Final init script changes

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,2 +1 @@
-/openwsmand.8.gz
-/v2.8.1.tar.gz
+openwsman-2.2.3.tar.bz2

openwsman-2.4.0-pamsetup.patch

@@ -1,13 +0,0 @@
-diff -up openwsman-2.6.8/etc/pam/openwsman.orig openwsman-2.6.8/etc/pam/openwsman
---- openwsman-2.6.8/etc/pam/openwsman.orig	2018-11-21 13:51:52.776325243 +0100
-+++ openwsman-2.6.8/etc/pam/openwsman	2018-11-21 13:54:17.066351134 +0100
-@@ -2,6 +2,6 @@
- auth       required	pam_unix.so	nullok
- auth       required	pam_nologin.so
- account    required	pam_unix.so
--password   required	pam_cracklib.so	nullok
--password   required	pam_unix.so	nullok use_first_pass use_authtok nis shadow
--session    required	pam_unix.so	none
-+password   required	pam_pwquality.so
-+password   required	pam_unix.so	nullok use_first_pass use_authtok
-+session    required	pam_unix.so

openwsman-2.4.12-ruby-binding-build.patch

@@ -1,12 +0,0 @@
-diff -up openwsman-2.7.2/bindings/ruby/extconf.rb.orig openwsman-2.7.2/bindings/ruby/extconf.rb
---- openwsman-2.7.2/bindings/ruby/extconf.rb.orig	2022-12-28 16:43:03.000000000 +0100
-+++ openwsman-2.7.2/bindings/ruby/extconf.rb	2023-08-09 12:50:21.361216733 +0200
-@@ -32,7 +32,7 @@ swig = find_executable("swig")
- raise "SWIG not found" unless swig
- 
- major, minor, path = RUBY_VERSION.split(".")
--raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
-+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.8.1-build/openwsman-2.8.1/include -o openwsman_wrap.c openwsman.i")
- 
- $CPPFLAGS = "-I/usr/include/openwsman -I.."
- 

