ssl.h.orig openwsman-2.7.0/src/server/shttpd/ssl.h
---- openwsman-2.7.0/src/server/shttpd/ssl.h.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/ssl.h	2021-03-09 09:15:26.750942006 +0100
+ 	        _shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
+diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
+--- openwsman-2.8.1/src/server/shttpd/ssl.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/ssl.h	2025-02-03 09:14:43.142975166 +0100
 @@ -12,55 +12,4 @@
  
  #include <openssl/ssl.h>

openwsman-2.6.8-update-ssleay-conf.patch

@@ -1,12 +1,9 @@
-diff -up openwsman-2.6.8/etc/ssleay.cnf.orig openwsman-2.6.8/etc/ssleay.cnf
---- openwsman-2.6.8/etc/ssleay.cnf.orig	2018-10-12 12:06:26.000000000 +0200
-+++ openwsman-2.6.8/etc/ssleay.cnf	2020-09-22 14:27:56.216306882 +0200
-@@ -2,10 +2,8 @@
- # SSLeay example configuration file.
+diff -up openwsman-2.7.1/etc/ssleay.cnf.orig openwsman-2.7.1/etc/ssleay.cnf
+--- openwsman-2.7.1/etc/ssleay.cnf.orig	2021-11-09 08:27:48.577749509 +0100
++++ openwsman-2.7.1/etc/ssleay.cnf	2021-11-09 08:28:10.499967010 +0100
+@@ -3,7 +3,7 @@
  #
  
--RANDFILE                = /dev/random
--
  [ req ]
 -default_bits            = 1024
 +default_bits            = 2048

openwsman-2.7.2-gcc15-fix.patch

@@ -0,0 +1,24 @@
+diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
+--- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c	2025-02-03 09:30:36.905616375 +0100
+@@ -49,7 +49,7 @@
+  */
+ 
+ static VALUE
+-load_module()
++load_module(VALUE)
+ {
+   ruby_script(PLUGIN_FILE);
+   return rb_require(PLUGIN_FILE);
+diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
+--- openwsman-2.8.1/src/server/CMakeLists.txt.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/CMakeLists.txt	2025-02-03 09:31:15.258241237 +0100
+@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
+   TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
+ ENDIF( HAVE_LIBDL )
+ 
+-INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
++INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
+ 
+ #		
+ #

openwsman-2.8.1-post-quantum.patch

@@ -0,0 +1,101 @@
+diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
+--- openwsman-2.7.2/etc/openwsman.conf.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/etc/openwsman.conf	2025-05-27 08:03:57.890057721 +0200
+@@ -32,8 +32,12 @@ ipv6 = yes
+ 
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
++# the openwsman server certificate fallback file, in .pem format
++#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
++# the openwsman server private key fallback, in .pem format
++#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
+--- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig	2025-05-21 10:07:40.404532496 +0200
++++ openwsman-2.7.2/src/server/shttpd/shttpd.c	2025-06-12 12:27:44.785904555 +0200
+@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
+ 	char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
+ 	int		retval = FALSE;
+-	EC_KEY*		key;
+ 
+ 	/* Initialize SSL crap */
+ 
+@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	else
+ 		retval = TRUE;
+ 
+-	/* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
+-	key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+-	if (key != NULL) {
+-		SSL_CTX_set_tmp_ecdh(CTX, key);
+-		EC_KEY_free(key);
++	/* Add fall back certificate/key pair */
++	if (wsmand_options_get_ssl_cert_fallback_file() &&
++                    wsmand_options_get_ssl_key_fallback_file()) {
++		if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
++		else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
++		else
++			retval = TRUE;
+ 	}
+ 
+ 	while (ssl_disabled_protocols) {
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
+--- openwsman-2.7.2/src/server/wsmand-daemon.c.orig	2025-05-27 07:18:16.878974761 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.c	2025-05-27 07:22:06.832235764 +0200
+@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
+ #endif
+ static int use_digest = 0;
+ static char *ssl_key_file = NULL;
++static char *ssl_key_fallback_file = NULL;
+ static char *service_path = DEFAULT_SERVICE_PATH;
+ static char *ssl_cert_file = NULL;
++static char *ssl_cert_fallback_file = NULL;
+ static char *ssl_disabled_protocols = NULL;
+ static char *ssl_cipher_list = NULL;
+ static char *pid_file = DEFAULT_PID_PATH;
+@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
+ 	service_path =
+ 	    iniparser_getstring(ini, "server:service_path", "/wsman");
+ 	ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
++	ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
+ 	ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
++	ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
+         ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
+         ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
+ 	use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
+@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
+ 	return ssl_cert_file;
+ }
+ 
++char *wsmand_options_get_ssl_key_fallback_file(void)
++{
++	return ssl_key_fallback_file;
++}
++
++char *wsmand_options_get_ssl_cert_fallback_file(void)
++{
++	return ssl_cert_fallback_file;
++}
++
+ char *wsmand_options_get_ssl_disabled_protocols(void)
+ {
+ 	return ssl_disabled_protocols;
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
+--- openwsman-2.7.2/src/server/wsmand-daemon.h.orig	2025-05-27 07:15:56.869002037 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.h	2025-05-27 07:18:06.429846617 +0200
+@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
+ int wsmand_options_get_server_ssl_port(void);
+ char *wsmand_options_get_ssl_key_file(void);
+ char *wsmand_options_get_ssl_cert_file(void);
++char *wsmand_options_get_ssl_key_fallback_file(void);
++char *wsmand_options_get_ssl_cert_fallback_file(void);
+ char *wsmand_options_get_ssl_disabled_protocols(void);
+ char *wsmand_options_get_ssl_cipher_list(void);
+ int wsmand_options_get_digest(void);

