Fedora Account System
Red Hat Associate
Red Hat Customer
Current F43 freeipa-client scriptlets fail on some infra hosts: [ 69/246] Upgrading sssd-common-0:2.12.0-1.fc43.aarch64 100% | 20.6 MiB/s | 6.3 MiB | 00m00s >>> Running %triggerin scriptlet: freeipa-client-0:4.13.0-2.fc43.aarch64 >>> Non-critical error in %triggerin scriptlet: freeipa-client-0:4.13.0-2.fc43.aarch64 >>> Scriptlet output: >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> >>> [RPM] %triggerin(freeipa-client-4.13.0-2.fc43.aarch64) scriptlet failed, exit status 2 ... >>> Finished %post scriptlet: freeipa-client-0:4.13.1-1.fc43.aarch64 >>> Scriptlet output: >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> >>> Running %triggerin scriptlet: freeipa-client-0:4.13.1-1.fc43.aarch64 >>> Non-critical error in %triggerin scriptlet: freeipa-client-0:4.13.1-1.fc43.aarch64 >>> Scriptlet output: >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> >>> [RPM] %triggerin(freeipa-client-4.13.1-1.fc43.aarch64) scriptlet failed, exit status 2 This is against the package policy: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax "All scriptlets MUST exit with the zero exit status. Because RPM in its default configuration does not execute shell scriptlets with the -e argument to the shell, excluding explicit exit calls (frowned upon with a non-zero argument!), the exit status of the last command in a scriptlet determines its exit status. Most commands in the snippets in this document have a "|| :" appended to them, which is a generic trick to force the zero exit status for those commands whether they worked or not. Usually the most important bit is to apply this to the last command executed in a scriptlet, or to add a separate command such as plain ":" or "exit 0" as the last one in a scriptlet. Note that depending on the case, other error checking/prevention measures may be more appropriate." The failures in this case don't cause the tranasction to fail immediately (fortunately), but they do cause its overall exit code to be non-zero, which means ansible shows the step as failed.
Hi Adam, can you please be more specific on how you managed to get this error, from the logs it looks like you've been using older version and updating to the latest one? We've not managed to reproduce this issue (regardless, this still seems to be a general packaging style issue).
David, I already fixed this in the current package build. https://src.fedoraproject.org/rpms/freeipa/c/9b5b1650a6e709dd18aca100dbfbb4f8635e0621?branch=rawhide
The fix is available in https://bodhi.fedoraproject.org/updates/FEDORA-2026-1ee381d925 freeipa-4.13.1-7.fc45
This should be fixed in stable releases too. I still saw this problem in a recent F43 update for instance: [17/62] Upgrading freeipa-client-0:4.13.1-6.fc43.x86_64 100% | 330.3 KiB/s | 238.1 KiB | 00m01s >>> Running %post scriptlet: freeipa-client-0:4.13.1-6.fc43.x86_64 >>> Finished %post scriptlet: freeipa-client-0:4.13.1-6.fc43.x86_64 >>> Scriptlet output: >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> >>> Running %triggerin scriptlet: freeipa-client-0:4.13.1-6.fc43.x86_64 >>> Non-critical error in %triggerin scriptlet: freeipa-client-0:4.13.1-6.fc43.x86_64 >>> Scriptlet output: >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> sed: can't read /etc/ssh/ssh_config.d/04-ipa.conf: No such file or directory >>> >>> [RPM] %triggerin(freeipa-client-4.13.1-6.fc43.x86_64) scriptlet failed, exit status 2 that's upgrading from 4.13.1-5.fc43 to 4.13.1-6.fc43 . Please fix this in F43 and F44 so future updates in those releases do not hit this problem.
I'm here because I get these error messages every time freeipa-client is updated on my F44 system. This RPM does not own the file /etc/ssh/ssh_config.d/04-ipa.conf and therefore it should not assume that that file exists. (I believe the reason why it doesn't exist may be because we run ipa-client-install with the --no-sshd flag. But it also wouldn't exist if the client hadn't enrolled yet.)
FEDORA-2026-708e6b8e0c (freeipa-4.13.4-3.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-708e6b8e0c
FEDORA-2026-a1aaa5d134 (freeipa-4.13.4-3.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-a1aaa5d134
FEDORA-2026-708e6b8e0c has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-708e6b8e0c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-708e6b8e0c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-a1aaa5d134 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a1aaa5d134` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a1aaa5d134 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-708e6b8e0c (freeipa-4.13.4-3.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-a1aaa5d134 (freeipa-4.13.4-3.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.