websms/freeipa
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Imported Upstream version 4.3.1

Browse Source
This commit is contained in:
Mario Fetka
2021-08-10 02:37:58 +02:00
parent a791de49a2
commit 2f177da8f2
2056 changed files with 421730 additions and 1668138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
install/certmonger/Makefile.am
View File

@@ -1,18 +1,15 @@
NULL =
appdir = $(libexecdir)/certmonger/
nodist_app_SCRIPTS = \
app_SCRIPTS = \
dogtag-ipa-ca-renew-agent-submit \
ipa-server-guard \
$(NULL)
dist_noinst_DATA = \
dogtag-ipa-ca-renew-agent-submit.in \
ipa-server-guard.in \
EXTRA_DIST = \
$(app_SCRIPTS) \
$(NULL)
PYTHON_SHEBANG = $(nodist_app_SCRIPTS)
CLEANFILES = $(PYTHON_SHEBANG)
include $(top_srcdir)/Makefile.pythonscripts.am
MAINTAINERCLEANFILES = \
*~ \
Makefile.in

263
install/certmonger/Makefile.in
View File

@@ -1,7 +1,7 @@
# Makefile.in generated by automake 1.16.1 from Makefile.am.
# Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2018 Free Software Foundation, Inc.
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,6 @@
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
@@ -87,23 +86,13 @@ POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = install/certmonger
subdir = certmonger
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(dist_noinst_DATA) \
$(am__DIST_COMMON)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES =
@@ -136,7 +125,7 @@ am__uninstall_files_from_dir = { \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
am__installdirs = "$(DESTDIR)$(appdir)"
SCRIPTS = $(nodist_app_SCRIPTS)
SCRIPTS = $(app_SCRIPTS)
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
@@ -156,118 +145,40 @@ am__can_run_installinfo = \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
DATA = $(dist_noinst_DATA)
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
am__DIST_COMMON = $(srcdir)/Makefile.in \
$(top_srcdir)/Makefile.pythonscripts.am
am__DIST_COMMON = $(srcdir)/Makefile.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
API_VERSION = @API_VERSION@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
CMOCKA_LIBS = @CMOCKA_LIBS@
CONFIG_STATUS = @CONFIG_STATUS@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
CRYPTO_LIBS = @CRYPTO_LIBS@
CYGPATH_W = @CYGPATH_W@
DATA_VERSION = @DATA_VERSION@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
DIRSRV_LIBS = @DIRSRV_LIBS@
DLLTOOL = @DLLTOOL@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
GIT_BRANCH = @GIT_BRANCH@
GIT_VERSION = @GIT_VERSION@
GMSGFMT = @GMSGFMT@
GMSGFMT_015 = @GMSGFMT_015@
GREP = @GREP@
INI_CFLAGS = @INI_CFLAGS@
INI_LIBS = @INI_LIBS@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
INTLLIBS = @INTLLIBS@
INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
IPAPLATFORM = @IPAPLATFORM@
IPA_DATA_DIR = @IPA_DATA_DIR@
IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
JSLINT = @JSLINT@
KRAD_LIBS = @KRAD_LIBS@
KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
KRB5_CFLAGS = @KRB5_CFLAGS@
KRB5_LIBS = @KRB5_LIBS@
LD = @LD@
LDAP_CFLAGS = @LDAP_CFLAGS@
LDAP_LIBS = @LDAP_LIBS@
LDFLAGS = @LDFLAGS@
LIBICONV = @LIBICONV@
LIBINTL = @LIBINTL@
LIBINTL_LIBS = @LIBINTL_LIBS@
LIBOBJS = @LIBOBJS@
LIBPDB_NAME = @LIBPDB_NAME@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
LIBVERTO_LIBS = @LIBVERTO_LIBS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBICONV = @LTLIBICONV@
LTLIBINTL = @LTLIBINTL@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAINT = @MAINT@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MK_ASSIGN = @MK_ASSIGN@
MK_ELSE = @MK_ELSE@
MK_ENDIF = @MK_ENDIF@
MK_IFEQ = @MK_IFEQ@
