Blob Blame History Raw
From 77fae8c48bbe0f4499f4d8ed91b268568c64cd7c Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Thu, 11 Jun 2020 11:17:25 +0200
Subject: [PATCH] Move ipa-epn systemd files and run RPM hooks

The init/systemd directory is for server only and not part of
CLIENT_ONLY builds.

It's necesary to run pre/post installation hooks to make systemd aware
of new files.

Fixes: https://pagure.io/freeipa/issue/8367
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Francois Cami <fcami@redhat.com>
---
 .gitignore                                    |  4 +--
 client/Makefile.am                            |  1 +
 client/share/Makefile.am                      |  5 ++++
 {install => client}/share/expire_msg.template |  0
 client/systemd/Makefile.am                    | 27 +++++++++++++++++++
 {init => client}/systemd/ipa-epn.service.in   |  0
 {init => client}/systemd/ipa-epn.timer.in     |  0
 configure.ac                                  | 24 +++++++++++++++--
 freeipa.spec.in                               | 15 +++++++++++
 init/systemd/Makefile.am                      |  8 +++---
 install/share/Makefile.am                     |  5 ----
 server.m4                                     | 19 -------------
 12 files changed, 76 insertions(+), 32 deletions(-)
 rename {install => client}/share/expire_msg.template (100%)
 create mode 100644 client/systemd/Makefile.am
 rename {init => client}/systemd/ipa-epn.service.in (100%)
 rename {init => client}/systemd/ipa-epn.timer.in (100%)

#diff --git a/.gitignore b/.gitignore
#index 6584c3b4f..4cedb1ff2 100644
#--- a/.gitignore
#+++ b/.gitignore
#@@ -94,8 +94,6 @@ freeipa2-dev-doc
# /init/ipa_memcached
# /init/systemd/ipa-custodia.service
# /init/systemd/ipa.service
#-/init/systemd/ipa-epn.service
#-/init/systemd/ipa-epn.timer
# /init/tmpfilesd/ipa.conf
# 
# !/install/ui/doc/Makefile.in
#@@ -116,6 +114,8 @@ freeipa2-dev-doc
# /client/ipa-getkeytab
# /client/ipa-join
# /client/ipa-rmkeytab
#+/client/systemd/ipa-epn.service
#+/client/systemd/ipa-epn.timer
# 
# /ipaplatform/override.py
# /ipapython/version.py
diff --git a/client/Makefile.am b/client/Makefile.am
index 858a9369e..87da87fcd 100644
--- a/client/Makefile.am
+++ b/client/Makefile.am
@@ -95,6 +95,7 @@ SUBDIRS =			\
 	share		        \
 	man			\
 	sysconfig	        \
+	systemd			\
 	$(NULL)
 #       init                    
 
