IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-26 08:51:50 -06:00
Code Issues Packages Projects Releases Wiki Activity
6c061b6836
freeipa/freeipa.spec.in

1561 lines
55 KiB
RPMSpec
Raw Normal View History

freeipa.spec.in: move ipa CLI utility to freeipa-client There is no notable package size cost, as all the libraries and packages are already in the freeipa-client package and freeipa-admintools only contained a short shim calling this code. Move /bin/ipa to freeipa-client, along with a man page and bash completion. Resolves: https://fedorahosted.org/freeipa/ticket/5934 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-25 03:59:34 -05:00
# Define ONLY_CLIENT to only make the ipa-client and ipa-python
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
# subpackages
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
spec file: support client-only build nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 01:48:29 -05:00
%if %{ONLY_CLIENT}
%global enable_server_option --disable-server
%else
%global enable_server_option --enable-server
%endif
Add a separate client-only target
2009-10-12 15:00:00 -05:00
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
# Build with ipatests
%if ! %{ONLY_CLIENT}
%global with_ipatests 1
%endif
%if 0%{?with_ipatests}
%global with_ipatests_option --with-ipatests
%else
%global with_ipatests_option --without-ipatests
%endif
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%if 0%{?rhel}
%global with_python3 0
%else
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%global with_python3 1
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%endif
spec file: do not include BuildRequires for lint by default Lint is never executed from rpmbuild, so the BuildRequires for lint are purely informational. Include them only if %with_lint RPM macro is specified. Update .travis.yml accordingly. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:27:16 -05:00
# lint is not executed during rpmbuild
spec file: do not define with_lint inside a comment RPM expands macros even inside comments in spec files, so the with_lint macro is unintentionally always defined. Escape the percent sign in '%global' in the comment to prevent this. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-12-05 05:17:54 -06:00
# %%global with_lint 1
SPEC: Fix build in mock Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-11 08:02:09 -06:00
%if 0%{?with_lint}
Make pylint and jsl optional ./configure no longer fails when pylint or jsl are not available. The make targets for pylint and jsl are no longer defined without the tools. Rational: pylint and jsl are not required to build FreeIPA. Both are useful developer tools. It's more user friendly to make both components optionally with default config arguments. There is no reason to fail building on a build system without development tools. It's still possible to enforce dependency checks with --with-jslint and --enable-pylint. https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-02-22 12:19:35 -06:00
%global linter_options --enable-pylint --with-jslint
SPEC: Fix build in mock Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-11 08:02:09 -06:00
%else
Make pylint and jsl optional ./configure no longer fails when pylint or jsl are not available. The make targets for pylint and jsl are no longer defined without the tools. Rational: pylint and jsl are not required to build FreeIPA. Both are useful developer tools. It's more user friendly to make both components optionally with default config arguments. There is no reason to fail building on a build system without development tools. It's still possible to enforce dependency checks with --with-jslint and --enable-pylint. https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-02-22 12:19:35 -06:00
%global linter_options --disable-pylint --without-jslint
SPEC: Fix build in mock Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-11 08:02:09 -06:00
%endif
spec file: do not include BuildRequires for lint by default Lint is never executed from rpmbuild, so the BuildRequires for lint are purely informational. Include them only if %with_lint RPM macro is specified. Update .travis.yml accordingly. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:27:16 -05:00
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
%global alt_name ipa
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
%if 0%{?rhel}
spec file: bump krb5 Requires for certauth fixes Bump krb5-* Requires to the version which includes the final version of certauth support. https://pagure.io/freeipa/issue/4905 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-25 07:35:34 -05:00
# 1.15.1-7: certauth (http://krbdev.mit.edu/rt/Ticket/Display.html?id=8561)
%global krb5_version 1.15.1-4
spec file: bump python-netaddr Requires Bump python-netaddr Requires to the version which has correct private and reserved IPv4 address ranges. This fixes DNS server install failure when 0.0.0.0 is entered as a forwarder. https://pagure.io/freeipa/issue/6894 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-25 07:13:00 -05:00
# 0.7.16: https://github.com/drkjam/netaddr/issues/71
%global python_netaddr_version 0.7.5-8
Bump samba version for FIPS and priv. separation With the latest Samba, adding trusts to AD under FIPS should now work as well as adding trusts as a whole after the privilege separation rework. https://pagure.io/freeipa/issue/6671 https://pagure.io/freeipa/issue/6697 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-24 08:47:38 -05:00
# Require 4.6.0-4 which brings RC4 for FIPS + trust fixes to priv. separation
%global samba_version 4.6.0-4
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
%global selinux_policy_version 3.12.1-153
support multiple uid values in schema compatibility tree https://fedorahosted.org/freeipa/ticket/6138 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2016-08-04 01:58:50 -05:00
%global slapi_nis_version 0.56.0-4
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
%else
spec file: bump krb5 Requires for certauth fixes Bump krb5-* Requires to the version which includes the final version of certauth support. https://pagure.io/freeipa/issue/4905 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-25 07:35:34 -05:00
# 1.15.1-7: certauth (http://krbdev.mit.edu/rt/Ticket/Display.html?id=8561)
%global krb5_version 1.15.1-7
spec file: bump python-netaddr Requires Bump python-netaddr Requires to the version which has correct private and reserved IPv4 address ranges. This fixes DNS server install failure when 0.0.0.0 is entered as a forwarder. https://pagure.io/freeipa/issue/6894 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-25 07:13:00 -05:00
# 0.7.16: https://github.com/drkjam/netaddr/issues/71
%global python_netaddr_version 0.7.16
Bump samba version for FIPS and priv. separation With the latest Samba, adding trusts to AD under FIPS should now work as well as adding trusts as a whole after the privilege separation rework. https://pagure.io/freeipa/issue/6671 https://pagure.io/freeipa/issue/6697 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-24 08:47:38 -05:00
# Require 4.6.0-4 which brings RC4 for FIPS + trust fixes to priv. separation
%global samba_version 2:4.6.0-4
replica promotion: fix AVC denials in remote connection check Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-01-15 01:07:21 -06:00
%global selinux_policy_version 3.13.1-158.4
support multiple uid values in schema compatibility tree https://fedorahosted.org/freeipa/ticket/6138 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2016-08-04 01:58:50 -05:00
%global slapi_nis_version 0.56.1
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
%endif
spec file: Update minimum required version of krb5 Automatically require the krb5 version used at build time. https://fedorahosted.org/freeipa/ticket/5132 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-15 03:45:53 -05:00
%define krb5_base_version %(LC_ALL=C rpm -q --qf '%%{VERSION}' krb5-devel | grep -Eo '^[^.]+\.[^.]+')
Replace uses of %define with %global in the .spec file Fixes rawhide builds per https://www.redhat.com/archives/fedora-devel-list/2010-January/msg00093.html Contributed by Nalin Dahyabhai
2010-01-07 13:12:52 -06:00
%global plugin_dir %{_libdir}/dirsrv/plugins
provide dedicated ccache file for httpd httpd service stores Kerberos credentials in kernel keyring which gets destroyed and recreated during service install/upgrade, causing problems when the process is run under SELinux context other than 'unconfined_t'. This patch enables HTTPInstance to set up a dedicated CCache file for Apache to store credentials. https://fedorahosted.org/freeipa/ticket/4973 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-04-28 09:24:02 -05:00
%global etc_systemd_dir %{_sysconfdir}/systemd/system
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%global gettext_domain ipa
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
Use hardening flags for ipa-optd. https://fedorahosted.org/freeipa/ticket/4010
2013-11-27 07:13:16 -06:00
%define _hardened_build 1
Build: move version handling from Makefile to configure Version information is now in VERSION.m4 instead of VERSION. Makefile target version-update was minimized and configure can be run before make. Makefile temporarily contains hardcoded version which has to match the one specified in VERSION.m4. This is preparatory step which will allow us to replace hand-made Makefile with one generated by Automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-21 15:35:28 -05:00
# Work-around fact that RPM SPEC parser does not accept
# "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
%define IPA_VERSION @VERSION@
%define AT_SIGN @
# redefine IPA_VERSION only if its value matches the Autoconf placeholder
%if "%{IPA_VERSION}" == "%{AT_SIGN}VERSION%{AT_SIGN}"
%define IPA_VERSION nonsense.to.please.RPM.SPEC.parser
%endif
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
Name: freeipa
Build: move version handling from Makefile to configure Version information is now in VERSION.m4 instead of VERSION. Makefile target version-update was minimized and configure can be run before make. Makefile temporarily contains hardcoded version which has to match the one specified in VERSION.m4. This is preparatory step which will allow us to replace hand-made Makefile with one generated by Automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-21 15:35:28 -05:00
Version: %{IPA_VERSION}
spec file: revert to the previous Release tag Revert from the current Release tag value `upstream` to the previously used `0%{?dist}`, because: * `0` sorts before `1`, which is usually used as the initial release number in downstream packages, * the information provided by `%{?dist}` is useful, as packages built on one OS are not always installable on another OS. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-12-05 05:18:54 -06:00
Release: 0%{?dist}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Summary: The Identity, Policy and Audit system
Group: System Environment/Base
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
License: GPLv3+
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
URL: http://www.freeipa.org/
Source0: freeipa-%{version}.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: openldap-devel
ipa-kdb: support KDB DAL version 6.1 DAL version 6.0 removed support for a callback to free principal. This broke KDB drivers which had complex e_data structure within the principal structure. As result, FreeIPA KDB driver was leaking memory with DAL version 6.0 (krb5 1.15). DAL version 6.1 added a special callback for freeing e_data structure. See details at krb5/krb5#596 Restructure KDB driver code to provide this callback in case we are built against DAL version that supports it. For DAL version prior to 6.0 use this callback in the free_principal callback to tidy the code. Use explicit KDB version dependency in Fedora 26+ via BuildRequires. With new DAL version, freeipa package will fail to build and we'll have to add a support for new DAL version explicitly. https://fedorahosted.org/freeipa/ticket/6619 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2017-01-24 03:02:30 -06:00
# For KDB DAL version, make explicit dependency so that increase of version
# will cause the build to fail due to unsatisfied dependencies.
# DAL version change may cause code crash or memory leaks, it is better to fail early.
%if 0%{?fedora} > 25
BuildRequires: krb5-kdb-version = 6.1
%endif
spec file: bump krb5 Requires for certauth fixes Bump krb5-* Requires to the version which includes the final version of certauth support. https://pagure.io/freeipa/issue/4905 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-25 07:35:34 -05:00
BuildRequires: krb5-devel >= %{krb5_version}
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
# 1.27.4: xmlrpc_curl_xportparms.gssapi_delegation
Fix client enrollment Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
2011-08-11 03:42:29 -05:00
BuildRequires: xmlrpc-c-devel >= 1.27.4
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: popt-devel
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
BuildRequires: autoconf
BuildRequires: automake
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: libtool
BuildRequires: gettext
Build: use standard infrastructure for translations We now use standard framework generatedby "gettextize" utility. It has two limitations which I do not consider sufficiently important to invest into hand-made solution: 1. It can automatically gather strings only from files which have some file extension like .c or .py. Right now we do not have any translatable strings in Python files without extensions. Given that these files will be removed from source tree and replaced with entry points from setuptools I do not see a reason to invest into supporting this. 2. It does not automatically strip untranslated strings from po files. This is a manual step in mainteiner's in workflow anyway so I will add separate Makefile target for it later on. This commit contains gettextize instrastructure + filled-in files Makevars and POTFILES.in. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-11-11 15:54:13 -06:00
BuildRequires: gettext-devel
Move some BuildRequires so building with ONLY_CLIENT works. ticket 978
2011-02-21 12:04:38 -06:00
BuildRequires: python-devel
spec file: add unconditional python-setuptools BuildRequires python-setuptools is required not only for lint, but to make the build possible at all. Move the python-setuptools BuildRequires from the lint section to the main section. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-03-14 13:55:38 -05:00
BuildRequires: python-setuptools
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
%if 0%{?with_python3}
BuildRequires: python3-devel
spec file: add unconditional python-setuptools BuildRequires python-setuptools is required not only for lint, but to make the build possible at all. Move the python-setuptools BuildRequires from the lint section to the main section. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-03-14 13:55:38 -05:00
BuildRequires: python3-setuptools
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
%endif # with_python3
# %{_unitdir}, %{_tmpfilesdir}
BuildRequires: systemd
Build: create /var/run directories at install time Directory creating was moved from SPEC file to install-data-hook. At the same time, it is using systemd-tmpfiles to create the directories so we do not risk any inconsistency between SPEC file and tmpfilesd configuration. systemd-tmpfiles call is non-critical on purpose: The build would fail when run under unprivileged user because systemd-tmpfiles tries to change ownership. Luckily it creates all the files and just do not change ownership so it works even under unprivileged user. Interestingly, systemd-tmpfiles continues if user does not have sufficient permissions to change ownership but fails if target username does not exist at all. For this reason there is BuildRequires on httpd. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 09:19:51 -05:00
# systemd-tmpfiles which is executed from make install requires apache user
BuildRequires: httpd
spec file: support client-only build nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 01:48:29 -05:00
BuildRequires: nspr-devel
BuildRequires: nss-devel
BuildRequires: openssl-devel
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: libini_config-devel
BuildRequires: cyrus-sasl-devel
%if ! %{ONLY_CLIENT}
# 1.3.3.9: DS_Sleep (https://fedorahosted.org/389/ticket/48005)
BuildRequires: 389-ds-base-devel >= 1.3.3.9
BuildRequires: svrcore-devel
%if 0%{?rhel}
BuildRequires: samba-devel >= 4.0.0
%else
BuildRequires: samba-devel >= 2:4.0.0
%endif
BuildRequires: libtalloc-devel
BuildRequires: libtevent-devel
BuildRequires: libuuid-devel
Add external domain extop DS plugin This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
2011-11-30 06:29:10 -06:00
BuildRequires: libsss_idmap-devel
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
BuildRequires: libsss_certmap-devel
spec file: bump libsss_nss_idmap-devel BuildRequires Bump BuildRequires on libsss_nss_idmap-devel to the version which introduces the sss_nss_getlistbycert function. This fixes RPM build failure when an older version of libsss_nss_idmap-devel was installed. https://pagure.io/freeipa/issue/6828 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-03-29 02:14:24 -05:00
# 1.15.3: sss_nss_getlistbycert (https://pagure.io/SSSD/sssd/issue/3050)
BuildRequires: libsss_nss_idmap-devel >= 1.15.3
Add missing dependency We use Java classes which are bundled with rhino when uglifying Javascript sources at build-time, so we need rhino at build-time. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-03-13 16:09:49 -05:00
BuildRequires: rhino
Add the krb5/FreeIPA RADIUS companion daemon This daemon listens for RADIUS packets on a well known UNIX domain socket. When a packet is received, it queries LDAP to see if the user is configured for RADIUS authentication. If so, then the packet is forwarded to the 3rd party RADIUS server. Otherwise, a bind is attempted against the LDAP server. https://fedorahosted.org/freeipa/ticket/3366 http://freeipa.org/page/V3/OTP
2013-04-11 13:03:25 -05:00
BuildRequires: libverto-devel
Use libunistring ulc_casecmp() on unicode strings https://fedorahosted.org/freeipa/ticket/3772
2013-07-16 10:47:27 -05:00
BuildRequires: libunistring-devel
RCUE initial commit https://fedorahosted.org/freeipa/ticket/3902
2013-10-10 06:41:31 -05:00
BuildRequires: python-lesscpy
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
%endif # ONLY_CLIENT
#
# Build dependencies for makeapi/makeaci
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
# makeapi/makeaci is using Python 2 only for now
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
#
ipaserver: remove ipalib import from setup.py Instead of importing ipalib to get IPA version string, create setup.py from a template and have the version string automatically filled in. This makes it possible to build the ipaserver package without having to have ipalib dependencies installed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 05:52:08 -05:00
BuildRequires: python-ldap
BuildRequires: python-netaddr
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: python-pyasn1
Add python-pyasn1-modules into dependencies Python-pyasn1-modules is needed because of this import: from pyasn1_modules import rfc2459 in ipalib/x509.py. Python-pyasn1-modules is required only by python-ldap package, but it would be good to not rely on another package and rather say explicitely that this package is necessary. https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-12-02 10:09:48 -06:00
BuildRequires: python-pyasn1-modules
ipaserver: remove ipalib import from setup.py Instead of importing ipalib to get IPA version string, create setup.py from a template and have the version string automatically filled in. This makes it possible to build the ipaserver package without having to have ipalib dependencies installed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 05:52:08 -05:00
BuildRequires: python-dns
BuildRequires: python-six
add python-libsss_nss_idmap and python-sss to BuildRequires This fixes pylint failing on import errors during 'lint' phase of build. https://fedorahosted.org/freeipa/ticket/6244 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-08-22 10:58:38 -05:00
BuildRequires: python-libsss_nss_idmap
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: python-cffi
Add python-wheel as build requirement Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-17 10:46:20 -06:00
#
Add with_wheels global to install wheel and PyPI packaging dependencies Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-22 02:21:35 -06:00
# Build dependencies for wheel packaging and PyPI upload
Add python-wheel as build requirement Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-17 10:46:20 -06:00
#
Don't hard-code with_wheels Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-04-03 03:04:04 -05:00
%if 0%{?with_wheels}
Add an option to build ipaserver wheels To create a wheel bundle with ipaserver and its dependencies: make wheel_bundle IPA_SERVER_WHEELS=1 To include additional dependencies: make wheel_bundle IPA_EXTRA_WHEELS=ipatests[webui] Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-01-17 05:16:25 -06:00
BuildRequires: dbus-glib-devel
tox testing support for client wheel packages Add tox infrastructure to test client wheel packages workflow: * build client packages * install client packages * ipa-run-tests --ipaclient-unittests under Python 2 and 3 * pylint of client packages under Python 2 and 3 * placeholder packages work as expected Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-17 09:43:17 -06:00
BuildRequires: libffi-devel
BuildRequires: python-tox
Add with_wheels global to install wheel and PyPI packaging dependencies Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-22 02:21:35 -06:00
BuildRequires: python2-twine
Add python-wheel as build requirement Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-17 10:46:20 -06:00
BuildRequires: python2-wheel
%if 0%{?with_python3}
tox testing support for client wheel packages Add tox infrastructure to test client wheel packages workflow: * build client packages * install client packages * ipa-run-tests --ipaclient-unittests under Python 2 and 3 * pylint of client packages under Python 2 and 3 * placeholder packages work as expected Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-17 09:43:17 -06:00
BuildRequires: python3-tox
Add with_wheels global to install wheel and PyPI packaging dependencies Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-22 02:21:35 -06:00
BuildRequires: python3-twine
