FEDORA-2025-634fec6b6c — enhancement update for dogtag-pki, freeipa, & 3 more — Fedora Updates System

unpushed

dogtag-pki-11.8.0-0.3.beta3.fc43.3, freeipa-4.12.2-15.fc43.1, & 3 more

FEDORA-2025-634fec6b6c created by jmagne a year ago for Fedora 43

Updates required to run dogtag-pki under tomcat-10 . The PR for dogtag-pki passed all of the CI tests except a couple of well known issues and we know that pki servers work from local testing. Also, a build of tomcat 10 was included in this side tag due to the fact that there was no such build before this one was created, using the current state of tomcat in rawhide.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

adamwill commented & provided feedback a year ago

karma

In FreeIPA tests, pki-tomcatd@pki-tomcat.service fails to start up:

Jul 10 17:09:34 ipa001.test.openqa.fedoraproject.org systemd[1]: Starting pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat...
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]: ERROR: [Errno 2] No such file or directory: '/usr/share/tomcat/conf/catalina.policy'
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]: Traceback (most recent call last):
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:   File "/usr/lib/python3.14/site-packages/pki/server/pkiserver.py", line 41, in <module>
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     cli.execute(sys.argv[1:])
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     ~~~~~~~~~~~^^^^^^^^^^^^^^
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:   File "/usr/lib/python3.14/site-packages/pki/server/cli/__init__.py", line 183, in execute
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     module.execute(module_args)
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     ~~~~~~~~~~~~~~^^^^^^^^^^^^^
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:   File "/usr/lib/python3.14/site-packages/pki/server/cli/migrate.py", line 98, in execute
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     instance.init()
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     ~~~~~~~~~~~~~^^
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:   File "/usr/lib/python3.14/site-packages/pki/server/instance.py", line 1111, in init
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     super().init()
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     ~~~~~~~~~~~~^^
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:   File "/usr/lib/python3.14/site-packages/pki/server/__init__.py", line 416, in init
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     self.create_catalina_policy()
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:   File "/usr/lib/python3.14/site-packages/pki/server/__init__.py", line 373, in create_catalina_policy
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:     with open(filename, 'r', encoding='utf-8') as f:
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]:          ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 10 17:09:35 ipa001.test.openqa.fedoraproject.org pki-server[4927]: FileNotFoundError: [Errno 2] No such file or directory: '/usr/share/tomcat/conf/catalina.policy'

adamwill commented & provided feedback a year ago

karma

OK, I think the problem is that dogtag-pki unconditionally expects a file at /usr/share/tomcat/conf/catalina.policy, but our tomcat package doesn't install one there. It has /etc/tomcat/catalina.policy.

adamwill commented a year ago

Well, none of that code has changed for years, so I'm a bit confused. But there's no file in Fedora that contains /usr/share/tomcat/conf/catalina.policy AFAICT.

abbra commented & provided feedback a year ago

karma

In Fedora 42 this is fine because tomcat package actually has a symlink /usr/share/tomcat/conf -> /etc/tomcat. In Fedora 43 the tomcat build (part of this update) has broke all the symlinks from /usr/share/tomcat:

$ rpm -qlv tomcat|egrep '^l'
lrwxrwxrwx    1 root     tomcat                     11 Jun 10 02:00 /usr/share/tomcat/conf -> /etc/tomcat
lrwxrwxrwx    1 root     tomcat                     22 Jun 10 02:00 /usr/share/tomcat/lib -> /usr/share/java/tomcat
lrwxrwxrwx    1 root     tomcat                     15 Jun 10 02:00 /usr/share/tomcat/logs -> /var/log/tomcat
lrwxrwxrwx    1 root     tomcat                     22 Jun 10 02:00 /usr/share/tomcat/temp -> /var/cache/tomcat/temp
lrwxrwxrwx    1 root     tomcat                     23 Jun 10 02:00 /usr/share/tomcat/webapps -> /var/lib/tomcat/webapps
lrwxrwxrwx    1 root     tomcat                     22 Jun 10 02:00 /usr/share/tomcat/work -> /var/cache/tomcat/work

$ rpm -qlpv https://kojipkgs.fedoraproject.org//packages/tomcat/10.1.36/8.fc43/noarch/tomcat-10.1.36-8.fc43.noarch.rpm|egrep '^l'
lrwxrwxrwx    1 root     root                       34 Apr 25 02:00 /var/lib/tomcat/conf -> ../../../../../../../../etc/tomcat
lrwxrwxrwx    1 root     root                       38 Apr 25 02:00 /var/lib/tomcat/logs -> ../../../../../../../../var/log/tomcat
lrwxrwxrwx    1 root     root                       40 Apr 25 02:00 /var/lib/tomcat/work -> ../../../../../../../../var/cache/tomcat

adamwill commented a year ago

ahhh, that'd be it. thanks.

jmagne edited this update.

