Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1629935 - freeipa-server cannot be installed on aarch64
Summary: freeipa-server cannot be installed on aarch64
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: pki-core
Version: 29
Hardware: aarch64
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Matthew Harmsen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: AcceptedBlocker
Depends On:
Blocks: F29BetaBlocker
TreeView+ depends on / blocked
 
Reported: 2018-09-17 16:10 UTC by Adam Williamson
Modified: 2018-09-19 00:35 UTC (History)
14 users (show)

Fixed In Version: pki-core-10.6.6-2.fc29
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-09-19 00:35:15 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Adam Williamson 2018-09-17 16:10:37 UTC 
I just noticed last night that FreeIPA tests are failing on aarch64, e.g.:

https://openqa.stg.fedoraproject.org/tests/361168

this appears to be because the freeipa-server package is not installable at all, presumably due to dependencies. After the test runs 'dnf groupinstall freeipa-server', this happens:

2018-09-16T17:41:36Z DEBUG Adding packages from group 'freeipa-server': {<libcomps.Package object 'freeipa-server-dns'
 at 0xffff8f49c3a8>, <libcomps.Package object 'freeipa-server-trust-ad' at 0xffff8f49c3c0>, <libcomps.Package object '
opendnssec' at 0xffff8f49c3d8>, <libcomps.Package object 'freeipa-server' at 0xffff8f49c378>, <libcomps.Package object
 'bind-dyndb-ldap' at 0xffff8f49c390>}
2018-09-16T17:41:36Z DEBUG --> Starting dependency resolution
2018-09-16T17:41:37Z DEBUG ---> Package bind.aarch64 32:9.11.4-5.P1.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package bind-dyndb-ldap.aarch64 11.1-12.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package bind-pkcs11.aarch64 32:9.11.4-5.P1.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package bind-pkcs11-libs.aarch64 32:9.11.4-5.P1.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package bind-pkcs11-utils.aarch64 32:9.11.4-5.P1.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package checkpolicy.aarch64 2.8-2.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package ldns.aarch64 1.7.0-21.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package libitm.aarch64 8.2.1-2.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package libxslt.aarch64 1.1.32-3.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package nss-tools.aarch64 3.38.0-4.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package opencryptoki.aarch64 3.10.0-2.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package opencryptoki-icsftok.aarch64 3.10.0-2.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package opencryptoki-libs.aarch64 3.10.0-2.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package opendnssec.aarch64 1.4.14-3.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package policycoreutils-python-utils.noarch 2.8-6.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package python3-IPy.noarch 0.81-23.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package python3-audit.aarch64 3.0-0.2.20180808git77fbcf3.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package python3-libsemanage.aarch64 2.8-3.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package python3-policycoreutils.noarch 2.8-6.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package python3-setools.aarch64 4.1.1-12.1.fc29 will be installed
2018-09-16T17:41:37Z DEBUG ---> Package softhsm.aarch64 2.4.0-1.fc29 will be installed

note it tries to pull in various freeipa-server-* packages, but none of them actually winds up in the transaction.

I haven't yet figured out what the problem is and why it's aarch64-only, but wanted to get this filed and proposed as a blocker quickly. It seems like a clear blocker per Basic criterion "It must be possible to configure a Fedora Server system installed according to the above criteria as a FreeIPA domain controller..." - if the package doesn't install, we can't do any of that or the other FreeIPA-related criteria. https://fedoraproject.org/wiki/Basic_Release_Criteria#FreeIPA_server_requirements
Comment 1 Adam Williamson 2018-09-17 16:13:59 UTC 
From the Branched depcheck log, this seems to be the problem:

[freeipa]
	freeipa-server-4.7.0-1.fc29.aarch64 requires pki-symkey >= 0:10.6.0-0.2
	freeipa-server-4.7.0-1.fc29.aarch64 requires pki-kra >= 0:10.6.0-0.2
	freeipa-server-4.7.0-1.fc29.aarch64 requires pki-ca >= 0:10.6.0-0.2
	python3-ipaserver-4.7.0-1.fc29.noarch requires python3-pki >= 0:10.6.0-0.2

it seems pki-core dropped aarch64 at some point (which *absolutely* should never have happened). dgilmore added it back in https://koji.fedoraproject.org/koji/buildinfo?buildID=1143645 , we need to pull that in.
Comment 2 Fedora Update System 2018-09-17 16:16:28 UTC 
pki-core-10.6.6-2.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-84a758e93b
Comment 3 Stephen Gallagher 2018-09-17 18:22:29 UTC 
+1 blocker
Comment 4 Dennis Gilmore 2018-09-17 18:35:26 UTC 
+1 blocker
Comment 5 Geoffrey Marr 2018-09-17 20:03:13 UTC 
Discussed during the 2018-09-17 blocker review meeting: [1]

The decision to classify this bug as an "AcceptedBlocker" was made as it violates all the FreeIPA-related criteria for aarch64, which is a release-blocking arch for Server.

[1] https://meetbot.fedoraproject.org/fedora-blocker-review/2018-09-17/f29-blocker-review.2018-09-17-16.02.txt
Comment 6 Fedora Update System 2018-09-19 00:35:15 UTC 
pki-core-10.6.6-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.