Updates to Fedora Account System and impacts to fedpkg, koji

David Moreau Simard

2 minute read

Today when trying to do my Fedora packaging stuff I encountered problems with the fedpkg and koji commands – they would just hang without any output.

It turns out the Fedora Infrastructure folks are having a “Flag Day” which impacts some of the packaging workflow.

After talking with some helpful individuals on #fedora-devel and #fedora-admin, here’s what I had to do on my Fedora 25 installation to get things working again:

Update some packages

# Update koji, fedpkg and fedora-packager from updates-testing
sudo dnf --best --allowerasing --enablerepo updates-testing install koji fedpkg fedora-packager

Get your kerberos ticket

Running kinit <user>@FEDORAPROJECT.ORG should yield a password prompt. This is your FAS password.

Errors while getting a kerberos ticket

If you’re like me, you might end up seeing errors like this when running kinit:

$ kinit dmsimard@FEDORAPROJECT.ORG
[26882] 1481563654.204169: Getting initial credentials for dmsimard@FEDORAPROJECT.ORG
[26882] 1481563654.204262: Sending request (199 bytes) to FEDORAPROJECT.ORG
[26882] 1481563654.204356: Resolving hostname id.fedoraproject.org
[26882] 1481563654.460597: TLS certificate name matched "id.fedoraproject.org"
[26882] 1481563654.548361: Sending HTTPS request to https 2607:f188::dead:beef:cafe:fed1:443
[26882] 1481563654.722706: Received answer (191 bytes) from https 2607:f188::dead:beef:cafe:fed1:443
[26882] 1481563654.722715: Terminating TCP connection to https 2607:f188::dead:beef:cafe:fed1:443
[26882] 1481563654.723511: Response was not from master KDC
[26882] 1481563654.723530: Received error from KDC: -1765328378/Client not found in Kerberos database
[26882] 1481563654.723577: Retrying AS request with master KDC
[26882] 1481563654.723580: Getting initial credentials for dmsimard@FEDORAPROJECT.ORG
[26882] 1481563654.723617: Sending request (199 bytes) to FEDORAPROJECT.ORG (master)
kinit: Client 'dmsimard@FEDORAPROJECT.ORG' not found in Kerberos database while getting initial credentials

The one thing you can do is logging in to FAS (Fedora Account System) and this will hopefully synchronize your account with IPA. If you’re still unable to run kinit successfully after logging in to the web interface, you might be hitting a known problem when syncing to IPA.

In this case, you can come ask on IRC in #fedora-admin (freenode) where a friendly administrator will resolve the issue. You’ll need to log in to FAS once more, change your password and then kinit should work properly.

Go on your merry way

Once you’re authenticated against kerberos, you’ll be able to run koji and fedpkg commands like before.

More reading: