chedi pushed to python-pytest-cov (f32). "epoch bump"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:33:51 UTC
From 66fd2084d06565872dd99a88d05147efac1168ab Mon Sep 17 00:00:00 2001
From: chedi <chedi.toueiti(a)gmail.com>
Date: Feb 01 2021 09:33:36 +0000
Subject: epoch bump
---
diff --git a/python-pytest-cov.spec b/python-pytest-cov.spec
index 39ec788..f95beb2 100644
--- a/python-pytest-cov.spec
+++ b/python-pytest-cov.spec
@@ -9,7 +9,7 @@
Name: python-%{srcname}
Version: 2.10.1
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: Pytest plugin for coverage reporting
License: MIT
@@ -91,7 +91,7 @@ py.test-%{python3_version} -vv \
%changelog
-* Mon Feb 01 2021 Chedi Toueiti <chedi.toueiti(a)gmail.com> - 2.10.1-1
+* Mon Feb 01 2021 Chedi Toueiti <chedi.toueiti(a)gmail.com> - 2.10.1-2
- Reverting to version 2.10.1 (#1922942)
* Wed Jan 20 2021 Chedi Toueiti <chedi.toueiti(a)gmail.com> - 2.11.1-1
https://src.fedoraproject.org/rpms/python-pytest-cov/c/66fd2084d06565872d...
3Â years, 4Â months
chedi pushed to python-pytest-cov (f32). "revert to version 2.10.1"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:32:56 UTC
From 67d33e4009016a539b3b52115bcedd2fc832f161 Mon Sep 17 00:00:00 2001
From: chedi <chedi.toueiti(a)gmail.com>
Date: Feb 01 2021 09:32:36 +0000
Subject: revert to version 2.10.1
---
diff --git a/python-pytest-cov.spec b/python-pytest-cov.spec
index 3ae6670..39ec788 100644
--- a/python-pytest-cov.spec
+++ b/python-pytest-cov.spec
@@ -8,7 +8,7 @@
%endif
Name: python-%{srcname}
-Version: 2.11.1
+Version: 2.10.1
Release: 1%{?dist}
Summary: Pytest plugin for coverage reporting
@@ -91,6 +91,9 @@ py.test-%{python3_version} -vv \
%changelog
+* Mon Feb 01 2021 Chedi Toueiti <chedi.toueiti(a)gmail.com> - 2.10.1-1
+- Reverting to version 2.10.1 (#1922942)
+
* Wed Jan 20 2021 Chedi Toueiti <chedi.toueiti(a)gmail.com> - 2.11.1-1
- Update to 2.11.1 (#1917248)
diff --git a/sources b/sources
index 46ee2f2..03b0eea 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (pytest-cov-2.11.1.tar.gz) = 513e89c061e926cfab718adb1a52f573abec6d67635df4ef791dc9a0e6338369c3a0771c9f2a44c5c2a17ab5a5ebc21398b4e3c525dba50724f70eea22a1c9ce
+SHA512 (pytest-cov-2.10.1.tar.gz) = b12ea3b7e321cc0921bc88e22003cda169edd807e05efa4814939af97816ed129f8a8b3b646f4ee78e7664fba249197f9bf54d92bccdc3c3401b74d9a5447446
https://src.fedoraproject.org/rpms/python-pytest-cov/c/67d33e4009016a539b...
3Â years, 4Â months
fjanus pushed to mutt (f32). "Rebase to upstream version 2.0.5
(..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:27:03 UTC
From 4b8a3a70eefc237dec6a84b7e674b6058a8b7359 Mon Sep 17 00:00:00 2001
From: Filip Januš <fjanus(a)redhat.com>
Date: Feb 01 2021 09:26:44 +0000
Subject: Rebase to upstream version 2.0.5
FIX CVE-2021-3181
---
diff --git a/.gitignore b/.gitignore
index a1cf8a6..614ff9e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,4 @@ mutt-1.5.23.tar.gz
/mutt-1.14.6.tar.gz
/mutt-1.14.7.tar.gz
/mutt-2.0.2.tar.gz
+/mutt-2.0.5.tar.gz
diff --git a/mutt.spec b/mutt.spec
index 0123999..fd6c2d3 100644
--- a/mutt.spec
+++ b/mutt.spec
@@ -19,8 +19,8 @@
Summary: A text mode mail user agent
Name: mutt
-Version: 2.0.2
-Release: 2%{?dist}
+Version: 2.0.5
+Release: 1%{?dist}
Epoch: 5
# The entire source code is GPLv2+ except
# pgpewrap.c setenv.c sha1.c wcwidth.c which are Public Domain
@@ -214,6 +214,10 @@ ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5
%changelog
+* Mon Feb 1 2021 Filip Januš <fjanus(a)redhat.com> -5:2.0.5-1
+- Rebase to upstream version 2.0.5
+- Fix CVE-2021-3181
+
* Tue Jan 19 2020 Filip Januš <fjanus(a)redhat.com> - 5:2.0.2-2
- Add patch for remove enforcing ssl
- Patch is based on upstream commit
diff --git a/sources b/sources
index e1eae2e..68af11e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (mutt-2.0.2.tar.gz) = 5dea02edf60b33e4873806481aa4256f91d90b05de99a9eccc620c459bd924197b656f85eb5a31757a61675389e6c4d76571128a757cfda255240934e82eec29
+SHA512 (mutt-2.0.5.tar.gz) = 41849d700b88e1b28b51fb90be2a9f6b639e8b111dce914073b66327e4655b5d4ca04dc3aedf2d44a0aa1a80ac3c4fcca6058eae7fb4f71f6b506fbe00a2a740
https://src.fedoraproject.org/rpms/mutt/c/4b8a3a70eefc237dec6a84b7e674b60...
3Â years, 4Â months
packagerbot pushed to dummy-test-package-rubino (master). "Bump
release (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:18:52 UTC
From 03d30b6e303504698773705fc6cb9214b0fb6a17 Mon Sep 17 00:00:00 2001
From: packagerbot <admin(a)fedoraproject.org>
Date: Feb 01 2021 09:18:47 +0000
Subject: Bump release
Signed-off-by: packagerbot <admin(a)fedoraproject.org>
---
diff --git a/dummy-test-package-rubino.spec b/dummy-test-package-rubino.spec
index 6c7ae08..d7e17f9 100644
--- a/dummy-test-package-rubino.spec
+++ b/dummy-test-package-rubino.spec
@@ -3,7 +3,7 @@
Name: dummy-test-package-rubino
Version: 0
-Release: 2682
+Release: 2683
Summary: Dummy Test Package called Rubino
License: CC0
URL: http://fedoraproject.org/wiki/DummyTestPackages
@@ -34,6 +34,9 @@ cp -p uuid %{buildroot}%{_datadir}/%{name}
%{_datadir}/%{name}
%changelog
+* Mon Feb 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2683
+- rebuilt
+
* Mon Feb 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2682
- rebuilt
https://src.fedoraproject.org/rpms/dummy-test-package-rubino/c/03d30b6e30...
3Â years, 4Â months
packagerbot pushed to dummy-test-package-crested (master). "Bump
release (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:18:39 UTC
From 3e65bb503d8bbb7d8c46df03808a5122d69d31ec Mon Sep 17 00:00:00 2001
From: packagerbot <admin(a)fedoraproject.org>
Date: Feb 01 2021 09:18:34 +0000
Subject: Bump release
Signed-off-by: packagerbot <admin(a)fedoraproject.org>
---
diff --git a/dummy-test-package-crested.spec b/dummy-test-package-crested.spec
index 05df2d6..4217345 100644
--- a/dummy-test-package-crested.spec
+++ b/dummy-test-package-crested.spec
@@ -3,7 +3,7 @@
Name: dummy-test-package-crested
Version: 0
-Release: 2682
+Release: 2683
Summary: Dummy Test Package called Crested
License: CC0
URL: http://fedoraproject.org/wiki/DummyTestPackages
@@ -32,6 +32,9 @@ cp -p uuid %{buildroot}%{_datadir}/%{name}
%{_datadir}/%{name}
%changelog
+* Mon Feb 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2683
+- rebuilt
+
* Mon Feb 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2682
- rebuilt
https://src.fedoraproject.org/rpms/dummy-test-package-crested/c/3e65bb503...
3Â years, 4Â months
abbra pushed to freeipa (master). "Remove unused patches"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:08:44 UTC
From e98c2f2a4734c5ef3516d0795b5919edb781add9 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy(a)redhat.com>
Date: Feb 01 2021 07:45:35 +0000
Subject: Remove unused patches
---
diff --git a/0001-Set-client-keytab-location-for-389ds.patch b/0001-Set-client-keytab-location-for-389ds.patch
deleted file mode 100644
index a22f4d2..0000000
--- a/0001-Set-client-keytab-location-for-389ds.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From df411f00a3d1db2fcb0d122a54b9e13a57e35f3f Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood(a)redhat.com>
-Date: Fri, 8 Jan 2021 11:43:31 -0500
-Subject: [PATCH] Set client keytab location for 389ds
-
-Handles behavior change in
-https://github.com/389ds/389-ds-base/pull/4523
-
-Fixes: https://pagure.io/freeipa/issue/8656
-Signed-off-by: Robbie Harwood <rharwood(a)redhat.com>
-Reviewed-By: Rob Crittenden <rcritten(a)redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com>
----
- install/share/ds-ipa-env.conf.template | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/install/share/ds-ipa-env.conf.template b/install/share/ds-ipa-env.conf.template
-index f5ce11a9a..c059aae15 100644
---- a/install/share/ds-ipa-env.conf.template
-+++ b/install/share/ds-ipa-env.conf.template
-@@ -3,4 +3,5 @@
- [Service]
- Environment=LC_ALL=C.UTF-8
- Environment=KRB5_KTNAME=$KRB5_KTNAME
-+Environment=KRB5_CLIENT_KTNAME=$KRB5_KTNAME
- Environment=KRB5CCNAME=$KRB5CCNAME
---
-2.26.2
-
diff --git a/5212.patch b/5212.patch
deleted file mode 100644
index cc8f64a..0000000
--- a/5212.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 2695789db45c2e7fe92e53a49521dc22fdffe317 Mon Sep 17 00:00:00 2001
-From: Mark Reynolds <mreynolds(a)redhat.com>
-Date: Wed, 28 Oct 2020 10:34:31 -0400
-Subject: [PATCH] New validation efforts in 389-ds-base require that the
- backend entry for a database be created before the mapping tree entry. This
- enforces that the mapping tree entry (the suffix) actually belongs to an
- existing backend.
