securing FAS certs
by Toshio Kuratomi
Hey bright idea bringers!
The Fedora Certificates issued by FAS are currently set to be
autogenerated if you have an account in FAS. This has one drawback. We
have to keep the password for the CA keys that sign the FAS certificates
in a file on the filesystem so that the automatic signing can use them.
Has anyone else had to confront this problem? Right now I'm thinking of
coding something that involves human interaction to sign the certs and
send email notifying people when their cert is ready to download.
That's certainly doable, but introduces a wait time that isn't in the
current design. I'd love input on better ways to do this.
-Toshio
15 years, 3 months
Notification - 2008-08-26 23:00 UTC
by Mike McGrath
There was an outage starting at 2008-08-26 23:00 UTC, which lasted
approximately 1 hour.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2008-08-26 23:00 UTC'
Affected Services:
Websites
Buildsystem
Database
Unaffected Services:
CVS / Source Control
DNS
Mail
Torrent
Ticket Link:
https://fedorahosted.org/fedora-infrastructure/ticket/784
Reason for Outage:
Cooling issues in our primary datacenter caused some ambient temperatures
to hit 39C/102F. After hitting a critical point many of our servers shut
themselves down. After the issue was corrected and things cooled down, we
powered up the servers without issue.
Contact Information:
Please join #fedora-admin in irc.freenode.net or respond to this email to
track the status of this outage.
15 years, 3 months
Maintaining a partial cvs workarea
by Axel Thimm
Hi,
I'm keeping only a partial checkout of the packages, e.g. the ones I'm
maintaining. Now I'd like to be able to cvs up and have all updates
flow in, but if I do so cvs will want to get all other thousand
packages in.
Until now I'm using a poor man's solution with a for loop and
pushd/popd, but it's extremely slow due to login in for each package.
Is there a more clever way to get cvs up running w/o pulling in all of
the cvsroot? I could probably manually edit CVS/Entries, but this feels
a bit dirty. What are other packagers doing?
--
Axel.Thimm at ATrpms.net
15 years, 3 months
cvs: Permission denied (publickey).
by Axel Thimm
Hi,
I saw that some people are using CVS again, so I tried as well, but I
got:
athimm@devel(1012):/home/.../smart/devel$ cvs up
Permission denied (publickey).
cvs [update aborted]: end of file from server (consult above messages if any)
I have a new FAS password, all certs updated, I even checked the cvs
procedures for newbies on fpo, but I had no luck. What am I doing
wrong?
Thanks!
--
Axel.Thimm at ATrpms.net
15 years, 3 months
Some noteworty praise
by Paul W. Frields
This whole team got a well-deserved attaboy from Tim Burke, who is the
Director of Linux Development inside Red Hat.
https://www.redhat.com/archives/fedora-devel-list/2008-August/msg01023.html
'''
Dear Fedorans,
There's an old expression: When the going gets tough; the tough get going.
The hardcore Fedora guys here at RH have been as tough, determined,
hard-working and resilient as I have ever seen. It is a privilege to
work among them. They didn't ask for a week of grief. They didn't
deserve a week of grief. This burden was inflicted on them through no
fault of their own. Through it all they have risen to the occasion and
gone well beyond. In addition, they have at all times had the interests
and spirit of the community front and center.
Because this is an ongoing investigation I am unable to articulate their
individual heroics in detail. If you have been lucky enough to meet any
of them at Fudcon, OLS, a local LUG meeting or online, you know who I'm
talking about. You know the magic they perform. We at Red Hat are proud
of every one of them. We stand behind them shoulder to shoulder 100%.
Inside the walls of Red Hat, the word "heroes" has almost never been
used. Glad we saved it for these guys.
In deep admiration
Tim Burke, Director Linux Development
'''
I couldn't agree more.
--
Paul W. Frields http://paul.frields.org/
gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717
http://redhat.com/ - - - - http://pfrields.fedorapeople.org/
irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug
15 years, 3 months
buildgroups directory vanished from http://buildsys.fedoraproject.org ?
by Manuel Wolfshant
While trying to test build a program for EL-5, mock bails out with:
INFO: Results and/or logs in: /var/lib/mock//epel-5-x86_64/result
ERROR: Command failed:
# /usr/bin/yum --installroot /var/lib/mock/epel-5-x86_64/root/ install
buildsys-build
http://buildsys.fedoraproject.org/buildgroups/rhel5/x86_64/repodata/repom...:
[Errno 14] HTTP Error 404: Not Found
Trying other mirror.
Error: Cannot retrieve repository metadata (repomd.xml) for repository:
groups. Please verify its path and try again
It looks like the buildgroups does not exist any more. Could someone
please fix it (or tell me what to use instead, if it's gone for good) ?
Manuel
15 years, 3 months
Test servers
by Mike McGrath
So we're in kind of an awkward but probably beneficial spot right now for
our test server infrastructure.
Its _ALL_ down right now. And we need to build it back up. We've talked
about another layer of test servers and I think its probably time for that
so here's what I propose.
Rebuild our test servers external to PHX. There is an open ticket for
this already, we're just going to be doing it finally.
Create a staging environment in the publictest and test areas in PHX.
Staging will be identical to our production environment where possible
with the exception of production data and where new features are being
implemented and are not in production yet.
Staging will be in puppet. All of it. Just like production is and
they'll get rebuilt regularly. We can use puppet's environments to do
this but I'm going to talk with kanarip about implementation and such. We
actually have a very basic testing environment setup in puppet now but its
not really tested or documented yet. Staging will be different.
What to know about the old pt servers:
1) AFAIK at this point in time, no data has been lost or anything. The
old servers are just off.
2) PT10 was kind of a mess and needed to be rebuilt anyway.
3) If you need to recover something ask but we're not going to blanket
replace everyone's home dirs. Hopefully you weren't developing on the
public test servers but were simply using it to show others.
This isn't all a done deal yet. I want to see what others say since this
affects a lot of people, we have a lot of testers.
-Mike
15 years, 3 months
Security assessment
by Paul W. Frields
Eric Christensen (IRC: Sparks) offered to provide some assistance or
input on security assessment. I let him know that the Infrastructure
team has of course been constantly looking at how to ensure best
security practices, but that we very much encouraged community input,
and asked him to get in touch.
--
Paul W. Frields
gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717
http://paul.frields.org/ - - http://pfrields.fedorapeople.org/
irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug
15 years, 3 months