On 09/17/2015 01:07 PM, Daniel Pocock wrote:
>
>
> For reSIProcate 1.10.0, we will support PFS on TLS connections, this
> requires a DH parameters file to be generated on each installation of
> the package. There is probably a similar requirement for other packages
> that have a TLS server and don't generate DH parameters at compile time.
>
> My current solution involves adding the following to %post
>
>
> if [ ! -e %{_sysconfdir}/repro/dh2048.pem ] ;
> then
> /usr/bin/openssl dhparam -outform PEM \
> -out %{_sysconfdir}/repro/dh2048.pem 2048
> chown root:repro %{_sysconfdir}/repro/dh2048.pem
> chmod 0640 %{_sysconfdir}/repro/dh2048.pem
> fi
>
>
> and then adding this to %files
>
>
> %config(missingok) %ghost %{_sysconfdir}/repro/dh2048.pem
>
>
> The dh2048.pem file is created correctly during package installation but
> it is not removed when the package is removed with "rpm -e"
You'll need to %ghost the file to have it removed.
> Is there a better way to do this or does it look OK?
Do look at the initital service setup stuff that Jason mentioned.
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion@xxxxxxxx
Boulder, CO 80301 http://www.nwra.com
--
packaging mailing list
packaging@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/packaging
