mock inside of Docker
by Miroslav Suchý
Hi,
I am investigating
https://bugzilla.redhat.com/show_bug.cgi?id=1336750
and honestly I'm not sure what is the right solution.
Right now we use unshare() for CLONE_NEWNS, CLONE_NEWUTS, CLONE_NEWIPC.
I can detect if mock is running inside of container and then skip those unshare.
But... What if I am running there some application *and* mock. In the same container. That can be risky. However we can
just document it and let the user shoot into its own leg.
Or we can just document that you need to gave the containter privileges to run unshare().
Or we can just leave it as it is and do not support run inside of container.
Any thoughts?
--
Miroslav Suchy, RHCA
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
6 years, 7 months
New version of Mock (kind of)
by Miroslav Suchý
I just tagged new version in Mock.git. But I will not release it.
There are several changes:
* version bumped up to 1.3.1
* move /usr/sbin/mock to /usr/libexec/mock/mock [RHBZ#1246810]
This needs a lot of testing. On RHEL7 you will need to set SELinux to permissive (until RHEL 7.4 is out).
* F22 configs has been removed
* I set up Copr project:
https://copr.fedorainfracloud.org/coprs/g/mock/mock/
After each commit in devel branch, there will be git snapshot build.
* I removed the automake and it will use Tito now. If you are new to tito, then just:
sudo dnf install tito
tito build --rpm --test -i # install code from last commit
tito build --rpm # build latest tagged version
The benefits are that release process is now *much* easier. And there are no more build artefacts directly in git repo.
Those changes are huge. So I'm *not* going to push it to Fedora. Not even to rawhide. Please test it and report any issues.
--
Miroslav Suchy, RHCA
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
6 years, 8 months
New Mock release
by Miroslav Suchý
Hi,
I just released new version of Mock.
https://fedoraproject.org/wiki/Mock/1.2.19
Copy from the above url:
Mock version 1.2.19 has those changes:
* plugin Mock/Plugin/PackageState is now enabled by default and it
has new options. By default this plugin now generate list of installed
packages. List of available packages is disabled by default.
* Fedora 25 configs has been added
* GPG keys in configs are now used from package
``distribution-gpg-keys``. Keys in /etc/pki/mock will be still shipped
for some time, so we do not break old user config. But new one will not
be added and users are encouraged to migrate their paths to GPG keys.
* you can include some other config using:
include('/path/to/config/to/be/included/include.cfg')
* there is new option available which will install additional
package to minimal chroot. This is extension of already existing option
``chroot_setup_cmd``. It was added to easy automated changed of minimal
buildroot in Copr.:
config_opts['chroot_additional_packages'] = 'some_package other_package'
* And it resolves those bugs: RHBZ#1272381, RHBZ#1358397,
RHBZ#1362478, RHBZ#1277187, RHBZ#1298220, RHBZ#1264508.
And few notes about future release:
* in next release will be very likely resolved RHBZ#1246810. I.e.
/usr/sbin/mock will be moved to /usr/libexec/mock/mock. Since this is
very big change, next release will likely be 1.3.0
* Development and documentation will likely move to Github or
Pagure. Please follow buildsys mailing list.
--
Miroslav Suchy, RHCA
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
6 years, 8 months
Security release of Mock
by Miroslav Suchý
I released new version of Mock. It is security release. All users of mock-scm are encouraged to upgrade.
If you use just mock (not the scm subpackage) then you are not affected.
From:
https://github.com/rpm-software-management/mock/wiki/Release-Notes-1.2.21
Mock version 1.2.21 is security release. It fixes:
CVE-2016-6299 - privilige escalation via mock-scm RHBZ#1375493
Additionally it has those changes:
root_cache: Mention root cache being created in state updates (log messages)
Rename mageia pubkey to RPM-GPG-KEY-Mageia
require generic system-release rather than fedora-release RHBZ#1367746
--
Miroslav Suchy, RHCA
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
6 years, 8 months