Currently some CI tests are executed twice. First, they run with Python 2. Then some files are copied/modified. Then the same tests run again with Python 3.

https://github.com/dogtagpki/pki/blob/92341c5be2cc631e5609049f8b16ed7c65058df4/.travis_run_task.sh#L71

 docker exec -i ${CONTAINER} ${SCRIPTDIR}/20-install-rpms
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/30-setup-389ds
 # Test whether pki subsystem works correctly
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/40-spawn-ca
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/50-spawn-kra
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/99-destroy
 # copy pki.server for Python 3
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/py3rewrite
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/30-setup-389ds
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/40-spawn-ca
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/50-spawn-kra
 docker exec -i ${CONTAINER} ${SCRIPTDIR}/99-destroy

Python 3 support is not actually required before Fedora 28. Also, there's already a separate IPA test that (possibly) runs with Python 3.

It would be better to test Python 3 with a platform that uses it by default, i.e. add CI test for Fedora 28, so the duplicate tests can be removed. The CI test should not need to modify the files provided by PKI packages.

Also, if PKI supports Python 3 on a specific platform, the PKI package for that platform should provide the proper Python 3 library files. The CI test should not need to copy the library files.