From 0fcd2aac1b89640f9a93ecf39aad26f846b308c5 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Wed, 15 Nov 2017 16:40:46 -0500
Subject: [PATCH 01/12] RPM: install man page for remctl-shell

---
 remctl.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/remctl.spec b/remctl.spec
index 1ea40118..53ee4cc0 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -347,6 +347,7 @@ EOF
 %{_sbindir}/*
 %doc CHANGELOG.md README TODO
 %doc %{_mandir}/*/remctld.*
+%doc %{_mandir}/*/remctl-shell.*
 %if !0%{?with_systemd:1}
 %config /etc/xinetd.d/remctl
 %endif

From 9ea2a4e8d564815a20ffb213cfb7fdfad7001fb4 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Thu, 16 Nov 2017 14:30:38 -0500
Subject: [PATCH 02/12] RPM: enable tests

Actually run the tests during rpmbuild's check phase. Kerberos tests are
enabled by providing the test principal name and keytab filename on the
rpmbuild command line. Note that this introduces new build dependencies
on rubygem-minitest (if building Ruby bindings) and fakeroot.
---
 remctl.spec | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/remctl.spec b/remctl.spec
index 53ee4cc0..6b1f09fc 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -54,7 +54,7 @@ Group: System Environment/Daemons
 Vendor: Stanford University
 Packager: Russ Allbery <eagle@eyrie.org>
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
-BuildRequires: krb5-devel, libgcrypt, libevent-devel
+BuildRequires: krb5-devel, libgcrypt, libevent-devel, fakeroot
 %if %{buildperl}
 BuildRequires: perl(Module::Build)
 %endif
@@ -65,7 +65,7 @@ BuildRequires: python-devel, python
 BuildRequires: php-devel
 %endif
 %if %{buildruby}
-BuildRequires: ruby, ruby-devel
+BuildRequires: ruby, ruby-devel, rubygem-minitest
 %endif
 %if 0%{?sles_version:1}
 %if 0%{?with_systemd:1}
@@ -326,6 +326,15 @@ TCP="remctl"
 EOF
 %endif
 
+%check
+# Use rpmbuild option "--define 'test_princ'" to set the principal name
+# Use rpmbuild option "--define 'test_keytab'" to specify the keytab location
+%if 0%{?test_princ:%{?test_keytab:1}}
+ln -s $(realpath '%{test_keytab}') tests/config/keytab
+echo '%{test_princ}'  > tests/config/principal
+%endif
+make check
+
 %files devel
 %defattr(-, root, root)
 /usr/include/remctl.h

From faf89363decac1ee1120627744dbd618c603c2fa Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Fri, 10 Jan 2020 16:20:46 -0500
Subject: [PATCH 03/12] RPM: update release detection for RHEL8

---
 remctl.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/remctl.spec b/remctl.spec
index 6b1f09fc..31b95416 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -14,7 +14,7 @@
 %define with_systemd 1
 %endif
 %else
-%define rel %(cat /etc/redhat-release | cut -d ' ' -f 7 | cut -d'.' -f1)
+%define rel %(perl -ne 'print $1 if /^Red.*Hat\\s+Enterprise\\s+Linux\\s+(?:(?:Server|Client|Workstation|Everything)\\s+)?release\\s+(\\d+)/i' /etc/redhat-release)
 %define relsuffix EL%{rel}
 %if %{rel} >= 7
 %define with_systemd 1

From f94cc916df62d045c8b7dd4c736121daea9d2d3b Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Thu, 16 Jan 2020 11:07:47 -0500
Subject: [PATCH 04/12] RPM: allow specifying a krb5.conf for testing

Also, fix a bug in generate-krb5-conf that prevented using a custom
krb5.conf from actually working.
---
 remctl.spec | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/remctl.spec b/remctl.spec
index 31b95416..15c8e060 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -329,10 +329,14 @@ EOF
 %check
 # Use rpmbuild option "--define 'test_princ'" to set the principal name
 # Use rpmbuild option "--define 'test_keytab'" to specify the keytab location
+# Use rpmbuild option "--define 'test_krb5_conf'" to specify a krb5.conf to use
 %if 0%{?test_princ:%{?test_keytab:1}}
 ln -s $(realpath '%{test_keytab}') tests/config/keytab
 echo '%{test_princ}'  > tests/config/principal
 %endif
+%if 0%{?test_krb5_conf:1}
+ln -s $(realpath '%{test_krb5_conf}') tests/config/krb5.conf
+%endif
 make check
 
