From 6781eb1365660963deb3df2e0dcd5d45ba48372f Mon Sep 17 00:00:00 2001
From: Fraser Tweedale <ftweedal@redhat.com>
Date: Tue, 31 May 2016 19:33:17 +1000
Subject: [PATCH 121/121] Lightweight CAs: remove pki-ipa-retrieve-key script

For the benefit of code locality and subsequent to the
generalisation of IPACustodiaKeyRetriever to
ExternalProcessKeyRetriever, the pki-ipa-retrieve-key script is
being moved to the FreeIPA codebase.

Part of: https://fedorahosted.org/pki/ticket/1625
---
 base/server/CMakeLists.txt               | 11 --------
 base/server/libexec/pki-ipa-retrieve-key | 45 --------------------------------
 specs/pki-core.spec                      |  1 -
 3 files changed, 57 deletions(-)
 delete mode 100755 base/server/libexec/pki-ipa-retrieve-key

diff --git a/base/server/CMakeLists.txt b/base/server/CMakeLists.txt
index 9e5b27833c8d023e63320c43d64ad64b0055c254..5a6aea96a2317655fb454967f9f218020443bcb8 100644
--- a/base/server/CMakeLists.txt
+++ b/base/server/CMakeLists.txt
@@ -81,17 +81,6 @@ install(
 
 install(
     DIRECTORY
-        libexec/
-    DESTINATION
-        ${LIBEXEC_INSTALL_DIR}
-    FILE_PERMISSIONS
-        OWNER_EXECUTE OWNER_WRITE OWNER_READ
-        GROUP_EXECUTE GROUP_READ
-        WORLD_EXECUTE WORLD_READ
-)
-
-install(
-    DIRECTORY
         upgrade
     DESTINATION
         ${DATA_INSTALL_DIR}/server/
diff --git a/base/server/libexec/pki-ipa-retrieve-key b/base/server/libexec/pki-ipa-retrieve-key
deleted file mode 100755
index 301f818b859577ef1a861bc7a855b6103a6f3af8..0000000000000000000000000000000000000000
--- a/base/server/libexec/pki-ipa-retrieve-key
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/python
-
-from __future__ import print_function
-
-import ConfigParser
-import base64
-import os
-import sys
-
-from jwcrypto.common import json_decode
-
-from ipalib import constants
-from ipaplatform.paths import paths
-from ipapython.secrets.client import CustodiaClient
-
-conf = ConfigParser.ConfigParser()
-conf.read(paths.IPA_DEFAULT_CONF)
-hostname = conf.get('global', 'host')
-realm = conf.get('global', 'realm')
-
-keyname = "ca_wrapped/" + sys.argv[1]
-servername = sys.argv[2]
-
-service = constants.PKI_GSSAPI_SERVICE_NAME
-client_keyfile = os.path.join(paths.PKI_TOMCAT, service + '.keys')
-client_keytab = os.path.join(paths.PKI_TOMCAT, service + '.keytab')
-
-client = CustodiaClient(
-    client=hostname, server=servername, realm=realm,
-    ldap_uri="ldaps://" + hostname,
-    client_servicename=service,
-    keyfile=client_keyfile, keytab=client_keytab,
-    )
-
-result_json = client.fetch_key(keyname, store=False)
-result = json_decode(result_json)
-certificate = result["certificate"]
-wrapped_key = base64.b64decode(result["wrapped_key"])
-
-# Custodia returns a PEM-encoded certificate and a base64-encoded
-# DER PKIArchiveOptions object.  Output these values, separated by a
-# null byte (certificate first), to be read by the Java
-# IPACustodiaKeyRetriever that invoked this program.
-
-print(certificate, wrapped_key, sep='\0', end='')
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index 04baec4f8f4a4aac1da793873e55e422672800c7..cdd087c11f0d03532bf2713db17cadcbd59bc031 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -1016,7 +1016,6 @@ systemctl daemon-reload
 %{_sbindir}/pki-server
 %{_sbindir}/pki-server-nuxwdog
 %{_sbindir}/pki-server-upgrade
-%{_libexecdir}/pki-ipa-retrieve-key
 %{python2_sitelib}/pki/server/
 %dir %{_datadir}/pki/deployment
 %{_datadir}/pki/deployment/config/
-- 
2.5.5