summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/installutils.py
Commit message (Collapse)AuthorAgeFilesLines
* Print correct subject on CA cert verification failureFraser Tweedale2018-11-131-0/+1
| | | | | | | | | | | | | | In load_external_cert(), if verification fails for a certificate in the trust chain, the error message contains the last subject name from a previous iteration of the trust chain, instead of the subject name of the current certificate. To report the correct subject, look it up using the current nickname. Part of: https://pagure.io/freeipa/issue/7761 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-051-8/+2
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-271-1/+1
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove create_replica_config from installutils in ipaserver/installThomas Woerner2018-09-121-46/+0
| | | | | | | | | This function is used to load the replica file. Without DL0 support this is not needed at all anymore. See: https://pagure.io/freeipa/issue/7689 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix pylint 2.0 conditional-related violationsArmando Neto2018-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | | In order to support pylint 2.0 the following violations must be fixed: - `chained-comparison` (R1716): Simplify chained comparison between the operands This message is emitted when pylint encounters boolean operation like "a < b and b < c", suggesting instead to refactor it to "a < b < c". - `consider-using-in` (R1714): Consider merging these comparisons with "in" to %r To check if a variable is equal to one of many values,combine the values into a tuple and check if the variable is contained "in" it instead of checking for equality against each of the values.This is faster and less verbose. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Ensure that public cert and CA bundle are readableChristian Heimes2018-06-271-1/+5
| | | | | | | | | | | | In CIS hardened mode, the process umask is 027. This results in some files not being world readable. Ensure that write_certificate_list() calls in client installer, server installer, and upgrader create cert bundles with permission bits 0644. Fixes: https://pagure.io/freeipa/issue/7594 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move config directives handling codeStanislav Laznicka2018-05-291-225/+0
| | | | | | | | Move config directives handling code: ipaserver.install.installutils -> ipapython.directivesetter Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use GnuPG 2 for symmentric encryptionChristian Heimes2018-05-271-51/+30
| | | | | | | | | | The /usr/bin/gpg command is old, legacy GnuPG 1.4 version. The recommended version is GnuPG 2 provided by /usr/bin/gpg2. For simple symmentric encryption, gpg2 is a drop-in replacement for gpg. Fixes: https://pagure.io/freeipa/issue/7560 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Disable message about log in ipa-backup if IPA is not configuredRob Crittenden2018-05-031-2/+3
| | | | | | | | | | | | | | | | | Introduce server installation constants similar to the client but only tie in SERVER_NOT_CONFIGURED right now. For the case of not configured don't spit out the "See <some log> for more information" because no logging was actually done. In the case of ipa-backup this could also be confusing if the --log-file option was also passed in because it would not be used. https://pagure.io/freeipa/issue/6843 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use a regex in installutils.get_directive instead of line splittingRob Crittenden2018-05-021-2/+9
| | | | | | | | | | | | This will allow for whitespace around the separator and changes the default space separator into white space (space + tabs) to be more generic and work better on Ubuntu which uses tabs in its Apache configuration. https://pagure.io/freeipa/issue/7490 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Handle whitespace, add separator to regex in set_directive_linesRob Crittenden2018-05-021-3/+7
| | | | | | | | | | | | | | | | We added the separator to the regex in set_directive_lines to avoid grabbing just a prefix. This doesn't allow for whitespace around the separator. For the Apache case we expected that the separator would be just spaces but it can also use tabs (like Ubuntu 18). Add a special case so that passing in a space separator is treated as whitespace (tab or space). https://pagure.io/freeipa/issue/7490 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Replace ntpd with chronyd in installationTibor Dudlák2018-04-091-2/+1
| | | | | | | | | | | | | | Completely remove ipaserver/install/ntpinstance.py This is no longer needed as chrony client configuration is now handled in ipa-client-install. Part of ipclient/install/client.py related to ntp configuration has been refactored a bit to not lookup for srv records and/or run chrony if not necessary. Addresses: https://pagure.io/freeipa/issue/7024 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* More cleanup after uninstallChristian Heimes2018-03-201-5/+5
| | | | | | | | | | | | | | | | Remove more files during ipaserver uninstallation: * /etc/gssproxy/10-ipa.conf * /etc/httpd/alias/*.ipasave * /etc/httpd/conf/password.conf * /etc/ipa/dnssec/softhsm2.conf * /etc/systemd/system/httpd.service.d/ * /var/lib/ipa/dnssec/tokens Fixes: https://pagure.io/freeipa/issue/7183 See: https://pagure.io/freeipa/issue/2694 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Koksharov <akokshar@redhat.com>
* Add value in set_directive after a commented-out versionRob Crittenden2018-02-211-6/+25
| | | | | | | | | | | When setting a value using set_directive() look for a commented-out version of the directive and add the new value immediately after that to keep the proper context. Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Replace hard-coded paths with path constantsChristian Heimes2018-02-081-5/+12
