From 450d4b23160d1b3ad73472a72c4443599b1e084a Mon Sep 17 00:00:00 2001 From: Timo Aaltonen Date: Sun, 8 Feb 2026 18:33:53 +0200 Subject: [PATCH] Drop upstreamed patches. --- debian/changelog | 1 + .../0001-ipalib-x509-support-PyCA-44.0.patch | 166 ------------------ ...ody-group-configurable-and-use-nogro.patch | 60 ------- ...ba-lock-directory-configurable-and-u.patch | 54 ------ debian/patches/series | 3 - 5 files changed, 1 insertion(+), 283 deletions(-) delete mode 100644 debian/patches/0001-ipalib-x509-support-PyCA-44.0.patch delete mode 100644 debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch delete mode 100644 debian/patches/Make-path-of-Samba-lock-directory-configurable-and-u.patch diff --git a/debian/changelog b/debian/changelog index 28101d1ea..1aa5dd256 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,7 @@ freeipa (4.13.1-1) UNRELEASED; urgency=medium * New upstream release. + * Drop upstreamed patches. -- Timo Aaltonen Thu, 30 Oct 2025 19:03:44 +0200 diff --git a/debian/patches/0001-ipalib-x509-support-PyCA-44.0.patch b/debian/patches/0001-ipalib-x509-support-PyCA-44.0.patch deleted file mode 100644 index c04c6558b..000000000 --- a/debian/patches/0001-ipalib-x509-support-PyCA-44.0.patch +++ /dev/null @@ -1,166 +0,0 @@ -From d4d56a6705c870901bc73882e4804367f7c9c91a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sun, 1 Dec 2024 20:16:54 +0200 -Subject: [PATCH] ipalib/x509: support PyCA 44.0 - -PyCA made x509.Certificate class concrete, it cannot be extended anymore -by Python code. The intent is to use helper functions to instantiate -certificate objects and never create them directly. - -FreeIPA wraps PyCA's x509.Certificate class and provides own shim -on top of it. In most cases we load the certificate content via the -helper functions and don't really need to derive from the certificate -class. - -Move IPACertificate to be a normal Python object class that stores -x509.Certificate internally. The only place where this breaks is when -IPACertificate object needs to be passed to a code that expects -x509.Certificate (Dogtag PKI). In such cases, expose the underlying -certificate instance via IPACertificate.cert property. - -Fixes: https://pagure.io/freeipa/issue/9708 - -Signed-off-by: Alexander Bokovoy -Reviewed-By: Florence Blanc-Renaud ---- - ipalib/ipajson.py | 4 ++-- - ipalib/x509.py | 10 +++++++++- - ipapython/ipaldap.py | 15 +++++++-------- - ipaserver/plugins/dogtag.py | 3 ++- - 4 files changed, 20 insertions(+), 12 deletions(-) - -diff --git a/ipalib/ipajson.py b/ipalib/ipajson.py -index 5551d12e5..fd99c8219 100644 ---- a/ipalib/ipajson.py -+++ b/ipalib/ipajson.py -@@ -9,7 +9,7 @@ from decimal import Decimal - import json - import six - from ipalib.constants import LDAP_GENERALIZED_TIME_FORMAT --from ipalib import capabilities -+from ipalib import capabilities, x509 - from ipalib.x509 import Encoding as x509_Encoding - from ipapython.dn import DN - from ipapython.dnsutil import DNSName -@@ -72,7 +72,7 @@ class _JSONPrimer(dict): - list: self._enc_list, - tuple: self._enc_list, - dict: self._enc_dict, -- crypto_x509.Certificate: self._enc_certificate, -+ x509.IPACertificate: self._enc_certificate, - crypto_x509.CertificateSigningRequest: self._enc_certificate, - }) - -diff --git a/ipalib/x509.py b/ipalib/x509.py -index fd0823896..6780bead0 100644 ---- a/ipalib/x509.py -+++ b/ipalib/x509.py -@@ -88,7 +88,7 @@ SAN_UPN = '1.3.6.1.4.1.311.20.2.3' - SAN_KRB5PRINCIPALNAME = '1.3.6.1.5.2.2' - - --class IPACertificate(crypto_x509.Certificate): -+class IPACertificate: - """ - A proxy class wrapping a python-cryptography certificate representation for - IPA purposes -@@ -205,6 +205,10 @@ class IPACertificate(crypto_x509.Certificate): - """ - return self._cert.fingerprint(algorithm) - -+ @property -+ def cert(self): -+ return self._cert -+ - @property - def serial_number(self): - return self._cert.serial_number -@@ -457,6 +461,8 @@ def load_pem_x509_certificate(data): - :returns: a ``IPACertificate`` object. - :raises: ``ValueError`` if unable to load the certificate. - """ -+ if