 %files devel

From 1052e064c9181621da26ac19e69295c825497693 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Mon, 24 May 2021 11:42:27 -0400
Subject: [PATCH 05/12] RPM: set KRB5RCACHEDIR for tests

MIT Kerberos 1.18 (found in RHEL 8.3) now uses a default replay cache
location based on the calling user's effective uid. Since RPM tests are
run under fakeroot, it ends up using /var/tmp/krb5_0.rcache2, which it
cannot actually access.

Avoid this by setting KRB5RCACHEDIR to the test suite's temporary
directory, where the krb5_0.rcache2 filename can be used without issues.
---
 remctl.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/remctl.spec b/remctl.spec
index 15c8e060..b909aa83 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -337,6 +337,7 @@ echo '%{test_princ}'  > tests/config/principal
 %if 0%{?test_krb5_conf:1}
 ln -s $(realpath '%{test_krb5_conf}') tests/config/krb5.conf
 %endif
+export KRB5RCACHEDIR=$(realpath tests/tmp)
 make check
 
 %files devel

From 658f111521d51d91f1fb0ad54058d095680818f3 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Mon, 24 May 2021 22:39:25 -0400
Subject: [PATCH 06/12] python: handle -Wl,* in REMCTL_PYTHON_LIBS

When REMCTL_PYTHON_LIBS includes arguments of the form -Wl,* make sure
they make their way into extra_link_args, so the module will actually
get linked correctly. This is needed when some of the libraries used are
in non-default locations and require a DT_RUNPATH tag.
---
 python/setup.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/python/setup.py b/python/setup.py
index dffc02b7..e1e174fd 100644
--- a/python/setup.py
+++ b/python/setup.py
@@ -91,8 +91,10 @@ def parse_flags(prefix, flags):
 # should be used in the link.  Extract those flags and pass them into the
 # extension configuration.  When built stand-alone, use the defaults and
 # assume we don't need special contortions to link with libremctl.
-library_dirs = parse_flags("-L", os.environ.get("REMCTL_PYTHON_LIBS", ""))
-libraries = parse_flags("-l", os.environ.get("REMCTL_PYTHON_LIBS", ""))
+flags = os.environ.get("REMCTL_PYTHON_LIBS", "")
+library_dirs = parse_flags("-L", flags)
+libraries = parse_flags("-l", flags)
+extra_link_args = [opt for opt in flags.split() if opt.startswith("-Wl,")]
 
 extension = Extension(
     "_remctl",
@@ -100,6 +102,7 @@ def parse_flags(prefix, flags):
     define_macros=[("VERSION", '"' + VERSION + '"')],
     libraries=["remctl"] + libraries,
     library_dirs=library_dirs,
+    extra_link_args=extra_link_args,
 )
 
 kwargs = {

From 3fb6f8e5f6342d7090cbcae99ecc026eca8ed12d Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Wed, 2 Jun 2021 13:36:58 -0400
Subject: [PATCH 07/12] RPM: systemd support needs systemd-devel

---
 remctl.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/remctl.spec b/remctl.spec
index b909aa83..e01febe6 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -74,7 +74,7 @@ BuildRequires: systemd-rpm-macros
 Distribution: SUSE Linux Enterprise %{sles_version}
 %else
 %if 0%{?with_systemd:1}
-BuildRequires: systemd-units
+BuildRequires: systemd-units, systemd-devel
 %endif
 Distribution: EL
 %endif

From 7adce5e82a598469308f13081d4e200d37a9ccdc Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Sun, 9 Aug 2026 09:02:47 -0400
Subject: [PATCH 08/12] RPM: remove support for RHEL6 and older

