Use different method to keep /usr/bin/ipa on Python 2

Fixes #1426847 - cannot upgrade freeipa-client on rawhide

Thanks to Petr Viktorin for coming up with the change

freeipa.spec

@@ -38,7 +38,7 @@
 
 Name:           freeipa
 Version:        %{VERSION}
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 Group:          System Environment/Base
@@ -762,6 +762,11 @@ ln -s %{_bindir}/ipa-test-task-%{python2_version} %{buildroot}%{_bindir}/ipa-tes
 make client-install DESTDIR=%{buildroot}
 %endif # ONLY_CLIENT
 
+# Move /usr/bin/ipa out of the way
+# XXX: ipa cli is not stable enough for enabling py3 support, keep it in py2
+# in any case
+mv %{buildroot}%{_bindir}/ipa %{buildroot}%{_bindir}/ipa-py2
+
 %if 0%{?with_python3}
 (cd ipalib && make PYTHON=%{__python3} IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} DESTDIR=%{buildroot} install)
 (cd ipapython && make PYTHON=%{__python3} IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} DESTDIR=%{buildroot} install)
@@ -769,10 +774,9 @@ make client-install DESTDIR=%{buildroot}
 (cd ipaclient && %{__python3} setup.py install --root %{buildroot})
 %endif # with_python3
 
-# Switch shebang of /usr/bin/ipa
-# XXX: ipa cli is not stable enough for enabling py3 support, keep it in py2
-# in any case
-sed -i -e'1s/python\(3\|$\)/python2/' %{buildroot}%{_bindir}/ipa
+# Use Python 2 version of /usr/bin/ipa
+# XXX: see comment above
+mv %{buildroot}%{_bindir}/ipa-py2 %{buildroot}%{_bindir}/ipa
 
 %find_lang %{gettext_domain}
 
@@ -1481,6 +1485,10 @@ fi
 %endif # ONLY_CLIENT
 
 %changelog
+* Wed Mar  1 2017 Alexander Bokovoy <abokovoy@redhat.com> - 4.4.3-8
+- Use different method to keep /usr/bin/ipa on Python 2
+- Fixes #1426847
+
 * Mon Feb 27 2017 Tomas Krizek <tkrizek@redhat.com> - 4.4.3-7
 - Fixes #1413137 CVE-2017-2590 ipa: Insufficient permission check for
   ca-del, ca-disable and ca-enable commands