devel-announce December 2024

devel-announce@lists.fedoraproject.org

5 participants
35 discussions

F42 Change Proposal: Firewalld IPv6_rpfilter default to loose on Workstations (self-contained)
by Aoife Moloney 03 Dec '24

03 Dec '24

Wiki - https://fedoraproject.org/wiki/Changes/Firewalld_IPv6_rpfilter_Default_Loose Discussion Thread - https://discussion.fedoraproject.org/t/f42-change-proposal-firewalld-ipv6-r… This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Default firewalld to using `IPv6_rpfilter=loose` for new Workstation installs. == Owner == * Name: [[User:erig0| Eric Garver]] * Email: egarver(a)redhat.com == Detailed Description == Fedora Workstation variants use connectivity checks by default. These checks can fail for multi-homed hosts where firewalld uses `IPv6_rpfilter=strict`. As such, for these variants we should instead default to `IPv6_rpfilter=loose` to allow connectivity checks to function as intended. Bug: https://bugzilla.redhat.com/show_bug.cgi?id=2324434 For IPv4 the rpfilter setting is already set to loose by default on all editions starting with Fedora 30. See: https://github.com/systemd/systemd/commit/230450d4e4f1f5fc9fa4295ed9185eea5… == Feedback == == Benefit to Fedora == The benefit is that connectivity checks will work properly on multi-homed, e.g. wifi + LAN, workstations. This helps avoid certain scenarios that can degrade user experience when switching between modes of connectivity. == Scope == * Proposal owners: The change is a small patch in the RPM spec file. The only affected file will be `/etc/firewalld/firewalld.conf`. * Other developers: N/A * Release engineering: N/A [https://pagure.io/releng/issues #Releng issue number] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: == Upgrade/compatibility impact == For systems upgrading to f42, the new value of `IPv6_rpfilter` depends on whether the user has customized `/etc/firewalld/firewalld.conf`. If no, then the RPM upgrade process will update the configuration to `IPv6_rpfilter=loose`. If yes, then the user configuration will be retained. It's important to note that this change is a deviation from firewalld upstream. Firewalld upstream will still default to `IPv6_rpfilter=strict`. == Early Testing (Optional) == Do you require 'QA Blueprint' support? N == How To Test == No special hardware is required. A default Workstation should be sufficient. Testing requires multiple network interfaces with internet access. Connectivity checks must be enabled (default). Tester must verify that the connectivity checks pass for both links. == User Experience == Connectivity checks work properly for multiple interfaces. There is one specific scenario in which a non-functioning connectivity check can lead to a degraded user experience: A user with a laptop that is connected to their home WiFi connects said laptop to their home network using Ethernet, for example to transfer a larger file to a network drive. The user's home network provides internet access using both IPv4 and IPv6 addressing. The user expects the Ethernet connection to take precedence over the already established WiFi connection. However, due to the `IPv6_rpfilter=strict` setting the IPv6 connectivity check fails and the Ethernet connection is deemed not connected to the internet. NetworkManager thus adds a penalty to the Ethernet interface's routing metric resulting in traffic to the local network and the internet preferring the WiFi interface over the Ethernet interface. If the WiFi connection is slower than the Ethernet connection this will lead to a degraded performance when transferring that large file. == Dependencies == No dependencies. == Contingency Plan == * Contingency mechanism: Keep existing default of `IPv6_rpfilter=strict`. * Contingency deadline: beta freeze * Blocks release? No == Documentation == https://bugzilla.redhat.com/show_bug.cgi?id=2324434 == Release Notes == Connectivity checks now work properly for multi-homed Workstations. -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney

1 0

F42 Change Proposal: Fedora WSL (Self-Contained)
by Aoife Moloney 03 Dec '24

03 Dec '24

Wiki - https://fedoraproject.org/wiki/Changes/FedoraWSL Discussion Thread - https://discussion.fedoraproject.org/t/f42-change-proposal-fedora-wsl-self-… This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. = Create Fedora Windows Subsystem for Linux Images = == Summary == Recent versions of Windows support running Linux guests via Windows Subsystem for Linux (WSL). These can be distributed via tarballs, Appx packages, or via the Windows Store. The purpose of this change is to start producing Fedora images for users of WSL. Distributing images via the Windows Store requires agreeing to the store policies and developer agreement, which is something Fedora has historically not been comfortable with. This change proposal is to distribute a tarball. In recent versions of WSL (version 2.4.4 and greater), the user experience has been greatly improved for WSL images outside the store. These include allowing tarballs to distribute first-time setup scripts and icons as part of the distribution instead of as a Windows application, as well as click-to-install support for tarballs using the ".wsl" file extension. Therefore, this proposal will work best with version 2.4.4+ of WSL, although documentation will be provided for users on older releases. == Owner == * Name: [[User:jcline| Jeremy Cline]] * Name: [[Cloud SIG]] * Email: jeremy(a)jcline.org == Detailed Description == Recent versions of Windows support running Linux distributions using [https://learn.microsoft.com/en-us/windows/wsl/about Windows Subsystem for Linux] (WSL). In the latest version, WSL 2, a single virtual machine is managed by the Windows host and guest Linux distributions run as containers within it. For basic WSL support, Fedora needs to distribute a root filesystem tarball. The Fedora base container can already be used with WSL, but it is not ideal as it intentionally excludes documentation and non-essential tools. There also isn't official documentation on how to use it with WSL. The goal of this change is to complete the following: * Add a WSL variant to https://src.fedoraproject.org/rpms/fedora-release/ * Provide a [https://learn.microsoft.com/en-us/windows/wsl/build-custom-distro#add-the-w… WSL configuration file and out-of-the-box experience script] * Create a [https://pagure.io/fedora-kiwi-descriptions/ Kiwi definition] to produce a WSL root filesystem tarball. * Write documentation on how to use the tarball with WSL. * Add our images to the [https://learn.microsoft.com/en-us/windows/wsl/build-custom-distro#adding-yo… WSL distribution list] so users can install it with the "wsl --install Fedora" command. Optionally, we can include a section on fedoraproject.org to ensure users can discover our WSL image. == Feedback == == Benefit to Fedora == A dedicated image with documentation allows people to easily try out a Fedora environment from their Windows installations. When it comes time to install a Linux distribution on their computer, they can be more confident when choosing Fedora. == Scope == * Proposal owners: * Other developers: * Release engineering: [https://pagure.io/releng/issues #Releng issue number] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with Community Initiatives: == Upgrade/compatibility impact == == How To Test == For WSL versions 2.4.4+: # Have access to a Windows installation with WSL 2.4.4+ # Run "wsl --install Fedora" # Enter the environment by running "wsl -d Fedora" # Use the interactive out-of-the-box experience script to set up a new user # Install some applications, start some services, see if things fall over. For WSL versions prior to 2.4.4: # Have access to a Windows 10 or 11 installation (VMs should work) # On the Windows host, download the WSL tarball from <somewhere> # Open up a Windows terminal and install WSL itself with "wsl --install" # Import the WSL tarball with "wsl --import Fedora C:\Users\<username>\AppData\Local\WSL\Fedora .\Path\To\Fedora.x86_64.tar.xz" # Enter the environment with "wsl -d Fedora -u root" # manually execute the interactive out-of-the-box experience script to set up a new user # Install some applications, start some services, see if things fall over. == User Experience == == Dependencies == == Contingency Plan == * Contingency mechanism: Don't ship the tarball * Contingency deadline: N/A (not a System Wide Change) * Blocks release? No == Documentation == Add a section somewhere in https://docs.fedoraproject.org/ (perhaps quick docs) with a short guide on installing the tarball. This will cover both older versions of WSL which require more manual steps as well as the newer, easier method of installation. == Release Notes == -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney

1 0

F42 Change Proposal: Switch to git-core (self-contained)
by Aoife Moloney 03 Dec '24

