Federation functional job failing on Bionic

[Dr. Jens Harbott]

When doing a test to migrate the functional tests to Bionic, this error occured within keystone-dsvm-functional-federation:

2018-10-18 15:43:32.336409 | controller | ++ functions-common:apt_get:1083 : sudo DEBIAN_FRONTEND=noninteractive http_proxy= https_proxy= no_proxy= apt-get --option Dpkg::Options::=--force-confold --assume-yes install libapache2-mod-shib2
2018-10-18 15:43:32.376149 | controller | Reading package lists...
2018-10-18 15:43:32.579166 | controller | Building dependency tree...
2018-10-18 15:43:32.579865 | controller | Reading state information...
2018-10-18 15:43:32.664285 | controller | Some packages could not be installed. This may mean that you have
2018-10-18 15:43:32.664482 | controller | requested an impossible situation or if you are using the unstable
2018-10-18 15:43:32.664634 | controller | distribution that some required packages have not yet been created
2018-10-18 15:43:32.664719 | controller | or been moved out of Incoming.
2018-10-18 15:43:32.664856 | controller | The following information may help to resolve the situation:
2018-10-18 15:43:32.664886 | controller |
2018-10-18 15:43:32.665000 | controller | The following packages have unmet dependencies:
2018-10-18 15:43:32.738989 | controller | libapache2-mod-shib2 : Depends: libshibsp-plugins (= 2.6.1+dfsg1-2) but it is not going to be installed
2018-10-18 15:43:32.739266 | controller | Depends: shibboleth-sp2-utils (>= 2.6) but it is not going to be installed
2018-10-18 15:43:32.739445 | controller | Depends: libshibsp7 but it is not going to be installed
2018-10-18 15:43:32.739651 | controller | Depends: libxmltooling7 (>= 1.6.0-5) but it is not going to be installed
2018-10-18 15:43:32.756003 | controller | E: Unable to correct problems, you have held broken packages.

Tracing the sequence of dependencies, it seems that ... isn't installable on ubuntu-server Bionic because of this reference to an outdated library:

$ sudo apt install libxmltooling7
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 libxmltooling7 : Depends: libcurl3 (>= 7.16.2) but it is not going to be installed
E: Unable to correct problems, you have held broken packages.
$ sudo apt install libcurl3
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  grub-pc-bin
Use 'sudo apt autoremove' to remove it.
The following packages will be REMOVED:
  curl libcurl4 pollinate ubuntu-server
The following NEW packages will be installed:
  libcurl3
0 upgraded, 1 newly installed, 4 to remove and 15 not upgraded.
Need to get 214 kB of archives.
After this operation, 495 kB disk space will be freed.
Do you want to continue? [Y/n] n

[Lance Bragstad (lbragstad)]

Looks like it's failing here [0]. I haven't seen anything like this recently, but I suppose we could patch that installation script to include other dependencies if needed.

Curious to hear if packagers have an opinion on what happened here.

[0] https://git.openstack.org/cgit/openstack/keystone/tree/devstack/lib/federation.sh#n62

[Dr. Jens Harbott (j-harbott)]

So it seems that this bug is the root cause https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1776489 but no progress or workaround available yet.

[Corey Bryant (corey.bryant)]

In Ubuntu we decided to support libapache2-mod-auth-mellon for keystone federation (https://launchpad.net/bugs/1610286). This was based on input from the security team at Canonical that xml-security-c code quality was lacking and it (and Xerces) were not well maintained at the time, and flaws could affect shibboleth. This doesn't solve the problem for this bug but may provide a work-around by using libapache2-mod-auth-mellon instead.

[Corey Bryant (corey.bryant)]

Not that libapache2-mod-auth-mellon is in main and will get full security support as of 18.04 LTS.

[Corey Bryant (corey.bryant)]

s/Not/Note