automated rpm signing woes
by John Florian
What is the recommended solution for this these days? What is
fedoraproject.org using?
I presently have a setup using Sigul on CentOS 7 but that's leading to
my current problem of being unable to upgrade anything. I can't find
anything workable with CentOS 8, meanwhile my Koji Hub is stuck at
1.21.1 because I'm unaware of any newer builds via epel7. My Koji
Builders are now stuck at Fedora 33 because tasks fail if they have a
newer version of Koji than the Hub.
My attempts at moving Sigul to CentOS 8 Stream have just led to one bug
after another using the only build I could find, located at
https://kojipkgs.fedoraproject.org/repos-dist/epel$releasever-infra/lates....
I've fumbled my way through a few fixes and would be happy to contribute
when I can or, at least, report bugs. However, whenever I go to
https://pagure.io/sigul/, the apparent upstream for the project, I see
the last commit as 10 months ago, the last comment on any issue as 7
months ago, no issues closed, no PRs merged. Is it dead?
1 year, 3 months
Re: [EPEL-devel] Mock/Copr default epel-8-* configuration to be changed
by Stephen John Smoogen
On Sun, 28 Nov 2021 at 19:32, Nico Kadel-Garcia <nkadel(a)gmail.com> wrote:
>
> On Sun, Nov 28, 2021 at 7:06 PM Neal Gompa <ngompa13(a)gmail.com> wrote:
> >
> > On Thu, Nov 25, 2021 at 2:02 PM Nico Kadel-Garcia <nkadel(a)gmail.com> wrote:
> > >
> > > On Thu, Nov 25, 2021 at 8:26 AM Neal Gompa <ngompa13(a)gmail.com> wrote:
> > > >
> > > > On Thu, Nov 25, 2021 at 6:19 AM Nico Kadel-Garcia <nkadel(a)gmail.com> wrote:
> > > > >
> > > > > On Thu, Nov 25, 2021 at 3:05 AM Miroslav Suchý <msuchy(a)redhat.com> wrote:
> > > > > >
> > > > > > Dne 22. 11. 21 v 15:00 Pavel Raiskup napsal(a):
> > > > > > > Hello Fedora EPEL maintainers!
> > > > > > >
> > > > > > > First I don't feel comfortable announcing this, I'm not happy about the
> > > > > > > situation and so I don't want to be the lightning rod :-). But I believe
> > > > > > > that we can come to acceptable Copr/Mock solution and this needs to be
> > > > > > > discussed... so here we are.
> > > > > > >
> > > > > > > By the end of the year 2021 we have to fix our default EPEL 8 Mock
> > > > > > > configuration (mock-core-configs.rpm, /etc/mock/epel-8-*.cfg) as CentOS 8
> > > > > > > goes EOL by then.
> > > > > >
> > > > > >
> > > > > > I wrote down the possible options and their pros and cons and I done my best to catch all the feedback here.
> > > > > >
> > > > > > https://docs.google.com/document/d/1wF7-7_y6Ac_oB-kCFdE6VBWPW8o8zjXd2Z0SG...
> > > > > >
> > > > > > Miroslav
> > > > >
> > > > > That seems to be a succinct listing. I think you left out my
> > > > > suggestion.of "support people re-inventing point releases for CentOS",
> > > > > which is what major CentOS users will do using internal mirrors. due
> > > > > to concern about unexpected and unwelcome updates of CentOS Stream,
> > > > > while they assess whether AlmaLinux or Rocky are reliable and stable
> > > > > enough to use. It's not an uncommon behavior for EPEL itself, partly
> > > > > because of EPEL's bad habit of deleting RPMs without warning and
> > > > > stripping out all previous releases. That's caused me problems with
> > > > > chromium and firefox when updates were incompatible with contemporary
> > > > > regression testing systems.
> > > > >
> > > >
> > > > It's not a "bad habit", it happens because when packages are retired,
> > > > keeping the packages there does a disservice to the community by
> > > > effectively forcing a maintenance burden when there's no maintainer.
> > > > As for stripping out previous releases, that's just how Pungi and
> > > > Bodhi do update composes at the moment. Someday that'll be fixed, but
> > > > then we'd have to come up with a policy on how many because there are
> > > > storage concerns for mirrors if we kept everything published forever.
> > >
> > > It causes problems and confusion for people who need to lock down
> > > evisting versions for deployment. And it happens for packages that are
> > > not retired, but merely updated. I was bitten by it myself with
> > > chromium updates last year. It forces users of EPEL to maintain
> > > internal repos, or out of band access to previously accessible RPMs.
