File krb5.spec of Package krb5

#specfile originally created for Fedora, modified for Moblin Linux
%define WITH_LDAP 0
%define WITH_OPENSSL 1
%define WITH_DIRSRV 0

%define krb5prefix %{_prefix}/kerberos

# This'll be made unconditional at some point.
%define split_workstation 1

# This'll be pulled out at some point.
%define build_static 0

# For consistency with regular login.
%define login_pam_service remote

Summary: The Kerberos network authentication system
Name: krb5
Version: 1.7.1
Release: 3
# Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.7/krb5-1.7.1-signed.tar
Source0: krb5-%{version}.tar.gz
Source1: krb5-%{version}.tar.gz.asc
Source2: kpropd.init
Source4: kadmind.init
Source5: krb5kdc.init
Source6: krb5.conf
Source7: krb5.sh
Source8: krb5.csh
Source9: kdcrotate
Source10: kdc.conf
Source11: kadm5.acl
Source12: krsh
Source13: krlogin
Source14: eklogin.xinetd
Source15: klogin.xinetd
Source16: kshell.xinetd
Source17: krb5-telnet.xinetd
Source18: gssftp.xinetd
Source19: krb5kdc.sysconfig
Source20: kadmin.sysconfig
Source22: ekrb5-telnet.xinetd
# The same source files we "check", generated with "krb5-tex-pdf.sh create"
# and tarred up.
Source23: krb5-%{version}-pdf.tar.gz
Source24: krb5-tex-pdf.sh
Source25: krb5-trunk-manpaths.txt
Source26: gssftp.pamd
Source27: kshell.pamd
Source28: ekshell.pamd

Patch3: krb5-1.3-netkit-rsh.patch
Patch4: krb5-1.3-rlogind-environ.patch
Patch5: krb5-1.3-ksu-access.patch
Patch6: krb5-1.5-ksu-path.patch
Patch9: krb5-1.5-brokenrev.patch
Patch11: krb5-1.2.1-passive.patch
Patch12: krb5-1.7-ktany.patch
Patch13: krb5-1.3-large-file.patch
Patch14: krb5-1.3-ftp-glob.patch
Patch16: krb5-1.7-buildconf.patch
Patch18: krb5-1.2.7-reject-bad-transited.patch
Patch23: krb5-1.3.1-dns.patch
Patch29: krb5-1.7-kprop-mktemp.patch
Patch30: krb5-1.3.4-send-pr-tempfile.patch
Patch32: krb5-1.4-ncurses.patch
Patch33: krb5-1.7-io.patch
Patch36: krb5-1.7-rcp-markus.patch
Patch39: krb5-1.7-api.patch
Patch40: krb5-1.4.1-telnet-environ.patch
Patch41: krb5-1.2.7-login-lpass.patch
Patch47: krb5-1.6-sort-of-static.patch
Patch53: krb5-1.6-nodeplibs.patch
Patch56: krb5-1.7-doublelog.patch
Patch58: krb5-1.6.2-key_exp.patch
Patch59: krb5-trunk-kpasswd_tcp.patch
Patch60: krb5-1.7-pam.patch
Patch61: krb5-trunk-manpaths.patch
Patch71: krb5-1.7-dirsrv-accountlock.patch
Patch72: krb5-1.6.3-ftp_fdleak.patch
Patch73: krb5-1.6.3-ftp_glob_runique.patch
Patch78: krb5-1.6-selinux-trick.patch

#Security patches:
Patch101: krb5-1.7.1-CVE-2010-0283.patch
Patch102: krb5-1.7.1-CVE-2010-0628.patch
Patch103: krb5-1.7.1-CVE-2010-1320.patch
Patch104: krb5-1.7.1-CVE-2010-1321.patch
Patch105: krb5-1.7.1-CVE-2010-1323.patch
Patch106: krb5-1.7.1-CVE-2010-4022.patch
Patch107: krb5-1.7.1-CVE-2011-0281,0282.patch
Patch108: krb5-1.7.1-CVE-2011-0284.patch