-
-For IPA we simply need to reverse the order of the backend vs mapping tree
-creation in cainstance.py -> __create_ds_db()
-
-Fixes: https://pagure.io/freeipa/issue/8558
----
- ipaserver/install/cainstance.py | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
-index fca829de094..1c2fab1dffb 100644
---- a/ipaserver/install/cainstance.py
-+++ b/ipaserver/install/cainstance.py
-@@ -1162,17 +1162,6 @@ def __create_ds_db(self):
- backend = 'ipaca'
- suffix = DN(('o', 'ipaca'))
-
-- # replication
-- dn = DN(('cn', str(suffix)), ('cn', 'mapping tree'), ('cn', 'config'))
-- entry = api.Backend.ldap2.make_entry(
-- dn,
-- objectclass=["top", "extensibleObject", "nsMappingTree"],
-- cn=[suffix],
-- )
-- entry['nsslapd-state'] = ['Backend']
-- entry['nsslapd-backend'] = [backend]
-- api.Backend.ldap2.add_entry(entry)
--
- # database
- dn = DN(('cn', 'ipaca'), ('cn', 'ldbm database'), ('cn', 'plugins'),
- ('cn', 'config'))
-@@ -1184,6 +1173,17 @@ def __create_ds_db(self):
- entry['nsslapd-suffix'] = [suffix]
- api.Backend.ldap2.add_entry(entry)
-
-+ # replication
-+ dn = DN(('cn', str(suffix)), ('cn', 'mapping tree'), ('cn', 'config'))
-+ entry = api.Backend.ldap2.make_entry(
-+ dn,
-+ objectclass=["top", "extensibleObject", "nsMappingTree"],
-+ cn=[suffix],
-+ )
-+ entry['nsslapd-state'] = ['Backend']
-+ entry['nsslapd-backend'] = [backend]
-+ api.Backend.ldap2.add_entry(entry)
-+
- def __setup_replication(self):
- repl = replication.CAReplicationManager(self.realm, self.fqdn)
- repl.setup_cs_replication(self.master_host)
diff --git a/5273.patch b/5273.patch
deleted file mode 100644
index 0b6970a..0000000
--- a/5273.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 87813eb6404ae0aa15b95b1af788db0d37e2efa5 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy(a)redhat.com>
-Date: Wed, 18 Nov 2020 12:35:38 +0200
-Subject: [PATCH] util: Fix client-only build
-
-Commit 26b9a697844c3bb66bdf83dad3a9738b3cb65361 did not fully fix the
-client-only build as util/ipa_pwd.c unconditionally includes
-pwquality.h.
-
-Make sure we define USE_PWQUALITY in the full server configuration and
-if that one is defined, include libpwquality use.
-
-Fixes: https://pagure.io/freeipa/issue/8587
-Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
----
- configure.ac | 4 +++-
- util/Makefile.am | 10 +++++++---
- util/ipa_pwd.c | 9 ++++++++-
- 3 files changed, 18 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index ef1a1c6867e..5d04d446e0a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -117,7 +117,9 @@ dnl ---------------------------------------------------------------------------
- dnl - Check for pwquality library
- dnl ---------------------------------------------------------------------------
- AM_COND_IF([ENABLE_SERVER], [
-- PKG_CHECK_MODULES([PWQUALITY], [pwquality])
-+ PKG_CHECK_MODULES([PWQUALITY], [pwquality],
-+ [AC_DEFINE(USE_PWQUALITY,1,[Use password quality checks])]
-+ )
- ])
-
- dnl ---------------------------------------------------------------------------
-diff --git a/util/Makefile.am b/util/Makefile.am
-index 5e21c098f14..b3803777809 100644
---- a/util/Makefile.am
-+++ b/util/Makefile.am
-@@ -21,7 +21,11 @@ libutil_la_SOURCES = \
-
- libutil_la_LIBADD = $(CRYPTO_LIBS) $(KRB5_LIBS) $(LDAP_LIBS) $(PWQUALITY_LIBS)
-
--check_PROGRAMS = t_pwd t_policy
--TESTS = $(check_PROGRAMS)
-+check_PROGRAMS = t_pwd
- t_pwd_LDADD = libutil.la
--t_policy_LDADD = libutil.la
-+if ENABLE_SERVER
-+check_PROGRAMS += t_policy
-+t_policy_LDADD = libutil.la
-+endif
-+
-+TESTS = $(check_PROGRAMS)
-diff --git a/util/ipa_pwd.c b/util/ipa_pwd.c
-index dbff5ef1cba..8fa413c69cf 100644
---- a/util/ipa_pwd.c
-+++ b/util/ipa_pwd.c
-@@ -23,6 +23,7 @@
- #ifndef _GNU_SOURCE
- #define _GNU_SOURCE
- #endif
-+#include "config.h"
- #include <stdio.h>
- #include <string.h>
- #include <time.h>
-@@ -31,7 +32,9 @@
- #include <syslog.h>
- #include <unistd.h>
- #include <errno.h>
-+#if defined(USE_PWQUALITY)
- #include <pwquality.h>
-+#endif
- #include <openssl/evp.h>
- #include <openssl/rand.h>
- #include <openssl/sha.h>
-@@ -417,11 +420,13 @@ int ipapwd_check_policy(struct ipapwd_policy *policy,
- {
- int pwdlen, blen;
- int ret;
-+#if defined(USE_PWQUALITY)
- pwquality_settings_t *pwq;
- int check_pwquality = 0;
-- int entropy;
-+ int entropy = 0;
- char buf[PWQ_MAX_ERROR_MESSAGE_LEN];
- void *auxerror;
-+#endif
-
- if (!policy || !password) {
- return IPAPWD_POLICY_ERROR;
-@@ -534,6 +539,7 @@ int ipapwd_check_policy(struct ipapwd_policy *policy,
- }
- }
-
-+#if defined(USE_PWQUALITY)
- /* Only call into libpwquality if at least one setting is made
- * because there are a number of checks that don't have knobs
- * so preserve the previous behavior.
-@@ -601,6 +607,7 @@ int ipapwd_check_policy(struct ipapwd_policy *policy,
- #endif
- }
- }
-+#endif /* USE_PWQUALITY */
-
- if (pwd_history) {
- char *hash;
diff --git a/freeipa-4.8.10-systemd-resolved-configuration.patch b/freeipa-4.8.10-systemd-resolved-configuration.patch
deleted file mode 100644
index 7d03fcc..0000000
--- a/freeipa-4.8.10-systemd-resolved-configuration.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 2e4f9ef1552d1ef784bb91918aa60de0f05e453a Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes(a)redhat.com>
-Date: Mon, 28 Sep 2020 12:00:01 +0200
-Subject: [PATCH 1/2] Ensure that resolved.conf.d is accessible
-
-systemd-resolved runs as user systemd-resolve. Ensure that
-resolved.conf.d drop-in directory is accessible when installer runs with
-restricted umask. Also ensure the file and directory has correct SELinux
-context.
-
-The parent directory /etc/systemd exists on all platforms.
-
-Fixes: https://pagure.io/freeipa/issue/8275
-Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
----
- ipaplatform/base/tasks.py | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/ipaplatform/base/tasks.py b/ipaplatform/base/tasks.py
-index a39857e869..adf320b700 100644
---- a/ipaplatform/base/tasks.py
-+++ b/ipaplatform/base/tasks.py
-@@ -336,7 +336,11 @@ def configure_dns_resolver(self, nameservers, searchdomains, *,
- from ipaplatform.services import knownservices
-
- confd = os.path.dirname(paths.SYSTEMD_RESOLVED_IPA_CONF)
-- os.makedirs(confd, exist_ok=True)
-+ if not os.path.isdir(confd):
-+ os.mkdir(confd)
-+ # owned by root, readable by systemd-resolve user
-+ os.chmod(confd, 0o755)
-+ tasks.restore_context(confd, force=True)
-
- cfg = RESOLVE1_IPA_CONF.format(
- searchdomains=" ".join(searchdomains)
-@@ -345,6 +349,10 @@ def configure_dns_resolver(self, nameservers, searchdomains, *,
- os.fchmod(f.fileno(), 0o644)
- f.write(cfg)
-
-+ tasks.restore_context(
-+ paths.SYSTEMD_RESOLVED_IPA_CONF, force=True
-+ )
-+
- knownservices["systemd-resolved"].reload_or_restart()
-
- def unconfigure_dns_resolver(self, fstore=None):
-
-From 8b193f09018c3be283e0a3ecdfd1a58d49af360a Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes(a)redhat.com>
-Date: Mon, 28 Sep 2020 12:29:00 +0200
-Subject: [PATCH 2/2] Also backup DNS config drop-ins
-
-/etc/NetworkManager/conf.d and /etc/systemd/resolved.conf.d drop-in
-files were not backed up.
-
-Related: https://pagure.io/freeipa/issue/8275
-Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
----
- ipaserver/install/ipa_backup.py | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py
-index 39347643d3..d472990afe 100644
---- a/ipaserver/install/ipa_backup.py
-+++ b/ipaserver/install/ipa_backup.py
-@@ -194,6 +194,8 @@ class Backup(admintool.AdminTool):
- paths.GSSPROXY_CONF,
- paths.HOSTS,
- paths.SYSTEMD_PKI_TOMCAT_IPA_CONF,
-+ paths.NETWORK_MANAGER_IPA_CONF,
-+ paths.SYSTEMD_RESOLVED_IPA_CONF,
- ) + tuple(
- os.path.join(paths.IPA_NSSDB_DIR, file)
- for file in (certdb.NSS_DBM_FILES + certdb.NSS_SQL_FILES)
diff --git a/freeipa-4.8.10-systemd-resolved-selinux-fixes.patch b/freeipa-4.8.10-systemd-resolved-selinux-fixes.patch
deleted file mode 100644
index e629a5d..0000000
--- a/freeipa-4.8.10-systemd-resolved-selinux-fixes.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 8b2002cc7e2e0400e1afa3a21963a22947c7a908 Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes(a)redhat.com>
-Date: Tue, 29 Sep 2020 10:39:01 +0200
-Subject: [PATCH] configure_dns_resolver: call self.restore_context
-
-Use the platform implementation of restore_context() instead of the base
-implementation.
