From 1880595227726f23bde71b3e1e3ea96b35487186 Mon Sep 17 00:00:00 2001 From: Steven Thomas Smith Date: Sat, 28 Dec 2024 21:35:37 -0500 Subject: [PATCH] calendar-contacts-server: Fix build; Migrate to postgresql17; Deprecate APNS --- net/calendar-contacts-server/Portfile | 263 +++++++++--------- .../files/calendarserver.plist | 4 +- .../files/patch-build_python_venv.diff | 67 +++++ 3 files changed, 207 insertions(+), 127 deletions(-) create mode 100644 net/calendar-contacts-server/files/patch-build_python_venv.diff diff --git a/net/calendar-contacts-server/Portfile b/net/calendar-contacts-server/Portfile index aaf094dee7c..4399ac76089 100644 --- a/net/calendar-contacts-server/Portfile +++ b/net/calendar-contacts-server/Portfile @@ -5,14 +5,12 @@ PortGroup conflicts_build 1.0 PortGroup github 1.0 github.setup apple ccs-calendarserver 13c706b985fb728b9aab42dc0fef85aae21921c3 -# Change github.tarball_from to 'releases' or 'archive' next update -github.tarball_from tarball name calendar-contacts-server # version from https://github.com/apple/ccs-calendarserver/blob/master/setup.py # with date of git commit appended version 9.3.20200212 -revision 3 +revision 4 categories net mail platforms {darwin any} supported_archs noarch @@ -23,7 +21,7 @@ description Apple Calendar and Contacts Server configuration long_description ccs-calendarserver is a standards-compliant server \ implementing the CalDAV and CardDAV protocols, \ - including iMIP and APNS. It provides a shared \ + including iMIP. It provides a shared \ location on the network allowing multiple users to \ store and edit calendaring and contact \ information. This port provides a basic, working, \ @@ -37,25 +35,33 @@ checksums rmd160 5fd33bb11370e40d3fb8e6550963ec3587156d24 \ sha256 e08d8d1a911d408dfd2f9716a1a02d77801b0d28401186d868d7ca3af198f4c6 \ size 3713620 +# diff -NaurdwB ./calendar-contacts-server-orig ./calendar-contacts-server-new | sed -E -e 's/\.\/calendar-contacts-server-(orig|new)/\./g' | sed -E -e 's|/opt/local|@PREFIX@|g' > ~/Downloads/patch-build_python_venv.diff +patchfiles-append patch-build_python_venv.diff + +post-patch { + reinplace -q "s|@PREFIX@|${prefix}|g" ${worksrcpath}/bin/_build.sh +} + # use these to specify python versions, python2 required # use ${prefix}/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/_resources/port1.0/group/python-1.0.tcl set python2_version 27 set python2_branch [string index ${python2_version} 0].[string range ${python2_version} 1 end] -# use these to specify PostgreSQL versions, postgresql9 required -set postgresql9_version 96 -set postgresql9_branch [string index ${postgresql9_version} 0].[string range ${postgresql9_version} 1 end] +# use these to specify PostgreSQL versions, >=postgresql17 required +set postgresql_previous_version 96 +set postgresql_version 17 depends_build-append \ port:py${python2_version}-setuptools -depends_lib-append port:cyrus-sasl2 \ +depends_lib-append port:curl-ca-bundle \ + port:cyrus-sasl2 \ port:libffi \ port:mail-server \ port:memcached \ port:nginx \ port:openssl \ - port:postgresql${postgresql9_version}-server \ + port:postgresql${postgresql_version}-server \ port:python${python2_version} \ port:py${python2_version}-asn1 \ port:py${python2_version}-asn1-modules \ @@ -63,6 +69,7 @@ depends_lib-append port:cyrus-sasl2 \ port:py${python2_version}-constantly \ port:py${python2_version}-cryptography \ port:py${python2_version}-dateutil \ + port:py${python2_version}-docutils \ port:py${python2_version}-enum34 \ port:py${python2_version}-incremental \ port:py${python2_version}-ldap \ @@ -77,7 +84,8 @@ depends_lib-append port:cyrus-sasl2 \ port:py${python2_version}-virtualenv \ port:py${python2_version}-zopeinterface \ -depends_run-append port:pip_select \ +depends_run-append port:curl \ + port:pip_select \ port:postgresql_select # this conflicts with the requirement sqlparse==0.2.0 @@ -85,8 +93,9 @@ conflicts_build-append \ py${python2_version}-sqlparse set calendarserverUser calendarserver +set