Rebuilt for Python 3.14.0rc3 bytecode

Signed-off-by: Björn Esser <besser82@fedoraproject.org>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,2 +1,2 @@
 /openwsmand.8.gz
-/v2.7.1.tar.gz
+/v2.8.1.tar.gz

openwsman-2.4.12-ruby-binding-build.patch

@@ -1,12 +1,12 @@
-diff -up openwsman-2.4.12/bindings/ruby/extconf.rb.orig openwsman-2.4.12/bindings/ruby/extconf.rb
---- openwsman-2.4.12/bindings/ruby/extconf.rb.orig	2015-02-09 09:28:58.232581263 +0100
-+++ openwsman-2.4.12/bindings/ruby/extconf.rb	2015-02-09 09:38:22.836772879 +0100
+diff -up openwsman-2.7.2/bindings/ruby/extconf.rb.orig openwsman-2.7.2/bindings/ruby/extconf.rb
+--- openwsman-2.7.2/bindings/ruby/extconf.rb.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/bindings/ruby/extconf.rb	2023-08-09 12:50:21.361216733 +0200
 @@ -32,7 +32,7 @@ swig = find_executable("swig")
  raise "SWIG not found" unless swig
  
  major, minor, path = RUBY_VERSION.split(".")
 -raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
-+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.7.1/include/ -o openwsman_wrap.c openwsman.i")
++raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.8.1-build/openwsman-2.8.1/include -o openwsman_wrap.c openwsman.i")
  
  $CPPFLAGS = "-I/usr/include/openwsman -I.."
  

openwsman-2.6.2-openssl-1.1-fix.patch

@@ -1,6 +1,6 @@
-diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/src/server/shttpd/compat_unix.h
---- openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/compat_unix.h	2021-03-09 09:15:26.750942006 +0100
+diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
+--- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/compat_unix.h	2025-02-03 09:11:35.072818890 +0100
 @@ -27,10 +27,6 @@
  	pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
  #endif /* !NO_THREADS */
@@ -12,9 +12,9 @@ diff -up openwsman-2.7.0/src/server/shttpd/compat_unix.h.orig openwsman-2.7.0/sr
  #define	DIRSEP				'/'
  #define	IS_DIRSEP_CHAR(c)		((c) == '/')
  #define	O_BINARY			0
-diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/server/shttpd/io_ssl.c
---- openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/io_ssl.c	2021-03-09 09:15:26.750942006 +0100
+diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
+--- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/io_ssl.c	2025-02-03 09:12:22.387355905 +0100
 @@ -11,28 +11,6 @@
  #include "defs.h"
  
@@ -44,10 +44,10 @@ diff -up openwsman-2.7.0/src/server/shttpd/io_ssl.c.orig openwsman-2.7.0/src/ser
  void
  _shttpd_ssl_handshake(struct stream *stream)
  {
-diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/server/shttpd/shttpd.c
---- openwsman-2.7.0/src/server/shttpd/shttpd.c.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/shttpd.c	2021-03-09 09:16:58.843241510 +0100
-@@ -1489,25 +1489,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
+--- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/shttpd.c	2025-02-03 09:13:43.415562784 +0100
+@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
  	int		retval = FALSE;
  	EC_KEY*		key;
  
@@ -73,10 +73,10 @@ diff -up openwsman-2.7.0/src/server/shttpd/shttpd.c.orig openwsman-2.7.0/src/ser
 +        OPENSSL_init_ssl(0, NULL);
  	if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
  #endif
- 		_shttpd_elog(E_LOG, NULL, "SSL_CTX_new error");
-diff -up openwsman-2.7.0/src/server/shttpd/ssl.h.orig openwsman-2.7.0/src/server/shttpd/ssl.h
---- openwsman-2.7.0/src/server/shttpd/ssl.h.orig	2020-05-25 15:16:28.000000000 +0200
-+++ openwsman-2.7.0/src/server/shttpd/ssl.h	2021-03-09 09:15:26.750942006 +0100
+ 	        _shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
+diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
+--- openwsman-2.8.1/src/server/shttpd/ssl.h.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/shttpd/ssl.h	2025-02-03 09:14:43.142975166 +0100
 @@ -12,55 +12,4 @@
  