diff --git a/client/share/Makefile.am b/client/share/Makefile.am
index 6d4a62d5e..1402a3a9d 100644
--- a/client/share/Makefile.am
+++ b/client/share/Makefile.am
@@ -4,3 +4,8 @@ appdir = $(IPA_DATA_DIR)/client
 dist_app_DATA =				\
 	freeipa.template		\
 	$(NULL)
+
+epnconfdir = $(IPA_SYSCONF_DIR)/epn
+dist_epnconf_DATA =			\
+	expire_msg.template	\
+	$(NULL)
diff --git a/install/share/expire_msg.template b/client/share/expire_msg.template
similarity index 100%
rename from install/share/expire_msg.template
rename to client/share/expire_msg.template
diff --git a/client/systemd/Makefile.am b/client/systemd/Makefile.am
new file mode 100644
index 000000000..1f591be83
--- /dev/null
+++ b/client/systemd/Makefile.am
@@ -0,0 +1,27 @@
+# This file will be processed with automake-1.7 to create Makefile.in
+#
+AUTOMAKE_OPTIONS = 1.7
+
+NULL =
+
+dist_noinst_DATA = 			\
+	ipa-epn.service.in		\
+	ipa-epn.timer.in		\
+	$(NULL)
+
+systemdsystemunit_DATA = 	\
+	ipa-epn.service			\
+	ipa-epn.timer		\
+	$(NULL)
+
+CLEANFILES = $(systemdsystemunit_DATA)
+
+%: %.in Makefile
+	sed \
+		-e 's|@bindir[@]|$(bindir)|g' \
+		-e 's|@IPA_SYSCONF_DIR[@]|$(IPA_SYSCONF_DIR)|g' \
+		-e 's|@localstatedir[@]|$(localstatedir)|g' \
+		-e 's|@sbindir[@]|$(sbindir)|g' \
+		-e 's|@libexecdir[@]|$(libexecdir)|g' \
+		-e 's|@sysconfenvdir[@]|$(sysconfenvdir)|g' \
+		'$(srcdir)/$@.in' >$@
diff --git a/init/systemd/ipa-epn.service.in b/client/systemd/ipa-epn.service.in
similarity index 100%
rename from init/systemd/ipa-epn.service.in
rename to client/systemd/ipa-epn.service.in
diff --git a/init/systemd/ipa-epn.timer.in b/client/systemd/ipa-epn.timer.in
similarity index 100%
rename from init/systemd/ipa-epn.timer.in
rename to client/systemd/ipa-epn.timer.in
diff --git a/configure.ac b/configure.ac
index 5ec529088..586b2532a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -220,6 +220,25 @@ AC_ARG_WITH([runstatedir],
             [runstatedir="/run"])
 AC_SUBST([runstatedir])
 
+dnl ---------------------------------------------------------------------------
+dnl - Check for systemd directories
+dnl ---------------------------------------------------------------------------
+
+PKG_CHECK_EXISTS([systemd], [], [AC_MSG_ERROR([systemd not found])])
+AC_ARG_WITH([systemdsystemunitdir],
+            AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
+               [Directory for systemd service files]),
+            [systemdsystemunitdir=$with_systemdsystemunitdir],
+        [systemdsystemunitdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=systemdsystemunitdir systemd)])
+AC_SUBST([systemdsystemunitdir])
+
+AC_ARG_WITH([systemdtmpfilesdir],
+            AS_HELP_STRING([--with-systemdtmpfilesdir=DIR],
+               [Directory for systemd-tmpfiles configuration files]),
+            [systemdtmpfilesdir=$with_systemdtmpfilesdir],
+        [systemdtmpfilesdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=tmpfilesdir systemd)])
+AC_SUBST([systemdtmpfilesdir])
+
 dnl ---------------------------------------------------------------------------
 dnl - Server-only configuration
 dnl ---------------------------------------------------------------------------
@@ -544,6 +563,7 @@ AC_CONFIG_FILES([
     client/share/Makefile
     client/man/Makefile
     client/sysconfig/Makefile
+    client/systemd/Makefile
     contrib/completion/Makefile
     contrib/Makefile
     daemons/dnssec/Makefile
@@ -637,13 +657,13 @@ echo "
         jslint:                   ${JSLINT}
         LDAP libs:                ${LDAP_LIBS}
         OpenSSL crypto libs:      ${CRYPTO_LIBS}
-        KRB5 libs:                ${KRB5_LIBS}"
+        KRB5 libs:                ${KRB5_LIBS}
+        systemdsystemunitdir:     ${systemdsystemunitdir}"
 
 AM_COND_IF([ENABLE_SERVER], [
     echo "\
         KRAD libs:                ${KRAD_LIBS}
         krb5rundir:               ${krb5rundir}
-        systemdsystemunitdir:     ${systemdsystemunitdir}
         systemdtmpfilesdir:       ${systemdtmpfilesdir}
         build mode:               server & client"
 ], [
diff --git a/freeipa.spec.in b/freeipa.spec.in
index cec57e64e..1d8f4e6aa 100755
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -586,6 +586,10 @@ on the machine enrolled into a FreeIPA environment
 %package client-epn
 Summary: Tools to configure Expiring Password Notification in IPA
 Group: System Environment/Base
+Requires: systemd-units
+Requires(post): systemd-units
+Requires(preun): systemd-units
+Requires(postun): systemd-units
 Requires: %{name}-client = %{version}-%{release}
 