calendarserverGroup _calendar add_users ${calendarserverUser} \ - group=_calendar \ + group=${calendarserverGroup} \ home=${prefix}/var/${calendarserverUser} set ccsname ${github.project} @@ -112,10 +121,9 @@ proc correct_horse_battery_staple {} { # * Keep personal data **outside** of ${prefix}, but provide symlinks post-extract { - # Use postgresql96 # ccs-calendarserver's postgres code points to `PSQL = "../postgresql/_root/bin/psql"` # https://github.com/apple/ccs-calendarserver/blob/master/calendarserver/tools/checkdatabaseschema.py - reinplace "s|\"../postgresql/_root/bin/psql\"|\"${prefix}/lib/postgresql${postgresql9_version}/bin/psql\"|g" \ + reinplace "s|\"../postgresql/_root/bin/psql\"|\"${prefix}/lib/postgresql${postgresql_version}/bin/psql\"|g" \ ${worksrcpath}/calendarserver/tools/checkdatabaseschema.py } @@ -164,7 +172,7 @@ destroot { Library/CalendarServer/postgresql Library/CalendarServer/run } { - xinstall -m 0750 -o ${calendarserverUser} -g _calendar -d \ + xinstall -m 0750 -o ${calendarserverUser} -g ${calendarserverGroup} -d \ ${destroot}${calendarserverdir}/${d} destroot.keepdirs-append \ ${destroot}${calendarserverdir}/${d} @@ -180,7 +188,7 @@ destroot { caldavd caldavd_requests } { - xinstall -m 0770 -o ${calendarserverUser} -g _calendar -d \ + xinstall -m 0770 -o ${calendarserverUser} -g ${calendarserverGroup} -d \ ${destroot}${calendarserverdir}/Library/CalendarServer/run/${d} destroot.keepdirs-append \ ${destroot}${calendarserverdir}/Library/CalendarServer/run/${d} @@ -197,20 +205,20 @@ destroot { close ${dot_profile_fd} # calenderserver configuration - xinstall -m 0600 -o ${calendarserverUser} -g _calendar \ + xinstall -m 0600 -o ${calendarserverUser} -g ${calendarserverGroup} \ ${filespath}/calendarserver.plist \ ${destroot}${calendarserverdir}/Library/CalendarServer/Config/calendarserver.plist.macports # Directory Service - xinstall -m 0660 -o ${calendarserverUser} -g _calendar \ + xinstall -m 0660 -o ${calendarserverUser} -g ${calendarserverGroup} \ ${worksrcpath}/conf/test/accounts.xml \ ${destroot}${calendarserverdir}/Library/CalendarServer/auth/accounts.xml.macports # nginx reverse proxy - xinstall -m 0640 -o ${calendarserverUser} -g _calendar \ + xinstall -m 0640 -o ${calendarserverUser} -g ${calendarserverGroup} \ ${filespath}/nginx.conf \ ${destroot}${calendarserverdir}/Library/CalendarServer/etc/nginx.conf.macports - xinstall -m 0644 -o ${calendarserverUser} -g _calendar \ + xinstall -m 0644 -o ${calendarserverUser} -g ${calendarserverGroup} \ ${filespath}/default.html \ ${destroot}${calendarserverdir}/Library/CalendarServer/etc/nginx_root @@ -265,18 +273,18 @@ post-activate { # personal data outside of ${prefix} if { ![file exists \ /private/var/calendarserver/Library/CalendarServer] } { - xinstall -o ${calendarserverUser} -g _calendar -d \ + xinstall -o ${calendarserverUser} -g ${calendarserverGroup} -d \ /private/var/calendarserver/Library/CalendarServer } if { ![file exists \ /private/var/calendarserver/Library/CalendarServer/Data] } { - xinstall -m 0700 -o ${calendarserverUser} -g _calendar -d \ + xinstall -m 0700 -o ${calendarserverUser} -g ${calendarserverGroup} -d \ /private/var/calendarserver/Library/CalendarServer/Data } # package/install calendarserver binaries system -W ${worksrcpath} \ - "sh <${calendarserverpackage}/bin/caldavd$|&\\ \t\t\\ \t\t-X\\ \t\t-R\\ @@ -511,7 +519,7 @@ PACKAGE_CALENDARSERVER ${calendarserverdir} { if { [file type ${f_or_d}] ne "link" } { file attributes ${f_or_d} \ - -owner ${calendarserverUser} -group _calendar + -owner ${calendarserverUser} -group ${calendarserverGroup} } } } @@ -638,107 +646,112 @@ if { [variant_isset "initialize_always"] } { working deployments." } +# remove after 2026-01-01 variant apns \ - description "Use Apple Push Notification Service (APNS)" { - if {[exists notes]} { - # leave a blank line after the existing notes - notes-append "" - } + description "Use Apple Push Notification Service (APNS) \[deprecated]" { notes-append \ - "Calendar and Contacts Server may be configured to use\ - Apple Push Notification Service (APNS) with these steps: - - 1. Acquire APNS Mail certificates from a (virtual) macOS\ - High Sierra 10.13 and Server.app version 5.6. Export\ - the APNS certificates and keys from the Keychain into the\ - files com.apple.servermgrd.apns.calendar.cer and\ - com.apple.servermgrd.apns.calendar.key.p12. APNS certificates\ - appear separately with names APSP: that correspond to the\ - certificate's User ID field, com.apple.calendar.XServer..