spec file: put Python modules into standalone packages

Make the following changes in packaging:

* freeipa-server - split off python2-ipaserver and freeipa-server-common,
* freeipa-server-dns - build as noarch,
* freeipa-client - split off python2-ipaclient and freeipa-client-common,
* freeipa-admintools - build as noarch,
* freeipa-python - split into python2-ipalib and freeipa-common, provide
  freeipa-python-compat for upgrades,
* freeipa-tests - rename to python2-ipatests and build as noarch.

Bump version to 4.2.91.

https://fedorahosted.org/freeipa/ticket/3197

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>

3 files changed, 311 insertions, 95 deletions

diff --git a/Makefile b/Makefile
index d2c37f159..b6cc388e4 100644
--- a/Makefile
+++ b/Makefile
@@ -237,6 +237,7 @@ rpms: rpmroot rpmdistdir version-update lint tarballs
 	cp dist/sources/$(TARBALL) $(RPMBUILD)/SOURCES/.
 	rpmbuild --define "_topdir $(RPMBUILD)" -ba freeipa.spec
 	cp $(RPMBUILD)/RPMS/*/$(PRJ_PREFIX)-*-$(IPA_VERSION)-*.rpm dist/rpms/
+	cp $(RPMBUILD)/RPMS/*/python2-ipa*-$(IPA_VERSION)-*.rpm dist/rpms/
 	cp $(RPMBUILD)/SRPMS/$(PRJ_PREFIX)-$(IPA_VERSION)-*.src.rpm dist/srpms/
 	rm -rf $(RPMBUILD)
 
@@ -244,6 +245,7 @@ client-rpms: rpmroot rpmdistdir version-update lint tarballs
 	cp dist/sources/$(TARBALL) $(RPMBUILD)/SOURCES/.
 	rpmbuild --define "_topdir $(RPMBUILD)" --define "ONLY_CLIENT 1" -ba freeipa.spec
 	cp $(RPMBUILD)/RPMS/*/$(PRJ_PREFIX)-*-$(IPA_VERSION)-*.rpm dist/rpms/
+	cp $(RPMBUILD)/RPMS/*/python2-ipa*-$(IPA_VERSION)-*.rpm dist/rpms/
 	cp $(RPMBUILD)/SRPMS/$(PRJ_PREFIX)-$(IPA_VERSION)-*.src.rpm dist/srpms/
 	rm -rf $(RPMBUILD)
 
diff --git a/VERSION b/VERSION
index b7f261b5c..2446c92a0 100644
--- a/VERSION
+++ b/VERSION
@@ -21,7 +21,7 @@
 ########################################################
 IPA_VERSION_MAJOR=4
 IPA_VERSION_MINOR=2
-IPA_VERSION_RELEASE=90
+IPA_VERSION_RELEASE=91
 
 ########################################################
 # For 'alpha' releases the version will be             #
diff --git a/freeipa.spec.in b/freeipa.spec.in
index f776defd8..aceb076b5 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -110,13 +110,17 @@ hosts, services), Authentication (SSO, 2FA), and Authorization
 features for further integration with Linux based clients (SUDO, automount)
 and integration with Active Directory based infrastructures (Trusts).
 
