Koschei and arch_override
by Pavel Zhukov
Hello,
I've receive few emails builds 'Package started to fail in Fedora
rawhide' recently. The reason of this is koschei uses arch_override to 'x86_64 i686 aarch64 ppc64'
Example [1]. Documentation [2] says it can be changed but I don't see
such option in the UI.
I had to disable i686 builds due to bug in GCC and the fact it's not
primary architecture anymore .
How can I change arch_override per package if it's possible? Koschei
helps a lot with monitoring of FTBFS cases and I'd prefer to keep it enabled...
[1] https://koji.fedoraproject.org/koji/taskinfo?taskID=20586803
[2] https://fedoraproject.org/wiki/Koschei#Setting_arch_override
--
PAVEL ZHUKOV
pzhukov(a)redhat.com IM: IRC: landgraf
6 years, 10 months
kernel 4.13 rawhide
by Dominik Kucher
If i try to update my rawhide test engine i get a gpg key error at
kernel 4.13
"Importing the key has not helped, wrong key?"
=====================================================================================================================================================================================================
Package Arch Version Paketquelle Größe
=====================================================================================================================================================================================================
Installieren:
kernel i686 4.13.0-0.rc1.git1.1.fc27 rawhide 65 k
kernel-core i686 4.13.0-0.rc1.git1.1.fc27 rawhide 21 M
kernel-modules i686 4.13.0-0.rc1.git1.1.fc27 rawhide 23 M
Entfernen:
kernel i686 4.10.0-0.rc4.git1.1.fc26 @rawhide 0
kernel-core i686 4.10.0-0.rc4.git1.1.fc26 @rawhide 52 M
kernel-modules i686 4.10.0-0.rc4.git1.1.fc26 @rawhide 21 M
kernel-modules-extra i686 4.10.0-0.rc4.git1.1.fc26 @rawhide 2.1 M
Transaktionsübersicht
=====================================================================================================================================================================================================
Installieren 3 Pakete
Entfernen 4 Pakete
Gesamtgröße: 44 M
Pakete werden heruntergeladen:
[SKIPPED] kernel-core-4.13.0-0.rc1.git1.1.fc27.i686.rpm: Already downloaded
[SKIPPED] kernel-4.13.0-0.rc1.git1.1.fc27.i686.rpm: Already downloaded
[SKIPPED] kernel-modules-4.13.0-0.rc1.git1.1.fc27.i686.rpm: Already
downloaded
Warnung:
/var/cache/dnf/rawhide-6cb74b5c20b9e175/packages/kernel-core-4.13.0-0.rc1.git1.1.fc27.i686.rpm:
Header V3 RSA/SHA256 Signature, Schlüssel-ID f5282ee4: NOKEY
Importing GPG key 0x64DAB85D:
Userid : "Fedora 26 Primary (26) <fedora-26-primary(a)fedoraproject.org>"
Fingerprint: E641 850B 77DF 4353 78D1 D7E2 812A 6B4B 64DA B85D
From : /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-26-i386
Schlüssel erfolgreich importiert
Importieren der Schlüssel hat nicht geholfen, falsche Schlüssel?
Fehler:
Öffentlicher Schlüssel für kernel-core-4.13.0-0.rc1.git1.1.fc27.i686.rpm
ist nicht installiertFehlgeschlagenes Paket ist:
kernel-core-4.13.0-0.rc1.git1.1.fc27.i686
GPG-Schlüssel sind eingerichtet als:
file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-26-i386
--
Dominik Kucher
A-2130 Mistelbach, Ebendorferstraße 7/2/3
p: +43 (0) 720 511 941
f: +43 (0) 1 34242 289967
m: +43 (0) 676 57 68 677
6 years, 10 months
fedpkg new-sources broken?
by Ralf Corsepius
Hi,
I seem to be unable to upload a new tarball for freefem++:
$ fedpkg new-sources freefem++-3.56.tar.gz
/usr/lib/python2.7/site-packages/fedora/client/bodhi.py:48:
DeprecationWarning: fedora.client.bodhi has been deprecated. Please use
bodhi.client.bindings instead.
