%global _smp_mflags -j1

%global __provides_exclude_from %{_docdir}
%global __requires_exclude_from %{_docdir}

%global gitdate          20260830
%global commit           f2ce37f6125276938330a8412cb21c5239368f58
%global shortcommit      %(c=%{commit}; echo ${c:0:7})

# pigeonhole
%global pcommit          fbd81ef709a4afe4bec9e67d4fb85e1ed43dca2a
%global pshortcommit     %(c=%{pcommit}; echo ${c:0:7})

%global version          2.4.5
%global release          1

# set this to "1" if building a snapshot release
%global snapshot         1

%if %{snapshot}
%global buildversion     %(v=%{version}; echo ${v%^*})
%endif

%if %{snapshot}
%global pigeonholever    %{version}
%else
%global pigeonholever    %{version}%{?prever}
%endif

Summary: Secure imap and pop3 server
Name: dovecot
Epoch: 1
%global prever %{nil}
%if %{snapshot}
Version:        %{version}^%{gitdate}git%{shortcommit}
%else
Version:        %{version}
%endif
Release:        %{release}%{?dist}
# dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
License: MIT AND LGPL-2.1-only

URL: https://www.dovecot.org/
# https://github.com/dovecot/core/
%if %{snapshot}
Source: https://github.com/dovecot/core/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
%else
Source: https://www.dovecot.org/releases/2.4/%{name}-%{version}%{?prever}.tar.gz
%endif
Source1: dovecot.init
Source2: dovecot.pam
# https://github.com/dovecot/pigeonhole
%if %{snapshot}
Source8: https://github.com/dovecot/pigeonhole/archive/%{pcommit}/pigeonhole-%{pshortcommit}.tar.gz
%else
Source8: https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-%{pigeonholever}.tar.gz
%endif
Source9: dovecot.sysconfig
Source10: dovecot.tmpfilesd

# our own
Source14: dovecot.conf.5
Source15: prestartscript
Source16: dovecot.sysusers

# 3x Fedora/RHEL specific
Patch1: dovecot-2.0-defaultconfig.patch
Patch2: dovecot-1.0.beta2-mkcert-permissions.patch
Patch3: dovecot-1.0.rc7-mkcert-paths.patch

#wait for network
Patch6: dovecot-2.1.10-waitonline.patch

Patch8: dovecot-2.2.20-initbysystemd.patch
Patch9: dovecot-2.2.22-systemd_w_protectsystem.patch
Patch15: dovecot-2.3.11-bigkey.patch

# do not use own implementation of HMAC, use OpenSSL for certification purposes
# not sent upstream as proper fix would use dovecot's lib-dcrypt but it introduces
# hard to break circular dependency between lib and lib-dcrypt
Patch16: dovecot-2.4.1-opensslhmac3.patch

# FTBFS
Patch17: dovecot-2.3.15-fixvalcond.patch
Patch18: dovecot-2.3.15-valbasherr.patch
Patch19: dovecot-2.4.2-lua-5.5.patch

Patch23: 0001-2.4.5-fix-opensslhmac3.patch
Patch24: 0001-2.4.5-fix-building-with-Wincompatible-pointer-types.patch
# temporary workaround for s390x build test failure
# https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/FZBVU55TK5332SMZSSDNWIVJCWGUAJQS/
Patch25: dovecot-2.4.2-ftbfs-workaround.patch

BuildRequires: gcc, gcc-c++, openssl-devel, pam-devel, zlib-devel, bzip2-devel, libcap-devel
BuildRequires: libtool, autoconf, automake, pkgconfig
BuildRequires: python3
BuildRequires: sqlite-devel
BuildRequires: libpq-devel
BuildRequires: mariadb-connector-c-devel
BuildRequires: libxcrypt-devel
BuildRequires: openldap-devel
BuildRequires: krb5-devel
BuildRequires: quota-devel
BuildRequires: xz-devel
BuildRequires: lz4-devel
BuildRequires: libzstd-devel
%if %{?rhel}0 == 0
BuildRequires: libsodium-devel
BuildRequires: lua-devel
BuildRequires: lua-json
BuildRequires: libexttextcat-devel
%endif
BuildRequires: libicu-devel
%if %{?rhel}0 == 0
BuildRequires: libstemmer-devel
%endif
BuildRequires: bison
BuildRequires: rpcgen
BuildRequires: systemd-devel
BuildRequires: systemd-rpm-macros
BuildRequires: wget
BuildRequires: xapian-core-devel

