From fb16bc933c839b9ce1a57684de416feacd8ac6a2 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Tue, 29 May 2018 23:35:16 +0200 Subject: [PATCH] Require JSS 4.4.4 with fix for sub CA replication The SQL backend of NSS behaves differently than the DBM backend. Specifically PK11_UnwrapPrivateKey generates a different CKA_ID. JSS 4.4.4 contains a workaround for broken sub CA replication. Note: FreeIPA doesn't depend on JSS directly. The version requirement was added to update JSS to a working version See: https://bugzilla.redhat.com/show_bug.cgi?id=1583140 Fixes: https://pagure.io/freeipa/issue/7536 Signed-off-by: Christian Heimes Reviewed-By: Fraser Tweedale --- freeipa.spec.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/freeipa.spec.in b/freeipa.spec.in index 26781146f..10b7e9810 100755 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -378,7 +378,9 @@ Requires(post): systemd-units Requires: selinux-policy >= %{selinux_policy_version} Requires(post): selinux-policy-base >= %{selinux_policy_version} Requires: slapi-nis >= %{slapi_nis_version} -# 10.5.1-2 contains Python 3 vault fix +# jss is an indirect dependency. 4.4.4 fixes sub CA replication bug, +# see https://pagure.io/freeipa/issue/7536 +Requires: jss >= 4.4.4 Requires: pki-ca >= %{pki_version} Requires: pki-kra >= %{pki_version} Requires(preun): systemd-units