help with failing build

[Greg Sheremeta]

Anyone have an idea? This used to work fine. Perhaps something changed recently.

https://copr-be.cloud.fedoraproject.org/results/patternfly/patternfly-test/f...

"""
Error Downloading http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...: hostname 'www.patternfly.org' doesn't match either of '*.rhcloud.com', 'rhcloud.com'
"""

RPM is hosted on www.patternfly.org, which is an OpenShift site (rhcloud.com). Almost looks like copr is checking IPs.

(An rpm upload would be very nice... not sure why copr needs to pull rpms via http anyway.)

Thanks,
Greg

Greg Sheremeta
Red Hat, Inc.
Sr. Software Engineer, RHEV
Cell: 919-807-1086
[e-mail]

[Greg Sheremeta]

----- Original Message -----
> From: "Greg Sheremeta" 
> To: [e-mail]
> Cc: "Robb Hamilton" 
> Sent: Wednesday, January 28, 2015 4:29:05 PM
> Subject: help with failing build
>
> Anyone have an idea? This used to work fine. Perhaps something changed
> recently.
>
> https://copr-be.cloud.fedoraproject.org/results/patternfly/patternfly-test/f...
>
> """
> Error Downloading
> http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...:
> hostname 'www.patternfly.org' doesn't match either of '*.rhcloud.com',
> 'rhcloud.com'
> """
>
> RPM is hosted on www.patternfly.org, which is an OpenShift site
> (rhcloud.com). Almost looks like copr is checking IPs.
>
> (An rpm upload would be very nice... not sure why copr needs to pull rpms via
> http anyway.)
>
> Thanks,
> Greg
>
> Greg Sheremeta
> Red Hat, Inc.
> Sr. Software Engineer, RHEV
> Cell: 919-807-1086
> [e-mail]
> _______________________________________________
> copr-devel mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/copr-devel

The build appears to work if I use a different server to host the src rpm.

[Miroslav Suchý]

On 01/28/2015 10:29 PM, Greg Sheremeta wrote:
> Anyone have an idea? This used to work fine. Perhaps something changed recently.
>
> https://copr-be.cloud.fedoraproject.org/results/patternfly/patternfly-test/f...
>
> """
> Error Downloading http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...: hostname 'www.patternfly.org' doesn't match either of '*.rhcloud.com', 'rhcloud.com'
> """
>
> RPM is hosted on www.patternfly.org, which is an OpenShift site (rhcloud.com). Almost looks like copr is checking IPs.
>
> (An rpm upload would be very nice... not sure why copr needs to pull rpms via http anyway.)

This is problem in mockchain:

[mirek@triple//tmp]$ mockchain -r fedora-21-x86_64 
http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...
starting logfile: None
results dir: /var/tmp/mock-chain-mirek-6869-VkB2l5/results/fedora-21-x86_64
config dir: /var/tmp/mock-chain-mirek-6869-VkB2l5/configs/fedora-21-x86_64
Fetching 
http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...
Error Downloading 
http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...: 
hostname 'www.patternfly.org' doesn't match either of '*.rhcloud.com', 
'rhcloud.com'
Results out to: 
/var/tmp/mock-chain-mirek-6869-VkB2l5/results/fedora-21-x86_64
Pkgs built: 0

Can I as you please to file bug against mock? I will investigate it.

Mirek

[Miroslav Suchý]

On 01/29/2015 04:36 PM, Miroslav Suchy wrote:
> This is problem in mockchain:

I'm taking it back. This is completly correct.

curl 
http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...

will print you redirect to https variant:

https://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc2...

And the SSL certificate is issued only for '*.rhcloud.com', 
'rhcloud.com' and therefore does not match www.patternfly.org and python 
library refuse to download it. Which is completely correct.

