From ffe4080f73ec6b286b16bb4da32678f408d16b6d Mon Sep 17 00:00:00 2001
From: Timo Aaltonen <tjaalton@debian.org>
Date: Wed, 17 May 2017 21:18:16 +0300
Subject: [PATCH] fix-opendnssec-setup.diff: Opendnssec 2.0.x broke DNSSEC
 setup, fix it.

---
 debian/changelog                         |  2 ++
 debian/patches/fix-opendnssec-setup.diff | 44 ++++++++++++++++++++++++
 debian/patches/series                    |  1 +
 3 files changed, 47 insertions(+)
 create mode 100644 debian/patches/fix-opendnssec-setup.diff

diff --git a/debian/changelog b/debian/changelog
index a1e521c93..9104eff6d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -16,6 +16,8 @@ freeipa (4.4.4-1) UNRELEASED; urgency=medium
     uninstall works.
   * fix-pkcs11-helper.diff: Fix ipa-dnskeysyncd setup which was broken
     by softhsm 2.2.
+  * fix-opendnssec-setup.diff: Opendnssec 2.0.x broke DNSSEC setup, fix
+    it.
 
  -- Timo Aaltonen <tjaalton@debian.org>  Fri, 17 Feb 2017 01:40:15 +0200
 
diff --git a/debian/patches/fix-opendnssec-setup.diff b/debian/patches/fix-opendnssec-setup.diff
new file mode 100644
index 000000000..b0d1f1cf4
--- /dev/null
+++ b/debian/patches/fix-opendnssec-setup.diff
@@ -0,0 +1,44 @@
+Description: Fix ODS setup with 2.0.x
+--- a/install/share/opendnssec_conf.template
++++ b/install/share/opendnssec_conf.template
+@@ -8,7 +8,6 @@
+ 			<Module>$SOFTHSM_LIB</Module>
+ 			<TokenLabel>$TOKEN_LABEL</TokenLabel>
+ 			<PIN>$PIN</PIN>
+-            <AllowExtraction/>
+ 		</Repository>
+ 
+ 	</RepositoryList>
+--- a/ipaserver/install/opendnssecinstance.py
++++ b/ipaserver/install/opendnssecinstance.py
+@@ -304,7 +304,7 @@ class OpenDNSSECInstance(service.Service
+         else:
+             # initialize new kasp.db
+             command = [
+-                paths.ODS_KSMUTIL,
++                '/usr/sbin/ods-enforcer-db-setup',
+                 'setup'
+             ]
+ 
+--- a/ipaplatform/base/paths.py
++++ b/ipaplatform/base/paths.py
+@@ -171,7 +171,7 @@ class BasePathNamespace(object):
+     NET = "/usr/bin/net"
+     BIN_NISDOMAINNAME = "/usr/bin/nisdomainname"
+     NSUPDATE = "/usr/bin/nsupdate"
+-    ODS_KSMUTIL = "/usr/bin/ods-ksmutil"
++    ODS_KSMUTIL = "/usr/bin/ods-enforcer"
+     ODS_SIGNER = "/usr/sbin/ods-signer"
+     OPENSSL = "/usr/bin/openssl"
+     PK12UTIL = "/usr/bin/pk12util"
+--- a/ipapython/dnssec/odsmgr.py
++++ b/ipapython/dnssec/odsmgr.py
+@@ -125,7 +125,7 @@ class ODSMgr(object):
+ 
+         Raises CalledProcessError if returncode != 0.
+         """
+-        cmd = ['ods-ksmutil'] + params
++        cmd = ['ods-enforcer'] + params
+         result = ipautil.run(cmd, capture_output=True)
+         return result.output
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 498c8c8e6..6d7337079 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -21,3 +21,4 @@ purge-firefox-extension.diff
 fix-ipa-otpd-service.diff
 fix-is-running.diff
 fix-kdcproxy-path.diff
+fix-opendnssec-setup.diff