\ - APNS keys are simply named com.apple.servermgrd.apns.calendar.\ - Repeat for the certificate com.apple.servermgrd.apns.contact.cer\ - and key com.apple.servermgrd.apns.contact.key.p12.\ - *Note*: APNS Mail certificate creation is deprecated on\ - Server.app version 5.7+. - - 1. Acquire APNS Mail certificates from a (virtual) macOS\ - High Sierra 10.13 and Server.app version 5.6. Export\ - the certificates from the Keychain into the files\ - com.apple.servermgrd.apns.calendar.p12 and\ - com.apple.servermgrd.apns.contact.p12. *Note*: APNS Mail\ - certificate creation is deprecated on Server.app version 5.7\+. - - 2. Convert the APNS Mail certificates to cert, key, and chain PEM files,\ - all named \"apns:com.apple.*.pem\": - - openssl x509 -inform der -in com.apple.servermgrd.apns.calendar.cer \\ - | sed '/BEGIN CERTIFICATE/,\$!d' > com.apple.calendar.cert.pem - openssl x509 -inform der -in com.apple.servermgrd.apns.contact.cer \\ - | sed '/BEGIN CERTIFICATE/,\$!d' > com.apple.contact.cert.pem - openssl pkcs12 -in com.apple.servermgrd.apns.calendar.key.p12 \\ - -nodes -nocerts | sed '/BEGIN PRIVATE KEY/,\$!d' \\ - > com.apple.calendarserver.key.pem.decrypted - openssl pkcs12 -in com.apple.servermgrd.apns.contact.key.p12 \\ - -nodes -nocerts | sed '/BEGIN PRIVATE KEY/,\$!d' \\ - > com.apple.contact.key.pem.decrypted - sudo security add-generic-password -a apns:com.apple.calendar \\ - -s 'MacPorts Calendar and Contacts Server' \\ - -T /usr/bin/security \\ - -w \$(openssl rand -base64 24) \\ - -U /Library/Keychains/System.keychain - sudo security add-generic-password -a apns:com.apple.contact \\ - -s 'MacPorts Calendar and Contacts Server' \\ - -T /usr/bin/security \\ - -w \$(openssl rand -base64 24) \\ - -U /Library/Keychains/System.keychain - # encrypt the keys with these passphrases - openssl rsa -aes256 -in com.apple.calendar.key.pem.decrypted \\ - -out com.apple.calendar.key.pem - openssl rsa -aes256 -in com.apple.contact.key.pem.decrypted \\ - -out com.apple.contact.key.pem - # create the full PKI chain of trust - curl -LO https://www.apple.com/certificateauthority/AppleAAI2CA.cer - curl -LO https://www.apple.com/appleca/AppleIncRootCertificate.cer - openssl x509 -inform der -in AppleAAI2CA.cer \\ - -out AppleAAI2CA.cert.pem - openssl x509 -inform der -in AppleIncRootCertificate.cer \\ - -out AppleIncRootCertificate.cert.pem - cat com.apple.calendar.cert.pem \\ - AppleAAI2CA.cert.pem \\ - AppleIncRootCertificate.cert.pem \\ - > com.apple.calendar.chain.pem - cat com.apple.contact.cert.pem \\ - AppleAAI2CA.cert.pem \\ - AppleIncRootCertificate.cert.pem \\ - > com.apple.contact.chain.pem - openssl verify -CAfile com.apple.calendar.chain.pem \\ - com.apple.calendar.cert.pem - openssl verify -CAfile com.apple.contact.chain.pem \\ - com.apple.contact.cert.pem - sudo install -m 0644 -o ${calendarserverUser} -g _calendar \\ - com.apple.calendar.cert.pem com.apple.contact.cert.pem \\ - com.apple.calendar.key.pem com.apple.contact.key.pem \\ - com.apple.calendar.chain.pem com.apple.contact.chain.pem \\ - ${calendarserverdir}/Library/CalendarServer/Config/Certificates - sudo bash -c 'cd ${calendarserverdir}/Library/CalendarServer/Config/Certificates \; \\ - for f in com.apple.*.pem\; do mv -f \"\${f}\" \"apns:\${f}\"\; done' - - 3. Configure calendarserver for APNS by uncommenting this block in\ - the file ${calendarserverdir}/Library/CalendarServer/Config/calendarserver.plist: - - Notifications - - Services - - APNS - - Enabled - - - - " + "Apple no longer supports APNS certificates for Calendar and Contacts.