Created attachment 1406211 [details] dnf debugsolver Description of problem: Upgrading Fedora 27 to Fedora 28 is currently not possible because of broken nss-pem dependencies (probably due to multilib deps installed with wine). Version-Release number of selected component (if applicable): dnf-2.7.5-2.fc27.noarch python3-dnf-plugin-system-upgrade-2.0.5-1.fc27.noarch PackageKit-1.1.9-0.fc27.kalev_copr0.x86_64 Actual results: Last metadata expiration check: 0:00:00 ago on Fri 09 Mar 2018 10:22:06 AM CET. Error: Problem 1: nss-pem-1.0.3-6.fc27.i686 has inferior architecture - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package nss-pem-1.0.3-6.fc27.i686 ... Expected results: Upgradepath should work. Additional info: dnf debugsolver attached. The system was updated to the latest updates-testing.
Proposed as a Blocker for 28-beta by Fedora user lbrabec using the blocker tracking app because: "The upgraded system must include all packages that would be present on the system after a default installation from install media, plus any packages the user previously had (minus any obsolete content)." https://fedoraproject.org/wiki/Fedora_28_Beta_Release_Criteria#Upgrade_requirements
We had a similar issue in the past, with the p11-kit-trust package, which wasn't provided automatically for multilib i686, because no other package had a dependency on it. Nobody had given us a solution for a long time. I wish someone from release engineering could offer a solution, in which the nss-pem.i686 package is made available, without any package depending on it. Lacking that, my only idea is to introduce a new dummy package into Fedora, such as nss-pem-survival, which has no other function than having a dependency on nss-pem.
Could we add a subpackage, to the main nss.rpm package? The subpackage would be called e.g. nss-pem-survival, and would be empty, and only have the dependency on nss-pem. No other package would depend on nss-pem-survival.
I wonder if the new nss-subpackage should also do this for p11-kit-trust. We could also use it for any other packages that could potentially be used by some users together with NSS on i686, but which aren't stricly required by anyone. So instead of nss-pem-survial, we could e.g. use the sub-package name: nss-optional-deps
Daiki, Kamil, what do you think?
Fedora releng maintains a list of explicitly multilib packages, and this list is used when creating a compose. If this is the case of nss-pem, you need to request releng to add it to the list. A releng ticket can be created here: https://pagure.io/releng/
I see some confusions here: - The p11-kit-trust multilib issue has already been resolved in the way suggested in comment 6 a while ago: https://pagure.io/releng/issue/6855 - Regarding adding an empty subpackage that depends on nss-pem; in bug 1539401, we removed the dependency on nss-pem. Wouldn't that mean to revert the change?
(In reply to Daiki Ueno from comment #7) > - Regarding adding an empty subpackage that depends on nss-pem; in bug > 1539401, we removed the dependency on nss-pem. Wouldn't that mean to revert > the change? It would be different. In the past, because nss.rpm had a dependency on nss-pem.rpm, the nss-pem.rpm package was installed together with the main nss package. We no longer want nss-pem.rpm to get automatically installed, only if another package depends on it. If nss.rpm doesn't depend on nss-optional-deps.rpm, I believe nss-pem wouldn't get installed automatically. However, because nss.rpm is built for i686, and nss-optional-deps.rpm will be built for i686, too. And I suspect this might be sufficient to ensure that nss-pem.rpm is built, too. p11-kit-trust is unrelated to this bug. I understand it's solved currently. However, in the past, i believe it happened once that it was accidently dropped from the rel-eng exception list. If the idea with nss-optional-deps could work, then extending it to p11-kit-trust, too, could provide an additional mechanism to ensure it won't get dropped.
(In reply to Kai Engert (:kaie) from comment #4) > So instead of nss-pem-survial, we could e.g. use the sub-package name: > nss-optional-deps That really does not feel like a sensible way to solve it. (In reply to Kamil Páral from comment #6) > Fedora releng maintains a list of explicitly multilib packages, and this > list is used when creating a compose. If this is the case of nss-pem, you > need to request releng to add it to the list. What exactly do you mean by "the case"? Is it intended for all packages that can be installed as multilib, or just for packages that are actually needed to work as multilib? If the former, I will create the ticket. If the letter, I propose to make nss-pem.x86_64 uninstall nss-pem.i686 on upgrade and stop supporting nss-pem.i686 on an x86_64 system.
