PR: https://github.com/freeipa/freeipa/pull/7589

Currently passes all upstream test suites except DNSSEC operations. The latter requires custom bind 9.18 version backporting OpenSSL provider support from bind 9.20+. @pemensik will look into that, hopefully.

bind 9.20+ is currently not supported for the reason that bind-dyndb-ldap is not buildable against it yet.

master:

• 1311df2e0e7343632e25f2d0adfbbbd79adfda51 Use OpenSSL provider with BIND for Fedora 42+ and RHEL10+
• d1e22146d2a4463ed09e63d2f78d618c1b9e7137 DNS: detect when OpenSSL engine should be removed on upgrade
• b9579fe08c83593b01b8f1781250617a5aef5975 ipa-dnskeysyncd: use systemd-tmpfiles to handle tokens
• c9f7cf11241ed83409439c737442ac22fc355eed freeipa.spec.in: update BIND-related dependencies
• d7b454e1593ad65d8addc8389325bfa095f9138d freeipa.spec.in: do not recommend encrypted DNS on pre-F42 systems
• 7e254aee3dd2ba0018346821fc79bf2e3ff7ec83 Azure CI: Use F42
• d271fc1938e0fe12e1f1a450c67fa850de290279 Make the Azure template work with both dnf4 and dnf5
• b7c17c70a18382aa156327618f5c961eb16fc595 Test: dnf5 handles updating itself differently than dnf4
• ec990a5e8b1d802d2de60df3a68fb0086440c911 Move wheel constraints to F41+
• ef6ead4c5d29b0a437a6677069a06748d1dd9bd0 fix used-before-assignment errors where pylint cannot infer logic
• 94a0552cc603c2cf7b551ae07b999707ed870523 pylint: do not use return at the end of flow
• 1493aec49ffbc0c7a82ec349f33b472f8cc14442 test_console: rework matching to adjust to Python 3.13
• 8934728d460bf822556d86e190c240ba489d8e25 Make IPAAbstractVersion available to all platforms
• ac791f7372d32d25c75eb61f949f1db38fe2f0d6 Stop using deprecated pkg_resources
• df319b973847b82d4d3447f4b8233a24eda0608d Azure CI: do not run test_ipaserver/test_migratepw
• e7095dce69d6f811b7420148f3c017869d10d70c test_schema: do not fool pytest with a non-test class name

ipa-4-12:

• 3e3af2d153f3fe8e8bfc0805e92cba0f5f649d73 Use OpenSSL provider with BIND for Fedora 42+ and RHEL10+
• 3094ef83b898bb7b7a3e835084e444fd403c6ee8 DNS: detect when OpenSSL engine should be removed on upgrade
• efbe63a6ff2cbdab128c6d3c879862dba22ac1cb ipa-dnskeysyncd: use systemd-tmpfiles to handle tokens
• a66adf2618d8d92b80c79537c7bcaaedea2bd9a4 freeipa.spec.in: update BIND-related dependencies
• 13332be5931b2492b19121c083ab0e37aa1ae88f freeipa.spec.in: do not recommend encrypted DNS on pre-F42 systems
• eeec57942a38dff637aec8f30099e6df4373b936 Azure CI: Use F42
• 69156cbeb4f096b5f63674c3f20b8054ff4cf993 Make the Azure template work with both dnf4 and dnf5
• 6a99d75f2557f4d5ad5693b3c63d57a22af2bf1f Test: dnf5 handles updating itself differently than dnf4
• 9d91d38b14a5b24e4d141c0bb925e9708b000dbe Move wheel constraints to F41+
• 66df1812d2d393b123f662e2a726624bd52d2e39 fix used-before-assignment errors where pylint cannot infer logic
• 7a8f3b82602fda716ce7510212d6ab876c1b789a pylint: do not use return at the end of flow
• 7df021d3d2472ff91d03efc1142e5dc8295d82cb test_console: rework matching to adjust to Python 3.13
• 6e43b2afef2360cfa5fb4f3034a0bd69846e3ae9 Make IPAAbstractVersion available to all platforms
• 1fed74f110ed9c8bd70a49ec85ef9a895fffdb9b Stop using deprecated pkg_resources
• b5ce6722527cab8602598939964ada0288707a70 Azure CI: do not run test_ipaserver/test_migratepw
• 6b027440dd2a85b98eef85752967a8d34dae96e3 test_schema: do not fool pytest with a non-test class name
• 0aff65d9453d456c7a99c1294dde8c2e2ab57ca8 dns install: fix selinux avc relabelto