From 966a5028eac1bcce2df03420f8fb5934f3da6583 Mon Sep 17 00:00:00 2001
From: Fritz Elfert <fritz@fritz-elfert.de>
Date: Feb 11 2021 06:51:21 +0000
Subject: Misc. fixes for jicofo


  - Fixed permissions for config dir
  - Set classpath and mainclass in jar manifest
  - Use own shell wrapper in the proper location at /usr/libexec in
    order to accomodate above changes.

---

diff --git a/jicofo/jicofo.service b/jicofo/jicofo.service
index a58050c..e26a227 100644
--- a/jicofo/jicofo.service
+++ b/jicofo/jicofo.service
@@ -7,7 +7,7 @@ Wants=network-online.target
 SuccessExitStatus=143
 EnvironmentFile=/etc/jicofo/config
 User=jicofo
-ExecStart=/usr/share/jicofo/jicofo.sh --host=${JICOFO_HOST} --domain=${JICOFO_HOSTNAME} --port=${JICOFO_PORT} --user_name=${JICOFO_AUTH_USER} --user_domain=${JICOFO_AUTH_DOMAIN} ${JICOFO_OPTS}
+ExecStart=/usr/libexec/jicofo --host=${JICOFO_HOST} --domain=${JICOFO_HOSTNAME} --port=${JICOFO_PORT} --user_name=${JICOFO_AUTH_USER} --user_domain=${JICOFO_AUTH_DOMAIN} ${JICOFO_OPTS}
 WorkingDirectory=~
 
 # Hardening
@@ -19,8 +19,8 @@ ProtectHome=yes
 ProtectKernelTunables=yes
 ProtectControlGroups=yes
 ProtectSystem=strict
-# whitelist writing to rundir and config dir 
-ReadWritePaths=/run/jicofo /etc/jicofo
+# whitelist writing to rundir
+ReadWritePaths=/run/jicofo
 
 [Install]
 WantedBy=multi-user.target
diff --git a/jicofo/jicofo.sh b/jicofo/jicofo.sh
new file mode 100755
index 0000000..7bac941
--- /dev/null
+++ b/jicofo/jicofo.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+if [[ "$1" == "--help"  || $# -lt 1 ]]; then
+    echo -e "Usage:"
+    echo -e "$0 [OPTIONS], where options can be:"
+    echo -e "\t--host=HOST\t sets the hostname of the XMPP server (default: domain, if domain is set, localhost otherwise)"
+    echo -e "\t--domain=DOMAIN\t sets the XMPP domain"
+    echo -e "\t--port=PORT\t sets the port of the XMPP server (default: 5347)"
+    echo -e "\t--subdomain=SUBDOMAIN\t sets the sub-domain used to bind focus XMPP component (default: focus)"
+    echo -e "\t--secret=SECRET\t sets the shared secret used to authenticate focus component to the XMPP server"
+    echo -e "\t--user_domain=DOMAIN\t specifies the name of XMPP domain used by the focus user to login."
+    echo -e "\t--user_name=USERNAME\t specifies the username used by the focus XMPP user to login. (default: focus@user_domain)"
+    echo -e "\t--user_password=PASSWORD\t specifies the password used by focus XMPP user to login. If not provided then focus user will use anonymous authentication method."
+    echo
+    echo -e "\tSECRET and PASSWORD can alternatively be set via the environment variables JICOFO_SECRET and JICOFO_AUTH_PASSWORD respectively."
+    echo
+    exit 1
+fi
+
+if [ -z "$JICOFO_MAX_MEMORY" ]; then JICOFO_MAX_MEMORY=3072m; fi
+
+cp /etc/jicofo/sip-communicator.properties ~/
+exec java -Xmx$JICOFO_MAX_MEMORY \
+    -XX:+HeapDumpOnOutOfMemoryError \
+    -XX:HeapDumpPath=/tmp \
+    -Djdk.tls.ephemeralDHKeySize=2048 \
+    $JAVA_SYS_PROPS \
+    -jar /usr/share/jicofo/jicofo.jar $@
diff --git a/jicofo/jicofo.spec b/jicofo/jicofo.spec
index 770bd8f..cfba4c4 100644
--- a/jicofo/jicofo.spec
+++ b/jicofo/jicofo.spec
@@ -15,10 +15,12 @@ Source3:    %{name}.service
 Source4:    %{name}.sysusers
 Source5:    %{name}.tmpfiles
 Source6:    README.fedora
+Source7:    jicofo.sh
 Patch1:     0001-log-to-syslog.patch
 
 BuildArch:      noarch
 BuildRequires:  maven
+BuildRequires:  maven-local
 BuildRequires:  java-openjdk-devel
 BuildRequires:  systemd-rpm-macros
 
@@ -52,6 +54,8 @@ instructions.
 #-- PREP, BUILD & INSTALL -----------------------------------------------------#
 %prep
 %autosetup -p1 -n %{name}-stable-%{project}-meet_%{project_version}
+%pom_xpath_inject //pom:manifest \
+    '<addClasspath>true</addClasspath><useUniqueVersions>false</useUniqueVersions><classpathPrefix>lib</classpathPrefix><mainClass>org.jitsi.jicofo.Main</mainClass>'
 
 %build
 # build & copy dependencies
@@ -64,7 +68,8 @@ mvn dependency:copy-dependencies -DincludeScope=runtime
 # program
 install -D -m 644 -t %{buildroot}%{_datadir}/%{name}/lib/ target/dependency/*
 install -m 644 target/%{name}-%{version}.jar %{buildroot}%{_datadir}/%{name}/%{name}.jar
-install -m 755 resources/%{name}.sh %{buildroot}%{_datadir}/%{name}/%{name}.sh
+# install -m 755 resources/%{name}.sh %{buildroot}%{_datadir}/%{name}/%{name}.sh
+install -D -m 755 %{SOURCE7} %{buildroot}%{_libexecdir}/%{name}
 
 # config
 install -D -m 640 -t %{buildroot}%{_sysconfdir}/%{name}/ lib/logging.properties
@@ -103,9 +108,10 @@ install -D -m 644 %{SOURCE6} %{buildroot}/%{_pkgdocdir}/README-fedora.md
 
 # package files/dirs
 %{_datadir}/%{name}/
-%dir %attr(0700,%{user},root) %{_sysconfdir}/%{name}/
-%config(noreplace) %attr(0644,%{user},root) %{_sysconfdir}/%{name}/*
-%dir %attr(0755,%{user},%{user}) %{_rundir}/%{name}/
+%{_libexecdir}/%{name}
+%dir %attr(0750,root,%{user}) %{_sysconfdir}/%{name}/
+%config(noreplace) %attr(0649,root,%{user}) %{_sysconfdir}/%{name}/*
+%dir %attr(0700,%{user},%{user}) %{_rundir}/%{name}/
 
 # system config
 %{_unitdir}/%{name}.service
diff --git a/jicofo/jicofo.tmpfiles b/jicofo/jicofo.tmpfiles
index 94c410e..f19109e 100644
--- a/jicofo/jicofo.tmpfiles
+++ b/jicofo/jicofo.tmpfiles
@@ -1,5 +1,5 @@
 # create rundir
-d /run/jicofo 0755 jicofo jicofo -
+d /run/jicofo 0700 jicofo jicofo -
 # ensure correct permissions for all files in config dir
-Z /etc/jicofo 0640 jicofo jicofo
-z /etc/jicofo 0750 jicofo jicofo
+Z /etc/jicofo 0640 root jicofo
+z /etc/jicofo 0750 root jicofo