Add python-wheel as build requirement Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-17 10:46:20 -06:00
BuildRequires: python3-wheel
%endif
Add with_wheels global to install wheel and PyPI packaging dependencies Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-22 02:21:35 -06:00
%endif # with_wheels
Add python-wheel as build requirement Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-17 10:46:20 -06:00
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
#
# Build dependencies for lint
#
spec file: do not include BuildRequires for lint by default Lint is never executed from rpmbuild, so the BuildRequires for lint are purely informational. Include them only if %with_lint RPM macro is specified. Update .travis.yml accordingly. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:27:16 -05:00
%if 0%{?with_lint}
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: samba-python
certdb: use certutil and match_hostname for cert verification Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-02 06:53:18 -06:00
# 1.6: x509.Name.rdns (https://github.com/pyca/cryptography/issues/3199)
BuildRequires: python-cryptography >= 1.6
Require python-gssapi >= 1.2.0 The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 04:01:57 -06:00
BuildRequires: python-gssapi >= 1.2.0
pylint: bump dependency to version >= 1.6 Older pylint versions produces false positive errors Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-10 08:57:42 -06:00
BuildRequires: pylint >= 1.6
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
# workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1096506
BuildRequires: python2-polib
makeapi, makeaci: do not fail on missing imports Add import hook to makeapi and makeaci which makes them ignore import errors in modules in our source tree and instead print a warning. This makes it possible to build IPA without having to have most of our runtime dependencies installed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 06:36:12 -05:00
BuildRequires: python-libipa_hbac
BuildRequires: python-lxml
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
# 5.0.0: QRCode.print_ascii
BuildRequires: python-qrcode-core >= 5.0.0
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
# 1.15: python-dns changed return type in to_text() method in PY3
BuildRequires: python-dns >= 1.15
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: jsl
BuildRequires: python-yubico
makeapi, makeaci: do not fail on missing imports Add import hook to makeapi and makeaci which makes them ignore import errors in modules in our source tree and instead print a warning. This makes it possible to build IPA without having to have most of our runtime dependencies installed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 06:36:12 -05:00
# pki Python package
pki-base: use pki-base-python2 as dependency pki-base provides pki-base-python2, but we should depend directly on pki-base-python2 because in future pki-base may provide pki-base-python3 instead. Source: cheimes@redhat.com https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-15 10:20:35 -06:00
BuildRequires: pki-base-python2
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: python-pytest-multihost
BuildRequires: python-pytest-sourceorder
BuildRequires: python-jwcrypto
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
BuildRequires: python-custodia >= 0.3.1
makeapi, makeaci: do not fail on missing imports Add import hook to makeapi and makeaci which makes them ignore import errors in modules in our source tree and instead print a warning. This makes it possible to build IPA without having to have most of our runtime dependencies installed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 06:36:12 -05:00
BuildRequires: dbus-python
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: python-dateutil
install: use standard Python classes to declare knob types Use type(None) rather than bool to define knobs which are represented as command line flags. This allows declaring both "--option" and "--option={0,1}"-style command line options. Use enum.Enum subclasses instead of set literals to declare enumerations. Use typing.List[T] instead of (list, T) to declare lists. (Note that a minimal reimplementation of typing.List is used instead of the Python 2 backport of the typing module due to non-technical reasons.) Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP addresses. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-07 07:01:10 -06:00
BuildRequires: python-enum34
makeapi, makeaci: do not fail on missing imports Add import hook to makeapi and makeaci which makes them ignore import errors in modules in our source tree and instead print a warning. This makes it possible to build IPA without having to have most of our runtime dependencies installed. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 06:36:12 -05:00
BuildRequires: python-netifaces
add python-libsss_nss_idmap and python-sss to BuildRequires This fixes pylint failing on import errors during 'lint' phase of build. https://fedorahosted.org/freeipa/ticket/6244 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-08-22 10:58:38 -05:00
BuildRequires: python-sss
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
BuildRequires: python-sss-murmur
BuildRequires: python-sssdconfig
BuildRequires: python-nose
BuildRequires: python-paste
BuildRequires: systemd-python
csrgen: Add code to generate scripts that generate CSRs Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-05 13:19:35 -05:00
BuildRequires: python2-jinja2
Turn on NSSOCSP check in mod_nss conf Turn on NSSOCSP directive during install/replica install/upgrade. That check whether the certificate which is used for login is revoked or not using OSCP. Marks the server cert in httpd NSS DB as trusted peer ('P,,') to avoid chicken and egg problem when it is needed to contact the OCSP responder when httpd is starting. https://pagure.io/freeipa/issue/6370 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-06 09:15:47 -05:00
BuildRequires: python-augeas
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
%if 0%{?with_python3}
# FIXME: this depedency is missing - server will not work
#BuildRequires: python3-samba
certdb: use certutil and match_hostname for cert verification Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-02 06:53:18 -06:00
# 1.6: x509.Name.rdns (https://github.com/pyca/cryptography/issues/3199)
BuildRequires: python3-cryptography >= 1.6
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
BuildRequires: python3-gssapi >= 1.2.0
pylint: bump dependency to version >= 1.6 Older pylint versions produces false positive errors Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-10 08:57:42 -06:00
BuildRequires: python3-pylint >= 1.6
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
# workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1096506
BuildRequires: python3-polib
BuildRequires: python3-libipa_hbac
BuildRequires: python3-memcached
BuildRequires: python3-lxml
# 5.0.0: QRCode.print_ascii
BuildRequires: python3-qrcode-core >= 5.0.0
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
# 1.15: python-dns changed return type in to_text() method in PY3
BuildRequires: python3-dns >= 1.15
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
BuildRequires: python3-yubico
# pki Python package
pki: add missing depedency pki-base[-python3] FreeIPA server modules requires pki module https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 05:28:25 -06:00
BuildRequires: pki-base-python3
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
BuildRequires: python3-pytest-multihost
BuildRequires: python3-pytest-sourceorder
BuildRequires: python3-jwcrypto
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
# 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
BuildRequires: python3-custodia >= 0.3.1
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
BuildRequires: python3-dbus
BuildRequires: python3-dateutil
BuildRequires: python3-enum34
BuildRequires: python3-netifaces
BuildRequires: python3-sss
BuildRequires: python3-sss-murmur
BuildRequires: python3-sssdconfig
BuildRequires: python3-libsss_nss_idmap
BuildRequires: python3-nose
BuildRequires: python3-paste
BuildRequires: python3-systemd
csrgen: Add code to generate scripts that generate CSRs Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-05 13:19:35 -05:00
BuildRequires: python3-jinja2
Turn on NSSOCSP check in mod_nss conf Turn on NSSOCSP directive during install/replica install/upgrade. That check whether the certificate which is used for login is revoked or not using OSCP. Marks the server cert in httpd NSS DB as trusted peer ('P,,') to avoid chicken and egg problem when it is needed to contact the OCSP responder when httpd is starting. https://pagure.io/freeipa/issue/6370 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-06 09:15:47 -05:00
BuildRequires: python3-augeas
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
%endif # with_python3
spec file: do not include BuildRequires for lint by default Lint is never executed from rpmbuild, so the BuildRequires for lint are purely informational. Include them only if %with_lint RPM macro is specified. Update .travis.yml accordingly. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:27:16 -05:00
%endif # with_lint
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
#
SPEC: Run cmocka based unit test in %check phase This patch also consolidate build dependencies for c based unit tests Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-13 01:11:38 -06:00
# Build dependencies for unit tests
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
#
%if ! %{ONLY_CLIENT}
SPEC: Run cmocka based unit test in %check phase This patch also consolidate build dependencies for c based unit tests Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-13 01:11:38 -06:00
BuildRequires: libcmocka-devel
BuildRequires: nss_wrapper
ipa-kdb: Fix unit test after packaging changes in krb5 Resolves: https://fedorahosted.org/freeipa/ticket/6173 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-08-05 01:34:23 -05:00
# Required by ipa_kdb_tests
BuildRequires: %{_libdir}/krb5/plugins/kdb/db2.so
spec file: clean up BuildRequires Add missing cyrus-sasl-devel, python-cffi, python-custodia, python-dateutil, python-nose, python-paste, python-sss-murmur, python-sssdconfig and systemd-python BuildRequires. Remove unused custodia, java-headless, m4, policycoreutils, python-kdcproxy, python-rhsm, pyOpenSSL and systemd-units BuildRequires. Correct versioned BuildRequires and provide explanatory comments. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 06:20:32 -05:00
%endif # ONLY_CLIENT
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description
Update FreeIPA package description https://fedorahosted.org/freeipa/ticket/5284 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-09-21 08:56:36 -05:00
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package server
Summary: The IPA authentication server
Group: System Environment/Base
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-server-common = %{version}-%{release}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: %{name}-client = %{version}-%{release}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-common = %{version}-%{release}
Requires: python2-ipaserver = %{version}-%{release}
spec file: bump minimal required version of 389-ds-base Require 389-ds-base >= 1.3.5.14 for: https://fedorahosted.org/389/ticket/48992 https://fedorahosted.org/freeipa/ticket/6369 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-01 05:36:30 -05:00
Requires: 389-ds-base >= 1.3.5.14
Fix SASL_NOCANON behavior for LDAPI Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for socket based connections (#960222).
2013-05-10 06:50:21 -05:00
Requires: openldap-clients > 2.4.35-4
Require version of NSS that properly parses base64-encoded certs There were cases where a base64-encoded cert with no header/footer would not be handled properly and rejected. This was causing the CA install to fail. https://fedorahosted.org/freeipa/ticket/3586
2013-04-26 11:36:05 -05:00
Requires: nss >= 3.14.3-12.0
Requires: nss-tools >= 3.14.3-12.0
spec file: bump krb5 Requires for certauth fixes Bump krb5-* Requires to the version which includes the final version of certauth support. https://pagure.io/freeipa/issue/4905 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-25 07:35:34 -05:00
Requires(post): krb5-server >= %{krb5_version}
spec file: Update minimum required version of krb5 Automatically require the krb5 version used at build time. https://fedorahosted.org/freeipa/ticket/5132 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-15 03:45:53 -05:00
Requires(post): krb5-server >= %{krb5_base_version}, krb5-server < %{krb5_base_version}.100
spec file: bump krb5 Requires for certauth fixes Bump krb5-* Requires to the version which includes the final version of certauth support. https://pagure.io/freeipa/issue/4905 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-25 07:35:34 -05:00
Requires: krb5-pkinit-openssl >= %{krb5_version}
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
Requires: cyrus-sasl-gssapi%{?_isa}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: ntp
Require httpd 2.4.6-31 with mod_proxy Unix socket support httpd 2.4.6-6 does not support mod_proxy ProxyPass for Unix sockets. The feature is provided by 2.4.7 upstream was backported to 2.4.6-31 (bz1168081). It's required to proxy Custodia. https://bugzilla.redhat.com/show_bug.cgi?id=1168081 https://httpd.apache.org/docs/trunk/mod/mod_proxy.html#proxypass https://fedorahosted.org/freeipa/ticket/6251 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 05:28:47 -05:00
Requires: httpd >= 2.4.6-31
Run ipaserver under mod_wsgi
2010-02-24 12:29:23 -06:00
Requires: mod_wsgi
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
Requires: mod_auth_gssapi >= 1.5.0
spec file: Bump requires to make Certificate Login in WebUI work gssproxy >= 0.7.0-2 - fixes impersonator checking mod_lookup_identity >= 0.9.9 - adds support for single certificate assigned to multiple users mod_nss >= 1.0.14-3 - no longer sets remote user in fixup hook sssd-dbus >= 1.15.2 - adds FindByNameAndCertificate DBus method https://pagure.io/freeipa/issue/6823 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-23 02:43:51 -05:00
# 1.0.14-3: https://bugzilla.redhat.com/show_bug.cgi?id=1431206
Requires: mod_nss >= 1.0.14-3
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
Requires: mod_session
spec file: Bump requires to make Certificate Login in WebUI work gssproxy >= 0.7.0-2 - fixes impersonator checking mod_lookup_identity >= 0.9.9 - adds support for single certificate assigned to multiple users mod_nss >= 1.0.14-3 - no longer sets remote user in fixup hook sssd-dbus >= 1.15.2 - adds FindByNameAndCertificate DBus method https://pagure.io/freeipa/issue/6823 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-23 02:43:51 -05:00
# 0.9.9: https://github.com/adelton/mod_lookup_identity/pull/3
Requires: mod_lookup_identity >= 0.9.9
FIX: ldap schmema updater needs correct ordering of the updates Required bugfix in python-ldap 2.4.15 Updates must respect SUP objectclasses/attributes and update dependencies first Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-23 07:42:33 -05:00
Requires: python-ldap >= 2.4.15
Require python-gssapi >= 1.2.0 The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 04:01:57 -06:00
Requires: python-gssapi >= 1.2.0
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: acl
Remove syslog.target from ipa.server This required target is no longer needed as systemd from version 38 has its own journal which is also in the basic set of service unit requirementes. https://fedorahosted.org/freeipa/ticket/3511
2013-03-27 08:58:16 -05:00
Requires: systemd-units >= 38
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
Requires(pre): shadow-utils
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
Requires(pre): systemd-units
Requires(post): systemd-units
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
Requires: selinux-policy >= %{selinux_policy_version}
spec file: Add Requires(post) on selinux-policy This prevents ipa-server-upgrade failures on SELinux AVCs because of old selinux-policy version. https://fedorahosted.org/freeipa/ticket/5256 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-08-25 07:14:25 -05:00
Requires(post): selinux-policy-base >= %{selinux_policy_version}
support multiple uid values in schema compatibility tree https://fedorahosted.org/freeipa/ticket/6138 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2016-08-04 01:58:50 -05:00
Requires: slapi-nis >= %{slapi_nis_version}
Do not configure PKI ajp redirection to use "::1" When ipa-server-install configures PKI, it provides a configuration file with the parameter pki_ajp_host set to ::1. This parameter is used to configure Tomcat redirection in /etc/pki/pki-tomcat/server.xml: <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" /> ie all requests to port 8009 are redirected to port 8443 on address ::1. If the /etc/hosts config file does not define ::1 for localhost, then AJP redirection fails and replica install is not able to request a certificate for the replica. Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP redirection with "localhost", FreeIPA does not need any more to override this setting. The code now depends on pki 10.3.5-11 which provides the fix in the template and the upgrade. https://fedorahosted.org/freeipa/ticket/6575 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-12 11:17:15 -06:00
Requires: pki-ca >= 10.3.5-11
Requires: pki-kra >= 10.3.5-11
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
Requires(preun): python systemd-units
Requires(postun): python systemd-units
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
Requires: policycoreutils >= 2.1.12-5
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
Requires: tar
spec file: Update minimal versions of required packages https://fedorahosted.org/freeipa/ticket/5103 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-08 06:18:27 -05:00
Requires(pre): certmonger >= 0.78
spec file: bump minimal required version of 389-ds-base Require 389-ds-base >= 1.3.5.14 for: https://fedorahosted.org/389/ticket/48992 https://fedorahosted.org/freeipa/ticket/6369 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-01 05:36:30 -05:00
Requires(pre): 389-ds-base >= 1.3.5.14
Use only system fonts This commit changes how fonts are used. - remove usage of bundled fonts and only system fonts are used instead - by using alias in httpd conf - by using local("Font Name") directive in font-face - removed usage of overpass font - redefined Open Sans font-face declarations. Note: upstream is doing the same change so we will be fine on upgrade. - introduce variable.less for variable definitions and overrides. This file will be very useful when we upgrade to newer RCUE so we will be able to redefine their and bootstrap's variables. Fixes: https://fedorahosted.org/freeipa/ticket/2861
2013-12-04 09:15:20 -06:00
Requires: fontawesome-fonts
Requires: open-sans-fonts
DNSSEC: dependencies Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:32:31 -05:00
Requires: openssl
Bump run-time requires to SoftHSM 2.0.0rc1. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-06-18 06:47:12 -05:00
Requires: softhsm >= 2.0.0rc1-1
DNSSEC: dependencies Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:32:31 -05:00
Requires: p11-kit
Requires: systemd-python
provide dedicated ccache file for httpd httpd service stores Kerberos credentials in kernel keyring which gets destroyed and recreated during service install/upgrade, causing problems when the process is run under SELinux context other than 'unconfined_t'. This patch enables HTTPInstance to set up a dedicated CCache file for Apache to store credentials. https://fedorahosted.org/freeipa/ticket/4973 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-04-28 09:24:02 -05:00
Requires: %{etc_systemd_dir}
ipa-backup: Add mechanism to store empty directory structure Certain subcomponents of IPA, such as Dogtag, cannot function if non-critical directories (such as log directories) have not been stored in the backup. This patch implements storage of selected empty directories, while preserving attributes and SELinux context. https://fedorahosted.org/freeipa/ticket/5297 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-09-17 10:09:33 -05:00
Requires: gzip
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
Requires: oddjob
spec file: Bump requires to make Certificate Login in WebUI work gssproxy >= 0.7.0-2 - fixes impersonator checking mod_lookup_identity >= 0.9.9 - adds support for single certificate assigned to multiple users mod_nss >= 1.0.14-3 - no longer sets remote user in fixup hook sssd-dbus >= 1.15.2 - adds FindByNameAndCertificate DBus method https://pagure.io/freeipa/issue/6823 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-23 02:43:51 -05:00
# 0.7.0-2: https://pagure.io/gssproxy/pull-request/172
Requires: gssproxy >= 0.7.0-2
# 1.15.2: FindByNameAndCertificate (https://pagure.io/SSSD/sssd/issue/3050)
Requires: sssd-dbus >= 1.15.2
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec: Add Provides directives to alternative package names https://fedorahosted.org/freeipa/ticket/5408 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-09 05:15:59 -06:00
Provides: %{alt_name}-server = %{version}
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-server
Obsoletes: %{alt_name}-server < %{version}
Drop SELinux subpackage All SELinux policy needed by FreeIPA server is now part of the global system SELinux policy which makes the subpackage redundant and slowing down the installation. This patch drops it. https://fedorahosted.org/freeipa/ticket/3683 https://fedorahosted.org/freeipa/ticket/3684
2013-06-13 07:40:52 -05:00
# With FreeIPA 3.3, package freeipa-server-selinux was obsoleted as the
# entire SELinux policy is stored in the system policy
Obsoletes: freeipa-server-selinux < 3.3.0
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
# upgrade path from monolithic -server to -server + -server-dns
Obsoletes: %{name}-server <= 4.2.0
Set bind and bind-dyndb-ldap min nvr This is a soft dependency, min nvr version will only be required when bind/bind-dyndb-ldap are installed. https://fedorahosted.org/freeipa/ticket/1121 https://fedorahosted.org/freeipa/ticket/1573
2011-09-09 05:30:00 -05:00
Drop uniqueMember mapping with nss-pam-ldapd. nss-pam-ldapd in 0.8.4 changed the default to map uniqueMember to member so it is no longer needed in the config file, and in fact causes an error to be raised. Add a Conflicts on older versions. https://fedorahosted.org/freeipa/ticket/3589