+
 %if ! %{ONLY_CLIENT}
+
 %package server
 Summary: The IPA authentication server
 Group: System Environment/Base
-Requires: %{name}-python = %{version}-%{release}
+Requires: %{name}-server-common = %{version}-%{release}
 Requires: %{name}-client = %{version}-%{release}
 Requires: %{name}-admintools = %{version}-%{release}
+Requires: %{name}-common = %{version}-%{release}
+Requires: python2-ipaserver = %{version}-%{release}
 Requires: 389-ds-base >= 1.3.4.4
 Requires: openldap-clients > 2.4.35-4
 Requires: nss >= 3.14.3-12.0
@@ -131,12 +135,9 @@ Requires: mod_auth_gssapi >= 1.3.0-2
 Requires: mod_nss >= 1.0.8-26
 Requires: python-ldap >= 2.4.15
 Requires: python-gssapi >= 1.1.2
-Requires: python-sssdconfig
 Requires: acl
-Requires: python-pyasn1
 Requires: memcached
 Requires: python-memcached
-Requires: dbus-python
 Requires: systemd-units >= 38
 Requires(pre): shadow-utils
 Requires(pre): systemd-units
@@ -148,8 +149,6 @@ Requires: pki-ca >= 10.2.6-12
 Requires: pki-kra >= 10.2.6-12
 Requires(preun): python systemd-units
 Requires(postun): python systemd-units
-Requires: python-dns >= 1.11.1
-Requires: python-kdcproxy >= 0.3
 Requires: zip
 Requires: policycoreutils >= 2.1.12-5
 Requires: tar
@@ -163,8 +162,6 @@ Requires: p11-kit
 Requires: systemd-python
 Requires: %{etc_systemd_dir}
 Requires: gzip
-Requires: python-gssapi >= 1.1.0
-Requires: custodia
 
 Provides: %{alt_name}-server = %{version}
 Conflicts: %{alt_name}-server
@@ -190,9 +187,57 @@ and integration with Active Directory based infrastructures (Trusts).
 If you are installing an IPA server, you need to install this package.
 
 
+%package -n python2-ipaserver
+Summary: Python libraries used by IPA server
+Group: System Environment/Libraries
+BuildArch: noarch
+%{?python_provide:%python_provide python2-ipaserver}
+Requires: %{name}-server-common = %{version}-%{release}
+Requires: %{name}-common = %{version}-%{release}
+Requires: python2-ipaclient = %{version}-%{release}
+Requires: python-ldap >= 2.4.15
+Requires: python-gssapi >= 1.1.2
+Requires: python-sssdconfig
+Requires: python-pyasn1
+Requires: dbus-python
+Requires: python-dns >= 1.11.1
+Requires: python-kdcproxy >= 0.3
+
+%description -n python2-ipaserver
+IPA is an integrated solution to provide centrally managed Identity (users,
+hosts, services), Authentication (SSO, 2FA), and Authorization
+(host access control, SELinux user roles, services). The solution provides
+features for further integration with Linux based clients (SUDO, automount)
+and integration with Active Directory based infrastructures (Trusts).
+If you are installing an IPA server, you need to install this package.
+
+
+%package server-common
+Summary: Common files used by IPA server
+Group: System Environment/Base
+BuildArch: noarch
+Requires: %{name}-client-common = %{version}-%{release}
+Requires: httpd >= 2.4.6-6
+Requires: systemd-units >= 38
+Requires: custodia
+
+Provides: %{alt_name}-server-common = %{version}
+Conflicts: %{alt_name}-server-common
+Obsoletes: %{alt_name}-server-common < %{version}
+
+%description server-common
+IPA is an integrated solution to provide centrally managed Identity (users,
+hosts, services), Authentication (SSO, 2FA), and Authorization
+(host access control, SELinux user roles, services). The solution provides
+features for further integration with Linux based clients (SUDO, automount)
+and integration with Active Directory based infrastructures (Trusts).
+If you are installing an IPA server, you need to install this package.
+
+
 %package server-dns
 Summary: IPA integrated DNS server with support for automatic DNSSEC signing
 Group: System Environment/Base
+BuildArch: noarch
 Requires: %{name}-server = %{version}-%{release}
 Requires: bind-dyndb-ldap >= 6.0-4
 %if 0%{?fedora} >= 21
@@ -223,7 +268,8 @@ Integrated DNS server is BIND 9. OpenDNSSEC provides key management.
 %package server-trust-ad
 Summary: Virtual package to install packages required for Active Directory trusts
 Group: System Environment/Base
-Requires: %{name}-server = %version-%release
+Requires: %{name}-server = %{version}-%{release}
+Requires: %{name}-common = %{version}-%{release}
 Requires: samba-python
 Requires: samba >= %{samba_version}
 Requires: samba-winbind
@@ -255,7 +301,9 @@ dependencies at once.
 %package client
 Summary: IPA authentication for use on clients
 Group: System Environment/Base
-Requires: %{name}-python = %{version}-%{release}
+Requires: %{name}-client-common = %{version}-%{release}
+Requires: %{name}-common = %{version}-%{release}
+Requires: python2-ipaclient = %{version}-%{release}
 Requires: python-ldap
 Requires: cyrus-sasl-gssapi%{?_isa}
 Requires: ntp
@@ -272,7 +320,6 @@ Requires: nss-tools
 Requires: bind-utils
 Requires: oddjob-mkhomedir
 Requires: python-gssapi >= 1.1.2
-Requires: python-dns >= 1.11.1
 Requires: libsss_autofs
 Requires: autofs
 Requires: libnfsidmap
@@ -293,11 +340,51 @@ If your network uses IPA for authentication, this package should be
 installed on every client machine.
 
