Bug 1500655 - nss-pem error while updating to fedora 27
Summary: nss-pem error while updating to fedora 27
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: nss
Version: 26
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Kai Engert (:kaie) (inactive account)
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1507482 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-11 09:49 UTC by Quentin Tayssier
Modified: 2018-05-02 12:18 UTC (History)
22 users (show)

Fixed In Version: nss-3.34.0-1.0.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-11-27 21:23:36 UTC


Attachments (Terms of Use)

Description Quentin Tayssier 2017-10-11 09:49:40 UTC
Description of problem:
Upgrade with dnf to fedora  27 from fedora 26


Version-Release number of selected component (if applicable):
26

Problem 1: nss-pem-1.0.3-3.fc26.i686 has inferior architecture
  - nss-pem-1.0.3-3.fc26.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-3.fc26.i686

Comment 1 Kamil Dudka 2017-10-11 14:32:57 UTC
Thank you for reporting the issue!

This seems to be triggered by the following change:

https://fedoraproject.org/wiki/Changes/libcurlBackToOpenSSL

Previously, the nss-pem package was marked as multilib thanks to this patch in libcurl.spec:

https://src.fedoraproject.org/cgit/rpms/curl.git/commit/?id=4832a02c

The code is no longer there because we build libcurl against OpenSSL in Fedora now.  So the patch can be transferred to nss.spec:

--- a/nss.spec
+++ b/nss.spec
@@ -35,9 +35,9 @@ BuildRequires:    perl-interpreter
 # nss-pem used to be bundled with the nss package on Fedora -- make sure that
 # programs relying on that continue to work until they are fixed to require
 # nss-pem instead.  Once all of them are fixed, the following line can be
 # removed.  See https://bugzilla.redhat.com/1346806 for details.
-Requires:         nss-pem
+Requires:         nss-pem%{?_isa}

 # NSS 3.28.1 introduced a curve, that is smaller than a check in old
 # Mozilla code allows.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1413182

... or the multilib-corrected dependency can be moved to the openldap package, which seems to be the latest user of nss-pem in Fedora.

Comment 3 Kamil Dudka 2017-10-30 11:35:14 UTC
*** Bug 1507482 has been marked as a duplicate of this bug. ***

Comment 4 Jeff Layton 2017-11-10 13:30:53 UTC
I've hit the same problem. Can someone apply the correct fix for f27? AFAIK, this is the only thing holding me back from a f26 to f27 upgrade.

Comment 5 Daiki Ueno 2017-11-10 14:21:00 UTC
Thank you for reminding (and thanks Kamil for the patch).  I have pushed the fix as:
http://pkgs.fedoraproject.org/cgit/rpms/nss.git/commit/?h=f27&id=09bd50715f5d2c0043da1f60227c3f292112187d

The upcoming rebase of NSS (to 3.34) will pick up this change.

Comment 6 Alexandre Singh 2017-11-14 15:34:48 UTC
Hello, same error here.

However before seeing this bug report I decided to upgrade anyway with "--allowerasing" flag, thinking that it shouldn't be critical.

Packages are updating right now. Did I destroyed something?

Comment 7 Kamil Dudka 2017-11-14 15:40:01 UTC
(In reply to Alexandre Singh from comment #6)
> However before seeing this bug report I decided to upgrade anyway with
> "--allowerasing" flag, thinking that it shouldn't be critical.

It is unfortunate that --allowerasing does not take a parameter.

> Packages are updating right now. Did I destroyed something?

It depends on which packages have been selected for removal.

Comment 8 Alexandre Singh 2017-11-14 15:46:49 UTC
(In reply to Kamil Dudka from comment #7)
Thank you for answering that fast!

> It depends on which packages have been selected for removal.
Nothing alarming I guess, usual kernel replacement, and removal of nss-pem i686:

Removing :
 kernel                                          x86_64       4.13.10-200.fc26                              @updates                                      0  
 kernel-core                                     x86_64       4.13.10-200.fc26                              @updates                                     55 M
 kernel-devel                                    x86_64       4.13.10-200.fc26                              @updates                                     43 M
 kernel-modules                                  x86_64       4.13.10-200.fc26                              @updates                                     24 M
 kernel-modules-extra                            x86_64       4.13.10-200.fc26                              @updates                                    2.0 M
Deleting dependancies:
 nss-pem                                         i686         1.0.3-3.fc26                                  @fedora                                     215 k
Retrograding:
 duplicity                                       x86_64       0.7.14-1.fc27                                 fedora                                      547 k
 mod_http2                                       x86_64       1.10.10-2.fc27                                fedora                                      151 k
 python2                                         x86_64       2.7.13-17.fc27                                fedora                                       99 k
 python2-libs                                    x86_64       2.7.13-17.fc27                                fedora                                      6.3 M
 sassc                                           x86_64       3.4.1-2.fc26                                  fedora                                       15 k
 spice-server                                    x86_64       0.13.90-2.fc27                                fedora                                      394 k
 sssd-nfs-idmap                                  x86_64       1.15.3-5.fc27                                 fedora                                       79 k
 wget                                            x86_64       1.19.1-3.fc27                                 fedora                                      725 k
 xorg-x11-drv-amdgpu

Comment 9 Kamil Dudka 2017-11-14 15:50:19 UTC
Removal of nss-pem.i686 should be safe unless you use openldap.i686.  Fedora 27 libcurl does not use nss-pem any more.

Comment 10 Alexandre Singh 2017-11-14 15:54:21 UTC
Package openldap.i686 is installed and currently upgraded. I probably have this because of Steam (from RPMFusion) and LinuxSteamIntegration (from a Copr).

Comment 11 Kamil Dudka 2017-11-14 16:03:22 UTC
In case you really need nss-pem.i686, you can download it directly from Koji:

https://koji.fedoraproject.org/koji/buildinfo?buildID=948917

Comment 12 Alexandre Singh 2017-11-14 16:07:40 UTC
Bookmarked the link if I need it sooner or later.
Well I guess I can upgrade safely, I'll report back after.

Thank you for your help! :)

Comment 13 Alexandre Singh 2017-11-14 21:26:15 UTC
Well, upgrade is a success, Steam+LSI still work flawlessly, so everything is ok for me (except a problem with an updated package but nothing related).

Thank you again!

Comment 14 Jeff Layton 2017-11-15 02:02:00 UTC
Just to follow up. ISTR that I tried using --allowerasing at one point, and it wanted to remove a whole swath of packages that I didn't want removed.

I tried it again today and it worked just fine. nss-pem was removed but in f27, not much relies on it anymore so removing it was no problem. I guess some dependency problem got cleaned up since then?

Comment 15 Fedora Update System 2017-11-15 14:57:48 UTC
nss-3.34.0-1.0.fc27 nss-softokn-3.34.0-1.0.fc27 nss-util-3.34.0-1.0.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-24169bbb2d

Comment 16 Fedora Update System 2017-11-15 14:58:26 UTC
nss-3.34.0-1.0.fc26 nss-softokn-3.34.0-1.0.fc26 nss-util-3.34.0-1.0.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-552febe596

Comment 17 Fedora Update System 2017-11-15 14:58:45 UTC
nss-3.34.0-1.0.fc25 nss-softokn-3.34.0-1.0.fc25 nss-util-3.34.0-1.0.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-15b7f781f0

Comment 18 Fedora Update System 2017-11-15 22:43:24 UTC
nss-3.34.0-1.0.fc25, nss-softokn-3.34.0-1.0.fc25, nss-util-3.34.0-1.0.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-15b7f781f0

Comment 19 Fedora Update System 2017-11-15 23:53:39 UTC
nss-3.34.0-1.0.fc27, nss-softokn-3.34.0-1.0.fc27, nss-util-3.34.0-1.0.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-24169bbb2d

Comment 20 Daiki Ueno 2017-11-16 10:27:12 UTC
The F27 update has just received this feedback:
"nothing provides nss-pem(x86-32) needed by nss-3.34.0-1.0.fc27.i686"
https://bodhi.fedoraproject.org/updates/nss-3.34.0-1.0.fc27%20nss-softokn-3.34.0-1.0.fc27%20nss-util-3.34.0-1.0.fc27#comment-695535

Indeed, nss-pem.i686 is missing in the F27 repo:
https://dl.fedoraproject.org/pub/fedora/linux/releases/27/Everything/x86_64/os/Packages/n/

From the comments, I suppose this is because the libcurl package no longer requires nss-pem.

Kamil, would you mind suggesting a way to resolve it?

Comment 21 Kamil Dudka 2017-11-16 11:08:12 UTC
Sorry, I forgot an important detail.  We need to include nss-pem in the update.

nss-pem-1.0.3-6.fc27 is currently being built:

https://koji.fedoraproject.org/koji/taskinfo?taskID=23155303

Daiki, could you please add it to your f27 nss erratum once it is ready?

Comment 22 Fedora Update System 2017-11-16 14:16:55 UTC
nss-3.34.0-1.0.fc27 nss-pem-1.0.3-6.fc27 nss-softokn-3.34.0-1.0.fc27 nss-util-3.34.0-1.0.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-24169bbb2d

Comment 23 Fedora Update System 2017-11-16 17:19:55 UTC
nss-3.34.0-1.0.fc26, nss-softokn-3.34.0-1.0.fc26, nss-util-3.34.0-1.0.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-552febe596

Comment 24 Fedora Update System 2017-11-17 18:53:39 UTC
nss-3.34.0-1.0.fc27, nss-pem-1.0.3-6.fc27, nss-softokn-3.34.0-1.0.fc27, nss-util-3.34.0-1.0.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-24169bbb2d

Comment 25 Sergei S. Rublёv 2017-11-24 20:37:46 UTC
Got this also. Used "rpm -e --nodeps nss-pem.i686" that helped.

