[SSSD] [PATCH] Split the providers into separate subpackages

Jakub Hrozek jhrozek at redhat.com
Thu Oct 11 11:14:24 UTC 2012


Hi,

the attached patch splits the previously monolithic sssd package into
sssd-common that contains the deamon and the responders and per-provider
packages such as sssd-ldap or sssd-ipa.

This split would benefit two parties:
    1) security auditors who are often trying to find the smallest package
    set including dependencies needed for the package to function. They
    would be able to i.e. install sssd-ldap and not bother about
    sssd-ipa or sssd-ad pulling in more dependencies.
    2) 3rd party programs such as realmd or authconfig that would only
    be able to require or install on demand the needed packages.

The patch addresses https://fedorahosted.org/sssd/ticket/1510 and must b
applied on the two specfile patches I sent earlier (the thread subject
included libsss_sudo).
-------------- next part --------------
>From f59cfde30777a2c46f0ba2d6bd57dff62561851f Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 28 Sep 2012 09:21:18 +0200
Subject: [PATCH] Split the providers into separate subpackages

---
 contrib/sssd.spec.in | 145 ++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 115 insertions(+), 30 deletions(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index e194245d166c7dee2f1988019b414e5fb47df2de..9b5a9b475544d245fbad0cbdd056ab55a0df4437 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -45,17 +45,13 @@ BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 Patch0001:  sssd-1.9-man-change-default-ccache.patch
 
 ### Dependencies ###
-
-Requires: libldb >= 0.9.3
-Requires: libtdb >= 1.1.3
+Conflicts: sssd < %{version}-%{release}
 Requires: sssd-client%{?_isa} = %{version}-%{release}
-Requires: libipa_hbac = %{version}-%{release}
-Requires: libsss_idmap = %{version}-%{release}
-Requires: cyrus-sasl-gssapi
-Requires: keyutils-libs
-Requires(post): initscripts chkconfig
-Requires(preun):  initscripts chkconfig
-Requires(postun): initscripts chkconfig
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-ldap = %{version}-%{release}
+Requires: sssd-krb5 = %{version}-%{release}
+Requires: sssd-ipa = %{version}-%{release}
+Requires: sssd-ad = %{version}-%{release}
 
 %global servicename sssd
 %global sssdstatedir %{_localstatedir}/lib/sss
@@ -126,6 +122,21 @@ the system and a pluggable backend system to connect to multiple different
 account sources. It is also the basis to provide client auditing and policy
 services for projects like FreeIPA.
 
+%package common
+Summary: Common files for the SSSD
+Group: Applications/System
+License: GPLv3+
+Requires: libldb >= 0.9.3
+Requires: libtdb >= 1.1.3
+Requires: sssd-client%{?_isa} = %{version}-%{release}
+Requires(post): initscripts chkconfig
+Requires(preun):  initscripts chkconfig
+Requires(postun): initscripts chkconfig
+Conflicts: sssd < %{version}-%{release}
+
+%description common
+Common files for the SSSD.
+
 %package client
 Summary: SSSD Client libraries for NSS and PAM
 Group: Applications/System
@@ -141,7 +152,7 @@ service.
 Summary: Userspace tools for use with the SSSD
 Group: Applications/System
 License: GPLv3+
-Requires: sssd = %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
 
 %description tools
 Provides userspace tools for manipulating users, groups, and nested groups in
@@ -153,6 +164,61 @@ Also provides several other administrative tools:
     * sss_seed which pre-creates a user entry for use in kickstarts
     * sss_obfuscate for generating an obfuscated LDAP password
 
+%package ldap
+Summary: The LDAP back end of the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: cyrus-sasl-gssapi
+Requires: sssd-common = %{version}-%{release}
+Requires: libsss_idmap = %{version}-%{release}
+
+%description ldap
+Provides the LDAP back end that the SSSD can utilize to fetch identity data
+from and authenticate against an LDAP server.
+
+%package krb5
+Summary: The Kerberos authentication back end for the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: cyrus-sasl-gssapi
+Requires: sssd-common = %{version}-%{release}
+
+%description krb5
+Provides the Kerberos back end that the SSSD can utilize authenticate
+against a Kerberos server.
+
+%package ipa
+Summary: The IPA back end of the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-ldap = %{version}-%{release}
+Requires: sssd-krb5 = %{version}-%{release}
+Requires: libipa_hbac = %{version}-%{release}
+Requires: libsss_idmap = %{version}-%{release}
+Requires: bind-utils
+
+%description ipa
+Provides the IPA back end that the SSSD can utilize to fetch identity data
+from and authenticate against an IPA server.
+
+%package ad
+Summary: The AD back end of the SSSD
+Group: Applications/System
+License: GPLv3+
+Conflicts: sssd < %{version}-%{release}
+Requires: sssd-common = %{version}-%{release}
+Requires: sssd-ldap = %{version}-%{release}
+Requires: sssd-krb5 = %{version}-%{release}
+Requires: libsss_idmap = %{version}-%{release}
+
+%description ad
+Provides the Active Directory back end that the SSSD can utilize to fetch
+identity data from and authenticate against an Active Directory server.
+
 %package -n libsss_idmap
 Summary: FreeIPA Idmap library
 Group: Development/Libraries
@@ -205,7 +271,7 @@ used by Python applications.
 Summary: A library to allow communication between SUDO and SSSD
 Group: Development/Libraries
 License: LGPLv3+
-Requires: sssd = %{version}-%{release}
+Requires: sssd-ldap = %{version}-%{release}
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
 
