Bug 2442429

Summary:	FreeIPA breaks on upgrade from F43 to F44 because F43's freeipa is higher versioned
Product:	[Fedora] Fedora	Reporter:	Adam Williamson <awilliam>
Component:	freeipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	44	CC:	abokovoy, ftrivino, ipa-maint, mhjacks, rcritten, robatino, ssorce, twoerner
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	openqa AcceptedBlocker
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-02-27 16:41:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2362357

Description Adam Williamson 2026-02-24 19:16:10 UTC

Currently, the stable FreeIPA for F43 is 4.13.1-5.fc43 , the stable FreeIPA for F44 is 4.13.1-2.fc44 . FreeIPA has an internal check on upgrade that the 'new' version is higher than the 'old' version and refuses to run the upgrade or start up if it's not, so FreeIPA is now broken on upgrade from F43 to F44.

This is a violation of https://fedoraproject.org/wiki/Fedora_44_Beta_Release_Criteria#Server_upgrade_requirements "It must be possible to successfully complete a direct upgrade from a fully updated installation of each of the last two stable Fedora Server releases with the system configured as a FreeIPA domain controller or postgresql server as specified in the relevant criteria", so proposing as a Beta blocker.

This is happening because the pending F44 update , https://bodhi.fedoraproject.org/updates/FEDORA-2026-b73dee6cac , has been failing testing. The latest issue is some kind of dependency problem:

- nothing provides libgse-private-samba.so(SAMBA_4.24.0RC2_PRIVATE_SAMBA)(64bit) needed by freeipa-server-trust-ad-4.13.1-6.fc44.x86_64 from advisory

To resolve this we need to fix the problems with that update and get it to pass gating, then it can be pushed stable.

Comment 1 Fedora Update System 2026-02-24 19:16:58 UTC

FEDORA-2026-b73dee6cac (freeipa-4.13.1-6.fc44, krb5-1.22.2-2.fc44, and 1 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b73dee6cac

Comment 2 Adam Williamson 2026-02-24 19:22:16 UTC

It seems wrong that freeipa-server-trust-ad is linking against that soname at all.

This isn't specific to F44, the F43 build requires "libgse-private-samba.so(SAMBA_4.23.5_PRIVATE_SAMBA)(64bit)" and the F45 build requires "libgse-private-samba.so(SAMBA_4.24.0RC2_PRIVATE_SAMBA)(64bit)".

There's an rc3 build in the pipeline for Rawhide right now which provides 4.24.0RC3 not 4.24.0RC2, so if that went stable it would break freeipa-server-trust-ad. Surely it should only be linking against / requiring libgse-private-samba.so()(64bit) ?

Comment 3 Adam Williamson 2026-02-24 21:25:10 UTC

+3 in https://pagure.io/fedora-qa/blocker-review/issue/2050 , marking accepted. The update has now passed tests so we can push it.

Comment 4 Fedora Update System 2026-02-24 23:08:31 UTC

FEDORA-2026-b73dee6cac has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b73dee6cac`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b73dee6cac

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-02-25 05:24:32 UTC

FEDORA-2026-b73dee6cac (freeipa-4.13.1-7.fc44, krb5-1.22.2-2.fc44, and 1 more) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Adam Williamson 2026-02-27 16:41:00 UTC

This is resolved, not sure why it wasn't autoclosed.