Bodhi critpath package updates now gated on openQA results
by Adam Williamson
Hey folks!
Just wanted to flag up that, now the new Bodhi version has been
deployed to production, critpath updates are gated on openQA test
results. If any openQA test for your critpath update failed, the gating
status will be marked as 'failed' and you will not be able to push it
stable.
Waivers can be issued for failed tests where appropriate:
https://docs.fedoraproject.org/en-US/ci/gating/#_waive
But in almost all cases a failure indicates either a genuine bug or an
opportunity to improve the test, so I'd prefer to avoid use of waivers
where possible. I am trying to keep an eye on all failed tests, but if
you have a blocked update and you don't understand the failure and I
haven't yet commented on it, please do poke me and I'll take a look.
If a failure looks like some kind of transient issue, several folks
have the power to rerun tests: myself, lruzicka, kparal, tflink,
abokovoy (abbra / ab), pwhalen, and sumantrom. You can ask one of us to
do it. There have been plans in the past to implement some sort of
rerun request system in Bodhi but no-one's quite had the roundtuits to
work it out yet; sorry about that.
Thanks everyone, please be patient with any kinks while we see how this
goes :)
--
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net
2 years, 5 months
deltarpm usefulness?
by Marek Marczykowski-Górecki
Hi all,
I think deltarpm is not really useful anymore:
- there are very few drpm files in the repository, see for example:
https://download.fedoraproject.org/pub/fedora/linux/updates/34/Everything...
https://download.fedoraproject.org/pub/fedora/linux/updates/33/Everything...
- those that actually are there, are mostly about small packages anyway
- personally, I haven't seen it being used for a long time
- there is also argument that people's connection bandwidth nowadays
tends to be fast enough to make the package rebuilding actually
slower than downloading the whole package (but that really vary between
different installations)
- and most importantly: drpm files are - by design - processed before
checking the package signature, which exposes rather big attack
surface(*)
Can deltarpm be disabled by default? In the few cases where it's
actually useful (if there are any...), user is free to enable it, but
the default would be significantly more secure this way.
(*) it is integrity protected via a hash in the repository metadata, but
repository metadata in Fedora are still not signed - so this all heavily
depends on the integrity of the [HTTPS connection to]
mirrors.fedoraproject.org server (or any of CAs trusted by the system) -
a rather fragile single point of failure.
--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
2 years, 5 months
openbabel-3.1* in Rawhide
by Antonio T. sagitter
Hi all.
openbabel-3.1.1 is ready for Rawhide branch. 'libopenbabel' soname is
updated from 5 to 7, all dependent packages will need a rebuild at least:
$ repoquery --whatrequires openbabel-devel --disablerepo=*
--enablerepo=*-source
IQmol-0:2.15.0-3.fc34.src
ghemical-0:3.0.0-16.fc34.src
molsketch-0:0.7.2-1.fc34.src
xdrawchem-0:1.10.2-4.fc34.src
I'm waiting some days (one week around) before creating a side-tag.
Ragards.
--
---
Antonio Trande
Fedora Project
mailto: sagitter(a)fedoraproject.org
GPG key: 0x29FBC85D7A51CC2F
GPG key server: https://keyserver1.pgp.com/
2 years, 5 months
Strange mock chainbuild issue: package has incorrect checksum
by Julian Sikorski
Hi,
my local kernel rebuilds have started failing for no apparent reason - I
was using a similar command successfully for several months.
/mnt/openmediavault is a samba share. This is what gets output into the log:
$ mock --chain --localrepo /mnt/openmediavault/kernel/ -r
fedora-34-x86_64 --disable-plugin=tmpfs --enable-plugin=yum_cache
--isolation=simple ../pesign/pesign-113-16.fc35.src.rpm
redhat/rpm/SRPMS/kernel-5.14.6-300.s0ix02.fc34.src.rpm --with baseonly
--without debuginfo --define='pe_signing_token NSS Certificate DB'
--define='pe_signing_cert Julians Secure Boot signing key - Julian Sikorski'
...
