Bug 1148783

Summary: not only packages, but also product id certificates must be upgraded during system upgrade
Product: Red Hat Enterprise Linux 7 Reporter: Jakub Dorňák <jdornak>
Component: redhat-upgrade-dracutAssignee: David Shea <dshea>
Status: CLOSED ERRATA QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.1CC: dshea, hhorak, mkovarik, redakkan, vanhoof
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: redhat-upgrade-dracut-0.8.9-1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-05 09:02:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 922066, 1005618, 1064025, 1107088, 1107092, 1107094, 1144544    

Description Jakub Dorňák 2014-10-02 11:05:27 UTC
Description of problem:
System id certificates located in /etc/pki/product should always correspond to packages being currently installed.
Since redhat-upgrade-dracut performs the actual upgrade - it installs all the packages previously downloaded by redhat-upgrade-tool, it is also responsible to install new product id certificates (also previously downloaded by redhat-upgrade-tool).

I have provided patch long ago: https://github.com/dashea/redhat-upgrade-dracut/pull/1

Version-Release number of selected component (if applicable):
redhat-upgrade-dracut-0.8.8-1

Comment 2 David Shea 2014-10-06 12:28:54 UTC
*** Bug 1144544 has been marked as a duplicate of this bug. ***

Comment 4 Rehana 2014-12-09 12:39:10 UTC
Retested.

Test steps:
==========
1) Installed rhel6.6  server (minimal install)
2) Register host using subscription-manager
3) Enabled extras and optional repos, installed preupgrade-assistant and redhat-upgrade-tool
4) Updated to latest package from brew 
Package version after update
# rpm -qa preupgrade* redhat-upgrade*
preupgrade-assistant-tools-2.0.1-3.el6.x86_64
redhat-upgrade-tool-0.7.32-1.el6.noarch
preupgrade-assistant-2.0.1-3.el6.x86_64
preupgrade-assistant-ui-2.0.1-3.el6.x86_64
preupgrade-assistant-contents-0.6.12-1.el6.noarch
preupgrade-assistant-debuginfo-2.0.1-3.el6.x86_64

5) Installed product version, and redhat-release 
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.6 (Santiago)
 
 
# subscription-manager  list --installed
+-------------------------------------------+
    Installed Product Status
+-------------------------------------------+
Product Name:   Red Hat Enterprise Linux Server
Product ID:     69
Version:        6.6
Arch:           x86_64
Status:         Subscribed
Status Details:
Starts:         10/05/2011
Ends:           12/31/2021


6. Execute `preupg`

# preupg
Preupg tool doesn't do the actual upgrade.
Please ensure you have backed up your system and/or data in the event of a failed upgrade
 that would require a full re-install of the system from installation media.
Do you want to continue? y/n
y
Gathering logs used by preupgrade assistant:
All installed packages : 01/10 ...finished (time 00:01s)
All changed files      : 02/10 ...finished (time 01:17s)
Changed config files   : 03/10 ...finished (time 00:00s)
All users              : 04/10 ...finished (time 00:00s)
All groups             : 05/10 ...finished (time 00:00s)
Service statuses       : 06/10 ...finished (time 00:00s)
All installed files    : 07/10 ...finished (time 00:03s)
All local files        : 08/10 ...finished (time 00:03s)
All executable files   : 09/10 ...finished (time 00:01s)

<snip>
|General                                                                                                     |needs_action      |
|Removed .so libs                                                                                            |needs_action      |
|Content for enabling and disabling services based on RHEL 6 system                                          |needs_action      |
|cgroups configuration compatibility check                                                                   |needs_action      |
|Check system requirements                                                                                   |needs_action      |
---------------------------------------------------------------------------------------------------------------------------------
Tarball with results is stored here /root/preupgrade-results/preupg_results-141209065201.tar.gz .
The latest assessment is stored in directory /root/preupgrade .
Summary information:
We found some potential in-place upgrade risks.
Read the file /root/preupgrade/result.html for more details.
Upload results to UI by command:
e.g. preupg -u http://127.0.0.1:8099/submit/ -r /root/preupgrade-results/preupg_results-*.tar.gz .

7. Execute redhat-update command using 7.1 instrepo

# redhat-upgrade-tool --network=7.1 --instrepo=http://download.eng.bos.redhat.com/rel-eng/latest-RHEL-7/compose/Server/x86_64/os/
setting up repos...
cmdline-instrepo                                                                                                               | 4.1 kB     00:00    
cmdline-instrepo/primary_db                                                                                                    | 3.4 MB     00:00    
.treeinfo                                                                                                                      | 2.2 kB     00:00    
Preupgrade assistant risk check found risks for this upgrade.
You can run preupg --riskcheck --verbose to view these risks.
Addressing high risk issues is required before the in-place upgrade
and ignoring these risks may result in a broken upgrade and unsupported upgrade.
Please backup your data.

<snip>


HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'libxcb.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'libX11-common.noarch'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'libX11.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'libXi.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'gtk2.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'mesa-libGLU.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'openldap.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'libpciaccess.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'biosdevname.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'kpartx.x86_64'
HOOK-pkgdowngrades: INFO: DOWNGRADE: enforcing package installation 'pixman.x86_64'
Finished. Reboot to start upgrade.


[root@dhcp70-226 ~]# reboot
 
Broadcast message from root.eng.bos.redhat.com
        (/dev/pts/0) at 6:57 ...
 
The system is going down for reboot NOW!


8) Wait for the upgrade process to complete

9) Login to the machine and verify that product id 69.pem having version "7.1" is installed

# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.1 Beta (Maipo)

[root@dhcp70-226 ~]# ls -lh /etc/pki/product
total 4.0K
-rw-r--r--. 1 root root 2.2K Dec  9 06:55 69.pem


[root@dhcp70-226 ~]# subscription-manager list --installed
 
+-------------------------------------------+
    Installed Product Status
+-------------------------------------------+
Product Name:   Red Hat Enterprise Linux Server
Product ID:     69
Version:        7.1 Beta
Arch:           x86_64
Status:         Subscribed
Status Details:
Starts:         10/05/2011
Ends:           12/31/2021

conclusion
=========

Above test steps demonstrates that after upgrading from rhel6.6 to rhel7.1 , product id file certificate is updated to 7.1 beta version

Marking this bug to Verified!!!

Comment 6 errata-xmlrpc 2015-03-05 09:02:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0405.html