Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1353054 - FreeIPA server deployment fails due to pki-core dangling symlinks (one from non-installed 'scannotation' package, one formerly in resteasy-jaxrs-api but now lost)
Summary: FreeIPA server deployment fails due to pki-core dangling symlinks (one from n...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: pki-core
Version: 24
Hardware: x86_64
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Endi Sukma Dewata
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-06 00:10 UTC by Adam Williamson
Modified: 2020-10-04 21:12 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-29 16:47:31 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github dogtagpki pki issues 2523 0 None None None 2020-10-04 21:12:11 UTC

Description Adam Williamson 2016-07-06 00:10:04 UTC 
https://bugzilla.redhat.com/show_bug.cgi?id=1348946 seems to have been fixed in current Rawhide, but FreeIPA server deployment is still failing. Here's today's openQA attempt:

https://openqa.fedoraproject.org/tests/24638

You can find the contents of /var/log here:

https://openqa.fedoraproject.org/tests/24638/file/role_deploy_domain_controller-var_log.tar.gz

Looking through the logs, I see this in ipaserver-install.log:

2016-07-04T12:42:14Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20160704084213.log
Loading deployment configuration from /tmp/tmp1X2EK4.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.

Installation failed: Dangling symlink /var/lib/pki/pki-tomcat/common/lib/scannotation.jar not allowed


2016-07-04T12:42:14Z DEBUG stderr=pkispawn    : WARNING  ....... Dangling symlink '/var/lib/pki/pki-tomcat/common/lib/scannotation.jar'-->'/usr/share/java/scannotation.jar'

2016-07-04T12:42:14Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmp1X2EK4' returned non-zero exit status 1
2016-07-04T12:42:14Z CRITICAL See the installation logs and the following files/directories for more information:
2016-07-04T12:42:14Z CRITICAL   /var/log/pki/pki-tomcat
2016-07-04T12:42:14Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 447, in start_creation
    run_step(full_msg, method)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 437, in run_step
    method()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 579, in __spawn_instance
    DogtagInstance.spawn_instance(self, cfg_file)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 181, in spawn_instance
    self.handle_setup_error(e)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 421, in handle_setup_error
    raise RuntimeError("%s configuration failed." % self.subsystem)
RuntimeError: CA configuration failed.

/usr/share/java/scannotation.jar appears to be part of the 'scannotation' package. Looking at /var/log/dnf.rpm.log from the test I don't see any indication that this package was installed, which may be the problem.
Comment 1 Adam Williamson 2016-07-07 00:23:25 UTC 
proposing as an F25 Alpha blocker - "Release-blocking roles and the supported role configuration interfaces must meet the core functional Role Definition Requirements to the extent that supported roles can be successfully deployed, started, stopped, brought to a working configuration, and queried." (you can't deploy the domain controller role because of this).
Comment 2 Adam Williamson 2016-07-07 00:38:26 UTC 
If I install scannotation package manually before attempting the role deployment, I get a different dangling symlink:

Installation failed: Dangling symlink /var/lib/pki/pki-tomcat/common/lib/jaxrs-api.jar not allowed
2016-07-07T00:32:41Z DEBUG stderr=pkispawn    : WARNING  ....... Dangling symlink '/var/lib/pki/pki-tomcat/common/lib/
jaxrs-api.jar'-->'/usr/share/java/resteasy/jaxrs-api.jar'

In F24, this file is part of the package resteasy-jaxrs-api . In F25, it apparently is not - it doesn't seem to be part of anything, according to repoquery -f on a Rawhide box.
Comment 3 Matthew Harmsen 2016-07-11 16:35:56 UTC 
Upstream ticket:
https://fedorahosted.org/pki/ticket/2403
Comment 4 Petr Schindler 2016-07-21 09:37:27 UTC 
Discussed at 2016-07-20 blocker review meeting: [1]. 

