Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On 5.11.2014 21:11, Alexander Bokovoy wrote: On Wed, 05 Nov 2014, Martin Basti wrote: +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=Schema Compatibility,cn=plugins,cn=config # We need to run schema-compat pre-bind callback before Conditional ACK -- did you check upgrades from 3.3 version? I did upgrade from 3.3.5 to 4.1 and it worked ACK. Pushed to: master: 85eb17553f46bfb4446279037e324f825d3389bd ipa-4-1: f0bcf2b29553003af3e5dd35fb6c73752fc95e21 -- Petr Vobornik ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On 11/06/2014 09:40 AM, Petr Vobornik wrote: On 5.11.2014 21:11, Alexander Bokovoy wrote: On Wed, 05 Nov 2014, Martin Basti wrote: +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=Schema Compatibility,cn=plugins,cn=config # We need to run schema-compat pre-bind callback before Conditional ACK -- did you check upgrades from 3.3 version? I did upgrade from 3.3.5 to 4.1 and it worked ACK. Pushed to: master: 85eb17553f46bfb4446279037e324f825d3389bd ipa-4-1: f0bcf2b29553003af3e5dd35fb6c73752fc95e21 Hello, Just curious, this deadlock also exists in ipa-4-0. Is it planed to backport it into that branch ? thanks thierry ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On Thu, 06 Nov 2014, thierry bordaz wrote: On 11/06/2014 09:40 AM, Petr Vobornik wrote: On 5.11.2014 21:11, Alexander Bokovoy wrote: On Wed, 05 Nov 2014, Martin Basti wrote: +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=Schema Compatibility,cn=plugins,cn=config # We need to run schema-compat pre-bind callback before Conditional ACK -- did you check upgrades from 3.3 version? I did upgrade from 3.3.5 to 4.1 and it worked ACK. Pushed to: master: 85eb17553f46bfb4446279037e324f825d3389bd ipa-4-1: f0bcf2b29553003af3e5dd35fb6c73752fc95e21 Hello, Just curious, this deadlock also exists in ipa-4-0. Is it planed to backport it into that branch ? It applies fine to 4.0, I think we can add it there as well. -- / Alexander Bokovoy ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On 6.11.2014 10:41, Alexander Bokovoy wrote: On Thu, 06 Nov 2014, thierry bordaz wrote: On 11/06/2014 09:40 AM, Petr Vobornik wrote: On 5.11.2014 21:11, Alexander Bokovoy wrote: On Wed, 05 Nov 2014, Martin Basti wrote: +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=Schema Compatibility,cn=plugins,cn=config # We need to run schema-compat pre-bind callback before Conditional ACK -- did you check upgrades from 3.3 version? I did upgrade from 3.3.5 to 4.1 and it worked ACK. Pushed to: master: 85eb17553f46bfb4446279037e324f825d3389bd ipa-4-1: f0bcf2b29553003af3e5dd35fb6c73752fc95e21 Hello, Just curious, this deadlock also exists in ipa-4-0. Is it planed to backport it into that branch ? It applies fine to 4.0, I think we can add it there as well. Pushed to ipa-4-0: a56a6aff88e9f3fd092fe45056aeb19f15cc2f9f -- Petr Vobornik ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On Thu, 30 Oct 2014, thierry bordaz wrote: https://fedorahosted.org/freeipa/ticket/4635 From 0a72220fc2b8af160b20085f372ab55d997546b4 Mon Sep 17 00:00:00 2001 From: Thierry bordaz (tbordaz) tbor...