openwsman.spec

@@ -2,16 +2,33 @@
 %global		gem_name %{name}
 
 # defining macros needed by SELinux
+# unless running a flatpak build.
+%if 0%{?flatpak}
+%global with_selinux 0
+%else
 %global with_selinux 1
 %global selinuxtype targeted
 %global modulename openwsman
+%endif
+
+# Bindings install in the wrong path for a flatpak build; this could be fixed, but
+# we don't currently need the bindings for any Flatpak'ed application
+%if 0%{?flatpak}
+%global with_ruby 0
+%global with_perl 0
+%global with_python 0
+%else
+%global with_ruby 0
+%global with_perl 1
+%global with_python 1
+%endif
 
 Name:		openwsman
-Version:	2.7.0
-Release:	5%{?dist}
+Version:	2.8.1
+Release:	10%{?dist}
 Summary:	Open source Implementation of WS-Management
 
-License:	BSD
+License:	BSD-3-Clause AND MIT
 URL:		http://www.openwsman.org/
 Source0:	https://github.com/Openwsman/openwsman/archive/v%{version}.tar.gz
 # help2man generated manpage for openwsmand binary
@@ -22,22 +39,35 @@ Source2:	openwsmand.service
 Source3:	owsmantestcert.sh
 # Source100-102: selinux policy for openwsman, extracted
 # from https://github.com/fedora-selinux/selinux-policy
+%if 0%{with_selinux}
 Source100: %{modulename}.te
 Source101: %{modulename}.if
 Source102: %{modulename}.fc
+%endif
 Patch1:		openwsman-2.4.0-pamsetup.patch
 Patch2:		openwsman-2.4.12-ruby-binding-build.patch
 Patch3:		openwsman-2.6.2-openssl-1.1-fix.patch
 Patch4:		openwsman-2.6.5-http-status-line.patch
 Patch5:		openwsman-2.6.8-update-ssleay-conf.patch
-BuildRequires: make
+Patch6:		openwsman-2.7.2-gcc15-fix.patch
+Patch7:		openwsman-2.8.1-post-quantum.patch
+BuildRequires:	make
 BuildRequires:	swig
 BuildRequires:	libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel
-BuildRequires:	python3 python3-devel ruby ruby-devel rubygems-devel perl-interpreter
-BuildRequires:	perl-devel perl-generators pkgconfig openssl-devel
+%if %{with_python}
+BuildRequires:	python3 python3-devel
+%endif
+%if %{with_ruby}
+BuildRequires:	ruby ruby-devel rubygems-devel
+%endif
+%if %{with_perl}
+BuildRequires:	perl-interpreter perl-devel perl-generators
+%endif
+BuildRequires:	pkgconfig openssl-devel
 BuildRequires:	cmake
 BuildRequires:	systemd-units
 BuildRequires:	gcc gcc-c++
+BuildRequires:	libxcrypt-devel
 
 %description
 Openwsman is a project intended to provide an open-source
@@ -49,7 +79,7 @@ requirements that exposes a set of operations focused on and covers
 all system management aspects.
 