MSGATTRIB = @MSGATTRIB@
MSGCMP = @MSGCMP@
MSGFMT = @MSGFMT@
MSGFMT_015 = @MSGFMT_015@
MSGINIT = @MSGINIT@
MSGMERGE = @MSGMERGE@
NAMED_GROUP = @NAMED_GROUP@
NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
NDRNBT_LIBS = @NDRNBT_LIBS@
NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
NDRPAC_LIBS = @NDRPAC_LIBS@
NDR_CFLAGS = @NDR_CFLAGS@
NDR_LIBS = @NDR_LIBS@
NM = @NM@
NMEDIT = @NMEDIT@
NSPR_CFLAGS = @NSPR_CFLAGS@
NSPR_LIBS = @NSPR_LIBS@
NSS_CFLAGS = @NSS_CFLAGS@
NSS_LIBS = @NSS_LIBS@
NUM_VERSION = @NUM_VERSION@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
ODS_USER = @ODS_USER@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
@@ -276,89 +187,33 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PKG_CONFIG = @PKG_CONFIG@
PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
PLATFORM_PYTHON = @PLATFORM_PYTHON@
POPT_CFLAGS = @POPT_CFLAGS@
POPT_LIBS = @POPT_LIBS@
POSUB = @POSUB@
PYLINT = @PYLINT@
PYTHON = @PYTHON@
PYTHON2 = @PYTHON2@
PYTHON3 = @PYTHON3@
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
PYTHON_PLATFORM = @PYTHON_PLATFORM@
PYTHON_PREFIX = @PYTHON_PREFIX@
PYTHON_VERSION = @PYTHON_VERSION@
RANLIB = @RANLIB@
SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
SASL_CFLAGS = @SASL_CFLAGS@
SASL_LIBS = @SASL_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
STRIP = @STRIP@
TALLOC_CFLAGS = @TALLOC_CFLAGS@
TALLOC_LIBS = @TALLOC_LIBS@
TEVENT_CFLAGS = @TEVENT_CFLAGS@
TEVENT_LIBS = @TEVENT_LIBS@
UNISTRING_LIBS = @UNISTRING_LIBS@
UNLINK = @UNLINK@
USE_NLS = @USE_NLS@
UUID_CFLAGS = @UUID_CFLAGS@
UUID_LIBS = @UUID_LIBS@
VENDOR_SUFFIX = @VENDOR_SUFFIX@
TX = @TX@
VERSION = @VERSION@
XGETTEXT = @XGETTEXT@
XGETTEXT_015 = @XGETTEXT_015@
XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
XMLRPC_LIBS = @XMLRPC_LIBS@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
i18ntests = @i18ntests@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
krb5rundir = @krb5rundir@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
@@ -367,42 +222,36 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkgpyexecdir = @pkgpyexecdir@
pkgpythondir = @pkgpythondir@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
pyexecdir = @pyexecdir@
pythondir = @pythondir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
sysconfenvdir = @sysconfenvdir@
systemdsystemunitdir = @systemdsystemunitdir@
systemdtmpfilesdir = @systemdtmpfilesdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
NULL =
appdir = $(libexecdir)/certmonger/
nodist_app_SCRIPTS = \
app_SCRIPTS = \
dogtag-ipa-ca-renew-agent-submit \
ipa-server-guard \
$(NULL)
dist_noinst_DATA = \
dogtag-ipa-ca-renew-agent-submit.in \
ipa-server-guard.in \
EXTRA_DIST = \
$(app_SCRIPTS) \
$(NULL)
PYTHON_SHEBANG = $(nodist_app_SCRIPTS)
CLEANFILES = $(PYTHON_SHEBANG)
MAINTAINERCLEANFILES = \
*~ \
Makefile.in
all: all-am
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(top_srcdir)/Makefile.pythonscripts.am $(am__configure_deps)
$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
@@ -411,30 +260,29 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(top_srcdir)/Makefile.pythonscrip
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/certmonger/Makefile'; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign certmonger/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign install/certmonger/Makefile
$(AUTOMAKE) --foreign certmonger/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_srcdir)/Makefile.pythonscripts.am $(am__empty):
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
install-nodist_appSCRIPTS: $(nodist_app_SCRIPTS)
