IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-24 14:17:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

Drop upstreamed patches.

Browse Source
This commit is contained in:
Timo Aaltonen committed 2026-02-08 18:33:53 +02:00
1 parent 75e106ee0c
commit 450d4b2316
5 files changed
+1 -283
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

debian/changelog
Vendored
+1
View File
@@ -1,6 +1,7 @@
freeipa (4.13.1-1) UNRELEASED; urgency=medium
* New upstream release.
* Drop upstreamed patches.
-- Timo Aaltonen <tjaalton@debian.org> Thu, 30 Oct 2025 19:03:44 +0200
debian/patches/0001-ipalib-x509-support-PyCA-44.0.patch
Vendored
-166
View File
@@ -1,166 +0,0 @@
From d4d56a6705c870901bc73882e4804367f7c9c91a Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 1 Dec 2024 20:16:54 +0200
Subject: [PATCH] ipalib/x509: support PyCA 44.0
PyCA made x509.Certificate class concrete, it cannot be extended anymore
by Python code. The intent is to use helper functions to instantiate
certificate objects and never create them directly.
FreeIPA wraps PyCA's x509.Certificate class and provides own shim
on top of it. In most cases we load the certificate content via the
helper functions and don't really need to derive from the certificate
class.
Move IPACertificate to be a normal Python object class that stores
x509.Certificate internally. The only place where this breaks is when
IPACertificate object needs to be passed to a code that expects
x509.Certificate (Dogtag PKI). In such cases, expose the underlying
certificate instance via IPACertificate.cert property.
Fixes: https://pagure.io/freeipa/issue/9708
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
---
ipalib/ipajson.py | 4 ++--
ipalib/x509.py | 10 +++++++++-
ipapython/ipaldap.py | 15 +++++++--------
ipaserver/plugins/dogtag.py | 3 ++-
4 files changed, 20 insertions(+), 12 deletions(-)
diff --git a/ipalib/ipajson.py b/ipalib/ipajson.py
index 5551d12e5..fd99c8219 100644
--- a/ipalib/ipajson.py
+++ b/ipalib/ipajson.py
@@ -9,7 +9,7 @@ from decimal import Decimal
import json
import six
from ipalib.constants import LDAP_GENERALIZED_TIME_FORMAT
-from ipalib import capabilities
+from ipalib import capabilities, x509
from ipalib.x509 import Encoding as x509_Encoding
from ipapython.dn import DN
from ipapython.dnsutil import DNSName
@@ -72,7 +72,7 @@ class _JSONPrimer(dict):
list: self._enc_list,
tuple: self._enc_list,
dict: self._enc_dict,
- crypto_x509.Certificate: self._enc_certificate,
+ x509.IPACertificate: self._enc_certificate,
crypto_x509.CertificateSigningRequest: self._enc_certificate,
})
diff --git a/ipalib/x509.py b/ipalib/x509.py
index fd0823896..6780bead0 100644
--- a/ipalib/x509.py
+++ b/ipalib/x509.py
@@ -88,7 +88,7 @@ SAN_UPN = '1.3.6.1.4.1.311.20.2.3'
SAN_KRB5PRINCIPALNAME = '1.3.6.1.5.2.2'
-class IPACertificate(crypto_x509.Certificate):
+class IPACertificate:
"""
A proxy class wrapping a python-cryptography certificate representation for
IPA purposes
@@ -205,6 +205,10 @@ class IPACertificate(crypto_x509.Certificate):
"""
return self._cert.fingerprint(algorithm)
+ @property
+ def cert(self):
+ return self._cert
+
@property
def serial_number(self):
return self._cert.serial_number
@@ -457,6 +461,8 @@ def load_pem_x509_certificate(data):
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
"""
+ if isinstance(data, IPACertificate):
+ return data
return IPACertificate(
crypto_x509.load_pem_x509_certificate(data, backend=default_backend())
)
@@ -469,6 +475,8 @@ def load_der_x509_certificate(data):
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
"""