@redhat.com Date: Wed, 29 Oct 2014 16:23:03 +0100 Subject: [PATCH] Deadlock in schema compat plugin (between automember_update_membership task and dse update) Defining schema-compat-ignore-subtree values for schema compat plugin config entries removes the default value (ignore: cn=tasks,cn=config). This default value prevented deadlocks. Schema plugin needs to scope the $SUFFIX and also any updates to its configuration. This change restrict the schema compat to those subtrees. It replaces the definition of ignored subtrees that would be too long for cn=config (tasks, mapping tree, replication, snmp..) https://fedorahosted.org/freeipa/ticket/4635 --- install/updates/10-schema_compat.update | 30 -- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/install/updates/10-schema_compat.update b/install/updates/10-schema_compat.update index 7b75ba532612bbdaf9c85f8c88b0c8b8454e5969..b8c79012d121116f9cf53908fbe4be9d3d82 100644 --- a/install/updates/10-schema_compat.update +++ b/install/updates/10-schema_compat.update @@ -18,15 +18,19 @@ add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq(ipaSudoRunAsUserCatego add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq(ipaSudoRunAsUserCategory,all,ALL,%deref_f(\ipaSudoRunAs\,\(objectclass=posixAccount)\,\uid\))' add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq(ipaSudoRunAsGroupCategory,all,ALL,%{ipaSudoRunAsExtGroup})' add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq(ipaSudoRunAsGroupCategory,all,ALL,%deref_f(\ipaSudoRunAsGroup\,\(objectclass=posixGroup)\,\cn\))' -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' # Change padding for host and userCategory so the pad returns the same value # as the original, '' or -. dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config replace: schema-compat-entry-attribute:'nisNetgroupTriple=(%link(%ifeq(\hostCategory\,\all\,\\,\%collect(\\\%{externalHost}\\\,\\\%deref(\\\memberHost\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\member\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\memberHost\\\,\\\member\\\,\\\fqdn\\\)\\\)\),-,,,%ifeq(\userCategory\,\all\,\\,\%collect(\\\%deref(\\\memberUser\\\,\\\uid\\\)\\\,\\\%deref_r(\\\member\\\,\\\uid\\\)\\\,\\\%deref_r(\\\memberUser\\\,\\\member\\\,\\\uid\\\)\\\)\),-),%{nisDomainName:-})::nisNetgroupTriple=(%link(%ifeq(\hostCategory\,\all\,\\,\%collect(\\\%{externalHost}\\\,\\\%deref(\\\memberHost\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\member\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\memberHost\\\,\\\member\\\,\\\fqdn\\\)\\\)\),%ifeq(\hostC! ategory\,\all\,\\,\-\),,,%ifeq(\userCategory\,\all\,\\,\%collect(\\\%deref(\\\memberUser\\\,\\\uid\\\)\\\,\\\%deref_r(\\\member\\\,\\\uid\\\)\\\,\\\%deref_r(\\\memberUser\\\,\\\member\\\,\\\uid\\\)\\\)\),%ifeq(\userCategory\,\all\,\\,\-\)),%{nisDomainName:-})' -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config default:objectClass: top @@ -41,19 +45,25 @@ default:schema-compat-entry-attribute: objectclass=device default:schema-compat-entry-attribute: objectclass=ieee802Device default:schema-compat-entry-attribute: cn=%{fqdn} default:schema-compat-entry-attribute: macAddress=%{macAddress} -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder} dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add:
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On 11/05/2014 03:19 PM, Alexander Bokovoy wrote: On Thu, 30 Oct 2014, thierry bordaz wrote: https://fedorahosted.org/freeipa/ticket/4635 From 0a72220fc2b8af160b20085f372ab55d997546b4 Mon Sep 17 00:00:00 2001 From: Thierry bordaz (tbordaz) tbor...@redhat.com Date: Wed, 29 Oct 2014 16:23:03 +0100 Subject: [PATCH] Deadlock in schema compat plugin (between automember_update_membership task and dse update) Defining schema-compat-ignore-subtree values for schema compat plugin config entries removes the default value (ignore: cn=tasks,cn=config). This default value prevented deadlocks. Schema plugin needs to scope the $SUFFIX and also any updates to its configuration. This change restrict the schema compat to those subtrees. It replaces the definition of ignored subtrees that would be too long for cn=config (tasks, mapping