  #include <openssl/ssl.h>

openwsman-2.7.1-fix-ruby-bindings-for-swig-41.patch

@@ -1,12 +0,0 @@
-diff -up openwsman-2.7.1/bindings/ruby/helpers.h.orig openwsman-2.7.1/bindings/ruby/helpers.h
---- openwsman-2.7.1/bindings/ruby/helpers.h.orig	2021-04-07 17:25:55.000000000 +0200
-+++ openwsman-2.7.1/bindings/ruby/helpers.h	2022-10-21 08:36:24.901459057 +0200
-@@ -47,7 +47,7 @@
-  * 
-  */
- 
--#if SWIGVERSION > 0x020004
-+#if SWIG_VERSION > 0x020004
- #define KLASS_DECL(k,t) swig_class *k = (swig_class *)(t->clientdata)
- #define KLASS_OF(x) x->klass
- #else

openwsman-2.7.1-http-unauthorized-improve.patch

@@ -1,56 +0,0 @@
-diff -up openwsman-2.7.1/src/lib/wsman-curl-client-transport.c.orig openwsman-2.7.1/src/lib/wsman-curl-client-transport.c
---- openwsman-2.7.1/src/lib/wsman-curl-client-transport.c.orig	2021-04-07 17:25:55.000000000 +0200
-+++ openwsman-2.7.1/src/lib/wsman-curl-client-transport.c	2022-07-19 09:25:22.435355610 +0200
-@@ -459,6 +459,7 @@ wsmc_handler( WsManClient *cl,
- 	long http_code;
- 	long auth_avail = 0;
- 	char *_user = NULL, *_pass = NULL;
-+	int _no_auth = 0; /* 0 if authentication is used, 1 if no authentication was used */
- 	u_buf_t *response = NULL;
- 	//char *soapaction;
- 	char *tmp_str = NULL;
-@@ -564,6 +565,7 @@ wsmc_handler( WsManClient *cl,
- 		_user = wsmc_get_user(cl);
- 		_pass = wsmc_get_password(cl);
- 		if (_user && _pass && cl->data.auth_set) {
-+			_no_auth = 0;
- 			r = curl_easy_setopt(curl, CURLOPT_HTTPAUTH, cl->data.auth_set);
- 			if (r != CURLE_OK) {
- 				cl->fault_string = u_strdup(curl_easy_strerror(r));
-@@ -584,6 +586,11 @@ wsmc_handler( WsManClient *cl,
- 				curl_err("curl_easy_setopt(curl, CURLOPT_USERPWD, ..) failed");
- 				goto DONE;
- 			}
-+        } else {
-+            /* request without user credentials, remember this for
-+             * later use when it might become necessary to print an error message
-+             */
-+            _no_auth = 1;
- 		}
- 
- 		if (wsman_debug_level_debugged(DEBUG_LEVEL_MESSAGE)) {
-@@ -616,6 +623,24 @@ wsmc_handler( WsManClient *cl,
- 				break;
- 			case 401:
- 				// The server requires authentication.
-+                /* RFC 2616 states:
-+                 *
-+                 * If the request already included Authorization credentials, then the 401
-+                 * response indicates that authorization has been refused for those
-+                 * credentials. If the 401 response contains the same challenge as the
-+                 * prior response, and the user agent has already attempted
-+                 * authentication at least once, then the user SHOULD be presented the
-+                 * entity that was given in the response, since that entity might
-+                 * include relevant diagnostic information.
-+                 */
-+                if (_no_auth == 0) {
-+                    /* no authentication credentials were used. It is only
-+                     * possible to write a message about the current situation. There
-+                     * is no information about the last attempt to access the resource.
-+                     * Maybe at a later point in time I will implement more state information.
-+                     */
-+                    fprintf(stdout,"Authentication failed, please retry\n");
-+                }
- 				break;
- 			default:
- 				// The status code does not indicate success.

