From https://bugzilla.redhat.com/show_bug.cgi?id=1880637#c1

We have logic that attempts to detect if foreman-maintain is installed and package locking is enabled but the output isn't being interpreted correctly.



"""
/usr/share/foreman-installer/hooks/post/30-upgrade.rb
~~~
if !app_value(:noop) && [0, 2].include?(@kafo.exit_code) && foreman_server?
  execute('foreman-rake upgrade:run')
end
~~~
which appears to kick off if the kafo-puppet run had a "bad" exit code. 

Looking back at that puppet run, the only error I see is
~~~
[ INFO 2020-09-18T18:21:00 verbose] Executing hooks in group pre_commit
[ERROR 2020-09-18T18:21:05 verbose] foreman-maintain packages is-locked --assumeyes failed! Check the output for error!
[ INFO 2020-09-18T18:21:05 verbose] All hooks in group pre_commit finished
~~~
There are a number of warnings though.

Running that command gives:
~~~
root@tstr000047:/var/log/foreman-installer $ foreman-maintain packages is-locked --assumeyes; echo $?
Packages are not locked
1
~~~

I ran it again with debug and captured this:
~~~
[ INFO 2020-09-18T19:03:39 main] Executing hooks in group pre_commit
[DEBUG 2020-09-18T19:03:39 main] Hook /usr/share/foreman-installer/katello/hooks/pre_commit/05-puppet_certs_exist.rb returned nil
[DEBUG 2020-09-18T19:03:39 main] Executing: foreman-maintain packages -h
[DEBUG 2020-09-18T19:03:41 main] Usage:
[DEBUG 2020-09-18T19:03:41 main]     foreman-maintain packages [OPTIONS] SUBCOMMAND [ARG] ...
[DEBUG 2020-09-18T19:03:41 main]
[DEBUG 2020-09-18T19:03:41 main] Parameters:
[DEBUG 2020-09-18T19:03:41 main]     SUBCOMMAND                    subcommand
[DEBUG 2020-09-18T19:03:41 main]     [ARG] ...                     subcommand arguments
[DEBUG 2020-09-18T19:03:41 main]
[DEBUG 2020-09-18T19:03:41 main] Subcommands:
[DEBUG 2020-09-18T19:03:41 main]     lock                          Prevent packages from automatic update
[DEBUG 2020-09-18T19:03:41 main]     unlock                        Enable packages for automatic update
[DEBUG 2020-09-18T19:03:41 main]     status                        Check if packages are protected against update
[DEBUG 2020-09-18T19:03:41 main]     install                       Install packages in an unlocked session
[DEBUG 2020-09-18T19:03:41 main]     update                        Update packages in an unlocked session
[DEBUG 2020-09-18T19:03:41 main]     is-locked                     Check if update of packages is allowed
[DEBUG 2020-09-18T19:03:41 main]
[DEBUG 2020-09-18T19:03:41 main] Options:
[DEBUG 2020-09-18T19:03:41 main]     -h, --help                    print help
[DEBUG 2020-09-18T19:03:41 main] foreman-maintain packages -h finished successfully!
[DEBUG 2020-09-18T19:03:41 main] Executing: foreman-maintain packages is-locked --assumeyes
[DEBUG 2020-09-18T19:03:43 main] Packages are not locked
[ERROR 2020-09-18T19:03:43 main] foreman-maintain packages is-locked --assumeyes failed! Check the output for error!
[DEBUG 2020-09-18T19:03:43 main] Hook /usr/share/foreman-installer/katello/hooks/pre_commit/09-version_locking.rb returned nil
~~~

It looks like that's ultimately coming from
/usr/share/foreman-installer/hooks/boot/03-foreman-maintain-extensions.rb
~~~
  def package_lock_feature?
    foreman_maintain('packages -h')
  end
~~~
"""