<commit_before>--- original/shibboleth.spec	2016-07-13 03:48:01.000000000 +0900
+++ new/shibboleth.spec	2017-07-30 08:17:24.000000000 +0900
@@ -11,6 +11,7 @@
 BuildRoot:	%{_tmppath}/%{name}-sp-%{version}-root
 Obsoletes:	shibboleth-sp = 2.5.0
 Requires:	openssl
+Requires: supervisor
 %if 0%{?rhel} >= 6 || 0%{?centos_version} >= 600 || 0%{?amzn} >= 1
 PreReq:		xmltooling-schemas%{?_isa} >= 1.6.0, opensaml-schemas%{?_isa} >= 2.6.0
 %else
@@ -163,7 +164,7 @@
 	fi
 	if [ "$APACHE_CONFD" != "no" ] ; then
 		%{__mkdir} -p $RPM_BUILD_ROOT$APACHE_CONFD
-		%{__cp} -p $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/$APACHE_CONFIG $RPM_BUILD_ROOT$APACHE_CONFD/shib.conf 
+		%{__cp} -p $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/$APACHE_CONFIG $RPM_BUILD_ROOT$APACHE_CONFD/shib.conf
 		echo "%config(noreplace) $APACHE_CONFD/shib.conf" >> rpm.filelist
 	fi
 fi
@@ -174,6 +175,10 @@
 	%{__mkdir} -p $RPM_BUILD_ROOT%{_unitdir}
 	echo "%attr(0444,-,-) %{_unitdir}/shibd.service" >> rpm.filelist
 	SYSTEMD_SHIBD="$RPM_BUILD_ROOT%{_unitdir}/shibd.service"
+	echo "%attr(0444,-,-) %{_unitdir}/shibfcgi.service" >> rpm.filelist
+	SYSTEMD_SHIBFCGI="$RPM_BUILD_ROOT%{_unitdir}/shibfcgi.service"
+	echo "%attr(0444,-,-) %{_sysconfdir}/shibboleth/shibfcgi-supervisor.conf" >> rpm.filelist
+	SHIBFCGI_SUPERVISOR_CONF="$RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/shibfcgi-supervisor.conf"
 
 	# Get run directory created at boot time.
 	%{__mkdir} -p $RPM_BUILD_ROOT%{_tmpfilesdir}
@@ -225,6 +230,40 @@
 [Install]
 WantedBy=multi-user.target
 EOF
+  cat > $SYSTEMD_SHIBFCGI <<EOF
+[Unit]
+Description=Shibboleth Fast CGI support service
+
+[Service]
+Type=forking
+ExecStart=/usr/bin/supervisord -c %{_sysconfdir}/shibboleth/shibfcgi-supervisor.conf
+
+[Install]
+WantedBy=multi-user.target
+EOF
+  cat > $SHIBFCGI_SUPERVISOR_CONF <<EOF
+[supervisord]
+logfile=%{_localstatedir}/log/shibboleth/supervisord.log
+
+[fcgi-program:shibauthorizer]
+command=%{_libdir}/shibboleth/shibauthorizer
+socket=unix://%{_localstatedir}/run/shibboleth/shibauthorizer.sock
+socket_owner=shibd:shibd
+socket_mode=0660
+user=shibd
+process_name=%%(program_name)s_%%(process_num)02d
+stdout_logfile=%{_localstatedir}/log/shibboleth/shibauthorizer.log
+stderr_logfile=%{_localstatedir}/log/shibboleth/shibauthorizer.error.log
+
+[fcgi-program:shibresponder]
+command=%{_libdir}/shibboleth/shibresponder
+socket=unix://%{_localstatedir}/run/shibboleth/shibresponder.sock
+socket_owner=shibd:shibd
+socket_mode=0660
+user=shibd
+stdout_logfile=%{_localstatedir}/log/shibboleth/shibresponder.log
+stderr_logfile=%{_localstatedir}/log/shibboleth/shibresponder.error.log
+EOF
 elif [ "$SYSCONFIG_SHIBD" != "no" ] ; then
 	# Populate the sysconfig file.
 	cat > $SYSCONFIG_SHIBD <<EOF
@@ -279,6 +318,7 @@
 	-d  %{_localstatedir}/run/shibboleth -s /sbin/nologin -c "Shibboleth SP daemon" %{runuser}
 %if 0%{?suse_version} >= 1210
 	%service_add_pre shibd.service
+	%service_add_pre shibfcgi.service
 %endif
 exit 0
 
