firewall rules on builders (iptables, firewalld, libvirt...)
by Matthew Miller
It's my understanding (Dennis please correct if I'm wrong) that the
problem with cloud image creation was due to libvirt iptables rules
being lost when iptables was restarted. This is a fundamental known
issue (see last paragraph of <http://libvirt.org/firewall.html>), and
one of the things firewalld was meant to solve.
Dennis says that there are lot of complicated rules on the builders
making switching to firewalld difficult. One possibility might be to
move those complicated rules from the builders to a network firewall,
and keep the host rules simple and functional. But that's probably a
big undertaking.
In the meantime, any time iptables is restarted or reloaded, libvirt
needs a SIGHUP. (I suppose this means: ansible playbooks and also added
to any manual procedures.)
[cc rel-eng, reply-to infrastructure]
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
9 years, 6 months
[releng] check_sigul: Fix mail parameters
by Till Maas
commit 8b150dad3b0a0154608a337741144c8cf7110997
Author: Till Maas <opensource(a)till.name>
Date: Tue Oct 28 08:00:18 2014 +0100
check_sigul: Fix mail parameters
scripts/check_sigul.py | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/scripts/check_sigul.py b/scripts/check_sigul.py
index 9f2b01c..73c3dd3 100755
--- a/scripts/check_sigul.py
+++ b/scripts/check_sigul.py
@@ -42,8 +42,8 @@ if __name__ == "__main__":
# FIXME: Make this a config option
fedora_user = getpass.getuser()
mail_logger = SubjectSMTPHandler(
- "127.0.0.1", fedora_user, [fedora_user], "Autosigner log event")
- mail_logger.subject_prefix = "Autosigner: "
+ "127.0.0.1", fedora_user, [fedora_user], "Sigul check log event")
+ mail_logger.subject_prefix = "Sigul check: "
mail_logger.setLevel(logging.DEBUG)
mail_logger.setFormatter(formatter)
log.addHandler(mail_logger)
9 years, 6 months
[releng] check_sigul: Fix comments
by Till Maas
commit 9a3926c2eb9dde1814cbcfde5d514175c2e42642
Author: Till Maas <opensource(a)till.name>
Date: Tue Oct 28 07:59:22 2014 +0100
check_sigul: Fix comments
scripts/check_sigul.py | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/scripts/check_sigul.py b/scripts/check_sigul.py
index baa4202..9f2b01c 100755
--- a/scripts/check_sigul.py
+++ b/scripts/check_sigul.py
@@ -1,7 +1,7 @@
#!/usr/bin/python -tt
# vim: fileencoding=utf8
# SPDX-License-Identifier: GPL-2.0+
-#{{{ License header: GPLv2+
+# {{{ License header: GPLv2+
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 2 of the License, or
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <https://www.gnu.org/licenses/>.
