|
|
|
|
@ -1,5 +1,5 @@
|
|
|
|
|
%global _hardened_build 1
|
|
|
|
|
%global clknetsim_ver f00531
|
|
|
|
|
%global clknetsim_ver 5d1dc0
|
|
|
|
|
%bcond_without debug
|
|
|
|
|
%bcond_without nts
|
|
|
|
|
|
|
|
|
|
@ -8,34 +8,35 @@
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
Name: chrony
|
|
|
|
|
Version: 4.3
|
|
|
|
|
Release: 1%{?dist}
|
|
|
|
|
Version: 4.5
|
|
|
|
|
Release: 5%{?dist}
|
|
|
|
|
Summary: An NTP client/server
|
|
|
|
|
|
|
|
|
|
License: GPLv2
|
|
|
|
|
URL: https://chrony.tuxfamily.org
|
|
|
|
|
Source0: https://download.tuxfamily.org/chrony/chrony-%{version}%{?prerelease}.tar.gz
|
|
|
|
|
Source1: https://download.tuxfamily.org/chrony/chrony-%{version}%{?prerelease}-tar-gz-asc.txt
|
|
|
|
|
Source2: https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
|
|
|
|
|
License: GPL-2.0-only
|
|
|
|
|
URL: https://chrony-project.org
|
|
|
|
|
Source0: https://chrony-project.org/releases/chrony-%{version}%{?prerelease}.tar.gz
|
|
|
|
|
Source1: https://chrony-project.org/releases/chrony-%{version}%{?prerelease}-tar-gz-asc.txt
|
|
|
|
|
Source2: https://chrony-project.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
|
|
|
|
|
Source3: chrony.dhclient
|
|
|
|
|
Source4: chrony.sysusers
|
|
|
|
|
# simulator for test suite
|
|
|
|
|
Source10: https://github.com/mlichvar/clknetsim/archive/%{clknetsim_ver}/clknetsim-%{clknetsim_ver}.tar.gz
|
|
|
|
|
Source10: https://gitlab.com/chrony/clknetsim/-/archive/master/clknetsim-%{clknetsim_ver}.tar.gz
|
|
|
|
|
%{?gitpatch:Patch0: chrony-%{version}%{?prerelease}-%{gitpatch}.patch.gz}
|
|
|
|
|
|
|
|
|
|
# add distribution-specific bits to DHCP dispatcher
|
|
|
|
|
Patch1: chrony-nm-dispatcher-dhcp.patch
|
|
|
|
|
# revert some hardening options in service files
|
|
|
|
|
Patch3: chrony-services.patch
|
|
|
|
|
|
|
|
|
|
BuildRequires: gnutls-devel libcap-devel libedit-devel pps-tools-devel
|
|
|
|
|
BuildRequires: libcap-devel libedit-devel nettle-devel pps-tools-devel
|
|
|
|
|
BuildRequires: gcc gcc-c++ make bison systemd gnupg2
|
|
|
|
|
%{?with_nts:BuildRequires: gnutls-utils}
|
|
|
|
|
%{?with_nts:BuildRequires: gnutls-devel gnutls-utils}
|
|
|
|
|
%{?with_seccomp:BuildRequires: libseccomp-devel}
|
|
|
|
|
|
|
|
|
|
%{?systemd_requires}
|
|
|
|
|
%{?sysusers_requires_compat}
|
|
|
|
|
|
|
|
|
|
# Needed by the leapsectz directive in default chrony.conf
|
|
|
|
|
Requires: tzdata
|
|
|
|
|
|
|
|
|
|
# Old NetworkManager expects the dispatcher scripts in a different place
|
|
|
|
|
Conflicts: NetworkManager < 1.20
|
|
|
|
|
|
|
|
|
|
@ -56,21 +57,20 @@ service to other computers in the network.
