freeIPA in Fedora 28 is currently broken for a number of reasons:
- The NSS switch to sqlite
- 389-ds now provides a default security entry
- many changes in dogtag
FESCO has given us and dogtag a reprieve on the beta deadline but we
need to get something working ASAP.
The dogtag team has their code in mostly working shape now.
For IPA we need to decide what to release. I see the choices as:
1. Use 4.6.3 + NSS and other patches
2. Release 4.7.0 now even though it doesn't have everything we planned
and ship that with F-28
3. Do a 4.7.0 pre-release (set IPA_VERSION_PRE_RELEASE in VERSION and
release a tarball).
4. Use a git pull from master for F-28 and name it something that will
be upgradable (this is the tricky bit).
Options #1 and #2 have been tested independently by Christian and I,
with him focusing on testing master and my testing of 4.6.3. Testing of
both cannot be described as thorough, mostly consisting of basic installs.
Upgrade from F-27 to 4.6.3+patches can work but it is still a little
bumpy, requiring a few post-install steps. We may be able to smooth this
out as well.
Should we allow upgrades at all given this unknown state? We can
probably add an rpm pretrans scriptlet to prevent upgrades.
rob