Bug 1687130 - dnf system-upgrade to F30 error involving openscap and scap-workbench
Summary: dnf system-upgrade to F30 error involving openscap and scap-workbench
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: openscap
Version: 30
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Šimon
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-03-10 07:33 UTC by Matt Fagnani
Modified: 2019-05-20 11:35 UTC (History)
11 users (show)

Fixed In Version: openscap-1.3.0-5.fc30
Clone Of:
Environment:
Last Closed: 2019-05-14 00:58:46 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Matt Fagnani 2019-03-10 07:33:58 UTC
Description of problem:

I ran the following command in F29 with updates-testing enabled to test upgrading to F30
sudo dnf system-upgrade download --refresh --releasever=30

I got the error
Problem 9: problem with installed package scap-workbench-1.2.0-2.fc29.i686
  - package scap-workbench-1.2.0-2.fc30.i686 requires libopenscap.so.25, but none of the providers can be installed
  - scap-workbench-1.2.0-2.fc29.i686 does not belong to a distupgrade repository
  - openscap-1:1.3.0-3.fc29.i686 does not belong to a distupgrade repository

openscap-1.3.0-3.fc30 has epoch 0, while openscap-1.3.0-3 in F29 has epoch 1 to fix a dnf issue where the version number of openscap-1.3.0_alpha2 was considered as higher than openscap-1.3.0. The f29 branch has the commit 
034205 which added epoch: 1 and 77f907 which added the epoch to the requires: for the openscap subpackages
https://src.fedoraproject.org/rpms/openscap/commits/f29

Those commits don't appear in the F30 branch. As a result, dnf treats openscap-1.3.0_alpha2-2.fc30 as the latest version in F30 instead of openscap-1.3.0-3.fc30. When I ran 
sudo dnf system-upgrade download --refresh --releasever=30 --skip-broken --allowerasing , scap-workbench was removed and openscap-* were downgraded to 1.3.0_alpha2-2.fc30

Removing dependent packages:
...
scap-workbench              i686   1.2.0-2.fc29             @updates-testing
                                                                             2.8 M
...

Downgrading:
...
openscap                    i686   1.3.0_alpha2-2.fc30      fedora          3.4 M
 openscap-containers         noarch 1.3.0_alpha2-2.fc30      fedora           23 k
 openscap-devel              i686   1.3.0_alpha2-2.fc30      fedora          1.5 M
 openscap-engine-sce         i686   1.3.0_alpha2-2.fc30      fedora           19 k
 openscap-engine-sce-devel   i686   1.3.0_alpha2-2.fc30      fedora           12 k
 openscap-perl               i686   1.3.0_alpha2-2.fc30      fedora          319 k
 openscap-python3            i686   1.3.0_alpha2-2.fc30      fedora          148 k
 openscap-scanner            i686   1.3.0_alpha2-2.fc30      fedora           56 k
 openscap-utils              i686   1.3.0_alpha2-2.fc30      fedora           23 k
...

openscap-1.3.0_alpha2-2.fc30 provides libopenscap.so.24, but openscap-1.3.0-3.fc30 provides libopenscap.so.25. dnf treating openscap-1.3.0_alpha2-2.fc30 as having the higher version due to the missing Epoch: 1 in openscap-1.3.0-3.fc30 might've led to the dnf error that libopenscap.so.25 wasn't available. Applying the epoch changes in 034205 and 77f907 to the F30 and master branches and rebuilding should fix this issue. Thanks.

Version-Release number of selected component (if applicable):
openscap-0:1.3.0-3.fc30
openscap-0:1.3.0_alpha2-2.fc30
openscap-1:1.3.0-3.fc29
scap-workbench-1.2.0-2.fc30

How reproducible:
2 of 2 times I tried

Steps to Reproduce:
In F29 with updates-testing enabled and openscap and scap-workbench installed
1. sudo dnf upgrade --refresh 
2. sudo dnf system-upgrade download --refresh --releasever=30
3. sudo dnf system-upgrade download --refresh --releasever=30 --skip-broken --allowerasing

Actual results:
dnf error involving openscap and scap-workbench when upgrading to F30

Expected results:
No dnf error.