@@ -321,6 +361,10 @@
 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
 	# Initial prep for systemd
 	%systemd_post shibd.service
+	%systemd_post shibfcgi.service
+	if [ $1 -eq 1 ] ; then
+		gpasswd -a nginx shibd
+	fi
 	if [ $1 -gt 1 ] ; then
 		systemctl daemon-reload
 	fi
@@ -347,6 +391,10 @@
 %if "%{_vendor}" == "redhat" || "%{_vendor}" == "amazon"
 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
 	%systemd_preun shibd.service
+	%systemd_preun shibfcgi.service
+	if [ $1 -eq 0 ] ; then
+		gpasswd -d nginx shibd
+	fi
 %else
 	if [ $1 -eq 0 ] ; then
 		/sbin/service shibd stop >/dev/null 2>&1
@@ -377,6 +425,7 @@
 	# On upgrade, restart components if they're already running.
 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
 	%systemd_postun_with_restart shibd.service
+	%systemd_postun_with_restart shibfcgi.service
 %else
 	if [ $1 -ge 1 ] ; then
 		/sbin/service shibd status 1>/dev/null && /sbin/service shibd restart 1>/dev/null
@@ -391,7 +440,7 @@
 %if 0%{?suse_version} >= 1210
 	%service_del_postun shibd.service
 %else
-	cd / 
+	cd /
 	%restart_on_update shibd
 	%{insserv_cleanup}
 %endif
@@ -526,7 +575,7 @@
 * Sun Jun 26 2011  <NAME>  <<EMAIL>>  - 2.4.3-1
 - Log files shouldn't be world readable.
 - Explicit requirement for libcurl-openssl on RHEL6
-- Uncomment LD_LIBRARY_PATH in init script for RHEL6 
+- Uncomment LD_LIBRARY_PATH in init script for RHEL6
 - Remove rpath from binaries for RHEL6
 
 * Fri Dec 25 2009  <NAME>  <<EMAIL>>  - 2.4-1<commit_msg>fix gpasswd: user nginx does not exist<commit_after>--- original/shibboleth.spec	2016-07-13 03:48:01.000000000 +0900
+++ new/shibboleth.spec	2017-09-19 23:38:46.000000000 +0900
@@ -11,6 +11,8 @@
 BuildRoot:	%{_tmppath}/%{name}-sp-%{version}-root
 Obsoletes:	shibboleth-sp = 2.5.0
 Requires:	openssl
+Requires: supervisor
+Requires: nginx
 %if 0%{?rhel} >= 6 || 0%{?centos_version} >= 600 || 0%{?amzn} >= 1
 PreReq:		xmltooling-schemas%{?_isa} >= 1.6.0, opensaml-schemas%{?_isa} >= 2.6.0
 %else
@@ -163,7 +165,7 @@
 	fi
 	if [ "$APACHE_CONFD" != "no" ] ; then
 		%{__mkdir} -p $RPM_BUILD_ROOT$APACHE_CONFD
-		%{__cp} -p $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/$APACHE_CONFIG $RPM_BUILD_ROOT$APACHE_CONFD/shib.conf 
+		%{__cp} -p $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/$APACHE_CONFIG $RPM_BUILD_ROOT$APACHE_CONFD/shib.conf
 		echo "%config(noreplace) $APACHE_CONFD/shib.conf" >> rpm.filelist
 	fi
 fi
@@ -174,6 +176,10 @@
 	%{__mkdir} -p $RPM_BUILD_ROOT%{_unitdir}
 	echo "%attr(0444,-,-) %{_unitdir}/shibd.service" >> rpm.filelist
 	SYSTEMD_SHIBD="$RPM_BUILD_ROOT%{_unitdir}/shibd.service"
+	echo "%attr(0444,-,-) %{_unitdir}/shibfcgi.service" >> rpm.filelist
+	SYSTEMD_SHIBFCGI="$RPM_BUILD_ROOT%{_unitdir}/shibfcgi.service"
+	echo "%attr(0444,-,-) %{_sysconfdir}/shibboleth/shibfcgi-supervisor.conf" >> rpm.filelist
+	SHIBFCGI_SUPERVISOR_CONF="$RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/shibfcgi-supervisor.conf"
 