> > > It's destabilizing and breaks the use of bills-of-material based
> > > deployments with complete lists of all desired RPMs.
> > >
> > > Storage and bandwidth concerns are legitimate concerns, as is
> > > potentially continuing to publish older releases with known
> > > vulnerabilities or bugs. But neither Fedora nor RHEL simply discard
> > > previously published versions this way, they aggregate new releases. I
> > > consider this a longstanding bug for EPEL, and one of the reasons I
> > > set up internal mirrors in large deployments.
> > >
> >
> > This is not true. Fedora and EPEL share the same system, and have the
> > same issues. The only difference is that the release repo is frozen in
> > Fedora, so only the updates repo is affected this way. So there's at
> > most two versions of a package at any time.
>
> You're correct. With the current setup, it's also relatively simple to
> revert to the "frozen" release, which handles most of the regression
> situations. And Fedora releases are nowhere near so long-lived as RHEL
> and EPEL, so it tends to be less of a long-lived problem.
>
> > RHEL *does* maintain multiple old versions, but their system is
> > completely different and supports that capability.
>
> What would it take to get Fedora, or at least EPEL, to preserve old
> releases in the default published repos? I appreciate that it would
> require thought and expand them noticeably, especially for bulky and
> frequently updating components like chromium. I admit to not having
> numbers on how much churn happens there: does anyone have numbers?
In order to keep older package releases, it would require changes to
the compose tool pungi. It would also have to make it so it worked for
EPEL versus Fedora. [Fedora Linux releases have grown to the point
that many mirrors can barely carry the OS as is.. adding in older
packages is out of the question for them.] I do not have numbers on
how often packages churn or which ones churn the most.
--
Stephen J Smoogen.
Let us be kind to one another, for most of us are fighting a hard
battle. -- Ian MacClaren
1 year, 6 months
Re: [EPEL-devel] Mock/Copr default epel-8-* configuration to be changed
by Neal Gompa
On Thu, Nov 25, 2021 at 2:02 PM Nico Kadel-Garcia <nkadel(a)gmail.com> wrote:
>
> On Thu, Nov 25, 2021 at 8:26 AM Neal Gompa <ngompa13(a)gmail.com> wrote:
> >
> > On Thu, Nov 25, 2021 at 6:19 AM Nico Kadel-Garcia <nkadel(a)gmail.com> wrote:
> > >
> > > On Thu, Nov 25, 2021 at 3:05 AM Miroslav Suchý <msuchy(a)redhat.com> wrote:
> > > >
> > > > Dne 22. 11. 21 v 15:00 Pavel Raiskup napsal(a):
> > > > > Hello Fedora EPEL maintainers!
> > > > >
> > > > > First I don't feel comfortable announcing this, I'm not happy about the
> > > > > situation and so I don't want to be the lightning rod :-). But I believe
> > > > > that we can come to acceptable Copr/Mock solution and this needs to be
> > > > > discussed... so here we are.
> > > > >
> > > > > By the end of the year 2021 we have to fix our default EPEL 8 Mock
> > > > > configuration (mock-core-configs.rpm, /etc/mock/epel-8-*.cfg) as CentOS 8
> > > > > goes EOL by then.
> > > >
> > > >
> > > > I wrote down the possible options and their pros and cons and I done my best to catch all the feedback here.
> > > >
> > > > https://docs.google.com/document/d/1wF7-7_y6Ac_oB-kCFdE6VBWPW8o8zjXd2Z0SG...
> > > >
> > > > Miroslav
> > >
> > > That seems to be a succinct listing. I think you left out my
> > > suggestion.of "support people re-inventing point releases for CentOS",
> > > which is what major CentOS users will do using internal mirrors. due
> > > to concern about unexpected and unwelcome updates of CentOS Stream,
> > > while they assess whether AlmaLinux or Rocky are reliable and stable
> > > enough to use. It's not an uncommon behavior for EPEL itself, partly
> > > because of EPEL's bad habit of deleting RPMs without warning and
> > > stripping out all previous releases. That's caused me problems with
> > > chromium and firefox when updates were incompatible with contemporary
> > > regression testing systems.
> > >
> >
> > It's not a "bad habit", it happens because when packages are retired,
> > keeping the packages there does a disservice to the community by
> > effectively forcing a maintenance burden when there's no maintainer.
> > As for stripping out previous releases, that's just how Pungi and
> > Bodhi do update composes at the moment. Someday that'll be fixed, but
> > then we'd have to come up with a policy on how many because there are
> > storage concerns for mirrors if we kept everything published forever.