 
+%package -n python2-ipaclient
+Summary: Python libraries used by IPA client
+Group: System Environment/Libraries
+BuildArch: noarch
+%{?python_provide:%python_provide python2-ipaclient}
+Requires: %{name}-client-common = %{version}-%{release}
+Requires: %{name}-common = %{version}-%{release}
+Requires: python2-ipalib%{?_isa} = %{version}-%{release}
+Requires: python-dns >= 1.11.1
+
+%description -n python2-ipaclient
+IPA is an integrated solution to provide centrally managed Identity (users,
+hosts, services), Authentication (SSO, 2FA), and Authorization
+(host access control, SELinux user roles, services). The solution provides
+features for further integration with Linux based clients (SUDO, automount)
+and integration with Active Directory based infrastructures (Trusts).
+If your network uses IPA for authentication, this package should be
+installed on every client machine.
+
+
+%package client-common
+Summary: Common files used by IPA client
+Group: System Environment/Base
+BuildArch: noarch
+
+Provides: %{alt_name}-client-common = %{version}
+Conflicts: %{alt_name}-client-common
+Obsoletes: %{alt_name}-client-common < %{version}
+
+%description client-common
+IPA is an integrated solution to provide centrally managed Identity (users,
+hosts, services), Authentication (SSO, 2FA), and Authorization
+(host access control, SELinux user roles, services). The solution provides
+features for further integration with Linux based clients (SUDO, automount)
+and integration with Active Directory based infrastructures (Trusts).
+If your network uses IPA for authentication, this package should be
+installed on every client machine.
+
+
 %package admintools
 Summary: IPA administrative tools
 Group: System Environment/Base
-Requires: %{name}-python = %{version}-%{release}
-Requires: %{name}-client = %{version}-%{release}
+BuildArch: noarch
+Requires: %{name}-client-common = %{version}-%{release}
+Requires: python2-ipalib%{?_isa} = %{version}-%{release}
 Requires: python-ldap
 
 Provides: %{alt_name}-admintools = %{version}
@@ -312,9 +399,46 @@ features for further integration with Linux based clients (SUDO, automount)
 and integration with Active Directory based infrastructures (Trusts).
 This package provides command-line tools for IPA administrators.
 
