Bug 2239725

Satellite 6.11 is also impacted

I discovered that if you remove openscap after the upgrade run fails, and then try the upgrade run again Satellite will complete the upgrade successfully.
Hope that helps in the short term if you have problems restoring from backup/snapshot or actually forgot to do both.

(In reply to arivera from comment #13)
> I discovered that if you remove openscap after the upgrade run fails, and
> then try the upgrade run again Satellite will complete the upgrade
> successfully.
> Hope that helps in the short term if you have problems restoring from
> backup/snapshot or actually forgot to do both.

I should have explained better. yum remove openscap after the upgrade run fails, and then try again.

I can confirm what arivera wrote. Removing openscap and re-running the upgrade completes successfully.

VERIFIED.

@Satellite 6.13.5 Snap1
rubygem-openscap-0.4.9-9.el8sat.noarch

by the following manual reproducer:

1) Upgrade across 6.13.z (while being on RHEL8.8.z)
# satellite-maintain upgrade run --target-version 6.13.z -y
...
Upgrade finished.

# rpm -q openscap
openscap-1.3.8-1.el8_8.x86_64

>>>  upgrade finished successfully and latest openscap rpm is installed

The upgrade still has the same error, when will the fix be promoted?

[root@dcp-rhelsat1n1v ~]# satellite-maintain upgrade run --target-version 6.13.z
Checking for new version of satellite-maintain...
Nothing to update, can't find new version of satellite-maintain.
Running preparation steps required to run the next scenarios
================================================================================
Check whether system has any non Red Hat repositories (e.g.: EPEL) enabled:
- Checking repositories enabled on the system                         [OK]
--------------------------------------------------------------------------------


Running Checks before upgrading to Satellite 6.13.z
================================================================================
Check number of fact names in database:                               [OK]
--------------------------------------------------------------------------------
Check whether all services are running:                               [OK]
--------------------------------------------------------------------------------
Check whether all services are running using the ping call:           [OK]
--------------------------------------------------------------------------------
Check for paused tasks:                                               [OK]
--------------------------------------------------------------------------------
Check to verify no empty CA cert requests exist:                      [OK]
--------------------------------------------------------------------------------
Check whether system is self-registered or not:                       [OK]
--------------------------------------------------------------------------------
Check to make sure root(/) partition has enough space:                [OK]
--------------------------------------------------------------------------------
Check to make sure /var/lib/candlepin has enough space:               [OK]
--------------------------------------------------------------------------------
Check to validate candlepin database:                                 [OK]
--------------------------------------------------------------------------------
Check for running tasks:                                              [OK]
--------------------------------------------------------------------------------
Check for old tasks in paused/stopped state:                          [OK]
--------------------------------------------------------------------------------
Check for pending tasks which are safe to delete:                     [OK]
--------------------------------------------------------------------------------
Check for tasks in planning state:                                    [OK]
--------------------------------------------------------------------------------
Check to verify if any hotfix installed on system:
/ Checking for presence of hotfix(es). It may take some time to verify.Reading Foreman protector configuration
*** Excluded total: 0

Nothing excluded by foreman-protector!

/ Checking for presence of hotfix(es). It may take some time to verify.
                                                                      [OK]
--------------------------------------------------------------------------------
Check whether system has any non Red Hat repositories (e.g.: EPEL) enabled:
\ Checking repositories enabled on the system                         [OK]
--------------------------------------------------------------------------------
Check if TMOUT environment variable is set:                           [OK]
--------------------------------------------------------------------------------
Check if system requirements match current tuning profile:            [OK]
--------------------------------------------------------------------------------
Check if any upstream repositories are enabled on system:
/ Checking for presence of upstream repositories                      [OK]
--------------------------------------------------------------------------------
Check for roles that have filters with multiple resources attached:   [OK]
--------------------------------------------------------------------------------
Check for duplicate permissions from database:                        [OK]
--------------------------------------------------------------------------------
Check if system has any non Red Hat RPMs installed (e.g.: Fedora):    [OK]
--------------------------------------------------------------------------------
Check whether reports have correct associations:                      [OK]
--------------------------------------------------------------------------------
Check to validate yum configuration before upgrade:                   [OK]
--------------------------------------------------------------------------------
Check if checkpoint_segments configuration exists on the system:      [OK]
--------------------------------------------------------------------------------
Validate availability of repositories:
| Validating availability of repositories for 6.13                    [OK]
--------------------------------------------------------------------------------


