Bug 1695499 - Cannot install pki-ca in rawhide / modular packages exclude regular packages from being installed
Summary: Cannot install pki-ca in rawhide / modular packages exclude regular packages ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: pki-core
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Matthew Harmsen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1696218 (view as bug list)
Depends On: 1708343 1708347 1708349 1708354 1708355 1708356 1708358 1708363 1708366 1708661
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-04-03 09:00 UTC by Lukas Slebodnik
Modified: 2019-10-31 21:55 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-13 15:30:19 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Fedora Pagure releng issue 8287 0 None None None 2019-04-15 17:55:35 UTC

Description Lukas Slebodnik 2019-04-03 09:00:30 UTC
Description of problem:
It is not possible to install dogtag in rawhide

Seems to be related to
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/CW4XMOIKMNRRPAZ4H2ER7VPBY6YV2ODL/

Version-Release number of selected component (if applicable):
pki-ca-10.6.9-1.fc30.noarch

How reproducible:
Deterministic

Steps to Reproduce:
1. dnf install -y pki-ca

Actual results:
[root@host ~]# docker run -ti --rm docker.io/fedora:rawhide bash
[root@e5834e3c534a /]# dnf install -y pki-ca
Last metadata expiration check: 0:05:00 ago on Wed 03 Apr 2019 08:47:32 AM UTC.
Error: 
 Problem: package pki-ca-10.6.9-1.fc30.noarch requires pki-server >= 10.6.9-1.fc30, but none of the providers can be installed
  - package pki-server-10.6.9-1.fc30.noarch requires pki-base-java >= 10.6.9-1.fc30, but none of the providers can be installed
  - package pki-base-java-10.6.9-1.fc30.noarch requires resteasy-jaxb-provider >= 3.0.17-1, but none of the providers can be installed
  - conflicting requests
  - package pki-base-java-10.6.10-1.module_f31+3708+9758368d.noarch is excluded
  - package pki-server-10.6.10-1.module_f31+3708+9758368d.noarch is excluded
  - nothing provides mvn(com.sun.xml.bind:jaxb-impl) needed by resteasy-jaxb-provider-3.0.19-9.fc30.noarch
(try to add '--skip-broken' to skip uninstallable packages)

Expected results:
Packages installed without any problem


Additional info:
Enabling module did not help

[root@e5834e3c534a /]# dnf module enable -y pki
Last metadata expiration check: 0:12:02 ago on Wed 03 Apr 2019 08:47:32 AM UTC.
Dependencies resolved.
================================================================================
 Package           Architecture     Version             Repository         Size
================================================================================
Enabling module streams:
 pki                                10.6                                       

Transaction Summary
================================================================================

Complete!

Switching module streams does not alter installed packages (see 'module enable' in dnf(8) for details)
[root@e5834e3c534a /]# dnf install -y pki-ca
Last metadata expiration check: 0:12:10 ago on Wed 03 Apr 2019 08:47:32 AM UTC.
Error: 
 Problem: package pki-server-10.6.10-1.module_f31+3708+9758368d.noarch requires pki-base-java >= 10.6.10-1.module_f31+3708+9758368d, but none of the providers can be installed
  - package pki-ca-10.6.10-1.module_f31+3708+9758368d.noarch requires pki-server >= 10.6.10-1.module_f31+3708+9758368d, but none of the providers can be installed
  - package pki-base-java-10.6.10-1.module_f31+3708+9758368d.noarch requires resteasy-jaxb-provider >= 3.0.17-1, but none of the providers can be installed
  - conflicting requests
  - nothing provides mvn(com.sun.xml.bind:jaxb-impl) needed by resteasy-jaxb-provider-3.0.19-9.fc30.noarch
(try to add '--skip-broken' to skip uninstallable packages)

Comment 1 Dinesh Prasanth 2019-04-11 20:01:28 UTC
the chain is bigger than it looks. This diagram [0] should be a tad easier to understand

