failing autopkgtest due to password issue by nss
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
freeipa (Ubuntu) |
Won't Fix
|
Undecided
|
Unassigned | ||
nss (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Hi,
I was failed by autopkgtests of freeipa, but not the old "ip route output changed" case.
Like: https:/
It essentially does this and fails:
$ apt install freeipa-server freeipa-server-dns freeipa-
Containers:
Bionic-as-is: installs ok
Bionic-Proposed: installs ok
In LP Infra:
dpkg: error processing package freeipa-client (--configure):
installed freeipa-client package post-installation script subprocess returned error exit status 1
Use Pinning to get the autopkgtest style:
# cat /etc/apt/
Package: *
Pin: release a=bionic
Pin-Priority: 1001
Package: libnss3 libnss3-tools libnss3-dev libnss3-dbg
Pin: release a=bionic-proposed
Pin-Priority: 1002
Bionic-
freeipa-client is in the postinst calling this:
python2 -c 'from ipapython.certdb import update_ipa_nssdb; update_ipa_nssdb()'
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "/usr/lib/
create_
File "/usr/lib/
db.
File "/usr/lib/
self.
File "/usr/lib/
return ipautil.
File "/usr/lib/
raise CalledProcessEr
subprocess.
That is - if called alone complaining about the passwd:
# /usr/bin/certutil -d /etc/ipa/nssdb -N -f /etc/ipa/
Invalid password.
certutil: Could not set password for the slot: SEC_ERROR_
Note that there is a related freeipa fix in later versions:
freeipa (4.6.2-4) unstable; urgency=medium
* client.postinst: Migrate from old nssdb only if it exists.
And since that change freeipa has:
if [ -f /etc/ipa/
around the call.
It also changed the import slightly - now the python being:
python2 -c 'from ipaclient.
That in the "all-proposed" case with the cert8.db file copied over is still failing but differently:
/usr/bin/certutil -d /etc/ipa/nssdb -L -f /etc/ipa/
certutil: function failed: SEC_ERROR_
The merge of nss was a minor bump 3.34->3.35
Also this is the nss version from Debian with the freeipa version from Debian. They seem to work together there.
I don't fully understand it yet - so filing this bug for a discussion.
I need the help of tjaalton who did the freeipa changes - maybe he knows what is going on.
Do we have to:
- rebuild freeipa against newer nss?
- just mark something as bad test
- something completely else?
Changed in nss (Ubuntu): | |
status: | New → Triaged |
Changed in freeipa (Ubuntu): | |
status: | New → Won't Fix |
Subscribing tjaalton to get his opinion on this.