%if %{snapshot}
BuildRequires: git-core
BuildRequires: vim-minimal
%endif

# gettext-devel is needed for running autoconf because of the
# presence of AM_ICONV
BuildRequires: gettext-devel

# explicit Runtime Requirements for executalbe
Requires: openssl >= 0.9.7f-4

# package includes an initscript service file, needs to require initscripts package
Requires(pre): shadow-utils
Requires: systemd
Requires(post): systemd-units
Requires(preun): systemd-units
Requires(postun): systemd-units

%{?systemd_requires}
%{?sysusers_requires_compat}

%global ssldir %{_sysconfdir}/pki/%{name}

BuildRequires: libcurl-devel expat-devel
BuildRequires: make

%global restart_flag /run/%{name}/%{name}-restart-after-rpm-install

%description
Dovecot is an IMAP server for Linux/UNIX-like systems, written with security 
primarily in mind.  It also contains a small POP3 server.  It supports mail 
in either of maildir or mbox formats.

The SQL drivers and authentication plug-ins are in their subpackages.

%package pigeonhole
Requires: %{name} = %{epoch}:%{version}-%{release}
Summary: Sieve and managesieve plug-in for dovecot
License: MIT AND LGPL-2.1-only

%description pigeonhole
This package provides sieve and managesieve plug-in for dovecot LDA.

%package pgsql
Requires: %{name} = %{epoch}:%{version}-%{release}
Summary: Postgres SQL back end for dovecot
%description pgsql
This package provides the Postgres SQL back end for dovecot-auth etc.

%package mysql
Requires: %{name} = %{epoch}:%{version}-%{release}
Summary: MySQL back end for dovecot
%description mysql
This package provides the MySQL back end for dovecot-auth etc.

%package devel
Requires: %{name} = %{epoch}:%{version}-%{release}
Summary: Development files for dovecot
%description devel
This package provides the development files for dovecot.

%prep
%if %{snapshot}
%setup -q -n core-%{commit} -a 8
echo %{buildversion} > version.txt
%else
%setup -q -n %{name}-%{version}%{?prever} -a 8
%endif

# standardize name, so we don't have to update patches and scripts
%if %{snapshot}
mv pigeonhole-%{pcommit} dovecot-pigeonhole
%else
mv dovecot-pigeonhole-%{pigeonholever} dovecot-pigeonhole
%endif

%patch -P 1 -p2 -b .default-settings
%patch -P 2 -p1 -b .mkcert-permissions
%patch -P 3 -p1 -b .mkcert-paths
%patch -P 6 -p2 -b .waitonline
%patch -P 8 -p2 -b .initbysystemd
%patch -P 9 -p1 -b .systemd_w_protectsystem
%patch -P 15 -p1 -b .bigkey
%patch -P 16 -p1 -b .opensslhmac3
%patch -P 17 -p2 -b .fixvalcond
%patch -P 18 -p1 -b .valbasherr
%patch -P 19 -p1 -b .lua55
%patch -P 23 -p1 -b .opensslhmac3
%patch -P 24 -p1 -b .fixbuild
%patch -P 25 -p1 -b .ftbfs-workaround
cp run-test-valgrind.supp dovecot-pigeonhole/
# valgrind would fail with shell wrapper
echo "testsuite" >dovecot-pigeonhole/run-test-valgrind.exclude


%build
# required for fdpass.c line 125,190: dereferencing type-punned pointer will break strict-aliasing rules
%global _hardened_build 1
#export CFLAGS="%%{__global_cflags} -fno-strict-aliasing -fstack-reuse=none"
#export LDFLAGS="-Wl,-z,now -Wl,-z,relro %%{?__global_ldflags}"

autoreconf -vfi

# configure: WARNING: unrecognized options:
# --with-nss, --with-shadow, --with-zlib, --with-libstemmer,
# --without-lucene, --without-exttextcat, --with-ssl, --with-docs