DeprecationWarning)
Uploading: freefem++-3.56.tar.gz
########################################################################
100.0%
Could not execute new_sources: Fail to upload files. Server returns
status 502
Any ideas about what is going on here?
Ralf
6 years, 10 months
Fedora Rawhide-20170719.n.0 compose check report
by Fedora compose checker
Missing expected images:
Workstation live i386
Server boot i386
Kde live i386
Failed openQA tests: 14/126 (x86_64), 2/18 (i386), 1/2 (arm)
New failures (same test did not fail in Rawhide-20170718.n.0):
ID: 122712 Test: x86_64 Workstation-live-iso base_service_manipulation
URL: https://openqa.fedoraproject.org/tests/122712
ID: 122719 Test: x86_64 Workstation-live-iso desktop_notifications_postinstall
URL: https://openqa.fedoraproject.org/tests/122719
ID: 122809 Test: x86_64 universal install_kickstart_firewall_disabled
URL: https://openqa.fedoraproject.org/tests/122809
ID: 122822 Test: i386 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/122822
Old failures (same test failed in Rawhide-20170718.n.0):
ID: 122696 Test: x86_64 Server-dvd-iso server_role_deploy_domain_controller
URL: https://openqa.fedoraproject.org/tests/122696
ID: 122698 Test: x86_64 Server-dvd-iso server_cockpit_default
URL: https://openqa.fedoraproject.org/tests/122698
ID: 122718 Test: x86_64 Workstation-live-iso desktop_notifications_live
URL: https://openqa.fedoraproject.org/tests/122718
ID: 122724 Test: x86_64 KDE-live-iso install_default_upload
URL: https://openqa.fedoraproject.org/tests/122724
ID: 122726 Test: x86_64 KDE-live-iso install_no_user
URL: https://openqa.fedoraproject.org/tests/122726
ID: 122737 Test: arm Minimal-raw_xz-raw.xz install_arm_image_deployment_upload
URL: https://openqa.fedoraproject.org/tests/122737
ID: 122763 Test: x86_64 universal install_rescue_encrypted
URL: https://openqa.fedoraproject.org/tests/122763
ID: 122792 Test: x86_64 universal upgrade_desktop_64bit
URL: https://openqa.fedoraproject.org/tests/122792
ID: 122794 Test: x86_64 universal upgrade_server_domain_controller
URL: https://openqa.fedoraproject.org/tests/122794
ID: 122795 Test: x86_64 universal upgrade_realmd_client
URL: https://openqa.fedoraproject.org/tests/122795
ID: 122797 Test: x86_64 universal upgrade_desktop_encrypted_64bit
URL: https://openqa.fedoraproject.org/tests/122797
ID: 122810 Test: x86_64 universal install_rescue_encrypted@uefi
URL: https://openqa.fedoraproject.org/tests/122810
ID: 122815 Test: i386 universal upgrade_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/122815
Soft failed openQA tests: 66/126 (x86_64), 12/18 (i386)
(Tests completed, but using a workaround for a known bug)
New soft failures (same test did not soft fail in Rawhide-20170718.n.0):
ID: 122694 Test: x86_64 Server-dvd-iso install_repository_nfs_variation
URL: https://openqa.fedoraproject.org/tests/122694
ID: 122695 Test: x86_64 Server-dvd-iso install_repository_nfs_graphical
URL: https://openqa.fedoraproject.org/tests/122695
ID: 122703 Test: x86_64 Server-dvd-iso install_updates_nfs
URL: https://openqa.fedoraproject.org/tests/122703
ID: 122709 Test: x86_64 Workstation-live-iso install_no_user
URL: https://openqa.fedoraproject.org/tests/122709
ID: 122747 Test: x86_64 universal install_kickstart_user_creation
URL: https://openqa.fedoraproject.org/tests/122747
ID: 122764 Test: x86_64 universal install_iscsi
URL: https://openqa.fedoraproject.org/tests/122764
ID: 122769 Test: x86_64 universal install_kickstart_nfs
URL: https://openqa.fedoraproject.org/tests/122769
ID: 122771 Test: x86_64 universal install_blivet_software_raid
URL: https://openqa.fedoraproject.org/tests/122771
ID: 122782 Test: x86_64 universal install_multi_empty@uefi
URL: https://openqa.fedoraproject.org/tests/122782
ID: 122785 Test: x86_64 universal install_btrfs@uefi
URL: https://openqa.fedoraproject.org/tests/122785
ID: 122798 Test: x86_64 universal upgrade_2_minimal_64bit
URL: https://openqa.fedoraproject.org/tests/122798
ID: 122800 Test: x86_64 universal upgrade_2_server_64bit
URL: https://openqa.fedoraproject.org/tests/122800
ID: 122812 Test: i386 universal install_blivet_xfs
URL: https://openqa.fedoraproject.org/tests/122812
ID: 122823 Test: i386 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/122823
Old soft failures (same test soft failed in Rawhide-20170718.n.0):
ID: 122682 Test: x86_64 Server-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/122682
ID: 122683 Test: x86_64 Server-boot-iso install_default@uefi
URL: https://openqa.fedoraproject.org/tests/122683
ID: 122684 Test: x86_64 Server-dvd-iso install_default_upload
URL: https://openqa.fedoraproject.org/tests/122684
ID: 122685 Test: x86_64 Server-dvd-iso install_default@uefi
URL: https://openqa.fedoraproject.org/tests/122685
ID: 122704 Test: i386 Server-dvd-iso install_default
URL: https://openqa.fedoraproject.org/tests/122704
ID: 122705 Test: x86_64 Everything-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/122705
ID: 122706 Test: x86_64 Everything-boot-iso install_default@uefi
URL: https://openqa.fedoraproject.org/tests/122706
ID: 122740 Test: x86_64 universal install_repository_http_variation
URL: https://openqa.fedoraproject.org/tests/122740
ID: 122741 Test: x86_64 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/122741
ID: 122742 Test: x86_64 universal install_mirrorlist_graphical
URL: https://openqa.fedoraproject.org/tests/122742
ID: 122743 Test: x86_64 universal install_delete_pata
URL: https://openqa.fedoraproject.org/tests/122743
ID: 122744 Test: x86_64 universal install_delete_pata@uefi
URL: https://openqa.fedoraproject.org/tests/122744
ID: 122745 Test: x86_64 universal install_sata
URL: https://openqa.fedoraproject.org/tests/122745
ID: 122746 Test: x86_64 universal install_sata@uefi
URL: https://openqa.fedoraproject.org/tests/122746
ID: 122748 Test: x86_64 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/122748
ID: 122749 Test: x86_64 universal install_multi
URL: https://openqa.fedoraproject.org/tests/122749
ID: 122750 Test: x86_64 universal install_multi@uefi
URL: https://openqa.fedoraproject.org/tests/122750
ID: 122751 Test: x86_64 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/122751
ID: 122752 Test: x86_64 universal install_simple_free_space
URL: https://openqa.fedoraproject.org/tests/122752
ID: 122753 Test: x86_64 universal install_multi_empty
URL: https://openqa.fedoraproject.org/tests/122753
ID: 122754 Test: x86_64 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/122754
ID: 122755 Test: x86_64 universal install_delete_partial
URL: https://openqa.fedoraproject.org/tests/122755
ID: 122756 Test: x86_64 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/122756
ID: 122757 Test: x86_64 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/122757
ID: 122758 Test: x86_64 universal install_xfs
URL: https://openqa.fedoraproject.org/tests/122758
ID: 122759 Test: x86_64 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/122759
ID: 122760 Test: x86_64 universal install_no_swap
URL: https://openqa.fedoraproject.org/tests/122760
ID: 122761 Test: x86_64 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/122761