| | | | | | | | | | | Several run() calls used hard-coded paths rather than pre-defined paths from ipaplatform.paths. The patch fixes all places that I was able to find with a simple search. The fix simplifies Darix's port of freeIPA on openSuSE. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Custom ca-subject loggingamitkuma2018-01-231-1/+2
| | | | | | | | | | | | | Present Situation: Logging is a bit incomplete when using a custom CA subject passed in via --ca-subject. If there is a problem finding the IPA CA certificate then the installer will log: ERROR IPA CA certificate not found in /tmp/servercert.pem, /tmp/cacert.pem After the Fix this sort of log is seen: ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): DEBUG The ipa-server-install command failed, exception: ScriptError: IPA CA certificate with subject 'CN=Certificate Authority,O=GSSLAB.PNQ2.REDHAT.COM' was not found in /root/ipa.cert, /root/rootCA.crt. Resolves: https://pagure.io/freeipa/issue/7245 Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Use pylint 1.7.5 with fix for bad python3 importChristian Heimes2017-12-191-1/+1
| | | | | | Closes: https://pagure.io/freeipa/issue/7315 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com>
* Add safe DirectiveSetter context managerChristian Heimes2017-12-121-3/+84
| | | | | | | | | | | | | | | installutils.set_directive() is both inefficient and potentially dangerous. It does not ensure that the whole file is written and properly synced to disk. In worst case it could lead to partially written or destroyed config files. The new DirectiveSetter context manager wraps everything under an easy to use interface. https://pagure.io/freeipa/issue/7312 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* installutils: refactor set_directiveFraser Tweedale2017-12-121-23/+33
| | | | | | | | | | | To separate concerns and make it easier to test set_directive, extract function ``set_directive_lines`` to do the line-wise search/replace, leaving ``set_directive`` to deal with the file handling. Part of: https://pagure.io/freeipa/issue/7288 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Prevent set_directive from clobbering other keysFraser Tweedale2017-12-121-3/+3
| | | | | | | | | | | | | | | | `set_directive` only looks for a prefix of the line matching the given directive (key). If a directive is encountered for which the given key is prefix, it will be vanquished. This occurs in the case of `{ca,kra}.sslserver.cert[req]`; the `cert` directive gets updated after certificate renewal, and the `certreq` directive gets clobbered. This can cause failures later on during KRA installation, and possibly cloning. Match the whole directive to avoid this issue. Fixes: https://pagure.io/freeipa/issue/7288 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Use os.path.isfile() and isdir()Christian Heimes2017-10-201-2/+2
| | | | | | | | | | | Replace custom file_exists() and dir_exists() functions with proper functions from Python's stdlib. The change also gets rid of pylint's invalid bad-python3-import error, https://github.com/PyCQA/pylint/issues/1565 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove the `message` attribute from exceptionsStanislav Laznicka2017-10-061-1/+1
| | | | | | | | | This is causing python2 tests print ugly warnings about the deprecation of the `message` attribute in python2.6. https://pagure.io/freeipa/issue/7131 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ldif: handle attribute names as stringsStanislav Laznicka2017-09-121-0/+3
| | | | | | | | | | | | | | | | | | | | | ldif.LDIFRecordList handles all attribute names as utf-8 strings and all attribute values as bytes. If we take the attribute value and try to search for it in the entry (= dictionary), if it contains the attribute name as a key (which is a string), their hashes match. However, even if hashes match, Python needs to make sure those two are the same in case of a hash collision, so it tries to compare them. This causes BytesWarning exception when running in strict mode because `bytes` and `str` instances cannot be compared. KeyError would be thrown in a non-strict mode. Also, when later passing the attr to replace_value(), we need for it to be `str` otherwise the modifications handler fails because it tries to sort the attributes it's modifying but that's a bit less poetic issue than the first one. https://pagure.io/freeipa/issue/7129 Reviewed-By: Michal Reznik <mreznik@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-271-10/+7
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-271-2/+2
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-80/+83
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* CheckedIPAddress: remove match_local paramMartin Basti2017-06-201-1/+1
| | | | | | | | | This parameter is unused in code. We are no longer testing if IP address matches an interface in constructor. https://pagure.io/freeipa/issue/4317 Reviewed-By: David Kupka <dkupka@redhat.com>
* Only warn when specified server IP addresses don't match intfMartin Basti2017-06-061-2/+2
| | | | | | | | | | In containers local addresses differ from public addresses and we need a way to provide only public address to installers. https://pagure.io/freeipa/issue/2715 https://pagure.io/freeipa/issue/4317 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* py3: ConfigParser: replace deprecated readfd with readMartin Basti2017-06-011-3/+2
| | | | | | | | | | ConfigParser.readfd() is deprecated in py3, we can use .read() which is compatible with py2 https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* py3: use ConfigParser instead of SafeConfigParserMartin Basti2017-06-011-1/+6
| | | | | | | | | | | DeprecationWarning: The SafeConfigParser class has been renamed to ConfigParser in Python 3.2. This alias will be removed in future versions. Use ConfigParser directly instead. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: fix KDC certificate validation in CA-lessJan Cholasta2017-05-191-8/+16
| | | | | | | | | | | Verify that the provided certificate has the extended key usage and subject alternative name required for KDC. https://pagure.io/freeipa/issue/6831 https://pagure.io/freeipa/issue/6869 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: use custom object for trust flagsJan Cholasta2017-05-191-1/+1
| | | | | | | | | | | Replace trust flag strings with `TrustFlags` objects. The `TrustFlags` class encapsulates `certstore` key policy and has an additional flag indicating the presence of a private key. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb, certs: make trust flags argument mandatoryJan Cholasta2017-05-191-2/+3
| | | | | | | | | | Make the trust flags argument mandatory in all functions in `certdb` and `certs`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* installutils: add DM password validatorTomas Krizek2017-05-171-0/+16
| | | | | | | | | | | | Add a validator that checks whether provided Directory Manager is valid by attempting to connect to LDAP. Related https://pagure.io/freeipa/issue/6892 Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Create system users for FreeIPA services during package installationDavid Kupka2017-04-111-13/+0
| | | | | | | | | | | | | | | | | | | | Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add a new user to run the framework codeSimo Sorce2017-02-151-0/+13
| | | | | | | | | | | | | | | | | Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Simplify NSSDatabase password file handlingSimo Sorce2017-02-151-11/+6
| | | | | | | https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change session handlingSimo Sorce2017-02-151-1/+1
| | | | | | | | | | | | | | | | Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Delegate directive value quoting/unquoting to separate functionsMartin Babinsky2017-01-251-27/+43
| | | | | | | | | | | | | | | | | Separate functions were added to installutils module to quote/unquote a string in arbitrary characters. `installutils.get/set_directive` functions will use them to enclose the directive values in double quotes/strip the double quotes from retrieved values to maintain the original behavior. These functions can be used also for custom quoting/unquoting of retrieved values when desired. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* installutils: improve directive value parsing in `get_directive`Martin Babinsky2017-01-251-2/+17
| | | | | | | | | | | | | `get_directive` value parsing was improved in order to bring its logic more in-line to changes in `set_directive`: a specified quoting character is now unquoted and stripped from the retrieved value. The function will now also error out when malformed directive is encountered. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix the installutils.set_directive docstringMartin Babinsky2017-01-251-5/+8
| | | | | | | | | Add missing parameter descriptions and fix incorrect indentation https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-111-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Extract function for computing default subject baseFraser Tweedale2017-01-111-0/+4
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installutils: remove hardcoded subject DN assumptionFraser Tweedale2017-01-111-3/+4
| | | | | | | | | | | | `installutils.load_external_cert` assumes that the IPA CA subject DN is `CN=Certificate Authority, {subject_base}`. In preparation for full customisability of IPA CA subject DN, push this assumption out of this function to call sites (which will be updated in a subsequent commit). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make `kadmin` family of functions return the result of ipautil.runMartin Babinsky2016-12-161-5/+8
| | | | | | | | | | This allows for diagnose the output and error code of these operations. Otherwise there is no way to infer their success or failure apart from inspecting logs post-mortem. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Accept server host names resolvable only using /etc/hostsPetr Spacek2016-11-291-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Apparently "files" implementation of hosts NSS database cannot deal with trailing period in host names. Previously name server.example.com which is was resolvable neither using dns nor myhostname NSS modules were rejected by installer (despite having matching line in /etc/hosts). These names which are resolvable purely using "files" database are now accepted. The problem is that I had to remove trailing period from names passed to getaddrinfo() function. This effectivelly enables search list processing. This means that items from the search list might be silently appended to the query and we might get an IP address for totally different names than we asked for. Unfortunatelly I see no way around this while keeping ability to use names from NSS hosts database. https://fedorahosted.org/freeipa/ticket/6518 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipautil: move file encryption functions to installutilsJan Cholasta2016-11-291-1/+79
| | | | | | | | | | | The encrypt_file() and decrypt_file() functions depend on ipaplatform. Move them to ipaserver.install.installutils, as they are only used for the server installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-1/+2
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-291-5/+0
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-2/+2
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 22:53:24 +0000