-%package python
+
+%package python-compat
+Summary: Compatiblity package for Python libraries used by IPA
+Group: System Environment/Libraries
+BuildArch: noarch
+Obsoletes: %{name}-python < 4.2.91
+Provides: %{name}-python = %{version}-%{release}
+Requires: %{name}-common = %{version}-%{release}
+Requires: python2-ipalib%{?_isa} = %{version}-%{release}
+
+Provides: %{alt_name}-python-compat = %{version}
+Conflicts: %{alt_name}-python-compat
+Obsoletes: %{alt_name}-python-compat < %{version}
+
+Obsoletes: %{alt_name}-python < 4.2.91
+Provides: %{alt_name}-python = %{version}
+
+%description python-compat
+IPA is an integrated solution to provide centrally managed Identity (users,
+hosts, services), Authentication (SSO, 2FA), and Authorization
+(host access control, SELinux user roles, services). The solution provides
+features for further integration with Linux based clients (SUDO, automount)
+and integration with Active Directory based infrastructures (Trusts).
+This is a compatibility package to accommodate %{name}-python split into
+python2-ipalib and %{name}-common. Packages still depending on
+%{name}-python should be fixed to depend on python2-ipaclient or
+%{name}-common instead.
+
+
+%package -n python2-ipalib
 Summary: Python libraries used by IPA
 Group: System Environment/Libraries
+Conflicts: %{name}-python < %{version}-%{release}
+%{?python_provide:%python_provide python2-ipalib}
+%{?python_provide:%{?_isa:%python_provide python2-ipalib%{_isa}}}
+Provides: python2-ipapython = %{version}-%{release}
+%{?python_provide:%python_provide python2-ipapython}
+Provides: python2-ipaplatform = %{version}-%{release}
+%{?python_provide:%python_provide python2-ipaplatform}
+Requires: %{name}-common = %{version}-%{release}
 Requires: python-gssapi >= 1.1.2
 Requires: gnupg
 Requires: iproute
@@ -336,11 +460,30 @@ Requires: python-setuptools
 Requires: python-six
 Requires: python-jwcrypto
 
-Provides: %{alt_name}-python = %{version}
-Conflicts: %{alt_name}-python
-Obsoletes: %{alt_name}-python < %{version}
+Conflicts: %{alt_name}-python < %{version}
+
+%description -n python2-ipalib
+IPA is an integrated solution to provide centrally managed Identity (users,
+hosts, services), Authentication (SSO, 2FA), and Authorization
+(host access control, SELinux user roles, services). The solution provides
+features for further integration with Linux based clients (SUDO, automount)
+and integration with Active Directory based infrastructures (Trusts).
+If you are using IPA, you need to install this package.
+
+
+%package common
+Summary: Common files used by IPA
+Group: System Environment/Libraries
+BuildArch: noarch
+Conflicts: %{name}-python < %{version}-%{release}
 
-%description python
+Provides: %{alt_name}-common = %{version}
+Conflicts: %{alt_name}-common
+Obsoletes: %{alt_name}-common < %{version}
+
+Conflicts: %{alt_name}-python < %{version}
+
+%description common
 IPA is an integrated solution to provide centrally managed Identity (users,
 hosts, services), Authentication (SSO, 2FA), and Authorization
 (host access control, SELinux user roles, services). The solution provides
@@ -348,11 +491,17 @@ features for further integration with Linux based clients (SUDO, automount)
 and integration with Active Directory based infrastructures (Trusts).
 If you are using IPA, you need to install this package.
 
+
 %if ! %{ONLY_CLIENT}
-%package tests
+
+%package -n python2-ipatests
 Summary: IPA tests and test tools
-Requires: %{name}-client = %{version}-%{release}
-Requires: %{name}-python = %{version}-%{release}
+BuildArch: noarch
+Obsoletes: %{name}-tests < 4.2.91
+Provides: %{name}-tests%{?_isa} = %{version}-%{release}
+%{?python_provide:%python_provide python2-ipatests}
+Requires: %{name}-client-common = %{version}-%{release}
+Requires: python2-ipalib%{?_isa} = %{version}-%{release}
 Requires: tar
 Requires: xz
 Requires: python-nose
@@ -363,11 +512,11 @@ Requires: python-polib
 Requires: python-pytest-multihost >= 0.5
 Requires: python-pytest-sourceorder
 
-Provides: %{alt_name}-tests = %{version}
+Provides: %{alt_name}-tests%{?_isa} = %{version}
 Conflicts: %{alt_name}-tests
 Obsoletes: %{alt_name}-tests < %{version}
 