Sorry, I don't fully understand the question, perhaps because I'm not much of a packager. If you want your package to be marked as multilib, and it isn't automatically, you can request releng to add it to their list.
Let me clarify it. Some i686 packages can (technically) be installed in parallel with x86_64 packages but nobody needs them installed in parallel. If the policy is that whatever maintainers ask for is added on the explicit list of mulitilib packages, then I will not ask for adding nss-pem on that list until we have any users of nss-pem actually requesting it. The reason why nss-pem used to be a multilib package is that libcurl and openldap (which themselves are multilib packages) were depending on it. However, libcurl dropped the dependency in f27 and openldap dropped the dependency in f28. I am not aware of any other reason for keeping nss-pem multilib in f28+.
How could we achieve that a system upgrade will uninstall nss-pem.i686 (if installed), and only keep nss-pem.x86_64?
(In reply to Kai Engert (:kaie) from comment #12) > How could we achieve that a system upgrade will uninstall nss-pem.i686 (if > installed), and only keep nss-pem.x86_64? This seems to do the trick: Obsoletes: nss-pem < %{version}-%{release} %if 0%{?__isa_bits} == 64 Conflicts: nss-pem%(tmp="%{_isa}" && echo "${tmp/-64/-32}") < %{version}-%{release} %endif Actually, just the Obsoletes line was sufficient in my testing scenario but I am not sure it would force the removal of nss-pem.i686 in all cases. The Conflicts line makes it explicit.
Kamil, which package should add the statements that you suggested in comment 13?
It needs to go to nss-pem.spec. Sorry if it was unclear. I am going to submit an update of nss-pem for f28 in a few days unless anybody stops me till then...
Thanks. I think that nobody will stop you. You are the nss-pem maintainer, you are the one who requested that nss-pem isn't completely removed from Fedora. I think it's your decision if you want to keep or remove nss-pem.i686 in Fedora 28. If you want to remove it, I think it's fine to proceed immediately.
I have pushed the proposed fix to rawhide for now, let's see how it works: https://src.fedoraproject.org/cgit/rpms/nss-pem.git/commit/?id=4d3c6ceb Just to clarify it, 32-bit nss-pem will still be built and it will be available in 32-bit RPM repos. The only change is that we will proactive purge old 32-bit builds of nss-pem on update of 64-bit systems.
nss-pem-1.0.3-9.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-7f8b60cd0e
Discussed during the 2018-03-12 blocker review meeting: [1] The decision to classify this bug as a RejectedBlocker and an AcceptedFreezeException was made as it does not violate any existing blocker criteria surrounding default packages, but it could impact users that use Wine, and so warrants a FreezeException. [1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2018-03-12/f28-blocker-review.2018-03-12-16.01.txt
nss-pem-1.0.3-9.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-7f8b60cd0e
nss-pem-1.0.3-9.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
Hi, for me the problem still persists (see second error): nss-pem seems to be needed by steam. Problem 1: package mariadb-libs-3:10.2.13-2.fc27.x86_64 requires mariadb-common(x86-64) = 3:10.2.13-2.fc27, but none of the providers can be installed - mariadb-common-3:10.2.13-2.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package mariadb-libs-3:10.2.13-2.fc27.x86_64 Problem 2: nss-pem-1.0.3-6.fc27.i686 has inferior architecture - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package nss-pem-1.0.3-6.fc27.i686
(In reply to axel from comment #22) > nss-pem seems to be needed by steam. Is 'steam' something that we support in Fedora? Any idea why is nss-pem.i686 actually needed by 'steam'? Note that nss-pem.i686 is still available in i686 Fedora repositories. Could you get around the problem by enabling the i686 repositories?
I too cannot upgrade to Fedora 28 because of this error regarding nss-pem.i686. When I try to remove nss-pem.i686 it also wants to remove packages related to Wine and PlayOnLinux and their dependencies. All of these packages are from the official Fedora repositories. I've tried enabling the i686 Fedora repositories but it doesn't work. I also did a `dnf clean all` followed by `dnf --refresh upgrade` and `dnf system-upgrade download --refresh --releasever=28` after enabling the i686 repositories but the issue still persists. I would like to request we re-open this bug as this issue has not been resolved with the updated nss-pem package.
(In reply to Shaun Assam from comment #24) > I too cannot upgrade to Fedora 28 because of this error regarding > nss-pem.i686. When I try to remove nss-pem.i686 it also wants to remove > packages related to Wine and PlayOnLinux and their dependencies. All of > these packages are from the official Fedora repositories. Which packages exactly are available in official 64bit Fedora repos and require nss-pem.i686?