2013-04-30 13:35:19 -05:00
# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to
# member.
Conflicts: nss-pam-ldapd < 0.8.4
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description server
Update FreeIPA package description https://fedorahosted.org/freeipa/ticket/5284 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-09-21 08:56:36 -05:00
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are installing an IPA server, you need to install this package.
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%package -n python2-ipaserver
Summary: Python libraries used by IPA server
Group: System Environment/Libraries
BuildArch: noarch
%{?python_provide:%python_provide python2-ipaserver}
spec file: always provide python package aliases Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 08:23:10 -05:00
%{!?python_provide:Provides: python-ipaserver = %{version}-%{release}}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-server-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Requires: python2-ipaclient = %{version}-%{release}
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
Requires: python-custodia >= 0.3.1
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: python-ldap >= 2.4.15
Port ipapython.dnssec.odsmgr to xml.etree The module ipapython.dnssec.odsmgr is the only module in ipalib, ipaclient, ipapython and ipaplatform that uses lxml.etree. https://fedorahosted.org/freeipa/ticket/6469 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-15 05:57:13 -06:00
Requires: python-lxml
Require python-gssapi >= 1.2.0 The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 04:01:57 -06:00
Requires: python-gssapi >= 1.2.0
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: python-sssdconfig
Requires: python-pyasn1
Requires: dbus-python
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
Requires: python-dns >= 1.15
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: python-kdcproxy >= 0.3
use FFI call to rpmvercmp function for version comparison Stop using rpm-python to compare package versions since the implicit NSS initialization upon the module import breaks NSS handling in IPA code. Call rpm-libs C-API function via CFFI instead. Big thanks to Martin Kosek <mkosek@redhat.com> for sharing the code snippet that spurred this patch. https://fedorahosted.org/freeipa/ticket/5572 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-11 09:22:40 -06:00
Requires: rpm-libs
pki-base: use pki-base-python2 as dependency pki-base provides pki-base-python2, but we should depend directly on pki-base-python2 because in future pki-base may provide pki-base-python3 instead. Source: cheimes@redhat.com https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-15 10:20:35 -06:00
Requires: pki-base-python2
Turn on NSSOCSP check in mod_nss conf Turn on NSSOCSP directive during install/replica install/upgrade. That check whether the certificate which is used for login is revoked or not using OSCP. Marks the server cert in httpd NSS DB as trusted peer ('P,,') to avoid chicken and egg problem when it is needed to contact the OCSP responder when httpd is starting. https://pagure.io/freeipa/issue/6370 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-06 09:15:47 -05:00
Requires: python-augeas
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%description -n python2-ipaserver
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are installing an IPA server, you need to install this package.
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%if 0%{?with_python3}
%package -n python3-ipaserver
Summary: Python libraries used by IPA server
Group: System Environment/Libraries
BuildArch: noarch
%{?python_provide:%python_provide python3-ipaserver}
Requires: %{name}-server-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Requires: python3-ipaclient = %{version}-%{release}
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
Requires: python3-custodia >= 0.3.1
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
Requires: python3-pyldap >= 2.4.15
Requires: python3-lxml
Build: specify BuildRequires for Python 3 pylint python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-30 06:38:07 -06:00
Requires: python3-gssapi >= 1.2.0
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
Requires: python3-sssdconfig
Requires: python3-pyasn1
Requires: python3-dbus
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
Requires: python3-dns >= 1.15
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
Requires: python3-kdcproxy >= 0.3
Turn on NSSOCSP check in mod_nss conf Turn on NSSOCSP directive during install/replica install/upgrade. That check whether the certificate which is used for login is revoked or not using OSCP. Marks the server cert in httpd NSS DB as trusted peer ('P,,') to avoid chicken and egg problem when it is needed to contact the OCSP responder when httpd is starting. https://pagure.io/freeipa/issue/6370 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-06 09:15:47 -05:00
Requires: python3-augeas
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
Requires: rpm-libs
pki: add missing depedency pki-base[-python3] FreeIPA server modules requires pki module https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 05:28:25 -06:00
Requires: pki-base-python3
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%description -n python3-ipaserver
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are installing an IPA server, you need to install this package.
%endif # with_python3
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%package server-common
Summary: Common files used by IPA server
Group: System Environment/Base
BuildArch: noarch
Requires: %{name}-client-common = %{version}-%{release}
Require httpd 2.4.6-31 with mod_proxy Unix socket support httpd 2.4.6-6 does not support mod_proxy ProxyPass for Unix sockets. The feature is provided by 2.4.7 upstream was backported to 2.4.6-31 (bz1168081). It's required to proxy Custodia. https://bugzilla.redhat.com/show_bug.cgi?id=1168081 https://httpd.apache.org/docs/trunk/mod/mod_proxy.html#proxypass https://fedorahosted.org/freeipa/ticket/6251 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-24 05:28:47 -05:00
Requires: httpd >= 2.4.6-31
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: systemd-units >= 38
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
Requires: custodia >= 0.3.1
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Provides: %{alt_name}-server-common = %{version}
Conflicts: %{alt_name}-server-common
Obsoletes: %{alt_name}-server-common < %{version}
%description server-common
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are installing an IPA server, you need to install this package.
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
%package server-dns
Summary: IPA integrated DNS server with support for automatic DNSSEC signing
Group: System Environment/Base
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
BuildArch: noarch
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
Requires: %{name}-server = %{version}-%{release}
Bump required version of bind-dyndb-ldap to 11.0-2 Fedora release bind-dyndb-ldap 11.0-2 transforms existing named.conf old style API to the new style API. This package version is required to enable upgrade of existing IPA installations to new version. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-02-13 11:36:12 -06:00
Requires: bind-dyndb-ldap >= 11.0-2
bump required version of BIND, bind-dyndb-ldap bynd-dyndb-ldap used a custom configuration file format. Since BIND 9.11, an API was accepted upstream. This caused backward incompatible changes to the named.conf configuration file used to configure the bind-dyndb-ldap BIND plugin. Version 11.0 of bind-dyndb-ldap plugin and BIND 9.11 are required to use with the new config file format. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-12-19 09:52:08 -06:00
Requires: bind >= 9.11.0-6.P2
Requires: bind-utils >= 9.11.0-6.P2
Requires: bind-pkcs11 >= 9.11.0-6.P2
Requires: bind-pkcs11-utils >= 9.11.0-6.P2
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
Requires: opendnssec >= 1.4.6-4
spec: Add Provides directives to alternative package names https://fedorahosted.org/freeipa/ticket/5408 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-09 05:15:59 -06:00
Provides: %{alt_name}-server-dns = %{version}
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
Conflicts: %{alt_name}-server-dns
Obsoletes: %{alt_name}-server-dns < %{version}
# upgrade path from monolithic -server to -server + -server-dns
Obsoletes: %{name}-server <= 4.2.0
%description server-dns
IPA integrated DNS server with support for automatic DNSSEC signing.
Integrated DNS server is BIND 9. OpenDNSSEC provides key management.
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%package server-trust-ad
Summary: Virtual package to install packages required for Active Directory trusts
Group: System Environment/Base
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-server = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Add support for unified samba packages Fedora 18 and later has moved unified samba and samba4 packages. Update Requires and BuildRequires in spec file to require correct versions. Also require libwbclient-devel which now provides libwbclient.h instead of samba4-devel package. https://fedorahosted.org/freeipa/ticket/3118
2012-10-01 08:32:36 -05:00
Requires: samba-python
Support building RPMs for RHEL/CentOS 7.0 https://fedorahosted.org/freeipa/ticket/4562 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-03 07:12:35 -05:00
Requires: samba >= %{samba_version}
Add support for unified samba packages Fedora 18 and later has moved unified samba and samba4 packages. Update Requires and BuildRequires in spec file to require correct versions. Also require libwbclient-devel which now provides libwbclient.h instead of samba4-devel package. https://fedorahosted.org/freeipa/ticket/3118
2012-10-01 08:32:36 -05:00
Requires: samba-winbind
Requires: libsss_idmap
spec file: update the python package names for libipa_hbac and libsss_nss_idmap Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-10 04:59:24 -05:00
Requires: python-libsss_nss_idmap
SPEC: Require python2 version of sssd bindings Python modules pysss and pysss_murmur was part of package sssd-common. Fedora 22 tries to get rid of python2 and therefore these modules were extracted from package sssd-common to separate packages python-sss and python-sss-murmur and python3 version of packages python3-sss python3-sss-murmur git grep "pysss" | grep import ipalib/plugins/trust.py: import pysss_murmur #pylint: disable=F0401 ipaserver/dcerpc.py:import pysss ipaserver/dcerpc.py is pacakged in freeipa-server-trust-ad palib/plugins/trust.py is packaged in freeipa-python Resolves: https://fedorahosted.org/freeipa/ticket/4929 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-02-27 13:43:38 -06:00
Requires: python-sss
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5
# on the installes where server-trust-ad subpackage is installed because
# IPA AD trusts cannot be used at the same time with the locator plugin
# since Winbindd will be configured in a different mode
Requires(post): %{_sbindir}/update-alternatives
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
Requires(post): python
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
Requires(postun): %{_sbindir}/update-alternatives
Requires(preun): %{_sbindir}/update-alternatives
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
spec: Add Provides directives to alternative package names https://fedorahosted.org/freeipa/ticket/5408 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-09 05:15:59 -06:00
Provides: %{alt_name}-server-trust-ad = %{version}
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-server-trust-ad
Obsoletes: %{alt_name}-server-trust-ad < %{version}
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%description server-trust-ad
Fix selected minor issues in the spec file and license This patch fixes: - too long description for server-trust-ad subpackage - adds (noreplace) flag %{_sysconfdir}/tmpfiles.d/ipa.conf to avoid overwriting potential user changes - changes permissions on default_encoding_utf8.so to prevent it pollute python subpackage Provides. - wrong address in GPL v2 license preamble in 2 distributed files https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:59:57 -05:00
Cross-realm trusts with Active Directory in IPA require working Samba 4
installation. This package is provided for convenience to install all required
dependencies at once.
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%package client
Summary: IPA authentication for use on clients
Group: System Environment/Base
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-client-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Requires: python2-ipaclient = %{version}-%{release}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: python-ldap
Add an arch-specific Requires on cyrus-sasl-gssapi If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
2011-07-22 08:06:13 -05:00
Requires: cyrus-sasl-gssapi%{?_isa}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: ntp
spec file: bump krb5 Requires for certauth fixes Bump krb5-* Requires to the version which includes the final version of certauth support. https://pagure.io/freeipa/issue/4905 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-25 07:35:34 -05:00
Requires: krb5-workstation >= %{krb5_version}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: authconfig
Migrate wget references and usage to curl https://fedorahosted.org/freeipa/ticket/5458 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-12-04 15:52:03 -06:00
Requires: curl
client: RPM require initscripts to get *-domainname.service https://fedorahosted.org/freeipa/ticket/4831 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-08 06:13:18 -05:00
# NIS domain name config: /usr/lib/systemd/system/*-domainname.service
Requires: initscripts
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
Requires: libcurl >= 7.21.7-2
Requires: xmlrpc-c >= 1.27.4
Bump SSSD version in requires This is required by commit aa734da49440c5d12c0f8d4566505adaeef254e8 for function sss_nss_getnamebycert() https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-06-22 03:49:39 -05:00
Requires: sssd >= 1.14.0
SPEC: Explicitly requires python-sssdconfig Resolves: https://fedorahosted.org/freeipa/ticket/4929 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-02-27 13:40:06 -06:00
Requires: python-sssdconfig
spec file: Update minimal versions of required packages https://fedorahosted.org/freeipa/ticket/5103 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-08 06:18:27 -05:00
Requires: certmonger >= 0.78
Clean up the spec file, add Requires for nss-pam-ldapd for F14+ Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
2010-09-09 17:10:14 -05:00
Requires: nss-tools
Try to register DNS name through a DNS Update on install. Fixes: https://fedorahosted.org/freeipa/ticket/935
2011-02-17 07:30:36 -06:00
Requires: bind-utils
Add Requires to ipa-client on oddjob-mkhomedir https://fedorahosted.org/freeipa/ticket/2337
2012-02-27 03:59:25 -06:00
Requires: oddjob-mkhomedir
Require python-gssapi >= 1.2.0 The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 04:01:57 -06:00
Requires: python-gssapi >= 1.2.0
Configure automount using autofs or sssd. This script edits nsswitch.conf to use either ldap (autofs) or sss (sssd) to find automount maps. NFSv4 services are started so Kerberos encryption and/or integrity can be used on the maps. https://fedorahosted.org/freeipa/ticket/1233 https://fedorahosted.org/freeipa/ticket/2193
2012-05-29 13:20:38 -05:00
Requires: libsss_autofs
Requires: autofs
Requires: libnfsidmap
Requires: nfs-utils
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
Requires(post): policycoreutils
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec: Add Provides directives to alternative package names https://fedorahosted.org/freeipa/ticket/5408 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-09 05:15:59 -06:00
Provides: %{alt_name}-client = %{version}
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-client
Obsoletes: %{alt_name}-client < %{version}
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
freeipa.spec.in: move ipa CLI utility to freeipa-client There is no notable package size cost, as all the libraries and packages are already in the freeipa-client package and freeipa-admintools only contained a short shim calling this code. Move /bin/ipa to freeipa-client, along with a man page and bash completion. Resolves: https://fedorahosted.org/freeipa/ticket/5934 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-25 03:59:34 -05:00
Provides: %{alt_name}-admintools = %{version}
Conflicts: %{alt_name}-admintools
Obsoletes: %{alt_name}-admintools < 4.4.1
Obsoletes: %{name}-admintools < 4.4.1
Provides: %{name}-admintools = %{version}-%{release}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%description client
Update FreeIPA package description https://fedorahosted.org/freeipa/ticket/5284 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-09-21 08:56:36 -05:00
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
freeipa.spec.in: move ipa CLI utility to freeipa-client There is no notable package size cost, as all the libraries and packages are already in the freeipa-client package and freeipa-admintools only contained a short shim calling this code. Move /bin/ipa to freeipa-client, along with a man page and bash completion. Resolves: https://fedorahosted.org/freeipa/ticket/5934 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-25 03:59:34 -05:00
This package provides command-line tools for IPA administrators.
