The fact that, in many cases, problems don't appear because of sonames, missing symbols or just pure luck, is really a band aid around this underlying issue. Package x was then released before the full set, y, and thus you end up with this problem that x is being run against versions of packages in y that were not those that it was built against. As I understand it, the issue here is that x was built against y, a subset of which, z, were not yet released in Fedora. Such a change is a kludge to fix what is inherent breakage in the packaging system.įor a package, x, there is a set of build dependencies, y. I'm not in favour of it either, I was just making sure you covered all bases if you did push this. > Still I'm very afraid to push this change. > Are you sure with 'as well'? I would say only nss-softokn, then? > be different, and it's softokn that provides the freebl library. Either way, we need to check nss-softokn as well, as the two can > %global NSS_BUILDTIME_VERSION %(pkg-config -modversion nss-softokn) would # tool to copy jdk's configs - should be Recommends only, but then only dnf/yum eforce it, not rpm transaction and so no configs are persisted when pure rpm -u is run. +# there is need to depnd on exact version of nss # libsctp.so.1 is being `dlopen`ed on demand %global _privatelibs -666,6 +668,8 Requires: javapackages-tools

+%global NSS_BUILDTIME_VERSION %(rpm -q nss | grep `uname -i` | sed s/.`uname -i`// | sed s/nss-//) %global NSS_CFLAGS %(pkg-config -cflags nss-softokn) Either java changed something (and potentially should require the new nss to force upgrade), or nss changed something (and perhaps should have bumped soname). So it seems java build -2.b14 is not happy with nss 3.22.2.

: enable PKIX certificate path discovery and validation : stopping certificate server instance to update CS.cfg install_tool(Server): ERROR CA configuration failed. CAInstance: CRITICAL /var/log/pki/pki-tomcat CAInstance: CRITICAL /var/log/pki-ca-install.log CAInstance: CRITICAL See the installation logs and the following files/directories for more information: CAInstance: CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpQSaQPY'' returned non-zero exit status 1 : configuring certificate server instance

Install freeipa-server, make sure you have the package versions as above.Ĭonfiguring certificate server (pki-tomcatd). Version-Release number of selected component (if applicable):ġ. With them, tomcat does not start so pki-ca-spawn fails. On my FreeIPA installation (which happens to be in container but that should not matter), packages used are

Critical ops hack 1.8.0