|
|
|
|
|
%prep
|
|
|
|
|
%{gpgverify} --keyring=%{SOURCE2} --signature=%{SOURCE1} --data=%{SOURCE0}
|
|
|
|
|
%setup -q -n %{name}-%{version}%{?prerelease} -a 10
|
|
|
|
|
%{?gitpatch:%patch0 -p1}
|
|
|
|
|
%patch1 -p1 -b .nm-dispatcher-dhcp
|
|
|
|
|
%patch3 -p1 -b .services
|
|
|
|
|
%{?gitpatch:%patch -P 0 -p1}
|
|
|
|
|
%patch -P 1 -p1 -b .nm-dispatcher-dhcp
|
|
|
|
|
|
|
|
|
|
%{?gitpatch: echo %{version}-%{gitpatch} > version.txt}
|
|
|
|
|
|
|
|
|
|
# review changes in packaged configuration files and scripts
|
|
|
|
|
md5sum -c <<-EOF | (! grep -v 'OK$')
|
|
|
|
|
222e652b95027289877fa77146d3b9b1 examples/chrony-wait.service
|
|
|
|
|
5530d6e60f84b76c27495485d2510bac examples/chrony-wait.service
|
|
|
|
|
2d01b94bc1a7b7fb70cbee831488d121 examples/chrony.conf.example2
|
|
|
|
|
96999221eeef476bd49fe97b97503126 examples/chrony.keys.example
|
|
|
|
|
6a3178c4670de7de393d9365e2793740 examples/chrony.logrotate
|
|
|
|
|
c3992e2f985550739cd1cd95f98c9548 examples/chrony.nm-dispatcher.dhcp
|
|
|
|
|
2b81c60c020626165ac655b2633608eb examples/chrony.nm-dispatcher.onoffline
|
|
|
|
|
619dd00009ea312c7201beefde10341a examples/chronyd.service
|
|
|
|
|
4e85d36595727318535af3387411070c examples/chrony.nm-dispatcher.onoffline
|
|
|
|
|
c11159b78b89684eca773db6236a9855 examples/chronyd.service
|
|
|
|
|
46fa3e2d42c8eb9c42e71095686c90ed examples/chronyd-restricted.service
|
|
|
|
|
EOF
|
|
|
|
|
|
|
|
|
|
# don't allow packaging without vendor zone
|
|
|
|
|
@ -79,20 +79,22 @@ test -n "%{vendorzone}"
|
|
|
|
|
# use example chrony.conf as the default config with some modifications:
|
|
|
|
|
# - use our vendor zone (2.*pool.ntp.org names include IPv6 addresses)
|
|
|
|
|
# - enable leapsectz to get TAI-UTC offset and leap seconds from tzdata
|
|
|
|
|
# - enable keyfile
|
|
|
|
|
# - use NTP servers from DHCP
|
|
|
|
|
sed -e 's|^\(pool \)\(pool.ntp.org\)|\12.%{vendorzone}\2|' \
|
|
|
|
|
-e 's|#\(leapsectz\)|\1|' \
|
|
|
|
|
-e 's|#\(keyfile\)|\1|' \
|
|
|
|
|
-e 's|^pool.*pool.ntp.org.*|&\n\n# Use NTP servers from DHCP.\nsourcedir /run/chrony-dhcp|' \
|
|
|
|
|
< examples/chrony.conf.example2 > chrony.conf
|
|
|
|
|
|
|
|
|
|
touch -r examples/chrony.conf.example2 chrony.conf
|
|
|
|
|
|
|
|
|
|
# set selinux context in chronyd-restricted service
|
|
|
|
|
sed -i '/^ExecStart/a SELinuxContext=system_u:system_r:chronyd_restricted_t:s0' \
|
|
|
|
|
examples/chronyd-restricted.service
|
|
|
|
|
|
|
|
|
|
# regenerate the file from getdate.y
|
|
|
|
|
rm -f getdate.c
|
|
|
|
|
|
|
|
|
|
mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
|
|
|
|
|
mv clknetsim-*-%{clknetsim_ver}* test/simulation/clknetsim
|
|
|
|
|
|
|
|
|
|
%build
|
|
|
|
|
%configure \
|
|
|
|
|
@ -107,9 +109,7 @@ mv clknetsim-%{clknetsim_ver}* test/simulation/clknetsim
|
|
|
|
|
--with-hwclockfile=%{_sysconfdir}/adjtime \
|
|
|
|
|
--with-pidfile=/run/chrony/chronyd.pid \
|
|
|
|
|
--with-sendmail=%{_sbindir}/sendmail \
|
|
|
|
|
--without-nettle \
|
|
|
|
|
--without-nss \
|
|
|
|
|
--without-tomcrypt
|
|
|
|
|
--without-nettle
|
|
|
|
|
%make_build
|
|
|
|
|
|
|
|
|
|
%install
|
|
|
|
|
@ -127,8 +127,6 @@ mkdir -p $RPM_BUILD_ROOT{%{_unitdir},%{_prefix}/lib/systemd/ntp-units.d}
|
|
|
|
|
|
|
|
|
|
install -m 644 -p chrony.conf $RPM_BUILD_ROOT%{_sysconfdir}/chrony.conf
|
|
|
|
|
|
|
|
|
|
install -m 640 -p examples/chrony.keys.example \
|
|
|
|
|
$RPM_BUILD_ROOT%{_sysconfdir}/chrony.keys
|
|
|
|
|
install -m 755 -p %{SOURCE3} \
|
|
|
|
|
$RPM_BUILD_ROOT%{_sysconfdir}/dhcp/dhclient.d/chrony.sh
|
|
|
|
|
install -m 644 -p examples/chrony.logrotate \
|
|
|
|
|
@ -136,6 +134,8 @@ install -m 644 -p examples/chrony.logrotate \
|
|
|
|
|
|
|
|
|
|
install -m 644 -p examples/chronyd.service \
|
|
|
|
|
$RPM_BUILD_ROOT%{_unitdir}/chronyd.service
|
|
|
|
|
install -m 644 -p examples/chronyd-restricted.service \
|
|
|
|
|
$RPM_BUILD_ROOT%{_unitdir}/chronyd-restricted.service
|
|
|
|
|
install -m 755 -p examples/chrony.nm-dispatcher.onoffline \
|
|
|
|
|
$RPM_BUILD_ROOT%{_prefix}/lib/NetworkManager/dispatcher.d/20-chrony-onoffline
|
|
|
|
|
install -m 755 -p examples/chrony.nm-dispatcher.dhcp \
|
|
|
|
|
@ -150,6 +150,7 @@ cat > $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/chronyd <<EOF
|
|
|
|
|
OPTIONS="%{?with_seccomp:-F 2}"
|
|
|
|
|
EOF
|
|
|
|
|
|
|
|
|
|
touch $RPM_BUILD_ROOT%{_sysconfdir}/chrony.keys
|
|
|
|
|
touch $RPM_BUILD_ROOT%{_localstatedir}/lib/chrony/{drift,rtc}
|
|
|
|
|
|
|
|
|
|
echo 'chronyd.service' > \
|
|
|
|
|
@ -157,13 +158,12 @@ echo 'chronyd.service' > \
|
|
|
|
|
|
|
|
|
|
%check
|
|
|
|
|
# set random seed to get deterministic results
|
|
|
|
|
export CLKNETSIM_RANDOM_SEED=24505
|
|
|
|
|
export CLKNETSIM_RANDOM_SEED=24508
|
|
|
|
|
%make_build -C test/simulation/clknetsim
|
|
|
|
|
make quickcheck
|
|
|
|
|
|
|
|
|
|
%pre
|
|
|
|
|
%sysusers_create_compat %{SOURCE4}
|
|
|
|
|
:
|
|
|
|
|
|
|
|
|
|
%post
|
|
|
|
|
# migrate from chrony-helper to sourcedir directive
|
|
|
|
|
@ -176,20 +176,20 @@ if test -a %{_libexecdir}/chrony-helper; then
|
|
|
|
|
sed 's|.*|server &|' < $f > /run/chrony-dhcp/"${f##*servers.}.sources"
|
|
|
|
|
done 2> /dev/null
|
|
|
|
|
fi
|
|
|
|
|
%systemd_post chronyd.service chrony-wait.service
|
|
|
|
|
%systemd_post chronyd.service chronyd-restricted.service chrony-wait.service
|
|
|
|
|
|
|
|
|
|
%preun
|
|
|
|
|
%systemd_preun chronyd.service chrony-wait.service
|
|
|
|
|
%systemd_preun chronyd.service chronyd-restricted.service chrony-wait.service
|
|
|
|
|
|
|
|
|
|
%postun
|
|
|
|
|
%systemd_postun_with_restart chronyd.service
|
|
|
|
|
%systemd_postun_with_restart chronyd.service chronyd-restricted.service
|
|
|
|
|
|
|
|
|
|
%files
|
|
|
|
|
%{!?_licensedir:%global license %%doc}
|
|
|
|
|
%license COPYING
|
|
|
|
|
%doc FAQ NEWS README
|
|
|
|
|
%doc FAQ NEWS README examples/chrony.keys.example
|
|
|
|
|
%config(noreplace) %{_sysconfdir}/chrony.conf
|
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %attr(640,root,chrony) %{_sysconfdir}/chrony.keys
|
|
|
|
|
%ghost %config %attr(640,root,chrony) %{_sysconfdir}/chrony.keys
|
|
|
|
|
%config(noreplace) %{_sysconfdir}/logrotate.d/chrony
|
|
|
|
|
%config(noreplace) %{_sysconfdir}/sysconfig/chronyd
|
|
|
|
|
%{_sysconfdir}/dhcp/dhclient.d/chrony.sh
|
|
|
|
|
@ -206,23 +206,92 @@ fi
|
|
|
|
|
%dir %attr(750,chrony,chrony) %{_localstatedir}/log/chrony
|
|
|
|
|
|
|
|
|
|
%changelog
|
|
|
|
|
* Wed Oct 12 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.3-1
|
|
|
|
|
- update to 4.3 (#2133754)
|
|
|
|
|
- add sysusers.d fragment for chrony user/group (#2095374)
|
|
|
|
|
|
|
|
|
|
* Wed Mar 23 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
|
|
|
|
|
- update to 4.2 (#2051441)
|
|
|
|
|
- fully switch from nettle to gnutls (#1953463 #1954483)
|
|
|
|
|
- use NTP servers from DHCPv6 NTP server option (#2047415)
|
|
|
|
|
- drop obsolete workaround in scriptlet
|
|
|
|
|
|
|
|
|
|
* Tue Aug 10 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.1-3
|
|
|
|
|
- update seccomp filter for new glibc (#1990589)
|
|
|
|
|
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 4.5-5
|
|
|
|
|
- Bump release for June 2024 mass rebuild
|
|
|
|
|
|
|
|
|
|
* Tue May 28 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.5-4
|
|
|
|
|
- disable nettle support in favor of gnutls (RHEL-38924)
|
|
|
|
|
|
|
|
|
|
* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.5-3
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.5-2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Tue Dec 05 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.5-1
|
|
|
|
|
- update to 4.5
|
|
|
|
|
|
|
|
|
|
* Wed Nov 22 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.5-0.1.pre1
|
|
|
|
|
- update to 4.5-pre1
|
|
|
|
|
|
|
|
|
|
* Wed Aug 09 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.4-1
|
|
|
|
|
- update to 4.4
|
|
|
|
|
- require tzdata (#2218368)
|
|
|
|
|
|
|
|
|
|
* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.4-0.4.pre2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Wed Jun 21 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.4-0.3.pre2
|
|
|
|
|
- update to 4.4-pre2
|
|
|
|
|
- set selinux context in chronyd-restricted service (#2169949)
|
|
|
|
|
|
|
|
|
|
* Tue Jun 06 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.4-0.2.pre1
|
|
|
|
|
- rebuild for AES-GCM-SIV in new nettle
|
|
|
|
|
|
|
|
|
|
* Wed May 10 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.4-0.1.pre1
|
|
|
|
|
- update to 4.4-pre1
|
|
|
|
|
- switch from patchX to patch -P X
|
|
|
|
|
|
|
|
|
|
* Wed Jan 25 2023 Miroslav Lichvar <mlichvar@redhat.com> 4.3-3
|
|
|
|
|
- drop default chrony.keys config (#2104918)
|
|
|
|
|
- add chronyd-restricted service for minimal NTP client configurations
|
|
|
|
|
- convert license tag to SPDX
|
|
|
|
|
|
|
|
|
|
* Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.3-2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Wed Aug 31 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.3-1
|
|
|
|
|
- update to 4.3
|
|
|
|
|
|
|
|
|
|
* Thu Aug 11 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.3-0.1.pre1
|
|
|
|
|
- update to 4.3-pre1
|
|
|
|
|
|
|
|
|
|
* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-7
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Tue May 24 2022 Luca BRUNO <lucab@lucabruno.net> - 4.2-6
|
|
|
|
|
- Add a sysusers.d fragment for chrony user/group
|
|
|
|
|
|
|
|
|
|
* Wed Feb 16 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 4.2-5
|
|
|
|
|
- Drop obsolete workaround in scriptlet
|
|
|
|
|
|
|
|
|
|
* Wed Feb 09 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.2-4
|
|
|
|
|
- update seccomp filter for latest glibc
|
|
|
|
|
|
|
|
|
|
* Tue Feb 08 2022 Miroslav Lichvar <mlichvar@redhat.com> 4.2-3
|
|
|
|
|
- use NTP servers passed by NetworkManager from DHCPv6 NTP server option
|
|
|
|
|
|
|
|
|
|
* Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Thu Dec 16 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
|
|
|
|
|
- update to 4.2
|
|
|
|
|
|
|
|
|
|
* Thu Dec 02 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.2-0.1.pre1
|
|
|
|
|
- update to 4.2-pre1
|
|
|
|
|
|
|
|
|
|
* Tue Nov 16 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.1-5
|
|
|
|
|
- fix hardened chronyd service to allow writing log files
|
|
|
|
|
|
|
|
|
|
* Wed Sep 29 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.1-4
|
|
|
|
|
- harden chronyd and chrony-wait services
|
|
|
|
|
|
|
|
|
|
* Mon Aug 09 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.1-3
|
|
|
|
|
- update seccomp filter for new glibc
|
|
|
|
|
- remove unnecessary build requirement
|
|
|
|
|
|
|
|
|
|
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 4.1-2
|
|
|
|
|
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
|
|
|
|
Related: rhbz#1991688
|
|
|
|
|
* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.1-2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Thu May 13 2021 Miroslav Lichvar <mlichvar@redhat.com> 4.1-1
|
|
|
|
|
- update to 4.1
|
|
|
|
|
|