#Compatible with openssl 1.0
Patch110: krb5-openssl-1.0.0.patch

License: MIT, freely distributable.
URL: http://web.mit.edu/kerberos/dist/krb5/1.6/
Group: System/Libraries
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Prereq: grep, info, sh-utils, /sbin/install-info
BuildRequires: autoconf, bison, e2fsprogs-devel >= 1.35, flex, gawk, libss-devel
BuildRequires: gzip, ncurses-devel,  texinfo, tar
#BuildRequires: tetex-latex, texinfo-tex , rsh
BuildRequires: keyutils-libs-devel
BuildRequires: pam-devel

%if %{WITH_LDAP}
BuildRequires: openldap-devel
%endif
%if %{WITH_OPENSSL}
BuildRequires: openssl-devel >= 0.9.8
%endif

%description
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords.

%package devel
Summary: Development files needed to compile Kerberos 5 programs
Group: Development/Libraries
Requires: %{name}-libs = %{version}-%{release}, e2fsprogs-devel, libss-devel
Requires: keyutils-libs-devel

%description devel
Kerberos is a network authentication system. The krb5-devel package
contains the header files and libraries needed for compiling Kerberos
5 programs. If you want to develop Kerberos-aware programs, you need
to install this package.

%package libs
Summary: The shared libraries used by Kerberos 5
Group: System/Libraries
Prereq: grep, /sbin/ldconfig, sh-utils
Obsoletes: krb5-configs

%description libs
Kerberos is a network authentication system. The krb5-libs package
contains the shared libraries needed by Kerberos 5. If you are using
Kerberos, you need to install this package.

%package server
Group: System/Daemons
Summary: The KDC and related programs for Kerberos 5
Requires: %{name}-libs = %{version}-%{release}
Prereq: grep, /sbin/install-info, /bin/sh, sh-utils, /sbin/chkconfig

%description server
Kerberos is a network authentication system. The krb5-server package
contains the programs that must be installed on a Kerberos 5 key
distribution center (KDC).  If you are installing a Kerberos 5 KDC,
you need to install this package (in other words, most people should
NOT install this package).

%package server-ldap
Group: System/Daemons
Summary: The LDAP storage plugin for the Kerberos 5 KDC
Requires: %{name}-server = %{version}-%{release}

%description server-ldap
Kerberos is a network authentication system. The krb5-server package
contains the programs that must be installed on a Kerberos 5 key
distribution center (KDC).  If you are installing a Kerberos 5 KDC,
and you wish to use a directory server to store the data for your
realm, you need to install this package.

%package workstation
Summary: Kerberos 5 programs for use on workstations
Group: System/Base
Requires: %{name}-libs = %{version}-%{release}
Prereq: grep, /sbin/install-info, /bin/sh, sh-utils
# mktemp is used by krb5-send-pr
Requires: mktemp

%description workstation
Kerberos is a network authentication system. The krb5-workstation
package contains the basic Kerberos programs (kinit, klist, kdestroy,
kpasswd). If your network uses Kerberos, this package should be
installed on every workstation.

%if %{split_workstation}
%package workstation-clients
Summary: Kerberos 5 clients for use on workstations
Group: System/Base
Requires: %{name}-workstation = %{version}-%{release}
Prereq: grep, /sbin/install-info, /bin/sh, sh-utils
# mktemp is used by krb5-send-pr
Requires: mktemp

%description workstation-clients
Kerberos is a network authentication system. The krb5-workstation-clients
package contains kerberized versions of Telnet, FTP, and rsh/rlogin
clients. If your network uses these services this package should be
installed on systems which expect to connect to servers which provide
these services.

