I want to decouple things a bit to make this bug less blocking, so I will:
1. prep a nss upload 2:3.35-2ubuntu1+really3.34.1-1ubuntu1
That will (for now) skip the nss merge that I meant to do to help while
coming by, but seems to
2. test that in a ppa if it would test correctly where nss 2:3.35-2ubuntu1
currently fails in regard to freeipa
That will allow me to get through for nss what I need for other things,
without the yet unclear impact on the nss password handling.
P.S. the actual change we wanted was the opening of freebl3 as you know,
I really need to test #1 if that change might have been the trigger for
these failure :-/
I'll report back here after the tests
You received this bug notification because you are a member of FreeIPA,
which is subscribed to freeipa in Ubuntu.
failing autopkgtest due to password issue by nss
Status in freeipa package in Ubuntu:
I was failed by autopkgtests of freeipa, but not the old "ip route output
It essentially does this and fails:
$ apt install freeipa-server freeipa-server-dns freeipa-server-trust-ad
freeipa-common freeipa-client freeipa-admintools freeipa-tests python-ipaclient
python-ipalib python-ipaserver python-ipatests
Bionic-as-is: installs ok
Bionic-Proposed: installs ok
In LP Infra:
dpkg: error processing package freeipa-client (--configure):
installed freeipa-client package post-installation script subprocess
returned error exit status 1
Use Pinning to get the autopkgtest style:
# cat /etc/apt/preferences.d/nssonlyproposed
Pin: release a=bionic
Package: libnss3 libnss3-tools libnss3-dev libnss3-dbg
Pin: release a=bionic-proposed
Bionic-nss-only-from-Proposed: TRIGGERS the issue
freeipa-client is in the postinst calling this:
python2 -c 'from ipapython.certdb import update_ipa_nssdb; update_ipa_nssdb()'
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "/usr/lib/python2.7/dist-packages/ipapython/certdb.py", line 64, in
File "/usr/lib/python2.7/dist-packages/ipapython/certdb.py", line 53, in
File "/usr/lib/python2.7/dist-packages/ipapython/certdb.py", line 149, in
self.run_certutil(["-N", "-f", password_filename])
File "/usr/lib/python2.7/dist-packages/ipapython/certdb.py", line 142, in
return ipautil.run(new_args, stdin, **kwargs)
File "/usr/lib/python2.7/dist-packages/ipapython/ipautil.py", line 515, in
raise CalledProcessError(p.returncode, arg_string, str(output))
subprocess.CalledProcessError: Command '/usr/bin/certutil -d /etc/ipa/nssdb
-N -f /etc/ipa/nssdb/pwdfile.txt' returned non-zero exit status 255
That is - if called alone complaining about the passwd:
# /usr/bin/certutil -d /etc/ipa/nssdb -N -f /etc/ipa/nssdb/pwdfile.txt
certutil: Could not set password for the slot: SEC_ERROR_BAD_PASSWORD: The
security password entered is incorrect.
Note that there is a related freeipa fix in later versions:
freeipa (4.6.2-4) unstable; urgency=medium
* client.postinst: Migrate from old nssdb only if it exists.
And since that change freeipa has:
if [ -f /etc/ipa/nssdb/cert8.db ]; then
around the call.
It also changed the import slightly - now the python being:
python2 -c 'from ipaclient.install.client import update_ipa_nssdb;
That in the "all-proposed" case with the cert8.db file copied over is still
failing but differently:
/usr/bin/certutil -d /etc/ipa/nssdb -L -f /etc/ipa/nssdb/pwdfile.txt
certutil: function failed: SEC_ERROR_BAD_DATABASE: security library: bad
The merge of nss was a minor bump 3.34->3.35
Also this is the nss version from Debian with the freeipa version from
Debian. They seem to work together there.
I don't fully understand it yet - so filing this bug for a discussion.
I need the help of tjaalton who did the freeipa changes - maybe he knows what
is going on.
Do we have to:
- rebuild freeipa against newer nss?
- just mark something as bad test
- something completely else?
To manage notifications about this bug go to:
Mailing list: https://launchpad.net/~freeipa
Post to : email@example.com
Unsubscribe : https://launchpad.net/~freeipa
More help : https://help.launchpad.net/ListHelp