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%package -n python2-ipaclient
Summary: Python libraries used by IPA client
Group: System Environment/Libraries
BuildArch: noarch
%{?python_provide:%python_provide python2-ipaclient}
spec file: always provide python package aliases Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 08:23:10 -05:00
%{!?python_provide:Provides: python-ipaclient = %{version}-%{release}}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-client-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
spec: do not require arch specific ipalib package from noarch packages noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-04 10:34:56 -06:00
Requires: python2-ipalib = %{version}-%{release}
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
Requires: python-dns >= 1.15
csrgen: Add code to generate scripts that generate CSRs Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-05 13:19:35 -05:00
Requires: python2-jinja2
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%description -n python2-ipaclient
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
Package python3-ipaclient Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-19 07:54:18 -06:00
%if 0%{?with_python3}
%package -n python3-ipaclient
Summary: Python libraries used by IPA client
Group: System Environment/Libraries
BuildArch: noarch
%{?python_provide:%python_provide python3-ipaclient}
Requires: %{name}-client-common = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
Requires: python3-ipalib = %{version}-%{release}
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
Requires: python3-dns >= 1.15
csrgen: Add code to generate scripts that generate CSRs Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-05 13:19:35 -05:00
Requires: python3-jinja2
Package python3-ipaclient Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-19 07:54:18 -06:00
%description -n python3-ipaclient
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
%endif # with_python3
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%package client-common
Summary: Common files used by IPA client
Group: System Environment/Base
BuildArch: noarch
Provides: %{alt_name}-client-common = %{version}
Conflicts: %{alt_name}-client-common
Obsoletes: %{alt_name}-client-common < %{version}
%description client-common
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
%package python-compat
Summary: Compatiblity package for Python libraries used by IPA
Group: System Environment/Libraries
BuildArch: noarch
Obsoletes: %{name}-python < 4.2.91
Provides: %{name}-python = %{version}-%{release}
Requires: %{name}-common = %{version}-%{release}
spec: do not require arch specific ipalib package from noarch packages noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-04 10:34:56 -06:00
Requires: python2-ipalib = %{version}-%{release}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Provides: %{alt_name}-python-compat = %{version}
Conflicts: %{alt_name}-python-compat
Obsoletes: %{alt_name}-python-compat < %{version}
Obsoletes: %{alt_name}-python < 4.2.91
Provides: %{alt_name}-python = %{version}
%description python-compat
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
This is a compatibility package to accommodate %{name}-python split into
python2-ipalib and %{name}-common. Packages still depending on
%{name}-python should be fixed to depend on python2-ipaclient or
%{name}-common instead.
%package -n python2-ipalib
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Summary: Python libraries used by IPA
Group: System Environment/Libraries
spec file: package python-ipalib as noarch https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2016-01-21 05:59:11 -06:00
BuildArch: noarch
Fix `Conflicts` with ipa-python The conflicts should have constant version in it because it is related to package split. https://fedorahosted.org/freeipa/ticket/6004 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-06-29 07:00:51 -05:00
Conflicts: %{name}-python < 4.2.91
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%{?python_provide:%python_provide python2-ipalib}
spec file: always provide python package aliases Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 08:23:10 -05:00
%{!?python_provide:Provides: python-ipalib = %{version}-%{release}}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Provides: python2-ipapython = %{version}-%{release}
%{?python_provide:%python_provide python2-ipapython}
spec file: always provide python package aliases Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 08:23:10 -05:00
%{!?python_provide:Provides: python-ipapython = %{version}-%{release}}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Provides: python2-ipaplatform = %{version}-%{release}
%{?python_provide:%python_provide python2-ipaplatform}
spec file: always provide python package aliases Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 08:23:10 -05:00
%{!?python_provide:Provides: python-ipaplatform = %{version}-%{release}}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Requires: %{name}-common = %{version}-%{release}
Require python-gssapi >= 1.2.0 The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 04:01:57 -06:00
Requires: python-gssapi >= 1.2.0
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Requires: gnupg
Move requirement for keyutils to freeipa-python package There was already a dependency in server package, however, the correct place for such dependency is in freeipa-python, since the relevant code using keyutils resides there. Both freeipa-server and freeipa-client require freeipa-python. https://fedorahosted.org/freeipa/ticket/3808
2013-07-23 10:21:47 -05:00
Requires: keyutils
Use OpenSSL for SSL instead of the built-in python version.
2009-02-19 16:20:37 -06:00
Requires: pyOpenSSL
python2-ipalib: add missing python dependency Commit dfd560a190cb2ab13f34ed9e21c5fb5c6e793f18 started to use ssl symbols like ssl.OP_NO_SSLv2 that were introduced in Python 2.7.9. Related https://pagure.io/freeipa/issue/6920 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-02 11:32:34 -05:00
Requires: python >= 2.7.9
certdb: use certutil and match_hostname for cert verification Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-02 06:53:18 -06:00
Requires: python-cryptography >= 1.6
spec file: bump python-netaddr Requires Bump python-netaddr Requires to the version which has correct private and reserved IPv4 address ranges. This fixes DNS server install failure when 0.0.0.0 is entered as a forwarder. https://pagure.io/freeipa/issue/6894 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-25 07:13:00 -05:00
Requires: python-netaddr >= %{python_netaddr_version}
spec file: update the python package names for libipa_hbac and libsss_nss_idmap Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-10 04:59:24 -05:00
Requires: python-libipa_hbac
Update qrcode support for newer python-qrcode This substantially reduces the FreeIPA dependencies and allows QR codes to fit in a standard terminal. https://fedorahosted.org/freeipa/ticket/4430 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-10 16:35:37 -05:00
Requires: python-qrcode-core >= 5.0.0
Add missing dependencies to freeipa-python package python-pyasn1 and python-qrcode were imported by ipalib but not required by python subpackage. https://fedorahosted.org/freeipa/ticket/4275 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-26 06:49:56 -05:00
Requires: python-pyasn1
Add python-pyasn1-modules into dependencies Python-pyasn1-modules is needed because of this import: from pyasn1_modules import rfc2459 in ipalib/x509.py. Python-pyasn1-modules is required only by python-ldap package, but it would be good to not rely on another package and rather say explicitely that this package is necessary. https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-12-02 10:09:48 -06:00
Requires: python-pyasn1-modules
Implement OTP token importing This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to validate or add. Using the output file, the sysadmin can attempt to recover these specific tokens. This code is implemented as a server-side script. However, it doesn't actually need to run on the server. This was done because importing is an odd fit for the IPA command framework: 1. We need to write an output file. 2. The operation may be long-running (thousands of tokens). 3. Only admins need to perform this task and it only happens infrequently. https://fedorahosted.org/freeipa/ticket/4261 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-08 10:06:16 -05:00
Requires: python-dateutil
Update python-yubico dependency version This change enables support for all current YubiKey hardware. https://fedorahosted.org/freeipa/ticket/4954 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
2015-03-31 09:17:18 -05:00
Requires: python-yubico >= 1.2.3
SPEC: Require python2 version of sssd bindings Python modules pysss and pysss_murmur was part of package sssd-common. Fedora 22 tries to get rid of python2 and therefore these modules were extracted from package sssd-common to separate packages python-sss and python-sss-murmur and python3 version of packages python3-sss python3-sss-murmur git grep "pysss" | grep import ipalib/plugins/trust.py: import pysss_murmur #pylint: disable=F0401 ipaserver/dcerpc.py:import pysss ipaserver/dcerpc.py is pacakged in freeipa-server-trust-ad palib/plugins/trust.py is packaged in freeipa-python Resolves: https://fedorahosted.org/freeipa/ticket/4929 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-02-27 13:43:38 -06:00
Requires: python-sss-murmur
Moved dbus-python dependence to freeipa-python package Added dbus-python dependency to freeipa-python. This should fix https://fedorahosted.org/freeipa/ticket/4863 and also cover dbus-python dependencies in other freeipa-* packages. Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-01-28 03:05:25 -06:00
Requires: dbus-python
add python-setuptools to requires Commit 9f049ca14403f3696d54d186e6b1b15181f055df introduced dependency on python-setuptools on line: from pkg_resources import parse_version This dependency is missing on minimal installation and then ipa-server-upgrade fails on rpm install/upgrade. Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-19 07:01:50 -05:00
Requires: python-setuptools
Add python-six to dependencies Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-08-10 11:11:52 -05:00
Requires: python-six
Add ipa-custodia service Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-08 12:39:29 -05:00
Requires: python-jwcrypto
ipapython: port p11helper C code to Python This replaces the binary _ipap11helper module with cffi-based Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-06 06:10:11 -06:00
Requires: python-cffi
spec: Add missing dependencies to python*-ipalib package Standalone instalation of python*-ipalib packages does not pull all required packages and results into import errors. https://fedorahosted.org/freeipa/ticket/5680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-25 10:47:10 -06:00
Requires: python-ldap >= 2.4.15
Requires: python-requests
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
Requires: python-dns >= 1.15
install: use standard Python classes to declare knob types Use type(None) rather than bool to define knobs which are represented as command line flags. This allows declaring both "--option" and "--option={0,1}"-style command line options. Use enum.Enum subclasses instead of set literals to declare enumerations. Use typing.List[T] instead of (list, T) to declare lists. (Note that a minimal reimplementation of typing.List is used instead of the Python 2 backport of the typing module due to non-technical reasons.) Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP addresses. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-07 07:01:10 -06:00
Requires: python-enum34
Use netifaces module instead of 'ip' command Netifaces allows to get addresses from local interfaces of the host in safer way than parsing output of the ip command. https://fedorahosted.org/freeipa/ticket/5591 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-13 09:14:42 -05:00
Requires: python-netifaces >= 0.10.4
Added pyusb as a dependency https://fedorahosted.org/freeipa/ticket/5886 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-27 06:45:57 -05:00
Requires: pyusb
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Conflicts: %{alt_name}-python < %{version}
%description -n python2-ipalib
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are using IPA, you need to install this package.
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%if 0%{?with_python3}
%package -n python3-ipalib
Summary: Python3 libraries used by IPA
Group: System Environment/Libraries
spec file: package python-ipalib as noarch https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2016-01-21 05:59:11 -06:00
BuildArch: noarch
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%{?python_provide:%python_provide python3-ipalib}
Provides: python3-ipapython = %{version}-%{release}
%{?python_provide:%python_provide python3-ipapython}
Provides: python3-ipaplatform = %{version}-%{release}
%{?python_provide:%python_provide python3-ipaplatform}
Requires: %{name}-common = %{version}-%{release}
Require python-gssapi >= 1.2.0 The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 04:01:57 -06:00
Requires: python3-gssapi >= 1.2.0
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
Requires: gnupg
Requires: keyutils
Requires: python3-pyOpenSSL
certdb: use certutil and match_hostname for cert verification Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-02 06:53:18 -06:00
Requires: python3-cryptography >= 1.6
spec file: bump python-netaddr Requires Bump python-netaddr Requires to the version which has correct private and reserved IPv4 address ranges. This fixes DNS server install failure when 0.0.0.0 is entered as a forwarder. https://pagure.io/freeipa/issue/6894 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-25 07:13:00 -05:00
Requires: python3-netaddr >= %{python_netaddr_version}
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
Requires: python3-libipa_hbac
Requires: python3-qrcode-core >= 5.0.0
Requires: python3-pyasn1
Add python-pyasn1-modules into dependencies Python-pyasn1-modules is needed because of this import: from pyasn1_modules import rfc2459 in ipalib/x509.py. Python-pyasn1-modules is required only by python-ldap package, but it would be good to not rely on another package and rather say explicitely that this package is necessary. https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-12-02 10:09:48 -06:00
Requires: python3-pyasn1-modules
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
Requires: python3-dateutil
Requires: python3-yubico >= 1.2.3
Requires: python3-sss-murmur
Requires: python3-dbus
Requires: python3-setuptools
Requires: python3-six
Requires: python3-jwcrypto
ipapython: port p11helper C code to Python This replaces the binary _ipap11helper module with cffi-based Python code. https://fedorahosted.org/freeipa/ticket/5596 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-06 06:10:11 -06:00
Requires: python3-cffi
spec: Add missing dependencies to python*-ipalib package Standalone instalation of python*-ipalib packages does not pull all required packages and results into import errors. https://fedorahosted.org/freeipa/ticket/5680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-25 10:47:10 -06:00
Requires: python3-pyldap >= 2.4.15
Requires: python3-requests
Py3: Fix ToASCII method in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-14 03:12:05 -06:00
Requires: python3-dns >= 1.15
Use netifaces module instead of 'ip' command Netifaces allows to get addresses from local interfaces of the host in safer way than parsing output of the ip command. https://fedorahosted.org/freeipa/ticket/5591 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-13 09:14:42 -05:00
Requires: python3-netifaces >= 0.10.4
Added pyusb as a dependency https://fedorahosted.org/freeipa/ticket/5886 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-27 06:45:57 -05:00
Requires: python3-pyusb
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%description -n python3-ipalib
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are using IPA with Python 3, you need to install this package.
%endif # with_python3
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%package common
Summary: Common files used by IPA
Group: System Environment/Libraries
BuildArch: noarch
Fix `Conflicts` with ipa-python The conflicts should have constant version in it because it is related to package split. https://fedorahosted.org/freeipa/ticket/6004 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-06-29 07:00:51 -05:00
Conflicts: %{name}-python < 4.2.91
Rename package to freeipa https://fedorahosted.org/freeipa/ticket/581
2011-01-17 03:26:19 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Provides: %{alt_name}-common = %{version}
Conflicts: %{alt_name}-common
Obsoletes: %{alt_name}-common < %{version}
Conflicts: %{alt_name}-python < %{version}
%description common
Update FreeIPA package description https://fedorahosted.org/freeipa/ticket/5284 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-09-21 08:56:36 -05:00
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
If you are using IPA, you need to install this package.
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%if 0%{?with_ipatests}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%package -n python2-ipatests
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Summary: IPA tests and test tools
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
BuildArch: noarch
Obsoletes: %{name}-tests < 4.2.91
spec: do not require arch specific ipalib package from noarch packages noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-04 10:34:56 -06:00
Provides: %{name}-tests = %{version}-%{release}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%{?python_provide:%python_provide python2-ipatests}
spec file: always provide python package aliases Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 08:23:10 -05:00
%{!?python_provide:Provides: python-ipatests = %{version}-%{release}}
spec file: require correct packages to get API plugins Since ipalib.plugins was split into ipaserver.plugins and ipaclient.plugins, require python-ipaserver and/or python-ipaclient instead of python-ipalib where appropriate. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-08 03:58:05 -05:00
Requires: python2-ipaclient = %{version}-%{release}
Requires: python2-ipaserver = %{version}-%{release}
Add tar and xz dependencies to the freeipa-tests package The beakerLib plugin collects log files via compressed tarballs, so these dependencies are needed
2013-07-24 07:43:43 -05:00
Requires: tar
Requires: xz
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Requires: python-nose
Integration tests: Port the ordering plugin to pytest Ordered integration tests may now be run with pytest. https://fedorahosted.org/freeipa/ticket/4610 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-10-10 07:56:29 -05:00
Requires: pytest >= 2.6
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Requires: python-paste
Requires: python-coverage
spec file: rename the python-polib dependency name to python2-polib Trying to install the package depending on python-polib breaks when the system has newer (and renamed) version python2-polib. *This patch is an workaround* for the issue described in [1]. If a renamed package's provides is equal to an older package's name, dnf tries to install the older package. When the newer package is in the system, this leads to a conflict. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1096506 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-15 08:54:40 -06:00
# workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1096506
Requires: python2-polib
spec: Add BuildRequires for python-pytest plugins Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-01-13 15:11:19 -06:00
Requires: python-pytest-multihost >= 0.5
ipatests: Use pytest-sourceorder The plugin to run tests within a class in the order they're defined in the source was split into a separate project. Use this project instead of a FreeIPA-specific copy. Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-12-02 06:30:20 -06:00
Requires: python-pytest-sourceorder
DNSSEC CI: add missing ldns-utils dependency Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-01-06 08:05:12 -06:00
Requires: ldns-utils
spec: Add python-sssdconfig dependency for python-ipatests package https://fedorahosted.org/freeipa/ticket/5843 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-04-22 16:43:47 -05:00
Requires: python-sssdconfig
certdb: use certutil and match_hostname for cert verification Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-02 06:53:18 -06:00
Requires: python2-cryptography >= 1.6
tests: add missing dependency iptables KDC proxy tests are using iptables, but this is optional package in at least Fedora cloud image, thus we must have it in dependencies Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-04-27 10:46:16 -05:00
Requires: iptables
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
spec: do not require arch specific ipalib package from noarch packages noarch packages should not contain: Requires: some-package-{?_isa} because then they are not the same for each arch - are not noarch https://fedorahosted.org/freeipa/ticket/5568 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-04 10:34:56 -06:00
Provides: %{alt_name}-tests = %{version}
Allow RPM upgrade from ipa-* packages https://fedorahosted.org/freeipa/ticket/4532 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 03:02:01 -05:00
Conflicts: %{alt_name}-tests
Obsoletes: %{alt_name}-tests < %{version}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%description -n python2-ipatests
Update FreeIPA package description https://fedorahosted.org/freeipa/ticket/5284 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-09-21 08:56:36 -05:00
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
This package contains tests that verify IPA functionality.