+ if isinstance(data, IPACertificate):
+ return data
return IPACertificate(
crypto_x509.load_der_x509_certificate(data, backend=default_backend())
)
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index 1888e4091..5bb81c1bc 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -33,7 +33,6 @@ import warnings
from collections import OrderedDict
-from cryptography import x509 as crypto_x509
from cryptography.hazmat.primitives import serialization
import ldap
@@ -748,10 +747,10 @@ class LDAPClient:
'dnszoneidnsname': DNSName,
'krbcanonicalname': Principal,
'krbprincipalname': Principal,
- 'usercertificate': crypto_x509.Certificate,
- 'usercertificate;binary': crypto_x509.Certificate,
- 'cACertificate': crypto_x509.Certificate,
- 'cACertificate;binary': crypto_x509.Certificate,
+ 'usercertificate': x509.IPACertificate,
+ 'usercertificate;binary': x509.IPACertificate,
+ 'cACertificate': x509.IPACertificate,
+ 'cACertificate;binary': x509.IPACertificate,
'nsds5replicalastupdatestart': unicode,
'nsds5replicalastupdateend': unicode,
'nsds5replicalastinitstart': unicode,
@@ -1000,7 +999,7 @@ class LDAPClient:
return dct
elif isinstance(val, datetime):
return val.strftime(LDAP_GENERALIZED_TIME_FORMAT).encode('utf-8')
- elif isinstance(val, crypto_x509.Certificate):
+ elif isinstance(val, x509.IPACertificate):
return val.public_bytes(x509.Encoding.DER)
elif val is None:
return None
@@ -1027,7 +1026,7 @@ class LDAPClient:
return DNSName.from_text(val.decode('utf-8'))
elif target_type in (DN, Principal):
return target_type(val.decode('utf-8'))
- elif target_type is crypto_x509.Certificate:
+ elif target_type is x509.IPACertificate:
return x509.load_der_x509_certificate(val)
else:
return target_type(val)
@@ -1381,7 +1380,7 @@ class LDAPClient:
]
return cls.combine_filters(flts, rules)
elif value is not None:
- if isinstance(value, crypto_x509.Certificate):
+ if isinstance(value, x509.IPACertificate):
value = value.public_bytes(serialization.Encoding.DER)
if isinstance(value, bytes):
value = binascii.hexlify(value).decode('ascii')
diff --git a/ipaserver/plugins/dogtag.py b/ipaserver/plugins/dogtag.py
index 78afb2797..ee6d0e347 100644
--- a/ipaserver/plugins/dogtag.py
+++ b/ipaserver/plugins/dogtag.py
@@ -1581,7 +1581,8 @@ class kra(Backend):
crypto = cryptoutil.CryptographyCryptoProvider(
transport_cert_nick="ra_agent",
- transport_cert=x509.load_certificate_from_file(paths.RA_AGENT_PEM)
+ transport_cert=x509.load_certificate_from_file(
+ paths.RA_AGENT_PEM).cert
)
# TODO: obtain KRA host & port from IPA service list or point to KRA load balancer
--
2.51.0
debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch
Vendored
-60
View File
@@ -1,60 +0,0 @@
From 8a9c5629214cd71e88a5ac9c1b639faad9fc4ec1 Mon Sep 17 00:00:00 2001
From: Frederik Himpe <frederik@frehi.be>
Date: Tue, 25 Feb 2025 13:49:23 +0100
Subject: [PATCH] Make name of nobody group configurable and use nogroup on
Debian
Fixes: https://pagure.io/freeipa/issue/9753
Signed-off-by: Frederik Himpe <frederik@frehi.be>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
---
ipaplatform/base/constants.py | 1 +
ipaplatform/debian/constants.py | 1 +
ipaserver/install/adtrustinstance.py | 6 ++++--
3 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/ipaplatform/base/constants.py b/ipaplatform/base/constants.py
index f1ef7efff..4c8038a84 100644
--- a/ipaplatform/base/constants.py
+++ b/ipaplatform/base/constants.py
@@ -124,6 +124,7 @@ class BaseConstantsNamespace:
NAMED_OPTIONS_VAR = "OPTIONS"
NAMED_OPENSSL_ENGINE = None
NAMED_ZONE_COMMENT = ""
+ NOBODY_GROUP = Group("nobody")
PKI_USER = User("pkiuser")
