Trial RPM packaging for 2.5

[Cantor, Scott]

2.5 is nowhere close to a release, but I've started work on the packaging
side instead of the feature side to give all the people objecting to
current behavior a chance to test and report bugs.

I'm posting this to users, because most of the complaints were here, but
please direct any follow up to dev (my mail client doesn't let me set
Reply-To), or you can file issues in Jira.

The test packages, which include unreleased library versions as well, are
in these repositories, which should not be used for production servers.

http://download.opensuse.org/repositories/home:/Scott_Cantor/

The eventual "real" 2.5 will NOT be upgradeable from these packages, the
revisions won't line up.

The changes to the shibboleth package are:

- /etc/httpd/shib.conf is left alone
- default logo and style sheet for errors moved to /usr/share/shibboleth
- shibd user/group created and used to run shibd service
- ownership of /var/run|log/shibboleth and contents changed to shibd
- ownership of key/cert changed to shibd

A word about the older Alias commands in shib.conf:

On Red Hat, Alias commands that match older installed Aliases referring to
main.css and logo.jpg are converted in place to the newer location that
won't change across versions. That's the only change to an existing
shib.conf that will be made, and it's safe, because people shouldn't be
editing files in /usr/share to use their own files.

On SUSE, I can't do that fixup. The build service won't allow it because
it's a packaged file and %post scripts can't change packaged files. As a
result, that is a breaking result across this upgrade. That's the best I
can do if I mark shib.conf noreplace. Complaints directed to
www.opensuse.org.

What's left is to move the changeable content in the shibd init script to
a sysconfig file. Once that's done, it should be possible to change the
user shibd runs as to a fixed value the package doesn't know about instead
of requiring the shibd user.

-- Scott