`pki-base-java` requires `resteasy` which requires `glassfish-jaxb` that provides `com.sun.xml.bind:jaxb-impl`. 

glassfish-jaxb [1] was dropped recently. As a result, there are no builds available for f31+ on Koji [2]. Alex has volunteered to take up this package [3]

[0] https://github.com/dogtagpki/pki/blob/master/docs/design/RPM_Dependency.md
[1] https://src.fedoraproject.org/rpms/glassfish-jaxb/commits/master
[2] https://koji.fedoraproject.org/koji/packageinfo?packageID=13552
[3] https://pagure.io/releng/issue/8278

Comment 2 Dinesh Prasanth 2019-04-15 14:17:25 UTC
*** Bug 1696218 has been marked as a duplicate of this bug. ***

Comment 3 Alex Scheel 2019-04-15 17:58:16 UTC
Pagure releng issue 8278 was resolved, giving me glassfish-jaxb. However, this is now blocked on 8287, which gives me the deps of glassfish-jaxb.

Comment 4 Jan Pazdziora 2019-04-17 07:30:57 UTC
The bug 1696218 seems to have been resolved. Is it expected, given that this bugzilla is still in NEW status?

Comment 5 Dinesh Prasanth 2019-04-17 12:18:21 UTC
@Jan The bug 1696218 was closed as a duplicate of this bug. That's the expected behavior of bugzilla. :)

Also, the rel-eng ticket[1] has been solved and we were able to have a successful `glassfish-jaxb` build on rawhide [2]. Can someone try testing it now?

[1] https://pagure.io/releng/issue/8287
[2] https://koji.fedoraproject.org/koji/buildinfo?buildID=1250244

Comment 6 Jan Pazdziora 2019-04-17 12:21:55 UTC
I'm fairly familiar with duplicates behaviour.

I'm concerned that this bugzilla (bug 1695499) is still in NEW state, not really reflecting the reality of the system.

Comment 7 Alex Scheel 2019-04-17 13:32:33 UTC
I think we can close it. There was discussion last night whether or not we needed to rebuild the pki module or our ursine packages. We decided not to, but glad that this is resolved. 


$ dnf module enable pki:10.6
$ dnf install -y pki-ca
<snip>
Complete!
$ rpm -qa | grep -i '\(pki-ca\|glassfish\)'
pki-ca-10.6.10-1.module_f31+3708+9758368d.noarch
glassfish-jaxb-api-2.2.12-11.fc30.noarch
glassfish-jaxb-txw2-2.2.11-11.fc31.noarch
glassfish-jaxb-core-2.2.11-11.fc31.noarch
glassfish-jaxb-runtime-2.2.11-11.fc31.noarch
glassfish-fastinfoset-1.2.13-11.fc31.noarch

Comment 8 Lukas Slebodnik 2019-05-09 08:32:41 UTC
The similar issue is again in rawhide. Reopening BZ.

[root@3ec1e2777323 /]# dnf install pki-ca
Last metadata expiration check: 0:03:46 ago on Thu 09 May 2019 08:26:17 AM UTC.
Error: 
 Problem: package pki-server-10.7.0-1.fc31.noarch requires tomcatjss >= 7.4.0, but none of the providers can be installed
  - package pki-ca-10.7.0-1.fc31.noarch requires pki-server = 10.7.0, but none of the providers can be installed
  - package tomcatjss-7.4.0-1.fc31.noarch requires slf4j, but none of the providers can be installed
  - conflicting requests
  - package slf4j-1.7.25-6.fc30.noarch is excluded
(try to add '--skip-broken' to skip uninstallable packages)

Comment 9 Lukas Slebodnik 2019-05-09 08:33:26 UTC
and I assume there will be more missing java packages and not just slf4j

