The freeipa-client, freeipa-server, freeipa-server-dns and freeipa-server-trust-ad RPMs require both Python 2 and Python 3.
Except in very special circumstances, there is no need for one package
to drag in both Python stacks. Usually, this is a packaging error: in this case the packages have Python 2 dependencies and '/usr/bin/python3' shebangs which introduce the dependency on Python 3. There is a section on
shebangs in the Python RPM Porting Guide .
As freeipa upstream supports Python 3 starting the latest release 4.6.0 ,
please switch the packages to Python 3. If there is anything blocking this,
then please let us know.
It's ok to do this in Rawhide only, however, it would be greatly
appreciated if you could push it to Fedora 26 as well.
If anything is unclear, or if you need any kind of assistance, you can
ask on IRC (#fedora-python on Freenode), or reply here. We'll be happy
to help investigating or fixing this issue!
DNSSec support tooling in IPA is still not working correctly in Python3, therefore the tools still requires Python2. We are looking into it but I don't know yet when it will be solved.
The other part is in freeipa-server-trust-ad should be fixed now upstream.
Update: we are not atm looking into fixing ipa-server-dns to not depend on Python3 We are not aiming for F27 release.
The dependencies on python 2 were removed from all freeipa packages, except freeipa-server-dns, which is still not ported to python 3, I've opened a separate upstream ticket for the effort:
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle.
Changing version to '28'.
Should be fixed in freeipa-4.6.90.pre1-3.fc28.