%configure                       \
    INSTALL_DATA="install -c -p -m644" \
    --with-rundir=%{_rundir}/%{name}   \
    --with-systemd               \
    --docdir=%{_docdir}/%{name}  \
    --disable-static             \
    --disable-rpath              \
    --enable-experimental-mail-utf8 \
    --enable-experimental-imap4rev2 \
    --enable-lto                 \
    --enable-year2038            \
    --with-pam                   \
    --with-gssapi=plugin         \
    --with-ldap=plugin           \
    --with-sql=plugin            \
    --with-pgsql                 \
    --with-mysql                 \
    --with-sqlite                \
    --with-icu                   \
    --with-sodium                \
    --with-zstd                  \
    --with-libcap                \
%if %{?rhel}0 == 0
    --with-solr                  \
    --with-flatcurve             \
    --with-stemmer               \
    --with-textcat               \
    --with-lua=plugin            \
%else
    --without-solr               \
    --without-flatcurve          \
    --without-stemmer            \
    --without-textcat            \
    --without-lua                \
%endif
    --with-systemd               \
    --with-ssldir=%{ssldir}      \
    systemdsystemunitdir=%{_unitdir}

sed -i 's|/etc/ssl|/etc/pki/dovecot|' doc/mkcert.sh # doc/example-config/conf.d/10-ssl.conf

%make_build

# pigeonhole
pushd dovecot-pigeonhole

%if %{snapshot}
# required for snapshot
echo %{buildversion} > version.txt
[ -f configure ] || autoreconf -fiv
%endif

[ -f ChangeLog ] || echo "Pigeonhole ChangeLog is not available, yet" >ChangeLog

%configure                             \
    INSTALL_DATA="install -c -p -m644" \
    --disable-static                   \
    --with-dovecot=../                 \
    --with-ldap=plugin                 \
    --without-unfinished-features

%make_build
popd

%install
%make_install

# move doc dir back to build dir so doc macro in files section can use it
%if %{snapshot}
mv $RPM_BUILD_ROOT/%{_docdir}/%{name} %{_builddir}/core-%{commit}/docinstall
%else
mv $RPM_BUILD_ROOT/%{_docdir}/%{name} %{_builddir}/%{name}-%{version}%{?prever}/docinstall
%endif

pushd dovecot-pigeonhole
%make_install

mv $RPM_BUILD_ROOT/%{_docdir}/%{name} $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole

install -m 644 AUTHORS ChangeLog COPYING COPYING.LGPL INSTALL NEWS README $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole
popd

install -p -D -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/dovecot

# install man pages
install -p -D -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{_mandir}/man5/dovecot.conf.5

# install waitonline script
install -p -D -m 755 %{SOURCE15} $RPM_BUILD_ROOT%{_libexecdir}/dovecot/prestartscript

install -p -D -m 0644 %{SOURCE16} $RPM_BUILD_ROOT%{_sysusersdir}/dovecot.conf

# generate ghost .pem files
mkdir -p $RPM_BUILD_ROOT%{ssldir}/certs
mkdir -p $RPM_BUILD_ROOT%{ssldir}/private
touch $RPM_BUILD_ROOT%{ssldir}/certs/dovecot.pem
chmod 600 $RPM_BUILD_ROOT%{ssldir}/certs/dovecot.pem
touch $RPM_BUILD_ROOT%{ssldir}/private/dovecot.pem
chmod 600 $RPM_BUILD_ROOT%{ssldir}/private/dovecot.pem

install -p -D -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_tmpfilesdir}/dovecot.conf

mkdir -p $RPM_BUILD_ROOT/run/dovecot/{login,empty,token-login}

# install dovecot configuration and dovecot-openssl.cnf
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d
install -p -m 644 $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole/example-config/conf.d/*.conf $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d
install -p -m 644 $RPM_BUILD_ROOT/%{_docdir}/%{name}-pigeonhole/example-config/conf.d/*.conf.ext $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/conf.d ||:
install -p -m 644 doc/dovecot-openssl.cnf $RPM_BUILD_ROOT%{ssldir}/dovecot-openssl.cnf