openwsman-2.7.2-gcc15-fix.patch

@@ -0,0 +1,24 @@
+diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
+--- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c	2025-02-03 09:30:36.905616375 +0100
+@@ -49,7 +49,7 @@
+  */
+ 
+ static VALUE
+-load_module()
++load_module(VALUE)
+ {
+   ruby_script(PLUGIN_FILE);
+   return rb_require(PLUGIN_FILE);
+diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
+--- openwsman-2.8.1/src/server/CMakeLists.txt.orig	2025-01-23 10:23:52.000000000 +0100
++++ openwsman-2.8.1/src/server/CMakeLists.txt	2025-02-03 09:31:15.258241237 +0100
+@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
+   TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
+ ENDIF( HAVE_LIBDL )
+ 
+-INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
++INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
+ 
+ #		
+ #

openwsman-2.8.1-post-quantum.patch

@@ -0,0 +1,101 @@
+diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
+--- openwsman-2.7.2/etc/openwsman.conf.orig	2022-12-28 16:43:03.000000000 +0100
++++ openwsman-2.7.2/etc/openwsman.conf	2025-05-27 08:03:57.890057721 +0200
+@@ -32,8 +32,12 @@ ipv6 = yes
+ 
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
++# the openwsman server certificate fallback file, in .pem format
++#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
++# the openwsman server private key fallback, in .pem format
++#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
+--- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig	2025-05-21 10:07:40.404532496 +0200
++++ openwsman-2.7.2/src/server/shttpd/shttpd.c	2025-06-12 12:27:44.785904555 +0200
+@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
+ 	char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
+ 	int		retval = FALSE;
+-	EC_KEY*		key;
+ 
+ 	/* Initialize SSL crap */
+ 
+@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
+ 	else
+ 		retval = TRUE;
+ 
+-	/* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
+-	key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+-	if (key != NULL) {
+-		SSL_CTX_set_tmp_ecdh(CTX, key);
+-		EC_KEY_free(key);
++	/* Add fall back certificate/key pair */
++	if (wsmand_options_get_ssl_cert_fallback_file() &&
++                    wsmand_options_get_ssl_key_fallback_file()) {
++		if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
++		else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
++			_shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
++		else
++			retval = TRUE;
+ 	}
+ 
+ 	while (ssl_disabled_protocols) {
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
+--- openwsman-2.7.2/src/server/wsmand-daemon.c.orig	2025-05-27 07:18:16.878974761 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.c	2025-05-27 07:22:06.832235764 +0200
+@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
+ #endif
+ static int use_digest = 0;
+ static char *ssl_key_file = NULL;
++static char *ssl_key_fallback_file = NULL;
+ static char *service_path = DEFAULT_SERVICE_PATH;
+ static char *ssl_cert_file = NULL;
++static char *ssl_cert_fallback_file = NULL;
+ static char *ssl_disabled_protocols = NULL;
+ static char *ssl_cipher_list = NULL;
+ static char *pid_file = DEFAULT_PID_PATH;
+@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
+ 	service_path =
+ 	    iniparser_getstring(ini, "server:service_path", "/wsman");
+ 	ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
++	ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
+ 	ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
++	ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
+         ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
+         ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
+ 	use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
+@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
+ 	return ssl_cert_file;
+ }
+ 
++char *wsmand_options_get_ssl_key_fallback_file(void)
++{
++	return ssl_key_fallback_file;
++}
++
++char *wsmand_options_get_ssl_cert_fallback_file(void)
++{
++	return ssl_cert_fallback_file;
++}
++
+ char *wsmand_options_get_ssl_disabled_protocols(void)
+ {
+ 	return ssl_disabled_protocols;
+diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
+--- openwsman-2.7.2/src/server/wsmand-daemon.h.orig	2025-05-27 07:15:56.869002037 +0200
++++ openwsman-2.7.2/src/server/wsmand-daemon.h	2025-05-27 07:18:06.429846617 +0200
+@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
+ int wsmand_options_get_server_ssl_port(void);
+ char *wsmand_options_get_ssl_key_file(void);
+ char *wsmand_options_get_ssl_cert_file(void);
++char *wsmand_options_get_ssl_key_fallback_file(void);
++char *wsmand_options_get_ssl_cert_fallback_file(void);
+ char *wsmand_options_get_ssl_disabled_protocols(void);
+ char *wsmand_options_get_ssl_cipher_list(void);
+ int wsmand_options_get_digest(void);

openwsman.spec

@@ -18,17 +18,17 @@
 %global with_perl 0
 %global with_python 0
 %else
-%global with_ruby 1
+%global with_ruby 0
 %global with_perl 1
 %global with_python 1
 %endif
 
 Name:		openwsman
-Version:	2.7.1
+Version:	2.8.1
 Release:	10%{?dist}
 Summary:	Open source Implementation of WS-Management
 