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%if 0%{?with_python3}
%package -n python3-ipatests
Summary: IPA tests and test tools
BuildArch: noarch
%{?python_provide:%python_provide python3-ipatests}
spec file: require correct packages to get API plugins Since ipalib.plugins was split into ipaserver.plugins and ipaclient.plugins, require python-ipaserver and/or python-ipaclient instead of python-ipalib where appropriate. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-08 03:58:05 -05:00
Requires: python3-ipaclient = %{version}-%{release}
# FIXME: uncomment once there's python3-ipaserver
#Requires: python3-ipaserver = %{version}-%{release}
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
Requires: tar
Requires: xz
Requires: python3-nose
Requires: python3-pytest >= 2.6
Requires: python3-coverage
Requires: python3-polib
Requires: python3-pytest-multihost >= 0.5
Requires: python3-pytest-sourceorder
DNSSEC CI: add missing ldns-utils dependency Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-01-06 08:05:12 -06:00
Requires: ldns-utils
spec: Add python-sssdconfig dependency for python-ipatests package https://fedorahosted.org/freeipa/ticket/5843 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-04-22 16:43:47 -05:00
Requires: python3-sssdconfig
certdb: use certutil and match_hostname for cert verification Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-02 06:53:18 -06:00
Requires: python3-cryptography >= 1.6
tests: add missing dependency iptables KDC proxy tests are using iptables, but this is optional package in at least Fedora cloud image, thus we must have it in dependencies Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-04-27 10:46:16 -05:00
Requires: iptables
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%description -n python3-ipatests
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
(host access control, SELinux user roles, services). The solution provides
features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
This package contains tests that verify IPA functionality under Python 3.
%endif # with_python3
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%endif # with_ipatests
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%prep
%setup -n freeipa-%{version} -q
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%if 0%{?with_python3}
# Workaround: We want to build Python things twice. To be sure we do not mess
# up something, do two separate builds in separate directories.
cp -r %{_builddir}/freeipa-%{version} %{_builddir}/freeipa-%{version}-python3
%endif # with_python3
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%build
Increase Java stack size on s390 platforms As reported in https://bugzilla.redhat.com/show_bug.cgi?id=1040576, the default stack trace needs to be also increased on s390 platforms to prevent rhino segfault.
2014-01-03 06:52:54 -06:00
# UI compilation segfaulted on some arches when the stack was lower (#1040576)
Increase Java stack size on PPC platforms Wit the default stack size, rhino segfaulted on PPC platforms. https://bugzilla.redhat.com/show_bug.cgi?id=1040576
2013-12-13 08:20:40 -06:00
export JAVA_STACK_SIZE="8m"
Build: workaround bug 1005235 related to Python paths in auto-generated Requires https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-10 08:24:50 -06:00
# PATH is workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1005235
export PATH=/usr/bin:/usr/sbin:$PATH
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
export PYTHON=%{__python2}
# Workaround: make sure all shebangs are pointing to Python 2
# This should be solved properly using setuptools
# and this hack should be removed.
find \
! -name '*.pyc' -a \
! -name '*.pyo' -a \
-type f -exec grep -qsm1 '^#!.*\bpython' {} \; \
-exec sed -i -e '1 s|^#!.*\bpython[^ ]*|#!%{__python2}|' {} \;
SPEC: Fix build in mock Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-11 08:02:09 -06:00
%configure --with-vendor-suffix=-%{release} \
spec file: support client-only build nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 01:48:29 -05:00
%{enable_server_option} \
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%{with_ipatests_option} \
Make pylint and jsl optional ./configure no longer fails when pylint or jsl are not available. The make targets for pylint and jsl are no longer defined without the tools. Rational: pylint and jsl are not required to build FreeIPA. Both are useful developer tools. It's more user friendly to make both components optionally with default config arguments. There is no reason to fail building on a build system without development tools. It's still possible to enforce dependency checks with --with-jslint and --enable-pylint. https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-02-22 12:19:35 -06:00
%{linter_options}
SPEC: Fix build in mock Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-11 08:02:09 -06:00
Build: workaround bug while calling parallel make from rpmbuild https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-25 03:23:34 -06:00
# -Onone is workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1398405
%make_build -Onone
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%if 0%{?with_python3}
pushd %{_builddir}/freeipa-%{version}-python3
export PYTHON=%{__python3}
# Workaround: make sure all shebangs are pointing to Python 3
# This should be solved properly using setuptools
# and this hack should be removed.
find \
! -name '*.pyc' -a \
! -name '*.pyo' -a \
-type f -exec grep -qsm1 '^#!.*\bpython' {} \; \
-exec sed -i -e '1 s|^#!.*\bpython[^ ]*|#!%{__python3}|' {} \;
SPEC: Fix build in mock Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-11 08:02:09 -06:00
%configure --with-vendor-suffix=-%{release} \
spec file: support client-only build nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 01:48:29 -05:00
%{enable_server_option} \
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%{with_ipatests_option} \
Make pylint and jsl optional ./configure no longer fails when pylint or jsl are not available. The make targets for pylint and jsl are no longer defined without the tools. Rational: pylint and jsl are not required to build FreeIPA. Both are useful developer tools. It's more user friendly to make both components optionally with default config arguments. There is no reason to fail building on a build system without development tools. It's still possible to enforce dependency checks with --with-jslint and --enable-pylint. https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-02-22 12:19:35 -06:00
%{linter_options}
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
popd
%endif # with_python3
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
SPEC: Run cmocka based unit test in %check phase This patch also consolidate build dependencies for c based unit tests Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-13 01:11:38 -06:00
%check
Build: pass down LIBDIR definition from RPM SPEC to Makefile Previously the value was sometimes lost. This was causing problems in later stages of refactoring. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-12 10:13:36 -05:00
make %{?_smp_mflags} check VERBOSE=yes LIBDIR=%{_libdir}
SPEC: Run cmocka based unit test in %check phase This patch also consolidate build dependencies for c based unit tests Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-13 01:11:38 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%install
Build: document what should be in %install section of SPEC file https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-11 05:21:58 -06:00
# Please put as much logic as possible into make install. It allows:
# - easier porting to other distributions
# - rapid devel & install cycle using make install
# (instead of full RPM build and installation each time)
#
# All files and directories created by spec install should be marked as ghost.
# (These are typically configuration files created by IPA installer.)
# All other artifacts should be created by make install.
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
#
# Exception to this rule are test programs which where want to install
# Python2/3 versions at the same time so we need to rename them. Yuck.
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%if 0%{?with_python3}
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
# Python 3 installation needs to be done first. Subsequent Python 2 install
# will overwrite /usr/bin/ipa and other scripts with variants using
# python2 shebang.
pushd %{_builddir}/freeipa-%{version}-python3
(cd ipaclient && %make_install)
(cd ipalib && %make_install)
(cd ipaplatform && %make_install)
(cd ipapython && %make_install)
spec file: support client-only build nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 01:48:29 -05:00
%if ! %{ONLY_CLIENT}
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
(cd ipaserver && %make_install)
spec file: support client-only build nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 01:48:29 -05:00
%endif # ONLY_CLIENT
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%if 0%{?with_ipatests}
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
(cd ipatests && %make_install)
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%endif # with_ipatests
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
popd
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%if 0%{?with_ipatests}
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
mv %{buildroot}%{_bindir}/ipa-run-tests %{buildroot}%{_bindir}/ipa-run-tests-%{python3_version}
mv %{buildroot}%{_bindir}/ipa-test-config %{buildroot}%{_bindir}/ipa-test-config-%{python3_version}
mv %{buildroot}%{_bindir}/ipa-test-task %{buildroot}%{_bindir}/ipa-test-task-%{python3_version}
ln -s %{_bindir}/ipa-run-tests-%{python3_version} %{buildroot}%{_bindir}/ipa-run-tests-3
ln -s %{_bindir}/ipa-test-config-%{python3_version} %{buildroot}%{_bindir}/ipa-test-config-3
ln -s %{_bindir}/ipa-test-task-%{python3_version} %{buildroot}%{_bindir}/ipa-test-task-3
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%endif # with_ipatests
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%endif # with_python3
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
# Python 2 installation
%make_install
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%if 0%{?with_ipatests}
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
mv %{buildroot}%{_bindir}/ipa-run-tests %{buildroot}%{_bindir}/ipa-run-tests-%{python2_version}
mv %{buildroot}%{_bindir}/ipa-test-config %{buildroot}%{_bindir}/ipa-test-config-%{python2_version}
mv %{buildroot}%{_bindir}/ipa-test-task %{buildroot}%{_bindir}/ipa-test-task-%{python2_version}
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
ln -s %{_bindir}/ipa-run-tests-%{python2_version} %{buildroot}%{_bindir}/ipa-run-tests-2
ln -s %{_bindir}/ipa-test-config-%{python2_version} %{buildroot}%{_bindir}/ipa-test-config-2
ln -s %{_bindir}/ipa-test-task-%{python2_version} %{buildroot}%{_bindir}/ipa-test-task-2
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
# test framework defaults to Python 2
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
ln -s %{_bindir}/ipa-run-tests-%{python2_version} %{buildroot}%{_bindir}/ipa-run-tests
ln -s %{_bindir}/ipa-test-config-%{python2_version} %{buildroot}%{_bindir}/ipa-test-config
ln -s %{_bindir}/ipa-test-task-%{python2_version} %{buildroot}%{_bindir}/ipa-test-task
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%endif # with_ipatests
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
# remove files which are useful only for make uninstall
find %{buildroot} -wholename '*/site-packages/*/install_files.txt' -exec rm {} \;
Use python2 for ipa cli Switch 'ipa' command to py3 has been done prematurely, this commit sets python2 as interpreter for ipa cli. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-14 04:41:25 -05:00
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
%find_lang %{gettext_domain}
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# Remove .la files from libtool - we don't want to package
# these files
rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_winsync.la
Replication version checking. Whenever we upgrade IPA such that any data incompatibilities might occur then we need to bump the DATA_VERSION value so that data will not replicate to other servers. The idea is that you can do an in-place upgrade of each IPA server and the different versions own't pollute each other with bad data.
2010-06-24 09:31:52 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la
ipa-uuid: DNA-like plugin that generates uuids
2010-10-15 09:49:29 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_uuid.la
Add new plugin used to modify related attributes after a modrdn operation.
2010-10-19 16:11:31 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
Update kerberos password policy values on LDAP binds. On a failed bind this will update krbLoginFailedCount and krbLastFailedAuth and will potentially fail the bind altogether. On a successful bind it will zero krbLoginFailedCount and set krbLastSuccessfulAuth. This will also enforce locked-out accounts. See http://k5wiki.kerberos.org/wiki/Projects/Lockout for details on kerberos lockout. ticket 343
2011-01-18 13:58:58 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
Create skeleton CLDAP server as a DS plugin
2011-11-09 18:03:48 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
Add 389 DS plugin for special idnsSOASerial attribute handling Default value "1" is added to replicated idnsZone objects if idnsSOASerial attribute is missing. https://fedorahosted.org/freeipa/ticket/3347 Signed-off-by: Petr Spacek <pspacek@redhat.com>
2013-03-08 11:54:58 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_dns.la
Add sidgen postop and task A postop plugin is added to create the SID for new created users and groups. A directory server task allows to set the SID for existing users and groups. Fixes https://fedorahosted.org/freeipa/ticket/2825
2012-06-21 05:54:34 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la
rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la
Add external domain extop DS plugin This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
2011-11-30 06:29:10 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la
Add range check preop plugin To make sure that ID ranges do not overlap this plugin checks new additions and changes for conflicts with existing ranges. https://fedorahosted.org/freeipa/ticket/2185
2012-06-18 14:25:31 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_range_check.la
Create ipa-otp-counter 389DS plugin This plugin ensures that all counter/watermark operations are atomic and never decrement. Also, deletion is not permitted. Because this plugin also ensures internal operations behave properly, this also gives ipa-pwd-extop the appropriate behavior for OTP authentication. https://fedorahosted.org/freeipa/ticket/4493 https://fedorahosted.org/freeipa/ticket/4494 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-09-10 16:31:37 -05:00
rm %{buildroot}/%{plugin_dir}/libipa_otp_counter.la
Add OTP last token plugin This plugin prevents the deletion or deactivation of the last valid token for a user. This prevents the user from migrating back to single factor authentication once OTP has been enabled. Thanks to Mark Reynolds for helping me with this patch. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2013-12-16 15:19:08 -06:00
rm %{buildroot}/%{plugin_dir}/libipa_otp_lasttoken.la
ds plugin - manage replication topology in the shared tree Implementation of ticket: https://fedorahosted.org/freeipa/ticket/4302 Design page: http://www.freeipa.org/page/V4/Manage_replication_topology Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2015-05-20 10:28:39 -05:00
rm %{buildroot}/%{plugin_dir}/libtopology.la
ipa-kdb: Initial plugin skeleton
2011-05-19 15:24:57 -05:00
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
Add ipasam samba passdb backend https://fedorahosted.org/freeipa/ticket/1874
2011-10-25 03:33:30 -05:00
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Own the Apache configuration files that ipa-server-install creates
2009-05-14 08:29:16 -05:00
# So we can own our Apache configuration
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con
Add ipa_memcached service * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
2012-02-06 12:15:06 -06:00
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5
touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Introduce ipa control script that reads configuration off ldap This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
2010-12-04 14:42:14 -06:00
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
/bin/touch %{buildroot}%{_sysconfdir}/ipa/ca.crt
Include the ipa command in client-only build https://fedorahosted.org/freeipa/ticket/4536 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 04:52:37 -05:00
%if ! %{ONLY_CLIENT}
Add support for tracking and counting entitlements Adds a plugin, entitle, to register to the entitlement server, consume entitlements and to count and track them. It is also possible to import an entitlement certificate (if for example the remote entitlement server is unaviailable). This uses the candlepin server from https://fedorahosted.org/candlepin/wiki for entitlements. Add a cron job to validate the entitlement status and syslog the results. tickets 28, 79, 278
2011-02-01 13:24:46 -06:00
mkdir -p %{buildroot}%{_sysconfdir}/cron.d
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%clean
rm -rf %{buildroot}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%post server
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
/bin/systemctl --system daemon-reload 2>&1 || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Automatically update IPA LDAP on rpm upgrades Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
2011-03-18 10:19:53 -05:00
if [ $1 -gt 1 ] ; then
Make certmonger a (pre) requires on server, restart it before upgrading certmonger may provide new CAs, as in the case from upgrading IPA 2.2 to 3.x. We need these new CAs available during the upgrade process. The certmonger package does its own condrestart as part of %postun which runs after the %post script of freeipa-server, so we need to restart it ourselves before upgrading. https://fedorahosted.org/freeipa/ticket/3378
2013-01-24 15:14:31 -06:00
/bin/systemctl condrestart certmonger.service 2>&1 || :
Automatically update IPA LDAP on rpm upgrades Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
2011-03-18 10:19:53 -05:00
fi
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
/bin/systemctl reload-or-try-restart dbus
/bin/systemctl reload-or-try-restart oddjobd
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Add plugin framework to LDAP updates. There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
2011-11-23 15:52:40 -06:00
%posttrans server
SPEC: do not run upgrade when ipa server is not installed Running upgrade when IPA is not installed produces false positive errors https://fedorahosted.org/freeipa/ticket/5704 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-01 11:56:28 -06:00
# don't execute upgrade and restart of IPA when server is not installed
Use /usr/bin/python2 Part of the effort to port FreeIPA to Arch Linux, where Python 3 is the default. FreeIPA hasn't been ported to Python 3, so the code must be modified to run /usr/bin/python2 https://fedorahosted.org/freeipa/ticket/3438 Updated by pviktori@redhat.com
2013-11-27 07:53:57 -06:00
python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
SPEC: do not run upgrade when ipa server is not installed Running upgrade when IPA is not installed produces false positive errors https://fedorahosted.org/freeipa/ticket/5704 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-01 11:56:28 -06:00
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
if [ $? -eq 0 ]; then
SPEC: do not run upgrade when ipa server is not installed Running upgrade when IPA is not installed produces false positive errors https://fedorahosted.org/freeipa/ticket/5704 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-01 11:56:28 -06:00
