[rpms/freeipa] rawhide: Handle upgrades from wrong internal IPA data version

[Alexander Bokovoy <abokovoy@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/freeipa
            Branch : rawhide
            Commit : 57fff673bc8956ab9dd7d9350384b6d00b4aaddf
            Author : Alexander Bokovoy <abokovoy@redhat.com>
            Date   : 2026-08-21T07:21:53+03:00
            Stats  : +64/-4 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/freeipa/c/57fff673bc8956ab9dd7d9350384b6d00b4aaddf?branch=rawhide

            Log:
            Handle upgrades from wrong internal IPA data version

FreeIPA 4.12.5 was shipped in Fedora with a patchset collection on top
of 4.12.2 because upstream did not have a release for long time. The
base version was internally bumped in the spec to represent 4.12.5 as
that was what the code expected.

With 4.13.2 release the bump script wasn't removed and 4.13.2 builds in
Fedora releases think they are 4.13.5. This prevents upgrades.

Change upgrade logic:
  - if we are cross Fedora releases, always force upgrade (fc43 to f44, for
    example)

  - if we are on the same Fedora release, force upgrade if the data
    version claims it is 4.13.5.

At worst, it is one more data upgrade run.

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>

---
diff --git a/freeipa-version-upgrade-fedora-only.patch b/freeipa-version-upgrade-fedora-only.patch
new file mode 100644
index 0000000..2691df4
--- /dev/null
+++ b/freeipa-version-upgrade-fedora-only.patch
@@ -0,0 +1,59 @@
+From 3d52493ae13e85d5e151e4858b1877c542597c55 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Fri, 21 Aug 2026 06:50:59 +0300
+Subject: [PATCH] downstream: workaround upgrade issues
+
+FreeIPA 4.12.5 was shipped in Fedora with a patchset collection on top
+of 4.12.2 because upstream did not have a release for long time. The
+base version was internally bumped in the spec to represent 4.12.5.
+
+With 4.13.2 release the bump script wasn't removed and 4.13.2 builds in
+Fedora releases think they are 4.13.5. This prevents upgrades.
+
+Change upgrade logic:
+  - if we are cross Fedora releases, always force upgrade (fc43 to f44, for
+    example)
+
+  - if we are on the same Fedora release, force upgrade if the data
+    version claims it is 4.13.5.
+
+At worst, it is one more data upgrade run.
+
+Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
+---
+ ipaserver/install/installutils.py | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
+index 613cbc6ac..56b24ed9c 100644
+--- a/ipaserver/install/installutils.py
++++ b/ipaserver/install/installutils.py
+@@ -59,6 +59,7 @@ from ipaserver.install import certs, sysupgrade
+ from ipaplatform import services
+ from ipaplatform.paths import paths
+ from ipaplatform.tasks import tasks
++from ipaplatform.osinfo import osinfo
+ 
+ 
+ logger = logging.getLogger(__name__)
+@@ -1270,6 +1271,17 @@ def check_version():
+                 "version '%s')" % (version.VENDOR_VERSION, data_version)
+             )
+         elif parsed_data_ver > parsed_ipa_ver:
++            # Handle wrong numbering in 4.12.2...4.13.2 Fedora builds
++            if osinfo.id == 'fedora':
++                # '1.2.3-1.fcX'
++                distro = int(data_version.split('.')[-1][2:])
++                # if we are on newer Fedora release, upgrade
++                if osinfo.version_number[0] > distro:
++                    return
++                # 4.12.2+patches was represented as 4.12.5
++                # 4.13.2 was mistakenly marked as 4.13.5, force upgrade
++                if data_version.split('-')[0] == '4.13.5':
++                    return
+             raise UpgradeDataNewerVersionError(
+                 "data are in newer version than IPA (data version '%s', IPA "
+                 "version '%s')" % (data_version, version.VENDOR_VERSION)
+-- 
+2.55.0
+

diff --git a/freeipa.spec b/freeipa.spec
index de1e73b..f39c997 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -211,7 +211,7 @@
 
 Name:           %{package_name}
 Version:        %{IPA_VERSION}
-Release:        1%{?rc_version:.%rc_version}%{?dist}
+Release:        1.1%{?rc_version:.%rc_version}%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 License:        GPL-3.0-or-later
@@ -233,6 +233,7 @@ Source1:        https://codeberg.org/freeipa/freeipa/releases/download/release-%
 Source2:        gpgkey-4B7E7AFBB0AAA98947CA2427F17E2569BEE3800C.asc
 %endif
 
+Patch0:         freeipa-version-upgrade-fedora-only.patch
 # RHEL spec file only: START: Change branding to IPA and Identity Management
 # Moved branding logos and background to redhat-logos-ipa-80.4:
 # header-logo.png, login-screen-background.jpg, login-screen-logo.png,
@@ -1104,9 +1105,6 @@ export PATH=/usr/bin:/usr/sbin:$PATH
 
 export PYTHON=%{__python3}
 
-# Adjust minor release version because we actually applied all patches post 4.12.2
-sed -i 's@IPA_VERSION_RELEASE, 2@IPA_VERSION_RELEASE, 5@' VERSION.m4
-
 autoreconf -ivf
 %configure --with-vendor-suffix=-%{release} \
            %{enable_server_option} \
@@ -1972,6 +1970,9 @@ fi
 %endif
 
 %changelog
+* Fri Aug 21 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.3-1.1
+- Force upgrade for versions that falsely represent themselves as 4.13.5 (not existing yet)
+
 * Thu Aug 20 2026 Alexander Bokovoy <abokovoy@redhat.com> - 4.13.3-1
 - Upstream release 4.13.3
 - Resolves: CVE-2026-11861, CVE-2026-13097, CVE-2026-19550, CVE-2026-73199, CVE-2026-73198, CVE-2026-73197, CVE-2026-73196