Skip DogtagCertsConfigCheck for PKI versions 11.5.0

Certificates are no longer stored in CS.cfg in 11.5.0+

Resolves: RHEL-21367

0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch

@@ -0,0 +1,46 @@
+From e556edc0b1cb607caa50f760d5059877f35fbcdc Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcritten@redhat.com>
+Date: Thu, 11 Jan 2024 14:40:02 -0500
+Subject: [PATCH] Skip DogtagCertsConfigCheck for PKI versions >= 11.5.0
+
+In 11.5.0 the PKI project stopped storing the certificate
+blobs in CS.cfg. If we continue to check it we will report a
+false positive so skip it in that case.
+
+Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/317
+
+Signed-off-by: Rob Crittenden <rcritten@redhat.com>
+---
+ src/ipahealthcheck/dogtag/ca.py | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/ipahealthcheck/dogtag/ca.py b/src/ipahealthcheck/dogtag/ca.py
+index 4afa5d7..ddf5ece 100644
+--- a/src/ipahealthcheck/dogtag/ca.py
++++ b/src/ipahealthcheck/dogtag/ca.py
+@@ -16,6 +16,8 @@ from ipaserver.install import krainstance
+ from ipapython.directivesetter import get_directive
+ from cryptography.hazmat.primitives.serialization import Encoding
+ 
++import pki.util
++
+ logger = logging.getLogger()
+ 
+ 
+@@ -30,6 +32,13 @@ class DogtagCertsConfigCheck(DogtagPlugin):
+             logger.debug("No CA configured, skipping dogtag config check")
+             return
+ 
++        pki_version = pki.util.Version(pki.specification_version())
++        if pki_version >= pki.util.Version("11.5.0"):
++            logger.debug(
++                "PKI 11.5.0 no longer stores certificats in CS.cfg"
++            )
++            return
++
+         kra = krainstance.KRAInstance(api.env.realm)
+ 
+         blobs = {'auditSigningCert cert-pki-ca': 'ca.audit_signing.cert',
+-- 
+2.42.0
+

0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch

@@ -0,0 +1,59 @@
+From cafe01a23a36c408c8c60357ad2651688dc63599 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcritten@redhat.com>
+Date: Fri, 12 Jan 2024 10:17:18 -0500
+Subject: [PATCH] test: Handle PKI >= 11.5.0 not storing certs in CS.cfg
+
+Update the test to expect 0 results if the PKI version is
+>= 11.5.0.
+
+Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/317
+
+Signed-off-by: Rob Crittenden <rcritten@redhat.com>
+---
+ tests/test_dogtag_ca.py | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tests/test_dogtag_ca.py b/tests/test_dogtag_ca.py
+index 0820aba..1f61dea 100644
+--- a/tests/test_dogtag_ca.py
++++ b/tests/test_dogtag_ca.py
+@@ -2,12 +2,16 @@
+ # Copyright (C) 2019 FreeIPA Contributors see COPYING for license
+ #
+ 
++import pki.util
+ from util import capture_results, CAInstance, KRAInstance
+ from base import BaseTest
+ from ipahealthcheck.core import config, constants
+ from ipahealthcheck.dogtag.plugin import registry
+ from ipahealthcheck.dogtag.ca import DogtagCertsConfigCheck
+ from unittest.mock import Mock, patch
++import pytest
++
++pki_version = pki.util.Version(pki.specification_version())
+ 
+ 
+ class mock_Cert:
+@@ -43,6 +47,9 @@ class TestCACerts(BaseTest):
+         Mock(return_value=KRAInstance()),
+     }
+ 
++    @pytest.mark.skipif(
++        pki_version >= pki.util.Version("11.5.0"),
++        reason='Does not apply to PKI 11.5.0+')
+     @patch('ipahealthcheck.dogtag.ca.get_directive')
+     @patch('ipaserver.install.certs.CertDB')
+     def test_ca_certs_ok(self, mock_certdb, mock_directive):
+@@ -71,6 +78,9 @@ class TestCACerts(BaseTest):
+             assert result.source == 'ipahealthcheck.dogtag.ca'
+             assert result.check == 'DogtagCertsConfigCheck'
+ 
++    @pytest.mark.skipif(
++        pki_version >= pki.util.Version("11.5.0"),
++        reason='Does not apply to PKI 11.5.0+')
+     @patch('ipahealthcheck.dogtag.ca.get_directive')
+     @patch('ipaserver.install.certs.CertDB')
+     def test_cert_missing_from_file(self, mock_certdb, mock_directive):
+-- 
+2.42.0
+

freeipa-healthcheck.spec

@@ -17,7 +17,7 @@
 
 Name:           %{prefix}-healthcheck
 Version:        0.16
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Health check tool for %{productname}
 BuildArch:      noarch
 License:        GPLv3
@@ -28,6 +28,8 @@ Source1:        ipahealthcheck.conf
 Patch0001:      0001-Remove-ipaclustercheck.patch
 Patch0002:      0002-Don-t-fail-if-a-service-name-cannot-be-looked-up-in-.patch
 Patch0003:      0003-Temporarily-disable-the-ipa-ods-exporter-service-sta.patch
+Patch0004:      0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch
+Patch0005:      0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch
 
 Requires:       %{name}-core = %{version}-%{release}
 Requires:       %{prefix}-server
@@ -157,6 +159,9 @@ PYTHONPATH=src PATH=$PATH:$RPM_BUILD_ROOT/usr/bin pytest-3 tests/test_*
 
 
 %changelog
+* Fri Jan 12 2024 Rob Crittenden <rcritten@redhat.com> - 0.16-3
+- Skip DogtagCertsConfigCheck for PKI versions 11.5.0 (RHEL-21367)
+
 * Tue Nov 14 2023 Rob Crittenden <rcritten@redhat.com> - 0.16-2
 - Don't fail if a service name cannot be looked up in LDAP
 - Disable the ipa-ods-exporter service check