-
-Fixes: https://pagure.io/freeipa/issue/8518
-Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
----
- ipaplatform/base/tasks.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/ipaplatform/base/tasks.py b/ipaplatform/base/tasks.py
-index adf320b700..4387e0e12f 100644
---- a/ipaplatform/base/tasks.py
-+++ b/ipaplatform/base/tasks.py
-@@ -340,7 +340,7 @@ def configure_dns_resolver(self, nameservers, searchdomains, *,
- os.mkdir(confd)
- # owned by root, readable by systemd-resolve user
- os.chmod(confd, 0o755)
-- tasks.restore_context(confd, force=True)
-+ self.restore_context(confd, force=True)
-
- cfg = RESOLVE1_IPA_CONF.format(
- searchdomains=" ".join(searchdomains)
-@@ -349,7 +349,7 @@ def configure_dns_resolver(self, nameservers, searchdomains, *,
- os.fchmod(f.fileno(), 0o644)
- f.write(cfg)
-
-- tasks.restore_context(
-+ self.restore_context(
- paths.SYSTEMD_RESOLVED_IPA_CONF, force=True
- )
-
diff --git a/freeipa-4.8.10-systemd-resolved.patch b/freeipa-4.8.10-systemd-resolved.patch
deleted file mode 100644
index 5147654..0000000
--- a/freeipa-4.8.10-systemd-resolved.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From f9900ef2401070351353724ef92111ec541e67f0 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy(a)redhat.com>
-Date: Sat, 26 Sep 2020 16:30:58 +0300
-Subject: [PATCH] Pre-populate IP addresses for the name server upgrades
-
-Setting up resolv.conf in BIND instance expects IP addresses of the
-server to be provided. This is done wiht BindInstance.setup() method
-call. However, when reusing resolver setup during upgrade BIND instance
-has no IP addresses configured and fails with an assert in
-tasks.configure_dns_resolver().
-
-Pass through the server's IP addresses during upgrade.
-
-Fixes: https://pagure.io/freeipa/issue/8518
-
-Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
----
- ipaserver/install/server/upgrade.py | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
-index 332f8b251..144b340a4 100644
---- a/ipaserver/install/server/upgrade.py
-+++ b/ipaserver/install/server/upgrade.py
-@@ -1451,6 +1451,9 @@ def upgrade_bind(fstore):
- # resolve1's stub resolver config file.
- has_resolved_ipa_conf = os.path.isfile(paths.SYSTEMD_RESOLVED_IPA_CONF)
- if not has_resolved_ipa_conf and detect_resolve1_resolv_conf():
-+ ip_addresses = installutils.get_server_ip_address(
-+ api.env.host, True, False, [])
-+ bind.ip_addresses = ip_addresses
- bind.setup_resolv_conf()
- logger.info("Updated systemd-resolved configuration")
-
---
-2.28.0
-
diff --git a/freeipa-4.8.9-support-older-installations.patch b/freeipa-4.8.9-support-older-installations.patch
deleted file mode 100644
index 04561fa..0000000
--- a/freeipa-4.8.9-support-older-installations.patch
+++ /dev/null
@@ -1,282 +0,0 @@
-From 071e283b19e925bea596a25b4758ab2cbc657914 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten(a)redhat.com>
-Date: Tue, 11 Aug 2020 10:47:05 -0400
-Subject: [PATCH 1/3] Fall back to old server installation detection when
- needed
-
-If there is no installation section the the install pre-dated
-this new method of detecting a successful installation, fall back
-to that.
-
-https://pagure.io/freeipa/issue/8458
-
-Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com>
-Reviewed-By: Stanislav Levin <slev(a)altlinux.org>
-Reviewed-By: Alexander Bokovoy <abbra(a)users.noreply.github.com>
----
- ipalib/facts.py | 31 ++++++++++++++++++++++++++++-
- ipaserver/install/installutils.py | 4 ----
- ipaserver/install/server/install.py | 3 ++-
- ipaserver/install/server/upgrade.py | 7 +++++--
- 4 files changed, 37 insertions(+), 8 deletions(-)
-
-diff --git a/ipalib/facts.py b/ipalib/facts.py
-index 5106fc2ac5..d78c1a2275 100644
---- a/ipalib/facts.py
-+++ b/ipalib/facts.py
-@@ -6,17 +6,46 @@
- Facts about the installation
- """
-
-+import logging
- import os
- from . import sysrestore
- from ipaplatform.paths import paths
-
-+logger = logging.getLogger(__name__)
-+
-+# Used to determine install status
-+IPA_MODULES = [
-+ 'httpd', 'kadmin', 'dirsrv', 'pki-tomcatd', 'install', 'krb5kdc', 'named']
-+
-
- def is_ipa_configured():
- """
- Use the state to determine if IPA has been configured.
- """
- sstore = sysrestore.StateFile(paths.SYSRESTORE)
-- return sstore.get_state('installation', 'complete')
-+ if sstore.has_state('installation'):
-+ return sstore.get_state('installation', 'complete')
-+
-+ # Fall back to older method in case this is an existing installation
-+
-+ installed = False
-+
-+ fstore = sysrestore.FileStore(paths.SYSRESTORE)
-+
-+ for module in IPA_MODULES:
-+ if sstore.has_state(module):
-+ logger.debug('%s is configured', module)
-+ installed = True
-+ else:
-+ logger.debug('%s is not configured', module)
-+
-+ if fstore.has_files():
-+ logger.debug('filestore has files')
-+ installed = True
-+ else:
-+ logger.debug('filestore is tracking no files')
-+
-+ return installed
-
-
- def is_ipa_client_configured(on_master=False):
-diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
-index 583b1aca0b..13baf494cd 100644
---- a/ipaserver/install/installutils.py
-+++ b/ipaserver/install/installutils.py
-@@ -63,10 +63,6 @@
-
- logger = logging.getLogger(__name__)
-
--# Used to determine install status
--IPA_MODULES = [
-- 'httpd', 'kadmin', 'dirsrv', 'pki-tomcatd', 'install', 'krb5kdc', 'named']
--
-
- class BadHostError(Exception):
- pass
-diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
-index b86c3fec15..4d8e3ad78f 100644
---- a/ipaserver/install/server/install.py
-+++ b/ipaserver/install/server/install.py
-@@ -37,13 +37,14 @@
- validate_domain_name,
- no_matching_interface_for_ip_address_warning,
- )
-+from ipalib.facts import IPA_MODULES
- from ipaserver.install import (
- adtrust, adtrustinstance, bindinstance, ca, dns, dsinstance,
- httpinstance, installutils, kra, krbinstance,
- otpdinstance, custodiainstance, replication, service,
- sysupgrade)
- from ipaserver.install.installutils import (
-- IPA_MODULES, BadHostError, get_fqdn, get_server_ip_address,
-+ BadHostError, get_fqdn, get_server_ip_address,
- load_pkcs12, read_password, verify_fqdn, update_hosts_file,
- validate_mask)
-
-diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
-index f0d9b746cd..109d1e100e 100644
---- a/ipaserver/install/server/upgrade.py
-+++ b/ipaserver/install/server/upgrade.py
-@@ -1455,8 +1455,11 @@ def upgrade_configuration():
- fstore = sysrestore.FileStore(paths.SYSRESTORE)
- sstore = sysrestore.StateFile(paths.SYSRESTORE)
-
-- if is_ipa_configured() is None:
-- sstore.backup_state('installation', 'complete', True)
-+ if not sstore.has_state('installation'):
-+ if is_ipa_configured():
-+ sstore.backup_state('installation', 'complete', True)
-+ else:
-+ sstore.backup_state('installation', 'complete', False)
-
- fqdn = api.env.host
-
-
-From 7d84d919a8f5767ade1dcc380ce4eebadac6a8b5 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten(a)redhat.com>
-Date: Tue, 11 Aug 2020 11:12:55 -0400
-Subject: [PATCH 2/3] Use is_ipa_configured from ipalib.facts
-
-A couple of places still used the deprecated installutils version.
-
-https://pagure.io/freeipa/issue/8458
-
-Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com>
-Reviewed-By: Stanislav Levin <slev(a)altlinux.org>
-Reviewed-By: Alexander Bokovoy <abbra(a)users.noreply.github.com>
----
- ipaserver/install/installutils.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
-index 13baf494cd..a3274d5797 100644
---- a/ipaserver/install/installutils.py
-+++ b/ipaserver/install/installutils.py
-@@ -665,7 +665,7 @@ def check_server_configuration():
- Most convenient use case for the function is in install tools that require
- configured IPA for its function.
- """
-- if not is_ipa_configured():
-+ if not facts.is_ipa_configured():
- raise ScriptError("IPA is not configured on this system.",
- rval=SERVER_NOT_CONFIGURED)
-
-
-From 36ecfdbfe4ceedcfe056816cbb22162842fae975 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten(a)redhat.com>
-Date: Tue, 11 Aug 2020 13:55:54 -0400
-Subject: [PATCH 3/3] ipatests: Add test for is_ipa_configured
-
-Validate that is_ipa_configured() returns True when using either
-the original and the new configuration methods. This will allow
-older installs to successfully upgrade.
-
-https://pagure.io/freeipa/issue/8458
-
-Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com>
-Reviewed-By: Stanislav Levin <slev(a)altlinux.org>
-Reviewed-By: Alexander Bokovoy <abbra(a)users.noreply.github.com>
----
- .../test_integration/test_installation.py | 88 +++++++++++++++++++
- 1 file changed, 88 insertions(+)
-
-diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py
-index fb19900838..98bdc98ab8 100644
---- a/ipatests/test_integration/test_installation.py
-+++ b/ipatests/test_integration/test_installation.py
-@@ -21,6 +21,7 @@
-
- from ipalib import x509
- from ipalib.constants import DOMAIN_LEVEL_0
-+from ipalib.sysrestore import SYSRESTORE_STATEFILE, SYSRESTORE_INDEXFILE
- from ipapython.dn import DN
- from ipaplatform.constants import constants
- from ipaplatform.osinfo import osinfo
-@@ -357,6 +358,93 @@ def test_ipa_ca_crt_permissions(self):
- assert owner == "root"
- assert group == "root"
-
-+ def test_is_ipa_configured(self):
-+ """Verify that the old and new methods of is_ipa_installed works
-+
-+ If there is an installation section then it is the status.
-+
-+ If not then it will fall back to looking for configured
-+ services and files and use that for determination.