Error calculating checksum
/mnt/openmediavault/kernel/results/fedora-34-x86_64/pesign-113-16.fc35/pesign-113-16.fc34.x86_64.rpm:
(39, fsync failed: Permission denied)
Package "pesign-113-16.fc34.x86_64" from local repository
"local_build_repo" has incorrect checksum
Error: Some packages from local repository have incorrect checksum
ERROR: Exception(redhat/rpm/SRPMS/kernel-5.14.6-300.s0ix02.fc34.src.rpm)
Config(fedora-34-x86_64) 0 minutes 7 seconds
INFO: Results and/or logs in:
/mnt/openmediavault/kernel/results/fedora-34-x86_64/kernel-5.14.6-300.s0ix02.fc34
ERROR: Command failed:
# /usr/bin/dnf builddep --installroot
/var/lib/mock/fedora-34-x86_64/root/ --releasever 34
--setopt=deltarpm=False --allowerasing --disableplugin=local
--disableplugin=spacewalk --disableplugin=versionlock
--disableplugin=local --disableplugin=spacewalk
--disableplugin=versionlock
/var/lib/mock/fedora-34-x86_64/root//builddir/build/SRPMS/kernel-5.14.6-300.s0ix02.fc34.src.rpm
--setopt=tsflags=nocontexts
Any ideas what is going on in here? Thanks!
Best regards,
Julian
2 years, 5 months
Fedora 32 System-Wide Change proposal: iptables-nft-default
by Ben Cotton
https://fedoraproject.org/wiki/Changes/iptables-nft-default
== Summary ==
Make iptables-nft the preferred iptables variant.
== Owner ==
* Name: [[User:psutter| Phil Sutter]]
* Email: psutter(a)redhat.com
== Detailed Description ==
<code>iptables-nft</code> package provides alternative implementations of
iptables, ip6tables, ebtables and arptables and associated save and restore
commands. These use nftables internally while providing the same look'n'feel as
the original tools. Users may choose between both implementations using
<code>alternatives</code> tool.
Upstream considers the traditional implementations legacy and therefore renamed
the binaries adding '-legacy' suffix. In Fedora, same has been done to
<code>arptables</code> and <code>ebtables</code> packages, namely renaming them
to <code>arptables-legacy</code> and <code>ebtables-legacy</code>. Legacy
<code>iptables</code> and <code>ip6tables</code> remain in
<code>iptables</code> package, which in fact is the only one other packages
depend upon.
To change the status quo, two measures are planned:
=== Raise priority of nft-variants in <code>alternatives</code> ===
Currently, legacy variants are installed with priority 10 and nft
variants with priority 5. This must be changed as otherwise installing
<code>iptables-legacy</code> in a system with
<code>iptables-nft</code> installed would change the active
alternative (since they are in automatic mode by default).
On the other hand, existing systems using legacy variants should not
be changed by a system update. Therefore nft variants' priorities
should be chosen to match legacy ones.
=== Rename <code>iptables</code> package ===
New name should be <code>iptables-legacy</code> which aligns with
ebtables and arptables and reflects upstream status. To resolve
dependencies, <code>Provides: iptables</code> statement will be added
to <code>iptables-nft</code> package. This should automatically change
the default variant to nft.
== Benefit to Fedora ==
* RHEL8 ships nft-variants exclusively, make Fedora align with that by
default while still providing the option to fall back to legacy tools.
* New features and improvements are likely to hit nft-variants due to
the possibility nftables backend allows for. Although at this point
some legacy features (e.g. ebtables among match) are still missing,
others are already there (like, e.g. xtables-monitor tool) or are
being upstreamed right now (improved tool performance when dealing
with large rulesets).
== Scope ==
* Proposal owners:
Changes are rather simple: Rename <code>iptables</code> package, add
<code>Provides:</code> line to <code>iptables-nft</code> package,
change priorities used when calling <code>alternatives</code>.
* Other developers: N/A
The changed tools may cause regressions among packages using them and
it affects only new installations (or those manually switched over).