 %description client-epn
@@ -1003,6 +1007,17 @@ fi
 # ONLY_CLIENT
 %endif
 
+%preun client-epn
+%systemd_preun ipa-epn.service
+%systemd_preun ipa-epn.timer
+
+%postun client-epn
+%systemd_postun ipa-epn.service
+%systemd_postun ipa-epn.timer
+
+%post client-epn
+%systemd_post ipa-epn.service
+%systemd_post ipa-epn.timer
 
 %post client
 if [ $1 -gt 1 ] ; then
diff --git a/init/systemd/Makefile.am b/init/systemd/Makefile.am
index 5053dbff6..175178787 100644
--- a/init/systemd/Makefile.am
+++ b/init/systemd/Makefile.am
@@ -2,17 +2,17 @@
 #
 AUTOMAKE_OPTIONS = 1.7
 
+NULL =
+
 dist_noinst_DATA = 			\
 	ipa-custodia.service.in		\
 	ipa.service.in			\
-	ipa-epn.service.in		\
-	ipa-epn.timer.in
+	$(NULL)
 
 systemdsystemunit_DATA = 	\
 	ipa-custodia.service	\
 	ipa.service				\
-	ipa-epn.service			\
-	ipa-epn.timer
+	$(NULL)
 
 CLEANFILES = $(systemdsystemunit_DATA)
 
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index 496e81288..e95796dfb 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -106,8 +106,3 @@ dist_app_DATA =				\
 kdcproxyconfdir = $(IPA_SYSCONF_DIR)/kdcproxy
 dist_kdcproxyconf_DATA =			\
 	kdcproxy.conf
-
-epnconfdir = $(IPA_SYSCONF_DIR)/epn
-dist_epnconf_DATA =			\
-	expire_msg.template	\
-	$(NULL)
diff --git a/server.m4 b/server.m4
index d35823e80..842d599d2 100644
--- a/server.m4
+++ b/server.m4
@@ -153,22 +153,3 @@ dnl Check for libverto
 dnl ---------------------------------------------------------------------------
 
 PKG_CHECK_MODULES([LIBVERTO], [libverto])
-
-dnl ---------------------------------------------------------------------------
-dnl - Check for systemd directories
-dnl ---------------------------------------------------------------------------
-
-PKG_CHECK_EXISTS([systemd], [], [AC_MSG_ERROR([systemd not found])])
-AC_ARG_WITH([systemdsystemunitdir],
-            AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
-               [Directory for systemd service files]),
-            [systemdsystemunitdir=$with_systemdsystemunitdir],
-        [systemdsystemunitdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=systemdsystemunitdir systemd)])
-AC_SUBST([systemdsystemunitdir])
-
-AC_ARG_WITH([systemdtmpfilesdir],
-            AS_HELP_STRING([--with-systemdtmpfilesdir=DIR],
-               [Directory for systemd-tmpfiles configuration files]),
-            [systemdtmpfilesdir=$with_systemdtmpfilesdir],
-        [systemdtmpfilesdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=tmpfilesdir systemd)])
-AC_SUBST([systemdtmpfilesdir])
-- 
2.26.2

From 23e2935e5c5cb402dd4f6f44eaa4b013e6a8188a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Mon, 22 Jun 2020 16:39:02 +0200
Subject: [PATCH] EPN: ship the configuration file.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ship and install /etc/ipa/epn.conf.
Minor fixes to the associated man page.

