Bug 1426847

Summary: Cannot upgrade freeipa-client on rawhide
Product: [Fedora] Fedora Reporter: Lukas Slebodnik <lslebodn>
Component: freeipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 26CC: abokovoy, awilliam, bkabrda, cstratak, dmalcolm, ipa-maint, jcholast, jhrozek, mcyprian, mhroncok, pviktori, pvoborni, rcritten, rkuska, robatino, ssorce, tkrizek, tomspur, torsava
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: freeipa-4.4.3-8.fc26 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-01 16:54:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1349184    
Attachments:
Description Flags
A more robust way to keep the py2 version of /usr/bin/ipa none

Description Lukas Slebodnik 2017-02-25 16:23:14 UTC
Description of problem:
Cannot upgrade freeipa-client on rahide

Version-Release number of selected component (if applicable):
sh# rpm -q freeipa-client
freeipa-client-4.4.3-4.fc26.x86_64

How reproducible:
Deterministic

Steps to Reproduce:
1. dnf update -y

Actual results:
sh# dnf update
Last metadata expiration check: 2:27:35 ago on Sat Feb 25 14:53:45 2017 CET.
Dependencies resolved.
================================================================================
 Package                    Arch        Version              Repository    Size
================================================================================
Skipping packages with broken dependencies
(add '--best' to command line to see why package dependency cannot be satisfied):
 freeipa-client             x86_64      4.4.3-5.fc26         rawhide      176 k
 freeipa-client-common      noarch      4.4.3-5.fc26         rawhide       58 k
 freeipa-common             noarch      4.4.3-5.fc26         rawhide      475 k
 python2-ipaclient          noarch      4.4.3-5.fc26         rawhide      475 k
 python2-ipalib             noarch      4.4.3-5.fc26         rawhide      591 k

Transaction Summary
================================================================================
Skip  5 Packages


Expected results:
Packages are upgraded without any problem.

Additional info:
sh# dnf update --best
Last metadata expiration check: 2:28:46 ago on Sat Feb 25 14:53:45 2017 CET.
Error: 
 Problem 1: cannot install the best update candidate for package freeipa-client-4.4.3-4.fc26.x86_64
  - nothing provides /usr/libexec/system-python2 needed by freeipa-client-4.4.3-5.fc26.x86_64
 Problem 2: package freeipa-client-4.4.3-4.fc26.x86_64 requires freeipa-client-common = 4.4.3-4.fc26, but none of the providers can be installed
  - package freeipa-client-common-4.4.3-5.fc26.noarch conflicts with ipa-client-common provided by freeipa-client-common-4.4.3-4.fc26.noarch
  - problem with installed package freeipa-client-4.4.3-4.fc26.x86_64
  - cannot install the best update candidate for package freeipa-client-common-4.4.3-4.fc26.noarch
  - nothing provides /usr/libexec/system-python2 needed by freeipa-client-4.4.3-5.fc26.x86_64
(try to add '--allowerasing' to command line to replace conflicting packages)

Comment 1 Alexander Bokovoy 2017-02-27 09:31:29 UTC
So, I rebuilt freeipa in Rawhide and the dependency is there again. We don't have any explicit dependency to /usr/libexec/system-python2, it is being added by the python build machinery.

I'm moving this bug to Python team. If you are interested how a build looks like when it adds /usr/libexec/system-python2 which is not provided by anything in Rawhide, check logs for https://koji.fedoraproject.org/koji/buildinfo?buildID=862466

Comment 2 Fedora End Of Life 2017-02-28 12:26:36 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.

Comment 3 Petr Viktorin (pviktori) 2017-02-28 16:15:27 UTC
This command in the spec:

sed -i -e'1s/python\(3\|$\)/python2/' %{buildroot}%{_bindir}/ipa

is assuming too much about the value of %{__python3}; it changes "/usr/libexec/system-python" to the nonexistent "/usr/libexec/system-python2".

The system-python change has been reverted for now, but we do plan to push it again after fixing packages.

I'll attach a patch to switch to the py2 version in a more robust way (though it's also a temporary hack -- if you want something long-term let's discuss).

Comment 4 Petr Viktorin (pviktori) 2017-02-28 16:16:47 UTC
Created attachment 1258429 [details]
A more robust way to keep the py2 version of /usr/bin/ipa

Comment 5 Adam Williamson 2017-02-28 23:36:08 UTC
Proposing as an F26 Alpha blocker, as this prevents deployment of the 'domain controller' role (which is one of the release-blocking roles for Fedora Server) - violates "Release-blocking roles and the supported role configuration interfaces must meet the core functional Role Definition Requirements to the extent that supported roles can be successfully deployed, started, stopped, brought to a working configuration, and queried." - and also prevents enrolment of systems as domain clients - violates "It must be possible to join the system to a FreeIPA or Active Directory domain at install time and post-install, and the system must respect the identity, authentication and access control configuration provided by the domain.".

https://fedoraproject.org/wiki/Fedora_26_Alpha_Release_Criteria

Comment 6 Alexander Bokovoy 2017-03-01 06:14:31 UTC
Thank you, Petr.

I'm going to do a build for rawhide with this patch. If that works, I'll do f26 build as well.

Comment 7 Alexander Bokovoy 2017-03-01 08:27:41 UTC
Ok, looks like dependencies are good not -- freeipa-client wants /usr/bin/python and /usr/bin/python2 but not /usr/libexec/system-python2 anymore.

Comment 8 Alexander Bokovoy 2017-03-01 08:28:01 UTC
s/good not/good now/

Comment 9 Charalampos Stratakis 2017-03-01 16:54:08 UTC
This is fixed at freeipa-4.4.3-8.fc26

Comment 10 Adam Williamson 2017-03-02 23:07:17 UTC
Well, that build has no tags. I'm asking releng if they can fix it.