Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com

This change makes single_value consistent with the raw property.

https://fedorahosted.org/freeipa/ticket/3521

Since we depend on Dogtag 10 now, there is no need to keep code
that installs a Dogtag 9 CA.

Support for upgraded Dogtag-9-style instances is left in.

https://fedorahosted.org/freeipa/ticket/3529

Ensure that 'ipactl stop' stops the dirsrv instance, even when no other
services are running.

https://fedorahosted.org/freeipa/ticket/3574

In addition to removing the module, fix all places where it was imported.

Preparation for: https://fedorahosted.org/freeipa/ticket/3446

Add a new init argument, ldap_uri, to IPAdmin to make this possible.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660

The file is only present in the case of a server installation.

It should only be touched by the server installer and ipactl.

https://fedorahosted.org/freeipa/ticket/3277

New servers that are installed with dogtag 10 instances will use
a single database instance for dogtag and IPA, albeit with different
suffixes.  Dogtag will communicate with the instance through a
database user with permissions to modify the dogtag  suffix only.
This user will authenticate using client auth using the subsystem cert
for the instance.

This patch includes changes to allow the creation of masters and clones
with single ds instances.

We check (possibly different) data from LDAP only at (re)start.
This way we always shutdown exactly the services we started even if the list
changed in the meanwhile (we avoid leaving a service running even if it was
removed from LDAP as the admin decided it should not be started in future).

This should also fix a problematic deadlock with systemd when we try to read
the list of service from LDAP at shutdown.

Ticket #2850 - Ipactl exception not handled well

There were various places in ipactl which intialized IpactlError with
None as the msg. If you called str() on that exception all was well
because ScriptError.__str__() converted a msg with None to the empty
string (IpactlError is subclassed from ScriptError). But a few places
directly access e.msg which will be None if initialized that way. It's
hard to tell from the stack traces but I'm pretty sure it's those
places which use e.msg directly which will cause the problems seen in
the bug report.

I do not believe it is ever correct to initialize an exception message
to None, I don't even understand what that means. On the other hand
initializing to the empty string is sensible and for that matter is
the default for the class.

This patch makes two fixes:

1) The ScriptError initializer will now convert a msg parameter of
None to the empty string.

2) All places that initialized IpactlError's msg parameter to None
removed the None initializer allowing the msg parameter to default
to the empty string.

I don't know how to test the fix for Ticket #2850 because it's not
clear how it got into that state in the first place, but I do believe
initialing the msg value to None is clearly wrong and should fix the
problem.