%package workstation-servers
Summary: Kerberos 5 servers for use on workstations
Group: System/Base
Requires: %{name}-workstation = %{version}-%{release}
Prereq: grep, /sbin/install-info, /bin/sh, sh-utils
# mktemp is used by krb5-send-pr
Requires: mktemp, xinetd, /etc/pam.d/%{login_pam_service}

%description workstation-servers
Kerberos is a network authentication system. The krb5-workstation-servers
package contains kerberized versions of Telnet, FTP, and rsh/rlogin
servers. If your network uses Kerberos, this package should be
installed on systems which are meant provide these services.
%endif

%package pkinit-openssl
Summary: The PKINIT module for Kerberos 5
Group: System/Libraries
Requires: %{name}-libs = %{version}-%{release}

%description pkinit-openssl
Kerberos is a network authentication system. The krb5-pkinit-openssl
package contains the PKINIT plugin, which uses OpenSSL to allow clients
to obtain initial credentials from a KDC using a private key and a
certificate.

%prep
%setup -q -a 23
pushd src
%patch60 -p2 -b .pam
%patch61 -p0 -b .manpaths
popd
#%patch63 -p1 -b .selinux-label
%patch3  -p1 -b .netkit-rsh
%patch4  -p1 -b .rlogind-environ
%patch5  -p1 -b .ksu-access
%patch6  -p1 -b .ksu-path
%patch9  -p1 -b .brokenrev
%patch11 -p1 -b .passive
%patch12 -p1 -b .ktany
%patch13 -p1 -b .large-file
%patch14 -p1 -b .ftp-glob
%patch16 -p1 -b .buildconf
%patch18 -p1 -b .reject-bad-transited
%patch23 -p1 -b .dns
# Removes a malloc(0) case, nothing more.
# %patch26 -p1 -b .efence
%patch29 -p1 -b .kprop-mktemp
%patch30 -p1 -b .send-pr-tempfile
%patch32 -p1 -b .ncurses
%patch33 -p1 -b .io
%patch36 -p1 -b .rcp-markus
%patch39 -p1 -b .api
%patch40 -p1 -b .telnet-environ
%patch41 -p1 -b .login-lpass
%if %{build_static}
%patch47 -p1 -b .sort-of-static
%endif
%patch78 -p1
%patch53 -p1 -b .nodeplibs
#%patch55 -p1 -b .empty
%patch56 -p1 -b .doublelog
#%patch57 -p1 -b .login_chdir
%patch58 -p1 -b .key_exp
%patch59 -p0 -b .kpasswd_tcp
#%patch64 -p0 -b .ok-as-delegate
#%patch70 -p0 -b .kpasswd_tcp2
%patch71 -p1 -b .dirsrv-accountlock
%patch72 -p1 -b .ftp_fdleak
%patch73 -p1 -b .ftp_glob_runique

%patch101 -p1 -b .CVE-2010-0283
%patch102 -p0 -b .CVE-2010-0628
%patch103 -p1 -b .CVE-2010-1320
%patch104 -p1 -b .CVE-2010-1321
%patch105 -p1 -b .CVE-2010-1323
%patch106 -p1 -b .CVE-2010-4022
%patch107 -p1 -b .CVE-2011-0281,0282
%patch108 -p1 -b .CVE-2011-0284

%patch110 -p0 -b .openssl-1.0.0

gzip doc/*.ps

sed -i -e '1s!\[twoside\]!!;s!%$\\usepackage{hyperref}$!\1!' doc/api/library.tex
sed -i -e '1c\
\\documentclass{article}\
\\usepackage{fixunder}\
\\usepackage{functions}\
\\usepackage{fancyheadings}\
\\usepackage{hyperref}' doc/implement/implement.tex

# Rename the man pages so that they'll get generated correctly.
pushd src
cat $RPM_SOURCE_DIR/krb5-trunk-manpaths.txt | while read manpage ; do
	mv "$manpage" "$manpage".in
done
popd

# Check that the PDFs we built earlier match this source tree.
chmod +x %{SOURCE24}
$RPM_SOURCE_DIR/krb5-tex-pdf.sh check << EOF
doc/api       library krb5
doc/api       libdes
doc/implement implement
doc/kadm5     adb-unit-test
doc/kadm5     api-unit-test
doc/kadm5     api-funcspec
doc/kadm5     api-server-design
EOF