-+ """
-+ def set_installation_state(host, state):
-+ """
-+ Update the complete value in the installation section
-+ """
-+ host.run_command(
-+ ['python3', '-c',
-+ 'from ipalib.install import sysrestore; '
-+ 'from ipaplatform.paths import paths;'
-+ 'sstore = sysrestore.StateFile(paths.SYSRESTORE); '
-+ 'sstore.backup_state("installation", "complete", '
-+ '{state})'.format(state=state)])
-+
-+ def get_installation_state(host):
-+ """
-+ Retrieve the installation state from new install method
-+ """
-+ result = host.run_command(
-+ ['python3', '-c',
-+ 'from ipalib.install import sysrestore; '
-+ 'from ipaplatform.paths import paths;'
-+ 'sstore = sysrestore.StateFile(paths.SYSRESTORE); '
-+ 'print(sstore.get_state("installation", "complete"))'])
-+ return result.stdout_text.strip() # a string
-+
-+ # This comes from freeipa.spec and is used to determine whether
-+ # an upgrade is required.
-+ cmd = ['python3', '-c',
-+ 'import sys; from ipalib import facts; sys.exit(0 '
-+ 'if facts.is_ipa_configured() else 1);']
-+
-+ # This will use the new method since this is a fresh install,
-+ # verify that it is true.
-+ self.master.run_command(cmd)
-+ assert get_installation_state(self.master) == 'True'
-+
-+ # Set complete to False which should cause the command to fail
-+ # This tests the state of a failed or in-process installation.
-+ set_installation_state(self.master, False)
-+ result = self.master.run_command(cmd, raiseonerr=False)
-+ assert result.returncode == 1
-+ set_installation_state(self.master, True)
-+
-+ # Tweak sysrestore.state to drop installation section
-+ self.master.run_command(
-+ ['sed','-i', r's/\[installation\]/\[badinstallation\]/',
-+ os.path.join(paths.SYSRESTORE, SYSRESTORE_STATEFILE)])
-+
-+ # Re-run installation check and it should fall back to old method
-+ # and be successful.
-+ self.master.run_command(cmd)
-+ assert get_installation_state(self.master) == 'None'
-+
-+ # Restore installation section.
-+ self.master.run_command(
-+ ['sed','-i', r's/\[badinstallation\]/\[installation\]/',
-+ os.path.join(paths.SYSRESTORE, SYSRESTORE_STATEFILE)])
-+
-+ # Uninstall and confirm that the old method reports correctly
-+ # on uninstalled servers. It will exercise the old method since
-+ # there is no state.
-+ tasks.uninstall_master(self.master)
-+
-+ # ensure there is no stale state
-+ result = self.master.run_command(r'test -f {}'.format(
-+ os.path.join(paths.SYSRESTORE, SYSRESTORE_STATEFILE)),
-+ raiseonerr=False
-+ )
-+ assert result.returncode == 1
-+ result = self.master.run_command(r'test -f {}'.format(
-+ os.path.join(paths.SYSRESTORE, SYSRESTORE_INDEXFILE)),
-+ raiseonerr=False
-+ )
-+ assert result.returncode == 1
-+
-+ # Now run is_ipa_configured() and it should be False
-+ result = self.master.run_command(cmd, raiseonerr=False)
-+ assert result.returncode == 1
-+
-+
- class TestInstallWithCA_KRA1(InstallTestBase1):
-
- @classmethod
diff --git a/freeipa-4.9.0-rc2-fixes.patch b/freeipa-4.9.0-rc2-fixes.patch
deleted file mode 100644
index 2914d5f..0000000
--- a/freeipa-4.9.0-rc2-fixes.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From cd2fe2947589aaf8de0e9e64839c8840b68e9664 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy(a)redhat.com>
-Date: Wed, 9 Dec 2020 11:15:20 +0200
-Subject: [PATCH 1/2] Allow mod_auth_gssapi to create and access ccaches in
- /run/ipa/ccaches
-
-With commit c6644b8566f747fa80e2c1925b79bad9f8c92bd7 we default to
-create unique credential caches in /run/ipa/ccaches for every client
-that connects to IPA with a new session. On F34, mod_auth_gssapi process
-running as 'apache' cannot create the ccache in /run/ipa/ccaches because
-it has no access rights.
-
-The core of the problem is that we have two different paths to obtaining
-a ccache: one where 'apache' running httpd process creates it directly
-and one where an internal redirect from 'ipaapi' running httpd process
-is happening.
-
-Use SUID and SGID to 'ipaapi'/'ipaapi' and allow 'apache' group to write
-to '/run/ipa/ccaches'. This fixes the problem.
-
-Note that we cannot completely remove 'GssapiDelegCcachePerms'. If we'd
-do so, mod_auth_gssapi will do redirects and fail.
-
-Fixes: https://pagure.io/freeipa/issue/8613
-
-Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
----
- init/tmpfilesd/ipa.conf.in | 3 ++-
- install/share/ipa.conf.template | 4 ++--
- 2 files changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/init/tmpfilesd/ipa.conf.in b/init/tmpfilesd/ipa.conf.in
-index 183ceeda6..6467e1b93 100644
---- a/init/tmpfilesd/ipa.conf.in
-+++ b/init/tmpfilesd/ipa.conf.in
-@@ -1,2 +1,3 @@
- d /run/ipa 0711 root root
--d /run/ipa/ccaches 0770 ipaapi ipaapi
-+d /run/ipa/ccaches 6770 ipaapi ipaapi
-+a+ /run/ipa/ccaches - - - - g:apache:rwx
-diff --git a/install/share/ipa.conf.template b/install/share/ipa.conf.template
-index ca51d2ea3..d74e14d4f 100644
---- a/install/share/ipa.conf.template
-+++ b/install/share/ipa.conf.template
-@@ -75,7 +75,7 @@ WSGIScriptReloading Off
-
- GssapiImpersonate On
- GssapiDelegCcacheDir $IPA_CCACHES
-- GssapiDelegCcachePerms mode:0660 gid:ipaapi
-+ GssapiDelegCcachePerms mode:0660
- GssapiDelegCcacheUnique On
- GssapiUseS4U2Proxy on
- GssapiAllowedMech krb5
-@@ -117,7 +117,7 @@ Alias /ipa/session/cookie "/usr/share/ipa/gssapi.login"
- <Location "/ipa/session/login_x509">
- AuthType none
- GssapiDelegCcacheDir $IPA_CCACHES
-- GssapiDelegCcachePerms mode:0660 gid:ipaapi
-+ GssapiDelegCcachePerms mode:0660
- GssapiDelegCcacheUnique On
- SSLVerifyClient require
- SSLUserName SSL_CLIENT_CERT
---
-2.29.2
-
-
-From 786e0823cdc58ad232b8320af94ea9ad89df88d6 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy(a)redhat.com>
-Date: Wed, 9 Dec 2020 13:26:05 +0200
-Subject: [PATCH 2/2] upgrade: provide DOMAIN to the server upgrade dictionary
-
-Rules in ipa-rewrite.conf use $DOMAIN variable but it is not available
-in the dictionary. Regression was introduced with
-e731b2725a3772cd037683ff2e08c514fd02019f.
-
-Fixes: https://pagure.io/freeipa/issue/8615
-Related: https://pagure.io/freeipa/issue/8595
-
-Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
----
- ipaserver/install/server/upgrade.py | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
-index 18891d53c..00a133a4d 100644
---- a/ipaserver/install/server/upgrade.py
-+++ b/ipaserver/install/server/upgrade.py
-@@ -1578,6 +1578,7 @@ def upgrade_configuration():
- IPA_CCACHES=paths.IPA_CCACHES,
- IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
- KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
-+ DOMAIN=api.env.domain,
- )
-
- subject_base = find_subject_base()
---
-2.29.2
-
diff --git a/freeipa-refactor-dnssec-paths.patch b/freeipa-refactor-dnssec-paths.patch
deleted file mode 100644
index f13d4f1..0000000
--- a/freeipa-refactor-dnssec-paths.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 44669a5a35970020d492cba644d0584bcc68774f Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes(a)redhat.com>
-Date: Mon, 14 Dec 2020 17:44:38 +0100
-Subject: [PATCH] Change mkdir logic in DNSSEC
-
-- Create /var/named/dyndb-ldap/ipa/master/ early
-- Assume that /var/named/dyndb-ldap/ipa/master/ exists in BINDMgr.sync()
-
-Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
----
- ipaserver/dnssec/bindmgr.py | 7 +++----
- ipaserver/install/dnskeysyncinstance.py | 19 +++++++++++++------
- ipaserver/install/server/upgrade.py | 1 +
- 3 files changed, 17 insertions(+), 10 deletions(-)
-
-diff --git a/ipaserver/dnssec/bindmgr.py b/ipaserver/dnssec/bindmgr.py
-index 4f7cad89344..a15c0e601a2 100644
---- a/ipaserver/dnssec/bindmgr.py
-+++ b/ipaserver/dnssec/bindmgr.py
-@@ -182,10 +182,9 @@ def sync_zone(self, zone):
- zone_path = os.path.join(paths.BIND_LDAP_DNS_ZONE_WORKDIR,
- self.get_zone_dir_name(zone))
- try:
-- os.makedirs(zone_path)
-- except OSError as e:
-- if e.errno != errno.EEXIST:
-- raise e
-+ os.mkdir(zone_path, 0o770)
-+ except FileExistsError:
-+ pass
-
- # fix HSM permissions
- # TODO: move out
-diff --git a/ipaserver/install/dnskeysyncinstance.py b/ipaserver/install/dnskeysyncinstance.py
-index 26c1d9c7516..16870b73b5c 100644
---- a/ipaserver/install/dnskeysyncinstance.py
-+++ b/ipaserver/install/dnskeysyncinstance.py
-@@ -66,12 +66,19 @@ def set_dyndb_ldap_workdir_permissions(self):
- """
- Setting up correct permissions to allow write/read access for daemons
- """
-- if not os.path.exists(paths.BIND_LDAP_DNS_IPA_WORKDIR):
-- os.mkdir(paths.BIND_LDAP_DNS_IPA_WORKDIR, 0o770)
-- # dnssec daemons require to have access into the directory
-- os.chmod(paths.BIND_LDAP_DNS_IPA_WORKDIR, 0o770)
-- os.chown(paths.BIND_LDAP_DNS_IPA_WORKDIR, self.named_uid,
-- self.named_gid)
-+ directories = [
-+ paths.BIND_LDAP_DNS_IPA_WORKDIR,
-+ paths.BIND_LDAP_DNS_ZONE_WORKDIR,
-+ ]
-+ for directory in directories:
-+ try:
-+ os.mkdir(directory, 0o770)
-+ except FileExistsError:
-+ pass
-+ else:
-+ os.chmod(directory, 0o770)
-+ # dnssec daemons require to have access into the directory
-+ os.chown(directory, self.named_uid, self.named_gid)
-
- def remove_replica_public_keys(self, replica_fqdn):
- ldap = api.Backend.ldap2
-diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
-index 18891d53c7d..c453e16b08a 100644
---- a/ipaserver/install/server/upgrade.py
-+++ b/ipaserver/install/server/upgrade.py
-@@ -1749,6 +1749,7 @@ def upgrade_configuration():
- else:
- if dnssec_set_openssl_engine(dnskeysyncd):
- dnskeysyncd.start_dnskeysyncd()
-+ dnskeysyncd.set_dyndb_ldap_workdir_permissions()
-
- cleanup_kdc(fstore)
- cleanup_adtrust(fstore)
https://src.fedoraproject.org/rpms/freeipa/c/e98c2f2a4734c5ef3516d0795b59...