-#}}}
+# }}}
import getpass
import logging
9 years, 6 months
[releng] add sigul check script
by Till Maas
commit b3c72ca48b955d233a0d5e60a51f52f0a44618bf
Author: Till Maas <opensource(a)till.name>
Date: Mon Oct 27 22:14:00 2014 +0100
add sigul check script
scripts/check_sigul.py | 80 ++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 80 insertions(+), 0 deletions(-)
---
diff --git a/scripts/check_sigul.py b/scripts/check_sigul.py
new file mode 100755
index 0000000..baa4202
--- /dev/null
+++ b/scripts/check_sigul.py
@@ -0,0 +1,80 @@
+#!/usr/bin/python -tt
+# vim: fileencoding=utf8
+# SPDX-License-Identifier: GPL-2.0+
+#{{{ License header: GPLv2+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+#}}}
+
+import getpass
+import logging
+log = logging.getLogger(__name__)
+import os
+import time
+
+from sigulsign_unsigned import SigulHelper
+from autosigner import SubjectSMTPHandler
+
+
+if __name__ == "__main__":
+ formatter = logging.Formatter(
+ '%(asctime)s: %(levelname)s: %(message)s',
+ )
+ # Log in UTC
+ formatter.converter = time.gmtime
+
+ console_logger = logging.StreamHandler()
+ console_logger.setLevel(logging.DEBUG)
+ console_logger.setFormatter(formatter)
+ log.setLevel(logging.DEBUG)
+ log.addHandler(console_logger)
+
+ # FIXME: Make this a config option
+ fedora_user = getpass.getuser()
+ mail_logger = SubjectSMTPHandler(
+ "127.0.0.1", fedora_user, [fedora_user], "Autosigner log event")
+ mail_logger.subject_prefix = "Autosigner: "
+ mail_logger.setLevel(logging.DEBUG)
+ mail_logger.setFormatter(formatter)
+ log.addHandler(mail_logger)
+
+ keys = ["fedora-22", "fedora-22-secondary"]
+ helpers = {}
+
+ for k in keys:
+ log.debug("Monitoring key " + k)
+ if k.endswith("-secondary"):
+ config_file = os.path.expanduser("~/.sigul/client-secondary.conf")
+ else:
+ config_file = None
+
+ helpers[k] = SigulHelper(k, config_file=config_file,
+ ask_with_agent=True, ask=True)
+
+ status = {}
+
+ log.debug("Starting checking...")
+ while True:
+ for key, helper in helpers.items():
+ res = helper.get_public_key()
+ ret, pubkey, errors = res
+ if status.setdefault(key, res) != res:
+ if ret != 0 or errors:
+ log.error(
+ "Sigul for key '{}' stopped working: {}:{}".format(
+ key, ret, errors))
+ else:
+ log.warning(
+ "Sigul for key '{}' resumed working".format(key))
+
+ time.sleep(600)
9 years, 6 months
[releng] block_retired: Import SubjectSMTPHandler
by Till Maas
commit 4c9c1301605849e502613aabe1c46eae0549fa56
Author: Till Maas <opensource(a)till.name>
Date: Mon Oct 27 22:03:56 2014 +0100
block_retired: Import SubjectSMTPHandler
scripts/block_retired.py | 13 ++-----------
1 files changed, 2 insertions(+), 11 deletions(-)
---
diff --git a/scripts/block_retired.py b/scripts/block_retired.py
index 2556980..7685719 100755
--- a/scripts/block_retired.py
+++ b/scripts/block_retired.py
@@ -26,6 +26,8 @@ import time
import koji
import pkgdb2client
+from autosigner import SubjectSMTPHandler
+
log = logging.getLogger(__name__)
RETIRING_BRANCHES = ["el5", "el6", "epel7", "f21", "master"]
@@ -209,17 +211,6 @@ def block_all_retired(branches=RETIRING_BRANCHES):
block_package(unblocked, branch)
-class SubjectSMTPHandler(logging.handlers.SMTPHandler):
- # Class copied from autosigner.py
- subject_prefix = ""
-
- def getSubject(self, record):
- first_line = record.message.split("\n")[0]
- fmt = self.subject_prefix + "{0.levelname}: {first_line}"
-
- return fmt.format(record, first_line=first_line)
-
-
def setup_logging(debug=False, mail=False):
if debug:
log.setLevel(logging.DEBUG)
9 years, 6 months
[releng] sigulsign_unsigned: add get_public_key()
by Till Maas
commit 5da8d841b1dc77f3fbae9ee9a854d2babb5e42d4
Author: Till Maas <opensource(a)till.name>
Date: Mon Oct 27 22:00:18 2014 +0100
sigulsign_unsigned: add get_public_key()
scripts/sigulsign_unsigned.py | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
---
diff --git a/scripts/sigulsign_unsigned.py b/scripts/sigulsign_unsigned.py
index b401d89..3a9b185 100755
--- a/scripts/sigulsign_unsigned.py
+++ b/scripts/sigulsign_unsigned.py
@@ -358,12 +358,16 @@ class SigulHelper(object):
self.config_file = config_file
self.arch = arch
- command = self.build_cmdline('get-public-key', self.key)
- ret, pubkey, stderr = self.run_command(command)
+ ret, pubkey, stderr = self.get_public_key()
if ret != 0:
raise ValueError("Invalid key or password: " + stderr)
self.keyid, self.v3 = get_key_info(pubkey)
+ def get_public_key(self):
+ command = self.build_cmdline('get-public-key', self.key)
+ ret, stdout, stderr = self.run_command(command)
+ return ret, stdout, stderr
+
def build_cmdline(self, *args):
cmdline = ['sigul', '--batch']
if self.config_file:
9 years, 6 months
last minute f21 change -- workstation dropping installable tree
by Matthew Miller
So in today's FESCo meeting, it was decided that since the workaround
for making the netinstall image isn't all... worked around... rel-eng
wants to just drop making a separate installable Workstation tree. On
the mirrors, Workstation will just contain the live images. (Netinstall
will still be possible, from the server netinstall, but not the
default.) I'm thinking that if that's being done, we should do the same
with Cloud, and just have Cloud images directly under Cloud (with no
repo or rpms there).
