summaryrefslogtreecommitdiffstats
path: root/freeipa.spec.in
Commit message (Collapse)AuthorAgeFilesLines
* spec file: always provide python package aliasesJan Cholasta2017-03-151-0/+6
| | | | | | | Provide python-ipa* aliases for python2-ipa* subpackages when the python_provide RPM macro is not available. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* spec file: support client-only buildJan Cholasta2017-03-151-8/+12
| | | | | | | | | | | | | | | | | | | nspr-devel, nss-devel and openssl-devel are required for client-only build, move their respective BuildRequires from the server-specific BuildRequires section to the main BuildRequires section. Pass --enable-server or --disable-server to ./configure based on the value of %{ONLY_CLIENT}. Remove the `make client-check` call from %check, as the client-check target does not exist anymore. Always call `make check` instead. Do not package the /usr/share/ipa directory in freeipa-client-common, as it is not created in client-only build. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* spec file: support build without ipatestsJan Cholasta2017-03-151-5/+24
| | | | | | | | | | Build ipatests only if %with_ipatests RPM macro is specified. By default the macro is specified if ONLY_CLIENT is not specified. https://pagure.io/freeipa/issue/6517 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Make pylint and jsl optionalChristian Heimes2017-03-151-7/+4
| | | | | | | | | | | | | | | | | | | | ./configure no longer fails when pylint or jsl are not available. The make targets for pylint and jsl are no longer defined without the tools. Rational: pylint and jsl are not required to build FreeIPA. Both are useful developer tools. It's more user friendly to make both components optionally with default config arguments. There is no reason to fail building on a build system without development tools. It's still possible to enforce dependency checks with --with-jslint and --enable-pylint. https://fedorahosted.org/freeipa/ticket/6604 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* spec file: add unconditional python-setuptools BuildRequiresJan Cholasta2017-03-151-2/+2
| | | | | | | | | | python-setuptools is required not only for lint, but to make the build possible at all. Move the python-setuptools BuildRequires from the lint section to the main section. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove copy-schema-to-ca.py from master branchMartin Basti2017-03-141-1/+0
| | | | | | | | | This script is used only for IPA <3.1, so it must be compatible with ipa-3-0 branch, so it should be placed there https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Support certificate login after installation and upgradePavel Vomacka2017-03-141-0/+1
| | | | | | | | | | | | Add necessary steps which set SSSD and set SELinux boolean during installation or upgrade. Also create new endpoint in apache for login using certificates. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* pylint: bump dependency to version >= 1.6Martin Basti2017-03-131-2/+2
| | | | | | Older pylint versions produces false positive errors Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Bump required version of gssproxy to 0.7.0David Kupka2017-03-101-2/+1
| | | | | | | https://pagure.io/freeipa/issue/6671 https://pagure.io/freeipa/issue/6698 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Move csrgen templates into ipaclient packageChristian Heimes2017-03-081-7/+6
| | | | | | | | | | | | csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* IdM Server: list all Employees with matching Smart CardFlorence Blanc-Renaud2017-03-081-0/+2
| | | | | | | | | | | | | Implement a new IPA command allowing to retrieve the list of users matching the provided certificate. The command is using SSSD Dbus interface, thus including users from IPA domain and from trusted domains. This requires sssd-dbus package to be installed on IPA server. https://fedorahosted.org/freeipa/ticket/6646 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change README to use MarkdownPetr Vobornik2017-03-021-16/+16
| | | | | | | | | So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add with_wheels global to install wheel and PyPI packaging dependenciesChristian Heimes2017-03-021-3/+8
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add python-wheel as build requirementChristian Heimes2017-03-021-0/+10
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Do not configure PKI ajp redirection to use "::1"Florence Blanc-Renaud2017-02-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | When ipa-server-install configures PKI, it provides a configuration file with the parameter pki_ajp_host set to ::1. This parameter is used to configure Tomcat redirection in /etc/pki/pki-tomcat/server.xml: <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="::1" /> ie all requests to port 8009 are redirected to port 8443 on address ::1. If the /etc/hosts config file does not define ::1 for localhost, then AJP redirection fails and replica install is not able to request a certificate for the replica. Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP redirection with "localhost", FreeIPA does not need any more to override this setting. The code now depends on pki 10.3.5-11 which provides the fix in the template and the upgrade. https://fedorahosted.org/freeipa/ticket/6575 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa-kdb: support KDB DAL version 6.1Alexander Bokovoy2017-02-151-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | DAL version 6.0 removed support for a callback to free principal. This broke KDB drivers which had complex e_data structure within the principal structure. As result, FreeIPA KDB driver was leaking memory with DAL version 6.0 (krb5 1.15). DAL version 6.1 added a special callback for freeing e_data structure. See details at krb5/krb5#596 Restructure KDB driver code to provide this callback in case we are built against DAL version that supports it. For DAL version prior to 6.0 use this callback in the free_principal callback to tidy the code. Use explicit KDB version dependency in Fedora 26+ via BuildRequires. With new DAL version, freeipa package will fail to build and we'll have to add a support for new DAL version explicitly. https://fedorahosted.org/freeipa/ticket/6619 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Configure HTTPD to work via Gss-ProxySimo Sorce2017-02-151-0/+3