# Generate an FDS-compatible LDIF file.
inldif=src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
cat > 60kerberos.ldif << EOF
# This is a variation on kerberos.ldif which Fedora Directory Server will like.
dn: cn=schema
EOF
egrep -iv '(^$|^dn:|^changetype:|^add:)' $inldif >> 60kerberos.ldif
touch -r $inldif 60kerberos.ldif

# Rebuild the configure scripts.
cd src
top=`pwd`
for configurein in `find -name configure.in -type f` ; do
	pushd `dirname $configurein`
	grep -q A._CONFIG_HEADER configure.in && autoheader -I "$top"
	autoconf -I "$top"
	popd
done

%build
cd src
INCLUDES=-I%{_includedir}/et
# Get LFS support on systems that need it which aren't already 64-bit.
%ifarch %{ix86} s390 ppc sparc
DEFINES="-D_FILE_OFFSET_BITS=64" ; export DEFINES
%endif
# Enable or disable the PKINIT plugin.  The configure script only checks for
# the version of OpenSSL being okay, so for now we have to use that to control
# whether or not it tries to build the module.
%if %{WITH_OPENSSL}
k5_cv_openssl_version_okay=
%else
k5_cv_openssl_version_okay=no ; export k5_cv_openssl_version_okay
%endif
# Work out the CFLAGS and CPPFLAGS which we intend to use.
CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC`"
CPPFLAGS="`echo $DEFINES $INCLUDES`"
%configure \
	CFLAGS="$CFLAGS" \
	CPPFLAGS="$CPPFLAGS" \
	SS_LIB="-lss -lcurses" \
	--enable-shared \
%if %{build_static}
	--enable-static \
%endif
	--bindir=%{krb5prefix}/bin \
	--mandir=%{krb5prefix}/man \
	--sbindir=%{krb5prefix}/sbin \
	--datadir=%{krb5prefix}/share \
	--localstatedir=%{_var}/kerberos \
	--with-krb4 \
	--with-system-et \
	--with-system-ss \
	--with-netlib=-lresolv \
	--without-tcl \
	--enable-dns \
%if %{WITH_LDAP}
%if %{WITH_DIRSRV}
	--with-dirsrv \
%else
	--with-ldap \
%endif
%endif
	--with-pam \
	--with-pam-login-service=%{login_pam_service} \
	--without-selinux
# Now build it.
make

# Run the test suite.
: make check TMPDIR=%{_tmppath}

%install
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT

# Shell scripts wrappers for Kerberized rsh and rlogin.
mkdir -p $RPM_BUILD_ROOT%{krb5prefix}/bin
install -m 755 $RPM_SOURCE_DIR/{krsh,krlogin} $RPM_BUILD_ROOT/%{krb5prefix}/bin/

# Info docs.
mkdir -p $RPM_BUILD_ROOT%{_infodir}
install -m 644 doc/*.info* $RPM_BUILD_ROOT%{_infodir}/

# Unconditionally compress the info pages so that we know the right file name
# to pass to install-info in %%post.
gzip $RPM_BUILD_ROOT%{_infodir}/*.info*

# Sample KDC config files.
mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
install -pm 644 $RPM_SOURCE_DIR/kdc.conf  $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
install -pm 644 $RPM_SOURCE_DIR/kadm5.acl $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/

# Login-time scriptlets to fix the PATH variable.
mkdir -p $RPM_BUILD_ROOT/etc/profile.d
install -pm 644 $RPM_SOURCE_DIR/krb5.conf $RPM_BUILD_ROOT/etc/krb5.conf
for subpackage in devel workstation ; do
	install -pm 644 $RPM_SOURCE_DIR/krb5.sh \
	$RPM_BUILD_ROOT/etc/profile.d/krb5-$subpackage.sh
	install -pm 644 $RPM_SOURCE_DIR/krb5.csh \
	$RPM_BUILD_ROOT/etc/profile.d/krb5-$subpackage.csh
done