Fixes: https://pagure.io/freeipa/issue/8374
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
---
 client/man/epn.conf.5    |  5 ++--
 client/share/Makefile.am |  7 +++++-
 client/share/epn.conf    | 54 ++++++++++++++++++++++++++++++++++++++++
 freeipa.spec.in          |  4 ++-
 4 files changed, 65 insertions(+), 5 deletions(-)
 create mode 100644 client/share/epn.conf

diff --git a/client/man/epn.conf.5 b/client/man/epn.conf.5
index 38e99e25d..14f5dbb75 100644
--- a/client/man/epn.conf.5
+++ b/client/man/epn.conf.5
@@ -71,11 +71,10 @@ Specifies the From e-mail address value in the e-mails sent. The default is
 root@localhost. Bounces will be sent here.
 .TP
 .B smtp_delay <milliseconds>
-Time to wait, in milliseconds, between each e-mail sent to try to avoid overloading the mail queue.
+Time to wait, in milliseconds, between each e-mail sent to try to avoid overloading the mail queue. The default is 0.
 .TP
 .B mail_from <address>
-Specifies the From: e-mal address value in the e-mails sent. The default is
-noreply@ipadefaultemaildomain. This value can be found by running
+Specifies the From: e-mail address value in the e-mails sent. The default is noreply@ipadefaultemaildomain. This value can be found by running
 .I ipa config-show
 .TP
 .B notify_ttls <list of days>
diff --git a/client/share/Makefile.am b/client/share/Makefile.am
index 1402a3a9d..472242e62 100644
--- a/client/share/Makefile.am
+++ b/client/share/Makefile.am
@@ -5,7 +5,12 @@ dist_app_DATA =				\
 	freeipa.template		\
 	$(NULL)
 
-epnconfdir = $(IPA_SYSCONF_DIR)/epn
+epnconfdir = $(IPA_SYSCONF_DIR)
 dist_epnconf_DATA =			\
+	epn.conf			\
+	$(NULL)
+
+epntemplatedir = $(IPA_SYSCONF_DIR)/epn
+dist_epntemplate_DATA =			\
 	expire_msg.template	\
 	$(NULL)
diff --git a/client/share/epn.conf b/client/share/epn.conf
new file mode 100644
index 000000000..0e590dfc3
--- /dev/null
+++ b/client/share/epn.conf
@@ -0,0 +1,54 @@
+# Global IPA-EPN [0] configuration file.
+# For a complete explanation of each parameter, see the epn.conf(5)
+# manual page.
+# For best results, change no more than a single parameter at a time,
+# and test if ipa-epn(1) still works as intended, using --dry-run when
+# it makes sense.
+#
+# [0] https://github.com/freeipa/freeipa/blob/master/doc/designs/expiring-password-notification.md
+
+[global]
+
+# Specifies the SMTP server to use. 
+smtp_server = localhost
+
+# Specifies the SMTP port.
+smtp_port = 25
+
+# Specifies the id of the user to authenticate with the SMTP server.
+# Default None (empty value).
+# smtp_user =
+
+# Specifies the password for the authorized user.
+# Default None (empty value).
+# smtp_password =
+
+# pecifies the number of seconds to wait for SMTP to respond.
+smtp_timeout = 60
+
+# Specifies the type of secure connection to make. Options are: none,
+# starttls and ssl.
+smtp_security = none
+
+# Specifies the From e-mail address value in the e-mails sent. Bounces will
+# be sent here.
+smtp_admin = root@localhost
+
+# Time to wait, in milliseconds, between each e-mail sent to try to avoid
+# overloading the mail queue.
+smtp_delay = 0
+
+# Specifies the From: e-mail address value in the e-mails sent.
+# The default when unset is noreply@ipadefaultemaildomain.
+# This value can be found by running ipa config-show.
+# mail_from =
+
+# The list of days before a password expiration when ipa-epn should notify
+# a user that their password will soon require a reset.
+notify_ttls = 28, 14, 7, 3, 1
+
+# Set the character set of the message.
+msg_charset = utf8
+
+# Set the message's MIME sub-content type.
+msg_subtype = plain
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 5bce6f118..8cca99697 100755
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -1387,13 +1387,15 @@ fi
 