Comment 26 Kamil Dudka 2017-11-24 21:02:31 UTC
(In reply to Sergei S. Rublёv from comment #25)
> Got this also. Used "rpm -e --nodeps nss-pem.i686" that helped.

As the problem is already fixed in updates-testing, the following command should help (without breaking dependencies of already installed packages):

# dnf --enablerepo=updates-testing update nss-pem.i686

Comment 27 Vincent Poinot 2017-11-25 16:28:03 UTC
(In reply to Kamil Dudka from comment #26)
> As the problem is already fixed in updates-testing, the following command
> should help (without breaking dependencies of already installed packages):
> 
> # dnf --enablerepo=updates-testing update nss-pem.i686

Is there any chance to get the fix in the stable branch?
I have just run sudo dnf system-upgrade download --refresh --releasever=27, and the problem is still there...
From what I understand, I would need to enable the updates-testing repo to get it working, but I'd rather avoid doing that, I wish I could just stay on stable.
No problem if it takes time, I can wait...

Comment 28 Antonin 2017-11-26 11:44:35 UTC
I hope it will be fixed. I am still not able to upgrade to F27.

Comment 29 Kai Engert (:kaie) (inactive account) 2017-11-27 12:33:02 UTC
(In reply to Antonin from comment #28)
> I hope it will be fixed. I am still not able to upgrade to F27.

Please see the earlier comments in this bug, e.g. comment 24, which says that builds were provided for updates-testing. It usually takes a while of testing until things are pushed to stable.

Comment 30 Fedora Update System 2017-11-27 21:23:36 UTC
nss-3.34.0-1.0.fc27, nss-pem-1.0.3-6.fc27, nss-softokn-3.34.0-1.0.fc27, nss-util-3.34.0-1.0.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 31 Jerther 2017-11-27 23:08:14 UTC
That's fine for F27, but what about F26? I still can't upgrade to F27:

Last metadata expiration check: 0:00:00 ago on Mon 27 Nov 2017 06:03:42 PM EST.
Error: 
 Problem: nss-pem-1.0.3-3.fc26.i686 has inferior architecture
  - nss-pem-1.0.3-3.fc26.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-3.fc26.i686

Comment 32 Stephen Herr 2017-11-28 03:13:08 UTC
(In reply to Jerther from comment #31)
> That's fine for F27, but what about F26? I still can't upgrade to F27:
> 
> Last metadata expiration check: 0:00:00 ago on Mon 27 Nov 2017 06:03:42 PM
> EST.
> Error: 
>  Problem: nss-pem-1.0.3-3.fc26.i686 has inferior architecture
>   - nss-pem-1.0.3-3.fc26.x86_64 does not belong to a distupgrade repository
>   - problem with installed package nss-pem-1.0.3-3.fc26.i686

Maybe try it again? Are you pointing at a mirror that may be out-of-date?

I can confirm that the problem has been resolved for me and I have successfully upgraded to F27.

Comment 33 Antonin 2017-11-28 08:06:03 UTC
I was successful with upgrade to F27 too.

Comment 34 Kamil Dudka 2017-11-28 09:09:55 UTC
(In reply to Jerther from comment #31)
> That's fine for F27, but what about F26?

This bug does not exist in F26.  Wait till the update reaches the mirror you are using and the problem will just go away...

Comment 35 Jerther 2017-11-28 13:31:39 UTC
I did an update this morning with not much in it other than a kernel update. After a reboot, the upgrade from 26 to 27 finally worked. Well, in fact it's ongoing :)

Thanks!

Comment 36 Fedora Update System 2017-12-02 08:02:30 UTC
nss-3.34.0-1.0.fc25, nss-softokn-3.34.0-1.0.fc25, nss-util-3.34.0-1.0.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 37 Fedora Update System 2017-12-02 21:21:58 UTC
nss-3.34.0-1.0.fc26, nss-softokn-3.34.0-1.0.fc26, nss-util-3.34.0-1.0.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 38 Avram Lubkin 2018-05-01 20:12:59 UTC
Problem seems to have regressed and is showing up for F28 upgrades

Comment 39 Kamil Dudka 2018-05-02 12:18:47 UTC
(In reply to Avram Lubkin from comment #38)
> Problem seems to have regressed and is showing up for F28 upgrades

The regression is now tracked as bug #1566070.


Note You need to log in before you can comment on or make changes to this bug.