install -p -m755 doc/mkcert.sh $RPM_BUILD_ROOT%{_libexecdir}/%{name}/mkcert.sh

mkdir -p $RPM_BUILD_ROOT/var/lib/dovecot

# remove the libtool archives
find $RPM_BUILD_ROOT%{_libdir}/%{name}/ -name '*.la' | xargs rm -f

# remove what we don't want
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/dovecot/README
pushd docinstall
rm -f securecoding.txt thread-refs.txt
popd


%pre
#%%if 0%%{?fedora} < 42
#dovecot uid and gid are reserved, see /usr/share/doc/setup-*/uidgid 
%sysusers_create_compat %{SOURCE16}
#%%endif

# do not let dovecot run during upgrade rhbz#134325
if [ "$1" = "2" ]; then
  rm -f %restart_flag
  /bin/systemctl is-active %{name}.service >/dev/null 2>&1 && touch %restart_flag ||:
  /bin/systemctl stop %{name}.service >/dev/null 2>&1
fi

%post
if [ $1 -eq 1 ]
then
  %systemd_post dovecot.service
fi

install -d -m 0755 -g dovecot -d /run/dovecot
install -d -m 0755 -d /run/dovecot/empty
install -d -m 0750 -g dovenull -d /run/dovecot/login
install -d -m 0750 -g dovenull -d /run/dovecot/token-login
[ -x /sbin/restorecon ] && /sbin/restorecon -R /run/dovecot ||:

%preun
if [ $1 = 0 ]; then
        /bin/systemctl disable dovecot.service dovecot.socket >/dev/null 2>&1 || :
        /bin/systemctl stop dovecot.service dovecot.socket >/dev/null 2>&1 || :
    rm -rf /run/dovecot
fi

%postun
/bin/systemctl daemon-reload >/dev/null 2>&1 || :

if [ "$1" -ge "1" -a -e %restart_flag ]; then
    /bin/systemctl start dovecot.service >/dev/null 2>&1 || :
rm -f %restart_flag
fi

%posttrans
# dovecot should be started again in %%postun, but it's not executed on reinstall
# if it was already started, restart_flag won't be here, so it's ok to test it again
if [ -e %restart_flag ]; then
    /bin/systemctl start dovecot.service >/dev/null 2>&1 || :
rm -f %restart_flag
fi

%check
if ! make check
then
  find . -name test-suite.log | xargs cat ||:
  exit 1
fi
cd dovecot-pigeonhole
# FIXME: make check will fail as it requires doveconf to be already installed at /usr/bin/doveconf
make check ||:

%files
%doc docinstall/* AUTHORS ChangeLog COPYING COPYING.LGPL COPYING.MIT INSTALL.md NEWS README.md SECURITY.md
%{_sbindir}/dovecot

%{_bindir}/doveadm
%{_bindir}/doveconf
%{_bindir}/dovecot-sysreport

%_tmpfilesdir/dovecot.conf
%{_sysusersdir}/dovecot.conf
%{_unitdir}/dovecot.service
%{_unitdir}/dovecot-init.service
%{_unitdir}/dovecot.socket

%dir %{_sysconfdir}/dovecot
%dir %{_sysconfdir}/dovecot/conf.d
%config(noreplace) %{_sysconfdir}/dovecot/dovecot.conf
%config(noreplace) %{_sysconfdir}/pam.d/dovecot
%config(noreplace) %{ssldir}/dovecot-openssl.cnf

%dir %{ssldir}
%dir %{ssldir}/certs
%dir %{ssldir}/private
%attr(0600,root,root) %ghost %config(missingok,noreplace) %verify(not md5 size mtime) %{ssldir}/certs/dovecot.pem
%attr(0600,root,root) %ghost %config(missingok,noreplace) %verify(not md5 size mtime) %{ssldir}/private/dovecot.pem

