freeipa

#8882 Directly integrate custodia
Closed: fixed by ftweedal. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

IPA uses custodia, a general-purpose secret handler, to store passwords and private keys used within IPA.

custodia upstream hasn't seen a release in several years and runs the risk of bit-rotting.

Rather than rely on it as an external component integrate it directly into IPA server so we can keep a closer eye on it. No other packages in Fedora relies on it.

Upstream: https://github.com/latchset/custodia

By integrating it soon into IPA the standalone package can be dropped in c9s and in Fedora.

PR https://github.com/freeipa/freeipa/pull/5831 adds a subset of Custodia as ipaserver.custodia subpackage. CLI, IPA integration, sqlite store, and Python 2 support are removed. I did not include upstream tests. They need to be rewritten. Custodia tests use unittests package but IPA no longer accepts unittest-based tests.

master:

  • 1e98f310f6e5a33218ae5625c1a0a4f7b02692b7 Add Custodia 0.6.0 to ipaserver package
  • d27f01b2fbc9b539e57a5ce04914b76714ba4128 Remove unused Custodia modules
  • a4631b7f3f1eca068c3ff6fbfe91563dbe911c4b Fix Custodia imports
  • e1abfe0fb7079f47c63e65048b1a54fa32fe258a Fix Custodia pylint issues
  • c27233e3a0d4c02479bbb91a21bfa3b608931fcf Remove more unused Custodia code
  • 470bb6ed45b9b1b2391c2e12a11be7769807edcd Add Custodia tests
  • e6f09c1b5f59ce6487d5d34399926defb4471953 Also drop Custodia client and forwarder

ipa-4-9:

  • 1be15d2024f327bc846e5fe324dc24fb2a96a828 Add Custodia 0.6.0 to ipaserver package
  • d804f1feeddd31957bc3d88dfb79e9bd119813cb Remove unused Custodia modules
  • 02ece292ada0da25864bc71ed4f2f16d01933df5 Fix Custodia imports
  • 0ec775fcfa15f1da20841111484e1e25d9f13d38 Fix Custodia pylint issues
  • 7cb2c89d5900dc02df1e587dd87d7f820404cd92 Remove more unused Custodia code
  • cde5e2d4d7c36fadad492a7a753547297ffbaf60 Add Custodia tests
  • 62647ff3217331339e66170a0665b529e204be2e Also drop Custodia client and forwarder

I have retired custodia in Fedora Rawhide and requested addition of Custodia to unwanted packages.

  • https://src.fedoraproject.org/rpms/custodia/tree/rawhide
  • https://github.com/minimization/content-resolver-input/pull/608

@cheimes Do you agree we can close this?

Christian is on PTO but I will speak to it. Yes we can close it, closing now :)

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.