 %package -n libwsman1
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Open source Implementation of WS-Management
 Provides:	%{name} = %{version}-%{release}
 Obsoletes:	%{name} < %{version}-%{release}
@@ -58,7 +88,7 @@ Obsoletes:	%{name} < %{version}-%{release}
 Openwsman library for packages dependent on openwsman.
 
 %package -n libwsman-devel
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Open source Implementation of WS-Management
 Provides:	%{name}-devel = %{version}-%{release}
 Obsoletes:	%{name}-devel < %{version}-%{release}
@@ -72,14 +102,14 @@ Requires:	libcurl-devel
 Development files for openwsman.
 
 %package client
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Openwsman Client libraries
 
 %description client
 Openwsman Client libraries.
 
 %package server
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Openwsman Server and service libraries
 Requires:	libwsman1 = %{version}-%{release}
 %if 0%{?with_selinux}
@@ -91,8 +121,9 @@ Requires:  (%{name}-selinux if selinux-policy-%{selinuxtype})
 %description server
 Openwsman Server and service libraries.
 
+%if %{with_python}
 %package python3
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Python bindings for openwsman client API
 Requires:	%{__python3}
 Requires:	libwsman1 = %{version}-%{release}
@@ -100,9 +131,11 @@ Requires:	libwsman1 = %{version}-%{release}
 
 %description python3
 This package provides Python3 bindings to access the openwsman client API.
+%endif
 
+%if %{with_ruby}
 %package -n rubygem-%{gem_name}
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Ruby client bindings for Openwsman
 Obsoletes:	%{name}-ruby < %{version}-%{release}
 Requires:	libwsman1 = %{version}-%{release}
@@ -118,16 +151,19 @@ BuildArch:	noarch
 
 %description -n rubygem-%{gem_name}-doc
 Documentation for rubygem-%{gem_name}
+%endif
 
+%if %{with_perl}
 %package perl
-License:	BSD
-Requires:	perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
+License:	BSD-3-Clause AND MIT
 Summary:	Perl bindings for openwsman client API
 Requires:	libwsman1 = %{version}-%{release}
 
 %description perl
 This package provides Perl bindings to access the openwsman client API.
+%endif
 
+%if %{with_ruby}
 %package winrs
 Summary:	Windows Remote Shell
 Requires:	rubygem-%{gem_name} = %{version}-%{release}
@@ -135,6 +171,7 @@ Requires:	rubygem-%{gem_name} = %{version}-%{release}
 %description winrs
 This is a command line tool for the Windows Remote Shell protocol.
 You can use it to send shell commands to a remote Windows hosts.
+%endif
 
 %if 0%{?with_selinux}
 # SELinux subpackage
@@ -153,11 +190,7 @@ Custom SELinux policy module
 %prep
 %setup -q
 
-%patch1 -p1 -b .pamsetup
-%patch2 -p1 -b .ruby-binding-build
-%patch3 -p1 -b .openssl-1.1-fix
-%patch4 -p1 -b .http-status-line
-%patch5 -p1 -b .update-ssleay-conf
+%autopatch -p1
 
 %build
 # Removing executable permissions on .c and .h files to fix rpmlint warnings. 
@@ -171,7 +204,7 @@ export CFLAGS="$RPM_OPT_FLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now"
 export CXXFLAGS="$RPM_OPT_FLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now"
 cd build
 cmake \
-	-DCMAKE_INSTALL_PREFIX=/usr \
+	-DCMAKE_INSTALL_PREFIX=%{_prefix} \
 	-DCMAKE_VERBOSE_MAKEFILE=TRUE \
 	-DCMAKE_BUILD_TYPE=Release \
 	-DCMAKE_C_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS -fno-strict-aliasing" \
@@ -181,10 +214,20 @@ cmake \
 	-DLIB=%{_lib} \
 	-DBUILD_JAVA=no \
 	-DBUILD_PYTHON=no \
+%if ! %{with_python}
+	-DBUILD_PYTHON3=no \
+%endif
+%if ! %{with_perl}
+	-DBUILD_PERL=no \
+%endif
+%if ! %{with_ruby}
+	-DBUILD_RUBY=no \
+%endif
 	..
 
 make
 
+%if %{with_ruby}
 # Make the freshly build openwsman libraries available to build the gem's
 # binary extension.
 export LIBRARY_PATH=%{_builddir}/%{name}-%{version}/build/src/lib
@@ -192,6 +235,7 @@ export CPATH=%{_builddir}/%{name}-%{version}/include/
 export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/build/src/lib/
 
 %gem_install -n ./bindings/ruby/%{name}-%{version}.gem
+%endif
 
 %if 0%{?with_selinux}
 # SELinux policy (originally from selinux-policy-contrib)
@@ -205,16 +249,21 @@ bzip2 -9 %{modulename}.pp
 %install
 cd build
 
+%if %{with_ruby}
 # Do not install the ruby extension, we are proviging the rubygem- instead.
 echo -n > bindings/ruby/cmake_install.cmake
+%endif
 
 %make_install
 cd ..
 rm -f %{buildroot}/%{_libdir}/*.la
 rm -f %{buildroot}/%{_libdir}/openwsman/plugins/*.la
 rm -f %{buildroot}/%{_libdir}/openwsman/authenticators/*.la
+%if %{with_ruby}
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsmanplugin.rb
+[ -d %{buildroot}/%{ruby_sitelibdir} ] && rm -f %{buildroot}/%{ruby_sitelibdir}/openwsmanplugin.rb
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsman.rb
+%endif
 mkdir -p %{buildroot}%{_sysconfdir}/init.d
 install -m 644 etc/openwsman.conf %{buildroot}/%{_sysconfdir}/openwsman
 install -m 644 etc/openwsman_client.conf %{buildroot}/%{_sysconfdir}/openwsman
@@ -230,6 +279,7 @@ install -m 644 include/wsman-xml.h %{buildroot}/%{_includedir}/openwsman
 install -m 644 include/wsman-xml-binding.h %{buildroot}/%{_includedir}/openwsman
 install -m 644 include/wsman-dispatcher.h %{buildroot}/%{_includedir}/openwsman
 
+%if %{with_ruby}
 mkdir -p %{buildroot}%{gem_dir}
 cp -pa ./build%{gem_dir}/* \
 	%{buildroot}%{gem_dir}/
@@ -238,6 +288,9 @@ rm -rf %{buildroot}%{gem_instdir}/ext
 
 mkdir -p %{buildroot}%{gem_extdir_mri}
 cp -a ./build%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/
+%else
+rm -f %{buildroot}%{_bindir}/winrs
+%endif
 
 %if 0%{?with_selinux}
 install -D -m 0644 build/%{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
@@ -294,12 +347,15 @@ fi
 %{_libdir}/pkgconfig/*
 %{_libdir}/*.so
 
+%if %{with_python}
 %files python3
 %doc AUTHORS COPYING ChangeLog README.md
 %{python3_sitearch}/*.so
 %{python3_sitearch}/*.py
 %{python3_sitearch}/__pycache__/*
+%endif
 
+%if %{with_ruby}
 %files -n rubygem-%{gem_name}
 %doc AUTHORS COPYING ChangeLog README.md
 %dir %{gem_instdir}
@@ -307,14 +363,19 @@ fi
 %{gem_extdir_mri}
 %exclude %{gem_cache}
 %{gem_spec}
+%endif
 
+%if %{with_ruby}
 %files -n rubygem-%{gem_name}-doc
 %doc %{gem_docdir}
+%endif
 
+%if %{with_perl}
 %files perl
 %doc AUTHORS COPYING ChangeLog README.md
 %{perl_vendorarch}/openwsman.so
 %{perl_vendorlib}/openwsman.pm
+%endif
 
 %files server
 %doc AUTHORS COPYING ChangeLog README.md
@@ -334,7 +395,7 @@ fi
 %dir %{_libdir}/openwsman/plugins
 %{_libdir}/openwsman/plugins/*.so
 %{_libdir}/openwsman/plugins/*.so.*
-%{_sbindir}/openwsmand
+%{_bindir}/openwsmand
 %{_libdir}/libwsman_server.so.*
 %{_mandir}/man8/*
 
