git: e4c7f141999c - main - security/dogtag-pki: Enable ACME support and improve rc integration
Jochen Neumeister <[email protected]> Thu, 06 Aug 2026 16:42:49 +0000
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <[email protected]> |
The branch main has been updated by joneum: URL: https://cgit.FreeBSD.org/ports/commit/?id=e4c7f141999c1c895ec7277ce76da4671986fdb8 commit e4c7f141999c1c895ec7277ce76da4671986fdb8 Author: Jochen Neumeister <[email protected]> AuthorDate: 2026-08-06 16:26:23 +0000 Commit: Jochen Neumeister <[email protected]> CommitDate: 2026-08-06 16:42:39 +0000 security/dogtag-pki: Enable ACME support and improve rc integration Enable the ACME responder that was previously disabled in the port: * Build with WITH_ACME and install the ACME webapp, configuration templates (database, issuer, realm, engine), the pki-acme-run script and pki-acme.jar * Patch hardcoded Linux paths in the ACME components to their FreeBSD locations (/usr/local/share/pki, /var/db/pki) * Link jaxb-api.jar and javax.activation-api.jar into the server common libs, required by the ACME webapp at runtime Improve the FreeBSD rc.d integration: * Generate java_opts and PKI_VERSION for the rc service directly from the instance's tomcat.conf instead of referencing an environment file * Add remove_rc_service() to cleanly remove the rc script, the service configuration and the rc.conf knob when an instance is destroyed, and use it in the instance removal scriptlet Sponsored by: Netzkommune GmbH --- security/dogtag-pki/Makefile | 46 ++++++++++-- .../files/patch-base_acme_bin_pki-acme-run | 26 +++++++ .../files/patch-base_acme_conf_configsources.conf | 8 +++ ...dogtagpki_acme_database_PostgreSQLDatabase.java | 20 ++++++ ...n_java_org_dogtagpki_acme_issuer_NSSIssuer.java | 11 +++ ...a_org_dogtagpki_acme_realm_PostgreSQLRealm.java | 11 +++ ..._java_org_dogtagpki_acme_server_ACMEEngine.java | 38 ++++++++++ ...h-base_server_python_pki_server_____init____.py | 84 +++++++++++++++------- ...patch-base_server_python_pki_server_cli_acme.py | 47 ++++++++++++ ...erver_deployment_scriptlets_instance__layout.py | 19 +++-- .../files/patch-base_server_share_conf_tomcat.conf | 11 +++ security/dogtag-pki/pkg-plist | 1 + 12 files changed, 281 insertions(+), 41 deletions(-) diff --git a/security/dogtag-pki/Makefile b/security/dogtag-pki/Makefile index e8b934a33ea8..0f8a96dd5711 100644 --- a/security/dogtag-pki/Makefile +++ b/security/dogtag-pki/Makefile @@ -1,7 +1,7 @@ PORTNAME= dogtag-pki DISTVERSIONPREFIX= v DISTVERSION= 11.7.0 -PORTREVISION= 4 +PORTREVISION= 5 CATEGORIES= security java python MAINTAINER= [email protected] @@ -114,9 +114,9 @@ CMAKE_ARGS= -DAPP_SERVER=tomcat-9.0 \ -DVERSION=${DISTVERSION} \ -DWITH_PYTHON_DOCS=OFF -CMAKE_ON= WITH_CA WITH_JAVA WITH_SERVER +CMAKE_ON= WITH_ACME WITH_CA WITH_JAVA WITH_SERVER -CMAKE_OFF= RUN_TESTS WITH_ACME WITH_CONSOLE WITH_EST WITH_JAVADOC WITH_KRA \ +CMAKE_OFF= RUN_TESTS WITH_CONSOLE WITH_EST WITH_JAVADOC WITH_KRA \ WITH_META WITH_OCSP WITH_TESTS WITH_THEME WITH_TKS WITH_TPS \ WITH_WURST @@ -136,15 +136,17 @@ PORTDATA= * _JAVA_BUILD_DIR= ${WRKDIR}/java-build -_JAVA_TARGETS= tps_library java pki-ca-links pki-lib pki-server-common-lib \ +_JAVA_TARGETS= pki-acme-links tps_library java pki-ca-links pki-lib pki-server-common-lib \ pki-server-lib pki-server-webapp-lib -_DOGTAG_JARS= pki-ca.jar pki-common.jar pki-server-webapp.jar pki-server.jar \ +_DOGTAG_JARS= pki-acme.jar pki-ca.jar pki-common.jar pki-server-webapp.jar pki-server.jar \ pki-tomcat-9.0.jar pki-tomcat.jar pki-tools.jar _RLN_PLACEHOLDERS=${JAVAJARDIR}/jss-tomcat.jar \ ${JAVAJARDIR}/jss-tomcat-9.0.jar \ -${JAVAJARDIR}/resteasy-servlet-initializer.jar +${JAVAJARDIR}/resteasy-servlet-initializer.jar \ +${JAVAJARDIR}/jaxb-api.jar \ +${JAVAJARDIR}/javax.activation-api.jar post-build: # Configure the Java build tree @@ -248,7 +250,24 @@ post-install-ca: post-install-server ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/ca \ "! -name CMakeLists.txt" -post-install-links: post-install-ca +post-install-acme: post-install-ca + @${MKDIR} ${STAGEDIR}${DATADIR}/acme \ + ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF + cd ${WRKSRC}/base/acme && \ + ${COPYTREE_BIN} bin ${STAGEDIR}${DATADIR}/acme +.for dir in conf database issuer openshift realm webapps + cd ${WRKSRC}/base/acme && \ + ${COPYTREE_SHARE} ${dir} ${STAGEDIR}${DATADIR}/acme \ + "! -name CMakeLists.txt" +.endfor + cd ${WRKSRC}/base/acme/tomcat-9.0 && \ + ${COPYTREE_SHARE} conf ${STAGEDIR}${DATADIR}/acme \ + "! -name CMakeLists.txt" + cd ${_JAVA_BUILD_DIR}/base/acme/webapp && \ + ${COPYTREE_SHARE} lib \ + ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF + +post-install-links: post-install-acme @${MKDIR} ${STAGEDIR}${DATADIR}/ca/webapps/ca/WEB-INF \ ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin \ ${STAGEDIR}${DATADIR}/server/common \ @@ -271,6 +290,14 @@ post-install-links: post-install-ca # Replace fragile upstream links with FreeBSD relative symlinks. @${TOUCH} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},} + @${RM} ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/jaxb-api.jar ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar + @${RM} ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/javax.activation-api.jar ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jaxb-api.jar + ${RLN} ${STAGEDIR}${DATADIR}/lib/jaxb-api.jar ${STAGEDIR}${DATADIR}/server/common/lib/jaxb-api.jar + @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/javax.activation-api.jar + ${RLN} ${STAGEDIR}${DATADIR}/lib/javax.activation-api.jar ${STAGEDIR}${DATADIR}/server/common/lib/javax.activation-api.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar ${RLN} ${STAGEDIR}${JAVAJARDIR}/jss-tomcat.jar ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat.jar @${RM} ${STAGEDIR}${DATADIR}/server/common/lib/jss-tomcat-9.0.jar @@ -296,6 +323,11 @@ post-install-links: post-install-ca @${RM} ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console ${RLN} ${STAGEDIR}${DATADIR}/server/webapps/pki/admin/console ${STAGEDIR}${DATADIR}/ca/webapps/ca/admin/console + @${RM} ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-server.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-server.jar ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-server.jar + @${RM} ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-acme.jar + ${RLN} ${STAGEDIR}${JAVAJARDIR}/pki/pki-acme.jar ${STAGEDIR}${DATADIR}/acme/webapps/acme/WEB-INF/lib/pki-acme.jar + @${RM} ${_RLN_PLACEHOLDERS:S,^,${STAGEDIR},} post-install-config: post-install-links diff --git a/security/dogtag-pki/files/patch-base_acme_bin_pki-acme-run b/security/dogtag-pki/files/patch-base_acme_bin_pki-acme-run new file mode 100644 index 000000000000..5369129aa7f4 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_bin_pki-acme-run @@ -0,0 +1,26 @@ +--- base/acme/bin/pki-acme-run.orig 2025-08-05 19:20:05 UTC ++++ base/acme/bin/pki-acme-run +@@ -5,7 +5,7 @@ + # SPDX-License-Identifier: GPL-2.0-or-later + # + +-. /usr/share/pki/scripts/config ++. /usr/local/share/pki/scripts/config + + # Allow the owner of the container (who might not be in the root group) + # to manage the config and log files. +@@ -16,7 +16,7 @@ then + if [ -z "$(ls -A /conf 2> /dev/null)" ] + then + echo "INFO: Installing default config files" +- cp -r /var/lib/pki/pki-tomcat/conf.default/* /conf ++ cp -r /var/db/pki/pki-tomcat/conf.default/* /conf + fi + + mkdir -p /conf/acme +@@ -120,4 +120,4 @@ fi + echo "INFO: Using default realm configuration" + fi + +-/usr/share/pki/server/bin/pki-server-run ++/usr/local/share/pki/server/bin/pki-server-run diff --git a/security/dogtag-pki/files/patch-base_acme_conf_configsources.conf b/security/dogtag-pki/files/patch-base_acme_conf_configsources.conf new file mode 100644 index 000000000000..8b68a24e58dc --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_conf_configsources.conf @@ -0,0 +1,8 @@ +--- base/acme/conf/configsources.conf.orig 2025-08-05 19:20:05 UTC ++++ base/acme/conf/configsources.conf +@@ -12,4 +12,4 @@ engine.class=org.dogtagpki.acme.server.ACMEEngineConfi + + # The 'filename' parameter tells the ACMEEngineConfigFileSource + # where to read the engine configuration from. +-engine.filename=/var/lib/pki/pki-tomcat/conf/acme/engine.conf ++engine.filename=/var/db/pki/pki-tomcat/conf/acme/engine.conf diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_database_PostgreSQLDatabase.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_database_PostgreSQLDatabase.java new file mode 100644 index 000000000000..2ea7cc027215 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_database_PostgreSQLDatabase.java @@ -0,0 +1,20 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/database/PostgreSQLDatabase.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/database/PostgreSQLDatabase.java +@@ -70,7 +70,7 @@ public class PostgreSQLDatabase extends ACMEDatabase { + + String statementsFilename = info.getProperty( + "statements", +- "/usr/share/pki/acme/database/postgresql/statements.conf"); ++ "/usr/local/share/pki/acme/database/postgresql/statements.conf"); + + logger.info("Loading statements from " + statementsFilename); + +@@ -153,7 +153,7 @@ public class PostgreSQLDatabase extends ACMEDatabase { + + logger.info("Setting up database"); + +- String filename = "/usr/share/pki/acme/database/postgresql/create.sql"; ++ String filename = "/usr/local/share/pki/acme/database/postgresql/create.sql"; + String content = new String(Files.readAllBytes(Paths.get(filename))); + + String[] statements = content.split(";"); diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_issuer_NSSIssuer.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_issuer_NSSIssuer.java new file mode 100644 index 000000000000..eb0226bd9af6 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_issuer_NSSIssuer.java @@ -0,0 +1,11 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/issuer/NSSIssuer.