The pre-upgrade checks indicate that the system is ready for upgrade.
It's recommended to perform a backup at this stage.
Confirm to continue with the modification part of the upgrade, [y(yes), n(no), q(quit)] y
Running Procedures before migrating to Satellite 6.13.z
================================================================================
disable active sync plans:
- Total 5 sync plans are now disabled.                                [OK]
--------------------------------------------------------------------------------
Add maintenance_mode tables/chain to nftables/iptables:               [OK]
--------------------------------------------------------------------------------
Stop applicable services:

Stopping the following service(s):
redis, postgresql, pulpcore-api, pulpcore-content, pulpcore-api.socket, pulpcore-content.socket, pulpcore-worker, pulpcore-worker, pulpcore-worker, pulpcore-worker, tomcat, dynflow-sidekiq@orchestrator, foreman, httpd, puppetserver, foreman.socket, dynflow-sidekiq@worker-1, dynflow-sidekiq@worker-hosts-queue-1, foreman-proxy
- All services stopped                                                [OK]
--------------------------------------------------------------------------------


Running Migration scripts to Satellite 6.13.z
================================================================================
Setup repositories:
/ Configuring repositories for 6.13                                   [OK]
--------------------------------------------------------------------------------
Enable the given stream modules:                                      [OK]
--------------------------------------------------------------------------------
Unlock packages:                                                      [OK]
--------------------------------------------------------------------------------
Update package(s) :                                                   [FAIL]
Failed executing yum -y --disableplugin=foreman-protector update, exit status 1:
 Updating Subscription Management repositories.
Red Hat Enterprise Linux 8 for x86_64 - AppStre  47 MB/s |  59 MB     00:01
Red Hat Enterprise Linux 8 for x86_64 - BaseOS   49 MB/s |  65 MB     00:01
Red Hat Satellite 6.13 for RHEL 8 x86_64 (RPMs) 3.1 MB/s | 1.6 MB     00:00
Red Hat Satellite Maintenance 6.13 for RHEL 8 x  62 kB/s |  32 kB     00:00
Last metadata expiration check: 0:00:01 ago on Mon 25 Sep 2023 09:49:53 AM EDT.
Error:
 Problem: package rubygem-openscap-0.4.9-8.el8sat.noarch requires openscap < 1.3.8, but none of the providers can be installed
  - openscap-1.3.7-1.el8.i686 has inferior architecture
  - openscap-1.3.0-7.el8.i686 has inferior architecture
  - openscap-1.3.1-1.el8.i686 has inferior architecture
  - openscap-1.3.2-6.el8.i686 has inferior architecture
  - openscap-1.3.3-5.el8.i686 has inferior architecture
  - openscap-1.3.3-6.el8_3.i686 has inferior architecture
  - openscap-1.3.4-5.el8.i686 has inferior architecture
  - openscap-1.3.4-6.el8_4.i686 has inferior architecture
  - openscap-1.3.5-6.el8.i686 has inferior architecture
  - openscap-1.3.6-3.el8.i686 has inferior architecture
  - openscap-1.3.6-4.el8.i686 has inferior architecture
  - openscap-1.3.6-5.el8_7.i686 has inferior architecture
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.7-1.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.0-7.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.1-1.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.2-6.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.3-5.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.3-6.el8_3.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.4-5.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.4-6.el8_4.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.5-6.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.6-3.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.6-4.el8.x86_64
  - cannot install both openscap-1.3.8-1.el8_8.x86_64 and openscap-1.3.6-5.el8_7.x86_64
  - cannot install the best update candidate for package rubygem-openscap-0.4.9-8.el8sat.noarch
  - cannot install the best update candidate for package openscap-1.3.7-1.el8.x86_64
(try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)
--------------------------------------------------------------------------------
Scenario [Migration scripts to Satellite 6.13.z] failed.

