Upgrade: fix trusts objectclass violationi

Execute updates in proper ordering.
Curently ldap-updater implementation doesnt allow better fix.

Ticket: https://fedorahosted.org/freeipa/ticket/4680
Reviewed-By: David Kupka <dkupka@redhat.com>

install/updates/59-trusts-sysacount.update

@@ -0,0 +1,8 @@
+# this update must be applied before 60-trusts.update, because current
+# implementation of ipa-ldap-updater doesn't keep the order of updates in
+# filesets
+dn: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
+add: objectClass: nestedgroup
+default: objectClass: GroupOfNames
+default: objectClass: top
+default: cn: adtrust agents

install/updates/60-trusts.update

@@ -10,12 +10,6 @@ default: member: uid=admin,cn=users,cn=accounts,$SUFFIX
 default: nsAccountLock: FALSE
 default: ipaUniqueID: autogenerate
 
-dn: cn=adtrust agents,cn=sysaccounts,cn=etc,$SUFFIX
-add: objectClass: nestedgroup
-default: objectClass: GroupOfNames
-default: objectClass: top
-default: cn: adtrust agents
-
 dn: cn=ADTrust Agents,cn=privileges,cn=pbac,$SUFFIX
 default: objectClass: top
 default: objectClass: groupofnames

install/updates/Makefile.am

@@ -42,6 +42,7 @@ app_DATA =				\
 	50-nis.update			\
 	50-ipaconfig.update		\
 	55-pbacmemberof.update		\
+	59-trusts-sysacount.update	\
 	60-trusts.update		\
 	61-trusts-s4u2proxy.update	\
 	62-ranges.update		\