Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: attempting to upgrade this system produced file ownership(?) problems (see below) Version-Release number of selected component (if applicable): see below How reproducible: always Steps to Reproduce: 1.see below 2. 3. Actual results: see below Expected results: clean upgrade Additional info: dnf -y --best upgrade python3-ipaclient.noarch python3-ipalib.noarch python3-xlrd.noarch Last metadata expiration check: 0:00:13 ago on Sat 03 Feb 2018 11:13:30 AM PST. Error: Problem 1: problem with installed package python2-mod_wsgi-4.5.20-2.fc28.x86_64 - package freeipa-server-4.6.3-1.fc28.x86_64 conflicts with mod_wsgi provided by python2-mod_wsgi-4.5.20-2.fc28.x86_64 - problem with installed package freeipa-server-4.6.1-4.fc28.x86_64 - package freeipa-server-4.6.1-4.fc28.x86_64 requires freeipa-client = 4.6.1-4.fc28, but none of the providers can be installed - package freeipa-client-4.6.1-4.fc28.x86_64 requires python3-ipaclient = 4.6.1-4.fc28, but none of the providers can be installed - cannot install both python3-ipaclient-4.6.3-1.fc28.noarch and python3-ipaclient-4.6.1-4.fc28.noarch - cannot install the best update candidate for package python3-ipaclient-4.6.1-4.fc28.noarch Problem 2: problem with installed package cobbler-2.8.2-1.fc28.x86_64 - package cobbler-2.8.2-1.fc28.x86_64 requires mod_wsgi, but none of the providers can be installed - package freeipa-server-4.6.3-1.fc28.x86_64 conflicts with mod_wsgi provided by python2-mod_wsgi-4.5.20-2.fc28.x86_64 - package freeipa-server-trust-ad-4.6.3-1.fc28.x86_64 requires freeipa-server = 4.6.3-1.fc28, but none of the providers can be installed - problem with installed package freeipa-server-trust-ad-4.6.1-4.fc28.x86_64 - package freeipa-server-trust-ad-4.6.1-4.fc28.x86_64 requires freeipa-common = 4.6.1-4.fc28, but none of the providers can be installed - package freeipa-common-4.6.3-1.fc28.noarch conflicts with ipa-common provided by freeipa-common-4.6.1-4.fc28.noarch - package python3-ipalib-4.6.3-1.fc28.noarch requires freeipa-common = 4.6.3-1.fc28, but none of the providers can be installed - cannot install the best update candidate for package python3-ipalib-4.6.1-4.fc28.noarch
Introduced in https://src.fedoraproject.org/rpms/freeipa/c/a416470bc566fc08f8016e845db34815e8f24262
It's not file conflict but a package conflict. I added the conflict on purpose. It's not possible to load the Apache mod_wsgi (Python 2) and python3-mod_wsgi modules at the same time. Only one of them can be enabled at the same time. Since IPA 4.6, the server runs on Python 3. I added a conflict with mod_wsgi to avoid bugs. You have to install or upgrade with ``dnf install --best --allowerasing`` or remove mod_wsgi before you install IPA.
I talked to Charalampos. We will try to find a better way to solve the issue.
I also think package Conflicts: arent' the way to go here. The guidelines say "we can usually make it so that conflicting packages can be installed and the user can decide which package to enable afterwards" ... and they only get stricter after that. It looks like python2-mod_wsgi and python3-mod_wsgi already have a check, so only one can be loaded at once. And that is check is in /etc, packaged as %config -- which sounds like what the guidelines intended. Would it be possible for IPA to detect if the wrong mod_wsgi is loaded, and give a reasonable error message on startup? Then the admin can uninstall python2-mod_wsgi manually, a better experience than what DNF will give you.
Charalampos told me that RPM conflict is problematic because only distribution upgrades use --best --allowerasing. Standard updates do not. However we need to ensure that freeipa-server-4.6.* uses python3-mod_wsgi. If both Python 2 and Python 3 variant is installed, then we may end up with Python 2 mod_wsgi, which breaks the server. The packages can be installed at the same time, but only one module can be loaded: $ cat /etc/httpd/conf.modules.d/10-wsgi-python3.conf # NOTE: mod_wsgi_python3 can not coexist in the same apache process as # mod_wsgi (python2). Only load if mod_wsgi is not already loaded. <IfModule !wsgi_module> LoadModule wsgi_module modules/mod_wsgi_python3.so </IfModule> We cannot fix the issue in /etc/httpd/conf.d/ipa.conf because the config file is loaded **after** the module configs. /etc/httpd/conf/httpd.conf first "Include conf.modules.d/*.conf", then "IncludeOptional conf.d/*.conf". I could remove the package conflict and install a freeIPA config file (/etc/httpd/conf.modules.d/02-ipa-wsgi-python3.conf) instead. The 02 prefix ensure that it gets loaded before the package config file from mod_wsgi is loaded.
# NOTE: mod_wsgi_python3 can not coexist in the same apache process as # mod_wsgi (python2). Only load if mod_wsgi is not already loaded. BTW We need to do it the other way around (some day).
Christina, the long term solution is to stop using the common apahce config file and system unit file and write our own config file and unit file complitely separate fro the system ones. It'd be nice to use this bugs as an excuse to finally do so.
Upstream ticket: https://pagure.io/freeipa/issue/7394
Fixed upstream master: https://pagure.io/freeipa/c/1785a3e17b9196ac661074ae66c4774d720358fb ipa-4-6: https://pagure.io/freeipa/c/3336051a9feb70ceab32e43015caced82d79eb5f
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle. Changing version to '28'.
Should be fixed in freeipa-4.6.90.pre1-3.fc28.