From 442a1348d8aadc2192edde569dbefbf85394f9aa Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 21 Aug 2018 20:10:20 +0200 Subject: [PATCH 1/5] Change IPA defaults and improve realm discovery Resolves: rhbz#1575538 Resolves: rhbz#1145777 --- ...NetBIOS-name-in-keytab-while-leaving.patch | 44 +++++-- 0001-Fix-issues-found-by-Coverity.patch | 42 +++++++ ...ange-qualified-names-default-for-IPA.patch | 113 ++++++++++++++++++ ...try-to-get-domain-name-from-hostname.patch | 76 ++++++++++++ realmd.spec | 14 ++- 5 files changed, 275 insertions(+), 14 deletions(-) create mode 100644 0001-Fix-issues-found-by-Coverity.patch create mode 100644 0002-Change-qualified-names-default-for-IPA.patch create mode 100644 0003-discover-try-to-get-domain-name-from-hostname.patch diff --git a/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch b/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch index 69f6aa3..894fe93 100644 --- a/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch +++ b/0001-Find-NetBIOS-name-in-keytab-while-leaving.patch @@ -1,4 +1,4 @@ -From d0d36965cce7a9bdff77c20ce9c9c1252b8c827c Mon Sep 17 00:00:00 2001 +From b11d891a50c2f70e3c02b880e0199583b8df186c Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Thu, 31 May 2018 16:16:08 +0200 Subject: [PATCH] Find NetBIOS name in keytab while leaving @@ -10,10 +10,10 @@ entries and use the NAME as the NetBIOS name. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1370457 --- - service/realm-kerberos.c | 64 ++++++++++++++++++++++++++++++++++++++++++++ + service/realm-kerberos.c | 64 ++++++++++++++++++++++++++++++++++++ service/realm-kerberos.h | 2 ++ - service/realm-samba-enroll.c | 13 ++++++--- - 3 files changed, 76 insertions(+), 3 deletions(-) + service/realm-samba-enroll.c | 17 ++++++++-- + 3 files changed, 80 insertions(+), 3 deletions(-) diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c index 54d1ed7..d6d109f 100644 @@ -101,7 +101,7 @@ index 0447e4d..58cfe07 100644 const gchar * realm_kerberos_get_realm_name (RealmKerberos *self); diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c -index 76e7b79..03f56d0 100644 +index 76e7b79..f5edca3 100644 --- a/service/realm-samba-enroll.c +++ b/service/realm-samba-enroll.c @@ -85,7 +85,8 @@ static JoinClosure * @@ -114,20 +114,38 @@ index 76e7b79..03f56d0 100644 { JoinClosure *join; gchar *workgroup; -@@ -106,6 +107,12 @@ join_closure_init (GTask *task, +@@ -93,6 +94,7 @@ join_closure_init (GTask *task, + int temp_fd; + const gchar *explicit_computer_name = NULL; + const gchar *authid = NULL; ++ gchar *name_from_keytab = NULL; + + join = g_new0 (JoinClosure, 1); + join->disco = realm_disco_ref (disco); +@@ -106,6 +108,14 @@ join_closure_init (GTask *task, else if (disco->explicit_netbios) authid = disco->explicit_netbios; -+ /* try to get the NetBIOS name from the keytab as last option while -+ * leaving the domain */ -+ if (authid == NULL && !do_join) { -+ authid = realm_kerberos_get_netbios_name_from_keytab(disco->kerberos_realm); ++ /* try to get the NetBIOS name from the keytab while leaving the domain */ ++ if (explicit_computer_name == NULL && !do_join) { ++ name_from_keytab = realm_kerberos_get_netbios_name_from_keytab(disco->kerberos_realm); ++ if (name_from_keytab != NULL) { ++ authid = name_from_keytab; ++ } + } + join->config = realm_ini_config_new (REALM_INI_NO_WATCH | REALM_INI_PRIVATE); realm_ini_config_set (join->config, REALM_SAMBA_CONFIG_GLOBAL, "security", "ads", -@@ -393,7 +400,7 @@ realm_samba_enroll_join_async (RealmDisco *disco, +@@ -151,6 +161,7 @@ join_closure_init (GTask *task, + g_warning ("Couldn't create temp file in: %s", g_get_tmp_dir ()); + } + ++ g_free (name_from_keytab); + return join; + } + +@@ -393,7 +404,7 @@ realm_samba_enroll_join_async (RealmDisco *disco, g_return_if_fail (cred != NULL); task = g_task_new (NULL, NULL, callback, user_data); @@ -136,7 +154,7 @@ index 76e7b79..03f56d0 100644 explicit_computer_name = realm_options_computer_name (options, disco->domain_name); if (explicit_computer_name != NULL) { realm_diagnostics_info (invocation, "Joining using a manual netbios name: %s", -@@ -462,7 +469,7 @@ realm_samba_enroll_leave_async (RealmDisco *disco, +@@ -462,7 +473,7 @@ realm_samba_enroll_leave_async (RealmDisco *disco, JoinClosure *join; task = g_task_new (NULL, NULL, callback, user_data); @@ -146,5 +164,5 @@ index 76e7b79..03f56d0 100644 switch (cred->type) { case REALM_CREDENTIAL_PASSWORD: -- -2.14.4 +2.17.1 diff --git a/0001-Fix-issues-found-by-Coverity.patch b/0001-Fix-issues-found-by-Coverity.patch new file mode 100644 index 0000000..abb6782 --- /dev/null +++ b/0001-Fix-issues-found-by-Coverity.patch @@ -0,0 +1,42 @@ +From 1831748847715a13f0cc911a9a491eb8614d6682 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 14 Aug 2018 14:09:48 +0200 +Subject: [PATCH 1/3] Fix issues found by Coverity + +--- + service/realm-kerberos.c | 5 ++++- + service/realm-packages.c | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c +index d6d109f..252e256 100644 +--- a/service/realm-kerberos.c ++++ b/service/realm-kerberos.c +@@ -980,7 +980,10 @@ realm_kerberos_set_details (RealmKerberos *self, + if (name == NULL) + break; + value = va_arg (va, const gchar *); +- g_return_if_fail (value != NULL); ++ if (value == NULL) { ++ va_end (va); ++ g_return_if_reached (); ++ } + + values[0] = g_variant_new_string (name); + values[1] = g_variant_new_string (value); +diff --git a/service/realm-packages.c b/service/realm-packages.c +index 9a6984c..5976439 100644 +--- a/service/realm-packages.c ++++ b/service/realm-packages.c +@@ -567,7 +567,7 @@ lookup_required_files_and_packages (const gchar **package_sets, + g_ptr_array_add (packages, NULL); + *result_packages = (gchar **)g_ptr_array_free (packages, FALSE); + } else { +- g_ptr_array_free (files, TRUE); ++ g_ptr_array_free (packages, TRUE); + } + + if (result_files) { +-- +2.17.1 + diff --git a/0002-Change-qualified-names-default-for-IPA.patch b/0002-Change-qualified-names-default-for-IPA.patch new file mode 100644 index 0000000..4ac6c6d --- /dev/null +++ b/0002-Change-qualified-names-default-for-IPA.patch @@ -0,0 +1,113 @@ +From 21ab1fdd127d242a9b4e95c3c90dd2bf3159d149 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 14 Aug 2018 16:44:39 +0200 +Subject: [PATCH 2/3] Change qualified names default for IPA + +In a FreeIPA domain it is typically expected that the IPA accounts use +sort names while accounts from trusted domains have fully qualified +names. This is automatically done by SSSD's IPA provider so there is no +need to force fully qualified names in the SSSD configuration. + +Related to https://bugzilla.redhat.com/show_bug.cgi?id=1575538 +--- + service/realm-options.c | 9 +++++---- + service/realm-options.h | 3 ++- + service/realm-samba-winbind.c | 2 +- + service/realm-sssd-ad.c | 2 +- + service/realm-sssd-ipa.c | 2 +- + 5 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/service/realm-options.c b/service/realm-options.c +index bd804ea..34a209f 100644 +--- a/service/realm-options.c ++++ b/service/realm-options.c +@@ -98,7 +98,7 @@ realm_options_automatic_mapping (GVariant *options, + + if (realm_name && !option) { + section = g_utf8_casefold (realm_name, -1); +- mapping = realm_settings_boolean (realm_name, REALM_DBUS_OPTION_AUTOMATIC_ID_MAPPING, TRUE); ++ mapping = realm_settings_boolean (section, REALM_DBUS_OPTION_AUTOMATIC_ID_MAPPING, TRUE); + g_free (section); + } + +@@ -112,20 +112,21 @@ realm_options_automatic_join (const gchar *realm_name) + gboolean mapping; + + section = g_utf8_casefold (realm_name, -1); +- mapping = realm_settings_boolean (realm_name, "automatic-join", FALSE); ++ mapping = realm_settings_boolean (section, "automatic-join", FALSE); + g_free (section); + + return mapping; + } + + gboolean +-realm_options_qualify_names (const gchar *realm_name) ++realm_options_qualify_names (const gchar *realm_name, ++ gboolean def) + { + gchar *section; + gboolean qualify; + + section = g_utf8_casefold (realm_name, -1); +- qualify = realm_settings_boolean (realm_name, "fully-qualified-names", TRUE); ++ qualify = realm_settings_boolean (section, "fully-qualified-names", def); + g_free (section); + + return qualify; +diff --git a/service/realm-options.h b/service/realm-options.h +index 7a1355e..b71d219 100644 +--- a/service/realm-options.h ++++ b/service/realm-options.h +@@ -37,7 +37,8 @@ const gchar * realm_options_user_principal (GVariant *options, + gboolean realm_options_automatic_mapping (GVariant *options, + const gchar *realm_name); + +-gboolean realm_options_qualify_names (const gchar *realm_name); ++gboolean realm_options_qualify_names (const gchar *realm_name, ++ gboolean def); + + gboolean realm_options_check_domain_name (const gchar *domain_name); + +diff --git a/service/realm-samba-winbind.c b/service/realm-samba-winbind.c +index 9335e26..61988eb 100644 +--- a/service/realm-samba-winbind.c ++++ b/service/realm-samba-winbind.c +@@ -102,7 +102,7 @@ realm_samba_winbind_configure_async (RealmIniConfig *config, + "winbind enum groups", "no", + "winbind offline logon", "yes", + "winbind refresh tickets", "yes", +- "winbind use default domain", realm_options_qualify_names (domain_name )? "no" : "yes", ++ "winbind use default domain", realm_options_qualify_names (domain_name, TRUE )? "no" : "yes", + "template shell", realm_settings_string ("users", "default-shell"), + NULL); + +diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c +index 8543ca8..de7ce30 100644 +--- a/service/realm-sssd-ad.c ++++ b/service/realm-sssd-ad.c +@@ -172,7 +172,7 @@ configure_sssd_for_domain (RealmIniConfig *config, + gchar *home; + + home = realm_sssd_build_default_home (realm_settings_string ("users", "default-home")); +- qualify = realm_options_qualify_names (disco->domain_name); ++ qualify = realm_options_qualify_names (disco->domain_name, TRUE); + shell = realm_settings_string ("users", "default-shell"); + explicit_computer_name = realm_options_computer_name (options, disco->domain_name); + realmd_tags = g_string_new (""); +diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c +index ff1dc8a..5029f6b 100644 +--- a/service/realm-sssd-ipa.c ++++ b/service/realm-sssd-ipa.c +@@ -201,7 +201,7 @@ on_ipa_client_do_restart (GObject *source, + + realm_sssd_config_update_domain (config, domain, &error, + "cache_credentials", "True", +- "use_fully_qualified_names", realm_options_qualify_names (domain) ? "True" : "False", ++ "use_fully_qualified_names", realm_options_qualify_names (domain, FALSE) ? "True" : "False", + "krb5_store_password_if_offline", "True", + "default_shell", shell, + "fallback_homedir", home, +-- +2.17.1 + diff --git a/0003-discover-try-to-get-domain-name-from-hostname.patch b/0003-discover-try-to-get-domain-name-from-hostname.patch new file mode 100644 index 0000000..b611d6c --- /dev/null +++ b/0003-discover-try-to-get-domain-name-from-hostname.patch @@ -0,0 +1,76 @@ +From 5e28cf702ad338e399f8fff0b3fa18736a297318 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 21 Aug 2018 13:09:20 +0200 +Subject: [PATCH 3/3] discover: try to get domain name from hostname + +If there is no domain name returned by DHCP check if the hostname +contains a domain part and use this to discover a realm. + +Related to https://bugzilla.redhat.com/show_bug.cgi?id=1619162 +--- + service/realm-provider.