Comment 10 Alex Scheel 2019-05-09 13:19:03 UTC
Lukas,

We can try rebuilding slf4j, but I'm unable to see this in Koschei:

https://apps.fedoraproject.org/koschei/package/pki-core
https://apps.fedoraproject.org/koschei/package/tomcatjss
https://apps.fedoraproject.org/koschei/package/slf4j

I'm also unable to try this in a Rawhide container due to bz#1708249 but I can't see this in a F30 container:

https://paste.fedoraproject.org/paste/H-IWQ8UvNVqnUM3dF8s1zw

Interestingly though, it pulls the lower NVR from the container:

 slf4j                                    noarch          1.7.25-4.module_f28+3939+dc18cd75             fedora-modular            76 k

Instead of the earlier slf4j-1.7.25-6.fc30 from releng. 

It does exist in F30 though, you have to disable both of the modular repos though:

[root@41dac9f415dc🎩︎ /]# dnf info --disablerepo=fedora-modular --disablerepo=updates-modular slf4j
Last metadata expiration check: 0:09:26 ago on Thu 09 May 2019 01:07:27 PM UTC.
Available Packages
Name         : slf4j
Version      : 1.7.25
Release      : 6.fc30
Architecture : noarch
Size         : 69 k
Source       : slf4j-1.7.25-6.fc30.src.rpm
Repository   : fedora
Summary      : Simple Logging Facade for Java
URL          : http://www.slf4j.org/
License      : MIT and ASL 2.0
Description  : The Simple Logging Facade for Java or (SLF4J) is intended to serve
             : as a simple facade for various logging APIs allowing to the end-user
             : to plug in the desired implementation at deployment time. SLF4J also
             : allows for a gradual migration path away from
             : Jakarta Commons Logging (JCL).
             : 
             : Logging API implementations can either choose to implement the
             : SLF4J interfaces directly, e.g. NLOG4J or SimpleLogger. Alternatively,
             : it is possible (and rather easy) to write SLF4J adapters for the given
             : API implementation, e.g. Log4jLoggerAdapter or JDK14LoggerAdapter..



We'll poke at this some more, but perhaps there's a bug somewhere else. It doesn't make sense to keep bumping NVR to exceed the module's NVR...

Comment 11 Dinesh Prasanth 2019-05-09 14:47:08 UTC
We have a new bumped NVR build for slf4j: https://koji.fedoraproject.org/koji/buildinfo?buildID=1265867

Once the mirrors pick up this new build, we should be good to close this issue.

Comment 12 Lukas Slebodnik 2019-05-09 14:56:06 UTC
(In reply to Alex Scheel from comment #10)
> Lukas,
> 
> We can try rebuilding slf4j, but I'm unable to see this in Koschei:
> 
> https://apps.fedoraproject.org/koschei/package/pki-core
> https://apps.fedoraproject.org/koschei/package/tomcatjss
> https://apps.fedoraproject.org/koschei/package/slf4j
> 
> I'm also unable to try this in a Rawhide container due to bz#1708249 but I
> can't see this in a F30 container:
> 

I know it works in f30 but tis BZis for rawhide(31)


> https://paste.fedoraproject.org/paste/H-IWQ8UvNVqnUM3dF8s1zw
> 

you can use image from fedora registry
registry.fedoraproject.org/fedora:rawhide

It is newer than docker.io/fedora:rawhide

I would recommend to pull newer image from docker registry
because I cannot see any update for the filesystem package