install-appSCRIPTS: $(app_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(nodist_app_SCRIPTS)'; test -n "$(appdir)" || list=; \
@list='$(app_SCRIPTS)'; test -n "$(appdir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
$(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
@@ -461,18 +309,12 @@ install-nodist_appSCRIPTS: $(nodist_app_SCRIPTS)
} \
; done
uninstall-nodist_appSCRIPTS:
uninstall-appSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(nodist_app_SCRIPTS)'; test -n "$(appdir)" || exit 0; \
@list='$(app_SCRIPTS)'; test -n "$(appdir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
tags TAGS:
ctags CTAGS:
@@ -480,10 +322,7 @@ ctags CTAGS:
cscope cscopelist:
distdir: $(BUILT_SOURCES)
$(MAKE) $(AM_MAKEFLAGS) distdir-am
distdir-am: $(DISTFILES)
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
@@ -515,7 +354,7 @@ distdir-am: $(DISTFILES)
done
check-am: all-am
check: check-am
all-am: Makefile $(SCRIPTS) $(DATA)
all-am: Makefile $(SCRIPTS)
installdirs:
for dir in "$(DESTDIR)$(appdir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
@@ -542,7 +381,6 @@ install-strip:
mostlyclean-generic:
clean-generic:
-test -z "$(CLEANFILES)" || rm -f $(CLEANFILES)
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
@@ -551,9 +389,10 @@ distclean-generic:
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-am
clean-am: clean-generic clean-libtool mostlyclean-am
clean-am: clean-generic mostlyclean-am
distclean: distclean-am
-rm -f Makefile
@@ -571,7 +410,7 @@ info: info-am
info-am:
install-data-am: install-nodist_appSCRIPTS
install-data-am: install-appSCRIPTS
install-dvi: install-dvi-am
@@ -605,7 +444,7 @@ maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
mostlyclean-am: mostlyclean-generic
pdf: pdf-am
@@ -615,31 +454,25 @@ ps: ps-am
ps-am:
uninstall-am: uninstall-nodist_appSCRIPTS
uninstall-am: uninstall-appSCRIPTS
.MAKE: install-am install-strip
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
cscopelist-am ctags-am distclean distclean-generic \
distclean-libtool distdir dvi dvi-am html html-am info info-am \
install install-am install-data install-data-am install-dvi \
install-dvi-am install-exec install-exec-am install-html \
install-html-am install-info install-info-am install-man \
install-nodist_appSCRIPTS install-pdf install-pdf-am \
install-ps install-ps-am install-strip installcheck \
installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic \
mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
uninstall-am uninstall-nodist_appSCRIPTS
.PHONY: all all-am check check-am clean clean-generic cscopelist-am \
ctags-am distclean distclean-generic distdir dvi dvi-am html \
html-am info info-am install install-am install-appSCRIPTS \
install-data install-data-am install-dvi install-dvi-am \
install-exec install-exec-am install-html install-html-am \
install-info install-info-am install-man install-pdf \
install-pdf-am install-ps install-ps-am install-strip \
installcheck installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic pdf \
pdf-am ps ps-am tags-am uninstall uninstall-am \
uninstall-appSCRIPTS
.PRECIOUS: Makefile
# special handling of Python scripts with auto-generated shebang line
$(PYTHON_SHEBANG):%: %.in Makefile
$(AM_V_GEN)sed -e 's|@PYTHONSHEBANG[@]|#!$(PYTHON) -E|g' $< > $@
$(AM_V_GEN)chmod +x $@
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:

263
install/certmonger/dogtag-ipa-ca-renew-agent-submit.in → install/certmonger/dogtag-ipa-ca-renew-agent-submit Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2 -E
#
# Authors:
# Jan Cholasta <jcholast@redhat.com>
@@ -31,21 +31,18 @@ import syslog
import traceback