>
> It causes problems and confusion for people who need to lock down
> evisting versions for deployment. And it happens for packages that are
> not retired, but merely updated. I was bitten by it myself with
> chromium updates last year. It forces users of EPEL to maintain
> internal repos, or out of band access to previously accessible RPMs.
> It's destabilizing and breaks the use of bills-of-material based
> deployments with complete lists of all desired RPMs.
>
> Storage and bandwidth concerns are legitimate concerns, as is
> potentially continuing to publish older releases with known
> vulnerabilities or bugs. But neither Fedora nor RHEL simply discard
> previously published versions this way, they aggregate new releases. I
> consider this a longstanding bug for EPEL, and one of the reasons I
> set up internal mirrors in large deployments.
>
This is not true. Fedora and EPEL share the same system, and have the
same issues. The only difference is that the release repo is frozen in
Fedora, so only the updates repo is affected this way. So there's at
most two versions of a package at any time.
RHEL *does* maintain multiple old versions, but their system is
completely different and supports that capability.
--
真実はいつも一つ！/ Always, there's only one truth!
1 year, 6 months
Re: [EPEL-devel] Mock/Copr default epel-8-* configuration to be changed
by Neal Gompa
On Thu, Nov 25, 2021 at 6:19 AM Nico Kadel-Garcia <nkadel(a)gmail.com> wrote:
>
> On Thu, Nov 25, 2021 at 3:05 AM Miroslav Suchý <msuchy(a)redhat.com> wrote:
> >
> > Dne 22. 11. 21 v 15:00 Pavel Raiskup napsal(a):
> > > Hello Fedora EPEL maintainers!
> > >
> > > First I don't feel comfortable announcing this, I'm not happy about the
> > > situation and so I don't want to be the lightning rod :-). But I believe
> > > that we can come to acceptable Copr/Mock solution and this needs to be
> > > discussed... so here we are.
> > >
> > > By the end of the year 2021 we have to fix our default EPEL 8 Mock
> > > configuration (mock-core-configs.rpm, /etc/mock/epel-8-*.cfg) as CentOS 8
> > > goes EOL by then.
> >
> >
> > I wrote down the possible options and their pros and cons and I done my best to catch all the feedback here.
> >
> > https://docs.google.com/document/d/1wF7-7_y6Ac_oB-kCFdE6VBWPW8o8zjXd2Z0SG...
> >
> > Miroslav
>
> That seems to be a succinct listing. I think you left out my
> suggestion.of "support people re-inventing point releases for CentOS",
> which is what major CentOS users will do using internal mirrors. due
> to concern about unexpected and unwelcome updates of CentOS Stream,
> while they assess whether AlmaLinux or Rocky are reliable and stable
> enough to use. It's not an uncommon behavior for EPEL itself, partly
> because of EPEL's bad habit of deleting RPMs without warning and
> stripping out all previous releases. That's caused me problems with
> chromium and firefox when updates were incompatible with contemporary
> regression testing systems.
>
It's not a "bad habit", it happens because when packages are retired,
keeping the packages there does a disservice to the community by
effectively forcing a maintenance burden when there's no maintainer.
As for stripping out previous releases, that's just how Pungi and
Bodhi do update composes at the moment. Someday that'll be fixed, but
then we'd have to come up with a policy on how many because there are
storage concerns for mirrors if we kept everything published forever.
> The difficulty with switching mock to AlmaLinux or Rocky is that there
> is likely to be significant phase lag with new point releases by Red
> Hat, and that it will inflict quite a bandwidth burden for all the
> "mock" setups in the field. Can they scale up to handle that?
Insofar as "phase lag with new point releases", AlmaLinux made their
release 48 hours after Red Hat did with RHEL. So, frankly, I'm not
worried there with AlmaLinux.
For bandwidth burdens, mirror networks are designed to alleviate that
burden and both have those in place.
--
真実はいつも一つ！/ Always, there's only one truth!
1 year, 6 months
Mock: how to get a client cert + key into the chroot?
by patrick+buildsys＠laimbock.com
Hi,
How do I get a client certificate + key into the mock chroot? Mock needs
access to a repo which requires the client to send its certificate
(nginx with ssl_verify_client on;).
If I copy the certificate and key to /etc/pki/tls/{certs,private} in the
bootstrap directory then the chroot picks them up and the repo is available.
Is there a way to specify the client certificate + key in a config
somewhere so they get picked up automatically?
Thanks!
Best,
Patrick
1 year, 6 months
