# Generated by rust2rpm 26 %bcond_without check %bcond_without vendor # prevent library files from being installed %global cargo_install_lib 0 # reduce debuginfo verbosity to work around OOM during linking stage %global rustflags_debuginfo 1 Name: vaultwarden Version: 1.37.1 Release: 1%{?dist} Summary: Unofficial Bitwarden compatible server ExcludeArch: ppc64le s390x # (Apache-2.0 OR MIT) AND BSD-3-Clause # (MIT OR Apache-2.0) AND Apache-2.0 # (MIT OR Apache-2.0) AND Unicode-3.0 # 0BSD # 0BSD OR MIT OR Apache-2.0 # AGPL-3.0-only # Apache-2.0 # Apache-2.0 AND ISC # Apache-2.0 OR BSL-1.0 # Apache-2.0 OR ISC OR MIT # Apache-2.0 OR MIT # Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT # BSD-2-Clause OR Apache-2.0 OR MIT # BSD-3-Clause # BSD-3-Clause AND MIT # MIT OR Apache-2.0 # MIT OR Apache-2.0 OR BSD-1-Clause # MIT OR Apache-2.0 OR LGPL-2.1-or-later # MIT OR Apache-2.0 OR Zlib # MIT OR Zlib OR Apache-2.0 # MPL-2.0 # Unicode-3.0 # Unlicense OR MIT # Zlib # Zlib OR Apache-2.0 OR MIT License: 0BSD AND AGPL-3.0-only AND Apache-2.0 AND BSD-3-Clause AND CDLA-Permissive-2.0 AND ISC AND MIT AND MPL-2.0 AND Unicode-3.0 AND Zlib AND (0BSD OR MIT OR Apache-2.0) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND (BSD-2-Clause OR Apache-2.0 OR MIT) AND (BSD-3-Clause OR MIT) AND (MIT OR Apache-2.0 OR BSD-1-Clause) AND (MIT OR Apache-2.0 OR LGPL-2.1-or-later) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT) # LICENSE.dependencies contains a full license breakdown URL: https://github.com/dani-garcia/vaultwarden Source: %{url}/archive/%{version}/%{name}-%{version}.tar.gz Source1: vaultwarden-%{version}-vendor.tar.xz Source2: vaultwarden.service Source3: vaultwarden.cfg Source4: vaultwarden.sysusers Source99: create-vendor-tarball.sh # EL 9.8/10.2 ship an older Rust toolchain (1.92.0) vs 1.93.0 desired %if 0%{?rhel} Patch0: lower-rust-version.patch %endif ExcludeArch: i686 BuildRequires: cargo-rpm-macros >= 26 BuildRequires: openssl-devel BuildRequires: mariadb-connector-c-devel BuildRequires: libpq-devel BuildRequires: systemd-rpm-macros Requires: %{name}-web %{?sysusers_requires_compat} %global _description %{expand: %{summary}.} %description %{_description} %prep %if %{with vendor} %autosetup -n %{name}-%{version} -p1 -a1 %cargo_prep -v vendor %else %autosetup -n %{name}-%{version} -p1 %cargo_prep %generate_buildrequires %cargo_generate_buildrequires %endif %build export VW_VERSION=%{version} %cargo_build -f sqlite,mysql,postgresql %{cargo_license_summary} %{cargo_license} > LICENSE.dependencies %{cargo_vendor_manifest} %if %{with vendor} # some vendored files have executable bit but bad shebangs find vendor/ -type f -executable -exec chmod -x {} + %endif %install export VW_VERSION=%{version} %cargo_install -f sqlite,mysql,postgresql # filesystem install -d %{buildroot}%{_sharedstatedir}/%{name} install -d %{buildroot}%{_localstatedir}/run/%{name} # user install -Dpm 0644 %{SOURCE4} %{buildroot}%{_sysusersdir}/vaultwarden.conf # configs install -Dpm 0640 %{SOURCE3} %{buildroot}%{_sysconfdir}/%{name}/%{name}.cfg # systemd install -Dp %{SOURCE2} %{buildroot}%{_unitdir}/%{name}.service %if %{with check} %check %cargo_test -f sqlite,mysql,postgresql %endif %pre %sysusers_create_compat %{SOURCE4} %post %systemd_post %{name}.service %preun %systemd_preun %{name}.service %postun %systemd_postun_with_restart %{name}.service %files %license LICENSE.txt %license LICENSE.dependencies %license cargo-vendor.txt %doc README.md %doc SECURITY.md %{_bindir}/vaultwarden %{_unitdir}/%{name}.service %config(noreplace) %attr(0640, root, vaultwarden) %{_sysconfdir}/%{name}/%{name}.cfg %dir %{_sysconfdir}/%{name}/ %{_sysusersdir}/vaultwarden.conf %dir %attr(0755, vaultwarden, vaultwarden) %ghost %{_localstatedir}/run/%{name} %dir %attr(0750, vaultwarden, vaultwarden) %{_sharedstatedir}/%{name} %changelog * Mon Aug 03 2026 Jonathan Wright - 1.37.1-1 - update to 1.37.1 rhbz#2510094 - Fix CVE-2026-31812 vaultwarden: quinn-proto: Denial of Service via crafted QUIC Initial packet rhbz#2446376 - Fix 8 cited but yet-to-be-listed medium-severity vulnerabilities * Fri Jul 17 2026 Fedora Release Engineering - 1.36.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Sat Jun 13 2026 Yaakov Selkowitz - 1.36.0-2 - Rebuilt for openssl 4.0 * Wed Jun 03 2026 Jonathan Wright - 1.36.0-1 - update to 1.36.0 rhbz#2368636 - Fix bitwarden mobile app not working rhbz#2437599 - Fix CVE-2025-58160 vaultwarden: Tracing log pollution - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion * Sat Jan 17 2026 Fedora Release Engineering - 1.34.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Tue Jul 29 2025 Jonathan Wright - 1.34.2-1 - update to 1.34.2 rhbz#2368636 * Fri Jul 25 2025 Fedora Release Engineering - 1.33.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Wed Apr 23 2025 Jonathan Wright - 1.33.2-2 - Build against mariadb-connector-c-devel instead of mariadb-devel * Mon Feb 10 2025 Jonathan Wright - 1.33.2-1 - update to 1.33.2 rhbz#2343535 Fix CVE-2025-0977 ssl::select_next_proto use after free rhbz#2344558 * Thu Jan 30 2025 Jonathan Wright - 1.33.0-1 - update to 1.33.0 rhbz#2342073 Fix GHSA-f7r5-w49x-gxm3 Getting access to the Admin Panel via CSRF Fix CVE-2025-24364 RCE in the admin panel Fix CVE-2025-24365 escalation of privilege via variable confusion in OrgHeaders trait * Tue Jan 21 2025 Jonathan Wright - 1.32.7-4 - Set VW_VERSION env var during build and install rhbz#2338534 * Sun Jan 19 2025 Fedora Release Engineering - 1.32.7-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Jan 15 2025 Jonathan Wright - 1.32.7-2 - fix build on el9 with rust 1.79 * Fri Jan 03 2025 Jonathan Wright - 1.32.7-1 - update to 1.32.7 rhbz#2322181 - Fix CVE-2024-56335 * Tue Oct 22 2024 Jonathan Wright - 1.32.2-1 - update to 1.32.2 rhbz#2316657 * Sun Aug 11 2024 Jonathan Wright - 1.32.0-1 - update to 1.32.0 rhbz#2304045 Resolves CVE-2024-39924 Resolves CVE-2024-39925 Resolves CVE-2024-39926 * Fri Aug 02 2024 Jonathan Wright - 1.31.0-2 - Exclude s390x and ppc64le * Fri Jul 19 2024 Jonathan Wright - 1.31.0-1 - update to 1.31.0 rhbz#2297149 * Tue May 21 2024 Jonathan Wright - 1.30.5-1 - Initial package build rhbz#2282807