So while no explicit effort is required from them, they should be made
aware of the change so they take a possible regression in iptables
into account, quickly test against legacy variant and file a ticket
(or complain to the right person) if that fixes the problem.
* Release engineering: [https://pagure.io/releng/issue/8934 #8934]
* Policies and guidelines: No change required
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
Due to the package rename and <code>Provides:</code> line, upgrades will pull
in <code>iptables-nft</code> package. But due to the equal alternatives
priorities, existing choices won't be changed and so existing installations
shouldn't be harmed (apart from forced installation of
<code>iptables-nft</code> package).
Sadly, there are a few known issues, like e.g. missing support for ebtables
broute table or among match and a few iptables targets/matches. Users depending
on such features are advised to install <code>iptables-legacy</code> package
and switch variants using <code>alternatives</code>.
== How To Test ==
Any users of iptables/ebtables/arptables should switch to nft-variants using
alternatives tool (if necessary) and check that everything works as before. Any
issues should be reported despite the known compatibility issues described
above since knowledge about who uses the missing features is valuable
information for both up- and downstream.
== User Experience ==
Ideally look'n'feel shouldn't change. Since iptables-nft does not need a lock
file anymore, no problems with stale xtables-lock or parallel iptables calls in
different mount namespaces are expected anymore. Given the changes currently
being upstreamed, users dealing with large rulesets should see a performance
increase when manipulating the ruleset (lower run-times of iptables or
iptables-restore, packet processing speed should not really change).
== Dependencies ==
Other packages depending on iptables:
* NFStest
* clatd
* ctdb
* fail2ban-server
* firewalld
* fwsnort
* iptstate
* libvirt-daemon-driver-network
* libvirt-daemon-driver-nwfilter
* moby-engine
* nfacct
* origin
* podman
* psad
* python3-ipatests
* ravada
* rkt
* shorewall
* shorewall-init
* shorewall-lite
* shorewall6
* shorewall6-lite
* sshuttle
* sslsplit
* ufw
Since nft-variants are supposed to be drop-in replacements, no outside
contribution is needed in order to perform this change.
== Contingency Plan ==
* Contingency mechanism: Nothing needs to be done, the change should
be atomic.
* Contingency deadline: N/A
* Blocks release? No
== Documentation ==
* https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools
* Man pages:
** [http://man7.org/linux/man-pages/man8/xtables-nft.8.html xtables-nft.8]
** [http://man7.org/linux/man-pages/man8/xtables-legacy.8.html xtables-legacy.8]
** [http://man7.org/linux/man-pages/man8/xtables-monitor.8.html
xtables-monitor.8]
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
2 years, 5 months
Fedora Linux 35 Final blocker review summary
by Ben Cotton
F35 Beta is GO! Time to focus on the Final blockers.
Action summary
====================
Accepted blockers
-----------------
1. mesa — gnome-shell: cogl_texture_get_gl_texture(): gnome-shell
killed by SIGSEGV — NEW
ACTION: Maintainers to revert the regression-causing commit
2. abrt — abrt-dbus segmentation faulted in abrt_p2_service_dbus when
shutting down, rebooting, or logging out of Plasma — ASSIGNED
ACTION: Maintainers to diagnose and fix issue
3. xdg-desktop-portal — time is transiently incorrect when Automatic
Time Zone is enabled — NEW
ACTION: Maintainers to diagnose and fix issue
Proposed blockers
-----------------
1. cockpit — Non-root user cannot join a domain through Cockpit — POST
ACTION: Maintainers include upstream PR in an update
2. gedit — gedit crashes when searching for files — NEW
ACTION: Maintainers to diagnose and fix issue
3. spice-vdagent — Mouse cursor position has a horizontal and vertical
offset after changing resolution in a VM — NEW
ACTION: Maintainers to diagnose and fix issue
4. libreport — Abort doesn't work well — NEW
ACTION: abrt teams to continue investigating retrace server issue
5. selinux-policy — The switch for Fedora Third Party repositories
does not switch them on. — ASSIGNED
ACTION: Maintainers to create SELinux policy that permits the appropriate action
6. systemd — [DNS over TLS] following connection to a wifi AP,
internet is not available for ~30s — NEW
ACTION: Maintainers to fix issue
NEEDINFO: lpoetter
7. webkit2gtk3 — crash happens everytime when try to add a google
account to Online Account — MODIFIED
ACTION: QA to verify FEDORA-2021-c58350f4c8
Bug-by-bug detail
=============
Accepted blockers
-----------------
1. mesa — https://bugzilla.redhat.com/show_bug.cgi?id=1989726 — NEW
gnome-shell: cogl_texture_get_gl_texture(): gnome-shell killed by SIGSEGV
The Tegra driver in mesa has a regression that causes this bug.