Additional info:

The previous reports about the openscap and scap-workbench dnf errors for F29 were at
https://bugzilla.redhat.com/show_bug.cgi?id=1640283
https://bugzilla.redhat.com/show_bug.cgi?id=1626801
https://bodhi.fedoraproject.org/updates/FEDORA-2018-93df1fbf1b

Comment 1 Jan Černý 2019-03-11 06:40:57 UTC
Hi, changing the epoch helped us to solve previous problems with packaging the alpha versions. Do I understand it well that the epoch should be changed in Fedora 30 branch as well? What will happen after Fedora 29 end-of-life if we introduce the epoch change to Fedora 30? Will we have to revert the patch (that increments the epoch) at some point or should the patch be carried forever? Thanks.

Comment 2 Matt Fagnani 2019-03-11 18:29:50 UTC
Jan, openscap-0:1.3.0_alpha2-2.fc30 has a higher version than openscap-0:1.3.0-3.fc30 according to dnf so the same problem is in F30. I think that the openscap epoch should be 1 in F30 and F31. When upgrading from F29 to F30, dnf will downgrade the openscap packages unless they have epoch: 1 in F30. I don't think further changes should be needed after F29 is EOL. I think the Epoch: 1 should be carried forward indefinitely until the epoch may need to be increased again. I'm not a Fedora maintainer though. Thanks.

Comment 3 Michael DePaulo 2019-05-01 18:44:45 UTC
Jan & Matt: I am a Fedora package maintainer. Adding an Epoch permanently is the correct way to solve the problem.

Please fix this for Fedora 30. I would like to install scap-workbench without having to workaround it by installing the F29 RPMs of openscap.

References:
1. I have 2735 packages on my laptop and 305 have Epochs
2. https://docs.fedoraproject.org/en-US/packaging-guidelines/Versioning/#_epoch_tag

Example downgrade workaround on F30:
$ sudo dnf install http://download-ib01.fedoraproject.org/pub/fedora/linux/updates/29/Everything/x86_64/Packages/o/openscap-1.3.0-3.fc29.x86_64.rpm http://download-ib01.fedoraproject.org/pub/fedora/linux/updates/29/Everything/x86_64/Packages/o/openscap-scanner-1.3.0-3.fc29.x86_64.rpm http://download-ib01.fedoraproject.org/pub/fedora/linux/updates/29/Everything/x86_64/Packages/o/openscap-utils-1.3.0-3.fc29.x86_64.rpm

Comment 4 Matt Fagnani 2019-05-01 21:10:05 UTC
I removed openscap and scap-workbench in F29 before I upgraded to F30 on April 6 due to the dnf system-upgrade errors I originally reported. When I ran sudo dnf install scap-workbench in F30, I got the following error because openscap-1.3.0_alpha2-2.fc30 was in the F30 fedora repo as it still is and provides libopenscap.so.24:

Error: 
 Problem: conflicting requests
  - nothing provides libopenscap.so.25 needed by scap-workbench-1.2.0-2.fc30.i686

I installed openscap-1.3.0-3.fc30, openscap-utils, and openscap-scanner from
https://koji.fedoraproject.org/koji/buildinfo?buildID=1194969

I installed scap-workbench-1.2.0-2.fc30 without errors after that. scap-workbench ran fine.
When I've run sudo dnf upgrade --refresh since then, I've gotten the following errors because openscap-1.3.0-3.fc30 still has Epoch: 0 and dnf treats openscap-1.3.0_alpha2-2.fc30 as having the higher version number. openscap-1.3.0_alpha2-2.fc30 is in the F30 fedora repo as the following output from today shows.