openwsman-2.6.2-openssl-1.1-fix.patch

@@ -1,135 +0,0 @@
-diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
---- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/compat_unix.h	2025-02-03 09:11:35.072818890 +0100
-@@ -27,10 +27,6 @@
- 	pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
- #endif /* !NO_THREADS */
- 
--#ifndef SSL_LIB
--#define	SSL_LIB				"libssl.so"
--#endif
--
- #define	DIRSEP				'/'
- #define	IS_DIRSEP_CHAR(c)		((c) == '/')
- #define	O_BINARY			0
-diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
---- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/io_ssl.c	2025-02-03 09:12:22.387355905 +0100
-@@ -11,28 +11,6 @@
- #include "defs.h"
- 
- #if !defined(NO_SSL)
--struct ssl_func	ssl_sw[] = {
--	{"SSL_free",			{0}},
--	{"SSL_accept",			{0}},
--	{"SSL_connect",			{0}},
--	{"SSL_read",			{0}},
--	{"SSL_write",			{0}},
--	{"SSL_get_error",		{0}},
--	{"SSL_set_fd",			{0}},
--	{"SSL_new",			{0}},
--	{"SSL_CTX_new",			{0}},
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
--	{"SSLv23_server_method",	{0}},
--	{"SSL_library_init",		{0}},
--#else
--	{"TLS_server_method",	{0}},
--	{"OPENSSL_init_ssl",		{0}},
--#endif
--	{"SSL_CTX_use_PrivateKey_file",	{0}},
--	{"SSL_CTX_use_certificate_file",{0}},
--	{NULL,				{0}}
--};
--
- void
- _shttpd_ssl_handshake(struct stream *stream)
- {
-diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
---- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/shttpd.c	2025-02-03 09:13:43.415562784 +0100
-@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
- 	int		retval = FALSE;
- 	EC_KEY*		key;
- 
--	/* Load SSL library dynamically */
--	if ((lib = dlopen(SSL_LIB, RTLD_LAZY)) == NULL) {
--		_shttpd_elog(E_LOG, NULL, "set_ssl: cannot load %s", SSL_LIB);
--		return (FALSE);
--	}
--
--	for (fp = ssl_sw; fp->name != NULL; fp++)
--		if ((fp->ptr.v_void = dlsym(lib, fp->name)) == NULL) {
--			_shttpd_elog(E_LOG, NULL,"set_ssl: cannot find %s", fp->name);
--			return (FALSE);
--		}
--
- 	/* Initialize SSL crap */
- 
- #if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	SSL_library_init();
- 	if ((CTX = SSL_CTX_new(SSLv23_server_method())) == NULL)
- #else
--        OPENSSL_init_ssl();
-+        OPENSSL_init_ssl(0, NULL);
- 	if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
- #endif
- 	        _shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
-diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
---- openwsman-2.8.1/src/server/shttpd/ssl.h.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/shttpd/ssl.h	2025-02-03 09:14:43.142975166 +0100
-@@ -12,55 +12,4 @@
- 
- #include <openssl/ssl.h>
- 
--#else
--
--/*
-- * Snatched from OpenSSL includes. I put the prototypes here to be independent
-- * from the OpenSSL source installation. Having this, shttpd + SSL can be
-- * built on any system with binary SSL libraries installed.
-- */
--
--typedef struct ssl_st SSL;
--typedef struct ssl_method_st SSL_METHOD;
--typedef struct ssl_ctx_st SSL_CTX;
--
--#define	SSL_ERROR_WANT_READ	2
--#define	SSL_ERROR_WANT_WRITE	3
--#define	SSL_ERROR_SYSCALL	5
--#define	SSL_FILETYPE_PEM	1
--
--#endif
--
--/*
-- * Dynamically loaded SSL functionality
-- */
--struct ssl_func {
--	const char	*name;		/* SSL function name	*/
--	union variant	ptr;		/* Function pointer	*/
--};
--
--extern struct ssl_func	ssl_sw[];
--
--#define	FUNC(x)	ssl_sw[x].ptr.v_func
--
--#define	SSL_free(x)	(* (void (*)(SSL *)) FUNC(0))(x)
--#define	SSL_accept(x)	(* (int (*)(SSL *)) FUNC(1))(x)
--#define	SSL_connect(x)	(* (int (*)(SSL *)) FUNC(2))(x)
--#define	SSL_read(x,y,z)	(* (int (*)(SSL *, void *, int)) FUNC(3))((x),(y),(z))
--#define	SSL_write(x,y,z) \
--	(* (int (*)(SSL *, const void *,int)) FUNC(4))((x), (y), (z))
--#define	SSL_get_error(x,y)(* (int (*)(SSL *, int)) FUNC(5))((x), (y))
--#define	SSL_set_fd(x,y)	(* (int (*)(SSL *, int)) FUNC(6))((x), (y))
--#define	SSL_new(x)	(* (SSL * (*)(SSL_CTX *)) FUNC(7))(x)
--#define	SSL_CTX_new(x)	(* (SSL_CTX * (*)(const SSL_METHOD *)) FUNC(8))(x)
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
--#define	SSLv23_server_method()	(* (SSL_METHOD * (*)(void)) FUNC(9))()
--#define	SSL_library_init() (* (int (*)(void)) FUNC(10))()
--#else
--#define	TLS_server_method()	(* (SSL_METHOD * (*)(void)) FUNC(9))()
--#define	OPENSSL_init_ssl() (* (int (*)(void)) FUNC(10))()
- #endif
--#define	SSL_CTX_use_PrivateKey_file(x,y,z)	(* (int (*)(SSL_CTX *, \
--		const char *, int)) FUNC(11))((x), (y), (z))
--#define	SSL_CTX_use_certificate_file(x,y,z)	(* (int (*)(SSL_CTX *, \
--		const char *, int)) FUNC(12))((x), (y), (z))

openwsman-2.6.5-http-status-line.patch

@@ -1,39 +0,0 @@
-diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c
---- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig	2016-07-27 16:03:55.000000000 +0200
-+++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c	2018-01-22 13:05:04.478923300 +0100
-@@ -344,6 +344,35 @@ DONE:
- 	if (fault_reason == NULL) {
- 		// this is a way to segfault, investigate
- 		//fault_reason = shttpd_reason_phrase(status);
-+		// ugly workaround follows...
-+		switch (status) {
-+			case 200:
-+				fault_reason = "OK";
-+				break;
-+			case 400:
-+				fault_reason = "Bad request";
-+				break;
-+			case 401:
-+				fault_reason = "Unauthorized";
-+				break;
-+			case 403:
-+				fault_reason = "Forbidden";
-+				break;
-+			case 404:
-+				fault_reason = "Not found";
-+				break;
-+			case 500:
-+				fault_reason = "Internal Error";
-+				break;
-+			case 501:
-+				fault_reason = "Not implemented";
-+				break;
-+			case 415:
-+				fault_reason = "Unsupported Media Type";
-+				break;
-+			default:
-+				fault_reason = "";
-+		}
- 	}
- 	debug("Response status=%d (%s)", status, fault_reason);
- 

