FEDORA-2026-165f7e7dec — bugfix update for freeipa, krb5, & 1 more

stable

freeipa-4.13.1-5.fc43, krb5-1.22.2-2.fc43, & 1 more

FEDORA-2026-165f7e7dec created by abbra 2 months ago for Fedora 43

Rebase to krb5 1.22.2

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-165f7e7dec

This update's test gating status has been changed to 'waiting'.

2 months ago

This update has been submitted for testing by bodhi.

2 months ago

This update's test gating status has been changed to 'failed'.

2 months ago

abbra commented 2 months ago

Failures are due to incomplete SELinux policy. See FEDORA-2026-165f7e7dec for details.

Adding -1 for preventing accidental push

jrische provided feedback 2 months ago

karma

abbra edited this update.

New build(s):

freeipa-4.13.1-3.fc43

Removed build(s):

freeipa-4.13.1-2.fc43

Karma has been reset.

2 months ago

This update's test gating status has been changed to 'waiting'.

2 months ago

This update's test gating status has been changed to 'failed'.

2 months ago

adamwill commented & provided feedback 2 months ago

karma

See discussion on the Rawhide update. SELinux issues.

This update has been pushed to testing.

2 months ago

abbra edited this update.

New build(s):

freeipa-4.13.1-5.fc43

Removed build(s):

freeipa-4.13.1-3.fc43

Karma has been reset.

2 months ago

This update has been submitted for testing by abbra.

2 months ago

This update's test gating status has been changed to 'waiting'.

2 months ago

This update's test gating status has been changed to 'passed'.

2 months ago

besser82 commented & provided feedback 2 months ago

karma

Works great! LGTM! =)

geraldosimiao provided feedback a month ago

karma

bojan commented & provided feedback a month ago

karma

Works.

imabug provided feedback a month ago

karma

Test Case desktop network smb

This update has been pushed to testing.

a month ago

This update can be pushed to stable now if the maintainer wishes

a month ago

This update's test gating status has been changed to 'failed'.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

This update's test gating status has been changed to 'failed'.

a month ago

This update's test gating status has been changed to 'waiting'.

a month ago

This update's test gating status has been changed to 'passed'.

a month ago

This update has been submitted for stable by abbra.

a month ago

adamwill commented a month ago

The waiver here seems incorrect. It says "krb5 functional tests seem aren't executed due to infra problems.", but the gating failure is https://artifacts.dev.testing-farm.io/9031dc9e-42cb-4bef-b558-834195b9ded9/ , which certainly was run, and shows a real failure:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Run GEF got-audit
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 07:36:43 ] :: [   PASS   ] :: Command 'systemctl restart krb5kdc.service' (Expected 0, got 0)
:: [ 07:36:43 ] :: [   PASS   ] :: Command 'systemctl restart kadmin.service' (Expected 0, got 0)
:: [ 07:36:44 ] :: [   PASS   ] :: Command 'systemctl --no-pager status krb5kdc.service' (Expected 0, got 0)
:: [ 07:36:44 ] :: [   PASS   ] :: Command 'systemctl --no-pager status kadmin.service' (Expected 0, got 0)
:: [ 07:36:44 ] :: [   PASS   ] :: Command 'SERVICE_PID=$( systemctl show --property=MainPID krb5kdc.service | cut -f2 -d= )' (Expected 0, got 0)
:: [ 07:36:44 ] :: [   PASS   ] :: Command 'echo SERVICE_PID is '8712'' (Expected 0, got 0)
:: [ 07:36:47 ] :: [   PASS   ] :: Command 'gdb-gef --pid '8712' --command='/var/ARTIFACTS/work-tests63kpg44u/plans/tests/discover/default-0/tests/tests/got-audit'/got-audit.gdb --batch > '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b'' (Expected 0, got 0)
:: [ 07:36:47 ] :: [   PASS   ] :: File '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b' should contain ' : /.*/libc.so' 
:: [ 07:36:47 ] :: [   FAIL   ] :: File '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b' should not contain ' :: ERROR' 
:: [ 07:36:47 ] :: [   PASS   ] :: Command 'cp '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b' '/var/ARTIFACTS/work-tests63kpg44u/plans/tests/execute/data/guest/default-0/tests/got-audit-1/data'/krb5kdc-got-audit.txt' (Expected 0, got 0)
:: [ 07:36:47 ] :: [   PASS   ] :: Command 'SERVICE_PID=$( systemctl show --property=MainPID kadmin.service | cut -f2 -d= )' (Expected 0, got 0)
:: [ 07:36:47 ] :: [   PASS   ] :: Command 'echo SERVICE_PID is '8742'' (Expected 0, got 0)
:: [ 07:36:49 ] :: [   PASS   ] :: Command 'gdb-gef --pid '8742' --command='/var/ARTIFACTS/work-tests63kpg44u/plans/tests/discover/default-0/tests/tests/got-audit'/got-audit.gdb --batch > '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b'' (Expected 0, got 0)
:: [ 07:36:49 ] :: [   PASS   ] :: File '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b' should contain ' : /.*/libc.so' 
:: [ 07:36:49 ] :: [   PASS   ] :: File '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b' should not contain ' :: ERROR' 
:: [ 07:36:49 ] :: [   PASS   ] :: Command 'cp '/tmp/tmp.SttfDE34sR/tmp.I4IcCfcm2b' '/var/ARTIFACTS/work-tests63kpg44u/plans/tests/execute/data/guest/default-0/tests/got-audit-1/data'/kadmin-got-audit.txt' (Expected 0, got 0)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Duration: 6s
::   Assertions: 15 good, 1 bad
::   RESULT: FAIL (Run GEF got-audit)