# Server init scripts and their configuration files.
mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
install -pm 755 $RPM_SOURCE_DIR/krb5kdc.init $RPM_BUILD_ROOT/etc/rc.d/init.d/krb5kdc
install -pm 755 $RPM_SOURCE_DIR/kadmind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/kadmin
install -pm 755 $RPM_SOURCE_DIR/kpropd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/kprop
mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
install -pm 644 $RPM_SOURCE_DIR/krb5kdc.sysconfig $RPM_BUILD_ROOT/etc/sysconfig/krb5kdc
install -pm 644 $RPM_SOURCE_DIR/kadmin.sysconfig $RPM_BUILD_ROOT/etc/sysconfig/kadmin

# Xinetd configuration files.
mkdir -p $RPM_BUILD_ROOT/etc/xinetd.d/
for xinetd in eklogin klogin kshell ekrb5-telnet krb5-telnet gssftp ; do
	install -pm 644 $RPM_SOURCE_DIR/${xinetd}.xinetd \
	$RPM_BUILD_ROOT/etc/xinetd.d/${xinetd}
done

# PAM configuration files.
mkdir -p $RPM_BUILD_ROOT/etc/pam.d/
for pam in kshell ekshell gssftp ; do
	install -pm 644 $RPM_SOURCE_DIR/$pam.pamd \
	$RPM_BUILD_ROOT/etc/pam.d/$pam
done

# Plug-in directories.
install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth
install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb

# The rest of the binaries, headers, libraries, and docs.
make -C src DESTDIR=$RPM_BUILD_ROOT install

# Munge the krb5-config script to remove rpaths.
sed "s|^CC_LINK=.*|CC_LINK='\$(CC) \$(PROG_LIBPATH)'|g" src/krb5-config > $RPM_BUILD_ROOT%{krb5prefix}/bin/krb5-config

# Munge krb5-config yet again.  This is totally wrong for 64-bit, but chunks
# of the buildconf patch already conspire to strip out /usr/<anything> from the
# list of link flags.
sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{krb5prefix}/bin/krb5-config

# Remove the randomly-generated compile-et filename comment from header files.
sed -i -e 's|^ \* ettmp[^ \t]*\.h:$| * ettmpXXXXXX.h:|g' $RPM_BUILD_ROOT%{_includedir}/*{,/*}.h

find doc -type f -exec chmod a-x {} \;
%clean
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT

%post libs -p /sbin/ldconfig

%postun libs -p /sbin/ldconfig

%post server
# Remove the init script for older servers.
[ -x /etc/rc.d/init.d/krb5server ] && /sbin/chkconfig --del krb5server
# Install the new ones.
/sbin/chkconfig --add krb5kdc
/sbin/chkconfig --add kadmin
/sbin/chkconfig --add kprop
# Install info pages.
/sbin/install-info %{_infodir}/krb425.info.gz %{_infodir}/dir
/sbin/install-info %{_infodir}/krb5-admin.info.gz %{_infodir}/dir
/sbin/install-info %{_infodir}/krb5-install.info.gz %{_infodir}/dir
exit 0

%preun server
if [ "$1" = "0" ] ; then
	/sbin/chkconfig --del krb5kdc
	/sbin/chkconfig --del kadmin
	/sbin/chkconfig --del kprop
	/sbin/service krb5kdc stop > /dev/null 2>&1 || :
	/sbin/service kadmin stop > /dev/null 2>&1 || :
	/sbin/service kprop stop > /dev/null 2>&1 || :
	/sbin/install-info --delete %{_infodir}/krb425.info.gz %{_infodir}/dir
	/sbin/install-info --delete %{_infodir}/krb5-admin.info.gz %{_infodir}/dir
	/sbin/install-info --delete %{_infodir}/krb5-install.info.gz %{_infodir}/dir
fi
exit 0

%postun server
if [ "$1" -ge 1 ] ; then
	/sbin/service krb5kdc condrestart > /dev/null 2>&1 || :
	/sbin/service kadmin condrestart > /dev/null 2>&1 || :
	/sbin/service kprop condrestart > /dev/null 2>&1 || :
fi
exit 0