3Â years, 4Â months
abbra pushed to freeipa (f33). "FreeIPA 4.9.1 release"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:08:44 UTC
From 5efa1cb6b26a751576aa386c85f94b3781d11319 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy(a)redhat.com>
Date: Feb 01 2021 08:04:04 +0000
Subject: FreeIPA 4.9.1 release
---
diff --git a/.gitignore b/.gitignore
index b832b7b..862e71c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,3 +94,5 @@
/freeipa-4.8.9.tar.gz.asc
/freeipa-4.8.10.tar.gz
/freeipa-4.8.10.tar.gz.asc
+/freeipa-4.9.1.tar.gz
+/freeipa-4.9.1.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index 08c93f4..ace5284 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -1,12 +1,24 @@
+# ipatests enabled by default, can be disabled with --without ipatests
+%bcond_without ipatests
+# default to not use XML-RPC in Rawhide, can be turned around with --with ipa_join_xml
+# On RHEL 8 we should use --with ipa_join_xml
+%bcond_with ipa_join_xml
+
+# Linting is disabled by default, needed for upstream testing
+%bcond_with lint
+
+# Build documentation with sphinx
+%bcond_with doc
+
+# Build Python wheels
+%bcond_with wheels
+
# 389-ds-base 1.4 no longer supports i686 platform, build only client
# packages, https://bugzilla.redhat.com/show_bug.cgi?id=1544386
-%if 0%{?fedora} >= 28 || 0%{?rhel} > 7
- %ifarch %{ix86}
- %{!?ONLY_CLIENT:%global ONLY_CLIENT 1}
- %endif
+%ifarch %{ix86}
+ %{!?ONLY_CLIENT:%global ONLY_CLIENT 1}
%endif
-
# Define ONLY_CLIENT to only make the ipa-client and ipa-python
# subpackages
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
@@ -16,44 +28,34 @@
%global enable_server_option --enable-server
%endif
-# Build ipatests
-%if 0%{?rhel}
+%if %{ONLY_CLIENT}
%global with_ipatests 0
%endif
-%if ! %{ONLY_CLIENT}
- %{!?with_ipatests:%global with_ipatests 1}
-%endif
-%if 0%{?with_ipatests}
+
+# Whether to build ipatests
+%if %{with ipatests}
%global with_ipatests_option --with-ipatests
%else
%global with_ipatests_option --without-ipatests
%endif
-# Python 2/3 packages and default Python interpreter
-%if 0%{?rhel} > 7
- %global with_default_python 3
-%endif
-
-%if 0%{?fedora} >= 29
- # F29 only supports Python 3 as default Python
- %global with_default_python 3
+# Whether to use XML-RPC with ipa-join
+%if %{with ipa_join_xml}
+ %global with_ipa_join_xml_option --with-ipa-join-xml
+%else
+ %global with_ipa_join_xml_option --without-ipa-join-xml
%endif
-%{!?with_default_python:%global with_default_python 3}
-
-%global with_python3 1
-%global python %{__python3}
-
# lint is not executed during rpmbuild
# %%global with_lint 1
-%if 0%{?with_lint}
+%if %{with lint}
%global linter_options --enable-pylint --with-jslint
%else
%global linter_options --disable-pylint --without-jslint
%endif
# Include SELinux subpackage
-%if 0%{?fedora} >= 30 || 0%{?rhel}
+%if 0%{?fedora} >= 30 || 0%{?rhel} >= 8
%global with_selinux 1
%global selinuxtype targeted
%global modulename ipa
@@ -62,41 +64,41 @@
%if 0%{?rhel}
%global package_name ipa
%global alt_name freeipa
-%global krb5_version 1.18
+%global krb5_version 1.18.2-2
+%global krb5_kdb_version 8.0
# 0.7.16: https://github.com/drkjam/netaddr/issues/71
-%global python_netaddr_version 0.7.16
+%global python_netaddr_version 0.7.19
# Require 4.7.0 which brings Python 3 bindings
-%global samba_version 4.7.0
-%global selinux_policy_version 3.14.3-21
-%global slapi_nis_version 0.56.1-4
+%global samba_version 4.12.3-12
+%global selinux_policy_version 3.14.3-52
+%global slapi_nis_version 0.56.4
%global python_ldap_version 3.1.0-1
# python3-lib389
# Fix for "Installation fails: Replica Busy"
# https://pagure.io/389-ds-base/issue/49818
-%global ds_version 1.4.0.16
+%global ds_version 1.4.2.4-6
# Fix for TLS 1.3 PHA, RHBZ#1775158
%global httpd_version 2.4.37-21
+%global bind_version 9.11.20-6
%else
# Fedora
%global package_name freeipa
%global alt_name ipa
-# Fix for CVE-2018-20217
-%global krb5_version 1.18
+# Fix for CVE-2020-28196
+%global krb5_version 1.18.2-29
# 0.7.16: https://github.com/drkjam/netaddr/issues/71
%global python_netaddr_version 0.7.16
# Require 4.7.0 which brings Python 3 bindings
# Require 4.12 which has DsRGetForestTrustInformation access rights fixes
-%global samba_version 2:4.12
+%global samba_version 2:4.12.10
-# SELinux context for dirsrv unit file, BZ 1820298
-%if 0%{?fedora} >= 32
-%global selinux_policy_version 3.14.5-39
-%else
-%global selinux_policy_version 3.14.4-52
-%endif
+# 3.14.5-45 or later includes a number of interfaces fixes for IPA interface
+%global selinux_policy_version 3.14.5-45
%global slapi_nis_version 0.56.5
+%global krb5_kdb_version 8.0
+
# fix for segfault in python3-ldap, https://pagure.io/freeipa/issue/7324
%global python_ldap_version 3.1.0-1
# 1.4.3 moved nsslapd-db-locks to cn=bdb sub-entry
@@ -104,45 +106,54 @@
%global ds_version 1.4.3
# Fix for TLS 1.3 PHA, RHBZ#1775146
-%if 0%{?fedora} >= 31
%global httpd_version 2.4.41-9
-%else
-%global httpd_version 2.4.41-6.1
-%endif
+%global bind_version 9.11.24-1
# Don't use Fedora's Python dependency generator on Fedora 30/rawhide yet.
# Some packages don't provide new dist aliases.
# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/
%{?python_disable_dependency_generator}
-
# Fedora
%endif
-# krb5 can only provide one KDB at a time
-%if 0%{?fedora} >= 32 || 0%{?rhel} >= 8
-%global krb5_kdb_version 8.0
+# BIND employs 'pkcs11' OpenSSL engine instead of native PKCS11
+# Fedora 31+ uses OpenSSL engine, as well as Fedora ELN (RHEL9)
+%if 0%{?fedora} || 0%{?rhel} >= 9
+ %global openssl_pkcs11_version 0.4.10-6
+ %global softhsm_version 2.5.0-4
%else
-%global krb5_kdb_version 7.0
+ %global with_bind_pkcs11 1
%endif
+%if 0%{?rhel} == 8
# PKIConnection has been modified to always validate certs.
# https://pagure.io/freeipa/issue/8379
%global pki_version 10.9.0-0.4
-
-# https://pagure.io/certmonger/issue/90
-%global certmonger_version 0.79.7-1
-
-# NSS release with fix for p11-kit-proxy issue, affects F28
-# https://pagure.io/freeipa/issue/7810
-%if 0%{?fedora} == 28
-%global nss_version 3.41.0-3
%else
-%global nss_version 3.41.0-1
+# New KRA profile, ACME support
+# https://pagure.io/freeipa/issue/8545
+%global pki_version 10.10.0-2
%endif
-%global sssd_version 2.2.0-1
+# RHEL 8.3+, F32+ has 0.79.13
+%global certmonger_version 0.79.7-3
+
+# RHEL 8.2+, F32+ has 3.58
+%global nss_version 3.44.0-4
-%define krb5_base_version %(LC_ALL=C rpm -q --qf '%%{VERSION}' krb5-devel | grep -Eo '^[^.]+\.[^.]+')
+# RHEL 8.3+, F32+
+%global sssd_version 2.4.0
+
+%define krb5_base_version %(LC_ALL=C /usr/bin/pkgconf --modversion krb5 | grep -Eo '^[^.]+\.[^.]+' || echo %krb5_version)
+%global kdcproxy_version 0.4-3
+
+%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
+# systemd with resolved enabled
+# see https://pagure.io/freeipa/issue/8275
+%global systemd_version 246.6-3
+%else
+%global systemd_version 239
+%endif
%global plugin_dir %{_libdir}/dirsrv/plugins
%global etc_systemd_dir %{_sysconfdir}/systemd/system
@@ -152,25 +163,43 @@
# Work-around fact that RPM SPEC parser does not accept
# "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.8.10
+%define IPA_VERSION 4.9.1
+# Release candidate version -- uncomment with one percent for RC versions
+#%%global rc_version %%nil
%define AT_SIGN @
# redefine IPA_VERSION only if its value matches the Autoconf placeholder
%if "%{IPA_VERSION}" == "%{AT_SIGN}VERSION%{AT_SIGN}"
%define IPA_VERSION nonsense.to.please.RPM.SPEC.parser
%endif
+%define NON_DEVELOPER_BUILD ("%{lua: print(rpm.expand('%{suffix:%IPA_VERSION}'):find('^dev'))}" == "nil")
+
Name: %{package_name}
Version: %{IPA_VERSION}
-Release: 6%{?dist}
+Release: 1%{?rc_version:.%rc_version}%{?dist}
Summary: The Identity, Policy and Audit system
License: GPLv3+
URL: http://www.freeipa.org/
-Source0: https://releases.pagure.org/freeipa/freeipa-%{version}.tar.gz
-Source1: https://releases.pagure.org/freeipa/freeipa-%{version}.tar.gz.asc
-Patch0: freeipa-4.8.10-systemd-resolved.patch
-Patch1: freeipa-4.8.10-systemd-resolved-configuration.patch
-Patch2: freeipa-4.8.10-systemd-resolved-selinux-fixes.patch
+Source0: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar.gz
+# Only use detached signature for the distribution builds. If it is a developer build, skip it
+%if %{NON_DEVELOPER_BUILD}
+Source1: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar....
