On 04/02/2022 13:59, Stephen Smoogen wrote:

On Fri, 4 Feb 2022 at 04:03, lejeczek via CentOS-devel centos-devel@centos.org wrote:

Hi guys,

I did not rush with this but now after a week and some - does anybody
else sees it to?

With the fact that CentOS 8 is EOL and no longer on mirrors, I can not duplicate this. It looks like you have an idm module installed and it is needing things which the best bind in your repo does not have. Try the following:

dnf --nobest <whatever you were doing to install>

and see if that fixes it any. After that, I would suggest looking to move to an alternative distribution (in alphabetical order): Alma Linux Oracle Linux Red Hat Enterprise Linux Rocky Linux

or in reverse order Rocky Red Hat Enterprise Oracle Alma

For tracking newer features which will show up in the next major Red Hat Enterprise Linux CentOS Stream 8

This happens also on a "clean" box. (with centos-stream-release-8.6-1.el8.noarch centos-stream-repos-8-4.el8.noarch)

a)

-> $ dnf module enable idm:DL1

b)

-> $ dnf install ipa-server-dns Last metadata expiration check: 0:24:54 ago on Mon 07 Feb 2022 08:47:24 GMT. Dependencies resolved. =========================================================================================================  Package                   Arch Version                                      Repository      Size ========================================================================================================= Installing:  ipa-server-dns            noarch 4.9.8-2.module_el8.6.0+1053+0ac05726         appstream      192 k Installing dependencies:  bind                      x86_64 32:9.11.26-6.el8                             appstream      2.1 M  bind-dyndb-ldap           x86_64 11.6-2.module_el8.5.0+750+c59b186b           appstream      128 k  bind-pkcs11               x86_64 32:9.11.26-6.el8                             appstream      398 k  bind-pkcs11-libs          x86_64 32:9.11.26-6.el8                             appstream      1.1 M  bind-pkcs11-utils         x86_64 32:9.11.26-6.el8                             appstream      260 k  ldns                      x86_64 1.7.0-21.el8                                 appstream      166 k  opencryptoki              x86_64 3.17.0-3.el8                                 baseos         155 k  opencryptoki-icsftok      x86_64 3.17.0-3.el8                                 baseos         291 k  opencryptoki-libs         x86_64 3.17.0-3.el8                                 baseos          61 k  opendnssec                x86_64 2.1.7-1.module_el8.5.0+750+c59b186b          appstream      473 k Downgrading:  bind-libs                 x86_64 32:9.11.26-6.el8                             appstream      174 k  bind-libs-lite            x86_64 32:9.11.26-6.el8                             appstream      1.2 M  bind-license              noarch 32:9.11.26-6.el8                             appstream      102 k  bind-utils                x86_64 32:9.11.26-6.el8                             appstream      451 k  python3-bind              noarch 32:9.11.26-6.el8                             appstream      150 k

c)

-> $ dnf update Last metadata expiration check: 0:28:29 ago on Mon 07 Feb 2022 08:47:24 GMT. Error:  Problem 1: package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed   - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64   - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64   - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64   - cannot install the best update candidate for package bind-libs-lite-32:9.11.26-6.el8.x86_64   - cannot install the best update candidate for package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 ...

...

thanks, L.

On 04/02/2022 15:58, Johnny Hughes wrote:

On 2/4/22 03:02, lejeczek via CentOS-devel wrote:

...

Hi guys,

I did not rush with this but now after a week and some - does anybody else sees it to?

Last metadata expiration check: 0:03:21 ago on Fri 04 Feb 2022 08:57:59 GMT. Error:   Problem 1: package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64    - cannot install the best update candidate for package bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install the best update candidate for package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64   Problem 2: problem with installed package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64    - package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64    - package bind-32:9.11.36-2.el8.x86_64 requires libdns.so.1115()(64bit), but none of the providers can be installed    - package bind-32:9.11.36-2.el8.x86_64 requires bind-libs-lite(x86-64) = 32:9.11.36-2.el8, but none of the providers can be installed    - cannot install the best update candidate for package bind-32:9.11.26-6.el8.x86_64   Problem 3: package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch requires bind-dyndb-ldap >= 11.2-2, but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.4.0+639+a88aab78.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64    - package bind-libs-32:9.11.36-2.el8.x86_64 requires libdns.so.1115()(64bit), but none of the providers can be installed    - package bind-libs-32:9.11.36-2.el8.x86_64 requires bind-libs-lite(x86-64) = 32:9.11.36-2.el8, but none of the providers can be installed    - cannot install the best update candidate for package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch    - cannot install the best update candidate for package bind-libs-32:9.11.26-6.el8.x86_64   Problem 4: problem with installed package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch    - package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch requires bind-dyndb-ldap >= 11.2-2, but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.4.0+639+a88aab78.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - package bind-libs-lite-32:9.11.26-6.el8.x86_64 requires bind-license = 32:9.11.26-6.el8, but none of the providers can be installed    - package bind-libs-lite-32:9.11.26-3.el8.x86_64 requires bind-license = 32:9.11.26-3.el8, but none of the providers can be installed    - package bind-libs-lite-32:9.11.26-4.el8_4.x86_64 requires bind-license = 32:9.11.26-4.el8_4, but none of the providers can be installed    - cannot install both bind-license-32:9.11.36-2.el8.noarch and bind-license-32:9.11.26-6.el8.noarch    - cannot install both bind-license-32:9.11.36-2.el8.noarch and bind-license-32:9.11.26-3.el8.noarch    - cannot install both bind-license-32:9.11.36-2.el8.noarch and bind-license-32:9.11.26-4.el8_4.noarch    - cannot install the best update candidate for package bind-license-32:9.11.26-6.el8.noarch

many thanks, L

CentOS 8 Linux is EOL and no longer on the mirrors.

If you are using CentOS 8 Linux, youu need to replace it with CentOS 8 Stream, RHEL 8, or one of the RHEL 8 rebuilds.

I am not getting this issue on CentOS 8 Stream.

But it's not CentOS EOL - system was 'swapped' a while go. This is on/from CentOS Stream.

Something - module? - must have not "migrated" over to 'stream'. This must be easily reproducible - have IdM up & working (from 'idm' module) on non-stream then 'swap'.

thanks, L.

On ma, 07 helmi 2022, lejeczek via CentOS-devel wrote:

On 04/02/2022 15:58, Johnny Hughes wrote:

...

On 2/4/22 03:02, lejeczek via CentOS-devel wrote:

...

Hi guys,

I did not rush with this but now after a week and some - does anybody else sees it to?

Last metadata expiration check: 0:03:21 ago on Fri 04 Feb 2022 08:57:59 GMT. Error:   Problem 1: package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64    - cannot install the best update candidate for package bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install the best update candidate for package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64   Problem 2: problem with installed package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64    - package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64    - package bind-32:9.11.36-2.el8.x86_64 requires libdns.so.1115()(64bit), but none of the providers can be installed    - package bind-32:9.11.36-2.el8.x86_64 requires bind-libs-lite(x86-64) = 32:9.11.36-2.el8, but none of the providers can be installed    - cannot install the best update candidate for package bind-32:9.11.26-6.el8.x86_64   Problem 3: package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch requires bind-dyndb-ldap >= 11.2-2, but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.4.0+639+a88aab78.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-6.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-3.el8.x86_64    - cannot install both bind-libs-lite-32:9.11.36-2.el8.x86_64 and bind-libs-lite-32:9.11.26-4.el8_4.x86_64    - package bind-libs-32:9.11.36-2.el8.x86_64 requires libdns.so.1115()(64bit), but none of the providers can be installed    - package bind-libs-32:9.11.36-2.el8.x86_64 requires bind-libs-lite(x86-64) = 32:9.11.36-2.el8, but none of the providers can be installed    - cannot install the best update candidate for package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch    - cannot install the best update candidate for package bind-libs-32:9.11.26-6.el8.x86_64   Problem 4: problem with installed package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch    - package ipa-server-dns-4.9.8-2.module_el8.6.0+1053+0ac05726.noarch requires bind-dyndb-ldap >= 11.2-2, but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.5.0+750+c59b186b.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - package bind-dyndb-ldap-11.6-2.module_el8.4.0+639+a88aab78.x86_64 requires libdns.so.1112()(64bit), but none of the providers can be installed    - package bind-libs-lite-32:9.11.26-6.el8.x86_64 requires bind-license = 32:9.11.26-6.el8, but none of the providers can be installed    - package bind-libs-lite-32:9.11.26-3.el8.x86_64 requires bind-license = 32:9.11.26-3.el8, but none of the providers can be installed    - package bind-libs-lite-32:9.11.26-4.el8_4.x86_64 requires bind-license = 32:9.11.26-4.el8_4, but none of the providers can be installed    - cannot install both bind-license-32:9.11.36-2.el8.noarch and bind-license-32:9.11.26-6.el8.noarch    - cannot install both bind-license-32:9.11.36-2.el8.noarch and bind-license-32:9.11.26-3.el8.noarch    - cannot install both bind-license-32:9.11.36-2.el8.noarch and bind-license-32:9.11.26-4.el8_4.noarch    - cannot install the best update candidate for package bind-license-32:9.11.26-6.el8.noarch

many thanks, L

CentOS 8 Linux is EOL and no longer on the mirrors.

If you are using CentOS 8 Linux, youu need to replace it with CentOS 8 Stream, RHEL 8, or one of the RHEL 8 rebuilds.

I am not getting this issue on CentOS 8 Stream.

But it's not CentOS EOL - system was 'swapped' a while go. This is on/from CentOS Stream.

Something - module? - must have not "migrated" over to 'stream'. This must be easily reproducible - have IdM up & working (from 'idm' module) on non-stream then 'swap'.

This is one more sample of manual CentOS 8 Stream update mode, unfortunately. In December 2021 bind and bind-dyndb-ldap were rebuilt when bind bumped its ABI. Since bind-dyndb-ldap is in idm:DL1 module stream, it got combined with the whole idm:DL1 update. That update also included hardening for CVE-2021-25717 (Samba and Active Directory issue). Now that all updates for this CVE were shipped in RHEL z-streams, it can be pushed to CentOS 8 Stream. In fact, it could have been pushed for about two weeks now, together with bind update, but since these checks on 'CVE should be fixed in released RHEL first' are partially manual for CentOS 8 Stream, it was only noticed when bind update broke the stream.

I asked Carl to unblock us here. In CentOS 9 Stream this is automated and coordinated builds will be blocked together until all of them allowed.