From 23157c3804955b1c9fe13e0213eb7c802ede296b Mon Sep 17 00:00:00 2001
From: Martin Kosek <mkosek@redhat.com>
Date: Mon, 6 Aug 2012 16:54:59 +0200
Subject: [PATCH] Update to current upstream state of 3.0.0 beta 2 development

---
 freeipa-2.1.4-inifiles-support.patch          | 139 ------------
 freeipa-2.1.4-python-ldap-2.4.6-support.patch |  26 ---
 freeipa-2.1.4-upgrade-systemd.patch           | 214 ------------------
 freeipa-2.1.90-shellescape.patch              |  33 ---
 freeipa-2.9.90-samba4-beta4.patch             |  33 ---
 freeipa.spec                                  | 131 ++++++++++-
 ui-bg_flat_8_225314_40x100.png                | Bin 0 -> 214 bytes
 ui-bg_glass_40_5e5e5e_1x400.png               | Bin 0 -> 115 bytes
 ui-icons_ededed_256x240.png                   | Bin 0 -> 4369 bytes
 ui-icons_ffcf29_256x240.png                   | Bin 0 -> 5355 bytes
 10 files changed, 125 insertions(+), 451 deletions(-)
 delete mode 100644 freeipa-2.1.4-inifiles-support.patch
 delete mode 100644 freeipa-2.1.4-python-ldap-2.4.6-support.patch
 delete mode 100644 freeipa-2.1.4-upgrade-systemd.patch
 delete mode 100644 freeipa-2.1.90-shellescape.patch
 delete mode 100644 freeipa-2.9.90-samba4-beta4.patch
 create mode 100644 ui-bg_flat_8_225314_40x100.png
 create mode 100644 ui-bg_glass_40_5e5e5e_1x400.png
 create mode 100644 ui-icons_ededed_256x240.png
 create mode 100644 ui-icons_ffcf29_256x240.png

diff --git a/freeipa-2.1.4-inifiles-support.patch b/freeipa-2.1.4-inifiles-support.patch
deleted file mode 100644
index c4f4154..0000000
--- a/freeipa-2.1.4-inifiles-support.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From 16d3d30130215d74295e89ba5a51522eed45e180 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Wed, 1 Feb 2012 14:20:53 +0200
-Subject: [PATCH 1/3] Add management of inifiles to allow manipulation of
- systemd units
-
-inifile_replace_variables() works similar to config_replace_variables() but
-allows to apply changes to specific section of an inifile. Inifiles are
-commonly used by freedesktop.org software and particularly used by systemd.
-
-When modifying inifile, all changes will be applied to specific section.
-
-Also fixes corner case in config_replace_variables() which would dublicate
-variables when adding them.
----
- ipapython/ipautil.py |  100 +++++++++++++++++++++++++++++++++++++++++++++++++-
- 1 files changed, 99 insertions(+), 1 deletions(-)
-
-diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
-index 718f209b32649df23177dcab7d5105d01c0cd7bc..e141e00171cb86bec58a6be0b3e7d1f51a24faf1 100644
---- a/ipapython/ipautil.py
-+++ b/ipapython/ipautil.py
-@@ -1245,7 +1245,7 @@ $)''', re.VERBOSE)
-         new_vars = replacevars.copy()
-         new_vars.update(appendvars)
-         newvars_view = set(new_vars.keys()) - set(old_values.keys())
--        append_view = (set(appendvars.keys()) - set(replacevars.keys())) - set(old_values.keys())
-+        append_view = (set(appendvars.keys()) - newvars_view)
-         for item in newvars_view:
-             new_config.write("%s=%s\n" % (item,new_vars[item]))
-         for item in append_view:
-@@ -1262,6 +1262,104 @@ $)''', re.VERBOSE)
- 
-     return old_values
- 
-+def inifile_replace_variables(filepath, section, replacevars=dict(), appendvars=dict()):
-+    """
-+    Take a section-structured key=value based configuration file, and write new version
-+    with certain values replaced or appended within the section
-+
-+    All (key,value) pairs from replacevars and appendvars that were not found
-+    in the configuration file, will be added there.
-+
-+    It is responsibility of a caller to ensure that replacevars and
-+    appendvars do not overlap.
-+
-+    It is responsibility of a caller to back up file.
-+
-+    returns dictionary of affected keys and their previous values
-+
-+    One have to run restore_context(filepath) afterwards or
-+    security context of the file will not be correct after modification
-+    """
-+    pattern = re.compile('''
-+(^
-+                        \[
-+        (?P<section>    .+) \]
-+                        (\s+((\#|;).*)?)?
-+$)|(^
-+                        \s*
-+        (?P<option>     [^\#;]+?)
-+                        (\s*=\s*)
-+        (?P<value>      .+?)?
-+                        (\s*((\#|;).*)?)?
-+$)''', re.VERBOSE)
-+    def add_options(config, replacevars, appendvars, oldvars):
-+        # add all options from replacevars and appendvars that were not found in the file
-+        new_vars = replacevars.copy()
-+        new_vars.update(appendvars)
-+        newvars_view = set(new_vars.keys()) - set(oldvars.keys())
-+        append_view = (set(appendvars.keys()) - newvars_view)
-+        for item in newvars_view:
-+            config.write("%s=%s\n" % (item,new_vars[item]))
-+        for item in append_view:
-+            config.write("%s=%s\n" % (item,appendvars[item]))
-+
-+    orig_stat = os.stat(filepath)
-+    old_values = dict()
-+    temp_filename = None
-+    with tempfile.NamedTemporaryFile(delete=False) as new_config:
-+        temp_filename = new_config.name
-+        with open(filepath, 'r') as f:
-+            in_section = False
-+            finished = False
-+            line_idx = 1
-+            for line in f:
-+                line_idx = line_idx + 1
-+                new_line = line
-+                m = pattern.match(line)
-+                if m:
-+                    sect, option, value = m.group('section', 'option', 'value')
-+                    if in_section and sect is not None:
-+                        # End of the searched section, add remaining options
-+                        add_options(new_config, replacevars, appendvars, old_values)
-+                        finished = True
-+                    if sect is not None:
-+                        # New section is found, check whether it is the one we are looking for
-+                        in_section = (str(sect).lower() == str(section).lower())
-+                    if option is not None and in_section:
-+                        # Great, this is an option from the section we are loking for
-+                        if replacevars and option in replacevars:
-+                            # replace value completely
-+                            new_line = u"%s=%s\n" % (option, replacevars[option])
-+                            old_values[option] = value
-+                        if appendvars and option in appendvars:
-+                            # append a new value unless it is already existing in the original one
-+                            if not value:
-+                                new_line = u"%s=%s\n" % (option, appendvars[option])
-+                            elif value.find(appendvars[option]) == -1:
-+                                new_line = u"%s=%s %s\n" % (option, value, appendvars[option])
-+                            old_values[option] = value
-+                    new_config.write(new_line)
-+            # We have finished parsing the original file.
-+            # There are two remaining cases:
-+            # 1. Section we were looking for was not found, we need to add it.
-+            if not (in_section or finished):
-+                new_config.write("[%s]\n" % (section))
-+            # 2. The section is the last one but some options were not found, add them.
-+            if in_section or not finished:
-+                add_options(new_config, replacevars, appendvars, old_values)
-+
-+        new_config.flush()
-+        # Make sure the resulting file is readable by others before installing it
-+        os.fchmod(new_config.fileno(), orig_stat.st_mode)
-+        os.fchown(new_config.fileno(), orig_stat.st_uid, orig_stat.st_gid)
-+
-+    # At this point new_config is closed but not removed due to 'delete=False' above
-+    # Now, install the temporary file as configuration and ensure old version is available as .orig
-+    # While .orig file is not used during uninstall, it is left there for administrator.
-+    install_file(temp_filename, filepath)
-+
-+    return old_values
-+
- def backup_config_and_replace_variables(fstore, filepath, replacevars=dict(), appendvars=dict()):
-     """
-     Take a key=value based configuration file, back up it, and
--- 
-1.7.8.3
-
diff --git a/freeipa-2.1.4-python-ldap-2.4.6-support.patch b/freeipa-2.1.4-python-ldap-2.4.6-support.patch
deleted file mode 100644
index 84e1cd1..0000000
--- a/freeipa-2.1.4-python-ldap-2.4.6-support.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From a639ff31c65b6fabfa916e0ea9256fad9e90d3cf Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Wed, 1 Feb 2012 14:25:46 +0200
-Subject: [PATCH 2/3] Adopt to python-ldap 2.4.6 by removing unused references
- which are not available in python-ldap anymore
-
----
- ipaserver/ipaldap.py |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/ipaserver/ipaldap.py b/ipaserver/ipaldap.py
-index 1820e690b10c820efcd3217801bde6b685bbf20b..89c031290acb5c041e0fa5e9412bbc85eb0288ec 100644
---- a/ipaserver/ipaldap.py
-+++ b/ipaserver/ipaldap.py
-@@ -31,7 +31,7 @@ import time
- import struct
- import ldap.sasl
- import ldapurl
--from ldap.controls import LDAPControl,DecodeControlTuples,EncodeControlTuples
-+from ldap.controls import LDAPControl
- from ldap.ldapobject import SimpleLDAPObject
- from ipaserver import ipautil
- from ipaserver.install import installutils
--- 
-1.7.8.3
-
diff --git a/freeipa-2.1.4-upgrade-systemd.patch b/freeipa-2.1.4-upgrade-systemd.patch
deleted file mode 100644
index 0eb004e..0000000
--- a/freeipa-2.1.4-upgrade-systemd.patch
+++ /dev/null
@@ -1,214 +0,0 @@
-From a9c0a0bc8d3fcf27bb16a92002d944c2a71f7ce7 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Wed, 1 Feb 2012 17:51:24 +0200
-Subject: [PATCH 3/3] Handle upgrade issues with systemd in Fedora 16 and
- above
-
-Since 389-ds-base-1.2.10-0.8.a7 Directory Server's systemd settings are
-configured via /etc/sysconfig/dirsrv.systemd. It means logic change in
-systemd/fedora16 platform of FreeIPA.
-
-Additionally, existing installs need to be handled during upgrade.
-
-Fixes:
-    https://fedorahosted.org/freeipa/ticket/2117
-    https://fedorahosted.org/freeipa/ticket/2300
----
- init/systemd/freeipa-systemd-upgrade |   96 ++++++++++++++++++++++++++++++++++
- ipapython/platform/fedora16.py       |   22 ++++----
- ipapython/platform/systemd.py        |   16 ++----
- 3 files changed, 113 insertions(+), 21 deletions(-)
- create mode 100755 init/systemd/freeipa-systemd-upgrade
-
-diff --git a/init/systemd/freeipa-systemd-upgrade b/init/systemd/freeipa-systemd-upgrade
-new file mode 100755
-index 0000000000000000000000000000000000000000..572d69df64b335e1a06b358fc9a0f2132807d6a6
---- /dev/null
-+++ b/init/systemd/freeipa-systemd-upgrade
-@@ -0,0 +1,96 @@
-+#! /usr/bin/python -E
-+from ipaserver.install.krbinstance import update_key_val_in_file
-+from ipapython import ipautil, config
-+from ipapython import services as ipaservices
-+import os, platform
-+
-+def convert_java_link(foo, topdir, filepaths):
-+    cwd = os.getcwd()
-+    os.chdir(topdir)
-+    for filepath in filepaths:
-+        # All this shouldn't happen because java system upgrade should properly
-+        # move files and symlinks but if this is a broken link
-+        if os.path.islink(filepath):
-+            print "    Checking %s ... " % (filepath),
-+            if not os.path.exists(filepath):
-+                rpath = os.path.realpath(filepath)
-+                # .. and it points to jss in /usr/lib
-+                if rpath.find('/usr/lib/') != -1  and rpath.find('jss') != -1:
-+                    base = os.path.basename(rpath)
-+                    bitness = platform.architecture()[0][:2]
-+                    # rewrite it to /usr/lib64 for x86_64 platform
-+                    if bitness == '64':
-+                        npath = "/usr/lib%s/jss/%s" % (bitness, base)
-+                        os.unlink(filepath)
-+                        os.symlink(npath, filepath)
-+                        print "%s -> %s" % (filepath, npath)
-+                    else:
-+                        print "Ok"
-+                else:
-+                    print "Ok"
-+            else:
-+                print "Ok"
-+    os.chdir(cwd)
-+
-+# 0. Init config
-+try:
-+    config.init_config()
-+except IPAConfigError, e:
-+    # No configured IPA install, no need to upgrade anything
-+    exit(0)
-+
-+# 1. Convert broken symlinks, if any, in /var/lib/pki-ca
-+if os.path.exists('/var/lib/pki-ca/common/lib'):
-+    print "Analyzing symlinks in PKI-CA install"
-+    os.path.walk('/var/lib/pki-ca/common/lib', convert_java_link, None)
-+
-+try:
-+    print "Found IPA server for domain %s" % (config.config.default_realm)
-+    # 1. Make sure Dogtag instance (if exists) has proper OIDs for IPA CA
-+    ipa_ca_cfg = "/var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg"
-+    if os.path.exists(ipa_ca_cfg):
-+        print "Make sure PKI-CA has Extended Key Usage OIDs for the certificates (Server and Client Authentication)",
-+        key = 'policyset.serverCertSet.7.default.params.exKeyUsageOIDs'
-+        value = '1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2'
-+        replacevars = {key:value}
-+        appendvars = {}
-+        old_values = ipautil.config_replace_variables(ipa_ca_cfg, replacevars=replacevars, appendvars=appendvars)
-+        ipaservices.restore_context(ipa_ca_cfg)
-+        if key in old_values and old_values[key] != value:
-+            print
-+            print "    WARNING: Previously issued certificate didn't have both Server and Client Authentication usage"
-+            print "             Old usage OID(s): %(oids)s" % (old_values[key])
-+            print "    Please make sure to revoke old certificates and re-issue them again to add both usages when needed"
-+            ipaservices.service('pki-cad').restart()
-+        else:
-+            print "... ok"
-+    print "Converting services setup to systemd"
-+    # 2. Upgrade /etc/sysconfig/dirsrv for systemd
-+    print "    Upgrade /etc/sysconfig/dirsrv"
-+    update_key_val_in_file("/etc/sysconfig/dirsrv", "KRB5_KTNAME", "/etc/dirsrv/ds.keytab")
-+    update_key_val_in_file("/etc/sysconfig/dirsrv", "export KRB5_KTNAME", "/etc/dirsrv/ds.keytab")
-+    # 3. Upgrade /etc/sysconfig/krb5kdc for systemd
-+    print "    Upgrade /etc/sysconfig/krb5kdc"
-+    replacevars = {'KRB5REALM':config.config.default_realm}
-+    appendvars = {}
-+    ipautil.config_replace_variables("/etc/sysconfig/krb5kdc",
-+       replacevars=replacevars, appendvars=appendvars)
-+    ipaservices.restore_context("/etc/sysconfig/krb5kdc")
-+    # 4. Enable DS instances:
-+    # when enabling DS instances we'll also do configure /etc/sysconfig/dirsrv.systemd
-+    # which comes with 389-ds-base-1.2.10-0.8.a7 on F-16 and later. This is handled in
-+    # fedora16 platform code
-+    realm = config.config.default_realm.upper().replace('.','-')
-+    print "    Re-enable Directory server instances PKI-IPA and %s " % (realm)
-+    if os.path.exists('/etc/systemd/system/dirsrv@.service'):
-+        os.unlink('/etc/systemd/system/dirsrv@.service')
-+    ipaservices.knownservices.dirsrv.enable(realm)
-+    ipaservices.knownservices.dirsrv.enable("PKI-IPA")
-+    # 4. Enable FreeIPA
-+    print "    Re-enable IPA service"
-+    ipaservices.knownservices.ipa.enable()
-+except:
-+    pass
-+
-+finally:
-+    print "Finished."
-diff --git a/ipapython/platform/fedora16.py b/ipapython/platform/fedora16.py
-index 0e476928e45be69e4aa09c5183070924a00b1269..369a1778b512fea6119e8e0f600ffda26739eb30 100644
---- a/ipapython/platform/fedora16.py
-+++ b/ipapython/platform/fedora16.py
-@@ -59,24 +59,24 @@ class Fedora16Service(systemd.SystemdService):
-         super(Fedora16Service, self).__init__(service_name)
- 
- # Special handling of directory server service
--# LimitNOFILE needs to be increased or any value set in the directory for this value will fail
--# Read /lib/systemd/system/dirsrv@.service for details.
--# We do modification of LimitNOFILE on service.enable() but we also need to explicitly enable instances
--# to install proper symlinks as dirsrv.target.wants/ dependencies. Unfortunately, ipa-server-install
--# does not do explicit dirsrv.enable() because the service startup is handled by ipactl.
-+#
-+# We need to explicitly enable instances to install proper symlinks as dirsrv.target.wants/
-+# dependencies. Standard systemd service class does it on #enable() method call. Unfortunately,
-+# ipa-server-install does not do explicit dirsrv.enable() because the service startup is handled by ipactl.
-+#
- # If we wouldn't do this, our instances will not be started as systemd would not have any clue
- # about instances (PKI-IPA and the domain we serve) at all. Thus, hook into dirsrv.restart().
- class Fedora16DirectoryService(Fedora16Service):
-     def enable(self, instance_name=""):
-         super(Fedora16DirectoryService, self).enable(instance_name)
--        srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name)
--        if os.path.exists(srv_etc):
-+        dirsrv_systemd = "/etc/sysconfig/dirsrv.systemd"
-+        if os.path.exists(dirsrv_systemd):
-             # We need to enable LimitNOFILE=8192 in the dirsrv@.service
--            # We rely on the fact that [Service] section is the last one
--            # and if variable is not there, it will be added as the last line
-+            # Since 389-ds-base-1.2.10-0.8.a7 the configuration of the service parameters is performed
-+            # via /etc/sysconfig/dirsrv.systemd file which is imported by systemd into dirsrv@.service unit
-             replacevars = {'LimitNOFILE':'8192'}
--            ipautil.config_replace_variables(srv_etc, replacevars=replacevars)
--            redhat.restore_context(srv_etc)
-+            ipautil.inifile_replace_variables(dirsrv_systemd, 'service', replacevars=replacevars)
-+            redhat.restore_context(dirsrv_systemd)
-             ipautil.run(["/bin/systemctl", "--system", "daemon-reload"],raiseonerr=False)
- 
-     def restart(self, instance_name="", capture_output=True):
-diff --git a/ipapython/platform/systemd.py b/ipapython/platform/systemd.py
-index 3f1fe730ebab4c0636f8c9d8d83d956da307b92b..ae06c0227aa59a46b2d4df024fc87577b8bbab29 100644
---- a/ipapython/platform/systemd.py
-+++ b/ipapython/platform/systemd.py
-@@ -137,16 +137,12 @@ class SystemdService(base.PlatformService):
- 
-         if len(instance_name) > 0 and l > 1:
-             # New instance, we need to do following:
--            # 1. Copy <service>@.service to /etc/systemd/system/ if it is not there
--            # 2. Make /etc/systemd/system/<service>.target.wants/ if it is not there
--            # 3. Link /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service to
--            #    /etc/systemd/system/<service>@.service
--            srv_etc = os.path.join(self.SYSTEMD_ETC_PATH, self.service_name)
-+            # 1. Make /etc/systemd/system/<service>.target.wants/ if it is not there
-+            # 2. Link /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service to
-+            #    /lib/systemd/system/<service>@.service
-             srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0]))
-             srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name))
-             try:
--                if not ipautil.file_exists(srv_etc):
--                    shutil.copy(self.lib_path, srv_etc)
-                 if not ipautil.dir_exists(srv_tgt):
-                     os.mkdir(srv_tgt)
-                 if os.path.exists(srv_lnk):
-@@ -156,11 +152,11 @@ class SystemdService(base.PlatformService):
-                     # object does not exist _or_ is a broken link
-                     if not os.path.islink(srv_lnk):
-                         # if it truly does not exist, make a link
--                        os.symlink(srv_etc, srv_lnk)
-+                        os.symlink(self.lib_path, srv_lnk)
-                     else:
-                         # Link exists and it is broken, make new one
-                         os.unlink(srv_lnk)
--                        os.symlink(srv_etc, srv_lnk)
-+                        os.symlink(self.lib_path, srv_lnk)
-                 ipautil.run(["/bin/systemctl", "--system", "daemon-reload"])
-             except:
-                 pass
-@@ -172,7 +168,7 @@ class SystemdService(base.PlatformService):
-         if instance_name != "" and len(elements) > 1:
-             # Remove instance, we need to do following:
-             #  Remove link from /etc/systemd/system/<service>.target.wants/<service>@<instance_name>.service
--            #  to /etc/systemd/system/<service>@.service
-+            #  to /lib/systemd/system/<service>@.service
-             srv_tgt = os.path.join(self.SYSTEMD_ETC_PATH, self.SYSTEMD_SRV_TARGET % (elements[0]))
-             srv_lnk = os.path.join(srv_tgt, self.service_instance(instance_name))
-             try:
--- 
-1.7.8.3
-
diff --git a/freeipa-2.1.90-shellescape.patch b/freeipa-2.1.90-shellescape.patch
deleted file mode 100644
index 6077ca0..0000000
--- a/freeipa-2.1.90-shellescape.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3bce02b17edfbdf90ecdac2f9643e28eb20a170a Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Tue, 13 Mar 2012 21:53:06 -0400
-Subject: [PATCH] No longer shell escape the DM password when calling
- pkisilent.
-
-pkisilent was modified to handle escaping characters itself in
-BZ https://bugzilla.redhat.com/show_bug.cgi?id=769388
-
-This removes the workaround from ticket 1636.
-
-https://fedorahosted.org/freeipa/ticket/2529
----
- ipaserver/install/cainstance.py |    3 ---
- 1 files changed, 0 insertions(+), 3 deletions(-)
-
-diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
-index 6012ae1c7a00a87522fc0778f2cb355a3924d805..894e1951fa0c6f1a0f235cce0520c275724f227d 100644
---- a/ipaserver/install/cainstance.py
-+++ b/ipaserver/install/cainstance.py
-@@ -659,9 +659,6 @@ class CAInstance(service.Service):
-                 args.append("-clone")
-                 args.append("false")
- 
--            # pkisilent does not escape the arguments before passing them to shell
--            args[2:] = [ipautil.shell_quote(i) for i in args[2:]]
--
-             # Define the things we don't want logged
-             nolog = (self.admin_password, self.dm_password,)
- 
--- 
-1.7.6
-
diff --git a/freeipa-2.9.90-samba4-beta4.patch b/freeipa-2.9.90-samba4-beta4.patch
deleted file mode 100644
index 25bca8c..0000000
--- a/freeipa-2.9.90-samba4-beta4.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-commit 61b2f0a5d066a14e22033ff9815a712716f12a96
-Author: Alexander Bokovoy <abokovoy@redhat.com>
-Date:   Wed Jul 18 15:52:33 2012 +0300
-
-    Follow change in samba4 beta4 for sid_check_is_domain to sid_check_is_our_sam
-    
-    With c43505b621725c9a754f0ee98318d451b093f2ed in samba git master
-    the function sid_check_is_domain() was renamed to sid_check_is_our_sam().
-    
-    https://fedorahosted.org/freeipa/ticket/2929
-
-diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
-index 86ed3fb..ab4b116 100644
---- a/daemons/ipa-sam/ipa_sam.c
-+++ b/daemons/ipa-sam/ipa_sam.c
-@@ -83,6 +83,8 @@ enum ndr_err_code ndr_pull_trustAuthInOutBlob(struct ndr_pull *ndr, int ndr_flag
- bool fetch_ldap_pw(char **dn, char** pw); /* available in libpdb.so */
- void nt_lm_owf_gen(const char *pwd, uint8_t nt_p16[16], uint8_t p16[16]); /* available in libcliauth.so */
- bool sid_check_is_builtin(const struct dom_sid *sid); /* available in libpdb.so */
-+/* available in libpdb.so, renamed from sid_check_is_domain() in c43505b621725c9a754f0ee98318d451b093f2ed */
-+bool sid_check_is_our_sam(const struct dom_sid *sid);
- void strlower_m(char *s); /* available in libutil_str.so */
- char *talloc_asprintf_strupper_m(TALLOC_CTX *t, const char *fmt, ...); /* available in libutil_str.so */
- void sid_copy(struct dom_sid *dst, const struct dom_sid *src); /* available in libsecurity.so */
-@@ -300,7 +302,7 @@ static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
- 	}
- 
- 	if (!sid_check_is_builtin(domain_sid) &&
--	    !sid_check_is_domain(domain_sid)) {
-+	    !sid_check_is_our_sam(domain_sid)) {
- 		result = NT_STATUS_INVALID_PARAMETER;
- 		goto done;
- 	}
diff --git a/freeipa.spec b/freeipa.spec
index bf9c908..105db7e 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -15,14 +15,97 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 
 Name:           freeipa
 Version:        3.0.0
-Release:        0.2%{?dist}
+Release:        0.3%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 Group:          System Environment/Base
 License:        GPLv3+
 URL:            http://www.freeipa.org/
 Source0:        http://www.freeipa.org/downloads/src/freeipa-%{VERSION}.tar.gz
-Patch0:         freeipa-2.9.90-samba4-beta4.patch
+Source1:        ui-bg_flat_8_225314_40x100.png
+Source2:        ui-bg_glass_40_5e5e5e_1x400.png
+Source3:        ui-icons_ededed_256x240.png
+Source4:        ui-icons_ffcf29_256x240.png
+Patch0:         freeipa-3.0.0.pre1-000-centralize-timeout-for-waiting-for-servers-to-start.patch
+Patch1:         freeipa-3.0.0.pre1-001-ipasam-improve-sasl-bind-callback.patch
+Patch2:         freeipa-3.0.0.pre1-002-allow-silent-build-if-available.patch
+Patch3:         freeipa-3.0.0.pre1-003-ipasam-fixes-for-clang-warnings.patch
+Patch4:         freeipa-3.0.0.pre1-004-ipasam-replace-testing-code.patch
+Patch5:         freeipa-3.0.0.pre1-005-use-smb.conf-dedicated-keytab-file-parameter-instead.patch
+Patch6:         freeipa-3.0.0.pre1-006-reduce-redundant-checks-in-ldapsam_search_users-to-a.patch
+Patch7:         freeipa-3.0.0.pre1-007-moved-configuration-to-last-position-in-navigation.patch
+Patch8:         freeipa-3.0.0.pre1-008-fix-wrong-check-after-allocation.patch
+Patch9:         freeipa-3.0.0.pre1-009-fix-typo.patch
+Patch10:        freeipa-3.0.0.pre1-010-do-not-change-ldapobject-objectclass-list.patch
+Patch11:        freeipa-3.0.0.pre1-011-make-client-server-option-multi-valued-allow-disabli.patch
+Patch12:        freeipa-3.0.0.pre1-012-display-loginas-information-only-after-login.patch
+Patch13:        freeipa-3.0.0.pre1-013-password-policy-measurement-units.patch
+Patch14:        freeipa-3.0.0.pre1-014-web-ui-kerberos-ticket-policy-measurement-units.patch
+Patch15:        freeipa-3.0.0.pre1-015-indirect-roles-in-webui.patch
+Patch16:        freeipa-3.0.0.pre1-016-fix-batch-command-error-reporting.patch
+Patch17:        freeipa-3.0.0.pre1-017-fix-wrong-option-name-in-ipa-managed-entries-man-pag.patch
+Patch18:        freeipa-3.0.0.pre1-018-add-and-remove-dns-per-domain-permission-in-web-ui.patch
+Patch19:        freeipa-3.0.0.pre1-019-add-automount-map-key-update-permissions.patch
+Patch20:        freeipa-3.0.0.pre1-020-adding-exit-status-3-4-to-ipa-client-install-man-pag.patch
+Patch21:        freeipa-3.0.0.pre1-021-fix-ipa-managed-entries-man-page-typo.patch
+Patch22:        freeipa-3.0.0.pre1-022-improve-address-family-handling-in-sockets.patch
+Patch23:        freeipa-3.0.0.pre1-023-enable-soa-serial-autoincrement.patch
+Patch24:        freeipa-3.0.0.pre1-024-add-range-mod-command.patch
+Patch25:        freeipa-3.0.0.pre1-025-warn-user-if-an-id-range-with-incorrect-size-was-cre.patch
+Patch26:        freeipa-3.0.0.pre1-026-print-ipa-ldap-updater-errors-during-rpm-upgrade.patch
+Patch27:        freeipa-3.0.0.pre1-027-enforce-cname-constrains-for-dns-commands.patch
+Patch28:        freeipa-3.0.0.pre1-028-differentiation-of-widget-type-and-text_widget-input.patch
+Patch29:        freeipa-3.0.0.pre1-029-fixed-display-of-attributes_widget-in-ie9.patch
+Patch30:        freeipa-3.0.0.pre1-030-bigger-textarea-for-permission-type-subtree.patch
+Patch31:        freeipa-3.0.0.pre1-031-ipalib-plugins-trust.py-validationerror-takes-error-.patch
+Patch32:        freeipa-3.0.0.pre1-032-handle-various-forms-of-admin-accounts-when-establis.patch
+Patch33:        freeipa-3.0.0.pre1-033-follow-change-in-samba4-beta4-for-sid_check_is_domai.patch
+Patch34:        freeipa-3.0.0.pre1-034-don-t-hardcode-serial_autoincrement-to-true.patch
+Patch35:        freeipa-3.0.0.pre1-035-fix-safety-checks-to-prevent-orphaning-replicas.patch
+Patch36:        freeipa-3.0.0.pre1-036-fix-detection-of-deleted-masters.patch
+Patch37:        freeipa-3.0.0.pre1-037-support-per-principal-sessions-and-handle-session-up.patch
+Patch38:        freeipa-3.0.0.pre1-038-fix-updating-minimum_connections-in-ipa-upgradeconfi.patch
+Patch39:        freeipa-3.0.0.pre1-039-default-to-no-when-trying-trying-to-install-a-replic.patch
+Patch40:        freeipa-3.0.0.pre1-040-framework-for-admin-install-tools-with-ipa-ldap-upda.patch
+Patch41:        freeipa-3.0.0.pre1-041-add-libtalloc-devel-as-spec-file-buildrequire.patch
+Patch42:        freeipa-3.0.0.pre1-042-ids-and-names-for-dialogs.patch
+Patch43:        freeipa-3.0.0.pre1-043-fix-autoscroll-to-top-in-tables-in-ie.patch
+Patch44:        freeipa-3.0.0.pre1-044-rework-task-naming-in-ldap-updates-to-avoid-conflict.patch
+Patch45:        freeipa-3.0.0.pre1-045-arrange-stripping-.po-files.patch
+Patch46:        freeipa-3.0.0.pre1-046-add-all-external-samba-libraries-to-buildrequires.patch
+Patch47:        freeipa-3.0.0.pre1-047-do-not-check-for-dna-magic-values.patch
+Patch48:        freeipa-3.0.0.pre1-048-fix-validator-for-selinux-user-map-settings-in-confi.patch
+Patch49:        freeipa-3.0.0.pre1-049-use-certmonger-to-renew-ca-subsystem-certificates.patch
+Patch50:        freeipa-3.0.0.pre1-050-move-code-into-common-krb5-utils.patch
+Patch51:        freeipa-3.0.0.pre1-051-improve-loops-around-slapi-mods.patch
+Patch52:        freeipa-3.0.0.pre1-052-add-special-modify-op-to-regen-ipanthash.patch
+Patch53:        freeipa-3.0.0.pre1-053-when-ipanthash-is-missing-ask-ipa-to-generate-it-fro.patch
+Patch54:        freeipa-3.0.0.pre1-054-update-translations.patch
+Patch55:        freeipa-3.0.0.pre1-055-ensure-ipa-adtrust-install-is-run-with-kerberos-tick.patch
+Patch56:        freeipa-3.0.0.pre1-056-fixed-unable-to-select-option-in-combobox-in-ie-and-.patch
+Patch57:        freeipa-3.0.0.pre1-057-fixed-combobox-stacking-in-service-adder-dialog.patch
+Patch58:        freeipa-3.0.0.pre1-058-add-per-service-option-to-store-the-types-of-pac-it-.patch
+Patch59:        freeipa-3.0.0.pre1-059-pac-type-options-for-services-in-web-ui.patch
+Patch60:        freeipa-3.0.0.pre1-060-update-to-jquery.1.7.2.min.patch
+Patch61:        freeipa-3.0.0.pre1-061-update-to-jquery-ui-1.8.21.custom.patch
+Patch62:        freeipa-3.0.0.pre1-062-fix-for-incorrect-event-handler-definition.patch
+Patch63:        freeipa-3.0.0.pre1-063-removal-of-unnecessary-overrides-of-jquery-ui-styles.patch
+Patch64:        freeipa-3.0.0.pre1-064-unified-buttons.patch
+Patch65:        freeipa-3.0.0.pre1-065-web-ui-tests-fix.patch
+Patch66:        freeipa-3.0.0.pre1-066-fixed-incorrect-use-of-jquery.attr-for-setting-disab.patch
+Patch67:        freeipa-3.0.0.pre1-067-replace-use-of-attr-with-prop-for-booleans.patch
+Patch68:        freeipa-3.0.0.pre1-068-avoid-redundant-info-message-during-rpm-update.patch
+Patch69:        freeipa-3.0.0.pre1-069-bump-bind-dyndb-ldap-version-for-f18.patch
+Patch70:        freeipa-3.0.0.pre1-070-move-mspac-structure-to-be-a-private-pointer.patch
+Patch71:        freeipa-3.0.0.pre1-071-load-list-of-trusted-domain-on-connecting-to-ldap.patch
+Patch72:        freeipa-3.0.0.pre1-072-properly-name-function-to-add-ipa-external-groups.patch
+Patch73:        freeipa-3.0.0.pre1-073-split-out-manipulation-of-logon_info-blob.patch
+Patch74:        freeipa-3.0.0.pre1-074-add-pac-filtering.patch
+Patch75:        freeipa-3.0.0.pre1-075-add-set-add-del-attr-options-to-commands-which-are-m.patch
+Patch76:        freeipa-3.0.0.pre1-076-handle-exceptions-when-establishing-trusts.patch
+Patch77:        freeipa-3.0.0.pre1-077-create-etc-sysconfig-network-if-it-doesn-t-exist.patch
+Patch78:        freeipa-3.0.0.pre1-078-make-set-add-del-attr-more-robust.patch
+Patch79:        freeipa-3.0.0.pre1-079-adds-check-for-ipa-join.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %if ! %{ONLY_CLIENT}
@@ -33,6 +116,8 @@ BuildRequires:  policycoreutils >= %{POLICYCOREUTILSVER}
 BuildRequires:  systemd-units
 BuildRequires:  samba4-devel >= 4.0.0-128
 BuildRequires:  samba4-python
+BuildRequires:  libtalloc-devel
+BuildRequires:  libtevent-devel
 %endif
 BuildRequires:  nspr-devel
 BuildRequires:  nss-devel
@@ -125,7 +210,7 @@ Requires: keyutils
 # We have a soft-requires on bind. It is an optional part of
 # IPA but if it is configured we need a way to require versions
 # that work for us.
-Conflicts: bind-dyndb-ldap < 1.1.0-0.12.rc1
+Conflicts: bind-dyndb-ldap < 1.1.0-0.15.rc1
 Conflicts: bind < 9.9.1-2.P1
 