Created attachment 1419033 [details] nss-pem.i686 list of dependencies This is the output I get when attempting to remove the nss-pem.i686 package. It lists all the dependency packages and their architecture marked for removal.
[AnonymousUser@localhost ~]$ sudo dnf system-upgrade download --refresh --releasever=28 [sudo] password for AnonymousUser: Before you continue ensure that your system is fully upgraded by running "dnf --refresh upgrade". Do you want to continue [y/N]: y Fedora 28 - x86_64 3.7 MB/s | 60 MB 00:16 Failed to synchronize cache for repo 'rpmfusion-free-updates', disabling. Failed to synchronize cache for repo 'rpmfusion-nonfree-updates', disabling. Last metadata expiration check: 0:00:00 ago on Sun 08 Apr 2018 07:23:06 PM EDT. Error: Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package nss-pem-1.0.3-6.fc27.i686 This is what I get when attempting to update to fedora 28 beta. I did a DNF refresh right before updating. Either im doing something wrong, or this bug still exists. If you can fix it or give me insight, that'd be great!
[AnonymousUser@localhost ~]$ sudo dnf remove nss-pem-1.0.3-6.fc27.i686 Dependencies resolved. ================================================================================ Package Arch Version Repository Size ================================================================================ Removing: nss-pem i686 1.0.3-6.fc27 @updates 215 k Removing dependent packages: gstreamer1-plugins-base i686 1.12.4-1.fc27 @updates 4.9 M libgphoto2 i686 2.5.16-1.fc27 @updates 6.1 M llvm-libs i686 5.0.1-6.fc27 @updates 56 M mesa-libOSMesa i686 17.3.6-1.fc27 @updates 6.9 M nss i686 3.36.0-1.0.fc27 @updates 2.4 M openldap i686 2.4.45-4.fc27 @updates 1.0 M sane-backends-drivers-cameras i686 1.0.27-15.fc27 @updates 47 k sane-backends-drivers-scanners i686 1.0.27-15.fc27 @updates 9.9 M sane-backends-libs i686 1.0.27-15.fc27 @updates 197 k unixODBC i686 2.3.5-2.fc27 @updates 1.3 M vulkan i686 1.1.70.0-1.fc27 @updates 7.6 M wine-development-common i686 1:3.5-1 @WineHQ 180 M wine-development64 x86_64 1:3.5-1 @WineHQ 212 M winehq-devel x86_64 1:3.5-1 @WineHQ 61 k Removing unused dependencies: SDL2 i686 2.0.7-2.fc27 @updates 1.1 M cdparanoia-libs i686 10.2-24.fc27 @fedora 125 k cyrus-sasl-lib i686 2.1.26-34.fc27 @fedora 387 k gd i686 2.2.5-3.fc27 @updates 405 k gstreamer1 i686 1.12.4-1.fc27 @updates 4.2 M lcms2 i686 2.8-5.fc27 @fedora 375 k libXcomposite i686 0.4.4-11.fc27 @fedora 34 k libXcursor i686 1.1.15-1.fc27 @updates 45 k libXfixes i686 5.0.3-4.fc27 @fedora 25 k libXinerama i686 1.1.3-9.fc27 @fedora 14 k libXpm i686 3.5.12-4.fc27 @fedora 112 k libXv i686 1.0.11-4.fc27 @fedora 21 k libXxf86vm i686 1.1.4-6.fc27 @fedora 24 k libdb i686 5.3.28-27.fc27 @updates 1.9 M libedit i686 3.1-20.20170329cvs.fc27 @fedora 212 k libexif i686 0.6.21-14.fc27 @updates 1.8 M libieee1284 i686 0.2.11-23.fc27 @fedora 80 k libtheora i686 1:1.1.1-18.fc27 @fedora 703 k libtool-ltdl i686 2.4.6-20.fc27 @fedora 65 k libv4l i686 1.12.5-5.fc27 @fedora 503 k libvisual i686 1:0.4.0-23.fc27 @fedora 430 k libwebp i686 0.6.1-8.fc27 @updates 796 k mesa-libOSMesa x86_64 17.3.6-1.fc27 @updates 6.9 M mesa-libglapi i686 17.3.6-1.fc27 @updates 199 k ocl-icd i686 2.2.12-1.fc27 @updates 147 k opus i686 1.2.1-3.fc27 @fedora 364 k orc i686 0.4.28-1.fc27 @updates 623 k spirv-tools-libs i686 2018.1-0.2.20180205.git9e19fc0.fc27 @updates 2.4 M unixODBC x86_64 2.3.5-2.fc27 @updates 1.2 M Transaction Summary ================================================================================ Remove 44 Packages Freed space: 514 M Is this ok [y/N]: n Operation aborted. I was curious to see what happens if I remove nss-pem and it appears that 44 packages on my computer are dependent on it. So I cant just remove it to update to fedora 28. (pasted from terminal)
Indeed, reopening. dnf behaves differently than one would expect: # dnf install nss-pem-1.0.3-9.fc28 Dependencies resolved. ============================================================================== Package Arch Version Repository Size ============================================================================== Upgrading: nss-pem x86_64 1.0.3-9.fc28 updates-testing 80 k Transaction Summary ============================================================================== Upgrade 1 Package Total download size: 80 k Is this ok [y/N]: # dnf update nss-pem-1.0.3-9.fc28 Dependencies resolved. Problem: package nss-pem-1.0.3-9.fc28.x86_64 conflicts with nss-pem(x86-32) < 1.0.3-9.fc28 provided by nss-pem-1.0.3-6.fc27.i686 - cannot install the best update candidate for package nss-pem-1.0.3-6.fc27.x86_64 - problem with installed package nss-pem-1.0.3-6.fc27.i686 ============================================================================== Package Arch Version Repository Size ============================================================================== Skipping packages with conflicts: (add '--best --allowerasing' to command line to force their upgrade): nss-pem x86_64 1.0.3-9.fc28 updates-testing 80 k Transaction Summary ============================================================================== Skip 1 Package Nothing to do. Complete!
*** Bug 1564781 has been marked as a duplicate of this bug. ***
I am facing this too with: sudo dnf dist-upgrade --releasever=28 --enablerepo=updates-testing interrestingly: sudo dnf dist-upgrade --releasever=28 --allowerasing --enablerepo=updates-testing proceed without mentioning nss-pem.i686 (not evenin in list of packages to be removed). But --allowerasing should not be the default choice for upgrading. So this is not an option. I think that correct solution should be that rel-eng put nss-pem back on multilib list. When nothing in Fedora depends on nss-pem.i686 it does not mean that anything built on top of Fedora does not require it too.
(In reply to Miroslav Suchý from comment #31) > But --allowerasing should not be the default choice for upgrading. So this > is not an option. This is more a bug of dnf in my view. There is a workaround in comment #29: # dnf install nss-pem-1.0.3-9.fc28 > I think that correct solution should be that rel-eng put nss-pem back on > multilib list. When nothing in Fedora depends on nss-pem.i686 it does not > mean that anything built on top of Fedora does not require it too. Are you referring to some official policy? I do not think that all packages that can be installed as multilib are on the mentioned list just in case.
Created attachment 1419869 [details] debugdata-install.tar produced by 'dnf install --deburesolver nss-pem-1.0.3-9.fc28'
Created attachment 1419871 [details] debugdata-update.tar produced by 'dnf update --deburesolver nss-pem-1.0.3-9.fc28'
> Are you referring to some official policy? No. > I do not think that all packages that can be installed as multilib are on the mentioned list just in case. It is not "just in case". We *know* that there are packages (steam) which use nss as multilib.
(In reply to Miroslav Suchý from comment #35) > We *know* that there are packages (steam) which use nss as multilib. Really? Then please tell us which (steam) packages exactly require nss-pem.i686. To me it looks more like someone hit dnf bug #1566070, which itself was unrelated to steam.
(In reply to Kamil Dudka from comment #36) > (In reply to Miroslav Suchý from comment #35) > > We *know* that there are packages (steam) which use nss as multilib. > > Really? Then please tell us which (steam) packages exactly require > nss-pem.i686. To me it looks more like someone hit dnf bug #1566070, which > itself was unrelated to steam. You're correct, Kamil. To prove the point, on F27, running: dnf install nss-pem-1.0.3-9.fc28 --releasever=28 dnf system-upgrade --releasever=28 download will properly prepare for F27->F28 upgrade *without* deleting steam.
RPMFusion x86_64 repository contains steam-1.0.0.54-17.fc28.i686 http://download1.rpmfusion.org/nonfree/fedora/development/28/Everything/x86_64/os/repoview/steam.html # rpm -qR steam|grep nss nss(x86-32) # rpm -q steam steam-1.0.0.54-17.fc28.i686 # rpm -qR steam|grep nss nss(x86-32) # rpm -q nss nss-3.36.0-1.0.fc28.x86_64 nss-3.36.0-1.0.fc28.i686 # rpm -q --provides nss-3.36.0-1.0.fc28.x86_64 |grep 'nss(x86-32)' ##### nothing returned # rpm -q --provides nss-3.36.0-1.0.fc28.i686 |grep 'nss(x86-32)' nss(x86-32) = 3.36.0-1.0.fc28
Miroslav, I am not sure why you are pasting output of the above commands. This bug is about the nss-pem package, not the nss package.
Ahh, you're right. Sorry for the confusion.
Confirm that performing dnf install nss-pem-1.0.3-9.fc28 --releasever=28 dnf system-upgrade --releasever=28 download from Fedora 27 allows upgrade to proceed.
Confirm, you can upgrade with --allowerasing option. dnf system-upgrade download --refresh --releasever=28 --allowerasing
The system upgrade proceeds after running `dnf install nss-pem-1.0.3-9.fc28 --releasever=28`.
*** Bug 1573557 has been marked as a duplicate of this bug. ***
This bug still exists: I too cannot upgrade from Fedora 27 to 28 because of: Error: Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package nss-pem-1.0.3-6.fc27.i686 I don't want to outright remove the i686 version of nss-pem because apparently it is used by the i686 wine. Luckily, the following command suggested in earlier comments, which apparently overrides my nss-pem with the one from Fedora 28, indeed appears to fix things enough for "dnf system-upgrade download" to work: dnf install nss-pem-1.0.3-9.fc28 --releasever=28 Still, would be better if an update was pushed to Fedora 27 (not just Fedora 28) so that upgrades without this trickery would succeed.
(In reply to Nadav Har'El from comment #45) > Still, would be better if an update was pushed to Fedora 27 (not just Fedora > 28) so that upgrades without this trickery would succeed. That is exactly what bug #1566070 is about.
(In reply to Nadav Har'El from comment #45) > Luckily, the following command suggested in earlier comments, which > apparently overrides my nss-pem with the one from Fedora 28, indeed appears > to fix things enough for "dnf system-upgrade download" to work: > > dnf install nss-pem-1.0.3-9.fc28 --releasever=28 I just had to do this in order to upgrade my system to f28.
> dnf install nss-pem-1.0.3-9.fc28 --releasever=28 I'm having the same issue. This workaround worked.
Same issue, but I don't have steam, play-on-linux or anything else like that installed: $ sudo dnf system-upgrade download --refresh --releasever=28 Before you continue ensure that your system is fully upgraded by running "dnf --refresh upgrade". Do you want to continue [y/N]: y Last metadata expiration check: 0:00:00 ago on Thu 03 May 2018 09:27:30 BST. Error: Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package nss-pem-1.0.3-6.fc27.i686 I can't remove it because sudo depends on it: $ sudo dnf remove nss-pem Error: Problem: The operation would result in removing the following protected packages: sudo
(In reply to Phil Armstrong from comment #49) > Same issue, but I don't have steam, play-on-linux or anything else like that > installed: > > $ sudo dnf system-upgrade download --refresh --releasever=28 > Before you continue ensure that your system is fully upgraded by running > "dnf --refresh upgrade". Do you want to continue [y/N]: y > Last metadata expiration check: 0:00:00 ago on Thu 03 May 2018 09:27:30 BST. > Error: > Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture > - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository > - problem with installed package nss-pem-1.0.3-6.fc27.i686 > > I can't remove it because sudo depends on it: > $ sudo dnf remove nss-pem > Error: > Problem: The operation would result in removing the following protected > packages: sudo Use the command sudo dnf remove nss-pem-1.0.3-6.fc27.i686 to specifically remove that package. It seems there are multiple. using sudo dnf remove nss-pem gave me the same error.
Upgrade the nss package prior to moving to f28 as follows: # dnf install nss-pem-1.0.3-9.fc28 --releasever=28 then perform the "dnf system-upgrade download --releasever=28" this should work for those with the problem to get them past the update
*** Bug 1579118 has been marked as a duplicate of this bug. ***
can confirm that. The patch works. However wondering that the problem still exists.