import tempfile
import shutil
import base64
import contextlib
import json
from cryptography import x509 as crypto_x509
from cryptography.hazmat.backends import default_backend
import six
from ipalib.install.kinit import kinit_keytab
from ipapython import ipautil
from ipapython.dn import DN
from ipalib import api, errors, x509
from ipalib import api, errors, pkcs10, x509
from ipaplatform.paths import paths
from ipaserver.plugins.ldap2 import ldap2
from ipaserver.install import ca, cainstance, dsinstance, certs
from ipaserver.install import cainstance, certs
# This is a certmonger CA helper script for IPA CA subsystem cert renewal. See
# https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/submit.txt for more
@@ -65,51 +62,6 @@ if six.PY3:
unicode = str
IPA_CA_NICKNAME = 'caSigningCert cert-pki-ca'
def get_nickname():
# we need to get the subject from a CSR in case we are requesting
# an OpenSSL certificate for which we have to reverse the order of its DN
# components thus changing the CERTMONGER_REQ_SUBJECT
# https://pagure.io/certmonger/issue/62
csr = os.environ.get('CERTMONGER_CSR').encode('ascii')
csr_obj = crypto_x509.load_pem_x509_csr(csr, default_backend())
subject = csr_obj.subject
if not subject:
return None
subject_base = dsinstance.DsInstance().find_subject_base()
if not subject_base:
return None
ca_subject_dn = ca.lookup_ca_subject(api, subject_base)
nickname_by_subject_dn = {
DN(ca_subject_dn): 'caSigningCert cert-pki-ca',
DN('CN=CA Audit', subject_base): 'auditSigningCert cert-pki-ca',
DN('CN=OCSP Subsystem', subject_base): 'ocspSigningCert cert-pki-ca',
DN('CN=CA Subsystem', subject_base): 'subsystemCert cert-pki-ca',
DN('CN=KRA Audit', subject_base): 'auditSigningCert cert-pki-kra',
DN('CN=KRA Transport Certificate', subject_base):
'transportCert cert-pki-kra',
DN('CN=KRA Storage Certificate', subject_base):
'storageCert cert-pki-kra',
DN('CN=IPA RA', subject_base): 'ipaCert',
}
return nickname_by_subject_dn.get(DN(subject))
def is_replicated():
return bool(get_nickname())
def is_renewal_master():
ca = cainstance.CAInstance(host_name=api.env.host)
return ca.is_renewal_master()
@contextlib.contextmanager
def ldap_connect():
conn = None
@@ -151,8 +103,7 @@ def call_handler(_handler, *args, **kwargs):
if profile is not None:
if not isinstance(profile, unicode):
raise TypeError
profile = (profile.encode('raw_unicode_escape')
.decode('ascii'))
profile = profile.encode('raw_unicode_escape')
except (TypeError, UnicodeEncodeError):
return (UNCONFIGURED,
"Invalid 'profile' in cookie: %r" % profile)
@@ -169,7 +120,7 @@ def call_handler(_handler, *args, **kwargs):
try:
if not isinstance(cookie, unicode):
raise TypeError
cookie = cookie.encode('raw_unicode_escape').decode('ascii')
cookie = cookie.encode('raw_unicode_escape')
except (TypeError, UnicodeEncodeError):
return (UNCONFIGURED,
"Invalid 'cookie' in cookie: %r" % cookie)
@@ -180,12 +131,11 @@ def call_handler(_handler, *args, **kwargs):
result = _handler(*args, **kwargs)
if result[0] in (WAIT, WAIT_WITH_DELAY):
context['cookie'] = (result[-1].encode('ascii')
.decode('raw_unicode_escape'))
context['cookie'] = result[-1].decode('raw_unicode_escape')
profile = os.environ.get('CERTMONGER_CA_PROFILE')
if profile is not None:
profile = profile.encode('ascii').decode('raw_unicode_escape')
profile = profile.decode('raw_unicode_escape')
context['profile'] = profile
cookie = json.dumps(context)
@@ -195,31 +145,19 @@ def call_handler(_handler, *args, **kwargs):
return result
def request_cert(reuse_existing, **kwargs):
def request_cert():
"""
Request certificate from IPA CA.