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/issuer/NSSIssuer.java +@@ -111,7 +111,7 @@ public class NSSIssuer extends ACMEIssuer { + } + + String extensions = config.getParameter("extensions"); +- if (extensions == null) extensions = "/usr/share/pki/acme/issuer/nss/sslserver.conf"; ++ if (extensions == null) extensions = "/usr/local/share/pki/acme/issuer/nss/sslserver.conf"; + logger.info("- extensions: " + extensions); + + Path extPath = instanceDir.resolve(extensions); diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_realm_PostgreSQLRealm.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_realm_PostgreSQLRealm.java new file mode 100644 index 000000000000..7f604a1c5588 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_realm_PostgreSQLRealm.java @@ -0,0 +1,11 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/realm/PostgreSQLRealm.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/realm/PostgreSQLRealm.java +@@ -18,7 +18,7 @@ public class PostgreSQLRealm extends PKIPostgreSQLReal + public void setConfig(RealmConfig config) { + super.setConfig(config); + if(config.getParameter("statements") == null) { +- this.config.setParameter("statements", "/usr/share/pki/acme/realm/postgresql/statements.conf"); ++ this.config.setParameter("statements", "/usr/local/share/pki/acme/realm/postgresql/statements.conf"); + } + } + diff --git a/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_server_ACMEEngine.java b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_server_ACMEEngine.java new file mode 100644 index 000000000000..56270457b383 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_acme_src_main_java_org_dogtagpki_acme_server_ACMEEngine.java @@ -0,0 +1,38 @@ +--- base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngine.java.orig 2025-08-05 19:20:05 UTC ++++ base/acme/src/main/java/org/dogtagpki/acme/server/ACMEEngine.java +@@ -220,7 +220,7 @@ public class ACMEEngine extends CMSEngine { + File configFile = new File(filename); + + if (!configFile.exists()) { +- configFile = new File("/usr/share/pki/acme/conf/engine.conf"); ++ configFile = new File("/usr/local/share/pki/acme/conf/engine.conf"); + } + + logger.info("Loading ACME engine config from " + configFile); +@@ -261,7 +261,7 @@ public class ACMEEngine extends CMSEngine { + File metadataConfigFile = new File(filename); + + if (!metadataConfigFile.exists()) { +- metadataConfigFile = new File("/usr/share/pki/acme/conf/metadata.conf"); ++ metadataConfigFile = new File("/usr/local/share/pki/acme/conf/metadata.conf"); + } + + logger.info("Loading ACME metadata from " + metadataConfigFile); +@@ -304,7 +304,7 @@ public class ACMEEngine extends CMSEngine { + File validatorsConfigFile = new File(filename); + + if (!validatorsConfigFile.exists()) { +- validatorsConfigFile = new File("/usr/share/pki/acme/conf/validators.conf"); ++ validatorsConfigFile = new File("/usr/local/share/pki/acme/conf/validators.conf"); + } + + logger.info("Loading ACME validators config from " + validatorsConfigFile); +@@ -365,7 +365,7 @@ public class ACMEEngine extends CMSEngine { + File schedulerConfigFile = new File(filename); + + if (!schedulerConfigFile.exists()) { +- schedulerConfigFile = new File("/usr/share/pki/acme/conf/scheduler.conf"); ++ schedulerConfigFile = new File("/usr/local/share/pki/acme/conf/scheduler.conf"); + } + + logger.info("Loading ACME scheduler config from " + schedulerConfigFile); diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py index 47774a8c557a..6287a1e98bc3 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_____init____.py @@ -72,7 +72,7 @@ # will