> Interestingly though, it pulls the lower NVR from the container:
> 
>  slf4j                                    noarch         
> 1.7.25-4.module_f28+3939+dc18cd75             fedora-modular            76 k
> 
> Instead of the earlier slf4j-1.7.25-6.fc30 from releng. 
> 
> It does exist in F30 though, you have to disable both of the modular repos
> though:
> 
> [root@41dac9f415dc🎩︎ /]# dnf info --disablerepo=fedora-modular
> --disablerepo=updates-modular slf4j
> Last metadata expiration check: 0:09:26 ago on Thu 09 May 2019 01:07:27 PM
> UTC.
> Available Packages
> Name         : slf4j
> Version      : 1.7.25
> Release      : 6.fc30
> Architecture : noarch
> Size         : 69 k
> Source       : slf4j-1.7.25-6.fc30.src.rpm
> Repository   : fedora
> Summary      : Simple Logging Facade for Java
> URL          : http://www.slf4j.org/
> License      : MIT and ASL 2.0
> Description  : The Simple Logging Facade for Java or (SLF4J) is intended to
> serve
>              : as a simple facade for various logging APIs allowing to the
> end-user
>              : to plug in the desired implementation at deployment time.
> SLF4J also
>              : allows for a gradual migration path away from
>              : Jakarta Commons Logging (JCL).
>              : 
>              : Logging API implementations can either choose to implement the
>              : SLF4J interfaces directly, e.g. NLOG4J or SimpleLogger.
> Alternatively,
>              : it is possible (and rather easy) to write SLF4J adapters for
> the given
>              : API implementation, e.g. Log4jLoggerAdapter or
> JDK14LoggerAdapter..
> 
> 
> 
> We'll poke at this some more, but perhaps there's a bug somewhere else. It
> doesn't make sense to keep bumping NVR to exceed the module's NVR...


[root@bcee12f5c5d4 /]# dnf info --disablerepo=fedora-modular --disablerepo=updates-modular slf4j
Fedora - Rawhide - Developmental packages for t 8.7 MB/s |  56 MB     00:06    
Last metadata expiration check: 0:00:11 ago on Thu 09 May 2019 02:55:17 PM UTC.
Error: No matching Packages to list

Comment 13 Lukas Slebodnik 2019-05-09 14:57:55 UTC
(In reply to Dinesh Prasanth from comment #11)
> We have a new bumped NVR build for slf4j:
> https://koji.fedoraproject.org/koji/buildinfo?buildID=1265867
> 
> Once the mirrors pick up this new build, we should be good to close this
> issue.

It is not just about slf4j.
Please use reproducer in rawhide image  "dnf install -y pki-ca".

Comment 14 Alex Scheel 2019-05-09 15:07:41 UTC
The bug isn't in PKI; the bug is against these Java packages not being installable. Many of them are maintained as ursine packages. Please contact their maintainers, not us.

Comment 15 Jan Pazdziora 2019-05-09 16:17:27 UTC
I'm sorry but pki-ca (and thus freeipa-server) is currently not installable.

It's pki-* that depends on something that is broken. Either remove that dependency, or work with maintainer of said package to get it fixed. But closing bugzilla with CANTFIX and sending reporter to hunt for maintainers of dependencies of pki-* packages is hardly correct solution.

Comment 16 Alex Scheel 2019-05-09 17:23:54 UTC
I'm sorry, but it isn't that pki-ca isn't installable due to missing dependencies, it is broken because other maintainers aren't maintaining their packages. This **isn't** a pki-* bug; this is a Fedora processes bug because the packages haven't been rebuilt after their removal and orphaning. The resolution is to file a bunch of BZs against the affected components. There is no "hunting for maintainers" required. Plus, it is all ultimately due to mizdebsk's packaging stunts. 


I've gone ahead and filed the real bugs though, since that appears to be what you want:

https://bugzilla.redhat.com/show_bug.cgi?id=1708343
https://bugzilla.redhat.com/show_bug.cgi?id=1708347
https://bugzilla.redhat.com/show_bug.cgi?id=1708349
https://bugzilla.redhat.com/show_bug.cgi?id=1708354
https://bugzilla.redhat.com/show_bug.cgi?id=1708355
https://bugzilla.redhat.com/show_bug.cgi?id=1708356
https://bugzilla.redhat.com/show_bug.cgi?id=1708358
https://bugzilla.redhat.com/show_bug.cgi?id=1708363
https://bugzilla.redhat.com/show_bug.cgi?id=1708366


These will all likely go away once the F31 mass rebuild is done anyways.