@@ -330,7 +396,11 @@ touch $RPM_BUILD_ROOT/%{mcpath}/group
 %clean
 rm -rf $RPM_BUILD_ROOT
 
-%files -f sssd.lang
+%files
+%defattr(-,root,root,-)
+%doc COPYING
+
+%files common -f sssd.lang
 %defattr(-,root,root,-)
 %doc COPYING
 %doc src/examples/sssd-example.conf
@@ -338,8 +408,6 @@ rm -rf $RPM_BUILD_ROOT
 %{_sbindir}/sssd
 
 %dir %{_libexecdir}/%{servicename}
-%{_libexecdir}/%{servicename}/krb5_child
-%{_libexecdir}/%{servicename}/ldap_child
 %{_libexecdir}/%{servicename}/proxy_child
 %{_libexecdir}/%{servicename}/sssd_be
 %{_libexecdir}/%{servicename}/sssd_nss
@@ -349,17 +417,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/%{servicename}/sssd_ssh
 %{_libexecdir}/%{servicename}/sssd_sudo
 
-# RHEL 5 is too old to support the PAC responder
-%if !0%{?is_rhel5}
-%{_libexecdir}/%{servicename}/sssd_pac
-
-%endif
-
 %dir %{_libdir}/%{name}
-%{_libdir}/%{name}/libsss_ad.so
-%{_libdir}/%{name}/libsss_ipa.so
-%{_libdir}/%{name}/libsss_krb5.so
-%{_libdir}/%{name}/libsss_ldap.so
 %{_libdir}/%{name}/libsss_proxy.so
 %{_libdir}/%{name}/libsss_simple.so
 
@@ -374,7 +432,6 @@ rm -rf $RPM_BUILD_ROOT
 %ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/group
 %attr(755,root,root) %dir %{pipepath}
 %attr(755,root,root) %dir %{pubconfpath}
-%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
 %attr(700,root,root) %dir %{pipepath}/private
 %attr(750,root,root) %dir %{_var}/log/%{name}
 %attr(711,root,root) %dir %{_sysconfdir}/sssd
@@ -385,10 +442,6 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/sssd/sssd.api.conf
 %{_datadir}/sssd/sssd.api.d
 %{_mandir}/man5/sssd.conf.5*
-%{_mandir}/man5/sssd-ipa.5*
-%{_mandir}/man5/sssd-ad.5*
-%{_mandir}/man5/sssd-krb5.5*
-%{_mandir}/man5/sssd-ldap.5*
 %{_mandir}/man5/sssd-simple.5*
 %{_mandir}/man5/sssd-sudo.5*
 %{_mandir}/man8/sssd.8*
@@ -399,6 +452,38 @@ rm -rf $RPM_BUILD_ROOT
 %dir %{python_sitelib}/SSSDConfig
 %{python_sitelib}/SSSDConfig/*.py*
 
+%files ldap
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libexecdir}/%{servicename}/ldap_child
+%{_libdir}/%{name}/libsss_ldap.so
+%{_mandir}/man5/sssd-ldap.5*
+
+%files krb5
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libexecdir}/%{servicename}/krb5_child
+%{_libdir}/%{name}/libsss_krb5.so
+%{_mandir}/man5/sssd-krb5.5*
+
+%files ipa
+%defattr(-,root,root,-)
+%doc COPYING
+# RHEL 5 is too old to support the PAC responder
+%if !0%{?is_rhel5}
+%{_libexecdir}/%{servicename}/sssd_pac
+%endif
+
+%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
+%{_libdir}/%{name}/libsss_ipa.so
+%{_mandir}/man5/sssd-ipa.5*
+
+%files ad
+%defattr(-,root,root,-)
+%doc COPYING
+%{_libdir}/%{name}/libsss_ad.so
+%{_mandir}/man5/sssd-ad.5*
+
 %files client -f sssd_client.lang
 %defattr(-,root,root,-)
 %doc src/sss_client/COPYING src/sss_client/COPYING.LESSER
-- 
1.7.11.4



More information about the sssd-devel mailing list