openwsman-2.6.8-update-ssleay-conf.patch

@@ -1,12 +0,0 @@
-diff -up openwsman-2.7.1/etc/ssleay.cnf.orig openwsman-2.7.1/etc/ssleay.cnf
---- openwsman-2.7.1/etc/ssleay.cnf.orig	2021-11-09 08:27:48.577749509 +0100
-+++ openwsman-2.7.1/etc/ssleay.cnf	2021-11-09 08:28:10.499967010 +0100
-@@ -3,7 +3,7 @@
- #
- 
- [ req ]
--default_bits            = 1024
-+default_bits            = 2048
- default_keyfile         = privkey.pem
- distinguished_name      = req_distinguished_name
- 

openwsman-2.7.2-gcc15-fix.patch

@@ -1,24 +0,0 @@
-diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
---- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c	2025-02-03 09:30:36.905616375 +0100
-@@ -49,7 +49,7 @@
-  */
- 
- static VALUE
--load_module()
-+load_module(VALUE)
- {
-   ruby_script(PLUGIN_FILE);
-   return rb_require(PLUGIN_FILE);
-diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
---- openwsman-2.8.1/src/server/CMakeLists.txt.orig	2025-01-23 10:23:52.000000000 +0100
-+++ openwsman-2.8.1/src/server/CMakeLists.txt	2025-02-03 09:31:15.258241237 +0100
-@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
-   TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
- ENDIF( HAVE_LIBDL )
- 
--INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
-+INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
- 
- #		
- #

openwsman-2.8.1-post-quantum.patch

@@ -1,101 +0,0 @@
-diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
---- openwsman-2.7.2/etc/openwsman.conf.orig	2022-12-28 16:43:03.000000000 +0100
-+++ openwsman-2.7.2/etc/openwsman.conf	2025-05-27 08:03:57.890057721 +0200
-@@ -32,8 +32,12 @@ ipv6 = yes
- 
- # the openwsman server certificate file, in .pem format
- ssl_cert_file = /etc/openwsman/servercert.pem
-+# the openwsman server certificate fallback file, in .pem format
-+#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
- # the openwsman server private key, in .pem format
- ssl_key_file = /etc/openwsman/serverkey.pem
-+# the openwsman server private key fallback, in .pem format
-+#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
- 
- # space-separated list of SSL protocols to *dis*able
- # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
-diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
---- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig	2025-05-21 10:07:40.404532496 +0200
-+++ openwsman-2.7.2/src/server/shttpd/shttpd.c	2025-06-12 12:27:44.785904555 +0200
-@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
- 	char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
- 	char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
- 	int		retval = FALSE;
--	EC_KEY*		key;
- 
- 	/* Initialize SSL crap */
- 
-@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
- 	else
- 		retval = TRUE;
- 
--	/* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
--	key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
--	if (key != NULL) {
--		SSL_CTX_set_tmp_ecdh(CTX, key);
--		EC_KEY_free(key);
-+	/* Add fall back certificate/key pair */
-+	if (wsmand_options_get_ssl_cert_fallback_file() &&
-+                    wsmand_options_get_ssl_key_fallback_file()) {
-+		if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
-+			_shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
-+		else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
-+			_shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
-+		else
-+			retval = TRUE;
- 	}
- 
- 	while (ssl_disabled_protocols) {
-diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
---- openwsman-2.7.2/src/server/wsmand-daemon.c.orig	2025-05-27 07:18:16.878974761 +0200
-+++ openwsman-2.7.2/src/server/wsmand-daemon.c	2025-05-27 07:22:06.832235764 +0200
-@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
- #endif
- static int use_digest = 0;
- static char *ssl_key_file = NULL;
-+static char *ssl_key_fallback_file = NULL;
- static char *service_path = DEFAULT_SERVICE_PATH;
- static char *ssl_cert_file = NULL;
-+static char *ssl_cert_fallback_file = NULL;
- static char *ssl_disabled_protocols = NULL;
- static char *ssl_cipher_list = NULL;
- static char *pid_file = DEFAULT_PID_PATH;
-@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
- 	service_path =
- 	    iniparser_getstring(ini, "server:service_path", "/wsman");
- 	ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
-+	ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
- 	ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
-+	ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
-         ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
-         ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
- 	use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
-@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
- 	return ssl_cert_file;
- }
- 
-+char *wsmand_options_get_ssl_key_fallback_file(void)
-+{
-+	return ssl_key_fallback_file;
-+}
-+
-+char *wsmand_options_get_ssl_cert_fallback_file(void)
-+{
-+	return ssl_cert_fallback_file;
-+}
-+
- char *wsmand_options_get_ssl_disabled_protocols(void)
- {
- 	return ssl_disabled_protocols;
-diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
---- openwsman-2.7.2/src/server/wsmand-daemon.h.orig	2025-05-27 07:15:56.869002037 +0200
-+++ openwsman-2.7.2/src/server/wsmand-daemon.h	2025-05-27 07:18:06.429846617 +0200
-@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
- int wsmand_options_get_server_ssl_port(void);
- char *wsmand_options_get_ssl_key_file(void);
- char *wsmand_options_get_ssl_cert_file(void);
-+char *wsmand_options_get_ssl_key_fallback_file(void);
-+char *wsmand_options_get_ssl_cert_fallback_file(void);
- char *wsmand_options_get_ssl_disabled_protocols(void);
- char *wsmand_options_get_ssl_cipher_list(void);
- int wsmand_options_get_digest(void);