 # mod_proxy provides a single API to communicate over SSL. If mod_ssl
@@ -189,7 +274,7 @@ Requires: wget
 Requires: libcurl
 Requires: xmlrpc-c
 Requires: sssd >= 1.8.0
-Requires: certmonger >= 0.53
+Requires: certmonger >= 0.58
 Requires: nss-tools
 Requires: bind-utils
 Requires: oddjob-mkhomedir
@@ -253,8 +338,37 @@ package.
 
 
 %prep
+# Update timestamps on the files touched by a patch, to avoid non-equal
+# .pyc/.pyo files across the multilib peers within a build, where "Level"
+# is the patch prefix option (e.g. -p1)
+# Taken from specfile for sssd and python-simplejson
+UpdateTimestamps() {
+  Level=$1
+  PatchFile=$2
+
+  # Locate the affected files:
+  for f in $(diffstat $Level -l $PatchFile); do
+    # Set the files to have the same timestamp as that of the patch:
+    touch -r $PatchFile $f
+  done
+}
+
 %setup -n freeipa-%{VERSION} -q
-%patch0 -p1
+
+for p in %patches ; do
+    %__patch -p1 -i $p
+    UpdateTimestamps -p1 $p
+done
+
+#FIXME: patch program does not seem to handle binary files in patch
+#       freeipa-3.0.0.pre1-061-update-to-jquery-ui-1.8.21.custom.patch
+#       well. Apply them manually
+cp %{SOURCE1} install/ui/images
+cp %{SOURCE2} install/ui/images
+cp %{SOURCE3} install/ui/images
+cp %{SOURCE4} install/ui/images
+rm install/ui/images/ui-bg_glass_40_111111_1x400.png
+rm install/ui/images/ui-bg_loop_8_333333_21x21.png
 