# This must be run in posttrans so that updates from previous
# execution that may no longer be shipped are not applied.
/usr/sbin/ipa-server-upgrade --quiet >/dev/null || :
# Restart IPA processes. This must be also run in postrans so that plugins
# and software is in consistent state
# NOTE: systemd specific section
Fix ipa.service restart Ticket: https://fedorahosted.org/freeipa/ticket/4243 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-17 09:12:47 -05:00
/bin/systemctl is-enabled ipa.service >/dev/null 2>&1
if [ $? -eq 0 ]; then
/bin/systemctl restart ipa.service >/dev/null 2>&1 || :
fi
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
fi
# END
Add plugin framework to LDAP updates. There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
2011-11-23 15:52:40 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%preun server
if [ $1 = 0 ]; then
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Update spec file to use systemd on Fedora 16 and above
2011-10-21 08:44:36 -05:00
/bin/systemctl --quiet stop ipa.service || :
/bin/systemctl --quiet disable ipa.service || :
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
/bin/systemctl reload-or-try-restart dbus
/bin/systemctl reload-or-try-restart oddjobd
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
fi
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
2012-02-13 08:16:26 -06:00
%pre server
# Stop ipa_kpasswd if it exists before upgrading so we don't have a
# zombie process when we're done.
if [ -e /usr/sbin/ipa_kpasswd ]; then
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
2012-02-13 08:16:26 -06:00
/bin/systemctl stop ipa_kpasswd.service >/dev/null 2>&1 || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
2012-02-13 08:16:26 -06:00
fi
Create system users for FreeIPA services during package installation Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-04-11 04:43:40 -05:00
# create users and groups
# create kdcproxy group and user
getent group kdcproxy >/dev/null || groupadd -f -r kdcproxy
getent passwd kdcproxy >/dev/null || useradd -r -g kdcproxy -s /sbin/nologin -d / -c "IPA KDC Proxy User" kdcproxy
# create ipaapi group and user
getent group ipaapi >/dev/null || groupadd -f -r ipaapi
getent passwd ipaapi >/dev/null || useradd -r -g ipaapi -s /sbin/nologin -d / -c "IPA Framework User" ipaapi
# add apache to ipaaapi group
id -Gn apache | grep '\bipaapi\b' >/dev/null || usermod apache -a -G ipaapi
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%postun server-trust-ad
if [ "$1" -ge "1" ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then
%{_sbindir}/alternatives --set winbind_krb5_locator.so /dev/null
fi
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
fi
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%post server-trust-ad
%{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
winbind_krb5_locator.so /dev/null 90
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
/bin/systemctl reload-or-try-restart dbus
/bin/systemctl reload-or-try-restart oddjobd
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Run server upgrade and restart in posttrans Running server upgrade or restart in %post or %postun may cause issues when there are still parts of old FreeIPA software (like entitlements plugin). https://fedorahosted.org/freeipa/ticket/3739
2013-07-11 09:35:26 -05:00
%posttrans server-trust-ad
Use /usr/bin/python2 Part of the effort to port FreeIPA to Arch Linux, where Python 3 is the default. FreeIPA hasn't been ported to Python 3, so the code must be modified to run /usr/bin/python2 https://fedorahosted.org/freeipa/ticket/3438 Updated by pviktori@redhat.com
2013-11-27 07:53:57 -06:00
python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
if [ $? -eq 0 ]; then
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# NOTE: systemd specific section
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
/bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Restart httpd if ipa-server-trust-ad is installed or updated If ipa-server-trust-ad is installed after the ipa server is installed and configured, httpd needs a restart for additional python modules to be loaded into httpd on IPA initialization. Fixes https://fedorahosted.org/freeipa/ticket/3185
2012-10-26 06:12:17 -05:00
fi
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%preun server-trust-ad
if [ $1 -eq 0 ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
/bin/systemctl reload-or-try-restart dbus
/bin/systemctl reload-or-try-restart oddjobd
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
fi
Implement an IPA Foreman smartproxy server This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-12-03 10:14:00 -06:00
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
%post client
if [ $1 -gt 1 ] ; then
# Has the client been configured?
restore=0
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf 2>/dev/null ; then
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
Use 'mv -Z' in specfile to restore SELinux context There might be AVC denial between moving file and restoring context. Using 'mv -Z' will solve this issue. https://fedorahosted.org/freeipa/ticket/4923 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-17 09:12:07 -05:00
mv -Z /etc/krb5.conf.ipanew /etc/krb5.conf
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
fi
fi
Fix ntpd config on clients. https://fedorahosted.org/freeipa/ticket/4094
2014-01-24 03:16:48 -06:00
if [ -f '/etc/sysconfig/ntpd' -a $restore -ge 2 ]; then
if grep -E -q 'OPTIONS=.*-u ntp:ntp' /etc/sysconfig/ntpd 2>/dev/null; then
sed -r '/OPTIONS=/ { s/\s+-u ntp:ntp\s+/ /; s/\s*-u ntp:ntp\s*// }' /etc/sysconfig/ntpd >/etc/sysconfig/ntpd.ipanew
Use 'mv -Z' in specfile to restore SELinux context There might be AVC denial between moving file and restoring context. Using 'mv -Z' will solve this issue. https://fedorahosted.org/freeipa/ticket/4923 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-17 09:12:07 -05:00
mv -Z /etc/sysconfig/ntpd.ipanew /etc/sysconfig/ntpd
Fix ntpd config on clients. https://fedorahosted.org/freeipa/ticket/4094
2014-01-24 03:16:48 -06:00
/bin/systemctl condrestart ntpd.service 2>&1 || :
fi
fi
Introduce NSS database /etc/ipa/nssdb This is the new default NSS database for IPA. /etc/pki/nssdb is still maintained for backward compatibility. https://fedorahosted.org/freeipa/ticket/3259 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-18 09:28:59 -05:00
client: stop using /etc/pki/nssdb Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses /etc/ipa/nssdb and IPA CA certificates are provided to the system using p11-kit. Remove leftovers on upgrade. https://fedorahosted.org/freeipa/ticket/5592 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-02-22 08:05:35 -06:00
if [ $restore -ge 2 ]; then
certdb: move IPA NSS DB install functions to ipaclient.install The create_ipa_nssdb() and update_ipa_nssdb() depend on ipaplatform. Move them to ipaclient.install.client as they are used only from the client installer and ipa-restore. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-22 23:23:47 -06:00
python2 -c 'from ipaclient.install.client import update_ipa_nssdb; update_ipa_nssdb()' >/var/log/ipaupgrade.log 2>&1
Introduce NSS database /etc/ipa/nssdb This is the new default NSS database for IPA. /etc/pki/nssdb is still maintained for backward compatibility. https://fedorahosted.org/freeipa/ticket/3259 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-18 09:28:59 -05:00
fi
Add the includedir to krb5.conf on upgrades https://fedorahosted.org/freeipa/ticket/3132
2012-10-31 04:15:28 -05:00
fi
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%triggerin client -- openssh-server
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
# Has the client been configured?
restore=0
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
sed -r '
/^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
Silence sshd messages during install Fix for accidentally pushed commit c15ba1f9e8c7d236586d46271fce7c3950b509da During install we call sshd with no config file, sometimes leading to it complaining about missing files or bad config options. Since we're just looking for the return code to see if the options are correct, we can discard these error messages. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-11 08:39:35 -05:00
if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody' 2>/dev/null; then
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
sed -ri '
s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
' /etc/ssh/sshd_config.ipanew
Silence sshd messages during install Fix for accidentally pushed commit c15ba1f9e8c7d236586d46271fce7c3950b509da During install we call sshd with no config file, sometimes leading to it complaining about missing files or bad config options. Since we're just looking for the return code to see if the options are correct, we can discard these error messages. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-11 08:39:35 -05:00
elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody' 2>/dev/null; then
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
sed -ri '
s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
' /etc/ssh/sshd_config.ipanew
Silence sshd messages during install Fix for accidentally pushed commit c15ba1f9e8c7d236586d46271fce7c3950b509da During install we call sshd with no config file, sometimes leading to it complaining about missing files or bad config options. Since we're just looking for the return code to see if the options are correct, we can discard these error messages. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-11 08:39:35 -05:00
elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody' 2>/dev/null; then
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
sed -ri '
s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
' /etc/ssh/sshd_config.ipanew
fi
Use 'mv -Z' in specfile to restore SELinux context There might be AVC denial between moving file and restoring context. Using 'mv -Z' will solve this issue. https://fedorahosted.org/freeipa/ticket/4923 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-17 09:12:07 -05:00
mv -Z /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
Add support for OpenSSH 6.2. Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config on openssh-server update. https://fedorahosted.org/freeipa/ticket/3571
2013-04-18 11:06:54 -05:00
chmod 600 /etc/ssh/sshd_config
/bin/systemctl condrestart sshd.service 2>&1 || :
fi
fi
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Add a separate client-only target
2009-10-12 15:00:00 -05:00
%if ! %{ONLY_CLIENT}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%files server
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Use %license instead of %doc for packaging the license https://fedorahosted.org/freeipa/ticket/5227 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-17 09:14:05 -05:00
%license COPYING
Full system backup and restore This will allow one to backup and restore the IPA files and data. This does not cover individual entry restoration. http://freeipa.org/page/V3/Backup_and_Restore https://fedorahosted.org/freeipa/ticket/3128
2013-03-13 08:36:41 -05:00
%{_sbindir}/ipa-backup
%{_sbindir}/ipa-restore
Make dogtag an optional (and default un-) installed component in a replica. A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
2011-06-17 15:47:39 -05:00
%{_sbindir}/ipa-ca-install
Add a KRA to IPA This patch adds the capability of installing a Dogtag KRA to an IPA instance. With this patch, a KRA is NOT configured by default when ipa-server-install is run. Rather, the command ipa-kra-install must be executed on an instance on which a Dogtag CA has already been configured. The KRA shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin user/agent (and agent cert) can be used for both subsystems. Certmonger is also confgured to monitor the new subsystem certificates. To create a clone KRA, simply execute ipa-kra-install <replica_file> on a replica on which a Dogtag CA has already been replicated. ipa-kra-install will use the security domain to detect whether the system being installed is a replica, and will error out if a needed replica file is not provided. The install scripts have been refactored somewhat to minimize duplication of code. A new base class dogtagintance.py has been introduced containing code that is common to KRA and CA installs. This will become very useful when we add more PKI subsystems. The KRA will install its database as a subtree of o=ipaca, specifically o=ipakra,o=ipaca. This means that replication agreements created to replicate CA data will also replicate KRA data. No new replication agreements are required. Added dogtag plugin for KRA. This is an initial commit providing the basic vault functionality needed for vault. This plugin will likely be modified as we create the code to call some of these functions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3872 The uninstallation option in ipa-kra-install is temporarily disabled. Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-18 10:23:30 -05:00
%{_sbindir}/ipa-kra-install
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-server-install
Connection check program for replica installation When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
2011-05-22 12:17:07 -05:00
%{_sbindir}/ipa-replica-conncheck
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-replica-install
%{_sbindir}/ipa-replica-prepare
%{_sbindir}/ipa-replica-manage
Create tool to manage dogtag replication agreements For the most part the existing replication code worked with the following exceptions: - Added more port options - It assumed that initial connections were done to an SSL port. Added ability to use startTLS - It assumed that the name of the agreement was the same on both sides. In dogtag one is marked as master and one as clone. A new option is added, master, the determines which side we're working on or None if it isn't a dogtag agreement. - Don't set the attribute exclude list on dogtag agreements - dogtag doesn't set a schedule by default (which is actually recommended by 389-ds). This causes problems when doing a force-sync though so if one is done we set a schedule to run all the time. Otherwise the temporary schedule can't be removed (LDAP operations error). https://fedorahosted.org/freeipa/ticket/1250
2011-07-14 22:35:01 -05:00
%{_sbindir}/ipa-csreplica-manage
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-server-certinstall
Server Upgrade: ipa-server-upgrade command https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2015-04-02 07:14:15 -05:00
%{_sbindir}/ipa-server-upgrade
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_sbindir}/ipa-ldap-updater
Implement OTP token importing This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to validate or add. Using the output file, the sysadmin can attempt to recover these specific tokens. This code is implemented as a server-side script. However, it doesn't actually need to run on the server. This was done because importing is an odd fit for the IPA command framework: 1. We need to write an output file. 2. The operation may be long-running (thousands of tokens). 3. Only admins need to perform this task and it only happens infrequently. https://fedorahosted.org/freeipa/ticket/4261 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-08 10:06:16 -05:00
%{_sbindir}/ipa-otptoken-import
Move tools that are really only applicable to be run on the server This moves a bunch of tools that only make sense to run on the actual server from the admintools subpackage to the server subpackage. ticket 947
2011-02-11 13:05:20 -06:00
%{_sbindir}/ipa-compat-manage
%{_sbindir}/ipa-nis-manage
25 Create Tool for Enabling/Disabling Managed Entry Plugins Remove legacy ipa-host-net-manage Add ipa-managed-entries tool Add man page for ipa-managed-entries tool https://fedorahosted.org/freeipa/ticket/1181
2011-09-20 11:13:42 -05:00
%{_sbindir}/ipa-managed-entries
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipactl
Provide ipa-advise tool Provides a pluggable framework for generating configuration scriptlets and instructions for various machine setups and use cases. Creates a new ipa-advise command, available to root user on the IPA server. Also provides an example configuration plugin, config-fedora-authconfig. https://fedorahosted.org/freeipa/ticket/3670
2013-06-10 07:43:24 -05:00
%{_sbindir}/ipa-advise
Add CA certificate management tool ipa-cacert-manage. Part of https://fedorahosted.org/freeipa/ticket/3737 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-03-13 04:28:27 -05:00
%{_sbindir}/ipa-cacert-manage
winsync-migrate: Include the tool parts in Makefile and friends https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-04-29 01:16:12 -05:00
%{_sbindir}/ipa-winsync-migrate
Add new certmonger CA helper dogtag-ipa-ca-renew-agent. The helper will be used to handle CA-related certificate renewal requests. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-10-16 02:26:39 -05:00
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
Make certificate renewal process synchronized Synchronization is achieved using a global renewal lock. https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-01-08 03:06:46 -06:00
%{_libexecdir}/certmonger/ipa-server-guard
DNSSEC: add ipa dnssec daemons Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-19 10:04:40 -05:00
%dir %{_libexecdir}/ipa
Use Custodia 0.3.1 features * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-28 05:07:19 -06:00
%{_libexecdir}/ipa/ipa-custodia
DNSSEC: add ipa dnssec daemons Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-19 10:04:40 -05:00
%{_libexecdir}/ipa/ipa-dnskeysyncd
%{_libexecdir}/ipa/ipa-dnskeysync-replica
%{_libexecdir}/ipa/ipa-ods-exporter
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
%{_libexecdir}/ipa/ipa-httpd-kdcproxy
Setup lightweight CA key retrieval on install/upgrade Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-31 17:07:33 -05:00
%{_libexecdir}/ipa/ipa-pki-retrieve-key