| | | | | | | | https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Generate tmpfiles config at install timeSimo Sorce2017-02-151-6/+1
| | | | | | | | | | | | | | We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change session handlingSimo Sorce2017-02-151-7/+3
| | | | | | | | | | | | | | | | Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Bump required python-cryptography versionStanislav Laznicka2017-02-141-8/+8
| | | | | | | | | | Since we started using 'Certificate.serial_number' instead of '.serial' from python-cryptography, bump the required version to the one where the above mentioned transition happened. https://fedorahosted.org/freeipa/ticket/6631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Bump required version of bind-dyndb-ldap to 11.0-2Tomas Krizek2017-02-141-1/+1
| | | | | | | | | | Fedora release bind-dyndb-ldap 11.0-2 transforms existing named.conf old style API to the new style API. This package version is required to enable upgrade of existing IPA installations to new version. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* bump required version of BIND, bind-dyndb-ldapTomas Krizek2017-02-091-12/+5
| | | | | | | | | | | | bynd-dyndb-ldap used a custom configuration file format. Since BIND 9.11, an API was accepted upstream. This caused backward incompatible changes to the named.conf configuration file used to configure the bind-dyndb-ldap BIND plugin. Version 11.0 of bind-dyndb-ldap plugin and BIND 9.11 are required to use with the new config file format. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
* pki-base: use pki-base-python2 as dependencyMartin Basti2017-02-071-3/+2
| | | | | | | | | | | | | pki-base provides pki-base-python2, but we should depend directly on pki-base-python2 because in future pki-base may provide pki-base-python3 instead. Source: cheimes@redhat.com https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* pki: add missing depedency pki-base[-python3]Martin Basti2017-02-071-2/+3
| | | | | | | | | FreeIPA server modules requires pki module https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add code to generate scripts that generate CSRsBen Lipton2017-01-311-0/+11
| | | | | | | | | | | | Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove deprecated ipa-upgradeconfig commandAbhijeet Kasurde2017-01-241-2/+0
| | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/6620 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* SPEC: Fix build in mockLukas Slebodnik2017-01-181-2/+13
| | | | | | | | | | | | | | | | | | | Neither pylint nor jsl is installed by default because rpm macro with_lint is not defined in spec file. However, configure script tried to find pylint/jsl anyway. checking for Pylint... /usr/bin/python2: No module named pylint configure: error: cannot find pylint for /usr/bin/python2 RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build) Resolves: https://fedorahosted.org/freeipa/ticket/6604 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Py3: Fix ToASCII methodMartin Basti2017-01-061-10/+10
| | | | | | | | | | | in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method returns Py3 default (unicode) string. So only in Py2 we have to decode str to unicode. https://fedorahosted.org/freeipa/ticket/5935 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* spec file: revert to the previous Release tagJan Cholasta2017-01-021-1/+1
| | | | | | | | | | | | | | | Revert from the current Release tag value `upstream` to the previously used `0%{?dist}`, because: * `0` sorts before `1`, which is usually used as the initial release number in downstream packages, * the information provided by `%{?dist}` is useful, as packages built on one OS are not always installable on another OS. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* spec file: do not define with_lint inside a commentJan Cholasta2016-12-191-1/+1
| | | | | | | | | | | RPM expands macros even inside comments in spec files, so the with_lint macro is unintentionally always defined. Escape the percent sign in '%global' in the comment to prevent this. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Build: specify BuildRequires for Python 3 pylintPetr Spacek2016-12-131-1/+40
| | | | | | | | | | | python3-samba is intentionally ommited because it is not in Fedora repos. Pylint somehow magically ignores this missing package. Keep in mind that server will not work until this this solved. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: makerpms.sh generates Python 2 & 3 packages at the same timePetr Spacek2016-12-131-55/+103
| | | | | | | | | | | | | | | | | | | | | Petr Viktorin recommended me to copy the whole build directory and run configure twice, with different values for PYTHON variable. After thinking a bit about that, it seems as cleanest approach. Building for two versions of Python at the same time should be temporary state so I decided not to complicate Autotools build system with conditional spagetti for two versions of Python. For proper Python2/3 distiction in the two separate builds, I added find/grep/sed combo which replaces shebangs with system-wide Python interpreter as necessary. This is workaround for the fact that FreeIPA does not use setuptools properly. Honza told me that proper use of setuptools is not trivial so we decided to go with this for now. https://fedorahosted.org/freeipa/ticket/157 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add python-pyasn1-modules into dependenciesPavel Vomacka2016-12-051-0/+3