What do you think?
This will all need to be revisited for F22 in any case.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
9 years, 6 months
[releng] sigulsign_unsigned: Fix PEP8 compliance
by Till Maas
commit a5788fdbf8c30b72e364bf84e30538dbad8f9720
Author: Till Maas <opensource(a)till.name>
Date: Sun Oct 26 11:45:16 2014 +0100
sigulsign_unsigned: Fix PEP8 compliance
scripts/sigulsign_unsigned.py | 18 ++++++++++--------
1 files changed, 10 insertions(+), 8 deletions(-)
---
diff --git a/scripts/sigulsign_unsigned.py b/scripts/sigulsign_unsigned.py
index a49d465..b401d89 100755
--- a/scripts/sigulsign_unsigned.py
+++ b/scripts/sigulsign_unsigned.py
@@ -138,10 +138,10 @@ def get_key_info(source, filename=False):
return keyid, v3
-def get_gpg_agent_passphrase(cache_id, ask=False, error_message="X", prompt="X",
- description=None):
+def get_gpg_agent_passphrase(cache_id, ask=False, error_message="X",
+ prompt="X", description=None):
gpg_agent = subprocess.Popen(["gpg-connect-agent"], stdin=subprocess.PIPE,
- stdout=subprocess.PIPE)
+ stdout=subprocess.PIPE)
cmdline = ["GET_PASSPHRASE"]
if not ask:
@@ -160,8 +160,8 @@ def get_gpg_agent_passphrase(cache_id, ask=False, error_message="X", prompt="X",
response, error = gpg_agent.communicate(cmdline)
if gpg_agent.returncode != 0:
- raise RuntimeError("gpg-agent-connect error: {}:{}".format(
- gpg_agent.returncode, error))
+ raise RuntimeError("gpg-agent-connect error: {}:{}".format(
+ gpg_agent.returncode, error))
elif not response.startswith("OK"):
raise RuntimeError("gpg-agent-connect error message: {}".format(
response))
@@ -343,12 +343,14 @@ class SigulHelper(object):
cache_id = "sigul:{}:{}".format(fas_username, key)
try:
- self.password = get_gpg_agent_passphrase(cache_id, ask=ask_with_agent)
+ self.password = get_gpg_agent_passphrase(cache_id,
+ ask=ask_with_agent)
except:
self.password = None
if self.password is None and ask and not ask_with_agent:
- self.password = getpass.getpass(prompt='Passphrase for %s: ' % key)
+ self.password = getpass.getpass(
+ prompt='Passphrase for %s: ' % key)
else:
self.password = password
if self.password is None:
@@ -458,7 +460,7 @@ if __name__ == "__main__":
key = args[0]
logging.debug('Using %s for key %s' % (KEYS[key]['id'], key))
- if not key in KEYS.keys():
+ if key not in KEYS.keys():
logging.error('Unknown key %s' % key)
parser.print_help()
sys.exit(1)
9 years, 6 months