@@ -343,17 +404,146 @@ fi
 %{_libdir}/libwsman_clientpp.so.*
 %config(noreplace) %{_sysconfdir}/openwsman/openwsman_client.conf
 
+%if %{with_ruby}
 %files winrs
 %{_bindir}/winrs
+%endif
 
 %if 0%{?with_selinux}
 %files selinux
 %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
 %{_datadir}/selinux/devel/include/distributed/%{modulename}.if
-%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
 %endif
 
 %changelog
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 2.8.1-10
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 2.8.1-9
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 2.8.1-7
+- Perl 5.42 rebuild
+
+* Tue Jun 17 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-6
+- Update to better support post-quantum cryptography
+
+* Mon Jun 09 2025 Python Maint <python-maint@redhat.com> - 2.8.1-5
+- Rebuilt for Python 3.14
+
+* Mon Jun 09 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-4
+- Remove deprecated path from systemd service file
+
+* Tue Jun 03 2025 Python Maint <python-maint@redhat.com> - 2.8.1-3
+- Rebuilt for Python 3.14
+
+* Thu Apr 10 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
+- Build winrs only when ruby binding is enabled
+
+* Mon Apr 07 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
+- Update to openwsman-2.8.1
+
+* Fri Feb 28 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-16
+- Update minimum required cmake version
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.7.2-15
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-14
+- Fix FTBFS with GCC 15, bin and sbin unification
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Jan 08 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-12
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jun 25 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-10
+- Rebuild
+  Resolves: #2290726
+
+* Tue Jun 18 2024 Python Maint <python-maint@redhat.com> - 2.7.2-9
+- Rebuilt for Python 3.13
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.2-8
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 2.7.2-7
+- Rebuilt for Python 3.13
+
+* Fri May 10 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-6
+- Update license tags in subpackages to SPDX format
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Jan 22 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-4
+- Fix FTBFS
+  Resolves: #2259165
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jan 03 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-2
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3
+
+* Thu Aug 31 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-1
+- Update to openwsman-2.7.2
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.1-13
+- Perl 5.38 rebuild
+
+* Wed Jun 14 2023 Python Maint <python-maint@redhat.com> - 2.7.1-12
+- Rebuilt for Python 3.12
+
+* Tue Feb 14 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.1-11
+- SPDX migration
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Jan 04 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.1-9
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2
+
+* Fri Oct 21 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.1-8
+- Fix Ruby bindings for swig 4.1 (backported from upstream)
+  Resolves: #2136510
+- Remove mixed use of spaces and tabs from spec file
+
+* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed Jul 20 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.1-6
+- Improve handling of HTTP 401 Unauthorized
+
+* Wed Jun 15 2022 Python Maint <python-maint@redhat.com> - 2.7.1-5
+- Rebuilt for Python 3.11
+
+* Mon May 30 2022 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.1-4
+- Perl 5.36 rebuild
+
+* Thu Jan 27 2022 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.1-3
+- F-36: rebuild against ruby31
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Nov 11 2021 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.1-1
+- Update to openwsman-2.7.1
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.7.0-6
+- Rebuilt with OpenSSL 3.0.0
+
 * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 

openwsmand.service

@@ -6,7 +6,7 @@ After=syslog.target
 Type=forking
 ExecStart=/usr/sbin/openwsmand -S
 ExecStartPre=/etc/openwsman/owsmantestcert.sh
-PIDFile=/var/run/wsmand.pid
+PIDFile=/run/wsmand.pid
 
