Use Custodia 0.3.1 features #517
Conversation
freeipa.spec.in
Outdated
| @@ -148,7 +148,8 @@ BuildRequires: pki-base-python2 | |||
| BuildRequires: python-pytest-multihost | |||
| BuildRequires: python-pytest-sourceorder | |||
| BuildRequires: python-jwcrypto | |||
| BuildRequires: python-custodia | |||
| # 0.3: sd-notify and ipaserver.secrets.service | |||
There was a problem hiding this comment.
Nitpick: Please specify what new API is provided (custodia.server) rather than what requires it (ipaserver.secrets.service). Also I don't think sd-notify is a build dependency.
There was a problem hiding this comment.
Counter nit pick: These are the new features provided by Custodia 0.3: fully working sd-notify support and the ability to provide ipaserver.secerts.service with custom argsparser.
There was a problem hiding this comment.
That's not how any other BuildRequires are commented. My point is, please follow the existing format instead of inventing your own thing.
|
FYI, Custodia 0.3 hasn't been released yet. I'm still doing smoke tests with FreeIPA's secrets service. So far, FreeIPA master and Custodia master work flawlessly. |
|
Custodia 0.3 is out, https://koji.fedoraproject.org/koji/taskinfo?taskID=18127414 |
tiran
force-pushed
the
ipa_custodia
branch
2 times, most recently
from
8a6b444
to
cbd232e
Compare
|
ipa-server-install failed |
|
sigh, template markers aren't picked up automatically. I fixed |
|
This PR must be merged into 4.5 ASAP. Without the fix it is not possible to define proper SELinux policies for ipa-custodia and stand-alone custodia. |
|
I assume that this is not WIP anymore then |
|
@tiran we first need a copr build on F25 to unblock Travis CI. Can you provide a copr repo and modify test runner config to add it during builddep phase? |
|
@martbab I will test it manually (when I receive f25/F26 rpms), if works then I will update master copr |
|
@MartinBasti ok there should be no problems with that (built it on F25 VM but threw it away afterwards, oh well) |
|
I had some issues with build system yesterday. For some reason F25 https://koji.fedoraproject.org/koji/taskinfo?taskID=18429524 |
|
This pr does more things then the linked ticket 5825. It needs a new ticket for backport to downstream- mainly for the SELinux separation - 5825 is not usable for it. |
MartinBasti
changed the title
|
PR is blocked because custodia 0.3 is not yet in https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-master/packages/ Please add the package fro Koji builds #517 (comment) |
|
No this PR si not blocker by this but by this. I manually tried this patch and replica installation failed. |
|
@MartinBasti How did you get Custodia into the test envs when it is not available in COPR or Fedora repos? |
|
@tiran I manually installed custodia on my VM from koji. Travis doesn't run replica install tests what is the primary use case for custodia in FreeIPA, so travis result has no weight for this PR |
|
Please custodia logs ( |
Audit file is empty |
|
custodia-0.3.0-3.fc25.noarch |
|
Replica logs^ Master logs: audit.log |
|
Full error message: Custodia issue latchset/custodia#135 |
|
0.3.1 with fix for the space in URLs is out.
|
|
F25 scratch build https://koji.fedoraproject.org/koji/taskinfo?taskID=18643521 |
|
Probably we should bump requires to custodia >= 0.3.1 |
|
Works for me, can be pushed when dependencies bumped |
* Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com>
|
Custodia 0.3.1 also fixes latchset/custodia#135 (KEM requests with whitespace in key name fail). The bug has been reported by @adelton as https://bugzilla.redhat.com/show_bug.cgi?id=1411810 . |
Use Custodia 0.3 features
default setting for IPA's config file. The new file also makes it
simpler to run IPA's custodia instance with its own SELinux context.
The patch addresses three issues:
Forward compatibility with Custodia 0.3 in Fedora rawhide
Use sd-notify
Prepare for separate SELinux context
Signed-off-by: Christian Heimes cheimes@redhat.com