New build(s):

dogtag-pki-11.8.0-0.2.beta2.fc43

Removed build(s):

dogtag-pki-11.8.0-0.1.beta1.fc43

Karma has been reset.

jmagne commented a year ago

Edited the update with a new build, that passes most of our CI, other than IPA related tests. We are currently working with that team to resolve.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

adamwill commented & provided feedback a year ago

karma

New version fails tests because this tomcat package has no tomcat binary in (/usr)/(s)bin (they're all the same place on Fedora, there's no binary in any of them in this package), but ipa-server-install expects there to be one. The previous tomcat package did have a tomcat binary.

2025-07-22T17:45:22Z DEBUG Starting external process
2025-07-22T17:45:22Z DEBUG args=['/usr/sbin/tomcat', 'version']
2025-07-22T17:45:22Z DEBUG Process execution failed
2025-07-22T17:45:22Z DEBUG Traceback (most recent call last):
  File "/usr/lib/python3.14/site-packages/ipaserver/install/service.py", line 688, in start_creation
    run_step(full_msg, method)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/service.py", line 674, in run_step
    method()
    ~~~~~~^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/dogtaginstance.py", line 415, in secure_ajp_connector
    if self._is_newer_tomcat_version('9.0.31.0'):
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^
  File "/usr/lib/python3.14/site-packages/ipaserver/install/dogtaginstance.py", line 376, in _is_newer_tomcat_version
    result = ipautil.run([paths.BIN_TOMCAT, "version"],
                         capture_output=True)
  File "/usr/lib/python3.14/site-packages/ipapython/ipautil.py", line 543, in run
    p = subprocess.Popen(args, stdin=p_in, stdout=p_out, stderr=p_err,
                         close_fds=True, env=env, cwd=cwd,
                         preexec_fn=preexec_fn)
  File "/usr/lib64/python3.14/subprocess.py", line 1038, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                        pass_fds, cwd, env,
                        ^^^^^^^^^^^^^^^^^^^
    ...<5 lines>...
                        gid, gids, uid, umask,
                        ^^^^^^^^^^^^^^^^^^^^^^
                        start_new_session, process_group)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.14/subprocess.py", line 1855, in _execute_child
    self._posix_spawn(args, executable, env, restore_signals, close_fds,
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                      p2cread, p2cwrite,
                      ^^^^^^^^^^^^^^^^^^
                      c2pread, c2pwrite,
                      ^^^^^^^^^^^^^^^^^^
                      errread, errwrite)
                      ^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.14/subprocess.py", line 1799, in _posix_spawn
    self.pid = os.posix_spawn(executable, args, env, **kwargs)
               ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/usr/sbin/tomcat'

BIN_TOMCAT is defined as /usr/sbin/tomcat in ipaplatform/base/paths.py in FreeIPA.

jmagne commented a year ago

Yes, I've just heard from rcrit that he thinks the fix is a one liner or thereabout. Thanks.

rcritten commented a year ago

I did the build targeting the side tag but it hasn't been added yet.

ftrivino commented a year ago

Hey @jmagne, could you manually add this IPA build to the side-tag? https://koji.fedoraproject.org/koji/taskinfo?taskID=135253288

jmagne edited this update.

New build(s):

freeipa-4.12.2-15.fc43

Karma has been reset.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

adamwill commented a year ago

openQA tests on this update now pass, but it is gated by various per-package gating policy failures:

dogtag-pki fails installability because its tests require pylint and pylint is FTI with Python 3.14: https://bugzilla.redhat.com/show_bug.cgi?id=2368703 . This would be appropriate to waive
dogtag-pki fails rpminspect. The failure is a bit mysterious - there are no rpminspect-level 'fail' results, only 'inspect' results for the runpath subtest. I guess those are considered a failure at the overall level? I find rpminspect a bit confusing sometimes with things like this. @dcantrell ?
freeipa similarly fails rpminspect in a mysterious way
tomcat failed the installability tests with various failures in update, downgrade and remove; not sure quite why they're failing, they look a bit odd
tomcat fails rpminspect with red results in permissions, ownership and capabilities

All the above should be investigated and resolved to get this update through.

jmagne edited this update.