-%description tests
+%description -n python2-ipatests
 IPA is an integrated solution to provide centrally managed Identity (users,
 hosts, services), Authentication (SSO, 2FA), and Authorization
 (host access control, SELinux user roles, services). The solution provides
@@ -381,6 +530,7 @@ This package contains tests that verify IPA functionality.
 %prep
 %setup -n freeipa-%{version} -q
 
+
 %build
 # UI compilation segfaulted on some arches when the stack was lower (#1040576)
 export JAVA_STACK_SIZE="8m"
@@ -409,9 +559,11 @@ make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all
 make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
 %endif # ONLY_CLIENT
 
+
 %check
 make %{?_smp_mflags} check VERBOSE=yes
 
+
 %install
 rm -rf %{buildroot}
 export SUPPORTED_PLATFORM=%{platform_module}
@@ -430,7 +582,6 @@ make client-install DESTDIR=%{buildroot}
 %endif # ONLY_CLIENT
 %find_lang %{gettext_domain}
 
-
 mkdir -p %{buildroot}%{_usr}/share/ipa
 
 %if ! %{ONLY_CLIENT}
@@ -548,7 +699,6 @@ install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir
 mkdir -p %{buildroot}%{_sysconfdir}/cron.d
 
 (cd %{buildroot}/%{python_sitelib}/ipaserver && find . -type f  | \
-    grep -v dcerpc | grep -v adtrustinstance | \
     sed -e 's,\.py.*$,.*,g' | sort -u | \
     sed -e 's,\./,%%{python_sitelib}/ipaserver/,g' ) >server-python.list
 
@@ -558,13 +708,15 @@ mkdir -p %{buildroot}%{_sysconfdir}/cron.d
 
 mkdir -p %{buildroot}%{_sysconfdir}/ipa/custodia
 
-
 %endif # ONLY_CLIENT
 
+
 %clean
 rm -rf %{buildroot}
 
+
 %if ! %{ONLY_CLIENT}
+
 %post server
 # NOTE: systemd specific section
     /bin/systemctl --system daemon-reload 2>&1 || :
@@ -573,6 +725,7 @@ if [ $1 -gt 1 ] ; then
     /bin/systemctl condrestart certmonger.service 2>&1 || :
 fi
 
+
 %posttrans server
 # This must be run in posttrans so that updates from previous
 # execution that may no longer be shipped are not applied.
@@ -590,6 +743,7 @@ if [  $? -eq 0 ]; then
 fi
 # END
 
+
 %preun server
 if [ $1 = 0 ]; then
 # NOTE: systemd specific section
@@ -598,6 +752,7 @@ if [ $1 = 0 ]; then
 # END
 fi
 
+
 %pre server
 # Stop ipa_kpasswd if it exists before upgrading so we don't have a
 # zombie process when we're done.
@@ -607,6 +762,7 @@ if [ -e /usr/sbin/ipa_kpasswd ]; then
 # END
 fi
 
+
 %postun server-trust-ad
 if [ "$1" -ge "1" ]; then
     if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then
@@ -614,12 +770,14 @@ if [ "$1" -ge "1" ]; then
     fi
 fi
 
+
 %post server-trust-ad
 %{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \
         winbind_krb5_locator.so /dev/null 90
 /bin/systemctl reload-or-try-restart dbus
 /bin/systemctl reload-or-try-restart oddjobd
 
+
 %posttrans server-trust-ad
 python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
 if [  $? -eq 0 ]; then
@@ -628,6 +786,7 @@ if [  $? -eq 0 ]; then
 # END
 fi
 
+
 %preun server-trust-ad
 if [ $1 -eq 0 ]; then
     %{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
@@ -637,6 +796,7 @@ fi
 
 %endif # ONLY_CLIENT
 
+
 %post client
 if [ $1 -gt 1 ] ; then
     # Has the client been configured?
@@ -672,7 +832,8 @@ if [ $1 -gt 1 ] ; then
     fi
 fi
 
