F36 Change: OpenLDAP 2.5 (System-Wide Change proposal)

[Ben Cotton]

https://fedoraproject.org/wiki/Changes/Openldap_25

== Summary ==
OpenLDAP upgrade from version 2.4.59 to the last upstream version
2.5.8 in Fedora.

== Owner ==
* Name: [[User:spichugi| Simon Pichugin]]
* Email: spichugi(a)gmail.com


== Detailed Description ==
Upgrading OpenLDAP from version 2.4.59 to version 2.5.8 according to
the new upstream release. Years of development differ between these
two releases, so problems are expected.

This change might cause failures during builds of multiple packages.
These two versions have slight ABI incompatibility even though it's
easily fixable. This step must be properly discussed with maintainers
of dependent packages, which should forward this change proposal to
their upstream projects.


== Benefit to Fedora ==
Brings a stable and up-to-date version of OpenLDAP according to
upsteam release. OpenLDAP 2.4 will be out of support as soon as
OpenLDAP 2.6 is released which is planned for this year. Fedora will
be prepared for such a step.

== Scope ==
* Proposal owners:
**Prepare openldap-2.5.8 as RPM package for Fedora Rawhide
**Check software that requires `openldap` and rebuild it with openldap-2.5.8
**Build openldap-2.5.8 to Rawhide in a side-tag
(https://fedoraproject.org/wiki/Package_update_HOWTO#Creating_a_side-tag)
**Rebuild depended packages with openldap-2.5.8 in the side-tag
**Merge the side-tag to Rawhide

* Other developers: Check if their packages can be build with
openldap-2.5.8, if not, they are required to make the appropriate
changes to their packages.
* Release engineering: https://pagure.io/releng/issue/10349
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:


== Upgrade/compatibility impact ==
Problems during build can appear in multiple packages what can lead to
build failure, as multiple packages require OpenLDAP as their upstream
dependency. These problems have to be resolved before adding
openldap-2.5.8 into Fedora. It seems aprox. 10% of dependent packages
are having problems during build, which could be caused by a problem
with same pattern.

== How To Test ==
Rebuilding your packages with openldap-2.5.8 dependency in copr
(https://copr.fedorainfracloud.org/coprs/spichugi/openldap-2.5/).

The best way to rebuild new version of package against openldap-2.5.8
is to create a pull-request against your dist-git repository (against
rawhide branch). After that, you package will be automatically rebuild
in the mentioned copr. Please find your package in the "Builds" tab
and search in the various sub-tabs for your build.

If possible, please prepare a pull-request, so you can easily merge
it, when the change will be executed.

For local testing and building, please download mock-config from the
given copr repository and use it with your mock:

`copr mock-config spichugi/openldap-2.5 fedora-rawhide-x86_64 >
spichugi-openldap-2.5_fedora-rawhide-x86_64.cfg`

`mv spichugi-openldap-2.5_fedora-rawhide-x86_64.cfg /etc/mock`

Now we may run:
`mock -r spichugi-openldap-2.5_fedora-rawhide-x86_64 --rebuild
<package-1.0-1.src.rpm>`

== User Experience ==
Users will be able to use the newer version (2.5) of OpenLDAP, and
building packages with openldap-2.4 won't be available, as it won't be
present on the specific fedora version. This can affect 3rd partly
packages, which are not part of Fedora.

To remediate the impact of the change the post-installation script
will be run with the package installation. And in case the
openldap-servers package is installed on the system, `dnf` will halt
the upgrade and notify the user with a message describing what and why
happened, and what steps to take to mitigate the issue.

The user will have to follow the Upstream upgrading guide and only
then concisely continue the upgrade:
https://www.openldap.org/doc/admin25/appendix-upgrading.html

== Dependencies ==
Tens of packages have build dependency on OpenLDAP, so they should be
properly notified and the upgradeshould be carefully tested. List of
dependent packages with their ability to be built with openldap-2.5
can be found in the given copr project
(https://copr.fedorainfracloud.org/coprs/spichugi/openldap-2.5/packages/)

== Contingency Plan ==
* Contingency mechanism: moving this change to Fedora 37, if not
successfully finished until Fedora 36 branching from Rawhide
* Contingency deadline: Fedora 36 branching from Rawhide (2022-02-08)
* Blocks release? No


== Documentation ==
Latest OpenLDAP documentation:
https://www.openldap.org/doc/admin25/

== Release Notes ==
Release notes for the latest OpenLDAP release:
https://www.openldap.org/software/release/


-- 
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis

[Neal Gompa]

On Tue, Oct 19, 2021 at 12:09 PM Ben Cotton <bcotton(a)redhat.com&gt; wrote:
>  == User Experience ==
>  Users will be able to use the newer version (2.5) of OpenLDAP, and
>  building packages with openldap-2.4 won't be available, as it won't be
>  present on the specific fedora version. This can affect 3rd partly
>  packages, which are not part of Fedora.
>
>  To remediate the impact of the change the post-installation script
>  will be run with the package installation. And in case the
>  openldap-servers package is installed on the system, `dnf` will halt
>  the upgrade and notify the user with a message describing what and why
>  happened, and what steps to take to mitigate the issue.
>
>  The user will have to follow the Upstream upgrading guide and only
>  then concisely continue the upgrade:
>  https://www.openldap.org/doc/admin25/appendix-upgrading.html
>  
This is not allowed in Fedora. We cannot have DNF failing via
scriptlet *at all*. The result of that is a completely broken
transaction and an unrecoverable system, depending on the scenario.
Please figure out a way to make upgrades work non-interactively with
OpenLDAP Server or do something to prevent the server service from
starting until migration tasks have been complete or something else
altogether.



-- 
真実はいつも一つ！/ Always, there's only one truth!

[Matthew Miller]

On Fri, Oct 29, 2021 at 06:27:54PM -0400, Neal Gompa wrote:
>  > Users will be able to use the newer version (2.5) of OpenLDAP,
> and
>  > building packages with openldap-2.4 won't be available, as it won't be
>  > present on the specific fedora version. This can affect 3rd partly
>  > packages, which are not part of Fedora.
>  >
>  > To remediate the impact of the change the post-installation script
>  > will be run with the package installation. And in case the
>  > openldap-servers package is installed on the system, `dnf` will halt
>  > the upgrade and notify the user with a message describing what and why
>  > happened, and what steps to take to mitigate the issue. 
[...]
>  This is not allowed in Fedora. We cannot have DNF failing via
>  scriptlet *at all*. The result of that is a completely broken
>  transaction and an unrecoverable system, depending on the scenario.
>  Please figure out a way to make upgrades work non-interactively with
>  OpenLDAP Server or do something to prevent the server service from
>  starting until migration tasks have been complete or something else
>  altogether. 
I'm not quite understanding the problem to be solved. What exactly are the
3rd-party packages referenced here? Non-RPM packages built against it which
might break?

It sounds like the goal is to make upgrades _not actually possible_ if
'openldap-servers <= 2.4.59' is installed. Or is the script planned to do
something more than that?


-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[Emmanuel Seyman]

* Ben Cotton [19/10/2021 12:08] :
>  == Benefit to Fedora ==
>  Brings a stable and up-to-date version of OpenLDAP according to
>  upsteam release. OpenLDAP 2.4 will be out of support as soon as
>  OpenLDAP 2.6 is released which is planned for this year. Fedora will
>  be prepared for such a step. 
Since this was written, the OpenLDAP Project has released OpenLDAP 2.6:
https://lists.openldap.org/hyperkitty/list/[e-mail]...

Emmanuel