Use namespace-aware meta importer for ipaplatform

Instead of symlinks and build-time configuration the ipaplatform module
is now able to auto-detect platforms on import time. The meta importer
uses the platform 'ID' from /etc/os-releases. It falls back to 'ID_LIKE'
on platforms like CentOS, which has ID=centos and ID_LIKE="rhel fedora".

The meta importer is able to handle namespace packages and the
ipaplatform package has been turned into a namespace package in order to
support external platform specifications.

https://fedorahosted.org/freeipa/ticket/6474

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

ipapython/certdb.py

@@ -16,6 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
+from __future__ import absolute_import
 
 import collections
 import logging
@@ -30,24 +31,12 @@ import shutil
 
 import cryptography.x509
 
+from ipaplatform.paths import paths
 from ipapython.dn import DN
 from ipapython.kerberos import Principal
 from ipapython import ipautil
 from ipalib import x509     # pylint: disable=ipa-forbidden-import
 
-try:
-    # pylint: disable=import-error,ipa-forbidden-import
-    from ipaplatform.paths import paths
-    # pylint: enable=import-error,ipa-forbidden-import
-except ImportError:
-    CERTUTIL = '/usr/bin/certutil'
-    PK12UTIL = '/usr/bin/pk12util'
-    OPENSSL = '/usr/bin/openssl'
-else:
-    CERTUTIL = paths.CERTUTIL
-    PK12UTIL = paths.PK12UTIL
-    OPENSSL = paths.OPENSSL
-
 
 logger = logging.getLogger(__name__)
 
@@ -188,7 +177,8 @@ def verify_kdc_cert_validity(kdc_cert, ca_certs, realm):
 
         try:
             ipautil.run(
-                [OPENSSL, 'verify', '-CAfile', ca_file.name, kdc_file.name],
+                [paths.OPENSSL, 'verify', '-CAfile', ca_file.name,
+                 kdc_file.name],
                 capture_output=True)
         except ipautil.CalledProcessError as e:
             raise ValueError(e.output)
@@ -244,7 +234,7 @@ class NSSDatabase(object):
         self.close()
 
     def run_certutil(self, args, stdin=None, **kwargs):
-        new_args = [CERTUTIL, "-d", self.secdir]
+        new_args = [paths.CERTUTIL, "-d", self.secdir]
         new_args = new_args + args
         new_args.extend(['-f', self.pwd_file])
         return ipautil.run(new_args, stdin, **kwargs)
@@ -367,7 +357,7 @@ class NSSDatabase(object):
         return root_nicknames
 
     def export_pkcs12(self, nickname, pkcs12_filename, pkcs12_passwd=None):
-        args = [PK12UTIL, "-d", self.secdir,
+        args = [paths.PK12UTIL, "-d", self.secdir,
                 "-o", pkcs12_filename,
                 "-n", nickname,
                 "-k", self.pwd_file]
@@ -391,7 +381,7 @@ class NSSDatabase(object):
                 pkcs12_password_file.close()
 
     def import_pkcs12(self, pkcs12_filename, pkcs12_passwd=None):
-        args = [PK12UTIL, "-d", self.secdir,
+        args = [paths.PK12UTIL, "-d", self.secdir,
                 "-i", pkcs12_filename,
                 "-k", self.pwd_file, '-v']
         pkcs12_password_file = None
@@ -501,7 +491,7 @@ class NSSDatabase(object):
                                 (key_file, filename))
 
                         args = [
-                            OPENSSL, 'pkcs8',
+                            paths.OPENSSL, 'pkcs8',
                             '-topk8',
                             '-passout', 'file:' + self.pwd_file,
                         ]
@@ -588,7 +578,7 @@ class NSSDatabase(object):
                 out_password = ipautil.ipa_generate_password()
                 out_pwdfile = ipautil.write_tmp_file(out_password)
                 args = [
-                    OPENSSL, 'pkcs12',
+                    paths.OPENSSL, 'pkcs12',
                     '-export',
                     '-in', in_file.name,
                     '-out', out_file.name,

ipapython/config.py

@@ -16,6 +16,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
+from __future__ import absolute_import
 
 # pylint: disable=deprecated-module
 from optparse import (
@@ -33,18 +34,10 @@ from six.moves.configparser import SafeConfigParser
 from six.moves.urllib.parse import urlsplit
 # pylint: enable=import-error
 
+from ipaplatform.paths import paths
 from ipapython.dn import DN
 from ipapython.ipautil import CheckedIPAddress, CheckedIPAddressLoopback
 
-try:
-    # pylint: disable=ipa-forbidden-import
-    from ipaplatform.paths import paths
-    # pylint: enable=ipa-forbidden-import
-except ImportError:
-    IPA_DEFAULT_CONF = '/etc/ipa/default.conf'
-else:
-    IPA_DEFAULT_CONF = paths.IPA_DEFAULT_CONF
-
 
 class IPAConfigError(Exception):
     def __init__(self, msg=''):
@@ -188,7 +181,7 @@ config = IPAConfig()
 
 def __parse_config(discover_server = True):
     p = SafeConfigParser()
-    p.read(IPA_DEFAULT_CONF)
+    p.read(paths.IPA_DEFAULT_CONF)
 
     try:
         if not config.default_realm:

ipapython/setup.py

@@ -42,6 +42,7 @@ if __name__ == '__main__':
             "dnspython",
             "gssapi",
             # "ipalib",  # circular dependency
+            "ipaplatform",
             "netaddr",
             "netifaces",
             "six",