ID: 122762 Test: x86_64 universal install_anaconda_text
URL: https://openqa.fedoraproject.org/tests/122762
ID: 122766 Test: x86_64 universal install_blivet_btrfs
URL: https://openqa.fedoraproject.org/tests/122766
ID: 122767 Test: x86_64 universal install_blivet_no_swap
URL: https://openqa.fedoraproject.org/tests/122767
ID: 122768 Test: x86_64 universal install_kickstart_firewall_configured
URL: https://openqa.fedoraproject.org/tests/122768
ID: 122770 Test: x86_64 universal install_blivet_xfs
URL: https://openqa.fedoraproject.org/tests/122770
ID: 122772 Test: x86_64 universal install_blivet_lvmthin
URL: https://openqa.fedoraproject.org/tests/122772
ID: 122773 Test: x86_64 universal install_blivet_ext3@uefi
URL: https://openqa.fedoraproject.org/tests/122773
ID: 122774 Test: x86_64 universal install_blivet_btrfs@uefi
URL: https://openqa.fedoraproject.org/tests/122774
ID: 122775 Test: x86_64 universal install_blivet_no_swap@uefi
URL: https://openqa.fedoraproject.org/tests/122775
ID: 122776 Test: x86_64 universal install_blivet_xfs@uefi
URL: https://openqa.fedoraproject.org/tests/122776
ID: 122777 Test: x86_64 universal install_blivet_software_raid@uefi
URL: https://openqa.fedoraproject.org/tests/122777
ID: 122778 Test: x86_64 universal install_blivet_lvmthin@uefi
URL: https://openqa.fedoraproject.org/tests/122778
ID: 122780 Test: x86_64 universal install_simple_encrypted@uefi
URL: https://openqa.fedoraproject.org/tests/122780
ID: 122781 Test: x86_64 universal install_simple_free_space@uefi
URL: https://openqa.fedoraproject.org/tests/122781
ID: 122783 Test: x86_64 universal install_software_raid@uefi
URL: https://openqa.fedoraproject.org/tests/122783
ID: 122786 Test: x86_64 universal install_ext3@uefi
URL: https://openqa.fedoraproject.org/tests/122786
ID: 122787 Test: x86_64 universal install_xfs@uefi
URL: https://openqa.fedoraproject.org/tests/122787
ID: 122788 Test: x86_64 universal install_lvmthin@uefi
URL: https://openqa.fedoraproject.org/tests/122788
ID: 122789 Test: x86_64 universal install_no_swap@uefi
URL: https://openqa.fedoraproject.org/tests/122789
ID: 122790 Test: x86_64 universal install_kickstart_hdd
URL: https://openqa.fedoraproject.org/tests/122790
ID: 122791 Test: x86_64 universal upgrade_minimal_64bit
URL: https://openqa.fedoraproject.org/tests/122791
ID: 122793 Test: x86_64 universal upgrade_server_64bit
URL: https://openqa.fedoraproject.org/tests/122793
ID: 122803 Test: x86_64 universal install_updates_img_local
URL: https://openqa.fedoraproject.org/tests/122803
ID: 122804 Test: x86_64 universal install_shrink_ext4
URL: https://openqa.fedoraproject.org/tests/122804
ID: 122805 Test: x86_64 universal install_shrink_ntfs
URL: https://openqa.fedoraproject.org/tests/122805
ID: 122808 Test: x86_64 universal install_asian_language
URL: https://openqa.fedoraproject.org/tests/122808
ID: 122811 Test: i386 universal install_blivet_no_swap
URL: https://openqa.fedoraproject.org/tests/122811
ID: 122813 Test: i386 universal install_blivet_software_raid
URL: https://openqa.fedoraproject.org/tests/122813
ID: 122814 Test: i386 universal install_blivet_lvmthin
URL: https://openqa.fedoraproject.org/tests/122814
ID: 122818 Test: i386 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/122818
ID: 122819 Test: i386 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/122819
ID: 122820 Test: i386 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/122820
ID: 122821 Test: i386 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/122821
ID: 122825 Test: i386 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/122825
ID: 122827 Test: i386 universal install_blivet_btrfs
URL: https://openqa.fedoraproject.org/tests/122827
ID: 122830 Test: x86_64 universal install_delete_partial@uefi
URL: https://openqa.fedoraproject.org/tests/122830
Passed openQA tests: 33/126 (x86_64), 4/18 (i386)
New passes (same test did not pass in Rawhide-20170718.n.0):
ID: 122693 Test: x86_64 Server-dvd-iso support_server
URL: https://openqa.fedoraproject.org/tests/122693
ID: 122707 Test: x86_64 Workstation-live-iso install_default_upload
URL: https://openqa.fedoraproject.org/tests/122707
ID: 122710 Test: x86_64 Workstation-live-iso base_selinux
URL: https://openqa.fedoraproject.org/tests/122710
ID: 122711 Test: x86_64 Workstation-live-iso base_services_start
URL: https://openqa.fedoraproject.org/tests/122711
ID: 122713 Test: x86_64 Workstation-live-iso base_update_cli
URL: https://openqa.fedoraproject.org/tests/122713
ID: 122714 Test: x86_64 Workstation-live-iso base_system_logging
URL: https://openqa.fedoraproject.org/tests/122714
ID: 122715 Test: x86_64 Workstation-live-iso desktop_update_graphical
URL: https://openqa.fedoraproject.org/tests/122715
ID: 122716 Test: x86_64 Workstation-live-iso desktop_terminal
URL: https://openqa.fedoraproject.org/tests/122716
ID: 122717 Test: x86_64 Workstation-live-iso desktop_browser
URL: https://openqa.fedoraproject.org/tests/122717
ID: 122739 Test: x86_64 universal support_server
URL: https://openqa.fedoraproject.org/tests/122739
ID: 122765 Test: x86_64 universal install_blivet_ext3
URL: https://openqa.fedoraproject.org/tests/122765
ID: 122799 Test: x86_64 universal upgrade_2_desktop_64bit
URL: https://openqa.fedoraproject.org/tests/122799
ID: 122801 Test: x86_64 universal upgrade_2_kde_64bit
URL: https://openqa.fedoraproject.org/tests/122801
ID: 122802 Test: x86_64 universal upgrade_2_desktop_encrypted_64bit
URL: https://openqa.fedoraproject.org/tests/122802
ID: 122816 Test: i386 universal upgrade_2_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/122816
ID: 122824 Test: i386 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/122824
ID: 122826 Test: i386 universal install_blivet_ext3
URL: https://openqa.fedoraproject.org/tests/122826
Skipped openQA tests: 12 of 146
Installed system changes in test x86_64 Server-boot-iso install_default:
System load changed from 0.04 to 0.16
Previous test data: https://openqa.fedoraproject.org/tests/121432#downloads
Current test data: https://openqa.fedoraproject.org/tests/122682#downloads
Installed system changes in test x86_64 Server-dvd-iso install_default_upload:
System load changed from 0.07 to 0.22
Used mem changed from 150 MiB to 186 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121434#downloads
Current test data: https://openqa.fedoraproject.org/tests/122684#downloads
Installed system changes in test x86_64 Server-dvd-iso install_default@uefi:
Used mem changed from 148 MiB to 186 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121435#downloads
Current test data: https://openqa.fedoraproject.org/tests/122685#downloads
Installed system changes in test i386 Server-dvd-iso install_default:
System load changed from 0.02 to 0.28
Used mem changed from 100 MiB to 120 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121454#downloads
Current test data: https://openqa.fedoraproject.org/tests/122704#downloads
Installed system changes in test x86_64 Workstation-live-iso install_default@uefi:
84 packages(s) added since previous compose: SDL2, celt051, corosync, corosynclib, cyrus-sasl, dmidecode, edk2-ovmf, genisoimage, glusterfs, glusterfs-api...