-%triggerin -n %{name}-client -- openssh-server
+
+%triggerin client -- openssh-server
 # Has the client been configured?
 restore=0
 test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
@@ -707,8 +868,10 @@ if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
     fi
 fi
 
+
 %if ! %{ONLY_CLIENT}
-%files server -f server-python.list
+
+%files server
 %defattr(-,root,root,-)
 %doc README Contributors.txt
 %license COPYING
@@ -742,6 +905,74 @@ fi
 %{_libexecdir}/ipa/ipa-dnskeysync-replica
 %{_libexecdir}/ipa/ipa-ods-exporter
 %{_libexecdir}/ipa/ipa-httpd-kdcproxy
+%dir %{_libdir}/ipa/certmonger
+%attr(755,root,root) %{_libdir}/ipa/certmonger/*
+# NOTE: systemd specific section
+%attr(644,root,root) %{_unitdir}/ipa.service
+%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
+%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
+%attr(644,root,root) %{_unitdir}/ipa-dnskeysyncd.service
+%attr(644,root,root) %{_unitdir}/ipa-ods-exporter.socket
+%attr(644,root,root) %{_unitdir}/ipa-ods-exporter.service
+# END
+%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
+%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
+%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
+%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
+%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
+%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
+%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
+%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
+%attr(755,root,root) %{plugin_dir}/libipa_dns.so
+%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
+%attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so
+%attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so
+%attr(755,root,root) %{plugin_dir}/libtopology.so
+%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
+%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
+%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
+%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
+%{_mandir}/man1/ipa-replica-conncheck.1.gz
+%{_mandir}/man1/ipa-replica-install.1.gz
+%{_mandir}/man1/ipa-replica-manage.1.gz
+%{_mandir}/man1/ipa-csreplica-manage.1.gz
+%{_mandir}/man1/ipa-replica-prepare.1.gz
+%{_mandir}/man1/ipa-server-certinstall.1.gz
+%{_mandir}/man1/ipa-server-install.1.gz
+%{_mandir}/man1/ipa-server-upgrade.1.gz
+%{_mandir}/man1/ipa-ca-install.1.gz
+%{_mandir}/man1/ipa-kra-install.1.gz
+%{_mandir}/man1/ipa-compat-manage.1.gz
+%{_mandir}/man1/ipa-nis-manage.1.gz
+%{_mandir}/man1/ipa-managed-entries.1.gz
+%{_mandir}/man1/ipa-ldap-updater.1.gz
+%{_mandir}/man8/ipactl.8.gz
+%{_mandir}/man8/ipa-upgradeconfig.8.gz
+%{_mandir}/man1/ipa-backup.1.gz
+%{_mandir}/man1/ipa-restore.1.gz
+%{_mandir}/man1/ipa-advise.1.gz
+%{_mandir}/man1/ipa-otptoken-import.1.gz
+%{_mandir}/man1/ipa-cacert-manage.1.gz
+%{_mandir}/man1/ipa-winsync-migrate.1.gz
+
+
+%files -n python2-ipaserver -f server-python.list
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
+%dir %{python_sitelib}/ipaserver
+%dir %{python_sitelib}/ipaserver/install
+%dir %{python_sitelib}/ipaserver/install/plugins
+%dir %{python_sitelib}/ipaserver/install/server
+%dir %{python_sitelib}/ipaserver/advise
+%dir %{python_sitelib}/ipaserver/advise/plugins
+%dir %{python_sitelib}/ipaserver/plugins
+
+
+%files server-common
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
 %ghost %verify(not owner group) %dir %{_sharedstatedir}/kdcproxy
 %dir %attr(0755,root,root) %{_sysconfdir}/ipa/kdcproxy
 %config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
@@ -755,25 +986,10 @@ fi