RHEL5/RHEL6 are well past end-of-life; there is little point in
continuing to maintain special cases for them in the spec file.
---
 remctl.spec | 46 ----------------------------------------------
 1 file changed, 46 deletions(-)

diff --git a/remctl.spec b/remctl.spec
index e01febe6..200b57c0 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -43,11 +43,7 @@ Name: remctl
 Summary: Client/server for Kerberos-authenticated command execution
 Version: %{vers}
 Release: 1.%{relsuffix}
-%if 0%{?rel} >= 4 || 0%{?sles_version:1}
 License: MIT
-%else
-Copyright: MIT
-%endif
 URL: https://www.eyrie.org/~eagle/software/remctl/
 Source: https://archives.eyrie.org/software/kerberos/%{name}-%{version}.tar.gz
 Group: System Environment/Daemons
@@ -83,36 +79,6 @@ Distribution: EL
 BuildArch: i686
 %endif
 
-%if %{buildphp}
-# RHEL 5/6 compatibility for PHP
-%if 0%{?rel} == 5
-%global php_apiver %((echo 0; php -i 2>/dev/null | sed -n 's/^PHP API => //p') | tail -1)
-%{!?php_extdir: %{expand: %%global php_extdir %(php-config --extension-dir)}}
-%endif
-%if 0%{?rel} == 5 || 0%{?rel} == 6
-%{!?php_inidir: %{expand: %%global php_inidir %{_sysconfdir}/php.d }}
-%endif
-%endif
-
-%if %{buildpython}
-# RHEL 5 compatibility for Python
-%if 0%{?rel} == 5
-%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")}
-%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
-%endif
-%endif
-
-%if %{buildruby}
-# RHEL 5/6 compatibility for Ruby
-%if 0%{?rel} == 5
-%{!?ruby_vendorarchdir: %global ruby_vendorarchdir %(ruby -rrbconfig -e 'puts Config::CONFIG["sitearchdir"] ')}
-%endif
-%if 0%{?rel} == 6
-%{!?ruby_vendorarchdir: %global ruby_vendorarchdir %(ruby -rrbconfig -e 'puts Config::CONFIG["vendorarchdir"] ')}
-%endif
-%endif
-
-
 %description
 remctl is a client/server protocol for executing specific commands on a
 remote system with Kerberos authentication.  The allowable commands must
@@ -170,12 +136,8 @@ This package contains the client program (remctl) and the client libraries.
 Summary: PHP interface to remctl
 Group: Development/Libraries
 Requires: %{name}-client = %{version}-%{release}
-%if 0%{?rel} == 5
-Requires:     php-api = %{php_apiver}
-%else
 Requires:     php(zend-abi) = %{php_zend_api}
 Requires:     php(api) = %{php_core_api}
-%endif
 
 %description php
 remctl is a client/server protocol for executing specific commands on a
@@ -210,11 +172,7 @@ This package contains the Python remctl client library.
 Summary: Ruby interface to remctl
 Group: Development/Libraries
 Requires: %{name}-client = %{version}-%{release}
-%if 0%{?rel} <= 6
-Requires: ruby(abi) = 1.8
-%else
 Requires: ruby(abi) = 1.9.1
-%endif
 Provides: ruby(remctl) = %{version}-%{release}
 
 %description ruby
@@ -268,10 +226,8 @@ options="$options --enable-python"
 %if %{buildperl}
 export PATH="/usr/kerberos/bin:/sbin:/bin:/usr/sbin:$PATH"
 export REMCTL_PERL_FLAGS="--installdirs=vendor"
-%if 0%{?rel} >= 6
 export REMCTL_PERL_FLAGS="$REMCTL_PERL_FLAGS --prefix=/usr"
 %endif
-%endif
 %configure $options
 %{__make}
 
@@ -381,9 +337,7 @@ make check
 %defattr(-, root, root)
 %{python_sitearch}/_remctl.so
 %{python_sitearch}/remctl.py*
-%if 0%{?rel} != 5
 %{python_sitearch}/pyremctl-%{version}-*.egg-info
-%endif
 %doc CHANGELOG.md TODO
 %doc python/README
 %endif

From d743c35463ca7314ba3dd299900da38159e1c3fc Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Sat, 8 Aug 2026 17:17:14 -0400
Subject: [PATCH 09/12] RPM: always build for python3, not python2.7

Since remctl no longer supports python2.7, and newer RHEL no longer
includes it, stop trying to build packages for it. Instead, build for
python3. Also, accommodate relevant RPM macro changes. This means...