%dir %{_libdir}/dovecot
%dir %{_libdir}/dovecot/auth
%dir %{_libdir}/dovecot/dict
%{_libdir}/dovecot/doveadm
%exclude %{_libdir}/dovecot/doveadm/*sieve*
%{_libdir}/dovecot/*.so.*
# these (*.so files) are plugins, not devel files
%{_libdir}/dovecot/*_plugin.so
%exclude %{_libdir}/dovecot/*_sieve_plugin.so
%{_libdir}/dovecot/auth/libauthdb_imap.so
%{_libdir}/dovecot/auth/libauthdb_ldap.so
%if %{?rhel}0 == 0
%{_libdir}/dovecot/auth/libauthdb_lua.so
%endif
%{_libdir}/dovecot/auth/libmech_gssapi.so
%{_libdir}/dovecot/auth/libmech_gss_spnego.so
%{_libdir}/dovecot/auth/libdriver_sqlite.so
%{_libdir}/dovecot/dict/libdriver_sqlite.so
%{_libdir}/dovecot/dict/libdict_ldap.so
%{_libdir}/dovecot/libdriver_sqlite.so
%{_libdir}/dovecot/libssl_iostream_openssl.so
%{_libdir}/dovecot/libfs_compress.so
%{_libdir}/dovecot/libfs_crypt.so
%{_libdir}/dovecot/libdcrypt_openssl.so
%{_libdir}/dovecot//var_expand_crypt.so

%dir %{_libdir}/dovecot/settings

%{_libexecdir}/%{name}
%exclude %{_libexecdir}/%{name}/managesieve*

%dir %attr(0755,root,dovecot) %ghost /run/dovecot
%attr(0750,root,dovenull) %ghost /run/dovecot/login
%attr(0750,root,dovenull) %ghost /run/dovecot/token-login
%attr(0755,root,root) %ghost /run/dovecot/empty

%attr(0750,dovecot,dovecot) /var/lib/dovecot

%{_datadir}/%{name}

%{_mandir}/man1/deliver.1*
%{_mandir}/man1/doveadm*.1*
%{_mandir}/man1/doveconf.1*
%{_mandir}/man1/dovecot*.1*
%{_mandir}/man5/dovecot.conf.5*
%{_mandir}/man7/doveadm-search-query.7*

%files devel
%{_includedir}/dovecot
%{_datadir}/aclocal/dovecot*.m4
%{_libdir}/dovecot/libdovecot*.so
%{_libdir}/dovecot/dovecot-config

%files pigeonhole
%{_bindir}/sieve-dump
%{_bindir}/sieve-filter
%{_bindir}/sieve-test
%{_bindir}/sievec
%config(noreplace) %{_sysconfdir}/dovecot/conf.d/20-managesieve.conf
%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-sieve.conf
%config(noreplace) %{_sysconfdir}/dovecot/conf.d/90-sieve-extprograms.conf

%{_docdir}/%{name}-pigeonhole

%{_libexecdir}/%{name}/managesieve
%{_libexecdir}/%{name}/managesieve-login

%{_libdir}/dovecot/doveadm/*sieve*
%{_libdir}/dovecot/*_sieve_plugin.so
%{_libdir}/dovecot/settings/libmanagesieve_*.so
%{_libdir}/dovecot/settings/libpigeonhole_*.so
%{_libdir}/dovecot/sieve/

%{_mandir}/man1/sieve-dump.1*
%{_mandir}/man1/sieve-filter.1*
%{_mandir}/man1/sieve-test.1*
%{_mandir}/man1/sievec.1*
%{_mandir}/man1/sieved.1*
%{_mandir}/man7/pigeonhole.7*

%files mysql
%{_libdir}/%{name}/libdriver_mysql.so
%{_libdir}/%{name}/auth/libdriver_mysql.so
%{_libdir}/%{name}/dict/libdriver_mysql.so

%files pgsql
%{_libdir}/%{name}/libdriver_pgsql.so
%{_libdir}/%{name}/auth/libdriver_pgsql.so
%{_libdir}/%{name}/dict/libdriver_pgsql.so

%changelog
* Sat Aug 01 2026 Patrick <patrickl@noreply.codeberg.org>
- initial release