Fix post and preun to not run on upgrade

See https://coreruleset.org/20220112/crs-plugin-mechanism/

.gitignore

@@ -5,3 +5,8 @@
 /owasp-modsecurity-crs-2.2.8.tar.gz
 /SpiderLabs-owasp-modsecurity-crs-2.2.9-19-ga57031b.tar.gz
 /owasp-modsecurity-crs-f16e0b1.tar.gz
+/owasp-modsecurity-crs-3.0.0.tar.gz
+/owasp-modsecurity-crs-3.2.0.tar.gz
+/v3.3.0.tar.gz
+/v3.3.4.tar.gz
+/v4.2.0.tar.gz

mod_security_crs.spec

@@ -1,86 +1,163 @@
-%global with_extras 0%{?fedora} || 0%{?rhel} <= 6
+%{!?_httpd_confdir:    %{expand: %%global _httpd_confdir    %%{_sysconfdir}/httpd/conf.d}}
 
-%global commit f16e0b1726c843889b9f024e27fd794147594677
-%global shortcommit %(c=%{commit}; echo ${c:0:7})
-
-
-Summary: ModSecurity Rules
+Summary: ModSecurity Core Ruleset
 Name: mod_security_crs
-Version: 2.2.9.20160414git
+Version: 4.2.0
 Release: 2%{?dist}
-License: ASL 2.0
-URL: https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
-Group: System Environment/Daemons
-Source: https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/%{commit}/owasp-modsecurity-crs-%{shortcommit}.tar.gz
+License: Apache-2.0
+URL: https://coreruleset.org/
+Source: https://github.com/coreruleset/coreruleset/archive/refs/tags/v%{version}.tar.gz
 BuildArch: noarch
-Requires: mod_security >= 2.7.0
+Requires: mod_security >= 2.9.6
+Obsoletes: mod_security_crs-extras < 3.0.0
+
+# Patch0: mod_security_crs-XXX.patch
 
 %description
 This package provides the base rules for mod_security.
 
-%if %with_extras
-%package        extras
-Summary:        Supplementary mod_security rules 
-Group:          System Environment/Daemons
-Requires:       %name = %version-%release
-
-%description    extras
-This package provides supplementary rules for mod_security.
-%endif
-
 %prep
-%setup -q -n owasp-modsecurity-crs-%{commit}
+%autosetup -p1 -S gendiff -n coreruleset-%{version}
 
 %build
 
 %install
-rm -rf %{buildroot}
+%{__install} -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/
+%{__install} -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules
+%{__install} -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/plugins
+%{__install} -d %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules
+%{__install} -d %{buildroot}%{_datarootdir}/mod_modsecurity_crs/plugins
 
-install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/
-install -d %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules
+# To exclude rules (pre/post)
+%{__mv} rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
+%{__mv} rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
 
-install -d %{buildroot}%{_prefix}/lib/modsecurity.d/base_rules
+%{__install} -m0644 rules/*.conf %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/
+%{__install} -m0644 rules/*.data %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/
+%{__install} -m0644 plugins/* %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/plugins/
+%{__mv} crs-setup.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/crs-setup.conf
 
-%if %with_extras
-install -d %{buildroot}%{_prefix}/lib/modsecurity.d/optional_rules
-install -d %{buildroot}%{_prefix}/lib/modsecurity.d/experimental_rules
-install -d %{buildroot}%{_prefix}/lib/modsecurity.d/slr_rules
-%endif
-
-install -m0644 modsecurity_crs_10_setup.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/modsecurity_crs_10_config.conf
-install -m0644 base_rules/* %{buildroot}%{_prefix}/lib/modsecurity.d/base_rules/
-
-
-%if %with_extras
-install -m0644 optional_rules/* %{buildroot}%{_prefix}/lib/modsecurity.d/optional_rules/
-install -m0644 experimental_rules/* %{buildroot}%{_prefix}/lib/modsecurity.d/experimental_rules/
-install -m0644 slr_rules/* %{buildroot}%{_prefix}/lib/modsecurity.d/slr_rules
-%endif
-
-# activate base_rules
-for f in `ls %{buildroot}/%{_prefix}/lib/modsecurity.d/base_rules/` ; do 
-    ln -s %{_prefix}/lib/modsecurity.d/base_rules/$f %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/$f; 
-done
-
-%clean
-rm -rf %{buildroot}
+%post
+if [ $1 == 1 ]; then
+    # activate base_rules
+    for f in `ls %{_datarootdir}/mod_modsecurity_crs/rules/` ; do 
+        %{__ln_s} %{_datarootdir}/mod_modsecurity_crs/rules/$f %{_sysconfdir}/httpd/modsecurity.d/activated_rules/$f; 
+    done
+    %{__sed} -i '/IncludeOptional modsecurity\.d\/\*\.conf/ a\    IncludeOptional modsecurity.d\/plugins\/*-config.conf\n    IncludeOptional modsecurity.d\/plugins\/*-before.conf' %{_httpd_confdir}/mod_security.conf
+    %{__sed} -i '/Include modsecurity\.d\/\*\.conf/a\    Include modsecurity.d/plugins/*-config.conf\n    Include modsecurity.d/plugins/*-before.conf' %{_httpd_confdir}/mod_security.conf
+    %{__sed} -i '/IncludeOptional modsecurity\.d\/local_rules\/\*\.conf/a\    IncludeOptional modsecurity.d\/plugins\/*-after.conf' %{_httpd_confdir}/mod_security.conf
+    %{__sed} -i '/Include modsecurity\.d\/local_rules\/\*\.conf/a\    Include modsecurity.d\/plugins\/*-after.conf' %{_httpd_confdir}/mod_security.conf
+fi
+exit 0
 