 %dir %attr(0700,apache,apache) %{_localstatedir}/run/httpd/ipa/krbcache/
 # NOTE: systemd specific section
 %{_tmpfilesdir}/%{name}.conf
-%attr(644,root,root) %{_unitdir}/ipa.service
 %attr(644,root,root) %{_unitdir}/ipa_memcached.service
-%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
-%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
-%attr(644,root,root) %{_unitdir}/ipa-dnskeysyncd.service
-%attr(644,root,root) %{_unitdir}/ipa-ods-exporter.socket
-%attr(644,root,root) %{_unitdir}/ipa-ods-exporter.service
 %attr(644,root,root) %{_unitdir}/ipa-custodia.service
 %attr(644,root,root) %{etc_systemd_dir}/httpd.service
 # END
-%dir %{python_sitelib}/ipaserver
-%dir %{python_sitelib}/ipaserver/install
-%dir %{python_sitelib}/ipaserver/install/plugins
-%dir %{python_sitelib}/ipaserver/install/server
-%dir %{python_sitelib}/ipaserver/advise
-%dir %{python_sitelib}/ipaserver/advise/plugins
-%dir %{python_sitelib}/ipaserver/plugins
-%dir %{_libdir}/ipa/certmonger
-%attr(755,root,root) %{_libdir}/ipa/certmonger/*
 %dir %{_usr}/share/ipa
 %{_usr}/share/ipa/wsgi.py*
 %{_usr}/share/ipa/copy-schema-to-ca.py*
@@ -855,22 +1071,6 @@ fi
 %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
 %dir %{_usr}/share/ipa/updates/
 %{_usr}/share/ipa/updates/*
-%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
-%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
-%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
-%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
-%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
-%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
-%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
-%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
-%attr(755,root,root) %{plugin_dir}/libipa_dns.so
-%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
-%attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so
-%attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so
-%attr(755,root,root) %{plugin_dir}/libtopology.so
-%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
-%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
-%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
 %dir %{_localstatedir}/lib/ipa
 %attr(700,root,root) %dir %{_localstatedir}/lib/ipa/backup
 %attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
@@ -878,42 +1078,25 @@ fi
 %attr(755,root,root) %dir %{_localstatedir}/lib/ipa/pki-ca
 %ghost %{_localstatedir}/lib/ipa/pki-ca/publish
 %ghost %{_localstatedir}/named/dyndb-ldap/ipa
-%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
 %dir %attr(0700,root,root) %{_sysconfdir}/ipa/custodia
-%{_mandir}/man1/ipa-replica-conncheck.1.gz
-%{_mandir}/man1/ipa-replica-install.1.gz
-%{_mandir}/man1/ipa-replica-manage.1.gz
-%{_mandir}/man1/ipa-csreplica-manage.1.gz
-%{_mandir}/man1/ipa-replica-prepare.1.gz
-%{_mandir}/man1/ipa-server-certinstall.1.gz
-%{_mandir}/man1/ipa-server-install.1.gz
-%{_mandir}/man1/ipa-server-upgrade.1.gz
-%{_mandir}/man1/ipa-ca-install.1.gz
-%{_mandir}/man1/ipa-kra-install.1.gz
-%{_mandir}/man1/ipa-compat-manage.1.gz
-%{_mandir}/man1/ipa-nis-manage.1.gz
-%{_mandir}/man1/ipa-managed-entries.1.gz
-%{_mandir}/man1/ipa-ldap-updater.1.gz
-%{_mandir}/man8/ipactl.8.gz
-%{_mandir}/man8/ipa-upgradeconfig.8.gz
-%{_mandir}/man1/ipa-backup.1.gz
-%{_mandir}/man1/ipa-restore.1.gz
-%{_mandir}/man1/ipa-advise.1.gz
-%{_mandir}/man1/ipa-otptoken-import.1.gz
-%{_mandir}/man1/ipa-cacert-manage.1.gz
-%{_mandir}/man1/ipa-winsync-migrate.1.gz
+
 
 %files server-dns
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
 %{_sbindir}/ipa-dns-install
 %{_mandir}/man1/ipa-dns-install.1.gz
 
