For reSIProcate 1.10.0, we will support PFS on TLS connections, this
requires a DH parameters file to be generated on each installation of
the package. There is probably a similar requirement for other packages
that have a TLS server and don't generate DH parameters at compile time.
My current solution involves adding the following to %post
if [ ! -e %{_sysconfdir}/repro/dh2048.pem ] ;
then
/usr/bin/openssl dhparam -outform PEM \
-out %{_sysconfdir}/repro/dh2048.pem 2048
chown root:repro %{_sysconfdir}/repro/dh2048.pem
chmod 0640 %{_sysconfdir}/repro/dh2048.pem
fi
and then adding this to %files
%config(missingok) %ghost %{_sysconfdir}/repro/dh2048.pem
The dh2048.pem file is created correctly during package installation but
it is not removed when the package is removed with "rpm -e"
Is there a better way to do this or does it look OK?
--
packaging mailing list
packaging@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/packaging
