Bug 61395

Summary:	make it unambiguous which PKI implementation is supported
Product:	Sisyphus	Reporter:	Stanislav Levin <slev>
Component:	freeipa-server	Assignee:	Stanislav Levin <slev>
Status:	RESOLVED FIXED	QA Contact:	qa-sisyphus
Severity:	normal
Priority:	P5	CC:	liannnix, liannnix, sem, sin, slev
Version:	unstable
Hardware:	x86_64
OS:	Linux

Description

Stanislav Levin 2026-11-10 11:27:10 MSK

Historically, only Dogtag PKI has been supported, but an alternative exists:        
https://forge.fedoraproject.org/freeipa/ipacta                                   
                                                                                 
> A pure-Python Certificate Authority that replaces Dogtag PKI for               
  FreeIPA deployments. Built on the cryptography library, ipacta provides           
  a compatible REST API, CLI tools, and python3-pki client library that             
  FreeIPA expects, without requiring Java, Tomcat, or the Dogtag stack.             
                                                                                 
However, it's unclear whether it's production-ready or an experiment:            
ipacta landed in Fedora but not RHEL (yet).                                      
                                                                                 
In the meantime it's unpredictable which implementation is installed:            
```                                                                              
marked for install (shallow): freeipa-server                                     
 satisfying Depends: python3-module-pki-base >= 11.8.0                           
  maybe install (a providing target): python3-module-ipacta-pki 0.1.1-alt1:sisyphus+440250.300.3.1@1794117728
  maybe install (another providing target): python3-module-dogtag-pki 11.8.0-alt1:sisyphus+403798.1700.14.1@1771005344
 target SELECTED: python3-module-ipacta-pki 0.1.1-alt1:sisyphus+440250.300.3.1@1794117728
```                                                                              
                                                                                 
This is neither expected, wanted, nor supported. If that were ever               
the case, a separate package would be required, e.g. freeipa-server-ipacta.

Comment 1

Evgeny Sinelnikov 2026-11-10 11:43:21 MSK

Кроме того, кажется разумным - вытащить все части для замещения dogtag в пакете ipacta, в отдельный подпакет.

Comment 2

Stanislav Levin 2026-11-10 11:48:24 MSK

(In reply to Evgeny Sinelnikov from comment #1)
> Кроме того, кажется разумным - вытащить все части для замещения dogtag в
> пакете ipacta, в отдельный подпакет.

Если это когда-нибудь понадобится.

Comment 3

Repository Robot 2026-11-10 12:28:51 MSK

freeipa-4.13.4-alt6 -> sisyphus:

Tue Nov 10 2026 Stanislav Levin <slev@altlinux> 4.13.4-alt6
- Explicitly require Dogtag PKI (closes: #61395).