security/dogtag-pki: Add CPE information

Sponsored by: Netzkommune GmbH

security/dogtag-pki: Set the boot flag with sysrc

create_rc_service() wrote <instance>_enable="YES" into rc.conf.d, which is
read after rc.conf and therefore overrode sysrc. The instance started at boot
whatever the administrator had set, and under FreeIPA it came up before the
Directory Server it needs. The flag now goes to rc.conf through sysrc.

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: convert OpenLDAP dependency to USES=ldap

Replace hardcoded libldap.so:net/openldap26-client in LIB_DEPENDS
with USES=ldap, letting the framework handle version selection.

PR:		ports/297779
Approved by:	maintainer (joneum)

security/dogtag-pki: Fix incomplete javac classpath

base/tomcat-9.0 compiles against pki-common, whose classes carry
@JsonInclude, but does not list jackson-annotations, so javac cannot
resolve the annotation.  Every other subproject already lists the jar.

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: Update to 11.10.1

Switch to Java 21.

Adapt the FreeBSD parts to the reworked upstream tree: guard the SELinux
import and its call sites, replace the remaining runuser call with
subprocess privilege switching, and pass APP_SERVER_CM through the
environment, which 11.10 reads instead of the CMake define.

Give pki-tomcatd a bounded stop.  jsvc records the pid of its child in
the pidfile while the parent handles SIGTERM, and Tomcat can deadlock in
JSS while closing LDAP connections, so rc(8) would wait forever and
stall the system shutdown.

Changes:	https://github.com/dogtagpki/pki/releases

Sponsored by:		Netzkommune GmbH

security/dogtag-pki: bound the rc onestop call during pkidestroy

The Tomcat stop path called `service <instance> onestop` and blocked on
rc.subr's wait_for_pids() indefinitely when the jsvc/JVM did not exit
(e.g. a wedged webapp during pkidestroy). Bound the call with a timeout
and fall back to SIGKILL so pkidestroy/uninstall can never hang.

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: Enable ACME support and improve rc integration

Enable the ACME responder that was previously disabled in the port:

* Build with WITH_ACME and install the ACME webapp, configuration
  templates (database, issuer, realm, engine), the pki-acme-run
  script and pki-acme.jar
* Patch hardcoded Linux paths in the ACME components to their
  FreeBSD locations (/usr/local/share/pki, /var/db/pki)
* Link jaxb-api.jar and javax.activation-api.jar into the server
  common libs, required by the ACME webapp at runtime

Improve the FreeBSD rc.d integration:

* Generate java_opts and PKI_VERSION for the rc service directly
  from the instance's tomcat.conf instead of referencing an
  environment file
* Add remove_rc_service() to cleanly remove the rc script, the
  service configuration and the rc.conf knob when an instance is
  destroyed, and use it in the instance removal scriptlet

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: Rework server and CA packaging

* Add the Java 17 build for the Dogtag server and CA components.
* Install the Dogtag server, CA, Tomcat, tools and web application JARs.
* Add the Java, REST, LDAP, JSS and Tomcat dependencies required by
  the server runtime.
* Install pkispawn, pkidestroy, pkidaemon and pki-server.
* Add the pkiuser user and group.
* Install the server and CA configuration templates, upgrade data,
  registry files, web applications and runtime library links.
* Generate and install the Dogtag VERSION file.
* Adapt the server tools, configuration and Tomcat integration to the
  FreeBSD filesystem layout.
* Replace systemd-specific service handling with FreeBSD rc.conf and
  Tomcat multi-instance service support.
* Update pkg-plist for the expanded server and CA runtime.

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: Add pkiuser account

Create the pkiuser system account required by Dogtag PKI.

security/dogtag-pki: Fix PKI version file path

Read share/pki/VERSION from LOCALBASE instead of the Linux
/usr/share/pki path.

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: Install PKI version file

Install share/pki/VERSION so the Python pki module can determine
the Dogtag PKI specification version at runtime.

Sponsored by:	Netzkommune GmbH

security/dogtag-pki: Add new Port

Dogtag PKI is an enterprise-class open source certificate system
providing Certificate Authority, Key Recovery Authority, OCSP,
and other PKI services.

This port installs the Dogtag PKI Python client and server modules.
It is required by the upcoming net/freeipa-server port.

WWW: https://www.dogtagpki.org/

Sponsored by:	Netzkommune GmbH