tree, replication, snmp..) https://fedorahosted.org/freeipa/ticket/4635 --- install/updates/10-schema_compat.update | 30 -- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/install/updates/10-schema_compat.update b/install/updates/10-schema_compat.update index 7b75ba532612bbdaf9c85f8c88b0c8b8454e5969..b8c79012d121116f9cf53908fbe4be9d3d82 100644 --- a/install/updates/10-schema_compat.update +++ b/install/updates/10-schema_compat.update @@ -18,15 +18,19 @@ add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq(ipaSudoRunAsUserCatego add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq(ipaSudoRunAsUserCategory,all,ALL,%deref_f(\ipaSudoRunAs\,\(objectclass=posixAccount)\,\uid\))' add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq(ipaSudoRunAsGroupCategory,all,ALL,%{ipaSudoRunAsExtGroup})' add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq(ipaSudoRunAsGroupCategory,all,ALL,%deref_f(\ipaSudoRunAsGroup\,\(objectclass=posixGroup)\,\cn\))' -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' # Change padding for host and userCategory so the pad returns the same value # as the original, '' or -. dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config replace: schema-compat-entry-attribute:'nisNetgroupTriple=(%link(%ifeq(\hostCategory\,\all\,\\,\%collect(\\\%{externalHost}\\\,\\\%deref(\\\memberHost\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\member\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\memberHost\\\,\\\member\\\,\\\fqdn\\\)\\\)\),-,,,%ifeq(\userCategory\,\all\,\\,\%collect(\\\%deref(\\\memberUser\\\,\\\uid\\\)\\\,\\\%deref_r(\\\member\\\,\\\uid\\\)\\\,\\\%deref_r(\\\memberUser\\\,\\\member\\\,\\\uid\\\)\\\)\),-),%{nisDomainName:-})::nisNetgroupTriple=(%link(%ifeq(\hostCategory\,\all\,\\,\%collect(\\\%{externalHost}\\\,\\\%deref(\\\memberHost\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\member\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\memberHost\\\,\\\member\\\,\\\fqdn\\\)\\\)\),%ifeq(\hostCategory\,\all\,\\,\-\),,,%ifeq(\userCategory\,\all\,\\,\%collect(\\\%deref(\\\memberUser\\\,\\\uid\\\)\\\,\\\%deref_r(\\\member\\\,\\\uid\\\)\\\,\\\%deref_r(\\\memberUser\\\,\\\member\\\,\\\uid\\\)\\\)\),%ifeq(\userCategory\,\all\,\\,\-\)),%{nisDomainName:-})' -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config default:objectClass: top @@ -41,19 +45,25 @@ default:schema-compat-entry-attribute: objectclass=device default:schema-compat-entry-attribute: objectclass=ieee802Device default:schema-compat-entry-attribute: cn=%{fqdn} default:schema-compat-entry-attribute: macAddress=%{macAddress} -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder} dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree:
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On 05/11/14 15:37, thierry bordaz wrote: On 11/05/2014 03:19 PM, Alexander Bokovoy wrote: On Thu, 30 Oct 2014, thierry bordaz wrote: https://fedorahosted.org/freeipa/ticket/4635 From 0a72220fc2b8af160b20085f372ab55d997546b4 Mon Sep 17 00:00:00 2001 From: Thierry bordaz (tbordaz) tbor...@redhat.com Date: Wed, 29 Oct 2014 16:23:03 +0100 Subject: [PATCH] Deadlock in schema compat plugin (between automember_update_membership task and dse update) Defining schema-compat-ignore-subtree values for schema compat plugin config entries removes the default value (ignore: cn=tasks,cn=config). This default value prevented deadlocks. Schema plugin needs to scope the $SUFFIX and also any updates to its configuration. This change restrict the schema compat to those subtrees. It replaces the definition of ignored subtrees that would be too long for cn=config (tasks, mapping tree, replication, snmp..) https://fedorahosted.org/freeipa/ticket/4635 --- install/updates/10-schema_compat.update | 30 -- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/install/updates/10-schema_compat.update b/install/updates/10-schema_compat.update index 7b75ba532612bbdaf9c85f8c88b0c8b8454e5969..b8c79012d121116f9cf53908fbe4be9d3d82 100644 --- a/install/updates/10-schema_compat.update +++ b/install/updates/10-schema_compat.update @@ -18,15 +18,19 @@ add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq(ipaSudoRunAsUserCatego add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq(ipaSudoRunAsUserCategory,all,ALL,%deref_f(\ipaSudoRunAs\,\(objectclass=posixAccount)\,\uid\))' add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq(ipaSudoRunAsGroupCategory,all,ALL,%{ipaSudoRunAsExtGroup})' add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq(ipaSudoRunAsGroupCategory,all,ALL,%deref_f(\ipaSudoRunAsGroup\,\(objectclass=posixGroup)\,\cn\))' -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' # Change padding for host and userCategory so the pad returns the same value # as the original, '' or -. dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config replace: schema-compat-entry-attribute:'nisNetgroupTriple=(%link(%ifeq(\hostCategory\,\all\,\\,\%collect(\\\%{externalHost}\\\,\\\%deref(\\\memberHost\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\member\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\memberHost\\\,\\\member\\\,\\\fqdn\\\)\\\)\),-,,,%ifeq(\userCategory\,\all\,\\,\%collect(\\\%deref(\\\memberUser\\\,\\\uid\\\)\\\,\\\%deref_r(\\\member\\\,\\\uid\\\)\\\,\\\%deref_r(\\\memberUser\\\,\\\member\\\,\\\uid\\\)\\\)\),-),%{nisDomainName:-})::nisNetgroupTriple=(%link(%ifeq(\hostCategory\,\all\,\\,\%collect(\\\%{externalHost}\\\,\\\%deref(\\\memberHost\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\member\\\,\\\fqdn\\\)\\\,\\\%deref_r(\\\memberHost\\\,\\\member\\\,\\\fqdn\\\)\\\)\),%ifeq(\hostCategory\,\! all\,\\ ,\-\),,,%ifeq(\userCategory\,\all\,\\,\%collect(\\\%deref(\\\memberUser\\\,\\\uid\\\)\\\,\\\%deref_r(\\\member\\\,\\\uid\\\)\\\,\\\%deref_r(\\\memberUser\\\,\\\member\\\,\\\uid\\\)\\\)\),%ifeq(\userCategory\,\all\,\\,\-\)),%{nisDomainName:-})' -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config default:objectClass: top @@ -41,19 +45,25 @@ default:schema-compat-entry-attribute: objectclass=device default:schema-compat-entry-attribute: objectclass=ieee802Device default:schema-compat-entry-attribute: cn=%{fqdn} default:schema-compat-entry-attribute: macAddress=%{macAddress} -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder} dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config -add: schema-compat-ignore-subtree: cn=changelog -add: schema-compat-ignore-subtree: o=ipaca +remove: schema-compat-ignore-subtree: cn=changelog +remove: schema-compat-ignore-subtree:
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On Wed, 05 Nov 2014, Martin Basti wrote: +remove: schema-compat-ignore-subtree: o=ipaca +add: schema-compat-restrict-subtree: '$SUFFIX' +add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config' dn: cn=Schema Compatibility,cn=plugins,cn=config # We need to run schema-compat pre-bind callback before Conditional ACK -- did you check upgrades from 3.3 version? I did upgrade from 3.3.5 to 4.1 and it worked ACK. -- / Alexander Bokovoy ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 005 Deadlock in schema compat plugin (between automember_update_membership task and dse update)
On 30/10/14 14:47, thierry bordaz wrote: https://fedorahosted.org/freeipa/ticket/4635 I can't reproduce the deadlock, so ACK -- Martin Basti ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel