[Pkg-freeipa-devel] Bug#971363: freeipa-client fails to install on upgrade

[Michael Stone]

Package: freeipa-client
Version: 4.8.10-1
Severity: important

dpkg configure stage fails without meaningful log:

# dpkg --configure -a
Setting up freeipa-client (4.8.10-1) ...
dpkg: error processing package freeipa-client (--configure):
 installed freeipa-client package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 freeipa-client


Digging through the postinst script indicates that the output is being redirected to /var/log/ipaclient-upgrade.log:

# cat /var/log/ipaclient-upgrade.log 
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python3/dist-packages/ipaclient/install/client.py", line 2474, in update_ipa_nssdb
    sys_db = certdb.NSSDatabase(paths.NSS_DB_DIR)
  File "/usr/lib/python3/dist-packages/ipapython/certdb.py", line 267, in __init__
    raise ValueError(
ValueError: NSS is built without support of the legacy database(DBM)


In addition to addressing the immediate bug, I also suggest using tee to ensure
that the error message goes to stdout in addition to the log file so that it's
easier for users to understand what is going on.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.8.0-1-amd64 (SMP w/12 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages freeipa-client depends on:
ii  bind9-dnsutils [dnsutils]    1:9.16.6-3
ii  bind9-utils                  1:9.16.6-3
ii  certmonger                   0.79.11-1
ii  curl                         7.72.0-1
ii  dnsutils                     1:9.16.6-3
ii  freeipa-common               4.8.10-1
ii  krb5-user                    1.17-10
ii  libc6                        2.31-3
ii  libcom-err2                  1.45.6-1
ii  libini-config5               0.6.1-2
ii  libk5crypto3                 1.17-10
ii  libkrb5-3                    1.17-10
ii  libldap-2.4-2                2.4.53+dfsg-1
ii  libnss-sss                   2.3.1-2
ii  libnss3-tools                2:3.56-1
ii  libpam-sss                   2.3.1-2
ii  libpopt0                     1.18-1
ii  libsasl2-modules-gssapi-mit  2.1.27+dfsg-2
ii  libsss-sudo                  2.3.1-2
ii  libxmlrpc-core-c3            1.33.14-9
ii  oddjob-mkhomedir             0.34.6-1
ii  python3                      3.8.2-3
ii  python3-dnspython            2.0.0-1
ii  python3-gssapi               1.6.1-1+b1
ii  python3-ipaclient            4.8.10-1
ii  python3-ldap                 3.2.0-4+b1
ii  python3-sss                  2.3.1-2
ii  sssd                         2.3.1-2

Versions of packages freeipa-client recommends:
pn  chrony  <none>

Versions of packages freeipa-client suggests:
pn  libpam-krb5  <none>

-- no debconf information