%if %{split_workstation}
%post workstation-servers
/sbin/service xinetd reload > /dev/null 2>&1 || :
exit 0

%postun workstation-servers
/sbin/service xinetd reload > /dev/null 2>&1 || :
exit 0
%else
%postun workstation
/sbin/service xinetd reload > /dev/null 2>&1 || :
exit 0
%endif

%post workstation
/sbin/install-info %{_infodir}/krb5-user.info %{_infodir}/dir
exit 0

%preun workstation
if [ "$1" = "0" ] ; then
	/sbin/install-info --delete %{_infodir}/krb5-user.info %{_infodir}/dir
fi
exit 0

%files workstation
%defattr(-,root,root,-)
%docdir %{krb5prefix}/man
%config(noreplace) /etc/profile.d/krb5-workstation.sh
%config(noreplace) /etc/profile.d/krb5-workstation.csh
%doc doc/user*.ps.gz src/config-files/services.append
%doc doc/{kdestroy,kinit,klist,kpasswd,ksu}.html
%attr(0755,root,root) %doc src/config-files/convert-config-files
%doc %{_infodir}/krb5-user.info*

%dir %{krb5prefix}
%dir %{krb5prefix}/bin
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man1
%dir %{krb5prefix}/man/man8
%dir %{krb5prefix}/sbin

# Clients of the KDC, including tools you're likely to need if you're running
# app servers other than those built from this source package.
%{krb5prefix}/bin/kdestroy
%{krb5prefix}/man/man1/kdestroy.1*
%{krb5prefix}/bin/kinit
%{krb5prefix}/man/man1/kinit.1*
%{krb5prefix}/bin/klist
%{krb5prefix}/man/man1/klist.1*
%{krb5prefix}/bin/kpasswd
%{krb5prefix}/man/man1/kpasswd.1*

%{krb5prefix}/bin/kvno
%{krb5prefix}/man/man1/kvno.1*
%{krb5prefix}/bin/kadmin
%{krb5prefix}/man/man1/kadmin.1*
%{krb5prefix}/bin/k5srvutil
%{krb5prefix}/man/man1/k5srvutil.1*
%{krb5prefix}/bin/ktutil
%{krb5prefix}/man/man1/ktutil.1*

# Doesn't really fit anywhere else.
%attr(4755,root,root) %{krb5prefix}/bin/ksu
%{krb5prefix}/man/man1/ksu.1*

# Problem-reporting tool.
%{krb5prefix}/sbin/krb5-send-pr
%{krb5prefix}/man/man1/krb5-send-pr.1*

%if %{split_workstation}
%files workstation-clients
%defattr(-,root,root)
%docdir %{krb5prefix}/man
%doc doc/{ftp,rcp,rlogin,rsh,telnet}.html
%attr(0755,root,root) %doc src/config-files/convert-config-files
%doc %{_infodir}/krb5-user.info*

%dir %{krb5prefix}
%dir %{krb5prefix}/bin
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man1
%dir %{krb5prefix}/sbin
%endif

# Used by both clients and servers.
%{krb5prefix}/bin/rcp
%{krb5prefix}/man/man1/rcp.1*

# Client network bits.
%{krb5prefix}/bin/ftp
%{krb5prefix}/man/man1/ftp.1*
%{krb5prefix}/bin/krlogin
%{krb5prefix}/bin/rlogin
%{krb5prefix}/man/man1/rlogin.1*
%{krb5prefix}/bin/krsh
%{krb5prefix}/bin/rsh
%{krb5prefix}/man/man1/rsh.1*
%{krb5prefix}/bin/telnet
%{krb5prefix}/man/man1/telnet.1*

# Protocol test clients.
%{krb5prefix}/bin/sim_client
%{krb5prefix}/bin/gss-client
%{krb5prefix}/bin/uuclient

%if %{split_workstation}
%files workstation-servers
%defattr(-,root,root)
%docdir %{krb5prefix}/man