 %files client-epn
 %doc README.md Contributors.txt
+%dir %{_sysconfdir}/ipa/epn
 %license COPYING
 %{_sbindir}/ipa-epn
 %{_mandir}/man1/ipa-epn.1*
 %{_mandir}/man5/epn.conf.5*
 %attr(644,root,root) %{_unitdir}/ipa-epn.service
 %attr(644,root,root) %{_unitdir}/ipa-epn.timer
-%attr(644,root,root) %{_sysconfdir}/ipa/epn/expire_msg.template
+%attr(600,root,root) %config(noreplace) %{_sysconfdir}/ipa/epn.conf
+%attr(644,root,root) %config(noreplace) %{_sysconfdir}/ipa/epn/expire_msg.template
 
 %files -n python3-ipaclient
 %doc README.md Contributors.txt
-- 
2.26.2

From 3b43950d35f78b28d4edde4fda475b5aa84f4587 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Tue, 23 Jun 2020 09:39:02 +0200
Subject: [PATCH] man pages: fix epn.conf.5 and ipa-epn.1 formatting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix formatting issues found with mandoc.

Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
---
 client/man/epn.conf.5 | 2 +-
 client/man/ipa-epn.1  | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/man/epn.conf.5 b/client/man/epn.conf.5
index 14f5dbb75..df1f0156c 100644
--- a/client/man/epn.conf.5
+++ b/client/man/epn.conf.5
@@ -16,7 +16,7 @@
 .\"
 .\" Author: Rob Crittenden <rcritten@@redhat.com>
 .\"
-.TH "epn.conf" "5" "Apr 28 2020" "FreeIPA" "FreeIPA Manual Pages"
+.TH "EPN.CONF" "5" "April 28, 2020" "FreeIPA" "FreeIPA Manual Pages"
 .SH "NAME"
 epn.conf \- Expiring Password Notification configuration file
 .SH "SYNOPSIS"
diff --git a/client/man/ipa-epn.1 b/client/man/ipa-epn.1
index 9999ea8ca..124fd4536 100644
--- a/client/man/ipa-epn.1
+++ b/client/man/ipa-epn.1
@@ -15,14 +15,14 @@
 .\" along with this program.  If not, see <http://www.gnu.org/licenses/>.
 .\"
 .\"
-.TH "ipa-epn" "1" "Apr 24 2020" "FreeIPA" "FreeIPA Manual Pages"
+.TH "IPA-EPN" "1" "April 24, 2020" "FreeIPA" "FreeIPA Manual Pages"
 .SH "NAME"
 ipa\-epn \- Send expiring password nofications
 .SH "SYNOPSIS"
-ipa\-epn \[options\]
+ipa\-epn \fR[options\fR]
 
 .SH "DESCRIPTION"
-ipa\-epn provides a method to warn users via email that their IPA account password is about to expire. 
+ipa\-epn provides a method to warn users via email that their IPA account password is about to expire.
 
 It can be used in dry\-run mode which is recommmended during setup. The output is always JSON in this case.
 
@@ -38,7 +38,7 @@ The \-\-to\-nbdays CLI option can be used to determine the number of notificatio
 
 If \fB\-\-from\-nbdays\fR is not specified, ipa\-epn will look within a 24\-hour long time range in <number of days> days.
 
-if \fB\-\-from\-nbdays\fR is specified, the date range starts at \fB\-\-from\-nbdays\fR days in the future and ends at \fB\-\-to\-nbdays\fR in the future. 
+if \fB\-\-from\-nbdays\fR is specified, the date range starts at \fB\-\-from\-nbdays\fR days in the future and ends at \fB\-\-to\-nbdays\fR in the future.
 
 Together, these two CLI options can be used to determine how many emails would be sent in a specific time in the future.
 
-- 
2.26.2

From 2648c218467792e907435eaa5267a0f3457f634f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Tue, 23 Jun 2020 13:50:02 +0200
Subject: [PATCH] ipatests: check that EPN's configuration file is installed.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://pagure.io/freeipa/issue/8374
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
---
 ipatests/test_integration/test_epn.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
index 7f56d4bc0..409d588d5 100644
--- a/ipatests/test_integration/test_epn.py
+++ b/ipatests/test_integration/test_epn.py
@@ -209,6 +209,20 @@ class TestEPN(IntegrationTest):
         cls.master.run_command(r'rm -f /etc/pki/tls/private/postfix.key')
         cls.master.run_command(r'rm -f /etc/pki/tls/certs/postfix.pem')
 
+    @pytest.mark.xfail(reason='pr-ci issue 378', strict=True)
+    def test_EPN_config_file(self):
+        """Check that the EPN configuration file is installed.
+           https://pagure.io/freeipa/issue/8374
+        """
+        epn_conf = "/etc/ipa/epn.conf"
+        epn_template = "/etc/ipa/epn/expire_msg.template"
+        cmd1 = self.master.run_command(["rpm", "-qc", "freeipa-client-epn"])
+        assert epn_conf in cmd1.stdout_text
+        assert epn_template in cmd1.stdout_text
+        cmd2 = self.master.run_command(["sha256sum", epn_conf])
+        ck = "4c207b5c9c760c36db0d3b2b93da50ea49edcc4002d6d1e7383601f0ec30b957"
+        assert cmd2.stdout_text.find(ck) == 0
+
     def test_EPN_smoketest_1(self):
         """No users except admin. Check --dry-run output.
            With the default configuration, the result should be an empty list.
-- 
2.26.2

From 06accac8906f66ebbb31849d6528b39ae006b124 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Wed, 24 Jun 2020 23:24:36 +0200
Subject: [PATCH] ipatests: ipa_epn: uninstall/reinstall ipa-client-epn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Due to https://github.com/freeipa/freeipa-pr-ci/issues/378
the installed version of freeipa-client-epn is not the built
one. Temporarily force uninstall/reinstall of this package
before running the test.

Fixes: https://pagure.io/freeipa/issue/8374
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
---
 ipatests/test_integration/test_epn.py | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
index 409d588d5..9a9fb17b9 100644
--- a/ipatests/test_integration/test_epn.py
+++ b/ipatests/test_integration/test_epn.py
@@ -209,11 +209,29 @@ class TestEPN(IntegrationTest):
         cls.master.run_command(r'rm -f /etc/pki/tls/private/postfix.key')
         cls.master.run_command(r'rm -f /etc/pki/tls/certs/postfix.pem')
 
-    @pytest.mark.xfail(reason='pr-ci issue 378', strict=True)
+    @pytest.mark.skip_if_platform(
+        "debian", reason="Cannot check installed packages using RPM"
+    )
     def test_EPN_config_file(self):
         """Check that the EPN configuration file is installed.
            https://pagure.io/freeipa/issue/8374
         """
+        # workaround for https://github.com/freeipa/freeipa-pr-ci/issues/378
+        rpm_q_cmds = [
+            ["rpm", "-qi", "freeipa-client"],
+            ["rpm", "-qi", "freeipa-client-epn"],
+            ["rpm", "-qc", "freeipa-client-epn"],
+            ["rpm", "-V", "freeipa-client-epn"],
+            ["rpm", "-qvc", "freeipa-client-epn"],
+            ["ls", "-l", "/etc/ipa", "/etc/ipa/epn"],
+        ]
+        for cmd in rpm_q_cmds:
+            self.master.run_command(cmd, raiseonerr=False)
+        tasks.uninstall_packages(self.master, ["*ipa-client-epn"])
+        tasks.install_packages(self.master, ["*ipa-client-epn"])
+        for cmd in rpm_q_cmds:
+            self.master.run_command(cmd, raiseonerr=False)
+        # end workaround
         epn_conf = "/etc/ipa/epn.conf"
         epn_template = "/etc/ipa/epn/expire_msg.template"
         cmd1 = self.master.run_command(["rpm", "-qc", "freeipa-client-epn"])
-- 
2.26.2