Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1553646 - Upgrading F27 > F28 is not possible because of nss-pem
Upgrading F27 > F28 is not possible because of nss-pem
Status: CLOSED DUPLICATE of bug 1566070
Product: Fedora
Classification: Fedora
Component: nss-pem (Show other bugs)
28
x86_64 Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Kamil Dudka
Fedora Extras Quality Assurance
RejectedBlocker AcceptedFreezeException
: Reopened
: 1564781 1573557 1579118 (view as bug list)
Depends On: 1566070
Blocks: F28BetaFreezeException
  Show dependency treegraph
 
Reported: 2018-03-09 04:27 EST by Lukas Brabec
Modified: 2018-09-20 07:03 EDT (History)
40 users (show)

See Also:
Fixed In Version: nss-pem-1.0.3-9.fc29 nss-pem-1.0.3-9.fc28
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1566070 (view as bug list)
Environment:
Last Closed: 2018-05-23 07:13:00 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
dnf debugsolver (8.03 MB, application/x-gzip)
2018-03-09 04:27 EST, Lukas Brabec
no flags Details
nss-pem.i686 list of dependencies (10.77 KB, text/plain)
2018-04-08 18:56 EDT, Shaun Assam
no flags Details
debugdata-install.tar produced by 'dnf install --deburesolver nss-pem-1.0.3-9.fc28' (9.31 MB, application/x-tar)
2018-04-10 09:11 EDT, Kamil Dudka
no flags Details
debugdata-update.tar produced by 'dnf update --deburesolver nss-pem-1.0.3-9.fc28' (9.31 MB, application/x-tar)
2018-04-10 09:12 EDT, Kamil Dudka
no flags Details

  None (edit)
Description Lukas Brabec 2018-03-09 04:27:43 EST
Created attachment 1406211 [details]
dnf debugsolver

Description of problem:
Upgrading Fedora 27 to Fedora 28 is currently not possible because of broken nss-pem dependencies (probably due to multilib deps installed with wine).

Version-Release number of selected component (if applicable):
dnf-2.7.5-2.fc27.noarch
python3-dnf-plugin-system-upgrade-2.0.5-1.fc27.noarch
PackageKit-1.1.9-0.fc27.kalev_copr0.x86_64


Actual results:
Last metadata expiration check: 0:00:00 ago on Fri 09 Mar 2018 10:22:06 AM CET.
Error: 
 Problem 1: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
  - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-6.fc27.i686
...

Expected results:
Upgradepath should work.

Additional info:
dnf debugsolver attached. The system was updated to the latest updates-testing.
Comment 1 Fedora Blocker Bugs Application 2018-03-09 04:29:04 EST
Proposed as a Blocker for 28-beta by Fedora user lbrabec using the blocker tracking app because:

 "The upgraded system must include all packages that would be present on the system after a default installation from install media, plus any packages the user previously had (minus any obsolete content)."

https://fedoraproject.org/wiki/Fedora_28_Beta_Release_Criteria#Upgrade_requirements
Comment 2 Kai Engert (:kaie) 2018-03-09 04:41:45 EST
We had a similar issue in the past, with the p11-kit-trust package, which wasn't provided automatically for multilib i686, because no other package had a dependency on it. Nobody had given us a solution for a long time.

I wish someone from release engineering could offer a solution, in which the nss-pem.i686 package is made available, without any package depending on it.

Lacking that, my only idea is to introduce a new dummy package into Fedora, such as nss-pem-survival, which has no other function than having a dependency on nss-pem.
Comment 3 Kai Engert (:kaie) 2018-03-09 05:54:02 EST
Could we add a subpackage, to the main nss.rpm package?

The subpackage would be called e.g. nss-pem-survival, and would be empty, and only have the dependency on nss-pem.

No other package would depend on nss-pem-survival.
Comment 4 Kai Engert (:kaie) 2018-03-09 05:56:57 EST
I wonder if the new nss-subpackage should also do this for p11-kit-trust. We could also use it for any other packages that could potentially be used by some users together with NSS on i686, but which aren't stricly required by anyone.

So instead of nss-pem-survial, we could e.g. use the sub-package name:
  nss-optional-deps
Comment 5 Kai Engert (:kaie) 2018-03-09 05:57:20 EST
Daiki, Kamil, what do you think?
Comment 6 Kamil Páral 2018-03-09 05:58:07 EST
Fedora releng maintains a list of explicitly multilib packages, and this list is used when creating a compose. If this is the case of nss-pem, you need to request releng to add it to the list. A releng ticket can be created here:
https://pagure.io/releng/
Comment 7 Daiki Ueno 2018-03-09 06:04:53 EST
I see some confusions here:

- The p11-kit-trust multilib issue has already been resolved in the way suggested in comment 6 a while ago:
https://pagure.io/releng/issue/6855

- Regarding adding an empty subpackage that depends on nss-pem; in bug 
1539401, we removed the dependency on nss-pem.  Wouldn't that mean to revert the change?
Comment 8 Kai Engert (:kaie) 2018-03-09 06:23:52 EST
(In reply to Daiki Ueno from comment #7)
> - Regarding adding an empty subpackage that depends on nss-pem; in bug 
> 1539401, we removed the dependency on nss-pem.  Wouldn't that mean to revert
> the change?

It would be different.

In the past, because nss.rpm had a dependency on nss-pem.rpm, the nss-pem.rpm package was installed together with the main nss package. We no longer want nss-pem.rpm to get automatically installed, only if another package depends on it.

If nss.rpm doesn't depend on nss-optional-deps.rpm, I believe nss-pem wouldn't get installed automatically.

However, because nss.rpm is built for i686, and nss-optional-deps.rpm will be built for i686, too. And I suspect this might be sufficient to ensure that nss-pem.rpm is built, too.

p11-kit-trust is unrelated to this bug. I understand it's solved currently. However, in the past, i believe it happened once that it was accidently dropped from the rel-eng exception list. If the idea with nss-optional-deps could work, then extending it to p11-kit-trust, too, could provide an additional mechanism to ensure it won't get dropped.
Comment 9 Kamil Dudka 2018-03-09 07:06:26 EST
(In reply to Kai Engert (:kaie) from comment #4)
> So instead of nss-pem-survial, we could e.g. use the sub-package name:
>   nss-optional-deps

That really does not feel like a sensible way to solve it.

(In reply to Kamil Páral from comment #6)
> Fedora releng maintains a list of explicitly multilib packages, and this
> list is used when creating a compose. If this is the case of nss-pem, you
> need to request releng to add it to the list.

What exactly do you mean by "the case"?  Is it intended for all packages that can be installed as multilib, or just for packages that are actually needed to work as multilib?

If the former, I will create the ticket.  If the letter,  I propose to make nss-pem.x86_64 uninstall nss-pem.i686 on upgrade and stop supporting nss-pem.i686 on an x86_64 system.
Comment 10 Kamil Páral 2018-03-09 07:22:19 EST
Sorry, I don't fully understand the question, perhaps because I'm not much of a packager. If you want your package to be marked as multilib, and it isn't automatically, you can request releng to add it to their list.
Comment 11 Kamil Dudka 2018-03-09 07:36:18 EST
Let me clarify it.  Some i686 packages can (technically) be installed in parallel with x86_64 packages but nobody needs them installed in parallel.  If the policy is that whatever maintainers ask for is added on the explicit list of mulitilib packages, then I will not ask for adding nss-pem on that list until we have any users of nss-pem actually requesting it.

The reason why nss-pem used to be a multilib package is that libcurl and openldap (which themselves are multilib packages) were depending on it.  However, libcurl dropped the dependency in f27 and openldap dropped the dependency in f28.  I am not aware of any other reason for keeping nss-pem multilib in f28+.
Comment 12 Kai Engert (:kaie) 2018-03-09 07:49:57 EST
How could we achieve that a system upgrade will uninstall nss-pem.i686 (if installed), and only keep nss-pem.x86_64?
Comment 13 Kamil Dudka 2018-03-09 09:37:02 EST
(In reply to Kai Engert (:kaie) from comment #12)
> How could we achieve that a system upgrade will uninstall nss-pem.i686 (if
> installed), and only keep nss-pem.x86_64?

This seems to do the trick:

Obsoletes: nss-pem < %{version}-%{release}
%if 0%{?__isa_bits} == 64
Conflicts: nss-pem%(tmp="%{_isa}" && echo "${tmp/-64/-32}") < %{version}-%{release}
%endif

Actually, just the Obsoletes line was sufficient in my testing scenario but I am not sure it would force the removal of nss-pem.i686 in all cases.  The Conflicts line makes it explicit.
Comment 14 Kai Engert (:kaie) 2018-03-09 09:50:32 EST
Kamil, which package should add the statements that you suggested in comment 13?
Comment 15 Kamil Dudka 2018-03-09 09:54:56 EST
It needs to go to nss-pem.spec.  Sorry if it was unclear.  I am going to submit an update of nss-pem for f28 in a few days unless anybody stops me till then...
Comment 16 Kai Engert (:kaie) 2018-03-09 09:58:32 EST
Thanks. I think that nobody will stop you.

You are the nss-pem maintainer, you are the one who requested that nss-pem isn't completely removed from Fedora. I think it's your decision if you want to keep or remove nss-pem.i686 in Fedora 28. If you want to remove it, I think it's fine to proceed immediately.
Comment 17 Kamil Dudka 2018-03-09 10:13:55 EST
I have pushed the proposed fix to rawhide for now, let's see how it works:

https://src.fedoraproject.org/cgit/rpms/nss-pem.git/commit/?id=4d3c6ceb

Just to clarify it, 32-bit nss-pem will still be built and it will be available in 32-bit RPM repos.  The only change is that we will proactive purge old 32-bit builds of nss-pem on update of 64-bit systems.
Comment 18 Fedora Update System 2018-03-12 11:36:25 EDT
nss-pem-1.0.3-9.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-7f8b60cd0e
Comment 19 Geoffrey Marr 2018-03-12 16:05:08 EDT
Discussed during the 2018-03-12 blocker review meeting: [1]

The decision to classify this bug as a RejectedBlocker and an AcceptedFreezeException was made as it does not violate any existing blocker criteria surrounding default packages, but it could impact users that use Wine, and so warrants a FreezeException.

