These are both things for fedora 19. First the java-atk-wrapper dependency appears to come from something that changed in java-1.7.0-openjdk. When you upgrade to the latest version of the JDK, on starting tomcat, an exception is thrown because the server cannot find this dependency. After some searching, it seems like this dependency is somehow brought in when tomcat is initializing the web containers. Its not clear who is bringing this in. For now, we're just going to add it to the dependencies for pki-server. Hopefully, at some later point, we can remove it. Second, we have added a pretrans section that runs only on f19 onwards. This %pretrans checks for the existence of dogtag 9 style instances, and if present, prevents the upgrade. This is to prevent people from upgrading and then discovering that their dogtag 9 style instance have broken because tomcat 6 does not exist on f19. The workaround - if they want to upgrade in any case -- is to move the registry files associated with those instances. Then they would have to install tomcat 6 and the right version of tomcatjss. The scriptlet is written in lua so that it does not break fresh installs. Go lua! Please review, Ade