The following steps ended up in failing state:

  [packages-update]

Resolve the failed steps and rerun the command.

If the situation persists and, you are unclear what to do next,
contact Red Hat Technical Support.

In case the failures are false positives, use
--whitelist="packages-update"

[root@dcp-rhelsat1n1v ~]# lsb_release -d
Description:    Red Hat Enterprise Linux release 8.8 (Ootpa)
[root@dcp-rhelsat1n1v ~]# hammer status
Version:           3.5.1.21
API Version:       v2
Database:
    Status:          ok
    Server Response: Duration: 0ms
Plugins:
 1) Name:    foreman-tasks
    Version: 7.2.1
 2) Name:    foreman_ansible
    Version: 10.4.3
 3) Name:    foreman_azure_rm
    Version: 2.2.7
 4) Name:    foreman_bootdisk
    Version: 21.0.3
 5) Name:    foreman_discovery
    Version: 22.0.2
 6) Name:    foreman_google
    Version: 1.0.3
 7) Name:    foreman_hooks
    Version: 0.3.17
 8) Name:    foreman_openscap
    Version: 5.2.3
 9) Name:    foreman_puppet
    Version: 5.0.0
 10)Name:    foreman_remote_execution
    Version: 8.3.2
 11)Name:    foreman_rh_cloud
    Version: 7.0.45
 12)Name:    foreman_templates
    Version: 9.3.0
 13)Name:    foreman_theme_satellite
    Version: 11.0.0.5
 14)Name:    foreman_virt_who_configure
    Version: 0.5.13
 15)Name:    foreman_webhooks
    Version: 3.0.5
 16)Name:    katello
    Version: 4.7.0.32
Smart Proxies:
 1) Name:     dcp-rhelsat1n1v.bh.local
    Version:  3.5.1
    Status:   ok
    Features:
     1) Name:    discovery
        Version: 1.0.5
     2) Name:    dynflow
        Version: 0.9.0
     3) Name:    ansible
        Version: 3.5.4
     4) Name:    openscap
        Version: 0.9.2
     5) Name:    script
        Version: 0.10.1
     6) Name:    pulpcore
        Version: 3.2.0
     7) Name:    puppetca
        Version: 3.5.1
     8) Name:    puppet
        Version: 3.5.1
     9) Name:    logs
        Version: 3.5.1
Compute Resources:

candlepin:
    Status:          ok
    Server Response: Duration: 31ms
candlepin_auth:
    Status:          ok
    Server Response: Duration: 29ms
candlepin_events:
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
katello_events:
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
pulp3:
    Status:          ok
    Server Response: Duration: 346ms
pulp3_content:
    Status:          ok
    Server Response: Duration: 90ms
foreman_tasks:
    Status:          ok
    Server Response: Duration: 3ms

(In reply to matthew.norwood from comment #19)
> The upgrade still has the same error, when will the fix be promoted?

I can't speak by Engineering, but the bug is verified and planned to be released as a hotfix or a z-stream fix. So I would say "soon".

If you need a workaround procedure, let follow https://access.redhat.com/solutions/7034031 .

Verified in 6.13.4.1 snap 1

Steps to Reproduce:

1) # rpm -qR rubygem-openscap | grep openscap
openscap >= 1.2.9
openscap < 1.3.8

2) Upgrade

3) # rpm -q openscap
openscap-1.3.8-1.el8_8.x86_64

Upgrade finished successfully and latest openscap rpm is installed

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Satellite 6.13.4.1 Async Update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:5399

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days