Comment 17 Alex Scheel 2019-05-09 17:25:47 UTC
I was starting to pass the bug to the next package, but instead I went ahead and filed new bugs for every package once I saw how many there were. Reassigning back to us, sorry for the noise.

Comment 18 Lukas Slebodnik 2019-05-09 18:44:27 UTC
(In reply to Alex Scheel from comment #14)
> The bug isn't in PKI; the bug is against these Java packages not being
> installable. Many of them are maintained as ursine packages. Please contact
> their maintainers, not us.

I do not agree With closing this BZ.
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/CW4XMOIKMNRRPAZ4H2ER7VPBY6YV2ODL/

I would at least consider to be a tracker of bunch of related bugs.
Because I am not interested whether I am able to install dependencies of pki-ca.
I just want to install pki-ca. How it will be solved is not my problem.

Comment 19 Miro Hrončok 2019-05-10 00:09:53 UTC
All of the problematic packages are listed as this in the error report:

  - package ... is excluded

I assume all of the problematic packages are available as urine packages and as modular packages.

The ursine packages install just fine:



$ mock -r fedora-rawhide-x86_64 install pki-ca
...
Installed:
  pki-ca-10.7.0-1.fc31.noarch
  apache-commons-codec-1.11-6.fc30.noarch
  ...
  slf4j-1.7.25-6.fc30.noarch
  ...

However with modular repositories enabled, it all blows up:


$ mock -r fedora-rawhide-x86_64 clean
$ mock -r fedora-rawhide-x86_64 install --enablerepo=rawhide-modular pki-ca
...
  - package slf4j-1.7.25-6.fc30.noarch is excluded



I think we have the following problem: the modular repos are excluding regular packages. This is IMHO a large distro-scale problem, not a problem of either pki-ca or the dependent packages.

CCing Stephen and Petr.

Comment 20 Stephen Gallagher 2019-05-10 13:53:14 UTC
(In reply to Miro Hrončok from comment #19)
> All of the problematic packages are listed as this in the error report:
> 
>   - package ... is excluded
> 
> I assume all of the problematic packages are available as urine packages and
> as modular packages.
> 
> The ursine packages install just fine:
> 
> 
> 
> $ mock -r fedora-rawhide-x86_64 install pki-ca
> ...
> Installed:
>   pki-ca-10.7.0-1.fc31.noarch
>   apache-commons-codec-1.11-6.fc30.noarch
>   ...
>   slf4j-1.7.25-6.fc30.noarch
>   ...
> 
> However with modular repositories enabled, it all blows up:
> 
> 
> $ mock -r fedora-rawhide-x86_64 clean
> $ mock -r fedora-rawhide-x86_64 install --enablerepo=rawhide-modular pki-ca
> ...
>   - package slf4j-1.7.25-6.fc30.noarch is excluded
> 
> 
> 
> I think we have the following problem: the modular repos are excluding
> regular packages. This is IMHO a large distro-scale problem, not a problem
> of either pki-ca or the dependent packages.
> 
> CCing Stephen and Petr.

I'm 99.9% certain this is happening because of BZ #1708661. A recent change to pungi inadvertently resulted in the Rawhide Modular repos having modular metadata but zero packages. As a result, DNF can't find any packages that would be provided by default module streams.

Comment 21 Stephen Gallagher 2019-05-10 13:54:02 UTC
I forgot to add; we're rolling back to the earlier Pungi and kicking off another Rawhide compose, so by tomorrow this should be addressed.

Comment 22 Jan Pazdziora 2019-05-13 07:58:23 UTC
Confirming that the issue is gone today.

Comment 23 Dinesh Prasanth 2019-05-13 15:30:19 UTC
Closing this issue after verifying the installation of pki-ca on rawhide using a docker image.

Please see the logs: https://paste.fedoraproject.org/paste/KGgOuimKHLf3iH5l2uLrHQ


Note You need to log in before you can comment on or make changes to this bug.