1 services(s) added since previous compose: libvirtd.service
Previous test data: https://openqa.fedoraproject.org/tests/121458#downloads
Current test data: https://openqa.fedoraproject.org/tests/122708#downloads
Installed system changes in test x86_64 Workstation-boot-iso install_default:
1 packages(s) added since previous compose: perl-interpreter
1 packages(s) removed since previous compose: perl
Previous test data: https://openqa.fedoraproject.org/tests/121470#downloads
Current test data: https://openqa.fedoraproject.org/tests/122720#downloads
Installed system changes in test x86_64 Workstation-boot-iso install_default@uefi:
1 packages(s) added since previous compose: perl-interpreter
1 packages(s) removed since previous compose: perl
Previous test data: https://openqa.fedoraproject.org/tests/121473#downloads
Current test data: https://openqa.fedoraproject.org/tests/122723#downloads
Installed system changes in test x86_64 universal install_package_set_minimal:
Used mem changed from 125 MiB to 160 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121511#downloads
Current test data: https://openqa.fedoraproject.org/tests/122761#downloads
Installed system changes in test x86_64 universal install_package_set_kde:
2 packages(s) added since previous compose: BDB2053 Freeing read locks for locker 0x1: 1793/140026978621696, BDB2053 Freeing read locks for locker 0x3: 1793/140026978621696
2 packages(s) removed since previous compose: BDB2053 Freeing read locks for locker 0x1: 1802/140638827084032, BDB2053 Freeing read locks for locker 0x3: 1802/140638827084032
Used mem changed from 503 MiB to 562 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121529#downloads
Current test data: https://openqa.fedoraproject.org/tests/122779#downloads
Installed system changes in test i386 universal install_package_set_kde:
2 packages(s) added since previous compose: BDB2053 Freeing read locks for locker 0x1: 1839/3075134976, BDB2053 Freeing read locks for locker 0x3: 1839/3075134976
2 packages(s) removed since previous compose: BDB2053 Freeing read locks for locker 0x1: 1821/3075913216, BDB2053 Freeing read locks for locker 0x3: 1821/3075913216
Previous test data: https://openqa.fedoraproject.org/tests/121567#downloads
Current test data: https://openqa.fedoraproject.org/tests/122817#downloads
Installed system changes in test i386 universal install_package_set_minimal:
System load changed from 0.04 to 0.16
Used mem changed from 82 MiB to 102 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121568#downloads
Current test data: https://openqa.fedoraproject.org/tests/122818#downloads
Installed system changes in test x86_64 KDE-live-iso install_default@uefi:
2 packages(s) added since previous compose: BDB2053 Freeing read locks for locker 0x1: 1640/140475187714304, BDB2053 Freeing read locks for locker 0x3: 1640/140475187714304
2 packages(s) removed since previous compose: BDB2053 Freeing read locks for locker 0x1: 1632/139904254642432, BDB2053 Freeing read locks for locker 0x3: 1632/139904254642432
System load changed from 0.64 to 1.07
Used mem changed from 471 MiB to 530 MiB
Previous test data: https://openqa.fedoraproject.org/tests/121578#downloads
Current test data: https://openqa.fedoraproject.org/tests/122829#downloads
x86_64 Workstation-boot-iso memory_check peak memory: 674MiB (117% of previous compose peak)
x86_64 Workstation-boot-iso memory_check@uefi peak memory: 679MiB (118% of previous compose peak)
--
Mail generated by check-compose:
https://pagure.io/fedora-qa/check-compose
6 years, 10 months
openQA brief outage
by Adam Williamson
Hey folks! Heads up: there is a brief openQA outage at present while I
upgrade the production instance to Fedora 26. Staging was already
upgraded last week, so there shouldn't be any big problems. Thanks!