Either please remove the http->https redirect or create SSL certificate 
which include www.patternfly.org (you have to have silver+ plan in 
OpenShift to do that) or just use different hosting (e.g. 
people.fedorahosted.org)

Mirek

[Greg Sheremeta]

Interesting -- I don't see that behavior in curl, and we actually
do have the proper cert installed for patternfly:

SSL Server Certificate
Issued To

Common Name (CN)	*.patternfly.org
Organization (O)	Red Hat Inc.
Organizational Unit (OU)	<Not Part Of Certificate>
Serial Number	02:51:C5:51:A1:11:D8:45:CA:B8:C1:FF:D8:3C:C2:D3

Maybe the cert isn't installed to all AWS locations properly? Very odd.
I'm in the eastern US.

Robb, looks like there is definitely some kind of patternfly.org
misconfiguration happening.

Thanks for the help, Mirek!

Greg

----- Original Message -----
> From: "Miroslav Suchy" 
> To: [e-mail]
> Sent: Thursday, January 29, 2015 10:43:35 AM
> Subject: Re: help with failing build
>
> On 01/29/2015 04:36 PM, Miroslav Suchy wrote:
> > This is problem in mockchain:
>
> I'm taking it back. This is completly correct.
>
> curl
> http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...
>
> will print you redirect to https variant:
>
> https://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc2...
>
> And the SSL certificate is issued only for '*.rhcloud.com',
> 'rhcloud.com' and therefore does not match www.patternfly.org and python
> library refuse to download it. Which is completely correct.
>
> Either please remove the http->https redirect or create SSL certificate
> which include www.patternfly.org (you have to have silver+ plan in
> OpenShift to do that) or just use different hosting (e.g.
> people.fedorahosted.org)
>
> Mirek
> _______________________________________________
> copr-devel mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/copr-devel

[Miroslav Suchý]

On 01/29/2015 07:09 PM, Greg Sheremeta wrote:
> Interesting -- I don't see that behavior in curl, and we actually
> do have the proper cert installed for patternfly:

Interesting. From browser I see too:
Common Name (CN)	*.patternfly.org

Here is full reproducer from CLI:

python -c 'import requests; 
requests.get("http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...")'

Traceback (most recent call last):
   File "<string>", line 1, in <module>
   File "/usr/lib/python2.7/site-packages/requests/api.py", line 55, in get
     return request('get', url, **kwargs)
   File "/usr/lib/python2.7/site-packages/requests/api.py", line 44, in 
request
     return session.request(method=method, url=url, **kwargs)
   File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 
456, in request
     resp = self.send(prep, **send_kwargs)
   File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 
585, in send
     history = [resp for resp in gen] if allow_redirects else []
   File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 
179, in resolve_redirects
     allow_redirects=False,
   File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 
559, in send
     r = adapter.send(request, **kwargs)
   File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 
382, in send
     raise SSLError(e, request=request)
requests.exceptions.SSLError: hostname 'www.patternfly.org' doesn't 
match either of '*.rhcloud.com', 'rhcloud.com'

curl 
http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a 
href="https://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20.src.rpm">here</a>.</p>
<hr>
<address>Apache/2.2.15 (Red Hat) Server at www.patternfly.org Port 
80</address>
</body></html>

I am not sure what going on.
I will try to dive deeper into requests module of python.

Mirek

[Greg Sheremeta]