I think the workaround with "dnf install nss-pem..." change the status of nss-pem package from installed as dependency to user installed. I would prefer clean system upgrade. I still wait.
Unless anybody is aware of a better workaround, I am going to close this bug as duplicate of bug #1566070. Marking nss-pem as multilib package, despite nobody uses it such, is not the correct way to fix the upgrade issue, in my opinion.
*** This bug has been marked as a duplicate of bug 1566070 ***
(In reply to Donald O. from comment #53) > can confirm that. The patch works. However wondering that the problem still > exists. it still persists. I had to do the workaround
I also tried an upgrade today and faced this issue. Having to dig in bugtrackers to find a workaround before upgrading is not really user-friendly, and can prevent several users from upgrading (like comment #54). It's IMO a major bug in the update process.
# dnf update nss-pem Last metadata expiration check: 0:20:16 ago on Sat 02 Jun 2018 07:57:03 AM EDT. Dependencies resolved. Nothing to do. Complete! --- # dnf remove nss-pem Error: Problem: The operation would result in removing the following protected packages: sudo Nice solution...
# dnf install nss-pem-1.0.3-9.fc28 --releasever=28 ... Upgraded: nss.i686 3.36.1-1.1.fc28 nss.x86_64 3.36.1-1.1.fc28 nss-pem.x86_64 1.0.3-9.fc28 nss-sysinit.x86_64 3.36.1-1.1.fc28 nss-tools.x86_64 3.36.1-1.1.fc28 Complete!
(In reply to Daniel Zirkin from comment #60) > # dnf install nss-pem-1.0.3-9.fc28 --releasever=28 > > ... > > > Upgraded: > nss.i686 3.36.1-1.1.fc28 nss.x86_64 3.36.1-1.1.fc28 nss-pem.x86_64 > 1.0.3-9.fc28 nss-sysinit.x86_64 3.36.1-1.1.fc28 nss-tools.x86_64 > 3.36.1-1.1.fc28 > > Complete! Works for me. Tks.
Same issue here: Erreur : Problème: nss-pem-1.0.3-6.fc27.i686 has inferior architecture - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository - problem with installed package nss-pem-1.0.3-6.fc27.i686 Trying to solve by removing the culprit is a no-go for me (ton of stuff including wine and steam): $ sudo dnf remove nss-pem.i686 Dépendances résolues. ====================================================================================================================== Paquet Architecture Version Dépôt Taille ====================================================================================================================== Suppression : nss-pem i686 1.0.3-6.fc27 @updates 215 k Supprimer des paquets dépendants: libcurl i686 7.55.1-12.fc27 @updates 585 k libdbusmenu-gtk2 i686 16.04.0-4.fc27 @fedora 79 k libdbusmenu-gtk3 i686 16.04.0-4.fc27 @fedora 79 k libgphoto2 i686 2.5.16-1.fc27 @updates 6.1 M mingw32-wine-gecko noarch 2.47-2.fc26 @fedora 48 M mingw64-wine-gecko noarch 2.47-2.fc26 @fedora 49 M nss i686 3.38.0-1.0.fc27 @updates 2.4 M openldap i686 2.4.45-4.fc27 @updates 1.0 M samba-common-tools x86_64 2:4.7.8-0.fc27 @updates 1.1 M samba-libs x86_64 2:4.7.8-0.fc27 @updates 740 k samba-winbind x86_64 2:4.7.8-0.fc27 @updates 1.5 M samba-winbind-clients x86_64 2:4.7.8-0.fc27 @updates 132 k samba-winbind-modules x86_64 2:4.7.8-0.fc27 @updates 79 k sane-backends-drivers-cameras i686 1.0.27-17.fc27 @updates 47 k sane-backends-drivers-scanners i686 1.0.27-17.fc27 @updates 9.9 M sane-backends-libs