Move ipa-otpd to $libexecdir/ipa This is more consistent with the other daemons. Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-09-29 17:00:02 -05:00
%{_libexecdir}/ipa/ipa-otpd
build: put oddjob scripts into separate directory https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:17:07 -06:00
%dir %{_libexecdir}/ipa/oddjob
replica install: add remote connection check over API Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-09 01:18:21 -06:00
%attr(0755,root,root) %{_libexecdir}/ipa/oddjob/org.freeipa.server.conncheck
%config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.freeipa.server.conf
%config(noreplace) %{_sysconfdir}/oddjobd.conf.d/ipa-server.conf
IPA certauth plugin This patch add a certauth plugin which allows the IPA server to support PKINIT for certificates which do not include a special SAN extension which contains a Kerberos principal but allow other mappings with the help of SSSD's certmap library. Related to https://pagure.io/freeipa/issue/4905 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2017-02-02 05:32:13 -06:00
%config(noreplace) %{_sysconfdir}/krb5.conf.d/ipa-certauth
Move freeipa certmonger helpers to libexecdir. The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-02-23 05:10:34 -06:00
%dir %{_libexecdir}/ipa/certmonger
%attr(755,root,root) %{_libexecdir}/ipa/certmonger/*
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
# NOTE: systemd specific section
%attr(644,root,root) %{_unitdir}/ipa.service
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
%attr(644,root,root) %{_unitdir}/ipa-dnskeysyncd.service
%attr(644,root,root) %{_unitdir}/ipa-ods-exporter.socket
%attr(644,root,root) %{_unitdir}/ipa-ods-exporter.service
# END
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
%attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so
%attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so
%attr(755,root,root) %{plugin_dir}/libtopology.so
%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
Build: do not compress manual pages at install time At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 07:36:45 -05:00
%{_mandir}/man1/ipa-replica-conncheck.1*
%{_mandir}/man1/ipa-replica-install.1*
%{_mandir}/man1/ipa-replica-manage.1*
%{_mandir}/man1/ipa-csreplica-manage.1*
%{_mandir}/man1/ipa-replica-prepare.1*
%{_mandir}/man1/ipa-server-certinstall.1*
%{_mandir}/man1/ipa-server-install.1*
%{_mandir}/man1/ipa-server-upgrade.1*
%{_mandir}/man1/ipa-ca-install.1*
%{_mandir}/man1/ipa-kra-install.1*
%{_mandir}/man1/ipa-compat-manage.1*
%{_mandir}/man1/ipa-nis-manage.1*
%{_mandir}/man1/ipa-managed-entries.1*
%{_mandir}/man1/ipa-ldap-updater.1*
%{_mandir}/man8/ipactl.8*
%{_mandir}/man1/ipa-backup.1*
%{_mandir}/man1/ipa-restore.1*
%{_mandir}/man1/ipa-advise.1*
%{_mandir}/man1/ipa-otptoken-import.1*
%{_mandir}/man1/ipa-cacert-manage.1*
%{_mandir}/man1/ipa-winsync-migrate.1*
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%files -n python2-ipaserver
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%license COPYING
%{python2_sitelib}/ipaserver
%{python2_sitelib}/ipaserver-*.egg-info
%if 0%{?with_python3}
%files -n python3-ipaserver
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%{python3_sitelib}/ipaserver
%{python3_sitelib}/ipaserver-*.egg-info
%endif # with_python3
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%files server-common
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
install: fix kdcproxy user home directory https://fedorahosted.org/freeipa/ticket/5314 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-23 03:35:06 -05:00
%ghost %verify(not owner group) %dir %{_sharedstatedir}/kdcproxy
spec file: Move /etc/ipa/kdcproxy to the server subpackage The directory was in the python subpackage, but that broke client-only build. We don't want the directory to be installed on clients anyway, since it is part of a server-side feature. Reviewed-By: Christian Heimes <cheimes@redhat.com>
2015-07-14 06:41:46 -05:00
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/kdcproxy
DNSSEC: add ipa dnssec daemons Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-19 10:04:40 -05:00
%config(noreplace) %{_sysconfdir}/sysconfig/ipa-dnskeysyncd
%config(noreplace) %{_sysconfdir}/sysconfig/ipa-ods-exporter
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
%config(noreplace) %{_sysconfdir}/ipa/kdcproxy/kdcproxy.conf
Add ipa-custodia service Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-08 12:39:29 -05:00
%attr(644,root,root) %{_unitdir}/ipa-custodia.service
Configure httpd service from installer instead of directly from RPM File httpd.service was created by RPM, what causes that httpd service may fail due IPA specific configuration even if IPA wasn't installed or was uninstalled (without erasing RPMs). With this patch httpd service is configured by httpd.d/ipa.conf during IPA installation and this config is removed by uninstaller, so no residual http configuration related to IPA should stay there. https://fedorahosted.org/freeipa/ticket/5681 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-03-16 03:04:42 -05:00
%ghost %attr(644,root,root) %{etc_systemd_dir}/httpd.d/ipa.conf
Prepare spec file for Fedora 18 FreeIPA 3.0 is being released to Fedora 18 only. Since we only support Fedora 17 and Fedora 18 in FreeIPA 3.0+, compatibility code for older Fedoras can be dropped. This should clean up the spec file and make it more readable. Dogtag10 Requires were fixed. Without this patch, there is a conflict on dogtag-pki-common-theme. Tar requirement was added to avoid crashes in ipa-replica-prepare on some minimal Fedora composes. https://fedorahosted.org/freeipa/ticket/2748 https://fedorahosted.org/freeipa/ticket/3237
2012-11-14 09:45:41 -06:00
# END
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa
Fixed ipa.spec.in to include share/ipa/wsgi.py*
2010-03-01 22:41:41 -06:00
%{_usr}/share/ipa/wsgi.py*
Replace hard-coded kdcproxy path with WSGI script mod_wsgi has no way to import a WSGI module by dotted module name. A new kdcproxy.wsgi script is used to import kdcproxy from whatever Python version mod_wsgi is compiled against. This will simplify moving FreeIPA to Python 3 and solves an import problem on Debian. Resolves: https://pagure.io/freeipa/issue/6834 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-29 10:58:47 -05:00
%{_usr}/share/ipa/kdcproxy.wsgi
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/*.ldif
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
Generate tmpfiles config at install time We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-01 10:37:20 -06:00
%{_usr}/share/ipa/ipa.conf.tmpfiles
Add ipa-advise plugins for legacy clients Old versions of SSSD do not directly support cross-realm trusts between IPA and AD. This patch introduces plugins for the ipa-advise tool, which should help with configuring an old version of SSSD (1.5-1.8) to gain access to resources in trusted domain. Since the configuration steps differ depending on whether the platform includes the authconfig tool, two plugins are needed: * config-redhat-sssd-before-1-9 - provides configuration for Red Hat based systems, as these system include the autconfig utility * config-generic-sssd-before-1-9 - provides configuration for other platforms https://fedorahosted.org/freeipa/ticket/3671 https://fedorahosted.org/freeipa/ticket/3672
2013-08-01 07:12:39 -05:00
%dir %{_usr}/share/ipa/advise
%dir %{_usr}/share/ipa/advise/legacy
%{_usr}/share/ipa/advise/legacy/*.template
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-11 20:17:48 -05:00
%dir %{_usr}/share/ipa/profiles
%{_usr}/share/ipa/profiles/*.cfg
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa/html
Configuration pages changed to use new FF extension browserconfig.html was changed to use new FF extension. The page is completely Firefox specific therefore the title was changed from 'Configure browser' to 'Firefox configuration'. Instruction to import CA cert in unauthorized.html are FF specific too, so they were moved to browserconfig.html. Unauthorized.html text was changed to distinguish FF config and other browsers. Now the page shows link for FF (browserconfig.html) and other browsers (ssbrowser.html). Ssbrowser.html should be enhanced by more configurations and browsers later [1]. Old configuration method was moved to ssbrowser.html. Unauthorized dialog in Web UI now links to http://../unauthorized.html instead of https. This change is done because of FF strange handling of extension installations from https sites [2]. Firefox allows ext. installation from https sites only when the certificate is signed by some build-in CA. To allow custom CAs an option in about:config has to be changed which don't help us at all because we wants to avoid manual changes in about:config. The design of browserconfig is inspired by Kyle Baker's design (2.1 Enhancements_v2.odt). It is not exactly the same. Highlighting of the steps wasn't used because in some cases we can switch some steps. Ticket: https://fedorahosted.org/freeipa/ticket/3094 [1] https://fedorahosted.org/freeipa/ticket/823 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=688383
2012-10-01 10:36:42 -05:00
%{_usr}/share/ipa/html/ffconfig.js
%{_usr}/share/ipa/html/ffconfig_page.js
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/html/ssbrowser.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%{_usr}/share/ipa/html/browserconfig.html
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/html/unauthorized.html
Add DS migration plugin and password migration page.
2010-01-12 09:40:09 -06:00
%dir %{_usr}/share/ipa/migration
%{_usr}/share/ipa/migration/error.html
%{_usr}/share/ipa/migration/index.html
%{_usr}/share/ipa/migration/invalid.html
%{_usr}/share/ipa/migration/migration.py*
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
%dir %{_usr}/share/ipa/ui
%{_usr}/share/ipa/ui/index.html
Separate reset password page This patch adds separate reset password page. It is a complement to separate login page. It differentiate from reset password capabilities in Web UI's anauthorized dialog by not performing login. This is useful for users who wants only to reset the password and not to use Web UI. And also for users who are using the separate login page. https://fedorahosted.org/freeipa/ticket/2755
2012-06-08 09:38:17 -05:00
%{_usr}/share/ipa/ui/reset_password.html
webui: add sync_otp.html standalone page for OTP token synchronization. It reuses SyncOTPScreen widget instead of reimplementing the logic as in other standalone pages. https://fedorahosted.org/freeipa/ticket/4218 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-05 11:50:03 -05:00
%{_usr}/share/ipa/ui/sync_otp.html
Fixed missing icons. The Makefile.am and the spec file have been fixed to include all icons in the install/ui folder. Ticket #1559
2011-08-02 12:42:42 -05:00
%{_usr}/share/ipa/ui/*.ico
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
%{_usr}/share/ipa/ui/*.css
%{_usr}/share/ipa/ui/*.js
Use only system fonts This commit changes how fonts are used. - remove usage of bundled fonts and only system fonts are used instead - by using alias in httpd conf - by using local("Font Name") directive in font-face - removed usage of overpass font - redefined Open Sans font-face declarations. Note: upstream is doing the same change so we will be fine on upgrade. - introduce variable.less for variable definitions and overrides. This file will be very useful when we upgrade to newer RCUE so we will be able to redefine their and bootstrap's variables. Fixes: https://fedorahosted.org/freeipa/ticket/2861
2013-12-04 09:15:20 -06:00
%dir %{_usr}/share/ipa/ui/css
RCUE initial commit https://fedorahosted.org/freeipa/ticket/3902
2013-10-10 06:41:31 -05:00
%{_usr}/share/ipa/ui/css/*.css
Own /usr/share/ipa/ui/js/ in the spec file. https://fedorahosted.org/freeipa/ticket/4010
2013-11-27 07:20:22 -06:00
%dir %{_usr}/share/ipa/ui/js
Updated makefiles to build FreeIPA Web UI layer Updated makefiles to comply to new directory structure and also to use builder for building Web UI. FreeIPA package spec is modified to use the output of the builder. https://fedorahosted.org/freeipa/ticket/112
2012-11-23 10:19:37 -06:00
%dir %{_usr}/share/ipa/ui/js/dojo
%{_usr}/share/ipa/ui/js/dojo/dojo.js
%dir %{_usr}/share/ipa/ui/js/libs
%{_usr}/share/ipa/ui/js/libs/*.js
%dir %{_usr}/share/ipa/ui/js/freeipa
%{_usr}/share/ipa/ui/js/freeipa/app.js
webui: layer for standalone pages which use WebUI framework Current compiled Web UI layer (app.js) contains every FreeIPA plugin and not just the UI framework. It's not possible to start just a simple facet. This commit creates a basis for a layer (core.js) which contains only framework code and not entity related code. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-05 10:12:41 -05:00
%{_usr}/share/ipa/ui/js/freeipa/core.js
Web UI plugin loader https://fedorahosted.org/freeipa/ticket/3235
2013-03-20 11:28:17 -05:00
%dir %{_usr}/share/ipa/ui/js/plugins
Fixed inconsistent image names. The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
2011-10-26 16:06:17 -05:00
%dir %{_usr}/share/ipa/ui/images
webui: login screen widget Reimplementation of unauthorized dialog into separate widget. It uses RCUE design. New features compared to unauthorized dialog: - reflects auth methods from `auth` module - validation summary - differentiates Kerberos auth failure with session expiration - Caps Lock warning - form based method doesn't allow password only submission https://fedorahosted.org/freeipa/ticket/4017 https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2013-11-13 09:02:48 -06:00
%{_usr}/share/ipa/ui/images/*.jpg
Fixed inconsistent image names. The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
2011-10-26 16:06:17 -05:00
%{_usr}/share/ipa/ui/images/*.png
Generate plugin index dynamically https://fedorahosted.org/freeipa/ticket/3235
2013-04-23 12:54:21 -05:00
%dir %{_usr}/share/ipa/wsgi
%{_usr}/share/ipa/wsgi/plugins.py*
%dir %{_sysconfdir}/ipa
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_sysconfdir}/ipa/html
Configuration pages changed to use new FF extension browserconfig.html was changed to use new FF extension. The page is completely Firefox specific therefore the title was changed from 'Configure browser' to 'Firefox configuration'. Instruction to import CA cert in unauthorized.html are FF specific too, so they were moved to browserconfig.html. Unauthorized.html text was changed to distinguish FF config and other browsers. Now the page shows link for FF (browserconfig.html) and other browsers (ssbrowser.html). Ssbrowser.html should be enhanced by more configurations and browsers later [1]. Old configuration method was moved to ssbrowser.html. Unauthorized dialog in Web UI now links to http://../unauthorized.html instead of https. This change is done because of FF strange handling of extension installations from https sites [2]. Firefox allows ext. installation from https sites only when the certificate is signed by some build-in CA. To allow custom CAs an option in about:config has to be changed which don't help us at all because we wants to avoid manual changes in about:config. The design of browserconfig is inspired by Kyle Baker's design (2.1 Enhancements_v2.odt). It is not exactly the same. Highlighting of the steps wasn't used because in some cases we can switch some steps. Ticket: https://fedorahosted.org/freeipa/ticket/3094 [1] https://fedorahosted.org/freeipa/ticket/823 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=688383
2012-10-01 10:36:42 -05:00
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
error handling style modifying the directories so they find the assets in the right locations
2011-01-25 13:44:42 -06:00
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
Properly own (via ghost) the Apache configuration files.
2009-09-16 12:04:14 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
spec file: remove config files from freeipa-python /etc/ipa/dnssec is now owned by freeipa-server. The remaining files are now owned by freeipa-client. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-11-26 03:52:07 -06:00
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/dnssec
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_usr}/share/ipa/ipa.conf
%{_usr}/share/ipa/ipa-rewrite.conf
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
%{_usr}/share/ipa/ipa-pki-proxy.conf
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con
Build and installation of Kerberos authentication extension This patch is adding a build of kerberosauth.xpi (FF Kerberos authentication extension). Currently the build is done in install phase of FreeIPA server. It is to allow signing of the extension by singing certificate. The signing might not be necessary because the only outcome is that in extension installation FF doesn't show that the maker is not verified. It shows text: 'Object signing cert'. This might be a bug in httpinstance.py:262(db.create_signing_cert("Signing-Cert", "Object Signing Cert", ca_db)) The value is in place of hostname parameter. If the extension is not signed, it can be created in rpm build phase, which should make upgrades easier. Current implementation doesn't handle upgrades yet. In order to keep extension and config pages not dependent on a realm, a krb.js.teplate file was created. This template is used for creating a /usr/share/ipa/html/krb.js file in install phase which holds FreeIPA's realm and domain information. This information can be then used by config pages by importing this file. Ticket: https://fedorahosted.org/freeipa/ticket/3094
2012-10-04 10:08:17 -05:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js
%ghost the UI files that we install/create on the fly https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 11:32:47 -06:00
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_usr}/share/ipa/updates/
%{_usr}/share/ipa/updates/*
%dir %{_localstatedir}/lib/ipa
Require new samba and krb5 Require samba 4.0.5 (passdb API changed). Make sure that we use the right epoch number with samba so that the Requires is correctly enforced. Require krb5 1.11.2-1 to fix missing PAC issue. Also fix backup dir permissions.
