From 6ddd9d978ac1d70acf688667515f916ee4373c42 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Tue, 6 Jan 2026 14:16:23 +0100 Subject: [PATCH] Upgrade: use openssl_engine on rhel9 The upgrade on RHEL9 needs to update /etc/sysconfig/ipa-dnskeysyncd with DNSSEC_TOKENS_DIR and DNSSEC_SOFTHSM_PIN because those environment variables are used by the systemd unit for ipa-dnskeysyncd. Currently the upgrade skips this step because of a wrong comparison when defining the constants: HAS_PKCS11_OPENSSL_ENGINE = osinfo.version_number == (9,) The above evaluates to false because osinfo.version_number is a tuple with (9, minor_version). Replace the comparison with osinfo.version_number[0] == 9 to make sure that the upgrade code is properly called on RHEL 9.x Fixes: https://pagure.io/freeipa/issue/9913 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Rob Crittenden --- ipaplatform/rhel/constants.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipaplatform/rhel/constants.py b/ipaplatform/rhel/constants.py index f4b503521..0f6be6171 100644 --- a/ipaplatform/rhel/constants.py +++ b/ipaplatform/rhel/constants.py @@ -18,7 +18,7 @@ from ipaplatform.osinfo import osinfo # RHEL 8 uses /etc/nfs.conf HAS_NFS_CONF = osinfo.version_number >= (8,) # RHEL 9 uses pkcs11 as openssl engine -HAS_PKCS11_OPENSSL_ENGINE = osinfo.version_number == (9,) +HAS_PKCS11_OPENSSL_ENGINE = osinfo.version_number[0] == 9 # RHEL 10 and later deprecated OpenSSL engine and recommend using OpenSSL # provider API.