+%endif
+
+# RHEL spec file only: START: Change branding to IPA and Identity Management
+# Moved branding logos and background to redhat-logos-ipa-80.4:
+# header-logo.png, login-screen-background.jpg, login-screen-logo.png,
+# product-name.png
+# RHEL spec file only: END: Change branding to IPA and Identity Management
+
+# RHEL spec file only: START
+%if 0%{?rhel} == 8 && %{NON_DEVELOPER_BUILD}
+Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch
+Patch1002: 1002-4.8.0-Remove-csrgen.patch
+Patch1003: 1003-Revert-WebUI-use-python3-rjsmin-to-minify-JavaScript.patch
+%endif
+# RHEL spec file only: END
# For the timestamp trick in patch application
BuildRequires: diffstat
@@ -181,20 +210,29 @@ BuildRequires: openldap-devel
# DAL version change may cause code crash or memory leaks, it is better to fail early.
BuildRequires: krb5-kdb-version = %{krb5_kdb_version}
BuildRequires: krb5-kdb-devel-version = %{krb5_kdb_version}
+BuildRequires: krb5-devel >= %{krb5_version}
+BuildRequires: pkgconfig(krb5)
+%if %{with ipa_join_xml}
# 1.27.4: xmlrpc_curl_xportparms.gssapi_delegation
BuildRequires: xmlrpc-c-devel >= 1.27.4
+%else
+BuildRequires: libcurl-devel
+BuildRequires: jansson-devel
+%endif
BuildRequires: popt-devel
BuildRequires: gcc
BuildRequires: make
BuildRequires: pkgconfig
+BuildRequires: pkgconf
BuildRequires: autoconf
BuildRequires: automake
+BuildRequires: make
BuildRequires: libtool
BuildRequires: gettext
BuildRequires: gettext-devel
BuildRequires: python3-devel
BuildRequires: python3-setuptools
-BuildRequires: systemd
+BuildRequires: systemd >= %{systemd_version}
# systemd-tmpfiles which is executed from make install requires apache user
BuildRequires: httpd
BuildRequires: nspr-devel
@@ -207,12 +245,13 @@ BuildRequires: samba-devel >= %{samba_version}
BuildRequires: libtalloc-devel
BuildRequires: libtevent-devel
BuildRequires: libuuid-devel
+BuildRequires: libpwquality-devel
BuildRequires: libsss_idmap-devel
BuildRequires: libsss_certmap-devel
BuildRequires: libsss_nss_idmap-devel >= %{sssd_version}
BuildRequires: nodejs(abi)
# use old dependency on RHEL 8 for now
-%if 0%{?fedora} >= 31 || 0%{?rhel} > 8
+%if 0%{?fedora} >= 31 || 0%{?rhel} >= 9
BuildRequires: python3-rjsmin
%else
BuildRequires: uglify-js
@@ -222,9 +261,9 @@ BuildRequires: libunistring-devel
# 0.13.0: https://bugzilla.redhat.com/show_bug.cgi?id=1584773
# 0.13.0-2: fix for missing dependency on python-six
BuildRequires: python3-lesscpy >= 0.13.0-2
-
+BuildRequires: cracklib-dicts
# ONLY_CLIENT
-%endif
+%endif
#
# Build dependencies for makeapi/makeaci
@@ -242,7 +281,7 @@ BuildRequires: python3-psutil
#
# Build dependencies for wheel packaging and PyPI upload
#
-%if 0%{?with_wheels}
+%if %{with wheels}
BuildRequires: dbus-glib-devel
BuildRequires: libffi-devel
BuildRequires: python3-tox
@@ -255,15 +294,21 @@ BuildRequires: python3-wheel
# with_wheels
%endif
+%if %{with doc}
+BuildRequires: python3-sphinx
+BuildRequires: python3-m2r
+%endif
+
#
# Build dependencies for lint and fastcheck
#
-%if 0%{?with_lint}
+%if %{with lint}
BuildRequires: git
BuildRequires: jsl
BuildRequires: nss-tools
BuildRequires: rpmlint
BuildRequires: softhsm
+
BuildRequires: keyutils
BuildRequires: python3-augeas
BuildRequires: python3-cffi
@@ -290,7 +335,7 @@ BuildRequires: python3-polib
BuildRequires: python3-pyasn1
BuildRequires: python3-pyasn1-modules
BuildRequires: python3-pycodestyle
-%if 0%{?fedora} >= 29
+%if 0%{?fedora} || 0%{?rhel} > 8
# https://bugzilla.redhat.com/show_bug.cgi?id=1648299
BuildRequires: python3-pylint >= 2.1.1-2
%else
@@ -320,11 +365,9 @@ BuildRequires: krb5-server >= %{krb5_version}
# ONLY_CLIENT
%endif
-#
# Build dependencies for SELinux policy
-# 3.14.6-9 includes fix for https://github.com/fedora-selinux/selinux-policy/pull/333
-%if 0%{?with_selinux}
-BuildRequires: selinux-policy-devel >= 3.14.6-9
+%if %{with selinux}
+BuildRequires: selinux-policy-devel >= %{selinux_policy_version}
%endif
%description
@@ -350,7 +393,6 @@ Requires: nss-tools >= %{nss_version}
Requires(post): krb5-server >= %{krb5_version}
Requires(post): krb5-server >= %{krb5_base_version}
Requires: krb5-kdb-version = %{krb5_kdb_version}
-
Requires: krb5-pkinit-openssl >= %{krb5_version}
Requires: cyrus-sasl-gssapi%{?_isa}
Requires: chrony
@@ -366,17 +408,19 @@ Requires: mod_session >= %{httpd_version}
# 0.9.9: https://github.com/adelton/mod_lookup_identity/pull/3
Requires: mod_lookup_identity >= 0.9.9
Requires: acl
-Requires: systemd-units >= 38
+Requires: systemd-units >= %{systemd_version}
+Requires(pre): systemd-units >= %{systemd_version}
+Requires(post): systemd-units >= %{systemd_version}
+Requires(preun): systemd-units >= %{systemd_version}
+Requires(postun): systemd-units >= %{systemd_version}
Requires(pre): shadow-utils
-Requires(pre): systemd-units
-Requires(post): systemd-units
Requires: selinux-policy >= %{selinux_policy_version}
Requires(post): selinux-policy-base >= %{selinux_policy_version}
Requires: slapi-nis >= %{slapi_nis_version}
Requires: pki-ca >= %{pki_version}
Requires: pki-kra >= %{pki_version}
-Requires(preun): systemd-units
-Requires(postun): systemd-units
+# pki-acme package was split out in pki-10.10.0
+Requires: (pki-acme >= %{pki_version} if pki-ca >= 10.10.0)
Requires: policycoreutils >= 2.1.12-5
Requires: tar
Requires(pre): certmonger >= %{certmonger_version}
@@ -392,6 +436,8 @@ Requires: oddjob
# 0.7.0-2: https://pagure.io/gssproxy/pull-request/172
Requires: gssproxy >= 0.7.0-2
Requires: sssd-dbus >= %{sssd_version}
+Requires: libpwquality
+Requires: cracklib-dicts
Provides: %{alt_name}-server = %{version}
Conflicts: %{alt_name}-server
@@ -408,6 +454,13 @@ Obsoletes: %{name}-server <= 4.2.0
# member.
Conflicts: nss-pam-ldapd < 0.8.4
+# RHEL spec file only: START: Do not build tests
+%if 0%{?rhel} == 8
+# ipa-tests subpackage was moved to separate srpm
+Conflicts: ipa-tests < 3.3.3-9
+%endif
+# RHEL spec file only: END: Do not build tests
+
%description server
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
@@ -431,7 +484,7 @@ Requires: python3-dbus
Requires: python3-dns >= 1.15
Requires: python3-gssapi >= 1.2.0
Requires: python3-ipaclient = %{version}-%{release}
-Requires: python3-kdcproxy >= 0.4.1
+Requires: python3-kdcproxy >= %{kdcproxy_version}
Requires: python3-lxml
Requires: python3-pki >= %{pki_version}
Requires: python3-pyasn1 >= 0.3.2-2
@@ -445,7 +498,6 @@ Requires: python3-urllib3 >= 1.24.2-3
Requires: python3-urllib3 >= 1.25.7
%endif
-
%description -n python3-ipaserver
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
@@ -460,7 +512,11 @@ Summary: Common files used by IPA server
BuildArch: noarch
Requires: %{name}-client-common = %{version}-%{release}
Requires: httpd >= %{httpd_version}
-Requires: systemd-units >= 38
+Requires: systemd-units >= %{systemd_version}
+Requires: custodia >= 0.3.1
+%if 0%{?rhel} >= 8
+Requires: redhat-logos-ipa >= 80.4
+%endif
Provides: %{alt_name}-server-common = %{version}
Conflicts: %{alt_name}-server-common
@@ -479,12 +535,19 @@ If you are installing an IPA server, you need to install this package.