 [Install]
 WantedBy=multi-user.target

plans/basic.fmf

@@ -0,0 +1,9 @@
+summary: Basic test plan
+prepare:
+    how: install
+    package:
+        - openwsman-server
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -0,0 +1,5 @@
+---
+badfuncs:
+    allowed:
+        /usr/sbin/openwsmand:
+            - inet_ntoa

sources

@@ -1,3 +1,2 @@
 SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
-SHA512 (v2.6.8.tar.gz) = 49e8ac9267602e3bedc5cca78f270798cd16cfb6ddf2fc5f2feb8539bb3eba3bbce09931a18c96cd231c4beeffda5c3ae5bb9e8531662c49ca6fd9681538ea31
-SHA512 (v2.7.0.tar.gz) = e61792eafd09e3608c736091d2742049086adaf5fffcda9391e4712ed1dedf3a533546a6af61ea6ce49d4cf4fb3649cb168f20260c4e975797395d6e565c6c37
+SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972

tests/post-quantum-cryptography/main.fmf

@@ -0,0 +1,6 @@
+summary: Post-quantum cryptography support test
+author: Vitezslav Crhonek <vcrhonek@redhat.com>
+contact: Vitezslav Crhonek <vcrhonek@redhat.com>
+require: patch
+duration: 10m
+test: ./runtest.sh

tests/post-quantum-cryptography/runtest.sh

@@ -0,0 +1,92 @@
+#!/bin/sh -eux
+
+function check_key_and_cert()
+{
+  echo -e "\n===== key info"
+  ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
+  file /etc/openwsman/serverkey.pem
+  echo -e "\n\n\n"
+
+  echo -e "\n===== cert info"
+  openssl x509 -in /etc/openwsman/servercert.pem --text --noout
+  echo -e "\n\n\n"
+}
+
+function test_key_exchange()
+{
+  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
+  echo -e "\n\n\n"
+  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
+  echo -e "\n\n\n"
+}
+
+function test_cert_support()
+{
+  echo -e "\n===== check that TLS certificate using ML-DSA works"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: mldsa65" cert-mldsa.out
+  echo -e "\n\n\n"
+  # simulate lack of ML-DSA support
+  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
+    tee cert-classic.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
+  echo -e "\n\n\n"
+}
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+systemctl start openwsmand
+check_key_and_cert
+test_key_exchange
+systemctl stop openwsmand
+
+# keep RSA certificate and key
+cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
+cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
+# remove previously generated certificates/keys
+rm -rf /etc/openwsman/{servercert,serverkey}.pem
+
+# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
+# and issue a self-signed certificate for localhost using this key
+patch /etc/openwsman/owsmangencert.sh << 'EOF'
+--- /etc/openwsman/owsmangencert.sh.orig	2025-06-25 04:03:22.295778704 -0400
++++ /etc/openwsman/owsmangencert.sh	2025-06-25 04:05:12.181435542 -0400
+@@ -26,7 +26,7 @@
+ # certificate is created
+ 
+ openssl req -days 365 $@ -config $CNFFILE \
+-  -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
++  -newkey mldsa65 -x509 -nodes -out $CERTFILE \
+   -keyout $KEYFILE
+ chmod 600 $KEYFILE
+
+EOF
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+
+# update config file
+patch /etc/openwsman/openwsman.conf << 'EOF'
+--- openwsman.conf.orig	2025-06-05 07:50:30.285822838 -0400
++++ openwsman.conf	2025-06-05 07:50:38.609822838 -0400
+@@ -33,11 +33,11 @@
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
+ # the openwsman server certificate fallback file, in .pem format
+-#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
++ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
+ # the openwsman server private key fallback, in .pem format
+-#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
++ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+EOF
+
+systemctl start openwsmand
+check_key_and_cert
+test_cert_support

tests/tests-DSP.yml

@@ -1,37 +0,0 @@
-- hosts: localhost
-
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    repositories:
-      - repo: https://pagure.io/DSP_test.git
-        dest: DSP_test
-        version: master
-
-    tests:
-    - DSP_test
-    environment:
-      # RPM package containing the policy module
-      TEST_RPM: openwsman-selinux
-      # policy module name
-      TEST_POLICY: openwsman
-      # policy sources will be extracted from corresponding .src.rpm
-      # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz")
-      # or empty string if policy sources are not inside a tar archive
-      POLICY_TAR: ''
-      # path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
-      # or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
-      # can contain wildcards (e.g. for versions etc.)
-      POLICY_PATH: .
-
-    required_packages:
-    - policycoreutils
-    - selinux-policy
-    - selinux-policy-targeted
-    - setools-console
-    - libselinux-utils
-    - rpm
-    - tar
-    - git
-    - openwsman-server