 	# Get run directory created at boot time.
 	%{__mkdir} -p $RPM_BUILD_ROOT%{_tmpfilesdir}
@@ -225,6 +231,40 @@
 [Install]
 WantedBy=multi-user.target
 EOF
+  cat > $SYSTEMD_SHIBFCGI <<EOF
+[Unit]
+Description=Shibboleth Fast CGI support service
+
+[Service]
+Type=forking
+ExecStart=/usr/bin/supervisord -c %{_sysconfdir}/shibboleth/shibfcgi-supervisor.conf
+
+[Install]
+WantedBy=multi-user.target
+EOF
+  cat > $SHIBFCGI_SUPERVISOR_CONF <<EOF
+[supervisord]
+logfile=%{_localstatedir}/log/shibboleth/supervisord.log
+
+[fcgi-program:shibauthorizer]
+command=%{_libdir}/shibboleth/shibauthorizer
+socket=unix://%{_localstatedir}/run/shibboleth/shibauthorizer.sock
+socket_owner=shibd:shibd
+socket_mode=0660
+user=shibd
+process_name=%%(program_name)s_%%(process_num)02d
+stdout_logfile=%{_localstatedir}/log/shibboleth/shibauthorizer.log
+stderr_logfile=%{_localstatedir}/log/shibboleth/shibauthorizer.error.log
+
+[fcgi-program:shibresponder]
+command=%{_libdir}/shibboleth/shibresponder
+socket=unix://%{_localstatedir}/run/shibboleth/shibresponder.sock
+socket_owner=shibd:shibd
+socket_mode=0660
+user=shibd
+stdout_logfile=%{_localstatedir}/log/shibboleth/shibresponder.log
+stderr_logfile=%{_localstatedir}/log/shibboleth/shibresponder.error.log
+EOF
 elif [ "$SYSCONFIG_SHIBD" != "no" ] ; then
 	# Populate the sysconfig file.
 	cat > $SYSCONFIG_SHIBD <<EOF
@@ -279,6 +319,7 @@
 	-d  %{_localstatedir}/run/shibboleth -s /sbin/nologin -c "Shibboleth SP daemon" %{runuser}
 %if 0%{?suse_version} >= 1210
 	%service_add_pre shibd.service
+	%service_add_pre shibfcgi.service
 %endif
 exit 0
 
@@ -321,6 +362,10 @@
 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
 	# Initial prep for systemd
 	%systemd_post shibd.service
+	%systemd_post shibfcgi.service
+	if [ $1 -eq 1 ] ; then
+		gpasswd -a nginx shibd
+	fi
 	if [ $1 -gt 1 ] ; then
 		systemctl daemon-reload
 	fi
@@ -347,6 +392,10 @@
 %if "%{_vendor}" == "redhat" || "%{_vendor}" == "amazon"
 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
 	%systemd_preun shibd.service
+	%systemd_preun shibfcgi.service
+	if [ $1 -eq 0 ] ; then
+		gpasswd -d nginx sh<PASSWORD>
+	fi
 %else
 	if [ $1 -eq 0 ] ; then
 		/sbin/service shibd stop >/dev/null 2>&1
@@ -377,6 +426,7 @@
 	# On upgrade, restart components if they're already running.
 %if 0%{?rhel} >= 7 || 0%{?centos_version} >= 700
 	%systemd_postun_with_restart shibd.service
+	%systemd_postun_with_restart shibfcgi.service
 %else
 	if [ $1 -ge 1 ] ; then
 		/sbin/service shibd status 1>/dev/null && /sbin/service shibd restart 1>/dev/null
@@ -391,7 +441,7 @@
 %if 0%{?suse_version} >= 1210
 	%service_del_postun shibd.service
 %else
-	cd / 
+	cd /
 	%restart_on_update shibd
 	%{insserv_cleanup}
 %endif
@@ -526,7 +576,7 @@
 * Sun Jun 26 2011  <NAME>  <<EMAIL>>  - 2.4.3-1
 - Log files shouldn't be world readable.
 - Explicit requirement for libcurl-openssl on RHEL6
-- Uncomment LD_LIBRARY_PATH in init script for RHEL6 
+- Uncomment LD_LIBRARY_PATH in init script for RHEL6
 - Remove rpath from binaries for RHEL6
 
 * Fri Dec 25 2009  <NAME>  <<EMAIL>>  - 2.4-1
{'fraction_non_alphanumeric': 0.1666107194808101, 'fraction_numerical': 0.053933087165715564, 'mean_word_length': 4.986604152712659, 'pattern_counts': {'":': 0, '<': 28, '<?xml version=': 0, '>': 72, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 4, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '621176', 'n_tokens_mistral': 4348, 'n_tokens_neox': 3881, 'n_words': 665}