%dir %{krb5prefix}
%dir %{krb5prefix}/bin
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man1
%dir %{krb5prefix}/man/man8
%dir %{krb5prefix}/sbin

# Problem-reporting tool.
%{krb5prefix}/sbin/krb5-send-pr
%{krb5prefix}/man/man1/krb5-send-pr.1*

# Used by both clients and servers.
%{krb5prefix}/bin/rcp
%{krb5prefix}/man/man1/rcp.1*
%endif

%config(noreplace) /etc/xinetd.d/*
%config(noreplace) /etc/pam.d/*

# Login is used by telnetd and klogind.
%{krb5prefix}/sbin/login.krb5
%{krb5prefix}/man/man8/login.krb5.8*

%if %{split_workstation}
# Tools you're likely to need if you're running these app servers.
%{krb5prefix}/bin/kvno
%{krb5prefix}/man/man1/kvno.1*
%{krb5prefix}/bin/kadmin
%{krb5prefix}/man/man1/kadmin.1*
%{krb5prefix}/bin/k5srvutil
%{krb5prefix}/man/man1/k5srvutil.1*
%{krb5prefix}/bin/ktutil
%{krb5prefix}/man/man1/ktutil.1*

%endif

# Application servers.
%{krb5prefix}/sbin/ftpd
%{krb5prefix}/man/man8/ftpd.8*
%{krb5prefix}/sbin/klogind
%{krb5prefix}/man/man8/klogind.8*
%{krb5prefix}/sbin/kshd
%{krb5prefix}/man/man8/kshd.8*
%{krb5prefix}/sbin/telnetd
%{krb5prefix}/man/man8/telnetd.8*

# Protocol test servers.
%{krb5prefix}/sbin/sim_server
%{krb5prefix}/sbin/gss-server
%{krb5prefix}/sbin/uuserver

%files server
%defattr(-,root,root)
%docdir %{krb5prefix}/man

%config /etc/rc.d/init.d/krb5kdc
%config /etc/rc.d/init.d/kadmin
%config /etc/rc.d/init.d/kprop
%config(noreplace) /etc/sysconfig/krb5kdc
%config(noreplace) /etc/sysconfig/kadmin

%doc doc/admin*.ps.gz
%doc doc/install*.ps.gz

%doc %{_infodir}/krb5-admin.info*
%doc %{_infodir}/krb5-install.info*

%dir %{_var}/kerberos
%dir %{_var}/kerberos/krb5kdc
%config(noreplace) %{_var}/kerberos/krb5kdc/kdc.conf
%config(noreplace) %{_var}/kerberos/krb5kdc/kadm5.acl

%dir %{krb5prefix}
%dir %{krb5prefix}/bin
%dir %{_libdir}/krb5
%dir %{_libdir}/krb5/plugins
%dir %{_libdir}/krb5/plugins/kdb
%dir %{_libdir}/krb5/plugins/preauth
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man1
%dir %{krb5prefix}/man/man5
%dir %{krb5prefix}/man/man8
%dir %{krb5prefix}/sbin

# Problem-reporting tool.
%{krb5prefix}/sbin/krb5-send-pr
%{krb5prefix}/man/man1/krb5-send-pr.1*

# KDC binaries.
%{krb5prefix}/man/man5/kdc.conf.5*
%{krb5prefix}/sbin/kadmin.local
%{krb5prefix}/man/man8/kadmin.local.8*
%{krb5prefix}/sbin/kadmind
%{krb5prefix}/man/man8/kadmind.8*
%{krb5prefix}/sbin/kdb5_util
%{krb5prefix}/man/man8/kdb5_util.8*
%{krb5prefix}/sbin/kprop
%{krb5prefix}/man/man8/kprop.8*
%{krb5prefix}/sbin/kpropd
%{krb5prefix}/man/man8/kpropd.8*
%{krb5prefix}/sbin/kproplog
%{krb5prefix}/man/man8/kproplog.8*
%{krb5prefix}/sbin/krb5kdc
%{krb5prefix}/man/man8/krb5kdc.8*