i686 1.0.27-17.fc27 @updates 197 k steam i686 1.0.0.54-18.fc27 @rpmfusion-nonfree-updates 2.7 M wine x86_64 3.13-3.fc27 @updates 0 wine-alsa i686 3.13-3.fc27 @updates 195 k wine-alsa x86_64 3.13-3.fc27 @updates 212 k wine-capi i686 3.13-3.fc27 @updates 83 k wine-capi x86_64 3.13-3.fc27 @updates 85 k wine-cms i686 3.13-3.fc27 @updates 124 k wine-cms x86_64 3.13-3.fc27 @updates 137 k wine-common noarch 3.13-3.fc27 @updates 142 k wine-core i686 3.13-3.fc27 @updates 190 M wine-core x86_64 3.13-3.fc27 @updates 201 M wine-desktop noarch 3.13-3.fc27 @updates 695 k wine-fonts noarch 3.13-3.fc27 @updates 0 wine-ldap i686 3.13-3.fc27 @updates 360 k wine-ldap x86_64 3.13-3.fc27 @updates 411 k wine-openal i686 3.13-3.fc27 @updates 114 k wine-openal x86_64 3.13-3.fc27 @updates 144 k wine-opencl i686 3.13-3.fc27 @updates 110 k wine-opencl x86_64 3.13-3.fc27 @updates 123 k wine-pulseaudio i686 3.13-3.fc27 @updates 170 k wine-pulseaudio x86_64 3.13-3.fc27 @updates 183 k wine-twain i686 3.13-3.fc27 @updates 225 k wine-twain x86_64 3.13-3.fc27 @updates 227 k Suppression des dépendances inutilisées: cyrus-sasl-lib i686 2.1.26-34.fc27 @fedora 387 k gd i686 2.2.5-3.fc27 @updates 405 k isdn4k-utils i686 3.27-8.fc27 @fedora 2.4 M isdn4k-utils x86_64 3.27-8.fc27 @fedora 2.4 M isdn4k-utils-data noarch 3.27-8.fc27 @fedora 1.6 M libXScrnSaver i686 1.2.2-13.fc27 @fedora 35 k libXpm i686 3.5.12-4.fc27 @fedora 112 k libdb i686 5.3.28-27.fc27 @updates 1.9 M libdbusmenu i686 16.04.0-4.fc27 @fedora 535 k libexif i686 0.6.21-14.fc27 @updates 1.8 M libieee1284 i686 0.2.11-23.fc27 @fedora 80 k libnghttp2 i686 1.31.1-1.fc27 @updates 163 k libpng12 i686 1.2.57-4.fc27 @fedora 451 k libpsl i686 0.18.0-3.fc27 @updates 55 k libssh2 i686 1.8.0-5.fc27 @fedora 197 k libv4l i686 1.12.5-5.fc27 @fedora 503 k libva i686 1.8.3-5.fc27 @updates 222 k libva-intel-driver i686 1.8.3-3.fc27 @rpmfusion-free-updates 4.2 M libvkd3d i686 1.0-1.fc27 @updates 382 k libvkd3d x86_64 1.0-1.fc27 @updates 403 k libwebp i686 1.0.0-1.fc27 @updates 837 k mesa-libOSMesa i686 17.3.9-1.fc27 @updates 7.1 M mesa-libOSMesa x86_64 17.3.9-1.fc27 @updates 6.9 M mpg123-libs i686 1.25.6-1.fc27 @fedora 537 k nss-mdns i686 0.14.1-1.fc27 @updates 126 k nss-softokn i686 3.38.0-1.0.fc27 @updates 1.7 M ocl-icd i686 2.2.12-1.fc27 @updates 147 k python2-talloc x86_64 2.1.13-1.fc27 @updates 27 k wine-courier-fonts noarch 3.13-3.fc27 @updates 170 k wine-fixedsys-fonts noarch 3.13-3.fc27 @updates 37 k wine-marlett-fonts noarch 3.13-3.fc27 @updates 32 k wine-mono noarch 4.7.3-1.fc27 @updates 57 M wine-ms-sans-serif-fonts noarch 3.13-3.fc27 @updates 4.6 M wine-small-fonts noarch 3.13-3.fc27 @updates 65 k wine-symbol-fonts noarch 3.13-3.fc27 @updates 51 k wine-system-fonts noarch 3.13-3.fc27 @updates 121 k wine-systemd noarch 3.13-3.fc27 @updates 119 wine-tahoma-fonts noarch 3.13-3.fc27 @updates 300 k wine-wingdings-fonts noarch 3.13-3.fc27 @updates 35 k Résumé de la transaction ====================================================================================================================== Supprimer 79 Paquets Tricky FIX as explained in comments above: $ sudo dnf install nss-pem-1.0.3-9.fc28 --releasever=28 Now I can upgrade to Fedora 28! $ sudo dnf system-upgrade download --releasever=28