Re: Koji SSL Certification Issue
by Tomas Kopecek
It is not clear what is broken there. But at least it seems that your
certification authority is not trusted on your machines. You need to add it
to trusted CAs. E.g. in Fedora it would mean adding it to
/etc/pki/ca-trust/source/anchors and running update-ca-trust.
On Mon, Jul 31, 2023 at 6:14 AM Joe (Jun-Yan) Chen <jychena(a)ambarella.com>
wrote:
> Dear Koji development team,
>
> I hope this email finds you well. I am facing some difficulties with *Koji's
> SSL certification* and would greatly appreciate your guidance on these
> matters.
>
> I have generated the CA and certificates as per the "Server How To"
> document. I imported the PKCS12 generated by user "kojiadmin" into my
> browser, and all components are communicating well with each other.
> However, my browser still treats Kojiweb as an insecure link.
>
> When I try to log in to the Koji webpage, I encounter the
> "SSL_ERROR_BAD_CERT_DOMAIN" error, which indicates that the requested
> domain name does not match the server's certificate. Even after accepting
> the risk and continuing, Koji returns the error: "An error has occurred
> in the web interface code. This could be due to a bug or a configuration
> issue. koji.AuthError: could not verify client: None."
>
> I noticed there are two certificates in the Koji server, "kojihub" and the
> FQDN of the server. Their information is quite similar except for the
> "Organizational Unit". The problem must be caused by one of the
> certificates among "kojihub", "koji_ca_cert", or "PKCS12", whose 'CN' and
> 'OU' were filled according to
> https://docs.pagure.org/koji/server_howto/#generate-the-koji-component-ce...
> .
>
> Is there any way to debug this issue? or am I missing something?
>
> Thank you very much for your attention and assistance. I am looking
> forward to your response.
>
>
> Best Regards,
> Junyan CHEN
>
> [image: Ambarella AI Envisioned] <https://www.ambarella.com>
>
> *Junyan(Joe) CHEN*
>
> Software Engineer | SDK Team
>
> *Phone: *+86-021-60880608-265
>
> *Email: *jychena(a)ambarella.com <ypchang(a)ambarella.com>
>
> ------------------------------
> This email and attachments contain Ambarella Proprietary and/or
> Confidential Information and is intended solely for the use of the
> individual(s) to whom it is addressed. Any unauthorized review, use,
> disclosure, distribute, copy, or print is prohibited. If you are not an
> intended recipient, please contact the sender by reply email and destroy
> all copies of the original message. Thank you.
> _______________________________________________
> koji-devel mailing list -- koji-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to koji-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/koji-devel@lists.fedorahoste...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
--
Tomas Kopecek <tkopecek(a)redhat.com>
RHEL Build Development, RedHat
10 months
Koji SSL Certification Issue
by Joe (Jun-Yan) Chen
Dear Koji development team,
I hope this email finds you well. I am facing some difficulties with Koji's SSL certification and would greatly appreciate your guidance on these matters.
I have generated the CA and certificates as per the "Server How To" document. I imported the PKCS12 generated by user "kojiadmin" into my browser, and all components are communicating well with each other. However, my browser still treats Kojiweb as an insecure link.
When I try to log in to the Koji webpage, I encounter the "SSL_ERROR_BAD_CERT_DOMAIN" error, which indicates that the requested domain name does not match the server's certificate. Even after accepting the risk and continuing, Koji returns the error: "An error has occurred in the web interface code. This could be due to a bug or a configuration issue. koji.AuthError: could not verify client: None."
I noticed there are two certificates in the Koji server, "kojihub" and the FQDN of the server. Their information is quite similar except for the "Organizational Unit". The problem must be caused by one of the certificates among "kojihub", "koji_ca_cert", or "PKCS12", whose 'CN' and 'OU' were filled according to https://docs.pagure.org/koji/server_howto/#generate-the-koji-component-ce....
Is there any way to debug this issue? or am I missing something?
Thank you very much for your attention and assistance. I am looking forward to your response.
Best Regards,
Junyan CHEN
[Ambarella AI Envisioned]<https://www.ambarella.com>
Junyan(Joe) CHEN
Software Engineer | SDK Team
Phone: +86-021-60880608-265
Email: jychena(a)ambarella.com<mailto:ypchang@ambarella.com>
**********************************************************************
This email and attachments contain Ambarella Proprietary and/or Confidential Information and is intended solely for the use of the individual(s) to whom it is addressed. Any unauthorized review, use, disclosure, distribute, copy, or print is prohibited. If you are not an intended recipient, please contact the sender by reply email and destroy all copies of the original message. Thank you.
10 months
Koji 1.33.1 release
by Tomas Kopecek
Koji 1.33.1 is out. Another minor update. So, the update should be
straightforward (no db schema changes) and safe for everybody. If
you've installed 1.33, an update is recommended as it contains few
minor regression fixes.
Thanks to everyone who contributed!
You can read full release notes here:
https://docs.pagure.org/koji/release_notes/release_notes_1.33.1/
A few small changes are part of this release:
#3846 - "call" command can now accept json arguments
#3834 - no more traceback when using log_timestamps kojid option
#3864 - kojivmd can now run again on python 2
#3839 - vim syntax highlighting file for admins
#3836 - sw_64 and loongarch64 arch support for dist-repo
You can view the 1.33.1 roadmap at https://pagure.io/koji/roadmap/1.33.1/
For the current roadmap, see https://pagure.io/koji/roadmap
You can download this and other releases at
https://pagure.io/koji/releases or PyPi.
See you again with major release 1.34 in ~two months!
--
Tomas Kopecek <tkopecek(a)redhat.com>
RHEL Build Development, RedHat
10 months, 3 weeks
Re: [EXT] Re: Do dist-repo Can Only have a Single Version of RPMS?
by Tomas Kopecek
Koji dist-repo command by default contains only latest packages. Anyway,
there is --non-latest option which will add all tagged build versions.
Might be worth to combine with --noinherit in case of too many inherited
builds which are not relevant for your usecase.
On Mon, Jul 10, 2023 at 3:40 AM Joe (Jun-Yan) Chen <jychena(a)ambarella.com>
wrote:
> Thank you for your replys,
>
> My purpose can be reliazed by "koji dist-repo --non-latest", I just found
> this parameter which can Include older builds, not just the latest.
>
> Best Regards,
> Junyan CHEN
>
> [image: Ambarella AI Envisioned] <https://www.ambarella.com>
>
> *Junyan(Joe) CHEN*
>
> Software Engineer | SDK Team
>
> *Phone: *+86-021-60880608-265
>
> *Email: *jychena(a)ambarella.com <ypchang(a)ambarella.com>
>
> ------------------------------
> *From:* Neal Gompa <ngompa13(a)gmail.com>
> *Sent:* Friday, July 7, 2023 5:53 PM
> *To:* Koji development <koji-devel(a)lists.fedorahosted.org>
> *Subject:* [EXT] Re: Do dist-repo Can Only have a Single Version of RPMS?
>
> On Fri, Jul 7, 2023 at 5:32 AM Miroslav Suchý <msuchy(a)redhat.com> wrote:
> >
> > Dne 06. 07. 23 v 12:32 Joe (Jun-Yan) Chen napsal(a):
> >
> > Dear Koji Development team,
> >
> > How is "dnf downgrade" achieved? Cuz their repo only has a single
> version of RPMS, how do they find other version of the RPMS?
> >
> > In koji, can dist-repo do like that? So that the repo I export can have
> various versions and can also realize "dnf downgrade".
> > Or are there any other methods can "createrepo" all different versions
> of packages in one tag in kojifiles?
> >
> > Thank you very much for your attention and assistance. I look forward to
> your response.
> >
> > Dist-git can hold only one version of RPM. And dist-git has nothing
> relevant what client see. They see dnf repository. That is basicaly just
> directory.