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +diff --git a/service/realm-provider.c b/service/realm-provider.c +index d647c7a..258e8e1 100644 +--- a/service/realm-provider.c ++++ b/service/realm-provider.c +@@ -28,6 +28,8 @@ + #include + #include + ++#include ++ + #define TIMEOUT_SECONDS 15 + + G_DEFINE_TYPE (RealmProvider, realm_provider, G_TYPE_DBUS_OBJECT_SKELETON); +@@ -181,6 +183,25 @@ on_discover_complete (GObject *source, + return_discover_result (method, realms, relevance, error); + } + ++static gchar * ++get_domain_from_hostname (void) ++{ ++ gchar hostname[HOST_NAME_MAX + 1]; ++ gchar *dot; ++ ++ if (gethostname (hostname, sizeof (hostname)) < 0) { ++ g_warning ("Couldn't get the computer host name: %s", g_strerror (errno)); ++ return NULL; ++ } ++ ++ dot = strchr (hostname, '.'); ++ if (dot != NULL) { ++ return g_strdup (dot + 1); ++ } ++ ++ return NULL; ++} ++ + static void + on_discover_default (GObject *source, + GAsyncResult *result, +@@ -195,6 +216,10 @@ on_discover_default (GObject *source, + g_clear_error (&error); + } + ++ if (method->string == NULL) { ++ method->string = get_domain_from_hostname (); ++ } ++ + if (method->string) { + g_strstrip (method->string); + if (g_str_equal (method->string, "")) { +@@ -210,7 +235,8 @@ on_discover_default (GObject *source, + on_discover_complete, method); + + } else { +- realm_diagnostics_info (method->invocation, "No default domain received via DHCP"); ++ realm_diagnostics_info (method->invocation, ++ "No default domain received via DHCP or given by hostname"); + return_discover_result (method, NULL, 0, NULL); + } + } +-- +2.17.1 + diff --git a/realmd.spec b/realmd.spec index c6dc189..69f8afb 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.16.3 -Release: 14%{?dist} +Release: 15%{?dist} Summary: Kerberos realm enrollment service License: LGPLv2+ URL: http://cgit.freedesktop.org/realmd/realmd/ @@ -16,6 +16,10 @@ Patch7: 0001-Use-current-idmap-options-for-smb.conf.patch Patch8: 0001-Find-NetBIOS-name-in-keytab-while-leaving.patch Patch9: 0001-tests-run-tests-with-python3.patch +Patch10: 0001-Fix-issues-found-by-Coverity.patch +Patch11: 0002-Change-qualified-names-default-for-IPA.patch +Patch12: 0003-discover-try-to-get-domain-name-from-hostname.patch + BuildRequires: gcc BuildRequires: automake BuildRequires: autoconf @@ -58,6 +62,9 @@ applications that use %{name}. %patch7 -p1 %patch8 -p1 %patch9 -p1 +%patch10 -p1 +%patch11 -p1 +%patch12 -p1 %build autoreconf -fi @@ -92,6 +99,11 @@ make install DESTDIR=%{buildroot} %doc ChangeLog %changelog +* Tue Aug 21 2018 Sumit Bose - 0.16.3-15 +- Change IPA defaults and improve realm discovery + Resolves: rhbz#1575538 + Resolves: rhbz#1145777 + * Sat Jul 14 2018 Fedora Release Engineering - 0.16.3-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 8fa8457c3b34c110ba312f1e487989fdd637a719 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Thu, 27 Sep 2018 13:26:48 +0200 Subject: [PATCH 2/5] Do not call authselect for IPA domains Resolves: rhbz#1620097 --- 0001-IPA-do-not-call-sssd-enable-logins.patch | 62 +++++++++++++++++++ realmd.spec | 9 ++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 0001-IPA-do-not-call-sssd-enable-logins.patch diff --git a/0001-IPA-do-not-call-sssd-enable-logins.patch b/0001-IPA-do-not-call-sssd-enable-logins.patch new file mode 100644 index 0000000..01fdef8 --- /dev/null +++ b/0001-IPA-do-not-call-sssd-enable-logins.patch @@ -0,0 +1,62 @@ +From 373f2e03736dfd87d50f02208b99d462cf34d891 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Thu, 27 Sep 2018 13:04:47 +0200 +Subject: [PATCH] IPA: do not call sssd-enable-logins + +It is expected that ipa-client-install will do all PAM and NSS +configuration. To avoid changing IPA default realmd will not try to +update the related configuration. +--- + service/realm-sssd-ipa.c | 24 +----------------------- + 1 file changed, 1 insertion(+), 23 deletions(-) + +diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c +index 5029f6b..70f8b0e 100644 +--- a/service/realm-sssd-ipa.c ++++ b/service/realm-sssd-ipa.c +@@ -109,41 +109,19 @@ enroll_closure_free (gpointer data) + g_free (enroll); + } + +-static void +-on_enable_nss_done (GObject *source, +- GAsyncResult *result, +- gpointer user_data) +-{ +- GTask *task = G_TASK (user_data); +- GError *error = NULL; +- gint status; +- +- status = realm_command_run_finish (result, NULL, &error); +- if (error == NULL && status != 0) +- g_set_error (&error, REALM_ERROR, REALM_ERROR_INTERNAL, +- _("Enabling SSSD in nsswitch.conf and PAM failed.")); +- if (error != NULL) +- g_task_return_error (task, error); +- else +- g_task_return_boolean (task, TRUE); +- g_object_unref (task); +-} +- + static void + on_restart_done (GObject *source, + GAsyncResult *result, + gpointer user_data) + { + GTask *task = G_TASK (user_data); +- EnrollClosure *enroll = g_task_get_task_data (task); + RealmSssd *sssd = g_task_get_source_object (task); + GError *error = NULL; + + realm_service_enable_and_restart_finish (result, &error); + if (error == NULL) { + realm_sssd_update_properties (sssd); +- realm_command_run_known_async ("sssd-enable-logins", NULL, enroll->invocation, +- on_enable_nss_done, g_object_ref (task)); ++ g_task_return_boolean (task, TRUE); + } else { + g_task_return_error (task, error); + } +-- +2.17.1 + diff --git a/realmd.spec b/realmd.spec index 69f8afb..2c4c30a 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.16.3 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Kerberos realm enrollment service License: LGPLv2+ URL: http://cgit.freedesktop.org/realmd/realmd/ @@ -20,6 +20,8 @@ Patch10: 0001-Fix-issues-found-by-Coverity.patch Patch11: 0002-Change-qualified-names-default-for-IPA.patch Patch12: 0003-discover-try-to-get-domain-name-from-hostname.patch +Patch13: 0001-IPA-do-not-call-sssd-enable-logins.patch + BuildRequires: gcc BuildRequires: automake BuildRequires: autoconf @@ -65,6 +67,7 @@ applications that use %{name}. %patch10 -p1 %patch11 -p1 %patch12 -p1 +%patch13 -p1 %build autoreconf -fi @@ -99,6 +102,10 @@ make install DESTDIR=%{buildroot} %doc ChangeLog %changelog +* Thu Sep 27 2018 Sumit Bose - 0.16.3-16 +- Do not call authselect for IPA domains + Resolves: rhbz#1620097 + * Tue Aug 21 2018 Sumit Bose - 0.16.3-15 - Change IPA defaults and improve realm discovery Resolves: rhbz#1575538 From 002b4a6a006d29f2cbe242552a93becf26c7581b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 2 Feb 2019 11:12:18 +0000 Subject: [PATCH 3/5] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- realmd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/realmd.spec b/realmd.spec index 2c4c30a..54f0c25 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.16.3 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Kerberos realm enrollment service License: LGPLv2+ URL: http://cgit.freedesktop.org/realmd/realmd/ @@ -102,6 +102,9 @@ make install DESTDIR=%{buildroot} %doc ChangeLog %changelog +* Sat Feb 02 2019 Fedora Release Engineering - 0.16.3-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Thu Sep 27 2018 Sumit Bose - 0.16.3-16 - Do not call authselect for IPA domains Resolves: rhbz#1620097 From f5073567bbf1e9e5389a9822c97ce3abef5bef39 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 21 Feb 2019 10:51:21 -0800 Subject: [PATCH 