IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-27 09:21:59 -06:00
Code Issues Packages Projects Releases Wiki Activity
af0a2409f9
freeipa/install/Makefile.am

59 lines
1.2 KiB
Makefile
Raw Normal View History

Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# This file will be processed with automake-1.7 to create Makefile.in
#
AUTOMAKE_OPTIONS = 1.7
NULL =
SUBDIRS = \
Use certmonger to renew CA subsystem certificates Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
2012-07-11 14:51:01 -05:00
certmonger \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
conf \
Kerberos authentication extension makefiles Makefiles for new FF kerberos authentication extension ihttps://fedorahosted.org/freeipa/ticket/3094
2012-10-02 09:47:28 -05:00
ffextension \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
html \
Add DS migration plugin and password migration page.
2010-01-12 09:40:09 -06:00
migration \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
share \
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
ui \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
tools \
updates \
Add support for building internationalized translations. A new directory install/po has been added which contains all the translations for all files in IPA. The build has been agumented to build these files. Also the autogen.sh script was mostly replaced by autoreconf, the preferred method. The old autogen.sh sript also had some serious bugs in the way it compared versions which caused it to run old versions of some of the tools, using standared autoreconf is much better.
2010-02-09 12:14:25 -06:00
po \
Configure certmonger to execute restart scripts on renewal. certmonger now has the ability to execute a script when it renews a certificate. This can be used to automatically restart servers so the certificate doesn't expire in the running server. https://fedorahosted.org/freeipa/ticket/2050
2012-04-10 14:21:08 -05:00
restart_scripts \
Generate plugin index dynamically https://fedorahosted.org/freeipa/ticket/3235
2013-04-23 12:54:21 -05:00
wsgi \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
$(NULL)
install-exec-local:
mkdir -p $(DESTDIR)$(localstatedir)/lib/ipa/sysrestore
chmod 700 $(DESTDIR)$(localstatedir)/lib/ipa/sysrestore
Add sysupgrade state file When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
2012-06-08 01:31:37 -05:00
mkdir -p $(DESTDIR)$(localstatedir)/lib/ipa/sysupgrade
chmod 700 $(DESTDIR)$(localstatedir)/lib/ipa/sysupgrade
Change group ownership of CRL publish directory Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no longer owned by created with package installation. The directory is rather created/removed with the CA instance itself. This ensures proper creation/removeal, group ownership and SELinux context. https://fedorahosted.org/freeipa/ticket/3727
2013-07-16 05:10:54 -05:00
mkdir -p $(DESTDIR)$(localstatedir)/lib/ipa/pki-ca
Move CRL publish directory to IPA owned directory Currently, CRL files are being exported to /var/lib/pki-ca sub-directory, which is then served by httpd to clients. However, this approach has several disadvantages: * We depend on pki-ca directory structure and relevant permissions. If pki-ca changes directory structure or permissions on upgrade, IPA may break. This is also a root cause of the latest error, where the pki-ca directory does not have X permission for others and CRL publishing by httpd breaks. * Since the directory is not static and is generated during ipa-server-install, RPM upgrade of IPA packages report errors when defining SELinux policy for these directories. Move CRL publish directory to /var/lib/ipa/pki-ca/publish (common for both dogtag 9 and 10) which is created on RPM upgrade, i.e. SELinux policy configuration does not report any error. The new CRL publish directory is used for both new IPA installs and upgrades, where contents of the directory (CRLs) is first migrated to the new location and then the actual configuration change is made. https://fedorahosted.org/freeipa/ticket/3144
2012-10-08 08:58:48 -05:00
chmod 755 $(DESTDIR)$(localstatedir)/lib/ipa/pki-ca
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
uninstall-local:
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/sysrestore
Add sysupgrade state file When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
2012-06-08 01:31:37 -05:00
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/sysupgrade
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa
DISTCLEANFILES = \
$(NULL)
MAINTAINERCLEANFILES = \
*~ \
intltool-*.in \
compile \
configure \
COPYING \
INSTALL \
install-sh \
missing \
mkinstalldirs \
config.guess \
ltmain.sh \
config.sub \
depcomp \
Makefile.in \
config.h.* \
aclocal.m4 \
version.m4 \
ipa-client.spec \
py-compile \
$(NULL)
Reference in New Issue Copy Permalink