"""
if reuse_existing:
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if cert:
return (ISSUED, cert)
else:
return (REJECTED, "New certificate requests not supported")
syslog.syslog(syslog.LOG_NOTICE,
"Forwarding request to dogtag-ipa-renew-agent")
args = ([paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT,
"--cafile", paths.IPA_CA_CRT,
"--certfile", paths.RA_AGENT_PEM,
"--keyfile", paths.RA_AGENT_KEY] +
sys.argv[1:] +
['--submit-option', "requestor_name=IPA"])
path = paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT
args = [path] + sys.argv[1:]
if os.environ.get('CERTMONGER_CA_PROFILE') == 'caCACert':
args += ['-N', '-O', 'bypassCAnotafter=true']
result = ipautil.run(args, raiseonerr=False, env=os.environ,
capture_output=True)
capture_output=True)
if six.PY2:
sys.stderr.write(result.raw_error_output)
else:
@@ -236,13 +174,12 @@ def request_cert(reuse_existing, **kwargs):
rc = result.returncode
if rc == WAIT_WITH_DELAY:
delay, _sep, cookie = stdout.partition('\n')
delay, sep, cookie = stdout.partition('\n')
return (rc, delay, cookie)
else:
return (rc, stdout)
def store_cert(**kwargs):
def store_cert():
"""
Store certificate in LDAP.
"""
@@ -261,14 +198,19 @@ def store_cert(**kwargs):
else:
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
nickname = get_nickname()
csr = os.environ.get('CERTMONGER_CSR')
if not csr:
return (UNCONFIGURED, "Certificate request not provided")
nickname = pkcs10.get_friendlyname(csr)
if not nickname:
return (REJECTED, "Nickname could not be determined")
return (REJECTED, "No friendly name in the certificate request")
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
cert = x509.load_pem_x509_certificate(cert.encode('ascii'))
dercert = x509.normalize_certificate(cert)
dn = DN(('cn', nickname), ('cn', 'ca_renewal'),
('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
@@ -276,14 +218,14 @@ def store_cert(**kwargs):
with ldap_connect() as conn:
try:
entry = conn.get_entry(dn, ['usercertificate'])
entry['usercertificate'] = [cert]
entry['usercertificate'] = [dercert]
conn.update_entry(entry)
except errors.NotFound:
entry = conn.make_entry(
dn,
objectclass=['top', 'pkiuser', 'nscontainer'],
cn=[nickname],
usercertificate=[cert])
usercertificate=[dercert])
conn.add_entry(entry)
except errors.EmptyModlist:
pass
@@ -298,12 +240,11 @@ def store_cert(**kwargs):
syslog.syslog(
syslog.LOG_ERR,
"Giving up. To retry storing the certificate, resubmit the "
"request with CA \"dogtag-ipa-ca-renew-agent-reuse\"")
"request with profile \"ipaStorage\"")
return (ISSUED, cert.public_bytes(x509.Encoding.PEM).decode('ascii'))
return (ISSUED, cert)
def request_and_store_cert(**kwargs):
def request_and_store_cert():
"""
Request certificate from IPA CA and store it in LDAP.
"""
@@ -316,7 +257,7 @@ def request_and_store_cert(**kwargs):
if not cookie:
return (UNCONFIGURED, "Cookie not provided")
state, _sep, cookie = cookie.partition(':')
state, sep, cookie = cookie.partition(':')
if state not in ('request', 'store'):
return (UNCONFIGURED,
"Invalid cookie: %r" % os.environ['CERTMONGER_CA_COOKIE'])
@@ -329,7 +270,7 @@ def request_and_store_cert(**kwargs):
else:
os.environ['CERTMONGER_CA_COOKIE'] = cookie
result = call_handler(request_cert, **kwargs)
result = call_handler(request_cert)
if result[0] == WAIT:
return (result[0], 'request:%s' % result[1])
elif result[0] == WAIT_WITH_DELAY:
@@ -340,7 +281,7 @@ def request_and_store_cert(**kwargs):
cert = result[1]
cookie = None
else:
cert, _sep, cookie = cookie.partition(':')
cert, sep, cookie = cookie.partition(':')
if cookie is None:
os.environ['CERTMONGER_OPERATION'] = 'SUBMIT'
@@ -348,7 +289,7 @@ def request_and_store_cert(**kwargs):
os.environ['CERTMONGER_CA_COOKIE'] = cookie
os.environ['CERTMONGER_CERTIFICATE'] = cert
result = call_handler(store_cert, **kwargs)
result = call_handler(store_cert)
if result[0] == WAIT:
return (result[0], 'store:%s:%s' % (cert, result[1]))
elif result[0] == WAIT_WITH_DELAY:
@@ -356,20 +297,22 @@ def request_and_store_cert(**kwargs):
else:
return result
def retrieve_or_reuse_cert(**kwargs):
def retrieve_or_reuse_cert():
"""
Retrieve certificate from LDAP. If the certificate is not available, reuse
the old certificate.
