Merge ~ahasenack/ubuntu/+source/freeipa:disco-freeipa-restrict-dep8-packages into ubuntu/+source/freeipa:ubuntu/devel

[Andreas Hasenack]

freeipa dep8 tests are currently blocking the samba migration (update, see comment: also blocking sssd) because they found what we think is a real bug in samba, but entirely by accident. The dep8 tests don't even run. The bug happens when winbind and samba are installed together, and winbind is started before sambe. In this case, samba will fail to start.

Upstream bug is https://bugzilla.samba.org/show_bug.cgi?id=13697, launchpad bug is #1806035, and discussion in the samba mailing lists is continuing.

The idea behind this branch is to workaround that bug by not installing winbind, as it's not needed for the freeipa tests. It's currently pulled in by freeipa-server-trust-ad.

That indeed is enough to let the dep8 freeipa tests run again, but then the 4.7.1-1 upload of freeipa added a change to ignore test failures:

  * tests: Don't fail the tests, just dump the log if something goes
    wrong.

I removed that and ran the tests, and they are indeed failing, but for other, more complicated (java) reasons:

<ahasenack> Caused by: java.lang.UnsupportedClassVersionError: org/mozilla/jss/ssl/SSLSocketListener has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0
<ahasenack> does that ring a bell?
<tjaalton> where's this from?
<ahasenack> tjaalton: /var/log/pki/pki-tomcat/catalina.out
<tjaalton> ah, you have the fresh libjss-java?
<ahasenack> tjaalton: the test run fails like this: https://pastebin.ubuntu.com/p/gs26bM4F8Y/
<tjaalton> which builds with jdk11 now
<ahasenack> tjaalton: it's disco, I might
<tjaalton> 4.5.1-1
<ahasenack> yes, that one
<tjaalton> dogtag itself needs to be fixed, it'll take a while until new resteasy3.0 with jackson2 provider is available (just uploaded it)
<tjaalton> after that dogtag 10.6.8 should be fine, and I've fixed it to build with jdk11
<tjaalton> now checking resteasy 3.6.2 if it can replace src:resteasy3.0..

So, the summary is:
- freeipa dep8 test failures are currently being ignored
- freeipa itself needs work before it's usable again in disco
- freeipa dep8 test setup is failing because of the mentioned samba bug, which fails the installation of the test dependencies and as such the tests won't even run
- there is a real issue with samba that needs to be addressed. Discussion ongoing.
- in the meantime, samba migration is blocked

One can argue that the samba migration being blocked is correct. Its own dep8 tests pass, but they don't use winbind.

As to this change I'm proposing, Timo is ok with it:
<ahasenack> https://pastebin.ubuntu.com/p/Yc4WPKxQXd/ is what I have, that doesn't trigger the samba bug
<ahasenack> that installs these packages: https://pastebin.ubuntu.com/p/8GTNNYjVnQ/
<ahasenack> we don't get freeipa-tests
<tjaalton> that's fine
<ahasenack> ok
<tjaalton> it's purpose is somewhat unclear to me anyway :)
<tjaalton> upstream doesn't use it either
<tjaalton> so might just as well drop it, maybe
<ahasenack> tjaalton: I'll proposed this: https://pastebin.ubuntu.com/p/vnntfcNWwV/
<tjaalton> upload away

But it will unblock samba, i.e., let it migrate into disco, with the known issue that is still being discussed.

Let's consider this MP from two points of view:
a) the consequences for the freeipa package itself (which is already ignoring dep8 failures, and is currently unusable in disco anyway)
b) the consequence of this change letting samba migrate into disco. Something will have to be done after to fix the bug.

[Andreas Hasenack (ahasenack)]

I added a block-proposed tag to #1806035: "Not touching package as requested in bug 1806035 on Tue Dec 4 17:40:23 2018" so there is no risk of samba migrating even if this freeipa branch lands.

[Andreas Hasenack (ahasenack)]

This branch would then workaround the samba bug, and let http://people.canonical.com/~ubuntu-archive/proposed-migration/update_excuses.html#sssd migrate

[Christian Ehrhardt  (paelzer)]

I like fixing the tests ahead of time and holding samba back via the block-proposed tag for now.
But IMHO that will make the Archive state of Disco slightly worse.

What we "loose" is the implicit installability test for freeipa-*
Which is what found your real samba bug.
But since the tests are ignoring their result anyway ...

While we were discussing here this was already uploaded in 4.7.1-3
So there is not much to debate anymore :-/

So the MP is no more matching its target -> nack.

review: Disapprove

[Christian Ehrhardt  (paelzer)]

I guess this old MP is dead, but it still shows up in overviews.
To avoid distraction I'll set it to rejected - @andreas feel free to change that if I'm assuming the status of this wrong.

Unmerged commits

b0b5931... by Andreas Hasenack on 2018-12-03

changelog

39de5ac... by Andreas Hasenack on 2018-12-03

  * d/t/control: restrict the freeipa packages we install for the test, to
    avoid installing winbind as a dependency which triggers #1806035 in
    samba. winbind is not needed for the freeipa DEP8 test.

8d643e7... by Timo Aaltonen on 2018-10-18

Import patches-unapplied version 4.7.1-2ubuntu1 to ubuntu/cosmic-proposed

Imported using git-ubuntu import.

Changelog parent: 185c0e509c29a4f086bd1f2ca3663a5fb02cbaae

New changelog entries:
  * Upload to cosmic.
  * control: Change python-nose to -mock on python-ipatests Depends.
  * fix-oddjobd-conf.diff: Fix path to org.freeipa.server.conncheck.
  * server.postinst: Fix a typo.
  * fix-fontawesome-path.diff: Fix upgrade.

diff --git a/debian/changelog b/debian/changelog
index 5482527..be79bac 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+freeipa (4.7.1-2ubuntu2) disco; urgency=medium
+
+  * d/t/control: restrict the freeipa packages we install for the test, to
+    avoid installing winbind as a dependency which triggers #1806035 in
+    samba. winbind is not needed for the freeipa DEP8 test.
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 03 Dec 2018 15:59:43 -0200
+
 freeipa (4.7.1-2ubuntu1) cosmic; urgency=medium
 
   * Upload to cosmic.
diff --git a/debian/tests/control b/debian/tests/control
index 55fb645..17ef6f3 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,6 +1,7 @@
 Tests: server-install
+# replaced "@" with a list of packages because of #1806035
 Depends:
- @,
+ freeipa-server, freeipa-client, freeipa-server-dns, freeipa-admintools
 Restrictions:
  allow-stderr,
  isolation-container,