abbra commented a month ago

The failure seem to be unrelated to these packages:



sss_string_array_free : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_string_array_free found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_radius_message_encode : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_radius_message_encode found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_string_array_copy : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_string_array_copy found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_strings_to_json_array : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_strings_to_json_array found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])
sss_radiuskdc_challenge_free : /usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so :: ERROR sss_radiuskdc_challenge_free found in multiple paths (['/usr/lib64/sssd/modules/sssd_krb5_passkey_plugin.so', '/usr/lib64/sssd/modules/sssd_krb5_idp_plugin.so'])

E.g. it comes from SSSD modules built using the same infrastructure in SSSD code.

This update has been pushed to stable.

a month ago

edvins123 commented & provided feedback a month ago

karma

Ran into dependency issues on Silverblue related to this update — sharing my experience and workaround in case anyone else hits the same problem or in case it is relevant for improving the release process.

On Fedora 43 Silverblue (compose 43.20260219.0), the base image includes krb5-libs-1.22.2-2.fc43, but rpm-ostree upgrade failed with dependency solving errors:

Failed to download updates: Could not depsolve transaction; 1 problem detected:
 Problem: package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires krb5-libs(x86-32) = 1.21.3-7.fc43, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5.so.3, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libk5crypto.so.3, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5.so.3(krb5_3_MIT), but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libk5crypto.so.3(k5crypto_3_MIT), but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5support.so.0, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5support.so.0(krb5support_0_MIT), but none of the providers can be installed
  - conflicting requests
  - krb5-libs-1.21.3-7.fc43.i686 from fedora does not belong to a distupgrade repository
  - package krb5-pkinit-1.21.3-7.fc43.x86_64 from fedora requires krb5-libs(x86-64) = 1.21.3-7.fc43, but none of the providers can be installed
  - cannot install both krb5-libs-1.21.3-7.fc43.x86_64 from fedora and krb5-libs-1.22.2-2.fc43.x86_64 from @System

I uninstalled both krb5-pkinit and freeipa-client packages, and then upgrade command succeeded, but could not reinstall them with issues like this:

$ rpm-ostree install freeipa-client krb5-pkinit
Checking out tree 8cb3d09... done
Enabled rpm-md repositories: updates fedora code
Updating metadata for 'updates'... done
Updating metadata for 'fedora'... done
Updating metadata for 'code'... done
Importing rpm-md... done
rpm-md repo 'updates'; generated: 2026-02-23T01:52:55Z solvables: 23575
rpm-md repo 'fedora'; generated: 2025-10-23T03:37:20Z solvables: 77664
rpm-md repo 'code'; generated: 2026-02-23T18:30:40Z solvables: 653
Resolving dependencies... done
error: Could not depsolve transaction; 1 problem detected:
 Problem: package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires krb5-libs(x86-32) = 1.21.3-7.fc43, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libk5crypto.so.3, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5.so.3, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5.so.3(krb5_3_MIT), but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5support.so.0, but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libk5crypto.so.3(k5crypto_3_MIT), but none of the providers can be installed
  - package krb5-pkinit-1.21.3-7.fc43.i686 from fedora requires libkrb5support.so.0(krb5support_0_MIT), but none of the providers can be installed
  - conflicting requests
  - krb5-libs-1.21.3-7.fc43.i686 from fedora does not belong to a distupgrade repository
  - package krb5-pkinit-1.21.3-7.fc43.x86_64 from fedora requires krb5-libs(x86-64) = 1.21.3-7.fc43, but none of the providers can be installed
  - cannot install both krb5-libs-1.21.3-7.fc43.x86_64 from fedora and krb5-libs-1.22.2-2.fc43.x86_64 from @System

Adding excludepkgs=*.i686 to the [fedora] and [updates] repo sections and clearing metadata cache (rpm-ostree cleanup -m) resolved the issue and allowed freeipa-client and krb5-pkinit to be installed. Why, having no 32-bit packages installed, the i686 version was preferred by the rpm-ostree install and upgrade commands is beyond me.

Please log in to add feedback.

Metadata

Type

bugfix

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

2 months ago

in testing

a month ago

in stable

a month ago

modified

2 months ago

approved

a month ago

Builds

freeipa-4.13.1-5.fc43

krb5-1.22.2-2.fc43

samba-4.23.5-2.fc43

freeipa-4.13.1-5.fc43

krb5-1.22.2-2.fc43

samba-4.23.5-2.fc43

Automated Test Results

passed

Test Cases


0	1	Test Case desktop network smb