- Updating our build dependencies
- Renaming the binary package containing our Python bindings
- Use /usr/bin/python3 instead of 'python' or %{__python}
- Updating other RPM macro references
---
 remctl.spec | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/remctl.spec b/remctl.spec
index 200b57c0..cbb00a1f 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -34,9 +34,9 @@
 # Use rpmbuild option "--define 'buildpython 0'" to not build the Python module.
 %{!?buildpython:%define buildpython 1}
 %if %{buildpython}
-%define py_version %(python -c "from distutils.sysconfig import get_python_version; print(get_python_version())" )
-%define py_libdest %(python -c "from distutils.sysconfig import get_config_vars; print(get_config_vars()[ 'LIBDEST' ])")
-%define py_binlibdest %(python -c "from distutils.sysconfig import get_config_vars; print(get_config_vars()[ 'BINLIBDEST' ])")
+%define py_version %(/usr/bin/python3 -c "from distutils.sysconfig import get_python_version; print(get_python_version())" )
+%define py_libdest %(/usr/bin/python3 -c "from distutils.sysconfig import get_config_vars; print(get_config_vars()[ 'LIBDEST' ])")
+%define py_binlibdest %(/usr/bin/python3 -c "from distutils.sysconfig import get_config_vars; print(get_config_vars()[ 'BINLIBDEST' ])")
 %endif
 
 Name: remctl
@@ -55,7 +55,10 @@ BuildRequires: krb5-devel, libgcrypt, libevent-devel, fakeroot
 BuildRequires: perl(Module::Build)
 %endif
 %if %{buildpython}
-BuildRequires: python-devel, python
+BuildRequires: python3-devel, python3
+%if (0%{?rel} >= 8)
+BuildRequires: python3-pytest-runner
+%endif
 %endif
 %if %{buildphp}
 BuildRequires: php-devel
@@ -151,12 +154,12 @@ This package contains the PHP remctl client library.
 %endif
 
 %if %{buildpython}
-%package python
+%package python3
 Summary: Python library for Kerberos-authenticated command execution
 Group: Applications/Internet
 Requires: %{name}-client = %{version}-%{release}
 
-%description python
+%description python3
 remctl is a client/server protocol for executing specific commands on a
 remote system with Kerberos authentication.  The allowable commands must
 be listed in a server configuration file, and the executable run on the
@@ -257,8 +260,8 @@ mkdir -p %{buildroot}/usr/share/doc/remctl-perl-%{vers}
 chmod 755 %{buildroot}/usr/share/doc/remctl-perl-%{vers}
 %endif
 %if %{buildpython}
-mkdir -p %{buildroot}/usr/share/doc/remctl-python-%{vers}
-chmod 755 %{buildroot}/usr/share/doc/remctl-python-%{vers}
+mkdir -p %{buildroot}/usr/share/doc/remctl-python3-%{vers}
+chmod 755 %{buildroot}/usr/share/doc/remctl-python3-%{vers}
 find %{buildroot} -name _remctl.so -exec chmod 755 {} \;
 %endif
 %if %{buildruby}
@@ -333,11 +336,12 @@ make check
 %endif
 
 %if %{buildpython}
-%files python
+%files python3
 %defattr(-, root, root)
-%{python_sitearch}/_remctl.so
-%{python_sitearch}/remctl.py*
-%{python_sitearch}/pyremctl-%{version}-*.egg-info
+%{python3_sitearch}/_remctl*.so
+%{python3_sitearch}/remctl.py*
+%{python3_sitearch}/__pycache__/remctl*.pyc
+%{python3_sitearch}/pyremctl-%{version}-*.egg-info
 %doc CHANGELOG.md TODO
 %doc python/README
 %endif

From 50460bc9e369e40071d9ae3506094658da6689c2 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Mon, 10 Aug 2026 12:52:17 -0400
Subject: [PATCH 10/12] Update automake for CHANGELOG.md

Update the way automake is invoked to avoid requiring NEWS.
And, add CHANGELOG.md to EXTRA_DIST, so it's actually present
when building from the dist tarball.
---
 Makefile.am  | 3 ++-
 configure.ac | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 437a4494..f3a5ba1b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -80,7 +80,8 @@ PYTHON_DIRECTORIES = python python/tests python/tests/data
 