----- Original Message -----
> From: "Miroslav Suchy" 
> To: "Cool Other Package Repositories" 
> Sent: Thursday, January 29, 2015 4:35:46 PM
> Subject: Re: help with failing build
>
> On 01/29/2015 07:09 PM, Greg Sheremeta wrote:
> > Interesting -- I don't see that behavior in curl, and we actually
> > do have the proper cert installed for patternfly:
>
> Interesting. From browser I see too:
> Common Name (CN)	*.patternfly.org
>
> Here is full reproducer from CLI:
>
> python -c 'import requests;
> requests.get("http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...")'
>
> Traceback (most recent call last):
>    File "<string>", line 1, in <module>
>    File "/usr/lib/python2.7/site-packages/requests/api.py", line 55, in get
>      return request('get', url, **kwargs)
>    File "/usr/lib/python2.7/site-packages/requests/api.py", line 44, in
> request
>      return session.request(method=method, url=url, **kwargs)
>    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line
> 456, in request
>      resp = self.send(prep, **send_kwargs)
>    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line
> 585, in send
>      history = [resp for resp in gen] if allow_redirects else []
>    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line
> 179, in resolve_redirects
>      allow_redirects=False,
>    File "/usr/lib/python2.7/site-packages/requests/sessions.py", line
> 559, in send
>      r = adapter.send(request, **kwargs)
>    File "/usr/lib/python2.7/site-packages/requests/adapters.py", line
> 382, in send
>      raise SSLError(e, request=request)
> requests.exceptions.SSLError: hostname 'www.patternfly.org' doesn't
> match either of '*.rhcloud.com', 'rhcloud.com'
>
> curl
> http://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20...
>
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
>
> <html><head>
> <title>302 Found</title>
> </head><body>
> <h1>Found</h1>
> <p>The document has moved <a
> href="https://www.patternfly.org/wp-content/uploads/rpmsrc/patternfly1-1.1.3-1.fc20.src.rpm">here</a>.</p>
> <hr>
> <address>Apache/2.2.15 (Red Hat) Server at www.patternfly.org Port
> 80</address>
> </body></html>
>
> I am not sure what going on.
> I will try to dive deeper into requests module of python.
>
> Mirek
> _______________________________________________
> copr-devel mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/copr-devel

Thanks. Robb is also reaching out to the OpenShift team to see if they have
any ideas.

Not a huge deal for us for this build, but something worth looking into.

Greg

[Miro Hrončok]

The problem is, that apps on OpenShift use SNI to enable custom domain
names with custom certificates. Which is a standard for a bazillion
years and the only thing that does not support it is Windows XP with IE
6 and... ehm, Python 2.

http://en.wikipedia.org/wiki/Server_Name_Indication

On Python 3 with request, this is completely supported. However, on
Python 2, there's a workaround needed. You'll need the following to use
SNI from requests:

requests>=2.3.0
ndg_httpsclient>=0.3.2
pyOpenSSL>=0.14
pyasn1>=0.1.7

On Fedora 21, for example, this is all available in the following packages:

python-requests
python-ndg_httpsclient
pyOpenSSL
python-pyasn1

See:

*
http://docs.python-requests.org/en/latest/community/faq/#what-are-hostname-d...
 *
https://stackoverflow.com/questions/18578439/using-requests-with-tls-doesnt-...

[Miroslav Suchý]

On 01/30/2015 12:16 PM, Miro Hrončok wrote:
> The problem is, that apps on OpenShift use SNI to enable custom domain
> names with custom certificates. Which is a standard for a bazillion
> years and the only thing that does not support it is Windows XP with IE
> 6 and... ehm, Python 2.
>
> http://en.wikipedia.org/wiki/Server_Name_Indication
>
> On Python 3 with request, this is completely supported. However, on
> Python 2, there's a workaround needed. You'll need the following to use
> SNI from requests:

Excelent!
> pyOpenSSL>=0.14

Not available on F21 :(

[Miro Hrončok]

Dne 30.1.2015 v 13:37 Miroslav Suchý napsal(a):
> > pyOpenSSL>=0.14
>
> Not available on F21 :(

That's weird. I have it working with 0.13 but it doesn't work in virtual
machine. I'm going to investigate.

[Miro Hrončok]

Dne 30.1.2015 v 14:40 Miro Hrončok napsal(a):
> That's weird. I have it working with 0.13 but it doesn't work in virtual
> machine. I'm going to investigate.

Ok, uninstalling and installing pyOpenSSL package reintroduced the
behavior (SNI not working)

However pyOpenSSL form rawhide is installable and makes SNI work.