isinstance(data, IPACertificate): -+ return data - return IPACertificate( - crypto_x509.load_pem_x509_certificate(data, backend=default_backend()) - ) -@@ -469,6 +475,8 @@ def load_der_x509_certificate(data): - :returns: a ``IPACertificate`` object. - :raises: ``ValueError`` if unable to load the certificate. - """ -+ if isinstance(data, IPACertificate): -+ return data - return IPACertificate( - crypto_x509.load_der_x509_certificate(data, backend=default_backend()) - ) -diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py -index 1888e4091..5bb81c1bc 100644 ---- a/ipapython/ipaldap.py -+++ b/ipapython/ipaldap.py -@@ -33,7 +33,6 @@ import warnings - - from collections import OrderedDict - --from cryptography import x509 as crypto_x509 - from cryptography.hazmat.primitives import serialization - - import ldap -@@ -748,10 +747,10 @@ class LDAPClient: - 'dnszoneidnsname': DNSName, - 'krbcanonicalname': Principal, - 'krbprincipalname': Principal, -- 'usercertificate': crypto_x509.Certificate, -- 'usercertificate;binary': crypto_x509.Certificate, -- 'cACertificate': crypto_x509.Certificate, -- 'cACertificate;binary': crypto_x509.Certificate, -+ 'usercertificate': x509.IPACertificate, -+ 'usercertificate;binary': x509.IPACertificate, -+ 'cACertificate': x509.IPACertificate, -+ 'cACertificate;binary': x509.IPACertificate, - 'nsds5replicalastupdatestart': unicode, - 'nsds5replicalastupdateend': unicode, - 'nsds5replicalastinitstart': unicode, -@@ -1000,7 +999,7 @@ class LDAPClient: - return dct - elif isinstance(val, datetime): - return val.strftime(LDAP_GENERALIZED_TIME_FORMAT).encode('utf-8') -- elif isinstance(val, crypto_x509.Certificate): -+ elif isinstance(val, x509.IPACertificate): - return val.public_bytes(x509.Encoding.DER) - elif val is None: - return None -@@ -1027,7 +1026,7 @@ class LDAPClient: - return DNSName.from_text(val.decode('utf-8')) - elif target_type in (DN, Principal): - return target_type(val.decode('utf-8')) -- elif target_type is crypto_x509.Certificate: -+ elif target_type is x509.IPACertificate: - return x509.load_der_x509_certificate(val) - else: - return target_type(val) -@@ -1381,7 +1380,7 @@ class LDAPClient: - ] - return cls.combine_filters(flts, rules) - elif value is not None: -- if isinstance(value, crypto_x509.Certificate): -+ if isinstance(value, x509.IPACertificate): - value = value.public_bytes(serialization.Encoding.DER) - if isinstance(value, bytes): - value = binascii.hexlify(value).decode('ascii') -diff --git a/ipaserver/plugins/dogtag.py b/ipaserver/plugins/dogtag.py -index 78afb2797..ee6d0e347 100644 ---- a/ipaserver/plugins/dogtag.py -+++ b/ipaserver/plugins/dogtag.py -@@ -1581,7 +1581,8 @@ class kra(Backend): - - crypto = cryptoutil.CryptographyCryptoProvider( - transport_cert_nick="ra_agent", -- transport_cert=x509.load_certificate_from_file(paths.RA_AGENT_PEM) -+ transport_cert=x509.load_certificate_from_file( -+ paths.RA_AGENT_PEM).cert - ) - - # TODO: obtain KRA host & port from IPA service list or point to KRA load balancer --- -2.51.0 - diff --git a/debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch b/debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch deleted file mode 100644 index 8c4a3bb6d..000000000 --- a/debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 8a9c5629214cd71e88a5ac9c1b639faad9fc4ec1 Mon Sep 17 00:00:00 2001 -From: Frederik Himpe -Date: Tue, 25 Feb 2025 13:49:23 +0100 -Subject: [PATCH] Make name of nobody group configurable and use nogroup on - Debian - -Fixes: https://pagure.io/freeipa/issue/9753 - -Signed-off-by: Frederik Himpe -Reviewed-By: Alexander Bokovoy ---- - ipaplatform/base/constants.py | 1 + - ipaplatform/debian/constants.py | 1 + - ipaserver/install/adtrustinstance.py | 6 ++++-- - 3 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/ipaplatform/base/constants.py b/ipaplatform/base/constants.py -index f1ef7efff..4c8038a84 100644 ---- a/ipaplatform/base/constants.py -+++ b/ipaplatform/base/constants.py -@@ -124,6 +124,7 @@ class BaseConstantsNamespace: - NAMED_OPTIONS_VAR = "OPTIONS" - NAMED_OPENSSL_ENGINE = None - NAMED_ZONE_COMMENT = "" -+ NOBODY_GROUP = Group("nobody") - PKI_USER = User("pkiuser") - PKI_GROUP = Group("pkiuser") - # ntpd init variable used for daemon options -diff --git a/ipaplatform/debian/constants.py b/ipaplatform/debian/constants.py -index 7216694ad..f8ee8cf9f 100644 ---- a/ipaplatform/debian/constants.py -+++ b/ipaplatform/debian/constants.py -@@ -29,5 +29,6 @@ class DebianConstantsNamespace(BaseConstantsNamespace): - ODS_USER = User("opendnssec") - ODS_GROUP = Group("opendnssec") - SECURE_NFS_VAR = "NEED_GSSD" -+ NOBODY_GROUP = Group("nogroup") - - constants = DebianConstantsNamespace() -diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py -index fd5a5a282..df2586ef1 100644 ---- a/ipaserver/install/adtrustinstance.py -+++ b/ipaserver/install/adtrustinstance.py -@@ -123,9 +123,11 @@ def make_netbios_name(s): - def map_Guests_to_nobody(): - env = {'LC_ALL': 'C'} - args = [paths.NET, '-s', '/dev/null', 'groupmap', 'add', -- 'sid=S-1-5-32-546', 'unixgroup=nobody', 'type=builtin'] -+ 'sid=S-1-5-32-546', -+ 'unixgroup="' + constants.NOBODY_GROUP + '"', 'type=builtin'] - -- logger.debug("Map BUILTIN\\Guests to a group 'nobody'") -+ logger.debug("Map BUILTIN\\Guests to a group '%s'", -+ constants.NOBODY_GROUP) - ipautil.run(args, env=env, raiseonerr=False, capture_error=True) - - --- -2.48.1 - diff --git a/debian/patches/Make-path-of-Samba-lock-directory-configurable-and-u.patch b/debian/patches/Make-path-of-Samba-lock-directory-configurable-and-u.patch deleted file mode 100644 index c4dd9801a..000000000 --- a/debian/patches/Make-path-of-Samba-lock-directory-configurable-and-u.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 1e47185289fbbe29eedca82a4872d1d075b26c26 Mon Sep 17 00:00:00 2001 -From: Frederik Himpe -Date: Thu, 27 Feb 2025 11:28:30 +0100 -Subject: [PATCH] Make path of Samba lock directory configurable and use - /run/samba on Debian - -Signed-off-by: Frederik Himpe -Reviewed-By: Alexander Bokovoy ---- - ipaplatform/base/paths.py | 1 + - ipaplatform/debian/paths.py | 1 + - ipaserver/install/adtrustinstance.py | 2 +- - 3 files changed, 3 insertions(+), 1 deletion(-) - -diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py -index 6a62d7bd0..f794aae6d 100644 ---- a/ipaplatform/base/paths.py -+++ b/ipaplatform/base/paths.py -@@ -350,6 +350,7 @@ class BasePathNamespace: - KRA_CS_CFG_PATH = "/var/lib/pki/pki-tomcat/conf/kra/CS.cfg" - KRACERT_P12 = "/root/kracert.p12" - SAMBA_DIR = "/var/lib/samba" -+ SAMBA_LOCKDIR = "/var/lib/samba/lock" - SSSD_DB = "/var/lib/sss/db" - SSSD_MC_GROUP = "/var/lib/sss/mc/group" - SSSD_MC_PASSWD = "/var/lib/sss/mc/passwd" -diff --git a/ipaplatform/debian/paths.py b/ipaplatform/debian/paths.py -index 7a8099680..229f185f0 100644 ---- a/ipaplatform/debian/paths.py -+++ b/ipaplatform/debian/paths.py -@@ -44,6 +44,7 @@ class DebianPathNamespace(BasePathNamespace): - OPENSSL_DIR = "/usr/lib/ssl" - OPENSSL_CERTS_DIR = "/usr/lib/ssl/certs" - OPENSSL_PRIVATE_DIR = "/usr/lib/ssl/private" -+ SAMBA_LOCKDIR = "/run/samba" - ETC_DEBIAN_VERSION = "/etc/debian_version" - # Old versions of freeipa wrote all trusted certificates to a single - # file, which is not supported by ca-certificates. -diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py -index df2586ef1..bc3a282e6 100644 ---- a/ipaserver/install/adtrustinstance.py -+++ b/ipaserver/install/adtrustinstance.py -@@ -962,7 +962,7 @@ class ADTRUSTInstance(service.Service): - # in /var/lib/samba and /var/lib/samba/private - for smbpath in (paths.SAMBA_DIR, - os.path.join(paths.SAMBA_DIR, "private"), -- os.path.join(paths.SAMBA_DIR, "lock")): -+ paths.SAMBA_LOCKDIR): - if os.path.isdir(smbpath): - tdb_files = [ - os.path.join(smbpath, tdb_file) --- -2.48.1 - diff --git a/debian/patches/series b/debian/patches/series index c75010bb0..a9d368b1b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -6,6 +6,3 @@ fix-sssd-socket-activation.diff # send upstream map-ssh-service.diff -Make-path-of-Samba-lock-directory-configurable-and-u.patch -Make-name-of-nobody-group-configurable-and-use-nogro.patch -0001-ipalib-x509-support-PyCA-44.0.patch