URL: https://github.com/freeipa/freeipa/pull/5575
Author: flo-renaud
Title: #5575: [Backport][ipa-4-9] Remove a remaining file used with csrgen
Action: opened
PR body:
"""
This PR was opened automatically because PR #5572 was pushed to master and backport to ipa-4-9 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5575/head:pr5575
git checkout pr5575
URL: https://github.com/freeipa/freeipa/pull/5576
Author: flo-renaud
Title: #5576: [Backport][ipa-4-9] Test for uninstall scenario with ipa kra
Action: opened
PR body:
"""
This PR was opened automatically because PR #5569 was pushed to master and backport to ipa-4-9 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5576/head:pr5576
git checkout pr5576
URL: https://github.com/freeipa/freeipa/pull/5577
Author: flo-renaud
Title: #5577: [Backport][ipa-4-9] Reduce confusing output when CA fails to deploy
Action: opened
PR body:
"""
This PR was opened automatically because PR #5542 was pushed to master and backport to ipa-4-9 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5577/head:pr5577
git checkout pr5577
URL: https://github.com/freeipa/freeipa/pull/5542
Author: rcritten
Title: #5542: Reduce confusing output when CA fails to deploy
Action: opened
PR body:
"""
Don't double-report any errors from pki-spawn failures
The output from pki-spawn is already displayed to the user
as well as a short traceback so re-displaying the CalledProcess
error provides no value and only provokes confusion,
particularly because it is condensed and includes embedded
newlines.
Re-raise the exception from None so that the traceback is
removed and while there is still an immense traceback from
the admintool class it is significantly shorter than before
and removes:
"During handling of the above exception, another exception occurred"
The handling is in fact expected.
This changes the user-facing installer output from:
[1/28]: configuring certificate server instance
Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmpr5x2l0gm', '--debug'] returned non-zero exit status 1: 'INFO: Connecting to LDAP server at ldap://ipa.example.test:389\nINFO: Connecting to LDAP server at ldap://ipa.example.test:389\nDEBUG: Installing Maven dependencies: False\nERROR: KeyError: \'CA\'\n File "/usr/lib/python3.9/site-packages/pki/server/pkispawn.py", line 575, in main\n raise KeyError(\'CA\')\n\n')
See the installation logs and the following files/directories for more information:
/var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
CA configuration failed.
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
to
[1/28]: configuring certificate server instance
Failed to configure CA instance
See the installation logs and the following files/directories for more information:
/var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
CA configuration failed.
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
The output is similarly reduced in the installer log. There is no
reason to acknowledge that a CalledProcessError was raised since
the output is already available and it's just an intermediary.
Hopefully this will encourage users to focus on the logs rather than
the malformed traceback.
https://pagure.io/freeipa/issue/8565
I noticed that while uninstalling I got an error about a missing CRL directory because it hadn't been created yet so don't try removing things that don't exist.
Others may have more creative ways to reproduce this but I hacked on /usr/lib/python3.X/site-packages/pki/server/pkispawn.py
And added a raise KeyError('CA') before the spawn ala:
scriptlet.instance = instance
raise KeyError('CA')
scriptlet.spawn(deployer)
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5542/head:pr5542
git checkout pr5542
URL: https://github.com/freeipa/freeipa/pull/5572
Author: rcritten
Title: #5572: Remove a remaining file used with csrgen
Action: opened
PR body:
"""
This file was missed in the first pass to remove support for
csrgen.
This was never feature complete and currently has issues and
we lack the resources to maintain it.
Drop it for now. It can be revived from git history in the
future if we see the need.
https://pagure.io/freeipa/issue/8669
Signed-off-by: Rob Crittenden <rcritten(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5572/head:pr5572
git checkout pr5572
URL: https://github.com/freeipa/freeipa/pull/5525
Author: rcritten
Title: #5525: ipa-cert-fix: Don't hardcode the NSS certificate nickname
Action: opened
PR body:
"""
ipa-cert-fix: Don't hardcode the NSS certificate nickname
The nickname of the 389-ds certificate was hardcoded as
Server-Cert which failed if the user had installed a
third-party certificate using ipa-server-certinstall.
Instead pull the nickname from the DS configuration and
retrieve it based on that.
https://pagure.io/freeipa/issue/8600
Signed-off-by: Rob Crittenden <rcritten(a)redhat.com>
**NOTE**: I'm not sure that the test is completely worth it as this is a bit of an edge case. It is not a fast test at all.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5525/head:pr5525
git checkout pr5525