Working with upstream on this. This bug was waived from F35 Beta.
2. abrt — https://bugzilla.redhat.com/show_bug.cgi?id=1997315 — ASSIGNED
abrt-dbus segmentation faulted in abrt_p2_service_dbus when shutting
down, rebooting, or logging out of Plasma
The crash reporter crashes (preventing us from receiving a crash
report from the crash reporter) when logging out or shutting down a
graphical session. It appears to be due to a change between
glib2-2.69.0-1.fc35 and glib2-2.69.2-1.fc35.
3. xdg-desktop-portal —
https://bugzilla.redhat.com/show_bug.cgi?id=1991075 — NEW
time is transiently incorrect when Automatic Time Zone is enabled
The displayed time is incorrect in some cases when Automatic Time Zone
is enabled. Both `timedatectl` and the GNOME display show the wrong
time. This behavior appears to exist on F34 and F35.
Proposed blockers
-----------------
1. cockpit — https://bugzilla.redhat.com/show_bug.cgi?id=2006028 — POST
Non-root user cannot join a domain through Cockpit
Non-root users who are members of the "Wheel" group cannot join a
FreeIPA or AD domain through Cockpit. Upstream PR
https://github.com/cockpit-project/cockpit/pull/16371 contains a fix
which appears to work.
2. gedit — https://bugzilla.redhat.com/show_bug.cgi?id=2007602 — NEW
gedit crashes when searching for files
When searching for a file in gedit, it results in a SIGSEGV.
3. spice-vdagent — https://bugzilla.redhat.com/show_bug.cgi?id=2006746 — NEW
Mouse cursor position has a horizontal and vertical offset after
changing resolution in a VM
Occasionally (1/3 times in kparal's testing), the mouse position was
offset in a virtual machine until rebooting.
4. libreport — https://bugzilla.redhat.com/show_bug.cgi?id=2006632 — NEW
Abort doesn't work well
Crash reports from abrt fail. This may be an issue with the retrace
server. abrt team is investigating.
5. selinux-policy —
https://bugzilla.redhat.com/show_bug.cgi?id=2001837 — ASSIGNED
The switch for Fedora Third Party repositories does not switch them on.
Enabling third party repos failed, which was sort of fixed in
gnome-initial-setup-41~rc-3.fc35. However, when running SELinux in
enforcing mode, it still fails. The `pkexec` run as part of
gnome-initial-setup leaves the SELinux context unchanged and the xdm_t
type does not have the ability to edit the appropriate files.
6. systemd — https://bugzilla.redhat.com/show_bug.cgi?id=2006393 — NEW
[DNS over TLS] following connection to a wifi AP, internet is not
available for ~30s
In some environments, systemd-resolved makes a DNS over TLS request
and gets no response, so it wait until it times out. Disabling DNS
over TLS avoids the problem, which may be caused by a "router…of
questionable quality."
7. webkit2gtk3 — https://bugzilla.redhat.com/show_bug.cgi?id=2006624 — MODIFIED
crash happens everytime when try to add a google account to Online Account
Trying to add a Google account causes Online Accounts to crash. Update
FEDORA-2021-c58350f4c8 contains a candidate fix.
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
2 years, 6 months