It looks like "fedpkg update" in Fedora 37 requires you to copy some string into a browser. I'm pretty sure it used to use Kerberos or ssh authentication which was somewhat more sensible.
I've got a bunch of scripts that now require manual interaction and a browser. How do I make this work without this?
Rich.
On Fri, Oct 14, 2022 at 8:57 PM Richard W.M. Jones rjones@redhat.com wrote:
It looks like "fedpkg update" in Fedora 37 requires you to copy some string into a browser. I'm pretty sure it used to use Kerberos or ssh authentication which was somewhat more sensible.
I've got a bunch of scripts that now require manual interaction and a browser. How do I make this work without this?
This sounds like the authentication flow changes in bodhi have propagated to fedpkg ... https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/...
According to the responses, it seems like "headless" use of the bodhi API is not going to be a supported use case for now.
Fabio
On Fri, Oct 14, 2022 at 09:10:48PM +0200, Fabio Valentini wrote:
On Fri, Oct 14, 2022 at 8:57 PM Richard W.M. Jones rjones@redhat.com wrote:
It looks like "fedpkg update" in Fedora 37 requires you to copy some string into a browser. I'm pretty sure it used to use Kerberos or ssh authentication which was somewhat more sensible.
I've got a bunch of scripts that now require manual interaction and a browser. How do I make this work without this?
This sounds like the authentication flow changes in bodhi have propagated to fedpkg ... https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/...
According to the responses, it seems like "headless" use of the bodhi API is not going to be a supported use case for now.
There's not really a way I can maintain the OCaml without automation, and I guess similar stacks may be affected.
Also the idea that involving a web browser in an authentication flow is secure is, frankly, quite absurd.
Rich.
On Fri, Oct 14, 2022 at 9:23 PM Richard W.M. Jones rjones@redhat.com wrote:
On Fri, Oct 14, 2022 at 09:10:48PM +0200, Fabio Valentini wrote:
On Fri, Oct 14, 2022 at 8:57 PM Richard W.M. Jones rjones@redhat.com wrote:
It looks like "fedpkg update" in Fedora 37 requires you to copy some string into a browser. I'm pretty sure it used to use Kerberos or ssh authentication which was somewhat more sensible.
I've got a bunch of scripts that now require manual interaction and a browser. How do I make this work without this?
This sounds like the authentication flow changes in bodhi have propagated to fedpkg ... https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/...
According to the responses, it seems like "headless" use of the bodhi API is not going to be a supported use case for now.
There's not really a way I can maintain the OCaml without automation, and I guess similar stacks may be affected.
Also the idea that involving a web browser in an authentication flow is secure is, frankly, quite absurd.
I agree. Interestingly enough, I just noticed that bodhi client added support for kerberos authentication a few days ago, and will use that by default, instead of the browser-based authentication: https://github.com/fedora-infra/bodhi/commit/4d5bb85ab7708ae730fbfa80538512e... I'm looking forward to that, as I am affected by $SUBJECT problem with fedora-update-feedback, as well.
Fabio
On Fri, Oct 14, 2022 at 09:34:33PM +0200, Fabio Valentini wrote:
On Fri, Oct 14, 2022 at 9:23 PM Richard W.M. Jones rjones@redhat.com wrote:
On Fri, Oct 14, 2022 at 09:10:48PM +0200, Fabio Valentini wrote:
On Fri, Oct 14, 2022 at 8:57 PM Richard W.M. Jones rjones@redhat.com wrote:
It looks like "fedpkg update" in Fedora 37 requires you to copy some string into a browser. I'm pretty sure it used to use Kerberos or ssh authentication which was somewhat more sensible.
I've got a bunch of scripts that now require manual interaction and a browser. How do I make this work without this?
This sounds like the authentication flow changes in bodhi have propagated to fedpkg ... https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/...
According to the responses, it seems like "headless" use of the bodhi API is not going to be a supported use case for now.
There's not really a way I can maintain the OCaml without automation, and I guess similar stacks may be affected.
Also the idea that involving a web browser in an authentication flow is secure is, frankly, quite absurd.
I agree. Interestingly enough, I just noticed that bodhi client added support for kerberos authentication a few days ago, and will use that by default, instead of the browser-based authentication: https://github.com/fedora-infra/bodhi/commit/4d5bb85ab7708ae730fbfa80538512e... I'm looking forward to that, as I am affected by $SUBJECT problem with fedora-update-feedback, as well.
Ah good stuff, let's see if that's in Fedora ...
... No. But it may be possible to backport. I'll see if it's easy.
Rich.