Problem 1: package scap-workbench-1.2.0-2.fc30.i686 requires libopenscap.so.25, but none of the providers can be installed
  - cannot install both openscap-1.3.0_alpha2-2.fc30.i686 and openscap-1.3.0-3.fc30.i686
  - cannot install the best update candidate for package scap-workbench-1.2.0-2.fc30.i686
  - cannot install the best update candidate for package openscap-1.3.0-3.fc30.i686
 Problem 2: problem with installed package scap-workbench-1.2.0-2.fc30.i686
  - package scap-workbench-1.2.0-2.fc30.i686 requires libopenscap.so.25, but none of the providers can be installed
  - cannot install both openscap-1.3.0_alpha2-2.fc30.i686 and openscap-1.3.0-3.fc30.i686
  - package openscap-scanner-1.3.0_alpha2-2.fc30.i686 requires openscap(x86-32) = 1.3.0_alpha2-2.fc30, but none of the providers can be installed
  - package openscap-scanner-1.3.0_alpha2-2.fc30.i686 requires libopenscap.so.24, but none of the providers can be installed
  - cannot install the best update candidate for package openscap-scanner-1.3.0-3.fc30.i686
===================================================================================
 Package                Arch       Version                      Repository    Size
===================================================================================
Skipping packages with conflicts:
(add '--best --allowerasing' to command line to force their upgrade):
 openscap               i686       1.3.0_alpha2-2.fc30          fedora       3.4 M
Skipping packages with broken dependencies:
 openscap-scanner       i686       1.3.0_alpha2-2.fc30          fedora        56 k

Transaction Summary
===================================================================================
Skip  2 Packages

I've been excluding openscap rpms from being upgraded to prevent these errors using 
sudo dnf upgrade --refresh -x openscap*

Michael, you could use the openscap-1.3.0-3.fc30 rpms in that way. Applying the epoch changes in the F29 branch to the F30 and master branches would be a preferable way to fix this problem as mentioned. Thanks.

Comment 5 Jan Černý 2019-05-02 07:55:17 UTC
Thank you, I'll update the spec file and rebuild with Epoch 1.

Comment 6 Fedora Update System 2019-05-02 08:25:27 UTC
openscap-1.3.0-4.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-01e533bca2

Comment 7 Matt Fagnani 2019-05-02 18:15:09 UTC
Thanks for the update, Jan. When I tried to update to openscap-1.3.0-4.fc30, openscap-scanner, and openscap-utils I got errors as follows.

sudo dnf upgrade https://kojipkgs.fedoraproject.org//packages/openscap/1.3.0/4.fc30/i686/openscap-1.3.0-4.fc30.i686.rpm https://kojipkgs.fedoraproject.org//packages/openscap/1.3.0/4.fc30/i686/openscap-scanner-1.3.0-4.fc30.i686.rpm https://kojipkgs.fedoraproject.org//packages/openscap/1.3.0/4.fc30/i686/openscap-utils-1.3.0-4.fc30.i686.rpm
Last metadata expiration check: 0:25:33 ago on Thu 02 May 2019 01:27:49 PM EDT.
openscap-1.3.0-4.fc30.i686.rpm                     1.2 MB/s | 3.3 MB     00:02    
openscap-scanner-1.3.0-4.fc30.i686.rpm             107 kB/s |  56 kB     00:00    
openscap-utils-1.3.0-4.fc30.i686.rpm                53 kB/s |  24 kB     00:00    
Dependencies resolved.