PKI_GROUP = Group("pkiuser")
# ntpd init variable used for daemon options
diff --git a/ipaplatform/debian/constants.py b/ipaplatform/debian/constants.py
index 7216694ad..f8ee8cf9f 100644
--- a/ipaplatform/debian/constants.py
+++ b/ipaplatform/debian/constants.py
@@ -29,5 +29,6 @@ class DebianConstantsNamespace(BaseConstantsNamespace):
ODS_USER = User("opendnssec")
ODS_GROUP = Group("opendnssec")
SECURE_NFS_VAR = "NEED_GSSD"
+ NOBODY_GROUP = Group("nogroup")
constants = DebianConstantsNamespace()
diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py
index fd5a5a282..df2586ef1 100644
--- a/ipaserver/install/adtrustinstance.py
+++ b/ipaserver/install/adtrustinstance.py
@@ -123,9 +123,11 @@ def make_netbios_name(s):
def map_Guests_to_nobody():
env = {'LC_ALL': 'C'}
args = [paths.NET, '-s', '/dev/null', 'groupmap', 'add',
- 'sid=S-1-5-32-546', 'unixgroup=nobody', 'type=builtin']
+ 'sid=S-1-5-32-546',
+ 'unixgroup="' + constants.NOBODY_GROUP + '"', 'type=builtin']
- logger.debug("Map BUILTIN\\Guests to a group 'nobody'")
+ logger.debug("Map BUILTIN\\Guests to a group '%s'",
+ constants.NOBODY_GROUP)
ipautil.run(args, env=env, raiseonerr=False, capture_error=True)
--
2.48.1
debian/patches/Make-path-of-Samba-lock-directory-configurable-and-u.patch
Vendored
-54
View File
@@ -1,54 +0,0 @@
From 1e47185289fbbe29eedca82a4872d1d075b26c26 Mon Sep 17 00:00:00 2001
From: Frederik Himpe <frederik@frehi.be>
Date: Thu, 27 Feb 2025 11:28:30 +0100
Subject: [PATCH] Make path of Samba lock directory configurable and use
/run/samba on Debian
Signed-off-by: Frederik Himpe <frederik@frehi.be>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
---
ipaplatform/base/paths.py | 1 +
ipaplatform/debian/paths.py | 1 +
ipaserver/install/adtrustinstance.py | 2 +-
3 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py
index 6a62d7bd0..f794aae6d 100644
--- a/ipaplatform/base/paths.py
+++ b/ipaplatform/base/paths.py
@@ -350,6 +350,7 @@ class BasePathNamespace:
KRA_CS_CFG_PATH = "/var/lib/pki/pki-tomcat/conf/kra/CS.cfg"
KRACERT_P12 = "/root/kracert.p12"
SAMBA_DIR = "/var/lib/samba"
+ SAMBA_LOCKDIR = "/var/lib/samba/lock"
SSSD_DB = "/var/lib/sss/db"
SSSD_MC_GROUP = "/var/lib/sss/mc/group"
SSSD_MC_PASSWD = "/var/lib/sss/mc/passwd"
diff --git a/ipaplatform/debian/paths.py b/ipaplatform/debian/paths.py
index 7a8099680..229f185f0 100644
--- a/ipaplatform/debian/paths.py
+++ b/ipaplatform/debian/paths.py
@@ -44,6 +44,7 @@ class DebianPathNamespace(BasePathNamespace):
OPENSSL_DIR = "/usr/lib/ssl"
OPENSSL_CERTS_DIR = "/usr/lib/ssl/certs"
OPENSSL_PRIVATE_DIR = "/usr/lib/ssl/private"
+ SAMBA_LOCKDIR = "/run/samba"
ETC_DEBIAN_VERSION = "/etc/debian_version"
# Old versions of freeipa wrote all trusted certificates to a single
# file, which is not supported by ca-certificates.
diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py
index df2586ef1..bc3a282e6 100644
--- a/ipaserver/install/adtrustinstance.py
+++ b/ipaserver/install/adtrustinstance.py
@@ -962,7 +962,7 @@ class ADTRUSTInstance(service.Service):
# in /var/lib/samba and /var/lib/samba/private
for smbpath in (paths.SAMBA_DIR,
os.path.join(paths.SAMBA_DIR, "private"),
- os.path.join(paths.SAMBA_DIR, "lock")):
+ paths.SAMBA_LOCKDIR):
if os.path.isdir(smbpath):
tdb_files = [
os.path.join(smbpath, tdb_file)
--
2.48.1
debian/patches/series
Vendored
-3
View File
@@ -6,6 +6,3 @@ fix-sssd-socket-activation.diff
# send upstream
map-ssh-service.diff
Make-path-of-Samba-lock-directory-configurable-and-u.patch
Make-name-of-nobody-group-configurable-and-use-nogro.patch
0001-ipalib-x509-support-PyCA-44.0.patch