This bug was accepted as Alpha blocker: This bug violates the criterion: "Release-blocking roles and the supported role configuration interfaces must meet the core functional Role Definition Requirements to the extent that supported roles can be successfully deployed, started, stopped, brought to a working configuration, and queried." The domain controller role can't be deployed because of this bug.

[1] https://meetbot.fedoraproject.org/fedora-blocker-review/2016-07-20/f25-blocker-review.2016-07-20-16.00.html
Comment 5 Jan Kurik 2016-07-26 04:03:31 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 25 development cycle.
Changing version to '25'.
Comment 6 Endi Sukma Dewata 2016-07-27 22:08:17 UTC 
Fixed in master:

* 3f4c9e4e7946f3f330b71cfe36a00ae933de2575
* 9e77b42d88da07e91a42966bc2d1ea9237e62f47
* ecbf1cded60cec973316584baf272ae4c7bae1dd
* bc28cfc1916c080c01cc453e43cae2db646bc2db
* 4926aace5cf0be65ddddf51c031e6cac6646a1dd
* 4ab5af20bf0914a484a2434f65a0f0643e5a92c5 
* f990cb0dee46df211c2c7212ca0165465b5f3531
Comment 7 Matthew Harmsen 2016-08-04 15:38:54 UTC 
Endi made these additional changes to the master:

* cb72f5b562e33875a2144c00ea93c7c017138141 
* e6c426eb69e294207a657897fdce0a7b07e4c41d
Comment 8 Matthew Harmsen 2016-08-04 15:40:41 UTC 
On August 4, 2016, gil wrote:

hi

/usr/share/java/resteasy/jaxrs-api.jar is no more available.

please, use instead jboss-jaxrs-2.0-api

soon should be available also in F24 ​https://bodhi.fedoraproject.org/updates/FEDORA-2016-3aee3bf66c

regards
Comment 9 Adam Williamson 2016-08-08 23:54:19 UTC 
Can we please have Fedora 25 and Rawhide builds with the fix? The Fedora 25 Alpha freeze kicks in very soon, and the go/no-go date is 2016-08-18, and there could well be all kinds of *other* bugs lurking behind this one - since we cannot complete a deployment due to this bug, we have done no testing of anything beyond this point yet. So we really need this bug fixed ASAP. Thank you.
Comment 10 Adam Williamson 2016-08-09 23:39:45 UTC 
10.3.5-1 seems to have been built for F24 but not F25 or Rawhide...
Comment 11 Fedora Update System 2016-08-10 22:43:33 UTC 
pki-core-10.3.5-1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-4d226a5f7e
Comment 12 Fedora Update System 2016-08-10 22:44:07 UTC 
pki-core-10.3.5-1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-0a384ead60
Comment 13 Fedora Update System 2016-08-12 09:49:14 UTC 
resteasy-3.0.17-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-5e7ddb8249
Comment 14 Fedora Update System 2016-08-12 19:22:04 UTC 
pki-core-10.3.5-1.fc24 resteasy-3.0.17-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-4d226a5f7e
Comment 15 Fedora Update System 2016-08-14 00:22:59 UTC 
pki-core-10.3.5-1.fc24, resteasy-3.0.17-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-4d226a5f7e
Comment 16 Fedora Update System 2016-08-16 03:19:41 UTC 
pki-core-10.3.5-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Comment 17 Adam Williamson 2016-08-16 21:28:00 UTC 
This is pushed stable and the fix is tested, so we can close it.
Comment 18 Fedora Update System 2016-08-22 22:28:36 UTC 
pki-core-10.3.5-1.fc24 resteasy-3.0.17-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-4d226a5f7e
Comment 19 Fedora Update System 2016-08-23 16:22:20 UTC 
pki-core-10.3.5-1.fc24, resteasy-3.0.17-3.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-4d226a5f7e
Comment 20 Fedora Update System 2016-09-01 03:20:38 UTC 
pki-core-10.3.5-1.fc24, resteasy-3.0.17-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 21 Adam Williamson 2016-09-29 16:47:31 UTC 
Closing again.
Note You need to log in before you can comment on or make changes to this bug.