+
 %files server-trust-ad
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
 %{_sbindir}/ipa-adtrust-install
 %{_usr}/share/ipa/smb.conf.empty
 %attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
 %{_mandir}/man1/ipa-adtrust-install.1.gz
-%{python_sitelib}/ipaserver/dcerpc*
-%{python_sitelib}/ipaserver/install/adtrustinstance*
 %ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
 %{_sysconfdir}/dbus-1/system.d/oddjob-ipa-trust.conf
 %{_sysconfdir}/oddjobd.conf.d/oddjobd-ipa-trust.conf
@@ -921,6 +1104,7 @@ fi
 
 %endif # ONLY_CLIENT
 
+
 %files client
 %defattr(-,root,root,-)
 %doc README Contributors.txt
@@ -931,6 +1115,26 @@ fi
 %{_sbindir}/ipa-getkeytab
 %{_sbindir}/ipa-rmkeytab
 %{_sbindir}/ipa-join
+%{_mandir}/man1/ipa-getkeytab.1.gz
+%{_mandir}/man1/ipa-rmkeytab.1.gz
+%{_mandir}/man1/ipa-client-install.1.gz
+%{_mandir}/man1/ipa-client-automount.1.gz
+%{_mandir}/man1/ipa-certupdate.1.gz
+%{_mandir}/man1/ipa-join.1.gz
+
+
+%files -n python2-ipaclient
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
+%dir %{python_sitelib}/ipaclient
+%{python_sitelib}/ipaclient/*.py*
+
+
+%files client-common
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
 %dir %attr(0755,root,root) %{_sysconfdir}/ipa/
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
@@ -943,16 +1147,9 @@ fi
 %dir %{_usr}/share/ipa
 %dir %{_localstatedir}/lib/ipa-client
 %dir %{_localstatedir}/lib/ipa-client/sysrestore
-%dir %{python_sitelib}/ipaclient
-%{python_sitelib}/ipaclient/*.py*
-%{_mandir}/man1/ipa-getkeytab.1.gz
-%{_mandir}/man1/ipa-rmkeytab.1.gz
-%{_mandir}/man1/ipa-client-install.1.gz
-%{_mandir}/man1/ipa-client-automount.1.gz
-%{_mandir}/man1/ipa-certupdate.1.gz
-%{_mandir}/man1/ipa-join.1.gz
 %{_mandir}/man5/default.conf.5.gz
 
+
 %files admintools
 %defattr(-,root,root,-)
 %doc README Contributors.txt
@@ -961,7 +1158,14 @@ fi
 %config %{_sysconfdir}/bash_completion.d
 %{_mandir}/man1/ipa.1.gz
 
-%files python -f %{gettext_domain}.lang
+
+%files python-compat
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
+
+
+%files -n python2-ipalib
 %defattr(-,root,root,-)
 %doc README Contributors.txt
 %license COPYING
@@ -985,8 +1189,16 @@ fi
 %{python_sitearch}/python_default_encoding-*.egg-info
 %{python_sitearch}/_ipap11helper-*.egg-info
 
+
+%files common -f %{gettext_domain}.lang
+%defattr(-,root,root,-)
+%doc README Contributors.txt
+%license COPYING
+
+
 %if ! %{ONLY_CLIENT}
-%files tests -f tests-python.list
+
+%files -n python2-ipatests -f tests-python.list
 %defattr(-,root,root,-)
 %doc README Contributors.txt
 %license COPYING
@@ -1008,8 +1220,10 @@ fi
 %{_mandir}/man1/ipa-run-tests.1.gz
 %{_mandir}/man1/ipa-test-config.1.gz
 %{_mandir}/man1/ipa-test-task.1.gz
+
 %endif # ONLY_CLIENT
 
+
 %changelog
 * Tue Nov 26 2013 Petr Viktorin<pviktori@redhat.com> - __VERSION__-__RELEASE__
 - Remove changelog. The history is kept in Git, downstreams have own logs.