-License:	BSD
+License:	BSD-3-Clause AND MIT
 URL:		http://www.openwsman.org/
 Source0:	https://github.com/Openwsman/openwsman/archive/v%{version}.tar.gz
 # help2man generated manpage for openwsmand binary
@@ -49,8 +49,8 @@ Patch2:		openwsman-2.4.12-ruby-binding-build.patch
 Patch3:		openwsman-2.6.2-openssl-1.1-fix.patch
 Patch4:		openwsman-2.6.5-http-status-line.patch
 Patch5:		openwsman-2.6.8-update-ssleay-conf.patch
-Patch6:		openwsman-2.7.1-http-unauthorized-improve.patch
-Patch7:		openwsman-2.7.1-fix-ruby-bindings-for-swig-41.patch
+Patch6:		openwsman-2.7.2-gcc15-fix.patch
+Patch7:		openwsman-2.8.1-post-quantum.patch
 BuildRequires:	make
 BuildRequires:	swig
 BuildRequires:	libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel
@@ -67,6 +67,7 @@ BuildRequires:	pkgconfig openssl-devel
 BuildRequires:	cmake
 BuildRequires:	systemd-units
 BuildRequires:	gcc gcc-c++
+BuildRequires:	libxcrypt-devel
 
 %description
 Openwsman is a project intended to provide an open-source
@@ -78,7 +79,7 @@ requirements that exposes a set of operations focused on and covers
 all system management aspects.
 
 %package -n libwsman1
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Open source Implementation of WS-Management
 Provides:	%{name} = %{version}-%{release}
 Obsoletes:	%{name} < %{version}-%{release}
@@ -87,7 +88,7 @@ Obsoletes:	%{name} < %{version}-%{release}
 Openwsman library for packages dependent on openwsman.
 
 %package -n libwsman-devel
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Open source Implementation of WS-Management
 Provides:	%{name}-devel = %{version}-%{release}
 Obsoletes:	%{name}-devel < %{version}-%{release}
@@ -101,14 +102,14 @@ Requires:	libcurl-devel
 Development files for openwsman.
 
 %package client
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Openwsman Client libraries
 
 %description client
 Openwsman Client libraries.
 
 %package server
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Openwsman Server and service libraries
 Requires:	libwsman1 = %{version}-%{release}
 %if 0%{?with_selinux}
@@ -122,7 +123,7 @@ Openwsman Server and service libraries.
 
 %if %{with_python}
 %package python3
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Python bindings for openwsman client API
 Requires:	%{__python3}
 Requires:	libwsman1 = %{version}-%{release}
@@ -134,7 +135,7 @@ This package provides Python3 bindings to access the openwsman client API.
 
 %if %{with_ruby}
 %package -n rubygem-%{gem_name}
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Ruby client bindings for Openwsman
 Obsoletes:	%{name}-ruby < %{version}-%{release}
 Requires:	libwsman1 = %{version}-%{release}
@@ -154,7 +155,7 @@ Documentation for rubygem-%{gem_name}
 
 %if %{with_perl}
 %package perl
-License:	BSD
+License:	BSD-3-Clause AND MIT
 Summary:	Perl bindings for openwsman client API
 Requires:	libwsman1 = %{version}-%{release}
 
@@ -162,6 +163,7 @@ Requires:	libwsman1 = %{version}-%{release}
 This package provides Perl bindings to access the openwsman client API.
 %endif
 
+%if %{with_ruby}
 %package winrs
 Summary:	Windows Remote Shell
 Requires:	rubygem-%{gem_name} = %{version}-%{release}
@@ -169,6 +171,7 @@ Requires:	rubygem-%{gem_name} = %{version}-%{release}
 %description winrs
 This is a command line tool for the Windows Remote Shell protocol.
 You can use it to send shell commands to a remote Windows hosts.
+%endif
 
 %if 0%{?with_selinux}
 # SELinux subpackage
@@ -187,13 +190,7 @@ Custom SELinux policy module
 %prep
 %setup -q
 
-%patch1 -p1 -b .pamsetup
-%patch2 -p1 -b .ruby-binding-build
-%patch3 -p1 -b .openssl-1.1-fix
-%patch4 -p1 -b .http-status-line
-%patch5 -p1 -b .update-ssleay-conf
-%patch6 -p1 -b .http-unauthorized-improve
-%patch7 -p1 -b .fix-ruby-bindings-for-swig-41
+%autopatch -p1
 
 %build
 # Removing executable permissions on .c and .h files to fix rpmlint warnings. 
@@ -264,6 +261,7 @@ rm -f %{buildroot}/%{_libdir}/openwsman/plugins/*.la
 rm -f %{buildroot}/%{_libdir}/openwsman/authenticators/*.la
 %if %{with_ruby}
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsmanplugin.rb
+[ -d %{buildroot}/%{ruby_sitelibdir} ] && rm -f %{buildroot}/%{ruby_sitelibdir}/openwsmanplugin.rb
 [ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsman.rb
 %endif
 mkdir -p %{buildroot}%{_sysconfdir}/init.d
@@ -290,6 +288,8 @@ rm -rf %{buildroot}%{gem_instdir}/ext
 
 mkdir -p %{buildroot}%{gem_extdir_mri}
 cp -a ./build%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/
+%else
+rm -f %{buildroot}%{_bindir}/winrs
 %endif
 
 %if 0%{?with_selinux}
@@ -395,7 +395,7 @@ fi
 %dir %{_libdir}/openwsman/plugins
 %{_libdir}/openwsman/plugins/*.so
 %{_libdir}/openwsman/plugins/*.so.*
-%{_sbindir}/openwsmand
+%{_bindir}/openwsmand
 %{_libdir}/libwsman_server.so.*
 %{_mandir}/man8/*
 
@@ -404,8 +404,10 @@ fi
 %{_libdir}/libwsman_clientpp.so.*
 %config(noreplace) %{_sysconfdir}/openwsman/openwsman_client.conf
 
+%if %{with_ruby}
 %files winrs
 %{_bindir}/winrs
+%endif
 
 %if 0%{?with_selinux}
 %files selinux
@@ -415,6 +417,98 @@ fi
 %endif
 
 %changelog
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 2.8.1-10
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 2.8.1-9
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 2.8.1-7
+- Perl 5.42 rebuild
+
+* Tue Jun 17 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-6
+- Update to better support post-quantum cryptography
+
+* Mon Jun 09 2025 Python Maint <python-maint@redhat.com> - 2.8.1-5
+- Rebuilt for Python 3.14
+
+* Mon Jun 09 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-4
+- Remove deprecated path from systemd service file
+
+* Tue Jun 03 2025 Python Maint <python-maint@redhat.com> - 2.8.1-3
+- Rebuilt for Python 3.14
+
+* Thu Apr 10 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
+- Build winrs only when ruby binding is enabled
+
+* Mon Apr 07 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
+- Update to openwsman-2.8.1
+
+* Fri Feb 28 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-16
+- Update minimum required cmake version
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.7.2-15
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-14
+- Fix FTBFS with GCC 15, bin and sbin unification
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Jan 08 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-12
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jun 25 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-10
+- Rebuild
+  Resolves: #2290726
+
+* Tue Jun 18 2024 Python Maint <python-maint@redhat.com> - 2.7.2-9
+- Rebuilt for Python 3.13
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.2-8
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 2.7.2-7
+- Rebuilt for Python 3.13
+
+* Fri May 10 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-6
+- Update license tags in subpackages to SPDX format
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Jan 22 2024 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-4
+- Fix FTBFS
+  Resolves: #2259165
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jan 03 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-2
+- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3
+
+* Thu Aug 31 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-1
+- Update to openwsman-2.7.2
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 2.7.1-13
+- Perl 5.38 rebuild
+
+* Wed Jun 14 2023 Python Maint <python-maint@redhat.com> - 2.7.1-12
+- Rebuilt for Python 3.12
+
+* Tue Feb 14 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.1-11
+- SPDX migration
+
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 

openwsmand.service

@@ -6,7 +6,7 @@ After=syslog.target
 Type=forking
 ExecStart=/usr/sbin/openwsmand -S
 ExecStartPre=/etc/openwsman/owsmantestcert.sh
-PIDFile=/var/run/wsmand.pid
+PIDFile=/run/wsmand.pid
 