openwsman-authors.patch

@@ -0,0 +1,14 @@
+diff -up openwsman-2.2.3/AUTHORS.diff openwsman-2.2.3/AUTHORS
+--- openwsman-2.2.3/AUTHORS.diff	2010-04-20 10:42:40.156797595 -0500
++++ openwsman-2.2.3/AUTHORS	2010-04-20 10:43:10.440803220 -0500
+@@ -13,5 +13,10 @@ Contributions and Patches by:
+ 	Viktor Mihajlovski, IBM
+ 	Klaus Kaempf, Novell
+ 
++AUTHORS from Spec file:
++    Anas Nashif <anas.nashif@intel.com>
++    Vadim Revyakin <vadim.revyakin@intel.com>
++    Denis Sadykov <denis.sadykov@intel.com>
++
+ 
+ If you think you name should be here and I forgot it, please let me know.

openwsman-initscript.patch

@@ -0,0 +1,112 @@
+diff -up ./etc/init/openwsmand.sh.in.old ./etc/init/openwsmand.sh.in
+--- ./etc/init/openwsmand.sh.in.old	2010-08-04 16:43:40.212100948 -0500
++++ ./etc/init/openwsmand.sh.in	2010-08-04 17:26:20.013849220 -0500
+@@ -4,15 +4,15 @@
+ # Provides: openwsmand
+ # Required-Start: $remote_fs
+ # Required-Stop: $network
+-# Default-Start: 2 3 4 5
+-# Default-Stop: 0 1 6 
++# Default-Start:
++# Default-Stop:
+ # Short-Description: Openwsman Daemon
+ # Description: openwsmand
+ #       Start/Stop the Openwsman Daemon
+ ### END INIT INFO
+ #
+ #
+-# chkconfig: 2345 36 64
++# chkconfig: - 36 64
+ # description: Openwsman Daemon
+ # processname: openwsmand
+ 
+@@ -56,20 +56,16 @@ start()
+ 	echo "Using common server certificate /etc/ssl/servercerts/servercert.pem"
+ 	ln -s /etc/ssl/servercerts/server{cert,key}.pem @SYSCONFDIR@
+       else
+-        echo "Generating Openwsman server public certificate and private key"
+-	FQDN=`hostname --fqdn`
+-	if [ "x${FQDN}" = "x" ]; then
+-	  FQDN=localhost.localdomain
+-	fi
+-cat << EOF | sh @SYSCONFDIR@/owsmangencert.sh > /dev/null 2>&1
+---
+-SomeState
+-SomeCity
+-SomeOrganization
+-SomeOrganizationalUnit
+-${FQDN}
+-root@${FQDN}
+-EOF
++	echo "FAILED: Starting openwsman server"
++        echo "There is no ssl server key available for openwsman server to use."
++	echo -e "Please generate one with the following script and start the openwsman service again:\n"
++	echo "##################################"
++        echo "/etc/openwsman/owsmangencert.sh"
++	echo "================================="
++
++	echo "NOTE: The script uses /dev/random device for generating some random bits while generating the server key."
++	echo "      If this takes too long, you can replace the value of \"RANDFILE\" in @SYSCONFDIR@/ssleay.cnf with /dev/urandom."
++		
+       fi
+     fi
+ 
+@@ -145,6 +141,10 @@ case "$1" in
+     fi
+     ;;
+ 
++   condrestart)
++      [ -e $lockfile ] && restart
++    ;;
++
+     *)
+     echo "Usage: $0 {restart|start|stop|reload|force-reload|status}"
+ esac
+diff -up ./etc/owsmangencert.sh.in.old ./etc/owsmangencert.sh.in
+--- ./etc/owsmangencert.sh.in.old	2010-08-04 17:14:31.241100874 -0500
++++ ./etc/owsmangencert.sh.in	2010-08-04 17:21:02.944850958 -0500
+@@ -1,7 +1,5 @@
+ #!/bin/sh
+ 
+-#!/bin/sh -e
+-
+ CERTFILE=@SYSCONFDIR@/servercert.pem
+ KEYFILE=@SYSCONFDIR@/serverkey.pem
+ CNFFILE=@SYSCONFDIR@/ssleay.cnf
+@@ -15,19 +13,33 @@ if [ "$1" = "--force" ]; then
+   shift
+ fi
+ 
++FQDN=`hostname --fqdn`
++        if [ "x${FQDN}" = "x" ]; then
++          FQDN=localhost.localdomain
++        fi
+ echo
+ echo creating selfsingned certificate
+ echo "replace it with one signed by a certification authority (CA)"
+ echo
+-echo enter your ServerName at the Common Name prompt
++#echo enter your ServerName at the Common Name prompt
+ echo
+ 
+ # use special .cnf, because with normal one no valid selfsigned
+ # certificate is created
+ 
+-export RANDFILE=/dev/random
+-openssl req -days 365 $@ -config $CNFFILE \
++#export RANDFILE=/dev/random
++cat <<EOF  |openssl req -days 365 $@ -config $CNFFILE \
+   -new -x509 -nodes -out $CERTFILE \
+   -keyout $KEYFILE
++--
++SomeState
++SomeCity
++SomeOrganization
++SomeOrganizationalUnit
++${FQDN}
++root@${FQDN}
++EOF
++
++ 
+ chmod 600 $KEYFILE
+ 

openwsman-randfile.patch

@@ -0,0 +1,12 @@
+diff -up ./etc/ssleay.cnf.new ./etc/ssleay.cnf
+--- ./etc/ssleay.cnf.new	2009-12-16 17:04:15.000000000 -0600
++++ ./etc/ssleay.cnf	2009-12-16 17:04:55.000000000 -0600
+@@ -2,7 +2,7 @@
+ # SSLeay example configuration file.
+ #
+ 
+-RANDFILE                = $ENV::HOME/.rnd
++RANDFILE                = /dev/random
+ 
+ [ req ]
+ default_bits            = 1024

openwsman-sitelibdir.patch

@@ -0,0 +1,29 @@
+diff -up ./bindings/ruby/Makefile.am.diff ./bindings/ruby/Makefile.am
+--- ./bindings/ruby/Makefile.am.diff	2010-08-02 16:57:20.407937479 -0500
++++ ./bindings/ruby/Makefile.am	2010-08-02 16:57:54.718188163 -0500
+@@ -4,8 +4,10 @@
+ 
+ SUBDIRS = openwsman tests
+ 
+-rubyarchdir = $(shell ruby -r rbconfig -e "vad = Config::CONFIG['vendorarchdir']; print(vad ? vad : Config::CONFIG['sitearchdir'])")
+-rubydir = $(shell ruby -r rbconfig -e "vd = Config::CONFIG['vendorlibdir']; print(vd ? vd : Config::CONFIG['sitelibdir'])")
++#rubyarchdir = $(shell ruby -r rbconfig -e "vad = Config::CONFIG['vendorarchdir']; print(vad ? vad : Config::CONFIG['sitearchdir'])")
++rubyarchdir = $(shell ruby -r rbconfig -e " print( Config::CONFIG['sitearchdir'])")
++#rubydir = $(shell ruby -r rbconfig -e "vd = Config::CONFIG['vendorlibdir']; print(vd ? vd : Config::CONFIG['sitelibdir'])")
++rubydir = $(shell ruby -r rbconfig -e " print(Config::CONFIG['sitelibdir'])")
+ rubyincdir = $(shell ruby -r rbconfig -e "print(Config::CONFIG['archdir'])")
+ 
+ INCLUDES =  \
+diff -up ./bindings/ruby/openwsman/Makefile.am.diff ./bindings/ruby/openwsman/Makefile.am
+--- ./bindings/ruby/openwsman/Makefile.am.diff	2010-08-02 16:58:05.201189127 -0500
++++ ./bindings/ruby/openwsman/Makefile.am	2010-08-02 16:58:20.999937941 -0500
+@@ -2,7 +2,8 @@
+ # Makefile.am for openwsman/bindings/ruby/openwsman
+ #
+ 
+-rubylibdir = $(shell ruby -r rbconfig -e "vld = Config::CONFIG['vendorlibdir']; print(vld ? vld : Config::CONFIG['sitelibdir'])")
++#rubylibdir = $(shell ruby -r rbconfig -e "vld = Config::CONFIG['vendorlibdir']; print(vld ? vld : Config::CONFIG['sitelibdir'])")
++rubylibdir = $(shell ruby -r rbconfig -e "print( Config::CONFIG['sitelibdir'])")
+ 
+ install-data-local:
+ 	$(mkinstalldirs) $(DESTDIR)$(rubylibdir)/openwsman

openwsman-swig-ver-check.patch

@@ -0,0 +1,82 @@
+diff -up ./acinclude.m4.old ./acinclude.m4
+--- ./acinclude.m4.old	2010-08-02 12:13:27.135937703 -0500
++++ ./acinclude.m4	2010-08-02 12:15:07.896938631 -0500
+@@ -157,6 +157,20 @@ AC_SUBST(SFCC_LDFLAGS)
+ #   may extend this special exception to the GPL to apply to your
+ #   modified version as well.
+ 
++AC_DEFUN([SWIG_VERSION_GOOD],[
++	AC_MSG_NOTICE([SWIG executable is '$SWIG'])
++        SWIG_LIB=`$SWIG -swiglib`
++        AC_MSG_NOTICE([SWIG library directory is '$SWIG_LIB'])
++        SWIG_VERSION=`echo $(( $available_major * 100 * 100 + $available_minor * 100 + $available_patch ))`
++        AC_MSG_NOTICE([SWIG version is '$SWIG_VERSION'])
++        # AM_CONDITIONAL(SWIG_NEW_OPTIONS, test "$SWIG_VERSION" \> 10331)
++])
++
++AC_DEFUN([SWIG_VERSION_BAD],[
++	AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.  You should look at http://www.swig.org])
++        SWIG='echo "Error: SWIG version >= $1 is required.  You have '"$swig_version"'.  You should look at http://www.swig.org" ; false'
++])
++
+ AC_DEFUN([AC_PROG_SWIG],[
+         AC_PATH_PROG([SWIG],[swig])
+         if test -z "$SWIG" ; then
+@@ -199,19 +213,44 @@ AC_DEFUN([AC_PROG_SWIG],[
+                         if test -z "$available_patch" ; then
+                                 [available_patch=0]
+                         fi
+-                        if test $available_major -ne $required_major \
+-                                -o $available_minor -ne $required_minor \
+-                                -o $available_patch -lt $required_patch ; then
+-                                AC_MSG_WARN([SWIG version >= $1 is required.  You have $swig_version.  You should look at http://www.swig.org])
+-                                SWIG='echo "Error: SWIG version >= $1 is required.  You have '"$swig_version"'.  You should look at http://www.swig.org" ; false'
+-                        else
+-                                AC_MSG_NOTICE([SWIG executable is '$SWIG'])
+-                                SWIG_LIB=`$SWIG -swiglib`
+-                                AC_MSG_NOTICE([SWIG library directory is '$SWIG_LIB'])
+-				SWIG_VERSION=`echo $(( $available_major * 100 * 100 + $available_minor * 100 + $available_patch ))`
+-                                AC_MSG_NOTICE([SWIG version is '$SWIG_VERSION'])
+-				# AM_CONDITIONAL(SWIG_NEW_OPTIONS, test "$SWIG_VERSION" \> 10331)
+-                        fi
++
++
++ 
++			if test $available_major -gt $required_major; then  
++				# the available major is greater than  required major --GOOD
++				SWIG_VERSION_GOOD()	
++                         
++			elif test $available_major -lt $required_major ; then  
++				# the avialable major is less than required major -- BAD
++				SWIG_VERSION_BAD()
++			else  
++				# the available and require major are equal check the minor and patch versions.
++				
++				if test $available_minor -gt $required_minor ; then 
++					# GOOD
++					SWIG_VERSION_GOOD()
++				elif test $avaialble_minor -lt $required_minor ; then  
++					# BAD
++					SWIG_VERSION_BAD()
++				else  
++					# the minor version are also equal
++
++					if test $available_patch -gt $required_patch ; then   
++						# GOOD						
++					 	SWIG_VERSION_GOOD()
++					elif test $available_minor -lt $required_minor ; then 
++						# BAD
++						SWIG_VERSION_BAD()
++					else 
++						# all the available major, minor and patch levels are the same as the required -- GOOD
++						SWIG_VERSION_GOOD()
++					fi
++				fi
++			fi	
++	
++	
++                               
++
+                 else
+                         AC_MSG_WARN([cannot determine SWIG version])
+                         SWIG='echo "Error: Cannot determine SWIG version.  You should look at http://www.swig.org" ; false'

openwsman.fc

@@ -1,7 +0,0 @@
-/usr/lib/systemd/system/openwsmand.*		--	gen_context(system_u:object_r:openwsman_unit_file_t,s0)
-
-/usr/sbin/openwsmand		--	gen_context(system_u:object_r:openwsman_exec_t,s0)
-
-/var/log/wsmand.*	--	gen_context(system_u:object_r:openwsman_log_t,s0)
-
-/var/run/wsmand.*	--	gen_context(system_u:object_r:openwsman_run_t,s0)

openwsman.if

@@ -1,79 +0,0 @@
-## <summary>WS-Management Server</summary>
-
-########################################
-## <summary>
-##	Execute openwsman in the openwsman domin.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`openwsman_domtrans',`
-	gen_require(`
-		type openwsman_t, openwsman_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, openwsman_exec_t, openwsman_t)
-')
-########################################
-## <summary>
-##	Execute openwsman server in the openwsman domain.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed to transition.
-##	</summary>
-## </param>
-#
-interface(`openwsman_systemctl',`
-	gen_require(`
-		type openwsman_t;
-		type openwsman_unit_file_t;
-	')
-
-	systemd_exec_systemctl($1)
-	init_reload_services($1)
-    systemd_read_fifo_file_passwd_run($1)
-	allow $1 openwsman_unit_file_t:file read_file_perms;
-	allow $1 openwsman_unit_file_t:service manage_service_perms;
-
-	ps_process_pattern($1, openwsman_t)
-')
-
-
-########################################
-## <summary>
-##	All of the rules required to administrate
-##	an openwsman environment
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`openwsman_admin',`
-	gen_require(`
-		type openwsman_t;
-	    type openwsman_unit_file_t;
-	')
-
-	allow $1 openwsman_t:process { signal_perms };
-	ps_process_pattern($1, openwsman_t)
-
-    tunable_policy(`deny_ptrace',`',`
-        allow $1 openwsman_t:process ptrace;
-    ')
-
-	openwsman_systemctl($1)
-	admin_pattern($1, openwsman_unit_file_t)
-	allow $1 openwsman_unit_file_t:service all_service_perms;
-	optional_policy(`
-		systemd_passwd_agent_exec($1)
-		systemd_read_fifo_file_passwd_run($1)
-	')
-')

openwsman.te

@@ -1,74 +0,0 @@
-policy_module(openwsman, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type openwsman_t;
-type openwsman_exec_t;
-init_daemon_domain(openwsman_t, openwsman_exec_t)
-
-type openwsman_tmp_t;
-files_tmp_file(openwsman_tmp_t)
-
-type openwsman_tmpfs_t;
-files_tmpfs_file(openwsman_tmpfs_t)
-
-type openwsman_log_t;
-logging_log_file(openwsman_log_t)
-
-type openwsman_run_t;
-files_pid_file(openwsman_run_t)
-
-type openwsman_unit_file_t;
-systemd_unit_file(openwsman_unit_file_t)
-
-########################################
-#
-# openwsman local policy
-#
-
-allow openwsman_t self:capability setuid;
-
-allow openwsman_t self:process { fork };
-allow openwsman_t self:fifo_file rw_fifo_file_perms;
-allow openwsman_t self:unix_stream_socket create_stream_socket_perms;
-allow openwsman_t self:tcp_socket { accept create_socket_perms listen };
-
-manage_files_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t)
-manage_dirs_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t)
-files_tmp_filetrans(openwsman_t, openwsman_tmp_t, { dir file })
-
-manage_files_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t)
-manage_dirs_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t)
-fs_tmpfs_filetrans(openwsman_t, openwsman_tmpfs_t, { dir file })
-
-manage_files_pattern(openwsman_t, openwsman_log_t, openwsman_log_t)
-logging_log_filetrans(openwsman_t, openwsman_log_t, { file })
-
-manage_files_pattern(openwsman_t, openwsman_run_t, openwsman_run_t)
-files_pid_filetrans(openwsman_t, openwsman_run_t, { file })
-
-auth_use_nsswitch(openwsman_t)
-auth_domtrans_chkpwd(openwsman_t)
-
-corenet_tcp_connect_pegasus_https_port(openwsman_t)
-corenet_tcp_bind_vnc_port(openwsman_t)
-corenet_tcp_bind_http_port(openwsman_t)
-
-dev_read_urand(openwsman_t)
-
-logging_send_syslog_msg(openwsman_t)
-logging_send_audit_msgs(openwsman_t)
-
-optional_policy(`
-    sblim_stream_connect_sfcbd(openwsman_t)
-    sblim_rw_semaphores_sfcbd(openwsman_t)
-    sblim_getattr_exec_sfcbd(openwsman_t)
-')
-
-optional_policy(`
-    unconfined_domain(openwsman_t)
-')
-

openwsmand.service

@@ -1,12 +0,0 @@
-[Unit]
-Description=Openwsman WS-Management Service
-After=syslog.target
-
-[Service]
-Type=forking
-ExecStart=/usr/sbin/openwsmand -S
-ExecStartPre=/etc/openwsman/owsmantestcert.sh
-PIDFile=/run/wsmand.pid
-
-[Install]
-WantedBy=multi-user.target