 Problem 1: cannot install the best update candidate for package openscap-utils-1.3.0-3.fc30.i686
  - nothing provides openscap-scanner(x86-32) = 1.3.0-4.fc30 needed by openscap-utils-1:1.3.0-4.fc30.i686
 Problem 2: problem with installed package openscap-utils-1.3.0-3.fc30.i686
  - package openscap-utils-1.3.0-3.fc30.i686 requires openscap(x86-32) = 1.3.0-3.fc30, but none of the providers can be installed
  - package openscap-utils-1.3.0_alpha2-2.fc30.i686 requires openscap(x86-32) = 1.3.0_alpha2-2.fc30, but none of the providers can be installed
  - cannot install both openscap-1:1.3.0-4.fc30.i686 and openscap-1.3.0-3.fc30.i686
  - cannot install both openscap-1:1.3.0-4.fc30.i686 and openscap-1.3.0_alpha2-2.fc30.i686
  - cannot install the best update candidate for package openscap-1.3.0-3.fc30.i686
  - nothing provides openscap-scanner(x86-32) = 1.3.0-4.fc30 needed by openscap-utils-1:1.3.0-4.fc30.i686
 Problem 3: problem with installed package scap-workbench-1.2.0-2.fc30.i686
  - package scap-workbench-1.2.0-2.fc30.i686 requires openscap-utils >= 1.2.11, but none of the providers can be installed
  - package openscap-utils-1.3.0-3.fc30.i686 requires openscap-scanner(x86-32) = 1.3.0-3.fc30, but none of the providers can be installed
  - package openscap-utils-1.3.0_alpha2-2.fc30.i686 requires openscap-scanner(x86-32) = 1.3.0_alpha2-2.fc30, but none of the providers can be installed
  - cannot install both openscap-scanner-1:1.3.0-4.fc30.i686 and openscap-scanner-1.3.0-3.fc30.i686
  - cannot install both openscap-scanner-1:1.3.0-4.fc30.i686 and openscap-scanner-1.3.0_alpha2-2.fc30.i686
  - cannot install the best update candidate for package openscap-scanner-1.3.0-3.fc30.i686
  - nothing provides openscap-scanner(x86-32) = 1.3.0-4.fc30 needed by openscap-utils-1:1.3.0-4.fc30.i686
===================================================================================
 Package               Arch      Version                   Repository         Size
===================================================================================
Skipping packages with conflicts:
(add '--best --allowerasing' to command line to force their upgrade):
 openscap              i686      1.3.0_alpha2-2.fc30       fedora            3.4 M
 openscap              i686      1:1.3.0-4.fc30            @commandline      3.3 M
 openscap-scanner      i686      1.3.0_alpha2-2.fc30       fedora             56 k
 openscap-scanner      i686      1:1.3.0-4.fc30            @commandline       56 k
Skipping packages with broken dependencies:
 openscap-utils        i686      1.3.0_alpha2-2.fc30       fedora             23 k
 openscap-utils        i686      1:1.3.0-4.fc30            @commandline       24 k

Transaction Summary
===================================================================================
Skip  6 Packages


openscap-utils-1:1.3.0-4.fc30 still requires openscap-scanner(x86-32) = 1.3.0-4.fc30 without the epoch.

openscap.spec line 76 could be changed to add the epoch as in the other requires lines to fix at least the first dnf error.
- Requires:       %{name}-scanner%{?_isa} = %{version}-%{release} 
+ Requires:       %{name}-scanner%{?_isa} = %{epoch}:%{version}-%{release}

Comment 8 Fedora Update System 2019-05-03 04:12:14 UTC
openscap-1.3.0-4.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-01e533bca2

Comment 9 Jan Černý 2019-05-03 08:58:34 UTC
Thanks for pointing out this oversight.

Comment 10 Fedora Update System 2019-05-03 09:46:40 UTC
openscap-1.3.0-5.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-71c438b96b

Comment 11 Fedora Update System 2019-05-04 01:57:32 UTC
openscap-1.3.0-5.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-71c438b96b

Comment 12 Fedora Update System 2019-05-14 00:58:46 UTC
openscap-1.3.0-5.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Šimon Lukašík 2019-05-18 15:59:56 UTC
Jan, can you please bump the epoch in f31 (master) as well?

Otherwise, you will have to resolve this issue again next time.

Comment 14 Jan Černý 2019-05-20 11:35:39 UTC
Thank you, I have rebuilt the rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=34951085


Note You need to log in before you can comment on or make changes to this bug.