This is the maximum lifetime currently allowed by the Fedora KDC.
Having a ticket with a lifetime longer than 24 hours makes the ticket easier to renew if one logs into ones computer at around the same time every day.
MIT Kerberos build gained capability to obtain Anonymous PKINIT ticket
automatically and use it to build a FAST channel armor during initial
ticket acquisition. This allows automatic enablement of passwordless
pre-authentication methods provided by FreeIPA.
The option is ignored by the Kerberos builds which do not have such
support. Once Kerberos packages upgraded, users will be able to see
requests for their OTP tokens in bare kinit command:
$ kinit user
Enter OTP token value:
instead of using
$ kinit -c fast.ccache -n @FEDORAPROJECT.ORG
$ kinit -T fast.ccache user
Enter OTP token value:
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
This is the known file for setting the FAS user for Fedora infrastructure
client tools to use when the local Unix user does not match the FAS user.
Adding support for this with fkinit makes it easier to use in containerized
environments.
I named it "riscv" (instead of "risc-v", or "riscv64") because the Koji
URLs begins with it: https://riscv-koji.fedoraproject.org/koji.
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
The pre-1.0 version of fedora-packager lacked the dependency on
fedora-packager-kerberos, so if we were updating from that version (such
as on Fedora 40), fedora-packager-kerberos would attempt to upgrade
while the fedora-packager package remained at the older version and they
would encounter a file conflict.
This patch adds the reverse dependency on fedora-packager-kerberos to
ensure that they are both upgraded together.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
This allows me to run:
$ FKINIT_OTP=$(ykman oath accounts code accounts.fedoraproject.org --single) fkinit
I can even alias this:
$ alias fkinit='FKINIT_OTP=$(ykman oath accounts code accounts.fedoraproject.org --single) fkinit'
And the invocation then looks like this:
$ fkinit
Touch your YubiKey...
🔐 FAS password: (press TAB for no echo)
Signed-off-by: Miro Hrončok <miro@hroncok.cz>
For added security, pass the password and OTP directly via a BASH
herestring instead of via `echo`. This will avoid putting the value into
the process table.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
fedora-review is included in the packages to install in Installing
Packager Tools [1], the only other package being fedora-packager. Make
the setup a bit simpler by getting everything from fedora-packager.
(As a side note, nothing in Package Maintainer Docs actually mentions
*using* fedora review. So the other way to fix the issue would be to
not ask to install fedora-review in Installing Packager Tools. But
since it is a useful packager tool, it seems valid to included it in
fedora-packager.)
[1]: https://docs.fedoraproject.org/en-US/package-maintainers/Installing_Packager_Tools/
This is needed for `koji edit-sidetag` e.g. for bootstrapping:
```
koji edit-sidetag --rpm-macro _with_bootstrap=1 <sidetag_name>
```
Signed-off-by: Michel Lind <salimma@fedoraproject.org>
This fixes the spec file syntax. I tried to use Coflicts in a way that
is not supported by rpm.
But also, I think we should use Requires here. The importance of
kerberos auth has only grown since this package was split out, and it
doesn't make sense to have a "fedora packager environment" without
kerberos.
In CI tests, we get this:
Warning: skipped PGP checks for 1 package from repository: testing-farm-tag-repository
- file /usr/share/licenses/fedora-packager/COPYING from install of fedora-packager-0.6.0.7-10.fc41.noarch conflicts with file from package fedora-packager-kerberos-0.6.0.7-16.fc41.noarch
We don't want to install mismatched versions of the main package and the
subpackage in any case. This could lead to confusion.
Also runs 'klist' afterwards to confirm success.
This adds an explicit dependency on 'systemd' for the use of the
systemd-ask-password command. As that package was already an indirect
dependency, this doesn't increase the footprint.
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
Originally submitted and reviewed in
https://pagure.io/fedora-packager/pull-request/179.
The project was always licensed as GPLv2+, but the license file was
changed from GPLv2 to GPLv3 during a cleanup. (GPL was the file for
the project, and COPYING was a symlink to automake's COPYING file.)
commit 139f99fc38eca529cc74c2763d5dbe84465829bb
Author: Todd Zullinger <tmz@pobox.com>
Date: Thu Jan 29 15:46:18 2009 -0600
Remove generated files and other autotools cruft
---
COPYING | 1 -
GPL | 339 ----
...
commit e23766acb2e084fe845e23392192deb5b1aaec1e
Author: Todd Zullinger <tmz@pobox.com>
Date: Thu Jan 29 15:46:18 2009 -0600
Restore COPYING as a regular file
---
COPYING | 674 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 674 insertions(+), 0 deletions(-)
create mode 100644 COPYING
Restore the original GPLv2 text so that the declared license matches
the license text.
There is no point in having a separate upstream, there are no other
users of that project except for Fedora. My moving the few files that
we need here, we can simplify the workflow quite a bit.
Difference in build outputs:
$ rpmdiff -iT noarch/fedora-packager-0.6.0.7-{11,12}.fc41.noarch.rpm
removed REQUIRES config(fedora-packager) = 0.6.0.7-11.fc41
added REQUIRES config(fedora-packager) = 0.6.0.7-12.fc41
removed PROVIDES config(fedora-packager) = 0.6.0.7-11.fc41
added PROVIDES config(fedora-packager) = 0.6.0.7-12.fc41
removed PROVIDES fedora-packager = 0.6.0.7-11.fc41
added PROVIDES fedora-packager = 0.6.0.7-12.fc41
removed REQUIRES rpmlib(PartialHardlinkSets) <= 4.0.4-1
removed /usr/share/doc/fedora-packager
removed /usr/share/doc/fedora-packager/AUTHORS
removed /usr/share/doc/fedora-packager/ChangeLog
removed /usr/share/doc/fedora-packager/TODO
$ rpmdiff -iT noarch/fedora-packager-kerberos-0.6.0.7-{11,12}.fc41.noarch.rpm
removed REQUIRES config(fedora-packager-kerberos) = 0.6.0.7-11.fc41
added REQUIRES config(fedora-packager-kerberos) = 0.6.0.7-12.fc41
removed PROVIDES config(fedora-packager-kerberos) = 0.6.0.7-11.fc41
added PROVIDES config(fedora-packager-kerberos) = 0.6.0.7-12.fc41
removed PROVIDES fedora-packager-kerberos = 0.6.0.7-11.fc41
added PROVIDES fedora-packager-kerberos = 0.6.0.7-12.fc41
removed /usr/share/licenses/fedora-packager-kerberos
removed /usr/share/licenses/fedora-packager-kerberos/COPYING
added /usr/share/licenses/fedora-packager
added /usr/share/licenses/fedora-packager/COPYING
The three doc files are dropped because they are completely outdated
and incomplete and it doesn't make sense to install them.
The COPYING files is shared because that's simpler.
Breaks out the kerberos configs into own subpackage so that users
who want to connect to kerberos but not install all the depenencies
of `fedora-packager` can do that.
Fixes https://pagure.io/fedora-packager/issue/152
Signed-off-by: Dusty Mabe <dusty@dustymabe.com>