 %build
 export CFLAGS="$CFLAGS %{optflags}"
@@ -394,7 +508,7 @@ fi
 %posttrans server
 # This must be run in posttrans so that updates from previous
 # execution that may no longer be shipped are not applied.
-/usr/sbin/ipa-ldap-updater --upgrade >/dev/null 2>&1 || :
+/usr/sbin/ipa-ldap-updater --upgrade >/dev/null || :
 
 %preun server
 if [ $1 = 0 ]; then
@@ -474,6 +588,7 @@ fi
 %{_sbindir}/ipactl
 %{_sbindir}/ipa-upgradeconfig
 %{_sbindir}/ipa-compliance
+%{_libexecdir}/certmonger/dogtag-ipa-retrieve-agent-submit
 %{_sysconfdir}/cron.d/ipa-compliance
 %config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
 %dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/
@@ -529,6 +644,7 @@ fi
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
+%{_usr}/share/ipa/ca_renewal
 %{_usr}/share/ipa/ipa.conf
 %{_usr}/share/ipa/ipa-rewrite.conf
 %{_usr}/share/ipa/ipa-pki-proxy.conf
@@ -639,6 +755,9 @@ fi
 %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
 
 %changelog
+* Mon Aug  6 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-0.3
+- Updated to current upstream state of 3.0.0 beta 2 development
+
 * Mon Jul 23 2012 Alexander Bokovoy <abokovy@redhat.com> - 3.0.0-0.2
 - Rebuild against samba4 beta4
 
diff --git a/ui-bg_flat_8_225314_40x100.png b/ui-bg_flat_8_225314_40x100.png
new file mode 100644
index 0000000000000000000000000000000000000000..c840d7c5991ec9f9a62ad35fa97c53140f6c61b1
GIT binary patch
literal 214
zcmeAS@N?(olHy`uVBq!ia0vp^8bF-F!N$PA*qrS22FRJ~>EalY(fIcIM&4!zkpmYd
zNX}@OdZT{Y623(apZpsu^!()?TdN41-nM@J^~Udo4;{O^nSVb0;-D9w`@yey-d4wE
zez`q=m?ZWaD}uqp`>l3gT2Mf_NZ<d9{>J+rXR?Hm2KO1<<<Z&_BN7I5D1)b~pUXO@
GgeCy121$be

literal 0
HcmV?d00001

diff --git a/ui-bg_glass_40_5e5e5e_1x400.png b/ui-bg_glass_40_5e5e5e_1x400.png
new file mode 100644
index 0000000000000000000000000000000000000000..70c70478052c4143a96ade28d1305c8222c2fe41
GIT binary patch
literal 115
zcmeAS@N?(olHy`uVBq!ia0vp^j6gJjgAK^akKnouq^vw$978O6-=5#d%b>`^a`5sk
z+ubSC895o7&c{1V?=g!Fz3MQj$MF26yQ>)l1+8aRUS-_yqyCu0=c6oQi#S&4E`OE)
PG=;&_)z4*}Q$iB}7NsR<