"""
nickname = get_nickname()
csr = os.environ.get('CERTMONGER_CSR')
if not csr:
return (UNCONFIGURED, "Certificate request not provided")
nickname = pkcs10.get_friendlyname(csr)
if not nickname:
return (REJECTED, "Nickname could not be determined")
return (REJECTED, "No friendly name in the certificate request")
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
cert = x509.load_pem_x509_certificate(cert.encode('ascii'))
with ldap_connect() as conn:
try:
@@ -381,26 +324,25 @@ def retrieve_or_reuse_cert(**kwargs):
pass
else:
cert = entry.single_value['usercertificate']
cert = base64.b64encode(cert)
cert = x509.make_pem(cert)
return (ISSUED, cert.public_bytes(x509.Encoding.PEM).decode('ascii'))
return (ISSUED, cert)
def retrieve_cert_continuous(reuse_existing, **kwargs):
def retrieve_cert_continuous():
"""
Retrieve new certificate from LDAP. Repeat every eight hours until the
certificate is available.
"""
old_cert = os.environ.get('CERTMONGER_CERTIFICATE')
if old_cert:
old_cert = x509.load_pem_x509_certificate(old_cert.encode('ascii'))
old_cert = x509.normalize_certificate(old_cert)
result = call_handler(retrieve_or_reuse_cert,
reuse_existing=reuse_existing,
**kwargs)
if result[0] != ISSUED or reuse_existing:
result = call_handler(retrieve_or_reuse_cert)
if result[0] != ISSUED:
return result
new_cert = x509.load_pem_x509_certificate(result[1].encode('ascii'))
new_cert = x509.normalize_certificate(result[1])
if new_cert == old_cert:
syslog.syslog(syslog.LOG_INFO, "Updated certificate not available")
# No cert available yet, tell certmonger to wait another 8 hours
@@ -408,51 +350,65 @@ def retrieve_cert_continuous(reuse_existing, **kwargs):
return result
def retrieve_cert(**kwargs):
def retrieve_cert():
"""
Retrieve new certificate from LDAP.
"""
result = call_handler(retrieve_cert_continuous, **kwargs)
result = call_handler(retrieve_cert_continuous)
if result[0] == WAIT_WITH_DELAY:
return (REJECTED, "Updated certificate not available")
return result
def export_csr():
"""
This does not actually renew the cert, it just writes the CSR provided
by certmonger to /var/lib/ipa/ca.csr and returns the existing cert.
"""
operation = os.environ.get('CERTMONGER_OPERATION')
if operation != 'SUBMIT':
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
def renew_ca_cert(reuse_existing, **kwargs):
"""
This is used for automatic CA certificate renewal.
"""
csr = os.environ.get('CERTMONGER_CSR').encode('ascii')
csr = os.environ.get('CERTMONGER_CSR')
if not csr:
return (UNCONFIGURED, "Certificate request not provided")
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
cert = x509.load_pem_x509_certificate(cert.encode('ascii'))
is_self_signed = cert.is_self_signed()
csr_file = paths.IPA_CA_CSR
try:
with open(csr_file, 'wb') as f:
f.write(csr)
except Exception as e:
return (UNREACHABLE, "Failed to write %s: %s" % (csr_file, e))
return (ISSUED, cert)
def renew_ca_cert():
"""
This is used for automatic CA certificate renewal.