| | | | | | | | | | | | | | Python-pyasn1-modules is needed because of this import: from pyasn1_modules import rfc2459 in ipalib/x509.py. Python-pyasn1-modules is required only by python-ldap package, but it would be good to not rely on another package and rather say explicitely that this package is necessary. https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Require python-cryptography >= 1.3.1Christian Heimes2016-11-301-6/+6
| | | | | | | | | | | | | | | | python-cryptography versions < 1.3 no longer compile with recent OpenSSL 1.0.2 versions. In order to build wheels, a more recent version of cryptography is required. 1.3.1 is the oldest well tested version (RHEL 7.3) that is known to work with FreeIPA. Bump up in freeipa.spec is not required for technical reasons. The problem only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Require python-gssapi >= 1.2.0Christian Heimes2016-11-301-6/+6
| | | | | | | | | | | | | | | The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the oldest version that has been tested at length by QE. It's know to work. Bump up in freeipa.spec is not required for technical reasons. The packaging bug only affects PyPI packages. It's policy to keep requirements in sync. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: move IPA NSS DB install functions to ipaclient.installJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | The create_ipa_nssdb() and update_ipa_nssdb() depend on ipaplatform. Move them to ipaclient.install.client as they are used only from the client installer and ipa-restore. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-291-4/+2
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* DNS: URI records: bump python-dns requirementsMartin Basti2016-11-291-5/+5
| | | | | | | | Support for DNS URI records has been added in python-dns 1.13 https://fedorahosted.org/freeipa/ticket/6344 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: workaround bug while calling parallel make from rpmbuildPetr Spacek2016-11-291-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: use standard infrastructure for translationsPetr Spacek2016-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | We now use standard framework generatedby "gettextize" utility. It has two limitations which I do not consider sufficiently important to invest into hand-made solution: 1. It can automatically gather strings only from files which have some file extension like .c or .py. Right now we do not have any translatable strings in Python files without extensions. Given that these files will be removed from source tree and replaced with entry points from setuptools I do not see a reason to invest into supporting this. 2. It does not automatically strip untranslated strings from po files. This is a manual step in mainteiner's in workflow anyway so I will add separate Makefile target for it later on. This commit contains gettextize instrastructure + filled-in files Makevars and POTFILES.in. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Port ipapython.dnssec.odsmgr to xml.etreeChristian Heimes2016-11-161-2/+1
| | | | | | | | | | The module ipapython.dnssec.odsmgr is the only module in ipalib, ipaclient, ipapython and ipaplatform that uses lxml.etree. https://fedorahosted.org/freeipa/ticket/6469 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: workaround bug 1005235 related to Python paths in auto-generated RequiresPetr Spacek2016-11-161-0/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: document what should be in %install section of SPEC filePetr Spacek2016-11-151-0/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move web UI file installation from SPEC to Makefile.amPetr Spacek2016-11-151-19/+0
| | | | | | | | This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move server directory handling from SPEC to Makefile.amPetr Spacek2016-11-151-8/+0
| | | | | | | | This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move client directory handling from SPEC to Makefile.amPetr Spacek2016-11-151-3/+0
| | | | | | | | This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* install: introduce installer class hierarchyJan Cholasta2016-11-111-1/+3
| | | | | | | | | Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: use standard Python classes to declare knob typesJan Cholasta2016-11-111-0/+2
| | | | | | | | | | | | | | | | | | | Use type(None) rather than bool to define knobs which are represented as command line flags. This allows declaring both "--option" and "--option={0,1}"-style command line options. Use enum.Enum subclasses instead of set literals to declare enumerations. Use typing.List[T] instead of (list, T) to declare lists. (Note that a minimal reimplementation of typing.List is used instead of the Python 2 backport of the typing module due to non-technical reasons.) Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP addresses. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-client-install: move client install to moduleMartin Basti2016-11-111-0/+3
| | | | | | | | | This commit only moves the code from ipa-client-install to module ipaclient/install/client.py and fixes PEP8. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Build: pass down %{release} from SPEC to configurePetr Spacek2016-11-111-1/+1
| | | | | | | | | This is required in order to bake-in precise vendor version to version.py. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-26 09:36:36 +0000