## START: Set by rpmautospec ## (rpmautospec version 0.8.4) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: release_number = 1; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} ## END: Set by rpmautospec %bcond selinux 1 %global selinux_variants targeted %global selinuxtype targeted %global selinux_package_dir %{_datadir}/selinux/packages %define localkdc_license %{shrink: MIT AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND BSD-2-Clause AND (BSD-2-Clause OR Apache-2.0 OR MIT) AND LGPL-2.1-or-later AND (MIT OR Apache-2.0) AND (Unlicense OR MIT) } # LICENSE.dependencies contains a full license breakdown Name: localkdc Version: 0.2.0 Release: %autorelease Summary: A local KDC based on MIT Kerberos License: %{localkdc_license} URL: https://gitlab.com/kirmes/localkdc Source0: https://gitlab.com/kirmes/localkdc/-/archive/%{version}/%{name}-%{version}.tar.gz BuildRequires: cargo BuildRequires: cargo-rpm-macros BuildRequires: cmake BuildRequires: gcc BuildRequires: krb5-devel BuildRequires: pam-devel BuildRequires: systemd-rpm-macros Requires: bash Requires: gawk Requires: hostname Requires: krb5-server Requires: krb5-workstation Requires: certmonger %if %{with selinux} Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) %endif Requires(post): (systemd-standalone-tmpfiles or systemd) Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units %description localkdc is a local authentication hub that leverages Kerberos for managing authentication and authorization on individual machines, whether standalone or domain-enrolled. It reuses expertise accumulated through decades of work on Samba and FreeIPA. The KDC communicates over a Unix domain socket rather than network ports, allowing systemd to activate it on demand. User principals are discovered dynamically from the operating system via systemd's userdb, eliminating separate database maintenance. Credential verification is delegated to PAM, so any local system user can authenticate via Kerberos using their existing system password. There is no directory service or manual enrollment required. %if %{with selinux} %package selinux Summary: SELinux support for %{name} BuildRequires: selinux-policy-devel Requires: %{name} = %{version}-%{release} Requires: selinux-policy-%{selinuxtype} Requires(post): selinux-policy-%{selinuxtype} %description selinux SELinux support for %{name} #endif with selinux %endif %prep %autosetup -p1 %cargo_prep pushd src >/dev/null %cargo_prep popd >/dev/null %generate_buildrequires pushd src >/dev/null %cargo_generate_buildrequires -a -t popd >/dev/null %build export RUSTFLAGS='%{build_rustflags}' %cmake \ -DCMAKE_INSTALL_RUNSTATEDIR=/run \ -DCMAKE_INSTALL_LOCALSTATEDIR=/var %cmake_build LDEPS="$(pwd)/LICENSE.dependencies" pushd src >/dev/null %{cargo_license_summary} %{cargo_license} > "${LDEPS}" popd >/dev/null pushd selinux for SELINUXVARIANT in %{selinux_variants}; do make -f /usr/share/selinux/devel/Makefile %{name}.pp mv -v %{name}.pp %{name}-${SELINUXVARIANT}.pp done popd %install %cmake_install install -d -m 0755 %{buildroot}%{_sysconfdir}/localkdc install -d -m 0755 %{buildroot}%{_var}/kerberos/localkdc %if %{with selinux} # Install the SELinux module(s). rm -fv selinux-files.txt for SELINUXVARIANT in %{selinux_variants}; do install -d -m 755 %{buildroot}%{selinux_package_dir}/${SELINUXVARIANT} bzip2 selinux/%{name}-${SELINUXVARIANT}.pp MODULE_PATH=%{selinux_package_dir}/${SELINUXVARIANT}/%{name}.pp.bz2 install -p -m 644 selinux/%{name}-${SELINUXVARIANT}.pp.bz2 \ %{buildroot}${MODULE_PATH} echo ${MODULE_PATH} >> selinux-files.txt done #endif with selinux %endif %post %tmpfiles_create %{_tmpfilesdir}/localkdc.conf %systemd_post localkdc.service localkdc.socket localkdc-pam-auth.socket %preun %systemd_preun localkdc.service localkdc.socket localkdc-pam-auth.socket %postun %systemd_postun localkdc.service localkdc.socket localkdc-pam-auth.socket %if %{with selinux} %pre selinux for SELINUXVARIANT in %{selinux_variants}; do %selinux_relabel_pre -s ${SELINUXVARIANT} done %post selinux for SELINUXVARIANT in %{selinux_variants}; do MODULE_PATH=%{selinux_package_dir}/${SELINUXVARIANT}/%{name}.pp.bz2 %selinux_modules_install -s ${SELINUXVARIANT} ${MODULE_PATH} done %postun selinux if [ $1 -eq 0 ]; then for SELINUXVARIANT in %{selinux_variants}; do %selinux_modules_uninstall -s ${SELINUXVARIANT} %{name} done fi %posttrans selinux for SELINUXVARIANT in %{selinux_variants}; do %selinux_relabel_post -s ${SELINUXVARIANT} done #endif with selinux %endif %files %license LICENSE LICENSE.dependencies %doc README.md %dir %{_sysconfdir}/localkdc %{_bindir}/lkdcctl %{_libexecdir}/localkdc/localkdc-pam-auth %{_libdir}/krb5/plugins/audit/audit_json.so %{_libdir}/krb5/plugins/kadm5_hook/kadm5_chpass.so %{_libdir}/krb5/plugins/kdb/kdb_userdb.so %dir %{_datadir}/localkdc %{_datadir}/localkdc/templates %{_tmpfilesdir}/localkdc.conf %{_unitdir}/localkdc.service %{_unitdir}/localkdc.socket %{_unitdir}/localkdc-pam-auth@.service %{_unitdir}/localkdc-pam-auth.socket %dir %{_var}/kerberos/localkdc %if %{with selinux} %files selinux -f selinux-files.txt %endif %changelog ## START: Generated by rpmautospec * Fri Aug 14 2026 Andreas Schneider - 0.2.0-1 - Update to version 0.2.0 * Thu Apr 16 2026 Andreas Schneider - 0.1.0-2 - Fix install location of localkdc-pam-auth * Wed Apr 15 2026 Andreas Schneider - 0.1.0-1 - Update to version 0.1.0 * Thu Nov 13 2025 Andreas Schneider - 0.0.1-36 - Improve error handling for our tools * Fri Jul 11 2025 Andreas Schneider - 0.0.1-35 - Use the right file_type for db files * Fri Jul 11 2025 Andreas Schneider - 0.0.1-34 - Get selinux working * Fri Jun 27 2025 Andreas Schneider - 0.0.1-33 - Fix selinux * Fri Jun 20 2025 Andreas Schneider - 0.0.1-32 - Fix an infinite loop * Fri May 16 2025 Andreas Schneider - 0.0.1-31 - Fix localkdc-setup * Fri May 16 2025 Andreas Schneider - 0.0.1-30 - Fix possible recursion in kdb with localhost * Fri May 16 2025 Andreas Schneider - 0.0.1-29 - Build with debuginfo package for kdb module * Fri May 16 2025 Andreas Schneider - 0.0.1-28 - Fix build because of missing errno.h * Fri May 16 2025 Andreas Schneider - 0.0.1-27 - Add support for IP and dynamic DNS aliases * Thu Apr 17 2025 Andreas Schneider - 0.0.1-26 - Use app-id derived from machine-id as localkdc realm - Added localkdc-kinit * Thu Apr 10 2025 Andreas Schneider - 0.0.1-25 - Fix issues with localkdc-useradd * Thu Apr 10 2025 Andreas Schneider - 0.0.1-24 - Fix localkdc-useradd - This goes to changelog * Tue Apr 08 2025 Andreas Schneider - 0.0.1-23 - Update for new localkdc realm option * Mon Apr 07 2025 Andreas Schneider - 0.0.1-22 - Require preauth * Mon Apr 07 2025 Andreas Schneider - 0.0.1-21 - Fix default realm * Wed Apr 02 2025 Andreas Schneider - 0.0.1-20 - Add userdb support * Wed Apr 02 2025 Andreas Schneider - 0.0.1-19 - gitignore * Wed Mar 12 2025 Andreas Schneider - 0.0.1-18 - foo * Fri Jan 24 2025 Andreas Schneider - 0.0.1-15 - New release * Mon Jan 20 2025 Andreas Schneider - 0.0.1-14 - Update for alias changes * Thu Dec 05 2024 Andreas Schneider - 0.0.1-13 - Updates for kdb api changes * Wed Dec 04 2024 Andreas Schneider - 0.0.1-12 - Fix tarball * Wed Dec 04 2024 Andreas Schneider - 0.0.1-11 - Don't use kdc_unixsock_listen anymore * Fri Nov 29 2024 Andreas Schneider - 0.0.1-10 - update tarball * Fri Nov 29 2024 Andreas Schneider - 0.0.1-9 - update tarball * Fri Nov 29 2024 Andreas Schneider - 0.0.1-6 - kdb driver * Fri Nov 29 2024 Andreas Schneider - 0.0.1-4 - selinux * Fri Nov 29 2024 Andreas Schneider - 0.0.1-1 - The big bang! ## END: Generated by rpmautospec