literal 0
HcmV?d00001

diff --git a/ui-icons_ededed_256x240.png b/ui-icons_ededed_256x240.png
new file mode 100644
index 0000000000000000000000000000000000000000..01bb36ba7668a4a9e181f4af7ad89dcf1fe3022d
GIT binary patch
literal 4369
zcmd^?`8O2)_s3^phOrG}UnfiUEn8(9QW1?MNkxXVDEpFin2{xWrLx5kBC;k~Gm<qS
zlCjL7i8RK}U~J#s@6Y%1S9~7lb?$xLU+y{go_o*h`AV=spXY*!!T<mOmxZ~R9RL9Q
zdj+hrf&W^P#f9C!Zpp^V{w#f&{=ajM-(|S|EgT(ahrR?5hM!<zvuS&nr6z6fi@J>w
z<@?HsG!Qg3zaV+-xQ3ldtad!U<6iGz_enGH*2akP_r)o1D&8p^5M)<i5Kvm7+w+1d
z&*|KAM&6N6?%o|XKL7xDVlB)}>_c8IIj6Wy*7HJo&CBLuo~nj>(63pZzO(Vv^ZuB3
zMYigjkwA;FEy|G}1jpiMj6|NTm7Uyiw=@FDE*nX<>jR!W@9XIyf%$Fd*J5*D0Z0Lm
z9}ZQxyT|x5ftNy?V>EbJz-K>bV9gs9RaXUP<^=;e?&Fqxj;6{ieR-a-@H<J_4GiWZ
zaVu(K@aJcf^w<j8VA*iR3{E8n{m4z5Ta=$%rXkgQO6v#}L)oynVyGEE=_51-z65?H
zDgGA81aw}gX`NgF4>ycA1KMKhql8GOmcx<Hp8QKqcf*>wZ?_-(3hMK^^a*(gaFvBH
ziIC!fgH4$W*NbKIaY&T?%&13``KbD@S-0`xQ%v3TV+B!;RC7O!+1a9QCA$H@3tR;k
z)SSoR7(s4)f{zM}eWgFN{(ZH5d1O}l)f$ruT!)Q&NImXyZsTzOf9TwctcSfr+M)aJ
z5otO+$jvm-P4)ykH)x|cO5xeb>?!`qGw$(>&axqLL6yoB${vsMXgL_-bz@2J_tS92
zdvZG-+vKl@K4Vr(<X8D7Fm5%eurE#<YP<1YLAHb!!E~xCzIMI68x%=Yh-w$L6-vB;
z!c#Z2_$LgPU;Po3j&(cwr6cKhhF=VILF!3vYQvfMvLYtV{!ir!NUtS|shjnm2Kl+v
z9M*o<>EL{WQt@Z+Ea-hxX0}nTSZxnpi^#Kn8Ox8FgIS|hc}KJQ4tm*HO16ui{(O9}
z1YN)GjiQt6fGq`Cj+^`zUf?8hk^(T{{cOQGWFP98am}is28A!5%{R#ENv8fCN!j69
zl<vTXm`x#Aj3pR~5$!tw8x6HJBT;veqlI((e3l5f1J0XQfUi^9^|f?)8pp02+%sAX
zr3QSEAghjFy?kTy2b}Y~5VYqs5GsSo#pFLl;)0^z+6P*`;T5Mu&WLv=bzI9Q@9K!#
zx3ne5{kTux3L#b!(t3OTfpmY0?(76nqT7xWC3Cn`hU1f1hZjxb%CxmPCafJTzecbo
zhDHzEdDz$vS9U>MEK(2z?|BY=Je$XD9mB-Kkem*(d-j^9j$2#6r$Dz?s)-TCDCGCs
z8>6Pvj{Y+YIeFA@qY22V$)awy@q!9A4rgk5b9TcC;s9Ig^G|6nDP+5=Fzg&?(L=vc
zCbGd>fSu~@6!94td+o#d@sid<c4_^>!EI<?7QBi6t=$bf#g{8RUCj>X$rx7*cawe6
z`dScJ+$HssdOjE)O#Ybs56vm-FQ$7yuJJD^Zqk%hMaIgAJ<2yb_MFQte_i;62ScT$
zpjifYyR_E=rQ+>H)pmlr-Udzg*-!|ssw(D7wJvC+Sf8bb9;;q8#z?0p!!bsd{wy|5
zpBaMHE-Ve>i#LLjHRaMLtp%9&(HCng7Sw96jVv!#0k%?F^K7&=T)mnYn)D9(i;4x5
z^NJTJwq~pv;kH@#ejTd*48~(J(r6j34|m`h9fEDj0im)~+%I5XphWymhT;_Zty|Q&
zzjPg#-ufAHZ<omf5#{klOC=UKcxxw*?x^rKwwoZ7wz3@8eku)ggLNRn<<KIdajH#H
zeA)T=Seh$G{X;Ew$<Zx1YdFKl^buFmaRdI%XI9raN<LH2H`S7|Dmv<?JPd_9FaRph
z7M0*0UG<&|_BGC;v{TKZe6h)s$R@%If`c(mfiu?)kSq&lq&xx(v`_L7ceQ&}Az*(Z
zkTW$+naI+A`yGk?qy`dg`WSb{6e&FN4RX;O&+frr6hjc+3<Yokv6*p`M#SE){vkzc
z3FL#%2;YdX9eq<GwL48ff7Y!gs4B@Hlzc$A2`aV3*Atk++JX5HDY4Bk;uB4Yxbu<X
z`L&1ByqMIqI8t`UE|_LH(~F2;?|){*%50r1sI9V=C6bO-=^K$CSiOmlVqzhvSi?6g
z4AzPTh<iZl4l)6IBfJ=W6EkAt_}>1M*Gccw?Kf|8Pnhtb0`!{N`Bqsa37J+>wC$!e
z00k+2Egzz;rbcWoUB%Jvp8W1}$XD%e3>4y;;OZ1ccT-O#uW6Ys@C}Pa`nZrNKzR(2
z4e%3)@QI4SE&E!lW`5y14QhbepBG%_XBV-O(%<aX6HVzRJ7ee*QV3AB=~LWyIoy{V
zqv~a)U>5tj)@9#|;sC-MNev!zGDHk}JdpGC`iJF#8=8-P$Xoku_=Dw%Cv3{U7L>gf
zRQ?<$t`cZ*MP5GQmbmx#!+*!zu>0MewRO9GFGS{b^m_fJ-N0?j@EqoFf>$khj+E|@
z7r3We&^tR^YZrxKe*d<YJy4G(9mh^GOxZ8bi3n#Ytos{m`t{%)Lj8wW{Y{jV+Q_6T
zI5_MMSa-xsCZ~p-HRDCj#<#0BIhacN@>22agXqCO0l44&kqCv{u)T|(lv`~PK@DvE
z{QI_TlCH5z*gR!>LO)k67{^R+vWx24U2^2ODXpwT;6y+6+$5m)_*w4WY&#do9dCeE
z)>p+Ykdhq($DhmMiaYXey!@N%L26uz($aJ!QT{B^Wu}U$^9e#5)=c+XF9@Ill?ZmM
zlNgHiz*9!vDc&uxOo;ZVxb`Q!Sk0*gnfxWzmbZh4(=%CD%qP?0=);n$&zaW_$UKV9
z8axdcN#AyZ{P)wj?V{P}vM)YY!>6@}^>U+iv$`9>nMTCPjN>z%yF&3yf%>+T@0vh4
zlC8Xa6zeo?%=o3}M8{aebLHcO{^1Ar8qiM=Gquf?Jo)q5`-+?sUpg?QXyEUpWSm+n
z$K-UyqkI<R?*3wTVfWE~<@2<uS?-MVl1;jzAA8*iL4xsi?b?BNi<UXgZAh$t2eX2O
zlaSjP6`u~(FfWAHwjdICW?Bi|*YB$4-Yt-e+urDxm7s0C-NReT=&xHY=NLk9^<)K_
z8Qvc8a9@Rcrh{U|jRjj-<@xXJdfDhCHAU3q@`fxV7DF|YZ^rH=h9J#M-17gO6$#8E
z=<ACLP@x){UQ68&`mEVXq`?Cxb~%;JJ<xQvIxsey(BZq&!Lur1_nVgz6$w$lK^&jz
z^=yq5^Y*23<@W0Z_KKzDbZLlkyC5J9t>wHLquru~o(OF)hhz$Y*|X>ZIbswnxRvr~
z2=rdOGVuD|xRlpAZE<0!X1F(%Anpl^@V^D3vbM}qxe|NI;TTiZy7(IM;R69RkA>a&
z6gwYE2sREzQ_LHmWqB+ogMk(fMaSFeoDq-!HkFB_nXt5+2ncFuk9BQL1I&oB1zZi)
zYW{6_&-Ip1l*OVRA##1ILQS;5R{-K^0wGTiJbVSi@LA^$D$;@J>^G{6@&+%4{b3(s
zC~LEHiTv(0b#zxt?YJ0r_~pUZM~mQ(??(n#>&tD%+@nq=Abj5*8R!~Ul1`G~=qFJ4
zfl|m8ZDCYgtr`4LcOpgiJYX9qRY5;DcWti~PmS$VB$E-Zt^f4)vLDOe_3XTq5^ylW
zJ9PKm!V-8sAOJXnUfuFNIf0R9tK-pNs2hO04zr620}5B(Ok>yB)Of-3sP59qfQNbm
zA4{w!2@cB;GbR(~szVrbO%(w=5S!X`o@o@x++wbN_tMPT0V<QhG{UeJ;8({%=z{L*
zWd0UgQl1fNI!H$Y$hXK#w3!Gvn(74Nb)t*FnucAAe1;`Z--B03CHyB#2gq}g;qs~I
zlu;^<Ox+<j-;_m5iBxJsQxuqvjs7QOWMpota<0)9-Vv;XHb%w=>c)*I;Fgsbf^*g0
z2Di?HTApwKq3+YwfNsqd3iP%{hyK1iyuVZc@*0tO_3+N0#GFsz>8MjeJ2UJ%L!%hi
zGYYAthH`E+ywA*u{(eJ=ia3h*%k?779rk-K<0VZAPkl;TFUbmei|$fqWO8!_zIvqt
z$ly$VrlH46nnpX~X5Yk0iBJl;=WuA4>~X4-f&K0yWf42h&0b30t@NYX$7egQ1Fp!a
zbui-D6cWCWV&|R1CY@G8(qOmWjWeX3eX7UggZPGimA}soOuQdXe4uZ#2>5zN>qlI0
z9xk}lE=tNpX1m6*nFr2EQ3xs79!^sCldDJYE$m(qYv3q7>}1R7?iZW7>$~*%zKaC|
z=$N?ME$>#+%T&MZC`dW1wUl6Z)JgyCn~V%K&i0H|iwE%$>xsZW3tTfZxIUe<xAj&4
z4Hz4+{_ST0nym-LoHhM~e(110&D!U_p#In^VLIn{J!Y#z&<>Pci@p;cRu|d=ItIwF
z1clVHy{hH?@SD|(Zfqi^0DQ1hczHN7xq85h)rzQqLHMX2^IkuK7FB!kI40s$|CY7~
zNX^{_UjN8}L%Med;|+=4RNTMozn8KT;2tb77bUPCmioh+rZBfIiM6f_P34cQ__o1G
zWqQp3VL~~pE5?qODf%iiQQ3f42YF@09tQ*$<v=*TB6gv{jy879dA6iNsN{5E@!(k4
z8HhaiU_^B~4$+iH?m^ArL%A5*Efo_%8ySb3DJ2+($#iHi9LOmDmMF7*5N3n2&E!HG
zolrkI2!HM5qnOHg23Q1&UfD^`iFCzlg;)`TxlRkY*i!V9>4v_EKUx;t1KCPCBtgqg
z@+Tn;O)a0uky_%jm+WjNB?=~VyH>V#L!*=l*@OS6SVyt_UEH&NA=?V2stHPyKkVNy
z<J*73J43UcB3bH1PM2@IZw;E0-Pr(2?E_y%c)4{fI(WYro>&jg<#cjros){#ji)dK
z%)We0L_478=HZ8-@xnwsKrWs8)x`MB;(Y`Cmu2c-&SH(vN-F(*e`l?c%+l$|y_AJJ
zhcDGnwLvN+bu;_sX|1<mH)GAPa-4}{cUWY%Y?nWr&(mZ0q~a8r+)V&r!Qf@i3-wZ~
zk29f}K4Mv56>AiePh<L{fUUyPI`J1j9<HC~w$=DnBr|v`eP$5Ka$0AMorz8kwj<6R
zqIF0X>x@u&%P$hf*xE+O=~D?_(_KGWQ!158YL-y9$*6mmPo;Rp*Dl5lm-mVM2i`h-
zM@nxv590_tvMwPD_{l=b$iOm|+|S{D9&P%zeT$GgX6Akl-tfUF>tL@Ld!B&{pN39t
zH>3Vhqkr}2Yul+jb7UiouWVGPNsxX7Ueba+9|~dz?d*QM$ng0DZfO0`7fAy?2yMm|
zcnRzUhZ&IcwgjH9cuU!w+VStYa{p*)4IgBf|E8)sqMYtB2KH_}SfsFq(c9i(Q6S3U
oBo%DI<H*|Oy`A%<=J$?q?|gu`ltGZq->*Kv;w;*%(i9W@e@>#j(*OVf