[1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2018-03-12/f28-blocker-review.2018-03-12-16.01.txt
Comment 20 Fedora Update System 2018-03-13 11:08:36 EDT
nss-pem-1.0.3-9.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-7f8b60cd0e
Comment 21 Fedora Update System 2018-03-20 00:41:50 EDT
nss-pem-1.0.3-9.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
Comment 22 axel 2018-03-28 11:02:35 EDT
Hi, for me the problem still persists (see second error):

nss-pem seems to be needed by steam. 

Problem 1: package mariadb-libs-3:10.2.13-2.fc27.x86_64 requires mariadb-common(x86-64) = 3:10.2.13-2.fc27, but none of the providers can be installed
  - mariadb-common-3:10.2.13-2.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package mariadb-libs-3:10.2.13-2.fc27.x86_64
 Problem 2: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
  - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-6.fc27.i686
Comment 23 Kamil Dudka 2018-03-28 11:20:07 EDT
(In reply to axel from comment #22)
> nss-pem seems to be needed by steam.

Is 'steam' something that we support in Fedora?

Any idea why is nss-pem.i686 actually needed by 'steam'?

Note that nss-pem.i686 is still available in i686 Fedora repositories.  Could you get around the problem by enabling the i686 repositories?
Comment 24 Shaun Assam 2018-04-07 09:21:28 EDT
I too cannot upgrade to Fedora 28 because of this error regarding nss-pem.i686. When I try to remove nss-pem.i686 it also wants to remove packages related to Wine and PlayOnLinux and their dependencies. All of these packages are from the official Fedora repositories.

I've tried enabling the i686 Fedora repositories but it doesn't work. I also did a `dnf clean all` followed by `dnf --refresh upgrade` and `dnf system-upgrade download --refresh --releasever=28` after enabling the i686 repositories but the issue still persists.

I would like to request we re-open this bug as this issue has not been resolved with the updated nss-pem package.
Comment 25 Kamil Dudka 2018-04-08 17:06:20 EDT
(In reply to Shaun Assam from comment #24)
> I too cannot upgrade to Fedora 28 because of this error regarding
> nss-pem.i686. When I try to remove nss-pem.i686 it also wants to remove
> packages related to Wine and PlayOnLinux and their dependencies. All of
> these packages are from the official Fedora repositories.

Which packages exactly are available in official 64bit Fedora repos and require nss-pem.i686?
Comment 26 Shaun Assam 2018-04-08 18:56 EDT
Created attachment 1419033 [details]
nss-pem.i686 list of dependencies

This is the output I get when attempting to remove the nss-pem.i686 package. It lists all the dependency packages and their architecture marked for removal.
Comment 27 SlayerProof32 2018-04-08 19:44:16 EDT
[AnonymousUser@localhost ~]$  sudo dnf system-upgrade download --refresh --releasever=28
[sudo] password for AnonymousUser: 
Before you continue ensure that your system is fully upgraded by running "dnf --refresh upgrade". Do you want to continue [y/N]: y
Fedora 28 - x86_64                              3.7 MB/s |  60 MB     00:16    
Failed to synchronize cache for repo 'rpmfusion-free-updates', disabling.
Failed to synchronize cache for repo 'rpmfusion-nonfree-updates', disabling.
Last metadata expiration check: 0:00:00 ago on Sun 08 Apr 2018 07:23:06 PM EDT.
Error: 
 Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
  - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-6.fc27.i686

This is what I get when attempting to update to fedora 28 beta. I did a DNF refresh right before updating. Either im doing something wrong, or this bug still exists. If you can fix it or give me insight, that'd be great!
Comment 28 SlayerProof32 2018-04-08 19:53:26 EDT
[AnonymousUser@localhost ~]$ sudo dnf remove nss-pem-1.0.3-6.fc27.i686
Dependencies resolved.
================================================================================
 Package                        Arch   Version                   Repository
                                                                           Size
================================================================================
Removing:
 nss-pem                        i686   1.0.3-6.fc27              @updates 215 k
Removing dependent packages:
 gstreamer1-plugins-base        i686   1.12.4-1.fc27             @updates 4.9 M
 libgphoto2                     i686   2.5.16-1.fc27             @updates 6.1 M
 llvm-libs                      i686   5.0.1-6.fc27              @updates  56 M
 mesa-libOSMesa                 i686   17.3.6-1.fc27             @updates 6.9 M
 nss                            i686   3.36.0-1.0.fc27           @updates 2.4 M
 openldap                       i686   2.4.45-4.fc27             @updates 1.0 M
 sane-backends-drivers-cameras  i686   1.0.27-15.fc27            @updates  47 k
 sane-backends-drivers-scanners i686   1.0.27-15.fc27            @updates 9.9 M
 sane-backends-libs             i686   1.0.27-15.fc27            @updates 197 k
 unixODBC                       i686   2.3.5-2.fc27              @updates 1.3 M
 vulkan                         i686   1.1.70.0-1.fc27           @updates 7.6 M
 wine-development-common        i686   1:3.5-1                   @WineHQ  180 M
 wine-development64             x86_64 1:3.5-1                   @WineHQ  212 M
 winehq-devel                   x86_64 1:3.5-1                   @WineHQ   61 k
Removing unused dependencies:
 SDL2                           i686   2.0.7-2.fc27              @updates 1.1 M
 cdparanoia-libs                i686   10.2-24.fc27              @fedora  125 k
 cyrus-sasl-lib                 i686   2.1.26-34.fc27            @fedora  387 k
 gd                             i686   2.2.5-3.fc27              @updates 405 k
 gstreamer1                     i686   1.12.4-1.fc27             @updates 4.2 M
 lcms2                          i686   2.8-5.fc27                @fedora  375 k
 libXcomposite                  i686   0.4.4-11.fc27             @fedora   34 k
 libXcursor                     i686   1.1.15-1.fc27             @updates  45 k
 libXfixes                      i686   5.0.3-4.fc27              @fedora   25 k
 libXinerama                    i686   1.1.3-9.fc27              @fedora   14 k
 libXpm                         i686   3.5.12-4.fc27             @fedora  112 k
 libXv                          i686   1.0.11-4.fc27             @fedora   21 k
 libXxf86vm                     i686   1.1.4-6.fc27              @fedora   24 k
 libdb                          i686   5.3.28-27.fc27            @updates 1.9 M
 libedit                        i686   3.1-20.20170329cvs.fc27   @fedora  212 k
 libexif                        i686   0.6.21-14.fc27            @updates 1.8 M
 libieee1284                    i686   0.2.11-23.fc27            @fedora   80 k
 libtheora                      i686   1:1.1.1-18.fc27           @fedora  703 k
 libtool-ltdl                   i686   2.4.6-20.fc27             @fedora   65 k
 libv4l                         i686   1.12.5-5.fc27             @fedora  503 k
 libvisual                      i686   1:0.4.0-23.fc27           @fedora  430 k
 libwebp                        i686   0.6.1-8.fc27              @updates 796 k
 mesa-libOSMesa                 x86_64 17.3.6-1.fc27             @updates 6.9 M
 mesa-libglapi                  i686   17.3.6-1.fc27             @updates 199 k
 ocl-icd                        i686   2.2.12-1.fc27             @updates 147 k
 opus                           i686   1.2.1-3.fc27              @fedora  364 k
 orc                            i686   0.4.28-1.fc27             @updates 623 k
 spirv-tools-libs               i686   2018.1-0.2.20180205.git9e19fc0.fc27
                                                                 @updates 2.4 M
 unixODBC                       x86_64 2.3.5-2.fc27              @updates 1.2 M

Transaction Summary
================================================================================
Remove  44 Packages

Freed space: 514 M
Is this ok [y/N]: n
Operation aborted.

I was curious to see what happens if I remove nss-pem and it appears that 44 packages on my computer are dependent on it. So I cant just remove it to update to fedora 28. (pasted from terminal)
Comment 29 Kamil Dudka 2018-04-09 14:04:05 EDT
Indeed, reopening.   dnf behaves differently than one would expect:


# dnf install nss-pem-1.0.3-9.fc28
Dependencies resolved.
==============================================================================
 Package       Arch         Version               Repository             Size
==============================================================================
Upgrading:
 nss-pem       x86_64       1.0.3-9.fc28          updates-testing        80 k

Transaction Summary
==============================================================================
Upgrade  1 Package

Total download size: 80 k
Is this ok [y/N]:


# dnf update nss-pem-1.0.3-9.fc28 
Dependencies resolved.

 Problem: package nss-pem-1.0.3-9.fc28.x86_64 conflicts with nss-pem(x86-32) < 1.0.3-9.fc28 provided by nss-pem-1.0.3-6.fc27.i686
  - cannot install the best update candidate for package nss-pem-1.0.3-6.fc27.x86_64
  - problem with installed package nss-pem-1.0.3-6.fc27.i686
==============================================================================
 Package       Arch         Version               Repository             Size
==============================================================================
Skipping packages with conflicts:
(add '--best --allowerasing' to command line to force their upgrade):
 nss-pem       x86_64       1.0.3-9.fc28          updates-testing        80 k

Transaction Summary
==============================================================================
Skip  1 Package

Nothing to do.
Complete!
Comment 30 Kamil Dudka 2018-04-09 14:04:31 EDT
*** Bug 1564781 has been marked as a duplicate of this bug. ***
Comment 31 Miroslav Suchý 2018-04-10 03:03:23 EDT
I am facing this too with:

sudo dnf dist-upgrade   --releasever=28  --enablerepo=updates-testing

interrestingly:

sudo dnf dist-upgrade   --releasever=28 --allowerasing  --enablerepo=updates-testing

proceed without mentioning nss-pem.i686 (not evenin in list of packages to be removed).
But --allowerasing should not be the default choice for upgrading. So this is not an option.

I think that correct solution should be that rel-eng put nss-pem back on multilib list. When nothing in Fedora depends on nss-pem.i686 it does not mean that anything built on top of Fedora does not require it too.
Comment 32 Kamil Dudka 2018-04-10 04:19:38 EDT
(In reply to Miroslav Suchý from comment #31)
> But --allowerasing should not be the default choice for upgrading. So this
> is not an option.

This is more a bug of dnf in my view.  There is a workaround in comment #29:

# dnf install nss-pem-1.0.3-9.fc28

> I think that correct solution should be that rel-eng put nss-pem back on
> multilib list. When nothing in Fedora depends on nss-pem.i686 it does not
> mean that anything built on top of Fedora does not require it too.

Are you referring to some official policy?  I do not think that all packages
that can be installed as multilib are on the mentioned list just in case.
Comment 33 Kamil Dudka 2018-04-10 09:11 EDT
Created attachment 1419869 [details]
debugdata-install.tar produced by 'dnf install --deburesolver nss-pem-1.0.3-9.fc28'
Comment 34 Kamil Dudka 2018-04-10 09:12 EDT
Created attachment 1419871 [details]
debugdata-update.tar produced by 'dnf update --deburesolver nss-pem-1.0.3-9.fc28'
Comment 35 Miroslav Suchý 2018-04-13 07:16:01 EDT
> Are you referring to some official policy?

No.

> I do not think that all packages
that can be installed as multilib are on the mentioned list just in case.

It is not "just in case". We *know* that there are packages (steam) which use nss as multilib.
Comment 36 Kamil Dudka 2018-04-14 09:35:49 EDT
(In reply to Miroslav Suchý from comment #35)
> We *know* that there are packages (steam) which use nss as multilib.

Really?  Then please tell us which (steam) packages exactly require nss-pem.i686.  To me it looks more like someone hit dnf bug #1566070, which itself was unrelated to steam.
Comment 37 Elad Alfassa 2018-04-14 15:20:20 EDT
(In reply to Kamil Dudka from comment #36)
> (In reply to Miroslav Suchý from comment #35)
> > We *know* that there are packages (steam) which use nss as multilib.
> 
> Really?  Then please tell us which (steam) packages exactly require
> nss-pem.i686.  To me it looks more like someone hit dnf bug #1566070, which
> itself was unrelated to steam.

You're correct, Kamil.
To prove the point, on F27, running:
dnf install nss-pem-1.0.3-9.fc28 --releasever=28
dnf system-upgrade --releasever=28 download

will properly prepare for F27->F28 upgrade *without* deleting steam.
Comment 38 Miroslav Suchý 2018-04-16 03:21:48 EDT
RPMFusion x86_64 repository contains steam-1.0.0.54-17.fc28.i686
http://download1.rpmfusion.org/nonfree/fedora/development/28/Everything/x86_64/os/repoview/steam.html

# rpm -qR steam|grep nss
nss(x86-32)
# rpm -q steam
steam-1.0.0.54-17.fc28.i686
# rpm -qR steam|grep nss
nss(x86-32)
# rpm -q nss
nss-3.36.0-1.0.fc28.x86_64
nss-3.36.0-1.0.fc28.i686
# rpm -q --provides nss-3.36.0-1.0.fc28.x86_64 |grep 'nss(x86-32)'
##### nothing returned
# rpm -q --provides nss-3.36.0-1.0.fc28.i686 |grep 'nss(x86-32)'
nss(x86-32) = 3.36.0-1.0.fc28
Comment 39 Kamil Dudka 2018-04-16 04:59:02 EDT
Miroslav, I am not sure why you are pasting output of the above commands.  This bug is about the nss-pem package, not the nss package.
Comment 40 Miroslav Suchý 2018-04-16 06:03:27 EDT
Ahh, you're right. Sorry for the confusion.
Comment 41 Mike Bursell 2018-05-01 04:37:33 EDT
Confirm that performing 

dnf install nss-pem-1.0.3-9.fc28 --releasever=28
dnf system-upgrade --releasever=28 download

from Fedora 27 allows upgrade to proceed.
Comment 42 Álvaro Castillo 2018-05-01 07:38:06 EDT
Confirm, you can upgrade with --allowerasing option.

dnf system-upgrade download --refresh --releasever=28 --allowerasing
Comment 43 Shaun Assam 2018-05-01 10:01:03 EDT
The system upgrade proceeds after running `dnf install nss-pem-1.0.3-9.fc28 --releasever=28`.
Comment 44 Jason Merrill 2018-05-01 13:18:09 EDT
*** Bug 1573557 has been marked as a duplicate of this bug. ***
Comment 45 Nadav Har'El 2018-05-02 04:02:41 EDT
This bug still exists: I too cannot upgrade from Fedora 27 to 28 because of:
Error: 
 Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
  - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-6.fc27.i686

I don't want to outright remove the i686 version of nss-pem because apparently it is used by the i686 wine.

Luckily, the following command suggested in earlier comments, which apparently overrides my nss-pem with the one from Fedora 28, indeed appears to fix things enough for "dnf system-upgrade download" to work:

dnf install nss-pem-1.0.3-9.fc28 --releasever=28

Still, would be better if an update was pushed to Fedora 27 (not just Fedora 28) so that upgrades without this trickery would succeed.
Comment 46 Kamil Dudka 2018-05-02 05:36:42 EDT
(In reply to Nadav Har'El from comment #45)
> Still, would be better if an update was pushed to Fedora 27 (not just Fedora
> 28) so that upgrades without this trickery would succeed.

That is exactly what bug #1566070 is about.
Comment 47 Víctor R. Ruiz 2018-05-02 19:36:10 EDT
(In reply to Nadav Har'El from comment #45)
> Luckily, the following command suggested in earlier comments, which
> apparently overrides my nss-pem with the one from Fedora 28, indeed appears
> to fix things enough for "dnf system-upgrade download" to work:
> 
> dnf install nss-pem-1.0.3-9.fc28 --releasever=28

I just had to do this in order to upgrade my system to f28.
Comment 48 smeg 2018-05-03 00:13:26 EDT
> dnf install nss-pem-1.0.3-9.fc28 --releasever=28

I'm having the same issue. This workaround worked.
Comment 49 Phil Armstrong 2018-05-03 04:29:24 EDT
Same issue, but I don't have steam, play-on-linux or anything else like that installed:

$ sudo dnf system-upgrade download --refresh --releasever=28
Before you continue ensure that your system is fully upgraded by running "dnf --refresh upgrade". Do you want to continue [y/N]: y
Last metadata expiration check: 0:00:00 ago on Thu 03 May 2018 09:27:30 BST.
Error: 
 Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
  - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-6.fc27.i686

I can't remove it because sudo depends on it:
$ sudo dnf remove nss-pem
Error: 
 Problem: The operation would result in removing the following protected packages: sudo
Comment 50 Justyn Temme 2018-05-04 09:06:54 EDT
(In reply to Phil Armstrong from comment #49)
> Same issue, but I don't have steam, play-on-linux or anything else like that
> installed:
> 
> $ sudo dnf system-upgrade download --refresh --releasever=28
> Before you continue ensure that your system is fully upgraded by running
> "dnf --refresh upgrade". Do you want to continue [y/N]: y
> Last metadata expiration check: 0:00:00 ago on Thu 03 May 2018 09:27:30 BST.
> Error: 
>  Problem: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
>   - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
>   - problem with installed package nss-pem-1.0.3-6.fc27.i686
> 
> I can't remove it because sudo depends on it:
> $ sudo dnf remove nss-pem
> Error: 
>  Problem: The operation would result in removing the following protected
> packages: sudo

Use the command sudo dnf remove nss-pem-1.0.3-6.fc27.i686 to specifically remove that package. It seems there are multiple. using sudo dnf remove nss-pem gave me the same error.
Comment 51 Bradley Scalio 2018-05-05 10:54:10 EDT
Upgrade the nss package prior to moving to f28 as follows:

# dnf install nss-pem-1.0.3-9.fc28 --releasever=28

then perform the "dnf system-upgrade download --releasever=28"

this should work for those with the problem to get them past the update
Comment 52 Kamil Dudka 2018-05-17 11:35:09 EDT
*** Bug 1579118 has been marked as a duplicate of this bug. ***
Comment 53 Donald O. 2018-05-19 03:34:41 EDT
can confirm that. The patch works. However wondering that the problem still exists.
Comment 54 Antonin 2018-05-21 10:12:41 EDT
I think the workaround with "dnf install nss-pem..." change the status of nss-pem package from installed as dependency to user installed.
I would prefer clean system upgrade. I still wait.
Comment 55 Kamil Dudka 2018-05-21 10:18:27 EDT
Unless anybody is aware of a better workaround, I am going to close this bug as duplicate of bug #1566070.  Marking nss-pem as multilib package, despite nobody uses it such, is not the correct way to fix the upgrade issue, in my opinion.
Comment 56 Kamil Dudka 2018-05-23 07:13:00 EDT

*** This bug has been marked as a duplicate of bug 1566070 ***
Comment 57 ufa 2018-05-23 17:29:33 EDT
(In reply to Donald O. from comment #53)
> can confirm that. The patch works. However wondering that the problem still
> exists.

it still persists. I had to do the workaround
Comment 58 Mickael Istria 2018-06-01 06:37:13 EDT
I also tried an upgrade today and faced this issue.
Having to dig in bugtrackers to find a workaround before upgrading is not really user-friendly, and can prevent several users from upgrading (like comment #54). It's IMO a major bug in the update process.
Comment 59 Daniel Zirkin 2018-06-02 08:21:34 EDT
# dnf update nss-pem

Last metadata expiration check: 0:20:16 ago on Sat 02 Jun 2018 07:57:03 AM EDT.
Dependencies resolved.
Nothing to do.
Complete!

---

# dnf remove nss-pem

Error:
 Problem: The operation would result in removing the following protected packages: sudo


Nice solution...
Comment 60 Daniel Zirkin 2018-06-02 08:25:56 EDT
# dnf install nss-pem-1.0.3-9.fc28 --releasever=28

 ...


Upgraded:
  nss.i686 3.36.1-1.1.fc28  nss.x86_64 3.36.1-1.1.fc28  nss-pem.x86_64 1.0.3-9.fc28  nss-sysinit.x86_64 3.36.1-1.1.fc28  nss-tools.x86_64 3.36.1-1.1.fc28

Complete!
Comment 61 Frederico Madeira 2018-07-01 15:50:39 EDT
(In reply to Daniel Zirkin from comment #60)
> # dnf install nss-pem-1.0.3-9.fc28 --releasever=28
> 
>  ...
> 
> 
> Upgraded:
>   nss.i686 3.36.1-1.1.fc28  nss.x86_64 3.36.1-1.1.fc28  nss-pem.x86_64
> 1.0.3-9.fc28  nss-sysinit.x86_64 3.36.1-1.1.fc28  nss-tools.x86_64
> 3.36.1-1.1.fc28
> 
> Complete!

Works for me. Tks.
Comment 62 Frederico Madeira 2018-07-01 15:51:07 EDT
(In reply to Daniel Zirkin from comment #60)
> # dnf install nss-pem-1.0.3-9.fc28 --releasever=28
> 
>  ...
> 
> 
> Upgraded:
>   nss.i686 3.36.1-1.1.fc28  nss.x86_64 3.36.1-1.1.fc28  nss-pem.x86_64
> 1.0.3-9.fc28  nss-sysinit.x86_64 3.36.1-1.1.fc28  nss-tools.x86_64
> 3.36.1-1.1.fc28
> 
> Complete!

Works for me. Tks.
Comment 63 Yannick Defais 2018-08-11 11:02:11 EDT
Same issue here:
Erreur : 
 Problème: nss-pem-1.0.3-6.fc27.i686 has inferior architecture
  - nss-pem-1.0.3-6.fc27.x86_64 does not belong to a distupgrade repository
  - problem with installed package nss-pem-1.0.3-6.fc27.i686