+%preun
+if [ $1 == 0 ]; then
+    %{__sed} -i -E '/Include(Optional)? modsecurity\.d\/plugins/d' %{_httpd_confdir}/mod_security.conf
+    for f in `ls %{_datarootdir}/mod_modsecurity_crs/rules/` ; do 
+        %{__rm} %{_sysconfdir}/httpd/modsecurity.d/activated_rules/$f; 
+    done
+fi
+exit 0
 
 %files
-%doc CHANGES INSTALL LICENSE README.md
+%license LICENSE
+%doc CHANGES.md README.md
+%{_datarootdir}/mod_modsecurity_crs
+%{_sysconfdir}/httpd/modsecurity.d/plugins
 %config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/activated_rules/*
-%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/modsecurity_crs_10_config.conf
-%{_prefix}/lib/modsecurity.d/base_rules
-
-
-%if %with_extras
-%files extras
-%{_prefix}/lib/modsecurity.d/optional_rules
-%{_prefix}/lib/modsecurity.d/experimental_rules
-%{_prefix}/lib/modsecurity.d/slr_rules
-%endif
+%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/crs-setup.conf
+%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/plugins/*
 
 %changelog
+* Tue Jul 9 2024 Daniel Demus <daniel-fedoauth@demus.dk> - 4.2.0-2
+- Prepare for plugins (see https://coreruleset.org/20220112/crs-plugin-mechanism/)
+
+* Thu May 02 2024 Luboš Uhliarik <luhliari@redhat.com> - 4.2.0-1
+- new version 4.2.0
+- switch to autosetup
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.4-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.4-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.4-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jun 06 2023 Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-5
+- SPDX migration
+
+* Mon Mar 20 2023 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 3.3.4-4
+- Change URL to new official homepage
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Mon Dec 05 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-2
+- Add Early blocking feature patch again
+
+* Fri Sep 30 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-1
+- new version 3.3.4
+
+* Wed Sep 07 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.0-6
+- Fix application of early blocking patch
+
+* Wed Aug 31 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.0-5
+- Backport early blocking feature
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri Mar 05 2021 Lubos Uhliarik <luhliari@redhat.com> - 3.2.0-1
+- new version 3.2.0
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Sat Apr 22 2017 Athmane Madjoudj <athmane@fedoraproject.org> - 3.0.0-4
+- Exclude rule files should not be symlink
+
+* Sat Apr 22 2017 Athmane Madjoudj <athmane@fedoraproject.org> - 3.0.0-3
+- Use versioned obsoletes
+- Move away from /lib since rules are data
+
+* Sat Apr 22 2017 Athmane Madjoudj <athmane@fedoraproject.org> - 3.0.0-2
+- Fix the install part since extra and experimental rules are not longer included in 3.x
+- Remove EL5 bits since EL5/EPEL5 are OEL-ed
+- Bump reqs
+
+* Sat Apr 22 2017 Athmane Madjoudj <athmane@fedoraproject.org> - 3.0.0-1
+- Update to 3.0.0
+- Clean up the spec
+
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.9.20160414git-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 

sources

@@ -1 +1 @@
-0543475c6c150b4dfe9864999a10acd2  owasp-modsecurity-crs-f16e0b1.tar.gz
+SHA512 (v4.2.0.tar.gz) = 041556b2071385c10a4b4a29ad4f926ee86f819f8b9c95f849e76b3d2724d5fc29c21a69f9eba6fd62e7f5709a109a95feca67a19d8c8d1f0410ee2987ac7a6b