Summary: IPA integrated DNS server with support for automatic DNSSEC signing
BuildArch: noarch
Requires: %{name}-server = %{version}-%{release}
-Requires: bind-dyndb-ldap >= 11.3-1
-Requires: bind >= 9.11.19
-Requires: bind-utils >= 9.11.19
-Requires: bind-pkcs11 >= 9.11.19
-Requires: bind-pkcs11-utils >= 9.11.19
-Requires: opendnssec >= 2.1.6-3
+Requires: bind-dyndb-ldap >= 11.2-2
+Requires: bind >= %{bind_version}
+Requires: bind-utils >= %{bind_version}
+%if %{with bind_pkcs11}
+Requires: bind-pkcs11 >= %{bind_version}
+Requires: bind-pkcs11-utils >= %{bind_version}
+%else
+Requires: softhsm >= %{softhsm_version}
+Requires: openssl-pkcs11 >= %{openssl_pkcs11_version}
+%endif
+# See https://bugzilla.redhat.com/show_bug.cgi?id=1825812
+# RHEL 8.3+ and Fedora 32+ have 2.1
+Requires: opendnssec >= 2.1.6-5
%{?systemd_requires}
Provides: %{alt_name}-server-dns = %{version}
@@ -507,7 +570,9 @@ Requires: %{name}-common = %{version}-%{release}
Requires: samba >= %{samba_version}
Requires: samba-winbind
Requires: libsss_idmap
-
+%if 0%{?rhel}
+Obsoletes: ipa-idoverride-memberof-plugin <= 0.1
+%endif
Requires(post): python3
Requires: python3-samba
Requires: python3-libsss_nss_idmap
@@ -548,13 +613,14 @@ Requires: krb5-workstation >= %{krb5_version}
Requires: authselect >= 0.4-2
Requires: curl
# NIS domain name config: /usr/lib/systemd/system/*-domainname.service
-%if 0%{?fedora} >= 29
+# All Fedora 28+ and RHEL8+ contain the service in hostname package
Requires: hostname
-%else
-Requires: initscripts
-%endif
Requires: libcurl >= 7.21.7-2
+%if %{with ipa_join_xml}
Requires: xmlrpc-c >= 1.27.4
+%else
+Requires: jansson
+%endif
Requires: sssd-ipa >= %{sssd_version}
Requires: certmonger >= %{certmonger_version}
Requires: nss-tools >= %{nss_version}
@@ -578,6 +644,11 @@ Obsoletes: %{alt_name}-admintools < 4.4.1
Obsoletes: %{name}-admintools < 4.4.1
Provides: %{name}-admintools = %{version}-%{release}
+%if 0%{?rhel} == 8
+# Conflict with crypto-policies < 20200629-1 to get AD-SUPPORT policy module
+Conflicts: crypto-policies < 20200629-1
+%endif
+
%description client
IPA is an integrated solution to provide centrally managed Identity (users,
hosts, services), Authentication (SSO, 2FA), and Authorization
@@ -608,11 +679,11 @@ on the machine enrolled into a FreeIPA environment
%package client-epn
Summary: Tools to configure Expiring Password Notification in IPA
Group: System Environment/Base
-Requires: systemd-units
-Requires(post): systemd-units
-Requires(preun): systemd-units
-Requires(postun): systemd-units
Requires: %{name}-client = %{version}-%{release}
+Requires: systemd-units >= %{systemd_version}
+Requires(post): systemd-units >= %{systemd_version}
+Requires(preun): systemd-units >= %{systemd_version}
+Requires(postun): systemd-units >= %{systemd_version}
%description client-epn
This package provides a service to collect and send expiring password
@@ -638,7 +709,6 @@ and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
-
%package client-common
Summary: Common files used by IPA client
BuildArch: noarch
@@ -646,6 +716,12 @@ BuildArch: noarch
Provides: %{alt_name}-client-common = %{version}
Conflicts: %{alt_name}-client-common
Obsoletes: %{alt_name}-client-common < %{version}
+# python2-ipa* packages are no longer available in 4.8.
+Obsoletes: python2-ipaclient < 4.8.0-1
+Obsoletes: python2-ipalib < 4.8.0-1
+Obsoletes: python2-ipaserver < 4.8.0-1
+Obsoletes: python2-ipatests < 4.8.0-1
+
%description client-common
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -712,10 +788,14 @@ Requires: python3-pyasn1-modules >= 0.3.2-2
Requires: python3-pyusb
Requires: python3-qrcode-core >= 5.0.0
Requires: python3-requests
-Requires: python3-setuptools
Requires: python3-six
Requires: python3-sss-murmur
Requires: python3-yubico >= 1.3.2-7
+%if 0%{?rhel} && 0%{?rhel} >= 8
+Requires: platform-python-setuptools
+%else
+Requires: python3-setuptools
+%endif
%description -n python3-ipalib
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -737,11 +817,11 @@ Obsoletes: %{alt_name}-common < %{version}
Conflicts: %{alt_name}-python < %{version}
-%if 0%{?with_selinux}
+%if %{with selinux}
# This ensures that the *-selinux package and all it’s dependencies are not
# pulled into containers and other systems that do not use SELinux. The
# policy defines types and file contexts for client and server.
-Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
+Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
%endif
%description common
@@ -753,7 +833,7 @@ and integration with Active Directory based infrastructures (Trusts).
If you are using IPA, you need to install this package.
-%if 0%{?with_ipatests}
+%if %{with ipatests}
%package -n python3-ipatests
Summary: IPA tests and test tools
@@ -762,18 +842,25 @@ BuildArch: noarch
Requires: python3-ipaclient = %{version}-%{release}
Requires: python3-ipaserver = %{version}-%{release}
Requires: iptables
-Requires: ldns-utils
Requires: python3-coverage
Requires: python3-cryptography >= 1.6
+%if 0%{?fedora}
+# These packages do not exist on RHEL and for ipatests use
+# they are installed on the controller through other means
+Requires: ldns-utils
Requires: python3-polib
Requires: python3-pytest >= 3.9.1
Requires: python3-pytest-multihost >= 0.5
Requires: python3-pytest-sourceorder
+Requires: sshpass
+%endif
Requires: python3-sssdconfig >= %{sssd_version}
Requires: tar
Requires: xz
Requires: openssh-clients
-Requires: sshpass
+%if 0%{?rhel}
+AutoReqProv: no
+%endif
%description -n python3-ipatests
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -783,10 +870,11 @@ features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
This package contains tests that verify IPA functionality under Python 3.
-# with_ipatests
+# with ipatests
%endif
-%if 0%{?with_selinux}
+
+%if %{with selinux}
# SELinux subpackage
%package selinux
Summary: FreeIPA SELinux policy
@@ -797,12 +885,11 @@ Requires(post): selinux-policy-%{selinuxtype}
%description selinux
Custom SELinux policy module for FreeIPA
-# with_selinux
+# with selinux
%endif
%prep
-# Fedora spec file only: START
# Update timestamps on the files touched by a patch, to avoid non-equal
# .pyc/.pyo files across the multilib peers within a build, where "Level"
# is the patch prefix option (e.g. -p1)
@@ -814,17 +901,24 @@ UpdateTimestamps() {
# Locate the affected files:
for f in $(diffstat $Level -l $PatchFile); do
# Set the files to have the same timestamp as that of the patch:
- touch -r $PatchFile $f
+ touch -c -r $PatchFile $f
done
}
-%setup -n freeipa-%{version} -q
+%setup -n freeipa-%{version}%{?rc_version} -q
+
+# To allow proper application patches to the stripped po files, strip originals
+pushd po
+for i in *.po ; do
+ msgattrib --translated --no-fuzzy --no-location -s $i > $i.tmp || exit 1
+ mv $i.tmp $i || exit 1
+done
+popd
for p in %patches ; do
%__patch -p1 -i $p
UpdateTimestamps -p1 $p
done
-# Fedora spec file only: END
%build
# PATH is workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1005235
@@ -835,6 +929,7 @@ autoreconf -ivf
%configure --with-vendor-suffix=-%{release} \
%{enable_server_option} \
%{with_ipatests_option} \
+ %{with_ipa_join_xml_option} \
%{linter_options}
# run build in default dir
@@ -855,11 +950,13 @@ make %{?_smp_mflags} check VERBOSE=yes LIBDIR=%{_libdir}
# All files and directories created by spec install should be marked as ghost.
# (These are typically configuration files created by IPA installer.)
# All other artifacts should be created by make install.
-#
-%{__make} python_install DESTDIR=%{?buildroot} INSTALL="%{__install} -p"
+%make_install
+
+# don't package ipasphinx for now
+rm -rf %{buildroot}%{python3_sitelib}/ipasphinx*
-%if 0%{?with_ipatests}
+%if %{with ipatests}
mv %{buildroot}%{_bindir}/ipa-run-tests %{buildroot}%{_bindir}/ipa-run-tests-%{python3_version}
mv %{buildroot}%{_bindir}/ipa-test-config %{buildroot}%{_bindir}/ipa-test-config-%{python3_version}
mv %{buildroot}%{_bindir}/ipa-test-task %{buildroot}%{_bindir}/ipa-test-task-%{python3_version}
@@ -872,14 +969,21 @@ ln -frs %{buildroot}%{_bindir}/ipa-test-task-%{python3_version} %{buildroot}%{_b
# with_ipatests
%endif
-# default installation
-# This installs all Python packages twice and overrides the ipa-test
-# commands. We'll fix the command links later with ln --force.
-%make_install
-
# remove files which are useful only for make uninstall
find %{buildroot} -wholename '*/site-packages/*/install_files.txt' -exec rm {} \;
+%if 0%{?rhel}
+# RHEL spec file only: START
+# Moved branding logos and background to redhat-logos-ipa-80.4:
+# header-logo.png, login-screen-background.jpg, login-screen-logo.png,
+# product-name.png
+rm -f %{buildroot}%{_usr}/share/ipa/ui/images/header-logo.png
+rm -f %{buildroot}%{_usr}/share/ipa/ui/images/login-screen-background.jpg
+rm -f %{buildroot}%{_usr}/share/ipa/ui/images/login-screen-logo.png
+rm -f %{buildroot}%{_usr}/share/ipa/ui/images/product-name.png
+%endif
+# RHEL spec file only: END
+
%find_lang %{gettext_domain}
%if ! %{ONLY_CLIENT}
@@ -945,7 +1049,7 @@ fi
%posttrans server
# don't execute upgrade and restart of IPA when server is not installed
-%{__python3} -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
+%{__python3} -c "import sys; from ipalib import facts; sys.exit(0 if facts.is_ipa_configured() else 1);" > /dev/null 2>&1
if [ $? -eq 0 ]; then
# This is necessary for Fedora system upgrades which by default
@@ -961,6 +1065,11 @@ if [ $? -eq 0 ]; then
if [ $? -eq 0 ]; then
/bin/systemctl restart ipa.service >/dev/null
fi
+
+ /bin/systemctl is-enabled ipa-ccache-sweep.timer >/dev/null 2>&1
+ if [ $? -eq 1 ]; then
+ /bin/systemctl enable ipa-ccache-sweep.timer>/dev/null
+ fi
fi
# END
@@ -1024,7 +1133,7 @@ fi
%posttrans server-trust-ad
-%{__python3} -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
+%{__python3} -c "import sys; from ipalib import facts; sys.exit(0 if facts.is_ipa_configured() else 1);" > /dev/null 2>&1
if [ $? -eq 0 ]; then
# NOTE: systemd specific section
/bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
@@ -1077,6 +1186,7 @@ if [ $1 -gt 1 ] ; then
fi
%{__python3} -c 'from ipaclient.install.client import configure_krb5_snippet; configure_krb5_snippet()' >>/var/log/ipaupgrade.log 2>&1
+ %{__python3} -c 'from ipaclient.install.client import update_ipa_nssdb; update_ipa_nssdb()' >>/var/log/ipaupgrade.log 2>&1
SSH_CLIENT_SYSTEM_CONF="/etc/ssh/ssh_config"
if [ -f "$SSH_CLIENT_SYSTEM_CONF" ]; then
sed -E --in-place=.orig 's/^(HostKeyAlgorithms ssh-rsa,ssh-dss)$/# disabled by ipa-client update\n# \1/' "$SSH_CLIENT_SYSTEM_CONF"