"""
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
is_self_signed = x509.is_self_signed(cert)
operation = os.environ.get('CERTMONGER_OPERATION')
if operation == 'SUBMIT':
state = 'retrieve'
if not reuse_existing and is_renewal_master():
state = 'request'
csr_file = paths.IPA_CA_CSR
try:
with open(csr_file, 'wb') as f:
f.write(csr)
except Exception as e:
return (UNREACHABLE, "Failed to write %s: %s" % (csr_file, e))
if is_self_signed:
ca = cainstance.CAInstance(host_name=api.env.host, ldapi=False)
if ca.is_renewal_master():
state = 'request'
elif operation == 'POLL':
cookie = os.environ.get('CERTMONGER_CA_COOKIE')
if not cookie:
return (UNCONFIGURED, "Cookie not provided")
state, _sep, cookie = cookie.partition(':')
state, sep, cookie = cookie.partition(':')
if state not in ('retrieve', 'request'):
return (UNCONFIGURED,
"Invalid cookie: %r" % os.environ['CERTMONGER_CA_COOKIE'])
@@ -462,24 +418,16 @@ def renew_ca_cert(reuse_existing, **kwargs):
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
if state == 'retrieve':
result = call_handler(retrieve_cert,
reuse_existing=reuse_existing,
**kwargs)
if result[0] == REJECTED and not is_self_signed and not reuse_existing:
result = call_handler(retrieve_cert)
if result[0] == REJECTED and not is_self_signed:
syslog.syslog(syslog.LOG_ALERT,
"Certificate with subject '%s' is about to expire, "
"use ipa-cacert-manage to renew it"
% (os.environ.get("CERTMONGER_REQ_SUBJECT"),))
"IPA CA certificate is about to expire, "
"use ipa-cacert-manage to renew it")
elif state == 'request':
profile = os.environ.get('CERTMONGER_CA_PROFILE')
profile = os.environ['CERTMONGER_CA_PROFILE']
os.environ['CERTMONGER_CA_PROFILE'] = 'caCACert'
result = call_handler(request_and_store_cert,
reuse_existing=reuse_existing,
**kwargs)
if profile is not None:
os.environ['CERTMONGER_CA_PROFILE'] = profile
else:
del os.environ['CERTMONGER_CA_PROFILE']
result = call_handler(request_and_store_cert)
os.environ['CERTMONGER_CA_PROFILE'] = profile
if result[0] == WAIT:
return (result[0], '%s:%s' % (state, result[1]))
@@ -489,17 +437,15 @@ def renew_ca_cert(reuse_existing, **kwargs):
return result
def main():
kwargs = {
'reuse_existing': False,
handlers = {
'ipaStorage': store_cert,
'ipaRetrievalOrReuse': retrieve_or_reuse_cert,
'ipaRetrieval': retrieve_cert,
'ipaCSRExport': export_csr,
'ipaCACertRenewal': renew_ca_cert,
}
try:
sys.argv.remove('--reuse-existing')
except ValueError:
pass
else:
kwargs['reuse_existing'] = True
api.bootstrap(in_server=True, context='renew', confdir=paths.ETC_IPA)
api.bootstrap(context='renew')
api.finalize()
operation = os.environ.get('CERTMONGER_OPERATION')
@@ -512,31 +458,26 @@ def main():
principal = str('host/%s@%s' % (api.env.host, api.env.realm))
ccache_filename = os.path.join(tmpdir, 'ccache')
os.environ['KRB5CCNAME'] = ccache_filename
kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_filename)
ipautil.kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_filename)
api.Backend.ldap2.connect()
if get_nickname() == IPA_CA_NICKNAME:
handler = renew_ca_cert
elif is_replicated():
if is_renewal_master():
profile = os.environ.get('CERTMONGER_CA_PROFILE')
if profile:
handler = handlers.get(profile, request_and_store_cert)
else:
ca = cainstance.CAInstance(host_name=api.env.host, ldapi=False)
if ca.is_renewal_master():
handler = request_and_store_cert
else:
handler = retrieve_cert_continuous
else:
handler = request_cert
res = call_handler(handler, **kwargs)
res = call_handler(handler)
for item in res[1:]:
print(item)
return res[0]
finally:
if api.Backend.ldap2.isconnected():
api.Backend.ldap2.disconnect()
certs.renewal_lock.release()
shutil.rmtree(tmpdir)
try:
sys.exit(main())
except Exception as e:

2
install/certmonger/ipa-server-guard.in → install/certmonger/ipa-server-guard Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2 -E
#
# Authors:
# Jan Cholasta <jcholast@redhat.com>