using include statements in pungi-fedora
by Dusty Mabe
I've been told recently that we can use include statements within pungi to
include variables/definitions in other files into our current configuration
file we are working on.
Can we start to use this model for our pungi-fedora repo? One example is that
the fedora-atomic.conf file has a bunch of configuration at the top of it that
is very cryptic to know what's relevant to atomic host image/iso creation and what
is not. It would be much better if, for a particular branch, we can have a file
that has most common definitions in it for all pungi configs for that branch. Then
we can make the individual pungi configs much more lightweight and less confusing.
If this is acceptable we can start with the Rawhide branch and when we branch for
future releases this will propagate.
Thoughts?
Dusty
6 years, 10 months
[releng] Issue #6791: Create module-bootstrap-master tag similar to
f26-modularity
by Jan Kaluža
jkaluza reported a new issue against the project: `releng` that you are following:
``
Hi,
to build base-runtime module, we are using manually created f26-modularity tag which groups RPMs needed to bootstrap the base-runtime module which is later used as a base module for other modules.
This f26-modularity tag is quite old and it has been created before we even deployed MBS to prod by following rel-eng tickets:
- https://pagure.io/releng/issue/6658
- https://pagure.io/releng/issue/6680
- https://pagure.io/releng/issue/6664
- https://pagure.io/releng/issue/6672
This tag is supposed to be F26 only and therefore we would like to have similar tag to bootstrap base-runtime using the rawhide packages (that's the long-term goal).
Therefore I would like to kindly ask rel-engs to create `module-bootstrap-master` tag, which would:
- white-list the same list of packages as `module-package-list` tag (this is tag f26-modularity inherits from)
- contains the same packages (NVRs) as the f26-modularity tag. I'm asking rel-engs to also tag the packages, because some of them are "secure-boot" packages and cannot be tagged by us.
We are using "module-bootstrap-master" name instead of "rawhide-modularity", because it fits to current "module-" prefixed namespace of modules better.
``
To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/6791
6 years, 10 months
[releng] Issue #6798: ED25519 SSH CA keys in dist-git are not recognized by
RHEL6 machines con
by Jakub Jelen
jjelen reported a new issue against the project: `releng` that you are following:
``
Recently, the RSA host key of "pkgs.fedoraproject.org" was signed using `ssh-ed25519` key (can't see any announcement about that), which is not recognized by old RHEL6 machines, which makes the dist-git inaccessible from this system (without a workaround `-o HostKeyAlgorithms=ssh-rsa`).
Per discussion in OpenSSH upstream, there is no simple solution how to make it working in old RHEL6 nor how to fix that in upstream/RHEL7. The easiest way would be not to use CA based on the ED25519 keys yet if we aim for compatibility with RHEL6 (which I believe we do).
The server can offer different keys so I would suggest to create
* rsa keys signed by rsa certificate authority for legacy deployments
* ed25519 key signed by ed25519 certificate authority for current
This will make it work for old systems and the new ones will be using future-proof algorithsm (for the price of maintaining two CA keys and host keys).
The related bug report, that I am going to close:
https://bugzilla.redhat.com/show_bug.cgi?id=1450609
``
To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/6798
6 years, 11 months