> >
> > Yum/dnf repository can hold as many version of the same name as you
> want. And when you run createrepo_c in that directory, then all version are
> included in that repository metadata.
> >
> > It is up to admin (of the dnf repository) how many old package they keep
> in the repository.
> >
>
> This person is asking about Koji's dist-repo functionality (which
> produces YUM repositories). I am actually not sure if dist-repos can
> be configured to hold more than one version of a package though...
>
>
> --
> 真実はいつも一つ！/ Always, there's only one truth!
> _______________________________________________
> koji-devel mailing list -- koji-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to koji-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://urldefense.com/v3/__https://docs.fedoraproject.org/en-US/project/...
> List Guidelines:
> https://urldefense.com/v3/__https://fedoraproject.org/wiki/Mailing_list_g...
> List Archives:
> https://urldefense.com/v3/__https://lists.fedorahosted.org/archives/list/...
> Do not reply to spam, report it:
> https://urldefense.com/v3/__https://pagure.io/fedora-infrastructure/new_i...
>
> ######################################################################
> This EXTERNAL email has been scanned by Proofpoint Email Protect service.
> ------------------------------
> This email and attachments contain Ambarella Proprietary and/or
> Confidential Information and is intended solely for the use of the
> individual(s) to whom it is addressed. Any unauthorized review, use,
> disclosure, distribute, copy, or print is prohibited. If you are not an
> intended recipient, please contact the sender by reply email and destroy
> all copies of the original message. Thank you.
> _______________________________________________
> koji-devel mailing list -- koji-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to koji-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/koji-devel@lists.fedorahoste...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
--
Tomas Kopecek <tkopecek(a)redhat.com>
RHEL Build Development, RedHat
10 months, 3 weeks
Re: Do dist-repo Can Only have a Single Version of RPMS?
by Miroslav Suchý
Dne 06. 07. 23 v 12:32 Joe (Jun-Yan) Chen napsal(a):
> Dear Koji Development team,
>
> How is "dnf downgrade" achieved? Cuz their repo only has a single version of RPMS, how do they find other
> version of the RPMS?
>
> In koji, can dist-repo do like that? So that the repo I export can have various versions and can also realize
> "dnf downgrade".
> Or are there any other methods can "createrepo" all different versions of packages in one tag in kojifiles?
>
> Thank you very much for your attention and assistance. I look forward to your response.
Dist-git can hold only one version of RPM. And dist-git has nothing relevant what client see. They see dnf repository.
That is basicaly just directory.
Yum/dnf repository can hold as many version of the same name as you want. And when you run createrepo_c in that
directory, then all version are included in that repository metadata.
It is up to admin (of the dnf repository) how many old package they keep in the repository.
--
Miroslav Suchy, RHCA
Red Hat, Manager, Packit and CPT, #brno, #fedora-buildsys
10 months, 3 weeks
Do dist-repo Can Only have a Single Version of RPMS?
by Joe (Jun-Yan) Chen
Dear Koji Development team,
How is "dnf downgrade" achieved? Cuz their repo only has a single version of RPMS, how do they find other version of the RPMS?
In koji, can dist-repo do like that? So that the repo I export can have various versions and can also realize "dnf downgrade".
Or are there any other methods can "createrepo" all different versions of packages in one tag in kojifiles?
Thank you very much for your attention and assistance. I look forward to your response.
Best Regards,
Junyan CHEN
[Ambarella AI Envisioned]<https://www.ambarella.com>
Junyan(Joe) CHEN
Software Engineer | SDK Team
Phone: +86-021-60880608-265
Email: jychena(a)ambarella.com<mailto:ypchang@ambarella.com>
**********************************************************************
This email and attachments contain Ambarella Proprietary and/or Confidential Information and is intended solely for the use of the individual(s) to whom it is addressed. Any unauthorized review, use, disclosure, distribute, copy, or print is prohibited. If you are not an intended recipient, please contact the sender by reply email and destroy all copies of the original message. Thank you.
11 months