On RHEL 7.2 with FreeIPA 4.3.1 installed from https://copr-be.cloud.fedoraproject.org/results/mbabinsk/freeipa-4-3-centos-7/epel-7-$basearch/, running {{{ipa-server-install}}} fails:
# /usr/sbin/ipa-server-install --hostname=ipa.example.com -r EXAMPLE.COM -n example.com -p <REDACTED> -a <REDACTED> --ip-address=10.11.12.13 -U Traceback (most recent call last): File "/usr/sbin/ipa-server-install", line 25, in <module> from ipaserver.install.server import Server File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 5, in <module> from .install import Server File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 35, in <module> from ipaserver.install import ( File "/usr/lib/python2.7/site-packages/ipaserver/install/kra.py", line 13, in <module> from ipaserver.install import custodiainstance File "/usr/lib/python2.7/site-packages/ipaserver/install/custodiainstance.py", line 3, in <module> from ipapython.secrets.kem import IPAKEMKeys File "/usr/lib/python2.7/site-packages/ipapython/secrets/kem.py", line 9, in <module> from custodia.message.kem import KEMKeysStore File "/usr/lib/python2.7/site-packages/custodia/message/kem.py", line 9, in <module> from jwcrypto.jwe import JWE File "/usr/lib/python2.7/site-packages/jwcrypto/jwe.py", line 5, in <module> from cryptography.hazmat.primitives import constant_time, hashes, hmac File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/primitives/constant_time.py", line 9, in <module> from cryptography.hazmat.bindings._constant_time import lib AttributeError: _init_cffi_1_0_external_module
Packages carrying files mentioned in the traceback are:
ipa-server-4.3.1-1.el7.centos.x86_64 python2-ipalib-4.3.1-1.el7.centos.noarch python2-ipaserver-4.3.1-1.el7.centos.noarch python-cryptography-1.1-1.el7.centos.x86_64 python-custodia-0.1.0-1.el7.centos.noarch python-jwcrypto-0.2.1-3.el7.centos.noarch
It's a bug in our build of the python-cryptography package. python-cryptography needs a more recent version of python-cffi. The box has only python-cffi-0.8.6-2.el7.x86_64 installed. FreeIPA's COPR has python-cffi 1.4.2-1.el7.centos, but it's not getting installed automatically. python-cryptography doesn't have the necessary version requirement in its spec file:
# rpm -qR python-cryptography | grep cffi python-cffi >= 0.8
It should be python-cffi >= 1.4.
https://copr-be.cloud.fedoraproject.org/results/mbabinsk/freeipa-4-3-centos-7/epel-7-$basearch/ now contains python-cryptography 1.2.1-3 which should pull in correct python-cffi dependency.
Test coverage: no - downstream test needed
4.4.0 was released, moving open tickets to 4.4.1
This was fixed in RHEL and Fedora as well:
Fedora dist-git commit 777ef8f7e53d65d3c5e0438134f0f3aec116fb64 Author: Nathaniel McCallum <npmccallum@redhat.com> AuthorDate: Mon Jan 11 15:10:31 2016 -0500 Commit: Nathaniel McCallum <npmccallum@redhat.com> CommitDate: Mon Jan 11 15:10:31 2016 -0500 Move python-cryptograph => python2-cryptography --- python-cryptography.spec | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 54 insertions(+), 12 deletions(-)
Metadata Update from @adelton: - Issue assigned to mbabinsk - Issue set to the milestone: FreeIPA 4.4.1
Login to comment on this ticket.