 [Install]
 WantedBy=multi-user.target

plans/basic.fmf

@@ -0,0 +1,9 @@
+summary: Basic test plan
+prepare:
+    how: install
+    package:
+        - openwsman-server
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -0,0 +1,5 @@
+---
+badfuncs:
+    allowed:
+        /usr/sbin/openwsmand:
+            - inet_ntoa

sources

@@ -1,2 +1,2 @@
 SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
-SHA512 (v2.7.1.tar.gz) = 37738bc5be7b1c3fa961587fca4db74b8e7714fc0641a550682275fbe925b2c8e18a683cf493f4740e479f7461cc98392d3d675f4769f5cf04e7249f1e9ee880
+SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972

tests/post-quantum-cryptography/main.fmf

@@ -0,0 +1,6 @@
+summary: Post-quantum cryptography support test
+author: Vitezslav Crhonek <vcrhonek@redhat.com>
+contact: Vitezslav Crhonek <vcrhonek@redhat.com>
+require: patch
+duration: 10m
+test: ./runtest.sh

tests/post-quantum-cryptography/runtest.sh

@@ -0,0 +1,92 @@
+#!/bin/sh -eux
+
+function check_key_and_cert()
+{
+  echo -e "\n===== key info"
+  ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
+  file /etc/openwsman/serverkey.pem
+  echo -e "\n\n\n"
+
+  echo -e "\n===== cert info"
+  openssl x509 -in /etc/openwsman/servercert.pem --text --noout
+  echo -e "\n\n\n"
+}
+
+function test_key_exchange()
+{
+  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
+  echo -e "\n\n\n"
+  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
+  echo -e "\n\n\n"
+}
+
+function test_cert_support()
+{
+  echo -e "\n===== check that TLS certificate using ML-DSA works"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: mldsa65" cert-mldsa.out
+  echo -e "\n\n\n"
+  # simulate lack of ML-DSA support
+  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
+  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
+    tee cert-classic.out
+  echo -e "\n\n\n"
+  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
+  echo -e "\n\n\n"
+}
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+systemctl start openwsmand
+check_key_and_cert
+test_key_exchange
+systemctl stop openwsmand
+
+# keep RSA certificate and key
+cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
+cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
+# remove previously generated certificates/keys
+rm -rf /etc/openwsman/{servercert,serverkey}.pem
+
+# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
+# and issue a self-signed certificate for localhost using this key
+patch /etc/openwsman/owsmangencert.sh << 'EOF'
+--- /etc/openwsman/owsmangencert.sh.orig	2025-06-25 04:03:22.295778704 -0400
++++ /etc/openwsman/owsmangencert.sh	2025-06-25 04:05:12.181435542 -0400
+@@ -26,7 +26,7 @@
+ # certificate is created
+ 
+ openssl req -days 365 $@ -config $CNFFILE \
+-  -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
++  -newkey mldsa65 -x509 -nodes -out $CERTFILE \
+   -keyout $KEYFILE
+ chmod 600 $KEYFILE
+
+EOF
+
+(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
+
+# update config file
+patch /etc/openwsman/openwsman.conf << 'EOF'
+--- openwsman.conf.orig	2025-06-05 07:50:30.285822838 -0400
++++ openwsman.conf	2025-06-05 07:50:38.609822838 -0400
+@@ -33,11 +33,11 @@
+ # the openwsman server certificate file, in .pem format
+ ssl_cert_file = /etc/openwsman/servercert.pem
+ # the openwsman server certificate fallback file, in .pem format
+-#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
++ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
+ # the openwsman server private key, in .pem format
+ ssl_key_file = /etc/openwsman/serverkey.pem
+ # the openwsman server private key fallback, in .pem format
+-#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
++ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
+ 
+ # space-separated list of SSL protocols to *dis*able
+ # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
+EOF
+
+systemctl start openwsmand
+check_key_and_cert
+test_cert_support

tests/tests-DSP.yml

@@ -1,37 +0,0 @@
-- hosts: localhost
-
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    repositories:
-      - repo: https://pagure.io/DSP_test.git
-        dest: DSP_test
-        version: master
-
-    tests:
-    - DSP_test
-    environment:
-      # RPM package containing the policy module
-      TEST_RPM: openwsman-selinux
-      # policy module name
-      TEST_POLICY: openwsman
-      # policy sources will be extracted from corresponding .src.rpm
-      # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz")
-      # or empty string if policy sources are not inside a tar archive
-      POLICY_TAR: ''
-      # path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
-      # or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
-      # can contain wildcards (e.g. for versions etc.)
-      POLICY_PATH: .
-
-    required_packages:
-    - policycoreutils
-    - selinux-policy
-    - selinux-policy-targeted
-    - setools-console
-    - libselinux-utils
-    - rpm
-    - tar
-    - git
-    - openwsman-server