owsmantestcert.sh

@@ -1,21 +0,0 @@
-#!/bin/bash
-
-if [ ! -f "/etc/openwsman/serverkey.pem" ]; then
-  if [ -f "/etc/ssl/servercerts/servercert.pem" \
-       -a -f "/etc/ssl/servercerts/serverkey.pem" ]; then
-    echo "Using common server certificate /etc/ssl/servercerts/servercert.pem"
-    ln -s /etc/ssl/servercerts/server{cert,key}.pem /etc/openwsman
-    exit 0
-  else
-    echo "FAILED: Starting openwsman server"
-    echo "There is no ssl server key available for openwsman server to use."
-    echo -e "Please generate one with the following script and start the openwsman service again:\n"
-    echo "##################################"
-    echo "/etc/openwsman/owsmangencert.sh"
-    echo "================================="
-    
-    echo "NOTE: The script uses /dev/random device for generating some random bits while generating the server key."
-    echo "      If this takes too long, you can replace the value of \"RANDFILE\" in /etc/openwsman/ssleay.cnf with /dev/urandom. Please understand the implications of replacing the RNADFILE."
-    exit 1
-  fi
-fi

plans/basic.fmf

@@ -1,9 +0,0 @@
-summary: Basic test plan
-prepare:
-    how: install
-    package:
-        - openwsman-server
-discover:
-    how: fmf
-execute:
-    how: tmt

rpminspect.yaml

@@ -1,5 +0,0 @@
----
-badfuncs:
-    allowed:
-        /usr/sbin/openwsmand:
-            - inet_ntoa

sources

@@ -1,2 +1 @@
-SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
-SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972
+79f637d86a2cbd2d6763b80f68e4bc96  openwsman-2.2.3.tar.bz2

tests/post-quantum-cryptography/main.fmf

@@ -1,6 +0,0 @@
-summary: Post-quantum cryptography support test
-author: Vitezslav Crhonek <vcrhonek@redhat.com>
-contact: Vitezslav Crhonek <vcrhonek@redhat.com>
-require: patch
-duration: 10m
-test: ./runtest.sh

tests/post-quantum-cryptography/runtest.sh

@@ -1,92 +0,0 @@
-#!/bin/sh -eux
-
-function check_key_and_cert()
-{
-  echo -e "\n===== key info"
-  ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
-  file /etc/openwsman/serverkey.pem
-  echo -e "\n\n\n"
-
-  echo -e "\n===== cert info"
-  openssl x509 -in /etc/openwsman/servercert.pem --text --noout
-  echo -e "\n\n\n"
-}
-
-function test_key_exchange()
-{
-  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
-  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
-  echo -e "\n\n\n"
-  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
-  echo -e "\n\n\n"
-}
-
-function test_cert_support()
-{
-  echo -e "\n===== check that TLS certificate using ML-DSA works"
-  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
-  echo -e "\n\n\n"
-  grep "Peer signature type: mldsa65" cert-mldsa.out
-  echo -e "\n\n\n"
-  # simulate lack of ML-DSA support
-  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
-  openssl s_client  -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
-    tee cert-classic.out
-  echo -e "\n\n\n"
-  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
-  echo -e "\n\n\n"
-}
-
-(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
-systemctl start openwsmand
-check_key_and_cert
-test_key_exchange
-systemctl stop openwsmand
-
-# keep RSA certificate and key
-cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
-cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
-# remove previously generated certificates/keys
-rm -rf /etc/openwsman/{servercert,serverkey}.pem
-
-# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
-# and issue a self-signed certificate for localhost using this key
-patch /etc/openwsman/owsmangencert.sh << 'EOF'
---- /etc/openwsman/owsmangencert.sh.orig	2025-06-25 04:03:22.295778704 -0400
-+++ /etc/openwsman/owsmangencert.sh	2025-06-25 04:05:12.181435542 -0400
-@@ -26,7 +26,7 @@
- # certificate is created
- 
- openssl req -days 365 $@ -config $CNFFILE \
--  -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
-+  -newkey mldsa65 -x509 -nodes -out $CERTFILE \
-   -keyout $KEYFILE
- chmod 600 $KEYFILE
-
-EOF
-
-(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
-
-# update config file
-patch /etc/openwsman/openwsman.conf << 'EOF'
---- openwsman.conf.orig	2025-06-05 07:50:30.285822838 -0400
-+++ openwsman.conf	2025-06-05 07:50:38.609822838 -0400
-@@ -33,11 +33,11 @@
- # the openwsman server certificate file, in .pem format
- ssl_cert_file = /etc/openwsman/servercert.pem
- # the openwsman server certificate fallback file, in .pem format
--#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
-+ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
- # the openwsman server private key, in .pem format
- ssl_key_file = /etc/openwsman/serverkey.pem
- # the openwsman server private key fallback, in .pem format
--#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
-+ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
- 
- # space-separated list of SSL protocols to *dis*able
- # possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
-EOF
-
-systemctl start openwsmand
-check_key_and_cert
-test_cert_support