Update spec for compiler flags and systemd user

azure-pipelines.yml

@@ -117,6 +117,11 @@ jobs:
           -e '/^\/usr\/share\/pki\/lib\/resteasy-jackson2-provider-.*\.jar/d' \
           -e '/^\/usr\/share\/pki\/server\/common\/lib\/resteasy-servlet-initializer-.*\.jar/d' \
           file_list
+
+      # exclude user managemant files only available in RPM
+      sed -i \
+          -e '/^\/usr\/lib\/sysusers\.d\/dogtag-pki\.conf/d' \
+          file_list
     displayName: Get list of files from RPM packages
 
   - script: |

pki.spec

@@ -1198,6 +1198,16 @@ fi
 %mvn_package org.dogtagpki.pki:pki-console        pki-console
 %endif
 
+%if 0%{?fedora}
+# Create a sysusers.d config file
+
+cat > %{product_id}.sysusers.conf <<EOF
+g %{pki_username} %{pki_gid}
+u %{pki_groupname} %{pki_uid} 'Certificate System' %{pki_homedir} -
+EOF
+
+%endif
+
 ################################################################################
 %build
 ################################################################################
@@ -1266,45 +1276,8 @@ popd
 %endif
 
 # Remove all symbol table and relocation information from the executable.
-C_FLAGS="-s"
-CXX_FLAGS="$CXX_FLAGS -g -fPIE -pie"
-
-%if 0%{?fedora} || 0%{?rhel} && 0%{?rhel} >= 10
-# https://sourceware.org/annobin/annobin.html/Test-gaps.html
-C_FLAGS="$C_FLAGS -fplugin=annobin"
-
-%ifarch x86_64
-# https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
-C_FLAGS="$C_FLAGS -fcf-protection=full"
-CXX_FLAGS="$CXX_FLAGS -fcf-protection=full"
-%endif
-
-# https://sourceware.org/annobin/annobin.html/Test-optimization.html
-C_FLAGS="$C_FLAGS -O2"
-CXX_FLAGS="$CXX_FLAGS -O2"
-
-# https://sourceware.org/annobin/annobin.html/Test-glibcxx-assertions.html
-C_FLAGS="$C_FLAGS -D_GLIBCXX_ASSERTIONS"
-CXX_FLAGS="$CXX_FLAGS -D_GLIBCXX_ASSERTIONS"
-
-# https://sourceware.org/annobin/annobin.html/Test-lto.html
-C_FLAGS="$C_FLAGS -flto"
-
-# https://sourceware.org/annobin/annobin.html/Test-fortify.html
-C_FLAGS="$C_FLAGS -D_FORTIFY_SOURCE=3"
-CXX_FLAGS="$CXX_FLAGS -D_FORTIFY_SOURCE=3"
-
-# https://sourceware.org/annobin/annobin.html/Test-stack-clash.html
-C_FLAGS="$C_FLAGS -fstack-clash-protection"
-CXX_FLAGS="$CXX_FLAGS -fstack-clash-protection"
-
-%ifarch aarch64
-# https://sourceware.org/annobin/annobin.html/Test-dynamic-tags.html
-C_FLAGS="$C_FLAGS -mbranch-protection=standard"
-CXX_FLAGS="$CXX_FLAGS -mbranch-protection=standard"
-%endif
-
-%endif
+C_FLAGS="%{optflags}"
+CXX_FLAGS="%{optflags}"
 
 pkgs=base\
 %{?with_server:,server}\
@@ -1541,6 +1514,13 @@ xmlstarlet edit --inplace \
 
 %if %{with server}
 
+%if 0%{?fedora}
+
+install -m0644 -D %{product_id}.sysusers.conf %{buildroot}%{_sysusersdir}/%{product_id}.conf
+%pre -n %{product_id}-server
+
+%else
+
 %pre -n %{product_id}-server
 
 # create PKI group if it doesn't exist
@@ -1551,6 +1531,8 @@ if ! getent passwd %{pki_username} >/dev/null ; then
     useradd -r -u %{pki_uid} -g %{pki_groupname} -d %{pki_homedir} -s /sbin/nologin -c "Certificate System" %{pki_username}
 fi
 
+%endif
+
 # create PKI home directory if it doesn't exist
 if [ ! -d %{pki_homedir} ] ; then
     cp -ar /etc/skel %{pki_homedir}
@@ -1820,7 +1802,9 @@ fi
 %{_mandir}/man8/pki-healthcheck.8.gz
 %{_datadir}/pki/setup/
 %{_datadir}/pki/server/
-
+%if 0%{?fedora}
+%{_sysusersdir}/%{product_id}.conf
+%endif
 %if %{without maven}
 %{_datadir}/java/pki/pki-server.jar
 %{_datadir}/java/pki/pki-server-webapp.jar