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net
6 years, 10 months
F27 Self Contained Change: New default cipher in OpenVPN
by Jaroslav Reznik
= Proposed Self Contained Change: New default cipher in OpenVPN =
https://fedoraproject.org/wiki/Changes/New_default_cipher_in_OpenVPN
Change owner(s):
* David Sommerseth <davids(a)openvpn.net>
Since the discovery of the SWEET32 flaw [1], ciphers using
cipher-blocks smaller than 128-bits are considered vulnerable and
should not be used any more. OpenVPN uses Blowfish (BF-128-CBC) as the
default cipher, which is hit by the SWEET32 flaw. This proposal
changes the default cipher to AES-256-GCM while in parallel allowing
clients to connect using AES-256-CBC, AES-128-CBC or the deprecated
BF-CBC,
This proposal will make use of that possibility by modifying the
openvpn-server@.service unit file slightly.
== Detailed Description ==
There have been two independent security audits of OpenVPN recently,
performed by QuarksLab SAS [2] and Cryptography Engineering [3]. Both
recommends moving away from the default Blowfish cipher (BF/BF-CBC) to
a stronger cipher.
The concept is fairly simple. In today's openvpn-server@.service
systemd unit file the following command line is used to start OpenVPN:
ExecStart=/usr/sbin/openvpn --status
%t/openvpn-server/status-%i.log --status-version 2
--suppress-timestamps --config %i.conf
By adding --cipher AES-256-GCM --ncp-ciphers
AES-256-GCM:AES-256-CBC:AES-128-GCM:AES-128-CBC:BF-CBC before the
--config option, the default cipher will be modified. The
--ncp-ciphers list allows clients to use any of the listed ciphers as
well. The new line will look like this:
ExecStart=/usr/sbin/openvpn --status
%t/openvpn-server/status-%i.log --status-version 2
--suppress-timestamps --cipher AES-256-GCM --ncp-ciphers
AES-256-GCM:AES-256-CBC:AES-128-GCM:AES-128-CBC:BF-CBC --config
%i.conf
This will result in the following:
* OpenVPN 2.4 based clients will automatically upgrade to AES-256-GCM,
regardless if they have --cipher in their configuration file or not.
For OpenVPN v2.4 configurations not wanting this cipher upgrade, the
client configuration needs to deploy --ncp-disable.
* OpenVPN 2.3 based clients and older (and v2.4 clients using
--ncp-disable in the client configuration) can connect to the server
using any of the --ncp-ciphers list; this is what is called "poor
man's cipher negotiation" by the upstream OpenVPN developers.
* Any client not providing --cipher defaults to BF-CBC. These clients
should still be able to connect to the server as the server allows
BF-CBC through --ncp-ciphers.
If an already configured OpenVPN v2.4 based server configuration
deploys --cipher and/or --ncp-ciphers, the options in the
configuration file will override command line options set before
--config. This should not break any existing configuration.
The log files will still complain about the use of BF-CBC if a client
uses that. But the advantage is that OpenVPN v2.3 and older clients
can be updated one-by-one, by adding the recommended --cipher
AES-256-CBC option in the client configurations in their own pace,
independent of the server - or upgrade to OpenVPN v2.4 or newer.
== Scope ==
* Proposal owners: Patch the openvpn-server@.service unit file which
adds the --cipher and --ncp-ciphers options.
* Other developers: N/A (not a System Wide Change)
* Release engineering: [4] (a check of an impact with Release
Engineering is needed)
* List of deliverables: N/A (not a System Wide Change)
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
[1] https://sweet32.info/
[2] https://ostif.org/wp-content/uploads/2017/05/OpenVPN1.2final.pdf
[3] https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-evaluation...
[4] https://pagure.io/releng/issue/6908
Jaroslav
6 years, 10 months