1426847 – Cannot upgrade freeipa-client on rawhide

Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1426847 - Cannot upgrade freeipa-client on rawhide

Summary: Cannot upgrade freeipa-client on rawhide

Keywords:
Status:	CLOSED RAWHIDE
Alias:	None
Product:	Fedora
Classification:	Fedora
Component:	freeipa
Sub Component:
Version:	26
Hardware:	All
OS:	Linux
Priority:	unspecified
Severity:	urgent
Target Milestone:	---
Assignee:	IPA Maintainers
QA Contact:	Fedora Extras Quality Assurance
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	F26AlphaBlocker
TreeView+	depends on / blocked

Reported:	2017-02-25 16:23 UTC by Lukas Slebodnik
Modified:	2017-03-02 23:07 UTC (History)
CC List:	19 users (show)
Fixed In Version:	freeipa-4.4.3-8.fc26
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2017-03-01 16:54:08 UTC
Type:	Bug
Embargoed:
Dependent Products:

Attachments	(Terms of Use)
A more robust way to keep the py2 version of /usr/bin/ipa (1.21 KB, patch) 2017-02-28 16:16 UTC, Petr Viktorin	no flags	Details \| Diff
View All

Description Lukas Slebodnik 2017-02-25 16:23:14 UTC

Description of problem:
Cannot upgrade freeipa-client on rahide

Version-Release number of selected component (if applicable):
sh# rpm -q freeipa-client
freeipa-client-4.4.3-4.fc26.x86_64

How reproducible:
Deterministic

Steps to Reproduce:
1. dnf update -y

Actual results:
sh# dnf update
Last metadata expiration check: 2:27:35 ago on Sat Feb 25 14:53:45 2017 CET.
Dependencies resolved.
================================================================================
 Package                    Arch        Version              Repository    Size
================================================================================
Skipping packages with broken dependencies
(add '--best' to command line to see why package dependency cannot be satisfied):
 freeipa-client             x86_64      4.4.3-5.fc26         rawhide      176 k
 freeipa-client-common      noarch      4.4.3-5.fc26         rawhide       58 k
 freeipa-common             noarch      4.4.3-5.fc26         rawhide      475 k
 python2-ipaclient          noarch      4.4.3-5.fc26         rawhide      475 k
 python2-ipalib             noarch      4.4.3-5.fc26         rawhide      591 k

Transaction Summary
================================================================================
Skip  5 Packages


Expected results:
Packages are upgraded without any problem.

Additional info:
sh# dnf update --best
Last metadata expiration check: 2:28:46 ago on Sat Feb 25 14:53:45 2017 CET.
Error: 
 Problem 1: cannot install the best update candidate for package freeipa-client-4.4.3-4.fc26.x86_64
  - nothing provides /usr/libexec/system-python2 needed by freeipa-client-4.4.3-5.fc26.x86_64
 Problem 2: package freeipa-client-4.4.3-4.fc26.x86_64 requires freeipa-client-common = 4.4.3-4.fc26, but none of the providers can be installed
  - package freeipa-client-common-4.4.3-5.fc26.noarch conflicts with ipa-client-common provided by freeipa-client-common-4.4.3-4.fc26.noarch
  - problem with installed package freeipa-client-4.4.3-4.fc26.x86_64
  - cannot install the best update candidate for package freeipa-client-common-4.4.3-4.fc26.noarch
  - nothing provides /usr/libexec/system-python2 needed by freeipa-client-4.4.3-5.fc26.x86_64
(try to add '--allowerasing' to command line to replace conflicting packages)

Comment 1 Alexander Bokovoy 2017-02-27 09:31:29 UTC

So, I rebuilt freeipa in Rawhide and the dependency is there again. We don't have any explicit dependency to /usr/libexec/system-python2, it is being added by the python build machinery.

I'm moving this bug to Python team. If you are interested how a build looks like when it adds /usr/libexec/system-python2 which is not provided by anything in Rawhide, check logs for https://koji.fedoraproject.org/koji/buildinfo?buildID=862466

Comment 2 Fedora End Of Life 2017-02-28 12:26:36 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.

Comment 3 Petr Viktorin 2017-02-28 16:15:27 UTC

This command in the spec:

sed -i -e'1s/python\(3\|$\)/python2/' %{buildroot}%{_bindir}/ipa

is assuming too much about the value of %{__python3}; it changes "/usr/libexec/system-python" to the nonexistent "/usr/libexec/system-python2".

The system-python change has been reverted for now, but we do plan to push it again after fixing packages.

I'll attach a patch to switch to the py2 version in a more robust way (though it's also a temporary hack -- if you want something long-term let's discuss).

Comment 4 Petr Viktorin 2017-02-28 16:16:47 UTC

Created attachment 1258429 [details]
A more robust way to keep the py2 version of /usr/bin/ipa

Comment 5 Adam Williamson 2017-02-28 23:36:08 UTC

Proposing as an F26 Alpha blocker, as this prevents deployment of the 'domain controller' role (which is one of the release-blocking roles for Fedora Server) - violates "Release-blocking roles and the supported role configuration interfaces must meet the core functional Role Definition Requirements to the extent that supported roles can be successfully deployed, started, stopped, brought to a working configuration, and queried." - and also prevents enrolment of systems as domain clients - violates "It must be possible to join the system to a FreeIPA or Active Directory domain at install time and post-install, and the system must respect the identity, authentication and access control configuration provided by the domain.".

https://fedoraproject.org/wiki/Fedora_26_Alpha_Release_Criteria

Comment 6 Alexander Bokovoy 2017-03-01 06:14:31 UTC

Thank you, Petr.

I'm going to do a build for rawhide with this patch. If that works, I'll do f26 build as well.

Comment 7 Alexander Bokovoy 2017-03-01 08:27:41 UTC

Ok, looks like dependencies are good not -- freeipa-client wants /usr/bin/python and /usr/bin/python2 but not /usr/libexec/system-python2 anymore.

Comment 8 Alexander Bokovoy 2017-03-01 08:28:01 UTC

s/good not/good now/

Comment 9 Charalampos Stratakis 2017-03-01 16:54:08 UTC

This is fixed at freeipa-4.4.3-8.fc26

Comment 10 Adam Williamson 2017-03-02 23:07:17 UTC

Well, that build has no tags. I'm asking releng if they can fix it.

Note You need to log in before you can comment on or make changes to this bug.