be an actual folder (i.e. not a link). self._logs_dir = None -@@ -243,9 +243,43 @@ class PKIServer(object): +@@ -243,9 +243,63 @@ class PKIServer(object): return '%s@%s' % (self.type, self.name) @property @@ -103,7 +103,12 @@ + print("%s_catalina_base=\"%s\"" % (prefix, self.base_dir), file=f) + print("%s_catalina_user=\"%s\"" % (prefix, self.user), file=f) + print("%s_java_home=\"%s\"" % (prefix, java_home), file=f) -+ print("%s_env_file=\"%s\"" % (prefix, self.tomcat_conf), file=f) ++ tomcat_config = {} ++ pki.util.load_properties(self.tomcat_conf, tomcat_config) ++ java_opts = tomcat_config.get("JAVA_OPTS", "").strip(chr(34)) ++ pki_version = tomcat_config.get("PKI_VERSION", "").strip(chr(34)) ++ print('%s_java_opts="%s"' % (prefix, java_opts), file=f) ++ print('%s_env="PKI_VERSION=%s"' % (prefix, pki_version), file=f) + + os.chmod(self.service_conf, 0o644) + @@ -113,11 +118,26 @@ + raise FileExistsError(self.rc_script) + + os.symlink(os.path.join(RC_DIR, "tomcat9"), self.rc_script) ++ ++ def remove_rc_service(self, force=False): ++ logger.info("Removing %s", self.rc_script) ++ pki.util.unlink(self.rc_script, force=force) ++ ++ logger.info("Removing %s", self.service_conf) ++ pki.util.remove(self.service_conf, force=force) ++ ++ rcvar = "%s_enable" % self.rc_service_name ++ logger.info("Removing %s from rc.conf", rcvar) ++ subprocess.run( ++ ["/usr/sbin/sysrc", "-x", rcvar], ++ stdout=subprocess.DEVNULL, ++ stderr=subprocess.DEVNULL, ++ check=False) + @property def uid(self): return pwd.getpwnam(self.user).pw_uid -@@ -295,7 +329,7 @@ class PKIServer(object): +@@ -295,7 +347,7 @@ class PKIServer(object): raise pki.PKIException('Invalid instance: ' + self.name, None) def is_active(self): @@ -126,7 +146,7 @@ logger.debug('Command: %s', ' '.join(cmd)) rc = subprocess.call(cmd) return rc == 0 -@@ -362,13 +396,13 @@ class PKIServer(object): +@@ -362,13 +414,13 @@ class PKIServer(object): logger.info('Creating catalina.policy') # add "do not edit" warning @@ -142,7 +162,7 @@ logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content += f.read() -@@ -376,7 +410,7 @@ class PKIServer(object): +@@ -376,7 +428,7 @@ class PKIServer(object): content += '\n\n' # add PKI's default policy @@ -151,7 +171,7 @@ logger.info('Appending %s', filename) with open(filename, 'r', encoding='utf-8') as f: content += f.read() -@@ -450,7 +484,7 @@ grant codeBase "file:%s" { +@@ -450,7 +502,7 @@ grant codeBase "file:%s" { def start(self, wait=False, max_wait=60, timeout=None): @@ -160,7 +180,7 @@ logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -490,7 +524,11 @@ grant codeBase "file:%s" { +@@ -490,7 +542,11 @@ grant codeBase "file:%s" { def stop(self, wait=False, max_wait=60, timeout=None): @@ -173,7 +193,7 @@ logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -536,12 +574,17 @@ grant codeBase "file:%s" { +@@ -536,12 +592,17 @@ grant codeBase "file:%s" { self.start(wait=wait, max_wait=max_wait, timeout=timeout) def enable(self): @@ -193,7 +213,7 @@ logger.debug('Command: %s', ' '.join(cmd)) subprocess.check_call(cmd) -@@ -581,16 +624,20 @@ grant codeBase "file:%s" { +@@ -581,16 +642,20 @@ grant codeBase "file:%s" { for name in self.config: logger.debug('- %s: %s', name, self.config[name]) @@ -218,7 +238,7 @@ java_home = self.config.get('JAVA_HOME') java_opts = self.config.get('JAVA_OPTS') -@@ -599,12 +646,12 @@ grant codeBase "file:%s" { +@@ -599,12 +664,12 @@ grant codeBase "file:%s" { classpath = [ Tomcat.SHARE_DIR + '/bin/bootstrap.jar', Tomcat.SHARE_DIR + '/bin/tomcat-juli.jar', @@ -234,7 +254,7 @@ if with_valgrind: cmd.extend(['valgrind', '--trace-children=yes', '--tool=massif']) -@@ -618,7 +665,7 @@ grant codeBase "file:%s" { +@@ -618,7 +683,7 @@ grant codeBase "file:%s" { else: cmd.extend([java_home + '/bin/java']) @@ -243,7 +263,7 @@ cmd.extend([ '--add-opens', 'java.base/java.lang=ALL-UNNAMED', '--add-opens', 'java.base/java.io=ALL-UNNAMED', -@@ -661,7 +708,7 @@ grant codeBase "file:%s" { +@@ -661,7 +726,7 @@ grant codeBase "file:%s" { logger.debug('Command: %s', ' '.join(cmd)) @@ -252,7 +272,7 @@ def chown(self, path): -@@ -787,8 +834,8 @@ grant codeBase "file:%s" { +@@ -787,8 +852,8 @@ grant codeBase "file:%s" { self.create_logging_properties(exist_ok=True) self.create_web_xml(exist_ok=True) @@ -263,7 +283,7 @@ self.copy( Tomcat.TOMCAT_CONF, self.tomcat_conf, -@@ -798,7 +845,7 @@ grant codeBase "file:%s" { +@@ -798,7 +863,7 @@ grant codeBase "file:%s" { tomcat_conf = pki.PropertyFile(self.tomcat_conf, quote='"') tomcat_conf.read() @@ -272,7 +292,7 @@ java_home = os.getenv('JAVA_HOME') tomcat_conf.set('JAVA_HOME', java_home) -@@ -810,27 +857,21 @@ grant codeBase "file:%s" { +@@ -810,27 +875,21 @@ grant codeBase "file:%s" { tomcat_conf.write() @@ -304,7 +324,7 @@ self.makedirs(self.conf_dir, exist_ok=exist_ok) def create_logs_dir(self, exist_ok=False): -@@ -844,15 +885,15 @@ grant codeBase "file:%s" { +@@ -844,15 +903,15 @@ grant codeBase "file:%s" { backup_dir = os.path.join(self._logs_dir, 'backup') self.makedirs(backup_dir, exist_ok=exist_ok) @@ -323,7 +343,7 @@ backup_dir = os.path.join(self.logs_dir, 'backup') self.makedirs(backup_dir, exist_ok=exist_ok) -@@ -868,8 +909,8 @@ grant codeBase "file:%s" { +@@ -868,8 +927,8 @@ grant codeBase "file:%s" { def create_catalina_properties(self, exist_ok=False): @@ -334,7 +354,7 @@ catalina_properties = os.path.join( PKIServer.SHARE_DIR, 'server', 'conf', 'catalina.properties') -@@ -877,16 +918,16 @@ grant codeBase "file:%s" { +@@ -877,16 +936,16 @@ grant codeBase "file:%s" { def create_context_xml(self, exist_ok=False): @@ -355,7 +375,7 @@ logging_properties = os.path.join(Tomcat.CONF_DIR, 'logging.properties') self.copy( -@@ -896,7 +937,7 @@ grant codeBase "file:%s" { +@@ -896,7 +955,7 @@ grant codeBase "file:%s" { def create_server_xml(self, exist_ok=False): @@ -364,7 +384,7 @@ self.copy( pki.server.Tomcat.SERVER_XML, -@@ -973,7 +1014,7 @@ grant codeBase "file:%s" { +@@ -973,7 +1032,7 @@ grant codeBase "file:%s" { self.makedirs(host_dir, exist_ok=exist_ok) # Link <instance>/conf/<engine>/<host>/rewrite.config @@ -373,7 +393,7 @@ link = os.path.join(host_dir, 'rewrite.config') self.symlink(target, link, exist_ok=exist_ok) -@@ -982,8 +1023,8 @@ grant codeBase "file:%s" { +@@ -982,8 +1041,8 @@ grant codeBase "file:%s" { def create_web_xml(self, exist_ok=False): @@ -384,7 +404,17 @@ self.symlink( os.path.join(Tomcat.CONF_DIR, 'web.xml'), -@@ -1327,7 +1368,7 @@ grant codeBase "file:%s" { +@@ -1304,8 +1363,7 @@ grant codeBase "file:%s" { + + def remove(self, remove_conf=False, remove_logs=False, force=False): + +- logger.info('Removing %s', self.service_conf) +- pki.util.remove(self.service_conf, force=force) ++ self.remove_rc_service(force=force) + + logger.info('Removing %s', self.work_dir) + pki.util.rmtree(self.work_dir, force=force) +@@ -1327,7 +1385,7 @@ grant codeBase "file:%s" { logger.info('Removing %s', self.bin_dir) pki.util.unlink(self.bin_dir, force=force) @@ -393,7 +423,7 @@ if os.path.islink(self.nssdb_link): logger.info('Removing %s', self.nssdb_link) pki.util.unlink(self.nssdb_link) -@@ -1356,7 +1397,7 @@ grant codeBase "file:%s" { +@@ -1356,7 +1414,7 @@ grant codeBase "file:%s" { # Get the actual folder in case it has changed _logs_dir = os.readlink(self.logs_dir) @@ -402,7 +432,7 @@ logger.info('Removing %s', self.logs_dir) pki.util.unlink(self.logs_dir, force=force) -@@ -1366,7 +1407,7 @@ grant codeBase "file:%s" { +@@ -1366,7 +1424,7 @@ grant codeBase "file:%s" { return @@ -411,7 +441,7 @@ logger.info('Removing %s', self.logs_dir) pki.util.rmtree(self.logs_dir, force=force) -@@ -1377,17 +1418,17 @@ grant codeBase "file:%s" { +@@ -1377,17 +1435,17 @@ grant codeBase "file:%s" { # Get the actual folder in case it has changed _conf_dir = os.readlink(self.conf_dir) @@ -432,7 +462,7 @@ logger.info('Removing %s', self.conf_dir) pki.util.rmtree(self.conf_dir, force=force) -@@ -1468,11 +1509,11 @@ grant codeBase "file:%s" { +@@ -1468,11 +1526,11 @@ grant codeBase "file:%s" { subsystem_dir = os.path.join(self.base_dir, subsystem_name) @@ -446,7 +476,7 @@ # https://issues.redhat.com/browse/RHEL-21568 if not os.listdir(subsystem_dir): # Directory exists but it is empty -@@ -2398,7 +2439,11 @@ class PKIServerFactory(object): +@@ -2398,7 +2456,11 @@ class PKIServerFactory(object): instance_type = parts[0] instance_name = parts[1] diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_cli_acme.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_cli_acme.py new file mode 100644 index 000000000000..67fa55fd50a9 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_cli_acme.py @@ -0,0 +1,47 @@ +--- base/server/python/pki/server/cli/acme.py.orig 2025-08-05 19:20:05 UTC ++++ base/server/python/pki/server/cli/acme.py +@@ -437,7 +437,7 @@ class ACMEMetadataShowCLI(pki.cli.CLI): + config = {} + + if not os.path.exists(metadata_conf): +- source = '/usr/share/pki/acme/conf/metadata.conf' ++ source = '/usr/local/share/pki/acme/conf/metadata.conf' + else: + source = metadata_conf + +@@ -524,7 +524,7 @@ class ACMEMetadataModifyCLI(pki.cli.CLI): + config = {} + + if not os.path.exists(metadata_conf): +- source = '/usr/share/pki/acme/conf/metadata.conf' ++ source = '/usr/local/share/pki/acme/conf/metadata.conf' + else: + source = metadata_conf + +@@ -810,7 +810,7 @@ class ACMEDatabaseModifyCLI(pki.cli.CLI): + pki.server.subsystem.ACME_DATABASE_CLASSES.get(database_type)) + + if orig_database_type != database_type: +- source = '/usr/share/pki/acme/database/{0}/database.conf'.format(database_type) ++ source = '/usr/local/share/pki/acme/database/{0}/database.conf'.format(database_type) + logger.info('Loading %s', source) + pki.util.load_properties(source, config) + +@@ -1143,7 +1143,7 @@ class ACMEIssuerModifyCLI(pki.cli.CLI): + pki.server.subsystem.ACME_ISSUER_CLASSES.get(issuer_type)) + + if orig_issuer_type != issuer_type: +- source = '/usr/share/pki/acme/issuer/{0}/issuer.conf'.format(issuer_type) ++ source = '/usr/local/share/pki/acme/issuer/{0}/issuer.conf'.format(issuer_type) + logger.info('Loading %s', source) + pki.util.load_properties(source, config) + +@@ -1488,7 +1488,7 @@ class ACMERealmModifyCLI(pki.cli.CLI): + pki.server.subsystem.ACME_REALM_CLASSES.get(realm_type)) + + if