4/5] Backport fix to always install latest packages via PK https://gitlab.freedesktop.org/realmd/realmd/merge_requests/3 --- ...when-resolving-packages-with-Package.patch | 47 +++++++++++++++++++ realmd.spec | 8 +++- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch diff --git a/0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch b/0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch new file mode 100644 index 0000000..e8ba689 --- /dev/null +++ b/0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch @@ -0,0 +1,47 @@ +From fa6dd59c5eaabc8c7e540f2aa2ded6f785de0a13 Mon Sep 17 00:00:00 2001 +From: Adam Williamson +Date: Wed, 20 Feb 2019 11:12:04 -0800 +Subject: [PATCH] Set 'NEWEST' flag when resolving packages with PackageKit + +When resolving package names via PackageKit, realmd does not set +the PK_FILTER_ENUM_NEWEST flag that asks PK to only give the +*newest available* package for each package name. So if there +are three different versions of the package available in three +repositories, realmd winds up producing an array containing the +package IDs for all three of those packages and calling +InstallPackages on all of them. I don't know if PK's behaviour +in this case is defined or predictable, but in practice in at +least one case it reliably results in one of the older package +versions being installed. + +This does not seem desirable, we should always want to install +the newest available version. So let's set the NEWEST flag to +ensure this. + +A possible consequence here is that, if a newer version of the +package is not installable but an older version is, we will now +fail where previously we did not. But even in that case I don't +know if we would *reliably* succeed before, and silently +installing an older version still doesn't necessarily seem like +the right thing to do. + +Signed-off-by: Adam Williamson +--- + service/realm-packages.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/service/realm-packages.c b/service/realm-packages.c +index 5976439..0309c57 100644 +--- a/service/realm-packages.c ++++ b/service/realm-packages.c +@@ -343,6 +343,7 @@ packages_resolve_async (GDBusConnection *connection, + gpointer user_data) + { + guint64 flags = 1 << 18 /* PK_FILTER_ENUM_ARCH */; ++ flags |= 1 << 16 /* PK_FILTER_ENUM_NEWEST */; + package_transaction_create ("Resolve", g_variant_new ("(t^as)", flags, package_names), + connection, cancellable, callback, user_data); + } +-- +2.20.1 + diff --git a/realmd.spec b/realmd.spec index 54f0c25..d88fb90 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.16.3 -Release: 17%{?dist} +Release: 18%{?dist} Summary: Kerberos realm enrollment service License: LGPLv2+ URL: http://cgit.freedesktop.org/realmd/realmd/ @@ -22,6 +22,8 @@ Patch12: 0003-discover-try-to-get-domain-name-from-hostname.patch Patch13: 0001-IPA-do-not-call-sssd-enable-logins.patch +Patch14: 0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch + BuildRequires: gcc BuildRequires: automake BuildRequires: autoconf @@ -68,6 +70,7 @@ applications that use %{name}. %patch11 -p1 %patch12 -p1 %patch13 -p1 +%patch14 -p1 %build autoreconf -fi @@ -102,6 +105,9 @@ make install DESTDIR=%{buildroot} %doc ChangeLog %changelog +* Wed Feb 20 2019 Adam Williamson - 0.16.3-18 +- Backport fix from upstream to always install latest packages via PK + * Sat Feb 02 2019 Fedora Release Engineering - 0.16.3-17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From b2eef0c605aca61eab623c10eb5b6e03c1d9d3ed Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 22 Feb 2019 10:44:39 +0100 Subject: [PATCH 5/5] Fix test depending on order Resolves: rhbz#1675879 --- ...s-ignore-order-in-test_update_domain.patch | 82 +++++++++++++++++++ realmd.spec | 10 ++- 2 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 0001-tests-ignore-order-in-test_update_domain.patch diff --git a/0001-tests-ignore-order-in-test_update_domain.patch b/0001-tests-ignore-order-in-test_update_domain.patch new file mode 100644 index 0000000..2a84aba --- /dev/null +++ b/0001-tests-ignore-order-in-test_update_domain.patch @@ -0,0 +1,82 @@ +From b6753bd048b4012b11d60c094d1ab6ca181ee50d Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Thu, 21 Feb 2019 21:16:26 +0100 +Subject: [PATCH] tests: ignore order in test_update_domain + +Individual options of a domain or in general for a section in an ini +file are stored by realmd in a hash table. When writing out the ini file +the options can show up in any order and the unit tests should be aware +of it. + +Resolves: https://gitlab.freedesktop.org/realmd/realmd/issues/19 +--- + tests/test-sssd-config.c | 41 ++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 39 insertions(+), 2 deletions(-) + +diff --git a/tests/test-sssd-config.c b/tests/test-sssd-config.c +index 59eab75..8f3fec5 100644 +--- a/tests/test-sssd-config.c ++++ b/tests/test-sssd-config.c +@@ -163,12 +163,49 @@ test_add_domain_only (Test *test, + g_free (output); + } + ++static void check_for_test_update_domain (char *new) ++{ ++ char *token; ++ char *saveptr; ++ size_t c; ++ int result = 0; ++ ++ token = strtok_r (new, "\n", &saveptr); ++ g_assert_nonnull (token); ++ g_assert_cmpstr (token, ==, "[domain/one]"); ++ ++ for (c = 0; c < 3; c++) { ++ token = strtok_r (NULL, "\n", &saveptr); ++ g_assert_nonnull (token); ++ if (strcmp (token, "val=1") == 0) { ++ result += 1; ++ } else if (strcmp (token, "uno = 1") == 0) { ++ result += 2; ++ } else if (strcmp (token, "eins = one") == 0) { ++ result += 4; ++ } else { ++ g_assert_not_reached (); ++ } ++ } ++ g_assert_cmpint (result, ==, 7); ++ ++ token = strtok_r (NULL, "\n", &saveptr); ++ g_assert_nonnull (token); ++ g_assert_cmpstr (token, ==, "[sssd]"); ++ ++ token = strtok_r (NULL, "\n", &saveptr); ++ g_assert_nonnull (token); ++ g_assert_cmpstr (token, ==, "domains=one"); ++ ++ token = strtok_r (NULL, "\n", &saveptr); ++ g_assert_null (token); ++} ++ + static void + test_update_domain (Test *test, + gconstpointer unused) + { + const gchar *data = "[domain/one]\nval=1\n[sssd]\ndomains=one"; +- const gchar *check = "[domain/one]\nval=1\nuno = 1\neins = one\n[sssd]\ndomains=one"; + GError *error = NULL; + gchar *output; + gboolean ret; +@@ -190,7 +227,7 @@ test_update_domain (Test *test, + g_assert_no_error (error); + g_assert (ret == TRUE); + +- g_assert_cmpstr (check, ==, output); ++ check_for_test_update_domain (output); + g_free (output); + } + +-- +2.20.1 + diff --git a/realmd.spec b/realmd.spec index d88fb90..f81a975 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.16.3 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Kerberos realm enrollment service License: LGPLv2+ URL: http://cgit.freedesktop.org/realmd/realmd/ @@ -24,6 +24,9 @@ Patch13: 0001-IPA-do-not-call-sssd-enable-logins.patch Patch14: 0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch +# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1675879 +Patch15: 0001-tests-ignore-order-in-test_update_domain.patch + BuildRequires: gcc BuildRequires: automake BuildRequires: autoconf @@ -71,6 +74,7 @@ applications that use %{name}. %patch12 -p1 %patch13 -p1 %patch14 -p1 +%patch15 -p1 %build autoreconf -fi @@ -105,6 +109,10 @@ make install DESTDIR=%{buildroot} %doc ChangeLog %changelog +* Thu Feb 21 2019 Sumit Bose - 0.16.3-19 +- fix test depending on order + Resolves: rhbz#1675879 + * Wed Feb 20 2019 Adam Williamson - 0.16.3-18 - Backport fix from upstream to always install latest packages via PK