2013-04-16 02:44:28 -05:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/backup
Configure HTTPD to work via Gss-Proxy https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-29 10:10:22 -06:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/gssproxy
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
Add sysupgrade state file When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
2012-06-08 01:31:37 -05:00
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysupgrade
Move CRL publish directory to IPA owned directory Currently, CRL files are being exported to /var/lib/pki-ca sub-directory, which is then served by httpd to clients. However, this approach has several disadvantages: * We depend on pki-ca directory structure and relevant permissions. If pki-ca changes directory structure or permissions on upgrade, IPA may break. This is also a root cause of the latest error, where the pki-ca directory does not have X permission for others and CRL publishing by httpd breaks. * Since the directory is not static and is generated during ipa-server-install, RPM upgrade of IPA packages report errors when defining SELinux policy for these directories. Move CRL publish directory to /var/lib/ipa/pki-ca/publish (common for both dogtag 9 and 10) which is created on RPM upgrade, i.e. SELinux policy configuration does not report any error. The new CRL publish directory is used for both new IPA installs and upgrades, where contents of the directory (CRLs) is first migrated to the new location and then the actual configuration change is made. https://fedorahosted.org/freeipa/ticket/3144
2012-10-08 08:58:48 -05:00
%attr(755,root,root) %dir %{_localstatedir}/lib/ipa/pki-ca
Change group ownership of CRL publish directory Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no longer owned by created with package installation. The directory is rather created/removed with the CA instance itself. This ensures proper creation/removeal, group ownership and SELinux context. https://fedorahosted.org/freeipa/ticket/3727
2013-07-16 05:10:54 -05:00
%ghost %{_localstatedir}/lib/ipa/pki-ca/publish
Fix named working directory permissions Just adding dir to specfile doesnt work, because is not guarantee the named is installed, during RPM installation. Ticket: https://fedorahosted.org/freeipa/ticket/4716 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 06:00:18 -06:00
%ghost %{_localstatedir}/named/dyndb-ldap/ipa
Add ipa-custodia service Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-08 12:39:29 -05:00
%dir %attr(0700,root,root) %{_sysconfdir}/ipa/custodia
support schema files from third-party plugins Allow upgrade process to include schema files from third-party plugins installed in /usr/share/ipa/schema.d/*.schema. The directory /usr/shar/eipa/schema.d is owned by the server-common subpackage and therefore third-party plugins should depend on freeipa-server-common (ipa-server-common) package in their package dependencies. Resolves: https://fedorahosted.org/freeipa/ticket/5864 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-05 05:04:19 -05:00
%dir %{_usr}/share/ipa/schema.d
%attr(0644,root,root) %{_usr}/share/ipa/schema.d/README
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
%attr(0644,root,root) %{_usr}/share/ipa/gssapi.login
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
%files server-dns
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
%{_sbindir}/ipa-dns-install
Build: do not compress manual pages at install time At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 07:36:45 -05:00
%{_mandir}/man1/ipa-dns-install.1*
Create server-dns sub-package. This allows us to automatically pull in package bind-pkcs11 and thus create upgrade path for on CentOS 7.1 -> 7.2. IPA previously had no requires on BIND packages and these had to be installed manually before first ipa-dns-install run. We need to pull additional bind-pkcs11 package during RPM upgrade so ipa-dns-install cannot help with this. https://fedorahosted.org/freeipa/ticket/4058 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-16 08:09:45 -05:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%files server-trust-ad
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%{_sbindir}/ipa-adtrust-install
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
%{_usr}/share/ipa/smb.conf.empty
Move AD trust support code to freeipa-server-trust-ad subpackage DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
2012-06-12 07:58:50 -05:00
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
Build: do not compress manual pages at install time At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 07:36:45 -05:00
%{_mandir}/man1/ipa-adtrust-install.1*
Make sure samba{,4}-winbind-krb5-locator package is not used with trusts Since use of winbind on FreeIPA server that is configured with trusts is conflicting with krb5 locator based on winbind, use alternatives mechanism to turn off the locator plugin by symlinking it to /dev/null. https://fedorahosted.org/freeipa/ticket/3102
2012-10-10 01:46:08 -05:00
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
%{_sysconfdir}/dbus-1/system.d/oddjob-ipa-trust.conf
%{_sysconfdir}/oddjobd.conf.d/oddjobd-ipa-trust.conf
replica promotion: fix AVC denials in remote connection check Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-01-15 01:07:21 -06:00
%%attr(755,root,root) %{_libexecdir}/ipa/oddjob/com.redhat.idm.trust-fetch-domains
Implement an IPA Foreman smartproxy server This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2013-12-03 10:14:00 -06:00
Remove rpmlint warnings in spec file Specifically: - combination of spaces and tabs in one line - using macros in comments - using "egrep" instead of "grep -E" https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 03:56:26 -05:00
%endif # ONLY_CLIENT
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%files client
Clean up some rpmlint errors in the spec file. Re-arrange doc and defattr to clean up rpmlint warnings Remove conditionals on older releases Move some man pages into admintools subpackage Remove some explicit Requires in client that aren't needed Consistent use of buildroot vs RPM_BUILD_ROOT Ticket 804
2011-01-25 10:03:40 -06:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Use %license instead of %doc for packaging the license https://fedorahosted.org/freeipa/ticket/5227 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-17 09:14:05 -05:00
%license COPYING
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-client-install
Configure automount using autofs or sssd. This script edits nsswitch.conf to use either ldap (autofs) or sss (sssd) to find automount maps. NFSv4 services are started so Kerberos encryption and/or integrity can be used on the maps. https://fedorahosted.org/freeipa/ticket/1233 https://fedorahosted.org/freeipa/ticket/2193
2012-05-29 13:20:38 -05:00
%{_sbindir}/ipa-client-automount
Add client certificate update tool ipa-certupdate. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-27 05:31:50 -05:00
%{_sbindir}/ipa-certupdate
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%{_sbindir}/ipa-getkeytab
A utility for removing principals from a keytab. When we un-enroll a client we'll do a bit of cleanup including removing any principals for the IPA realm from /etc/krb5.keytab. This removes principals in 2 ways: - By principal, only entries matching the full principal are removed - By realm. Any principal for that realm is removed This does not change the KDC at all, just removes entries from a file on the client machine.
2009-12-04 15:29:09 -06:00
%{_sbindir}/ipa-rmkeytab
Enrollment for a host in an IPA domain This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
2009-09-14 16:04:08 -05:00
%{_sbindir}/ipa-join
freeipa.spec.in: move ipa CLI utility to freeipa-client There is no notable package size cost, as all the libraries and packages are already in the freeipa-client package and freeipa-admintools only contained a short shim calling this code. Move /bin/ipa to freeipa-client, along with a man page and bash completion. Resolves: https://fedorahosted.org/freeipa/ticket/5934 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-25 03:59:34 -05:00
%{_bindir}/ipa
%config %{_sysconfdir}/bash_completion.d
Build: do not compress manual pages at install time At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 07:36:45 -05:00
%{_mandir}/man1/ipa.1*
%{_mandir}/man1/ipa-getkeytab.1*
%{_mandir}/man1/ipa-rmkeytab.1*
%{_mandir}/man1/ipa-client-install.1*
%{_mandir}/man1/ipa-client-automount.1*
%{_mandir}/man1/ipa-certupdate.1*
%{_mandir}/man1/ipa-join.1*
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%files -n python2-ipaclient
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
%dir %{python_sitelib}/ipaclient
Added plugins directory to paclient subpackages Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-28 09:21:49 -05:00
%dir %{python_sitelib}/ipaclient/plugins
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%{python_sitelib}/ipaclient/*.py*
ipa-client-install: move client install to module This commit only moves the code from ipa-client-install to module ipaclient/install/client.py and fixes PEP8. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-10-19 03:52:37 -05:00
%{python_sitelib}/ipaclient/install/*.py*
ipaclient: introduce ipaclient.plugins Load plugins from ipaclient.plugins in client API instances. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-08 05:37:40 -06:00
%{python_sitelib}/ipaclient/plugins/*.py*
ipaclient: implement thin client Dynamically create plugin package for the remote server with modules and commands based on the API schema when client API is finalizes. For in-tree API instances, use ipalib.plugins directly. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-02 03:12:26 -05:00
%{python_sitelib}/ipaclient/remote_plugins/*.py*
client: add support for pre-schema servers Bundle remote plugin interface definitions for servers which lack API schema support. These server API versions are included: * 2.49: IPA 3.1.0 on RHEL/CentOS 6.5+, * 2.114: IPA 4.1.4 on Fedora 22, * 2.156: IPA 4.2.0 on RHEL/CentOS 7.2 and IPA 4.2.4 on Fedora 23, * 2.164: IPA 4.3.1 on Fedora 23. For servers with other API versions, the closest lower API version is used. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-30 08:51:29 -05:00
%{python_sitelib}/ipaclient/remote_plugins/2_*/*.py*
Move csrgen templates into ipaclient package csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 09:09:53 -06:00
%{python_sitelib}/ipaclient/csrgen/profiles/*.json
%{python_sitelib}/ipaclient/csrgen/rules/*.json
%{python_sitelib}/ipaclient/csrgen/templates/*.tmpl
Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts) Make ipaclient a Python library like ipapython, ipalib, etc. Use setup.py instead of autotools for installing it. Move C client tools, Python scripts, and man pages, to client/. Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS). Remove /setup-client.py (ipalib/setup.py should be used instead). Update Makefiles and the spec file accordingly. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-14 07:15:49 -06:00
%{python_sitelib}/ipaclient-*.egg-info
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Package python3-ipaclient Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-19 07:54:18 -06:00
%if 0%{?with_python3}
%files -n python3-ipaclient
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Package python3-ipaclient Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-19 07:54:18 -06:00
%license COPYING
%dir %{python3_sitelib}/ipaclient
Added plugins directory to paclient subpackages Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-28 09:21:49 -05:00
%dir %{python3_sitelib}/ipaclient/plugins
Package python3-ipaclient Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-19 07:54:18 -06:00
%{python3_sitelib}/ipaclient/*.py
%{python3_sitelib}/ipaclient/__pycache__/*.py*
ipa-client-install: move client install to module This commit only moves the code from ipa-client-install to module ipaclient/install/client.py and fixes PEP8. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-10-19 03:52:37 -05:00
%{python3_sitelib}/ipaclient/install/*.py
%{python3_sitelib}/ipaclient/install/__pycache__/*.py*
ipaclient: introduce ipaclient.plugins Load plugins from ipaclient.plugins in client API instances. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-08 05:37:40 -06:00
%{python3_sitelib}/ipaclient/plugins/*.py
%{python3_sitelib}/ipaclient/plugins/__pycache__/*.py*
ipaclient: implement thin client Dynamically create plugin package for the remote server with modules and commands based on the API schema when client API is finalizes. For in-tree API instances, use ipalib.plugins directly. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-02 03:12:26 -05:00
%{python3_sitelib}/ipaclient/remote_plugins/*.py
%{python3_sitelib}/ipaclient/remote_plugins/__pycache__/*.py*
client: add support for pre-schema servers Bundle remote plugin interface definitions for servers which lack API schema support. These server API versions are included: * 2.49: IPA 3.1.0 on RHEL/CentOS 6.5+, * 2.114: IPA 4.1.4 on Fedora 22, * 2.156: IPA 4.2.0 on RHEL/CentOS 7.2 and IPA 4.2.4 on Fedora 23, * 2.164: IPA 4.3.1 on Fedora 23. For servers with other API versions, the closest lower API version is used. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-06-30 08:51:29 -05:00
%{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
%{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
Move csrgen templates into ipaclient package csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 09:09:53 -06:00
%{python3_sitelib}/ipaclient/csrgen/profiles/*.json
%{python3_sitelib}/ipaclient/csrgen/rules/*.json
%{python3_sitelib}/ipaclient/csrgen/templates/*.tmpl
Package python3-ipaclient Part of the work for https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-19 07:54:18 -06:00
%{python3_sitelib}/ipaclient-*.egg-info
%endif # with_python3
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%files client-common
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
spec file: remove config files from freeipa-python /etc/ipa/dnssec is now owned by freeipa-server. The remaining files are now owned by freeipa-client. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-11-26 03:52:07 -06:00
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/nssdb
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/cert8.db
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/key3.db
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/secmod.db
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/pwdfile.txt
%ghost %config(noreplace) %{_sysconfdir}/pki/ca-trust/source/ipa.p11-kit
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%dir %{_localstatedir}/lib/ipa-client
%dir %{_localstatedir}/lib/ipa-client/sysrestore
Build: do not compress manual pages at install time At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 07:36:45 -05:00
%{_mandir}/man5/default.conf.5*
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%files python-compat
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
%files -n python2-ipalib
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Use %license instead of %doc for packaging the license https://fedorahosted.org/freeipa/ticket/5227 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-17 09:14:05 -05:00
%license COPYING
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%dir %{python_sitelib}/ipapython
%{python_sitelib}/ipapython/*.py*
install: Introduce installer framework ipapython.install https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-02 07:04:25 -05:00
%dir %{python_sitelib}/ipapython/install
%{python_sitelib}/ipapython/install/*.py*
Include some directories in spec file Two directories were left out from package file list: ..../site-packages/ipalib ..../site-packages/ipaserver http://fedorahosted.org/freeipa/ticket/688
2011-01-05 14:51:56 -06:00
%dir %{python_sitelib}/ipalib
install: introduce installer class hierarchy Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-09 05:44:22 -06:00
%{python_sitelib}/ipalib/*.py*
%dir %{python_sitelib}/ipalib/install
%{python_sitelib}/ipalib/install/*.py*
ipaplatform: Change makefiles to accomodate for new platform package https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-02 00:50:12 -05:00
%dir %{python_sitelib}/ipaplatform
ipaplatform: Fix build warnings The newly created ipaplatform subdirectories base and fedora were mentioned multiple times in the specfile, which produced build warnings. Part of: https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-19 08:09:37 -05:00
%{python_sitelib}/ipaplatform/*
Rename ipa-python directory to ipapython so it is a real python library We used to install it as ipa, now installing it as ipapython. The rpm is still ipa-python.
2009-02-05 14:03:08 -06:00
%{python_sitelib}/ipapython-*.egg-info
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%{python_sitelib}/ipalib-*.egg-info
Include ipaplatform in client-only build https://fedorahosted.org/freeipa/ticket/4533 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-09-17 04:49:51 -05:00
%{python_sitelib}/ipaplatform-*.egg-info
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%files common -f %{gettext_domain}.lang
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
%license COPYING
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%if 0%{?with_python3}
%files -n python3-ipalib
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%license COPYING
%{python3_sitelib}/ipapython/
%{python3_sitelib}/ipalib/
%{python3_sitelib}/ipaplatform/
%{python3_sitelib}/ipapython-*.egg-info
%{python3_sitelib}/ipalib-*.egg-info
%{python3_sitelib}/ipaplatform-*.egg-info
%endif # with_python3
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%if 0%{?with_ipatests}
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%files -n python2-ipatests
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Use %license instead of %doc for packaging the license https://fedorahosted.org/freeipa/ticket/5227 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-17 09:14:05 -05:00
%license COPYING
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%{python_sitelib}/ipatests
%{python_sitelib}/ipatests-*.egg-info
Add ipa-run-tests command Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-22 04:08:10 -05:00
%{_bindir}/ipa-run-tests
Add a framework for integration test configuration Integration tests are configured via environment variables. Add a framework for parsing these variables and storing them in easy-to-use objects. Add an `ipa-test-config` executable that loads the configuration and prints out variables needed in shell scripts. Part of the work for https://fedorahosted.org/freeipa/ticket/3621
2013-05-24 12:55:21 -05:00
%{_bindir}/ipa-test-config
Add the ipa-test-task tool This script makes common testing tasks such as IPA installation and uninstallation available outside of Python. https://fedorahosted.org/freeipa/ticket/3721
2013-06-27 03:47:58 -05:00
%{_bindir}/ipa-test-task
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%{_bindir}/ipa-run-tests-2
%{_bindir}/ipa-test-config-2
%{_bindir}/ipa-test-task-2
%{_bindir}/ipa-run-tests-%{python2_version}
%{_bindir}/ipa-test-config-%{python2_version}
%{_bindir}/ipa-test-task-%{python2_version}
Build: do not compress manual pages at install time At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 07:36:45 -05:00
%{_mandir}/man1/ipa-run-tests.1*
%{_mandir}/man1/ipa-test-config.1*
%{_mandir}/man1/ipa-test-task.1*
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%if 0%{?with_python3}
%files -n python3-ipatests
%defattr(-,root,root,-)
Change README to use Markdown So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-28 12:04:03 -06:00
%doc README.md Contributors.txt
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%license COPYING
Build: makerpms.sh generates Python 2 & 3 packages at the same time Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-24 10:35:24 -06:00
%{python3_sitelib}/ipatests
%{python3_sitelib}/ipatests-*.egg-info
Package ipapython, ipalib, ipaplatform, ipatests for Python 3 Running make with PYTHON=/usr/bin/python3 will build/install the bits for Python 3. Executable scripts in ipatests have symlinks Python version suffixes as per Fedora guidelines. Suffix-less names point to the Python 2 versions. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-03 09:39:40 -06:00
%{_bindir}/ipa-run-tests-3
%{_bindir}/ipa-test-config-3
%{_bindir}/ipa-test-task-3
%{_bindir}/ipa-run-tests-%{python3_version}
%{_bindir}/ipa-test-config-%{python3_version}
%{_bindir}/ipa-test-task-%{python3_version}
%endif # with_python3
spec file: support build without ipatests Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 03:30:14 -05:00
%endif # with_ipatests
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
spec file: put Python modules into standalone packages Make the following changes in packaging: * freeipa-server - split off python2-ipaserver and freeipa-server-common, * freeipa-server-dns - build as noarch, * freeipa-client - split off python2-ipaclient and freeipa-client-common, * freeipa-admintools - build as noarch, * freeipa-python - split into python2-ipalib and freeipa-common, provide freeipa-python-compat for upgrades, * freeipa-tests - rename to python2-ipatests and build as noarch. Bump version to 4.2.91. https://fedorahosted.org/freeipa/ticket/3197 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 06:52:38 -06:00
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
%changelog
Build: move version handling from Makefile to configure Version information is now in VERSION.m4 instead of VERSION. Makefile target version-update was minimized and configure can be run before make. Makefile temporarily contains hardcoded version which has to match the one specified in VERSION.m4. This is preparatory step which will allow us to replace hand-made Makefile with one generated by Automake. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-10-21 15:35:28 -05:00
* Tue Nov 26 2013 Petr Viktorin <pviktori@redhat.com> - @VERSION@-@VENDOR_SUFFIX@
Remove changelog from the spec The project's history is kept in Git. We used the spec changelog for changes to the spec itself, which doesn't make much sense. Downstreams like Fedora use their own changelog anyway. A single entry is left for tools that expect a changelog.
2013-11-26 06:06:07 -06:00
- Remove changelog. The history is kept in Git, downstreams have own logs.
# note, this entry is here to placate tools that expect a non-empty changelog
Reference in New Issue Copy Permalink