@@ -1085,7 +1195,7 @@ if [ $1 -gt 1 ] ; then
fi
-%if 0%{?with_selinux}
+%if %{with selinux}
# SELinux contexts are saved so that only affected files can be
# relabeled after the policy module installation
%pre selinux
@@ -1142,6 +1252,7 @@ if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
fi
fi
+
%triggerin client -- openssh-server >= 8.2
# Has the client been configured?
restore=0
@@ -1202,9 +1313,11 @@ fi
%{_sbindir}/ipa-pkinit-manage
%{_sbindir}/ipa-crlgen-manage
%{_sbindir}/ipa-cert-fix
+%{_sbindir}/ipa-acme-manage
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
%{_libexecdir}/certmonger/ipa-server-guard
%dir %{_libexecdir}/ipa
+%{_libexecdir}/ipa/ipa-ccache-sweeper
%{_libexecdir}/ipa/ipa-custodia
%{_libexecdir}/ipa/ipa-custodia-check
%{_libexecdir}/ipa/ipa-httpd-kdcproxy
@@ -1229,6 +1342,8 @@ fi
%attr(644,root,root) %{_unitdir}/ipa.service
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
+%attr(644,root,root) %{_unitdir}/ipa-ccache-sweep.service
+%attr(644,root,root) %{_unitdir}/ipa-ccache-sweep.timer
# END
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
@@ -1269,6 +1384,7 @@ fi
%{_mandir}/man1/ipa-pkinit-manage.1*
%{_mandir}/man1/ipa-crlgen-manage.1*
%{_mandir}/man1/ipa-cert-fix.1*
+%{_mandir}/man1/ipa-acme-manage.1*
%files -n python3-ipaserver
@@ -1326,8 +1442,15 @@ fi
%{_usr}/share/ipa/ui/js/freeipa/core.js
%dir %{_usr}/share/ipa/ui/js/plugins
%dir %{_usr}/share/ipa/ui/images
+%if 0%{?rhel}
+%{_usr}/share/ipa/ui/images/facet-*.png
+# Moved branding logos and background to redhat-logos-ipa-80.4:
+# header-logo.png, login-screen-background.jpg, login-screen-logo.png,
+# product-name.png
+%else
%{_usr}/share/ipa/ui/images/*.jpg
%{_usr}/share/ipa/ui/images/*.png
+%endif
%dir %{_usr}/share/ipa/wsgi
%{_usr}/share/ipa/wsgi/plugins.py*
%dir %{_sysconfdir}/ipa
@@ -1416,6 +1539,8 @@ fi
%{_mandir}/man1/ipa-client-automount.1*
%{_mandir}/man1/ipa-certupdate.1*
%{_mandir}/man1/ipa-join.1*
+%dir %{_libexecdir}/ipa/acme
+%{_libexecdir}/ipa/acme/certbot-dns-ipa
%files client-samba
%doc README.md Contributors.txt
@@ -1423,6 +1548,7 @@ fi
%{_sbindir}/ipa-client-samba
%{_mandir}/man1/ipa-client-samba.1*
+
%files client-epn
%doc README.md Contributors.txt
%dir %{_sysconfdir}/ipa/epn
@@ -1453,6 +1579,9 @@ fi
%dir %{python3_sitelib}/ipaclient/remote_plugins/2_*
%{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
%{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
+%if 0%{?rhel}
+# RHEL spec file only: DELETED: Remove csrgen
+%else
%dir %{python3_sitelib}/ipaclient/csrgen
%dir %{python3_sitelib}/ipaclient/csrgen/profiles
%{python3_sitelib}/ipaclient/csrgen/profiles/*.json
@@ -1460,6 +1589,7 @@ fi
%{python3_sitelib}/ipaclient/csrgen/rules/*.json
%dir %{python3_sitelib}/ipaclient/csrgen/templates
%{python3_sitelib}/ipaclient/csrgen/templates/*.tmpl
+%endif
%{python3_sitelib}/ipaclient-*.egg-info
@@ -1497,7 +1627,7 @@ fi
%doc README.md Contributors.txt
%license COPYING
%dir %{_usr}/share/ipa
-
+%dir %{_libexecdir}/ipa
%files -n python3-ipalib
%doc README.md Contributors.txt
@@ -1511,7 +1641,8 @@ fi
%{python3_sitelib}/ipaplatform-*.egg-info
-%if 0%{?with_ipatests}
+%if %{with ipatests}
+
%files -n python3-ipatests
%doc README.md Contributors.txt
@@ -1531,17 +1662,21 @@ fi
%{_mandir}/man1/ipa-test-config.1*
%{_mandir}/man1/ipa-test-task.1*
-# with_ipatests
+# with ipatests
%endif
-%if 0%{?with_selinux}
+
+%if %{with selinux}
%files selinux
%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
-# with_selinux
+# with selinux
%endif
%changelog
+* Wed Jan 27 2021 Alexander Bokovoy <abokovoy(a)redhat.com> - 4.9.1-1
+- Upstream release FreeIPA 4.9.1
+
* Tue Oct 13 2020 Alexander Bokovoy <abokovoy(a)redhat.com> - 4.8.10-6
- Handle sshd_config upgrade properly
Fixes: rhbz#1887928
diff --git a/sources b/sources
index f373cc2..7b716a1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,4 @@
SHA512 (freeipa-4.8.10.tar.gz) = a14608cd2f8b50f1404df4761f1f72f1c250ea54257e8f072f488c1684a5f01dba060c67d17e11ab1237f65e041d9fca0eb4d0b9d1804cedb33a957c9ecfd954
SHA512 (freeipa-4.8.10.tar.gz.asc) = 7d188fd8ce742e4900c8b359e23406efda955578930d7d800fca96f03b461162bd2799e3915db7968c325c9c24712cfc108064e93dc3d6dd97b77968390e0e04
+SHA512 (freeipa-4.9.1.tar.gz) = 6a8671752190cb347d8df6e2b02aa363662f55b78989b0182b21ac1de4bb50fa940271f62641ebcaad3ad58532bc7b91364caf0099b69140b4ebe23c610017ee
+SHA512 (freeipa-4.9.1.tar.gz.asc) = 13aeea214adcdb89175a45d33e88ec49010bd0f5ca082f5b4973b4f500d34989b877867cc1b474d9d2953f3a8a5673101653fff85b5c155c9e6d1b58d94a7caf
https://src.fedoraproject.org/rpms/freeipa/c/5efa1cb6b26a751576aa386c85f9...
3Â years, 4Â months
fjanus pushed to mutt (master). "Rebase to upstream version 2.0.5
(..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:05:53 UTC
From 17eb9e353a2c72c7770196c9013c8d47c1cc2ae2 Mon Sep 17 00:00:00 2001
From: Filip Januš <fjanus(a)redhat.com>
Date: Feb 01 2021 09:05:11 +0000
Subject: Rebase to upstream version 2.0.5
FIX CVE-2021-3181
---
diff --git a/.gitignore b/.gitignore
index a1cf8a6..614ff9e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,4 @@ mutt-1.5.23.tar.gz
/mutt-1.14.6.tar.gz
/mutt-1.14.7.tar.gz
/mutt-2.0.2.tar.gz
+/mutt-2.0.5.tar.gz
diff --git a/mutt.spec b/mutt.spec
index b7c05f4..b7a23cd 100644
--- a/mutt.spec
+++ b/mutt.spec
@@ -19,8 +19,8 @@
Summary: A text mode mail user agent
Name: mutt
-Version: 2.0.2
-Release: 2%{?dist}
+Version: 2.0.5
+Release: 1%{?dist}
Epoch: 5
# The entire source code is GPLv2+ except
# pgpewrap.c setenv.c sha1.c wcwidth.c which are Public Domain
@@ -212,6 +212,10 @@ ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5
%changelog
+* Mon Feb 1 2021 Filip Januš <fjanus(a)redhat.com> -5:2.0.5-1
+- Rebase to upstream version 2.0.5
+- Fix CVE-2021-3181
+
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 5:2.0.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
diff --git a/sources b/sources
index e1eae2e..68af11e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (mutt-2.0.2.tar.gz) = 5dea02edf60b33e4873806481aa4256f91d90b05de99a9eccc620c459bd924197b656f85eb5a31757a61675389e6c4d76571128a757cfda255240934e82eec29
+SHA512 (mutt-2.0.5.tar.gz) = 41849d700b88e1b28b51fb90be2a9f6b639e8b111dce914073b66327e4655b5d4ca04dc3aedf2d44a0aa1a80ac3c4fcca6058eae7fb4f71f6b506fbe00a2a740
https://src.fedoraproject.org/rpms/mutt/c/17eb9e353a2c72c7770196c9013c8d4...
3Â years, 4Â months
packagerbot pushed to dummy-test-package-gloster (master). "Bump
release (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-02-01 09:05:43 UTC
From 9a4891009caf25c3cc103a044d8a510499639d56 Mon Sep 17 00:00:00 2001
From: packagerbot <admin(a)fedoraproject.org>
Date: Feb 01 2021 09:05:38 +0000
Subject: Bump release
Signed-off-by: packagerbot <admin(a)fedoraproject.org>
---
diff --git a/dummy-test-package-gloster.spec b/dummy-test-package-gloster.spec
index f36bdba..83be23c 100644
--- a/dummy-test-package-gloster.spec
+++ b/dummy-test-package-gloster.spec
@@ -3,7 +3,7 @@
Name: dummy-test-package-gloster
Version: 0
-Release: 2573%{?dist}
+Release: 2574%{?dist}
Summary: Dummy Test Package called Gloster
License: CC0
URL: http://fedoraproject.org/wiki/DummyTestPackages
@@ -32,6 +32,9 @@ cp -p uuid %{buildroot}%{_datadir}/%{name}
%{_datadir}/%{name}
%changelog
+* Mon Feb 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2574
+- rebuilt
+
* Mon Feb 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2573
- rebuilt
https://src.fedoraproject.org/rpms/dummy-test-package-gloster/c/9a4891009...
3Â years, 4Â months