# This is here for people who want to test their server, and also 
# included in devel package for similar reasons.
%{krb5prefix}/bin/sclient
%{krb5prefix}/man/man1/sclient.1*
%{krb5prefix}/sbin/sserver
%{krb5prefix}/man/man8/sserver.8*

%if %{WITH_LDAP}
%files server-ldap
%defattr(-,root,root)
%docdir %{krb5prefix}/man
%doc src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif
%doc src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema
%doc 60kerberos.ldif
%dir %{_libdir}/krb5
%dir %{_libdir}/krb5/plugins
%dir %{_libdir}/krb5/plugins/kdb
%dir %{krb5prefix}
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man8
%dir %{krb5prefix}/sbin
%{_libdir}/krb5/plugins/kdb/kldap.so
%{_libdir}/libkdb_ldap.so
%{_libdir}/libkdb_ldap.so.*
%{krb5prefix}/man/man8/kdb5_ldap_util.8.gz
%{krb5prefix}/sbin/kdb5_ldap_util
%endif

%files libs
%defattr(-,root,root)
%docdir %{krb5prefix}/man
%verify(not md5 size mtime) %config(noreplace) /etc/krb5.conf
%dir %{krb5prefix}
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man1
%dir %{krb5prefix}/man/man5
%{krb5prefix}/man/man1/tmac.doc*
%{krb5prefix}/man/man1/kerberos.1*
%{krb5prefix}/man/man5/.k5login.5*
%{krb5prefix}/man/man5/krb5.conf.5*
%{_libdir}/libgssapi_krb5.so.*
%{_libdir}/libgssrpc.so.*
%{_libdir}/libk5crypto.so.*
%{_libdir}/libkadm5clnt.so.*
%{_libdir}/libkadm5srv.so.*
%{_libdir}/libkdb5.so.*
%{_libdir}/libkrb5.so.*
%{_libdir}/libkrb5support.so.*
%dir %{_libdir}/krb5
%dir %{_libdir}/krb5/plugins
%dir %{_libdir}/krb5/plugins/*
%dir %{_libdir}/krb5/plugins/*
%{_libdir}/krb5/plugins/preauth/encrypted_challenge.so
%{_libdir}/krb5/plugins/kdb/db2.so
%{krb5prefix}/share

%if %{WITH_OPENSSL}
%files pkinit-openssl
%defattr(-,root,root)
%dir %{_libdir}/krb5
%dir %{_libdir}/krb5/plugins
%dir %{_libdir}/krb5/plugins/preauth
%{_libdir}/krb5/plugins/preauth/pkinit.so
%endif

%files devel
%defattr(-,root,root)

%config(noreplace) /etc/profile.d/krb5-devel.sh
%config(noreplace) /etc/profile.d/krb5-devel.csh

%docdir %{krb5prefix}/man
%doc doc/api/*.pdf
%doc doc/implement/*.pdf
%doc doc/kadm5/*.pdf
%doc doc/kadmin
%doc doc/krb5-protocol
%doc doc/rpc
%doc doc/threads.txt

%dir %{krb5prefix}
%dir %{krb5prefix}/bin
%dir %{krb5prefix}/man
%dir %{krb5prefix}/man/man1
%dir %{krb5prefix}/man/man8
%dir %{krb5prefix}/sbin

%{_includedir}/*
%{_libdir}/libgssapi_krb5.so
%{_libdir}/libgssrpc.so
%{_libdir}/libk5crypto.so
%{_libdir}/libkadm5clnt.so
%{_libdir}/libkadm5srv.so
%{_libdir}/libkdb5.so
%{_libdir}/libkrb5.so
%{_libdir}/libkrb5support.so

%if %{build_static}
%{_libdir}/*.a
%endif

%{krb5prefix}/bin/krb5-config
%{krb5prefix}/bin/sclient
%{krb5prefix}/man/man1/krb5-config.1*
%{krb5prefix}/man/man1/sclient.1*
%{krb5prefix}/man/man8/sserver.8*
%{krb5prefix}/sbin/sserver