Trying to solve by removing the culprit is a no-go for me (ton of stuff including wine and steam):
$ sudo dnf remove nss-pem.i686
Dépendances résolues.
======================================================================================================================
 Paquet                                Architecture  Version                  Dépôt                             Taille
======================================================================================================================
Suppression :
 nss-pem                               i686          1.0.3-6.fc27             @updates                          215 k
Supprimer des paquets dépendants:
 libcurl                               i686          7.55.1-12.fc27           @updates                          585 k
 libdbusmenu-gtk2                      i686          16.04.0-4.fc27           @fedora                            79 k
 libdbusmenu-gtk3                      i686          16.04.0-4.fc27           @fedora                            79 k
 libgphoto2                            i686          2.5.16-1.fc27            @updates                          6.1 M
 mingw32-wine-gecko                    noarch        2.47-2.fc26              @fedora                            48 M
 mingw64-wine-gecko                    noarch        2.47-2.fc26              @fedora                            49 M
 nss                                   i686          3.38.0-1.0.fc27          @updates                          2.4 M
 openldap                              i686          2.4.45-4.fc27            @updates                          1.0 M
 samba-common-tools                    x86_64        2:4.7.8-0.fc27           @updates                          1.1 M
 samba-libs                            x86_64        2:4.7.8-0.fc27           @updates                          740 k
 samba-winbind                         x86_64        2:4.7.8-0.fc27           @updates                          1.5 M
 samba-winbind-clients                 x86_64        2:4.7.8-0.fc27           @updates                          132 k
 samba-winbind-modules                 x86_64        2:4.7.8-0.fc27           @updates                           79 k
 sane-backends-drivers-cameras         i686          1.0.27-17.fc27           @updates                           47 k
 sane-backends-drivers-scanners        i686          1.0.27-17.fc27           @updates                          9.9 M
 sane-backends-libs                    i686          1.0.27-17.fc27           @updates                          197 k
 steam                                 i686          1.0.0.54-18.fc27         @rpmfusion-nonfree-updates        2.7 M
 wine                                  x86_64        3.13-3.fc27              @updates                            0  
 wine-alsa                             i686          3.13-3.fc27              @updates                          195 k
 wine-alsa                             x86_64        3.13-3.fc27              @updates                          212 k
 wine-capi                             i686          3.13-3.fc27              @updates                           83 k
 wine-capi                             x86_64        3.13-3.fc27              @updates                           85 k
 wine-cms                              i686          3.13-3.fc27              @updates                          124 k
 wine-cms                              x86_64        3.13-3.fc27              @updates                          137 k
 wine-common                           noarch        3.13-3.fc27              @updates                          142 k
 wine-core                             i686          3.13-3.fc27              @updates                          190 M
 wine-core                             x86_64        3.13-3.fc27              @updates                          201 M
 wine-desktop                          noarch        3.13-3.fc27              @updates                          695 k
 wine-fonts                            noarch        3.13-3.fc27              @updates                            0  
 wine-ldap                             i686          3.13-3.fc27              @updates                          360 k
 wine-ldap                             x86_64        3.13-3.fc27              @updates                          411 k
 wine-openal                           i686          3.13-3.fc27              @updates                          114 k
 wine-openal                           x86_64        3.13-3.fc27              @updates                          144 k
 wine-opencl                           i686          3.13-3.fc27              @updates                          110 k
 wine-opencl                           x86_64        3.13-3.fc27              @updates                          123 k
 wine-pulseaudio                       i686          3.13-3.fc27              @updates                          170 k
 wine-pulseaudio                       x86_64        3.13-3.fc27              @updates                          183 k
 wine-twain                            i686          3.13-3.fc27              @updates                          225 k
 wine-twain                            x86_64        3.13-3.fc27              @updates                          227 k
Suppression des dépendances inutilisées:
 cyrus-sasl-lib                        i686          2.1.26-34.fc27           @fedora                           387 k
 gd                                    i686          2.2.5-3.fc27             @updates                          405 k
 isdn4k-utils                          i686          3.27-8.fc27              @fedora                           2.4 M
 isdn4k-utils                          x86_64        3.27-8.fc27              @fedora                           2.4 M
 isdn4k-utils-data                     noarch        3.27-8.fc27              @fedora                           1.6 M
 libXScrnSaver                         i686          1.2.2-13.fc27            @fedora                            35 k
 libXpm                                i686          3.5.12-4.fc27            @fedora                           112 k
 libdb                                 i686          5.3.28-27.fc27           @updates                          1.9 M
 libdbusmenu                           i686          16.04.0-4.fc27           @fedora                           535 k
 libexif                               i686          0.6.21-14.fc27           @updates                          1.8 M
 libieee1284                           i686          0.2.11-23.fc27           @fedora                            80 k
 libnghttp2                            i686          1.31.1-1.fc27            @updates                          163 k
 libpng12                              i686          1.2.57-4.fc27            @fedora                           451 k
 libpsl                                i686          0.18.0-3.fc27            @updates                           55 k
 libssh2                               i686          1.8.0-5.fc27             @fedora                           197 k
 libv4l                                i686          1.12.5-5.fc27            @fedora                           503 k
 libva                                 i686          1.8.3-5.fc27             @updates                          222 k
 libva-intel-driver                    i686          1.8.3-3.fc27             @rpmfusion-free-updates           4.2 M
 libvkd3d                              i686          1.0-1.fc27               @updates                          382 k
 libvkd3d                              x86_64        1.0-1.fc27               @updates                          403 k
 libwebp                               i686          1.0.0-1.fc27             @updates                          837 k
 mesa-libOSMesa                        i686          17.3.9-1.fc27            @updates                          7.1 M
 mesa-libOSMesa                        x86_64        17.3.9-1.fc27            @updates                          6.9 M
 mpg123-libs                           i686          1.25.6-1.fc27            @fedora                           537 k
 nss-mdns                              i686          0.14.1-1.fc27            @updates                          126 k
 nss-softokn                           i686          3.38.0-1.0.fc27          @updates                          1.7 M
 ocl-icd                               i686          2.2.12-1.fc27            @updates                          147 k
 python2-talloc                        x86_64        2.1.13-1.fc27            @updates                           27 k
 wine-courier-fonts                    noarch        3.13-3.fc27              @updates                          170 k
 wine-fixedsys-fonts                   noarch        3.13-3.fc27              @updates                           37 k
 wine-marlett-fonts                    noarch        3.13-3.fc27              @updates                           32 k
 wine-mono                             noarch        4.7.3-1.fc27             @updates                           57 M
 wine-ms-sans-serif-fonts              noarch        3.13-3.fc27              @updates                          4.6 M
 wine-small-fonts                      noarch        3.13-3.fc27              @updates                           65 k
 wine-symbol-fonts                     noarch        3.13-3.fc27              @updates                           51 k
 wine-system-fonts                     noarch        3.13-3.fc27              @updates                          121 k
 wine-systemd                          noarch        3.13-3.fc27              @updates                          119  
 wine-tahoma-fonts                     noarch        3.13-3.fc27              @updates                          300 k
 wine-wingdings-fonts                  noarch        3.13-3.fc27              @updates                           35 k

Résumé de la transaction
======================================================================================================================
Supprimer  79 Paquets

Tricky FIX as explained in comments above:
$ sudo dnf install nss-pem-1.0.3-9.fc28 --releasever=28

Now I can upgrade to Fedora 28!
$ sudo dnf system-upgrade download --releasever=28

Note You need to log in before you can comment on or make changes to this bug.