New build(s):

jss-5.8.0-0.3.beta3.fc43.1
tomcat-10.1.43-5.fc43

Removed build(s):

jss-5.8.0-0.1.beta1.fc43
tomcat-10.1.36-8.fc43

Karma has been reset.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

adamwill commented a year ago

Hum, now openQA tests are failing again. Will look at it in the morning.

jmagne edited this update.

New build(s):

freeipa-4.12.2-15.fc43.1

Removed build(s):

freeipa-4.12.2-15.fc43

Karma has been reset.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

adamwill commented & provided feedback a year ago

karma

Current error: there's a var/log/pki/pki-tomcat/pki/debug.2025-07-30.log with this Java trace (will expire in a day). Obvious errors in it:

java.nio.file.NoSuchFileException: /usr/share/java/tomcat-jakartaee-migration/bcel-6.10.0.jar
java.nio.file.NoSuchFileException: /usr/share/java/tomcat-jakartaee-migration/commons-compress-1.27.1.jar
java.nio.file.NoSuchFileException: /usr/share/java/tomcat-jakartaee-migration/bcel-6.10.0.jar
java.nio.file.NoSuchFileException: /usr/share/java/tomcat-jakartaee-migration/commons-compress-1.27.1.jar

jmagne edited this update.

New build(s):

dogtag-pki-11.8.0-0.3.beta3.fc43.3

Removed build(s):

dogtag-pki-11.8.0-0.2.beta2.fc43

Karma has been reset.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

adamwill commented & provided feedback a year ago

karma

Latest error, in pki-tomcat service logs this time:

Jul 30 11:39:18 ipa002.test.openqa.fedoraproject.org systemd[1]: Starting pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat...
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org pki-server[5093]: WARNING: A restricted method in java.lang.System has been called
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org pki-server[5093]: WARNING: java.lang.System::loadLibrary has been called by com.netscape.cmstools.tps.TPSClientCLI in an unnamed module (file:/usr/share/java/pki/pki-tools.jar)
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org pki-server[5093]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org pki-server[5093]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org pki-server[5090]: AJP connector requiredSecret: None
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org pki-server[5090]: AJP connector requiredSecret: None
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org systemd[1]: Started pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat.
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: Java virtual machine used: /usr/lib/jvm/jre-25-openjdk/bin/java
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: main class used: org.apache.catalina.startup.Bootstrap
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: flags used: -Dcom.redhat.fips=false --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager     -Djava.security.manager     -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: arguments used: start
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: Error occurred during initialization of VM
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]: java.lang.Error: A command line option has attempted to allow or enable the Security Manager. Enabling a Security Manager is not supported.
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org server[5176]:         at java.lang.System.initPhase3(java.base@25-ea/System.java:1969)
Jul 30 11:39:19 ipa002.test.openqa.fedoraproject.org systemd[1]: pki-tomcatd@pki-tomcat.service: Main process exited, code=exited, status=1/FAILURE

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

This update's test gating status has been changed to 'waiting'.

This update's test gating status has been changed to 'failed'.

kevin commented 12 months ago

This update has been unpushed.

Please log in to add feedback.

Metadata

Type

enhancement

Severity

high

Karma

-1

Signed

Content Type

RPM

Test Gating

failed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Thresholds

Minimum Karma

+2

Minimum Testing

14 days

Dates

submitted

a year ago

in testing

a year ago

modified

a year ago

Builds

5

dogtag-pki-11.8.0-0.3.beta3.fc43.3

freeipa-4.12.2-15.fc43.1

jss-5.8.0-0.3.beta3.fc43.1

resteasy-3.0.26-33.fc43

tomcat-10.1.43-5.fc43

dogtag-pki-11.8.0-0.3.beta3.fc43.3

freeipa-4.12.2-15.fc43.1

jss-5.8.0-0.3.beta3.fc43.1

resteasy-3.0.26-33.fc43

tomcat-10.1.43-5.fc43

Automated Test Results

For help debugging failed Fedora CI tests (fedora-ci.*), contact the Fedora CI team.
For help debugging failed Fedora CoreOS tests (coreos.*), contact the Fedora CoreOS team.
For help debugging failed openQA tests (update.*), contact the Fedora Quality team, who will usually investigate and diagnose all failures within 24 hours.

failed

Copyright © 2007-2026 Red Hat, Inc. and others.

Running bodhi-server 26.4.0 on bodhi-web-69455fd696-c84bv.

bodhi is Free Software. Please file issues if you have any problems. Read the documentation.

• Composes • Legal • Privacy policy •