orig_realm_type != realm_type: +- source = '/usr/share/pki/acme/realm/{0}/realm.conf'.format(realm_type) ++ source = '/usr/local/share/pki/acme/realm/{0}/realm.conf'.format(realm_type) + logger.info('Loading %s', source) + pki.util.load_properties(source, config) + diff --git a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py index 3f3d693f9fb7..714e7b1965f6 100644 --- a/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py +++ b/security/dogtag-pki/files/patch-base_server_python_pki_server_deployment_scriptlets_instance__layout.py @@ -1,4 +1,4 @@ ---- base/server/python/pki/server/deployment/scriptlets/instance_layout.py.orig 2026-07-12 10:34:10 UTC +--- base/server/python/pki/server/deployment/scriptlets/instance_layout.py.orig 2025-08-05 19:20:05 UTC +++ base/server/python/pki/server/deployment/scriptlets/instance_layout.py @@ -160,15 +160,6 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl @@ -49,16 +49,15 @@ def destroy(self, deployer): instance = self.instance -@@ -246,21 +214,9 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl +@@ -246,27 +214,11 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptl logger.info('Removing %s instance', instance.name) - logger.info('Removing %s', deployer.systemd.systemd_link) - pki.util.unlink(link=deployer.systemd.systemd_link, -+ logger.info('Removing %s', instance.rc_script) -+ pki.util.unlink(link=instance.rc_script, - force=deployer.force) -- +- force=deployer.force) ++ instance.remove_rc_service(force=deployer.force) + - if os.path.exists(deployer.systemd.base_override_dir): - logger.info('Removing %s', deployer.systemd.base_override_dir) - pki.util.rmtree(path=deployer.systemd.base_override_dir, @@ -70,6 +69,12 @@ - force=deployer.force) - - deployer.systemd.daemon_reload() - +- if config.str2bool(deployer.mdict['pki_registry_enable']): instance.remove_registry(force=deployer.force) + +- logger.info('Removing %s', instance.service_conf) +- pki.util.remove(instance.service_conf, force=deployer.force) + + logger.info('Removing %s', instance.work_dir) + pki.util.rmtree(instance.work_dir, force=deployer.force) diff --git a/security/dogtag-pki/files/patch-base_server_share_conf_tomcat.conf b/security/dogtag-pki/files/patch-base_server_share_conf_tomcat.conf new file mode 100644 index 000000000000..8b33ebe68f74 --- /dev/null +++ b/security/dogtag-pki/files/patch-base_server_share_conf_tomcat.conf @@ -0,0 +1,11 @@ +--- base/server/share/conf/tomcat.conf.orig 2025-08-05 19:20:05 UTC ++++ base/server/share/conf/tomcat.conf +@@ -27,7 +27,7 @@ CATALINA_TMPDIR="[pki_instance_path]/temp" + # -Djava.library.path=/usr/lib + # - parameters to run a java debugger (e. g. - 'eclipse') + # -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=n -Djava.awt.headless=true -Xmx128M +-JAVA_OPTS="-Dcom.redhat.fips=false" ++JAVA_OPTS="-Dcom.redhat.fips=false -Djava.net.preferIPv4Stack=false" + + # What user should run tomcat + TOMCAT_USER="[pki_user]" diff --git a/security/dogtag-pki/pkg-plist b/security/dogtag-pki/pkg-plist index 4259e4883cad..1119cbaa262f 100644 --- a/security/dogtag-pki/pkg-plist +++ b/security/dogtag-pki/pkg-plist @@ -4,6 +4,7 @@ sbin/pki-server sbin/pki-upgrade sbin/pkidestroy sbin/pkispawn +%%JAVAJARDIR%%/pki/pki-acme.jar %%JAVAJARDIR%%/pki/pki-ca.jar %%JAVAJARDIR%%/pki/pki-common.jar %%JAVAJARDIR%%/pki/pki-server-webapp.jar