 ACLOCAL_AMFLAGS = -I m4
 EXTRA_DIST = .clang-format .gitignore .github LICENSE Makefile.w32	    \
-	README.md bootstrap ci/README.md ci/apt-packages ci/cpanfile	    \
+	CHANGELOG.md README.md bootstrap				    \
+	ci/README.md ci/apt-packages ci/cpanfile			    \
 	ci/files/heimdal/heimdal-kdc ci/files/heimdal/kadmind.acl	    \
 	ci/files/heimdal/kdc.conf ci/files/heimdal/krb5.conf		    \
 	ci/files/mit/extensions.client ci/files/mit/extensions.kdc	    \
diff --git a/configure.ac b/configure.ac
index 7bd5a1dd..cd281695 100644
--- a/configure.ac
+++ b/configure.ac
@@ -13,7 +13,7 @@ AC_INIT([remctl], [3.18], [eagle@eyrie.org])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_LIBOBJ_DIR([portable])
 AC_CONFIG_MACRO_DIR([m4])
-AM_INIT_AUTOMAKE([1.11 check-news dist-xz foreign silent-rules subdir-objects
+AM_INIT_AUTOMAKE([1.11 dist-xz foreign silent-rules subdir-objects
     -Wall -Werror])
 AM_MAINTAINER_MODE
 

From 0df2433d0df6084cffb517e8bb29a43d721d3a23 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Mon, 10 Aug 2026 13:36:23 -0400
Subject: [PATCH 11/12] RPM: don't install .la file

It seems that distribution vendors no longer want packages to contain
.la files. As of RPM 4.17, there is a default policy which removes them
from the buildroot. Thus, we should should not include it in the client
packages files list. Further, we remove the file ourselves, to ensure
proper behavior on older platforms.
---
 remctl.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/remctl.spec b/remctl.spec
index cbb00a1f..19eac634 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -251,6 +251,7 @@ mkdir -p %{buildroot}/etc/remctl/conf.d
 mkdir -p %{buildroot}/usr/share/doc/remctl-{server,client}-%{vers}
 chmod 755 %{buildroot}/usr/share/doc/remctl-{server,client}-%{vers}
 install -c -m 0644 examples/remctl.conf %{buildroot}/etc/remctl/remctl.conf
+rm -f %{buildroot}/usr/lib64/libremctl.la
 %if %{buildperl}
 find %{buildroot} -type f -name perllocal.pod -exec rm -f {} \;
 find %{buildroot} -type f -name .packlist -exec rm -f {} \;
@@ -309,7 +310,6 @@ make check
 %defattr(-, root, root)
 %{_bindir}/*
 %doc CHANGELOG.md README TODO
-%{_libdir}/libremctl.la
 %{_libdir}/libremctl.so
 %{_libdir}/libremctl.so.*
 %doc %{_mandir}/man1/remctl.*

From a57b8241af1f657c2553e6041bb2f14768a22553 Mon Sep 17 00:00:00 2001
From: Jeffrey Hutzelman <jhutz@cmu.edu>
Date: Mon, 10 Aug 2026 15:00:56 -0400
Subject: [PATCH 12/12] RPM: Use separate dir for test KRB5RCACHEDIR

Commit 1052e06 set KRB5RCACHEDIR to tests/tmp when running tests under
RPM. Unfortunately, this breaks the ruby tests, which expect the tmp
directory to be empty and removable for each test.

Switch to using a separate tests/rcache directory for KRB5RCACHEDIR.
---
 remctl.spec | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/remctl.spec b/remctl.spec
index 19eac634..c15258a8 100644
--- a/remctl.spec
+++ b/remctl.spec
@@ -297,7 +297,8 @@ echo '%{test_princ}'  > tests/config/principal
 %if 0%{?test_krb5_conf:1}
 ln -s $(realpath '%{test_krb5_conf}') tests/config/krb5.conf
 %endif
-export KRB5RCACHEDIR=$(realpath tests/tmp)
+export KRB5RCACHEDIR=$(realpath tests/rcache)
+mkdir -p ${KRB5RCACHEDIR}
 make check
 
 %files devel