\ + This variant will be removed in a future update. See:\ + https://discussions.apple.com/thread/255898876" } -default_variants +apns +if {${postgresql_previous_version} ne ${postgresql_version}} { + notes-append \ + "Migration of the caldav PostgreSQL database from\ + postgresql${postgresql_previous_version} to postgresql${postgresql_version} may be required. + + Issue the following commands, possibly modified for your own specific\ + database location and previous version: + +# shutdown calendar-contacts-server and associated database +sudo port unload calendar-contacts-server + +# move original db cluster.pg directory +sudo ls -l \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database +sudo mv \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster.pg \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_previous_version}.pg + +# create socket to original db and dump the db +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + install -o ${calendarserverUser} -g ${calendarserverGroup} -m 0700 \\ + -d /tmp/ccs-migration +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + install -o ${calendarserverUser} -g ${calendarserverGroup} -m 0700 \\ + -d /tmp/ccs-migration/PostgresSocket-${postgresql_previous_version} +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_previous_version}/bin/pg_ctl \\ + -U caldav -D \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_previous_version}.pg \\ + -o \"-k /tmp/ccs-migration/PostgresSocket-${postgresql_previous_version}\" \\ + -l /tmp/ccs-migration/postgresql${postgresql_previous_version}_logfile.txt start +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_previous_version}/bin/pg_dumpall \\ + --username=caldav --host=/tmp/ccs-migration/PostgresSocket-${postgresql_previous_version} \\ + --file=/tmp/ccs-migration/caldav${postgresql_previous_version}.dump +sudo chmod 0600 /tmp/ccs-migration/caldav${postgresql_previous_version}.dump +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_previous_version}/bin/pg_ctl \\ + -U caldav -D \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_previous_version}.pg \\ + -o \"-k /tmp/ccs-migration/PostgresSocket-${postgresql_previous_version}\" \\ + -l /tmp/ccs-migration/postgresql${postgresql_previous_version}_logfile.txt stop + +# import the data into a new database +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + install -o ${calendarserverUser} -g ${calendarserverGroup} -m 0700 -d \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_version}.pg +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + install -o ${calendarserverUser} -g ${calendarserverGroup} -m 0700 -d \\ + /tmp/ccs-migration/PostgresSocket-${postgresql_version} +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_version}/bin/initdb -E UTF8 -U caldav \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_version}.pg +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_version}/bin/pg_ctl -U caldav -D \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_version}.pg \\ + -o \"-k /tmp/ccs-migration/PostgresSocket-${postgresql_version}\" \\ + -l /tmp/ccs-migration/postgresql${postgresql_version}_logfile.txt start +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_version}/bin/createdb -U caldav \\ + -h /tmp/ccs-migration/PostgresSocket-${postgresql_version} caldav +sudo -u ${calendarserverUser} -g ${calendarserverGroup} bash -c \\ + '${prefix}/lib/postgresql${postgresql_version}/bin/psql -U caldav \\ + -h /tmp/ccs-migration/PostgresSocket-${postgresql_version} \\ + < /tmp/ccs-migration/caldav${postgresql_previous_version}.dump' +# dump the new db to compare +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_version}/bin/pg_dumpall --username=caldav \\ + -h /tmp/ccs-migration/PostgresSocket-${postgresql_version} \\ + --file=/tmp/ccs-migration/caldav${postgresql_version}.dump +sudo chmod 0600 /tmp/ccs-migration/caldav${postgresql_version}.dump +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ${prefix}/lib/postgresql${postgresql_version}/bin/pg_ctl -U caldav -D \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster_postgresql${postgresql_version}.pg \\ + -o \"-k /tmp/ccs-migration/PostgresSocket-${postgresql_version}\" \\ + -l /tmp/ccs-migration/postgresql${postgresql_version}_logfile.txt stop +sudo -u ${calendarserverUser} -g ${calendarserverGroup} \\ + ls -l /tmp/ccs-migration + +# symlink `cluster.pg` to new db data +sudo -u ${calendarserverUser} -g ${calendarserverGroup} ln -s \\ + ./cluster_postgresql${postgresql_version}.pg \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Data/Database/cluster.pg + +# port select the new PostgreSQL version +sudo port select --set postgresql postgresql${postgresql_version} +# edit by hand previously installed configuration file +sudo -u ${calendarserverUser} -g ${calendarserverGroup} sed -i \"\" \\ + 's|postgresql${postgresql_previous_version}|postgresql${postgresql_version}|g' \\ + ${prefix}/var/${calendarserverUser}/Library/${calendarserverUser}/Config/calendarserver.plist + +# clean up +sudo -u ${calendarserverUser} -g ${calendarserverGroup} rm -fr \\ + /tmp/ccs-migration + +sudo port load calendar-contacts-server +" +} livecheck.type none diff --git a/net/calendar-contacts-server/files/calendarserver.plist b/net/calendar-contacts-server/files/calendarserver.plist index edecbfcec0e..ffcbc986c78 100644 --- a/net/calendar-contacts-server/files/calendarserver.plist +++ b/net/calendar-contacts-server/files/calendarserver.plist @@ -128,7 +128,7 @@ Postgres Ctl - @PREFIX@/lib/postgresql@POSTGRESQL9_VERSION@/bin/pg_ctl + @PREFIX@/lib/postgresql@POSTGRESQL_VERSION@/bin/pg_ctl Options @@ -151,7 +151,7 @@ Init - @PREFIX@/lib/postgresql@POSTGRESQL9_VERSION@/bin/initdb + @PREFIX@/lib/postgresql@POSTGRESQL_VERSION@/bin/initdb diff --git a/net/calendar-contacts-server/files/patch-build_python_venv.diff b/net/calendar-contacts-server/files/patch-build_python_venv.diff new file mode 100644 index 00000000000..314a1c880ac --- /dev/null +++ b/net/calendar-contacts-server/files/patch-build_python_venv.diff @@ -0,0 +1,67 @@ +diff -NaurdwB ./bin/_build.sh ./bin/_build.sh +--- ./bin/_build.sh 2024-12-28 13:40:15 ++++ ./bin/_build.sh 2024-12-28 13:40:10 +@@ -788,7 +788,7 @@ + virtualenv==15.0.2 \ + ; do + ruler "Installing ${pkg}"; +- "${bootstrap_python}" -m pip install -I ${NESTED} "${pkg}"; ++ "${bootstrap_python}" -m pip install -I ${NESTED} --cert @PREFIX@/share/curl/curl-ca-bundle.crt "${pkg}"; + done; + } + +@@ -802,6 +802,7 @@ + --pre \ + --no-cache-dir \ + --log-file="${dev_home}/pip.log" \ ++ --cert @PREFIX@/share/curl/curl-ca-bundle.crt \ + "$@"; + } + +@@ -815,6 +816,7 @@ + --find-links="${dev_patches}" \ + --find-links="${dev_home}/pip_downloads" \ + --log-file="${dev_home}/pip.log" \ ++ --cert @PREFIX@/share/curl/curl-ca-bundle.crt \ + "$@"; + } + +@@ -826,6 +828,7 @@ + --no-cache-dir \ + --find-links="${dev_patches}" \ + --log-file="${dev_home}/pip.log" \ ++ --cert @PREFIX@/share/curl/curl-ca-bundle.crt \ + "$@"; + } + +diff -NaurdwB ./requirements-cs.txt ./requirements-cs.txt +--- ./requirements-cs.txt 2024-12-28 13:40:15 ++++ ./requirements-cs.txt 2024-12-28 13:40:10 +@@ -37,5 +37,5 @@ + + psutil==5.0.0 + setproctitle==1.1.10 +- # xattr==0.7.5 # Only needed for upgrades from ancient versions. Added in _cache_deps. ++ xattr==0.7.5 # Only needed for upgrades from ancient versions. Added in _cache_deps. + #cffi +diff -NaurdwB ./requirements-twisted-default.txt ./requirements-twisted-default.txt +--- ./requirements-twisted-default.txt 2024-12-28 13:40:15 ++++ ./requirements-twisted-default.txt 2024-12-28 20:47:02 +@@ -10,7 +10,7 @@ + # but doesn't specify them as dependencies, so that are explicitly + # added to calendarserver. + #pyOpenSSL +- service_identity==16.0.0 ++ service_identity + characteristic==14.3.0 + pyasn1==0.1.9 + pyasn1-modules==0.0.8 +@@ -18,7 +18,7 @@ + pycrypto==2.6.1 + + pyOpenSSL==16.2.0 +- cryptography==1.6 ++ cryptography + idna + #pyasn1 + #cffi