literal 0
HcmV?d00001

diff --git a/ui-icons_ffcf29_256x240.png b/ui-icons_ffcf29_256x240.png
new file mode 100644
index 0000000000000000000000000000000000000000..8c376157d037d4fa61dff6f20a1eed495d919c14
GIT binary patch
literal 5355
zcmd^@=RX?`7sVrySh4piwQCoxEwR-evG?qtw%Ej0HGj2glu~N6Xp5Q=wMWcaO%bao
z6|*)^|BvT>?u+kvch7lsKKF&Op*AHs8#w>~pnRmGVF~~c{X@V$Dd->78;1G(6Mu~L
z5t>(HqW?du35~%2Gj14YYG?*vp^+jcHSUUgEzX1Rg?l)$(P5$7N=#}xx_4{@BuzyV
zWRhZfo(+u;$Z2qNwno%8Rissa{33K+!bc#705i&6a^BW^Ef;I4ct>SDc`~JQ4FJ$P
zKGIM{gcSX;r*OqJ(?W)HZL0FiuJYL*Bd0|dJ`04y6vS+$+qb9ccCK$rq*whgD}c=J
z)4Hifxo>-pe2Mn}G{gxk#DOJh*UZK3WT?o8pb+^NO#x7|=eg>GGggBw8*B$_9NDW=
zv+JfxwDcydV|7};xM5}|ml?x^A{`GF5rNjw)8fEoGfgq=1N>R0+>XkQYGvW`g&Mb%
zit}A6?kF4Hy<eR~0W^y<^$*7dcPAP=3=6B{OTP<IekzUOkmPUa<@FcRu%frpW2!WX
z)Bob2TL@whW^L5VA;R>6(}q8VA@V<~b~iROZ%5sRx``n;^`E*QF`Lzz3F)DJ_a$?%
zWh-&-?6|~S;fiKQ*EIPJ+r}1$%%bMR9a|1v=lQy@Cgv{6BI=(W)RWZhs?b=9wSTaw
zl2c>TnfSqxnlhg!!WTtgs2Qkj1B$r6OWXgzaxO0{-+#-h%O<>Gp>a{N;&YTUwl*;6
zmj`bXkDEPvdOJ2sj;UGjsqI-sR+>hc<)?skDjo(eJ0iO&T{+E1Vjtv&=E0*_Pfh1)
zxYDq^lMr3`-CdsO8|u5i)6wU;BVdIww;aACamrq4xVMFSaPd0->)<sNUiv(u2_$BN
zc5{r{tbY@E1cj`;YkChI=4y}T6?LaOX|_jD_+3j3;d3LpT$gd{r}?OvYL_?c9=^Ui
z%P(DY?gO;|c^EV9;Q+1=oYdJ+{e&4I7*AYzTMdranzR1p%L(K1dq-Cp>JQcJ82IQc
z#0pd!$M~qGW~Z24ilBd&Gf+&@7*m=2x#!3E2Q5z8c7+Wsuh3ET<gN<p;u9Nr=3CBh
z-fae42dUf3D$%&higt9!kiGvgHMBfjKg(*)NR=_u%VEh}^j_@s1y;R_>39$+Th<eV
z2<I2>YLq{p;u+uQvWVZE4!c<~>eVVrGH)ei0L!gRrrrZsM|Fs>;`vvtKFScx5YCnw
zi)K`o(}V8Mf*?7x4%3sb9<dOx2Goxw9NDN0I(^)E76fXdSf6vp39ga{To}Ddp0@l?
z_E;?8OEi8?F+uvyO2~-^-QWL6WkbvTli9xWs<#%ei^#ir8Zg_7pUC-Hr?R;5nsy#I
zWnKfi>K9IHHa(rq9Xu=J|MFf*7{i2v>iGJjGDts<ubt{xbHr{m|9<&EDlTod<m)dy
zDT;I1A>!8$c8=I{(8RtAE<D1yTNLJrMrleQ`!I0{o*@0^QP=_mQ0}9w=r$MP#Xipo
zqGrTsj)l{AovA9ooHGriy7;vH64gX<p3oB|se@GlGu<7Hh~&CI?PJ`|(yAnbjlG&R
zGo3J$C#tGLu>(D}+u|jdf~+uFw<c$RMK5Za*Jxcv;E06j_q69RY<lae--5Uqb-hZS
znn7}S=46jr_z!4Y!^&%zs4Hvj!t6dEn=T5{v1Q(3)2fP=Y9^L(x2|d5HUqTM;9f+$
zRTH3Zve(<AG2MANQb8Bp*9=u<rbZl_tzjR+3ih6a?*Om68|A+YKu>wP?dk}~7BplS
z<1cR>&K2+X2U+9E`3YT>MhoO5yp%voa>QEVzlp%gcQzS+_%-loTaHu}6l^#JW8Yow
zSazwdt+a1$YW)(!(l|L!@6-a^Ywe4@c_vt1yBMh1cle4ts95SEiY~gQlrGY?H|t3k
zzYnr@4yhiwcd*nGN0K~ad$rN7REB;hvZZo3KoRh~i*|Vnkv7XbpD6q#V5qV9uvb(M
z*W6%NlYD}E`pk*T9ly*8^0!8RW2Xf$56g!-|Cp#IuhK7%fQ-Mn2hq1}fFfkI%SkJL
z-!fvpo|<0KV@{0GG{$Y|eCr=2Bo~>=&xMg@mp=n7wJJN*HG6P?U+oeQDTPVaoF{?%
z`q^m{Ft!;vHboULB@<b#)h*-_R+Sa*g~j~4l`9Q8Qp#=)+Dm7_v@RWgWB1a62z|c}
zL_I{c!vGyS0cP8Yc2odDH^up-g;7sSR|S3DKGG7^N<?zl&GX9W`$Rcqi!^vK=v~L3
zo9>BT#%zIYtFU+Av%U9oAxMZc3Dhnah6#o#L!^L17Irh#sdJ~jaQ?SFepUH6xE6<P
zEs0`fFV_v)T!=gxZ8}fvAlDM_nF|ZlOIW^23Dy;ACRCz{f!LRUE7FMkOG<V<C(qQS
z^X#mw*soMPYRafZqR!WMgiwTU)?cqm!z+IB7`8_=&w#8jI?Be}trf&lQh(FC`-e^d
zM|apuaNFFGzQM{31TSDVUTJ38{xhOQ4AtklmZp<Fnl=#7Cs0ZIh|EnX1bQd&K8rW@
z>+;~4FD$3zCH}!tg9*EY1BVf{63A2R`drgZf#ySU*b3%Cf?DuEDdF2R<0EDKGaKWK
z*pmQ3RSVRC*q{fZAOGeU6N%N9LPEm93!)KLsx0qD59c33RFe#?hg#G=T`z^zFSNxl
z_7U*@5FU#;Gk76Jh_rU?IHCmBSn?lS@;`;f;_<bV46YA~;GVT(zXZj$ixvFLmrZ0n
z`KSFsyto{xj|YDkrx~fK(cU0cB0W$mPirzHb#Gt5ZUQ2=n#LV`YXmvu5c;*^xTrk}
z8okp*KHn);1)IJ>vD1M4HcNwRQU)?+tcj<z!7^z-5F&<bwwWr#6vrOcZh-iuD+vDK
zQ1v|h&&Y6_r>DEAL7t_P;3bWc!b9EZ61J<!gK{%FhcKu<STsnh?TRk2V?;0XNi59?
zedM#X1vh^Wz74GOPbJm+l1T$4;ZOz^Kb4Z5<T(X(x6%UfyngfUoQ2NtMb(OWpJ%3q
z@iAl-n+=)l@f@J+$r2MXHpniMS!x#wT>J?jL1T|5!CD~lO8lSz$2o0C&hVN%CP0(V
zCb(rBaO6D4Hipe$!fBbO=<w2YUCfZVbCYU+|8@V$h9$Uc(Lz=w*V}p8$QFkc8AdU7
z4-vX#I8t=9=xPcb*dcY4pt;1D+~doBqk2P+&W6q&gm0Mh1$dv0q90`eH<FO(Vmh2K
z`!jBD7QHy0RvR4Bh49Axh@q~r(O%;vHN4?jfMB|?&h`N@O(`=)Tg`v1WXVUI`mf8W
zW)Cj3!;!mZ-x?FPVQ7oG?M6$-?zAy2Yi#vXkzsSetfM6v3X3nR(02?Iva9S9{Grqc
zr=6r4|23jNZ_}*KJ*tgBC6L82pN)6$3{`d?70XKs_O)nlh*X7MwD2Oc$3UgQ>94e*
zCknN)nSjy<eFhgI6B(Q>q49=)cUhHsQjE#;eZ1#~R6x+oCkk8xuaQe^kD?Ofw>NXz
z^tc~*v{Aa{Z?gA(1-Op=T~>Z0S6(46Crw@3sweYo9|>vLqrI)<2*uDpt%zWSBPCr8
z85810|6URnK-7gz)%{43(dzq*iIxRZ8}0tOIINPgNpbP>#x+~zl}Q%Jo)9QkRa&1V
z6H~dUJA>E1vy#ASMMj!2I;aC;AE_MbeyA|>k?k#4*i+qW*Gg)^>{}0km=_t_`nbiw
z*F{(oz$h~Ee$U>6Y3OJ~LQg+`A+9-%A1^g=K=4t=<UZ$KTRLzIsj)--S#oW>XK@R1
z*7_o?<V~#=5ezAGraUXnxx*!zmk^bYo)`%L=pFeg?;f70xy+^@E9LLMZ1(1Nom|_a
zBCK2+9*tPB%W>iN6j59kKM`$r^VHMG>go1&h-7o>2GS%;3zf$xzV{$$4uXxQ-*zQm
z9ubUS&R2!`!21Ef%~+0*0Vyf){+V-FvXn3Hsu6B20&b3I`&v9ud~oY@Wwys@Fm6YL
zrjYem>P8(A?M2DrE2k)1Sy}Jy-#FnvTN9SpOpIxyxUa5NFJ19y{>&^|?!{TEV}vyZ
zkQ-k0{s$CvHu2ojJ7!On9|h&;xYA%3O6l>-JOG$*T;3diJl|P-XJ0ip$mFmdr>n8&
zRJNfic__pk((+$I7;Vd)m7yMB?4at4@OaUblA#|WsC-nI2n%`XzamfJMEn;A4xv{H
zVIKT9TLViu`0E-a6)IobLfR}+r8XbIYjQ?sWTZ!vv0hQqD>8WCdQVx1$Fp9!Qkp0r
zEaJ($uQ5?7MsNu%B_(x7q1gesEEVU3{24Cj6o(_eCflcsbzqH@hiCHorVJ3ql@CP)
z8{j&`1yJ=UE1(Xzf0&Cl&RjBL#KmYe85IF>9lETa@Fi1@$vXCQ#X<iTqJzQ0yu52~
z%ki&dC!_UL=xAR2^cm=!AO`W-O`Ok@CiIVMZD_qT8skB}&I5Kr<9i?(x4zlZlDnC-
zD6RKl9C9T3C;=&7YV9PI&NWGkD62S=?rvb5(dV-dQL*)Ri8c4h85+S2g;2>rcD^5j
z;VIPQq_I6$EYVlwT6B`>;b0oAu{Bg`Y6e^QpYE8~E;jc>?J9+o+UcB7YZ%F+ZJ&nJ
zC1x~#YL4y_#zIy3^p;n5wq!XGdiolyPay+{O>WNyyzw%kAd>i5>(X131U-2nWQBUs
z2oOLuB<%jII|sdXDt@!b!fG|ZWpl{N7JN)y_%F(Is+IOx6=99XOz72nab)Zzw+EY&
zNsNo1e$pn)3xD<r(iKwvvc6!jo$ElwE%yj)!5u03(IXxZdv*g%Q28iw7l2lY$$=F>
zxD(spjh(N~+^?Rgt><aT9o`W88jU+Yc8lOJ9zfLj9gaOd<eMD-JCH#w_q5>NWWZlZ
zQD*fhW;+T6^I406he?~}E#!86+fIkFvMaxwEbdotfZ|VjUE#zY@rDv{Lp1|k9&hrJ
z?-&oqS=b9dDJc7nfwt|e<OPdo(E+yd%HqOh+ny5X>;y%AJ80GQmM+3<_g!tm!Q2^0
z_mhni>RpCUE@*(;2`qTU_<}AWHgwQ(g>fYI1E9OFPqPh-@n2{vs}6nCA>3jbZ2^#q
z(j?wTR7PDeC>w5UM>om2&)g*w4&M^h+81jjyd~bJP!P9n%;@HPOi#)!M0gE+b=K=}
zR~+@M8pQ#T8FY9ECZv3C`U8BB>qE^##&V$+84-113!t2{ucK8|H*X@h?J)gu50y3P
zTsw(SIg(v_yD}mX9;X*7P|b-Qe}@e>F)AJl{eCa2kGHm`th3(#W;~59Dt+7eZnuCX
znzME%jM8TO`|jJ$G{kzvpScPp<P+67K?h*R@j}jHp0CXLubZcHyJ8PW!VvIT5IXGQ
z0y|?SWmD7kmR>#*LBVbAd?t2PcR8v9uJ~2YYJfGA6)wo!pM5+re_zr2VC0hS(G<Cd
z@06M+Kk;X9%LN!X0X!w%e;Imucji5>J)F#{jrhU5+6DD~-rkYrSNN)<v!-RLz{>C6
zLGYf*s<I+?^>)MGn@wLIHrxfc{pGT5pVHP6{6p0ca}&^m+5!5jzNnY55?Jr^SU8!E
zEwSPZtp3l!vE$}aExB*mk^OUyWtY!|!)ZLH*sMHd<MX4eW!BU5dz`6yVvxDW$<y{!
zs~#_fNQy?nsSi858g9c}(ExlXx6e4&!)$o(#%$HmkfOfQ9`doUu5Z-eZ764qP`#2X
zVVIRvk2?%RN!J!rIu5CIl3zAGwwVPHuY{>=61SNi4^LHaIkpEBUfDCtfOs%3fV3zd
z&2>zgM&_n!uz4E|0<b8Ts#Ak*%|gyh`S1sL+tKM1h4KwH0&YG&;dq%7hTo9!>ojfI
zf29~2^gsayJ0*q_zqb$+e}jznigC^HB9fI|+%0k#|FLPgi>BzvE;o66+KROiV~Q3?
zc(CZWtpRuw2ix4buX$dWRZW+yRtCl(fMuJ|C3-``o*~)7n?XO_7ZN~<@KT4E1()l)
zygdWq+?%6ONd|lE;p<xsArfLFy7;&~@55UX_PBf9`6gaP&peg+xeo9$Rm@B+a}SSM
z79&gBZ>9p#r{t%hRt>Mx+P9?j22*4;zLF@^);?dDI!Pn6M=yudj&(33F`{ZE#X3qz
zq;LrHQ+?bl(6~2|aA3s+=iZ)6k1*i<q!GVgD}kH<hcR(c#c-`#F)UsCmMC#da`W@9
zO_Pky@Af+KFM{qUA8z+ce3V}og0rZ@6Yyl1cx!|D7Ecch@4Og;|0ujiy>R%Wn;dE8
zy0bPgi2+{IpQ=;}p!x|ugKsaj!?pV32I8V%UJF>Sm4U>c5+4eKy|NI%lc{g|IZW(R
z1Bs?+?}GuYj<T<>ESX(?Evxdsta)|x==AYi^$N$>_P5S=-R}htrR7br4!=(gOo_HE
zJ{``!eE~qvV$2tUw#(Hi_kZ_^{P;B^S^9KP`Td}^87nJm3F%oR>h1;8HV(TLG=j^$
z1MH&SClbxHkWg!Xa9o^H|BWC@S;RE7Pc43>{yBoEbH)EWJK?f%?Azkp7AUj5nasvP
z@p4Mi7c8*$>Iu&(<e)nPHkg6&iOrRb^6~oSOymm@^=kEZG%r|j{xLqTr9(<;_n{FL
z_T)Of{Sy#>N|d-IqV4!xt=@L2`IvP75}<xO^Yy=*zt7CV77v>%q@|=FPJ#VPTjfbb
zwbR=QXP1ZZZ^pwJ8Loje$E}z(Z6=I50r=0zCHyvAGo3tvMS<fZo89!r%ypGR(JC2$
z{E7x93{b?C$)hAtYMrV+j#qmeICA&^bM{TLEgX7n&uwy@(FFFQ2m-u6_ux>xp}t57
W;3(aKZ2WuT0Ul`@YSgJY#r_Z9jayg%

literal 0
HcmV?d00001