03 Dec '24

Wiki - https://fedoraproject.org/wiki/Changes/ChangeToGitCore Discussion Thread - https://discussion.fedoraproject.org/t/f42-change-proposal-switch-to-git-co… This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. = Switch to git-core = == Summary == Packages that only require `git` binary should depend on `git-core` and not on the `git` package. == Owner == * Name: [[User:Mikelo2| Mikel Olasagasti]] * Email: mikel at olasagasti.info == Detailed Description == Many package have either requirement or build requirement for the `git` binary. The `git` package is complex and is divided in mulitple subpackages. The subpackage that contains the `git` binary, that is enough for most of the use cases, is part of the `git-core` subpackage. In a fresh rawhide image `git-core` package installs 10 packages and requires 8 MiB, while `git` package requires 77 packages and 19 MiB. The proposed change would be to open Pull Requests against each package to switch to `git-core` and, when possible, test it before the PR is accepted. Currently around 230 packages have `git` as `BuildRequires` and another 60 as `Requires`. Verified using [https://src.fedoraproject.org/lookaside/rpm-specs-latest.tar.xz latest spec archive snapshot] available. <pre> $ cd /tmp/ $ wget https://src.fedoraproject.org/lookaside/rpm-specs-latest.tar.xz $ tar xf rpm-specs-latest.tar.xz $ cd /tmp/rpm-specs $ grep -E '^BuildRequires:\s*git$' *.spec |wc -l 236 $ grep -E '^Requires:\s*git$' *.spec |wc -l 61 </pre> * Installing `git-core` <pre> # dnf install git-core Updating and loading repositories: Repositories loaded. Package Arch Version Repository Size Installing: git-core x86_64 2.47.0-1.fc42 rawhide 22.6 MiB Installing dependencies: expat x86_64 2.6.4-1.fc42 rawhide 285.5 KiB less x86_64 668-1.fc42 rawhide 406.4 KiB libcbor x86_64 0.11.0-2.fc41 rawhide 73.9 KiB libedit x86_64 3.1-53.20240808cvs.fc41 rawhide 244.1 KiB libfdisk x86_64 2.40.2-8.fc42 rawhide 362.9 KiB libfido2 x86_64 1.15.0-2.fc41 rawhide 238.2 KiB openssh x86_64 9.9p1-5.fc42 rawhide 1.4 MiB openssh-clients x86_64 9.9p1-5.fc42 rawhide 2.7 MiB util-linux x86_64 2.40.2-8.fc42 rawhide 3.7 MiB Transaction Summary: Installing: 10 packages Total size of inbound packages is 8 MiB. Need to download 8 MiB. After this operation, 32 MiB extra will be used (install 32 MiB, remove 0 B). </pre> * Installing `git` <pre> # dnf install git Updating and loading repositories: Repositories loaded. Package Arch Version Repository Size Installing: git x86_64 2.47.0-1.fc42 rawhide 85.2 KiB Installing dependencies: expat x86_64 2.6.4-1.fc42 rawhide 285.5 KiB git-core x86_64 2.47.0-1.fc42 rawhide 22.6 MiB git-core-doc noarch 2.47.0-1.fc42 rawhide 17.2 MiB groff-base x86_64 1.23.0-7.fc41 rawhide 3.8 MiB less x86_64 668-1.fc42 rawhide 406.4 KiB libcbor x86_64 0.11.0-2.fc41 rawhide 73.9 KiB libedit x86_64 3.1-53.20240808cvs.fc41 rawhide 244.1 KiB libfdisk x86_64 2.40.2-8.fc42 rawhide 362.9 KiB libfido2 x86_64 1.15.0-2.fc41 rawhide 238.2 KiB ncurses x86_64 6.5-2.20240629.fc41 rawhide 627.3 KiB openssh x86_64 9.9p1-5.fc42 rawhide 1.4 MiB openssh-clients x86_64 9.9p1-5.fc42 rawhide 2.7 MiB perl-AutoLoader noarch 5.74-512.fc42 rawhide 20.5 KiB perl-B x86_64 1.89-512.fc42 rawhide 498.0 KiB perl-Carp noarch 1.54-511.fc41 rawhide 46.6 KiB perl-Class-Struct noarch 0.68-512.fc42 rawhide 25.4 KiB perl-Data-Dumper x86_64 2.189-512.fc41 rawhide 111.7 KiB perl-Digest noarch 1.20-511.fc41 rawhide 35.3 KiB perl-Digest-MD5 x86_64 2.59-5.fc41 rawhide 59.8 KiB perl-DynaLoader x86_64 1.56-512.fc42 rawhide 32.1 KiB perl-Encode x86_64 4:3.21-511.fc41 rawhide 4.7 MiB perl-Errno x86_64 1.38-512.fc42 rawhide 8.4 KiB perl-Error noarch 1:0.17029-16.fc41 rawhide 77.3 KiB perl-Exporter noarch 5.78-511.fc41 rawhide 54.3 KiB perl-Fcntl x86_64 1.18-512.fc42 rawhide 49.0 KiB perl-File-Basename noarch 2.86-512.fc42 rawhide 14.0 KiB perl-File-Find noarch 1.44-512.fc42 rawhide 41.9 KiB perl-File-Path noarch 2.18-511.fc41 rawhide 63.5 KiB perl-File-Temp noarch 1:0.231.100-511.fc41 rawhide 162.3 KiB perl-File-stat noarch 1.14-512.fc42 rawhide 12.5 KiB perl-FileHandle noarch 2.05-512.fc42 rawhide 9.3 KiB perl-Getopt-Long noarch 1:2.58-2.fc41 rawhide 144.5 KiB perl-Getopt-Std noarch 1.14-512.fc42 rawhide 11.2 KiB perl-Git noarch 2.47.0-1.fc42 rawhide 64.0 KiB perl-HTTP-Tiny noarch 0.090-1.fc42 rawhide 154.4 KiB perl-IO x86_64 1.55-512.fc42 rawhide 151.1 KiB perl-IO-Socket-IP noarch 0.42-512.fc41 rawhide 98.7 KiB perl-IO-Socket-SSL noarch 2.089-1.fc42 rawhide 703.3 KiB perl-IPC-Open3 noarch 1.22-512.fc42 rawhide 22.5 KiB perl-MIME-Base32 noarch 1.303-21.fc41 rawhide 30.7 KiB perl-MIME-Base64 x86_64 3.16-511.fc41 rawhide 46.1 KiB perl-Net-SSLeay x86_64 1.94-7.fc41 rawhide 1.3 MiB perl-POSIX x86_64 2.20-512.fc42 rawhide 235.1 KiB perl-PathTools x86_64 3.91-511.fc41 rawhide 180.0 KiB perl-Pod-Escapes noarch 1:1.07-511.fc41 rawhide 24.9 KiB perl-Pod-Perldoc noarch 3.28.01-512.fc41 rawhide 163.7 KiB perl-Pod-Simple noarch 1:3.45-511.fc41 rawhide 560.9 KiB perl-Pod-Usage noarch 4:2.03-511.fc41 rawhide 84.8 KiB perl-Scalar-List-Utils x86_64 5:1.68-1.fc42 rawhide 148.9 KiB perl-SelectSaver noarch 1.02-512.fc42 rawhide 2.2 KiB perl-Socket x86_64 4:2.038-511.fc41 rawhide 124.0 KiB perl-Storable x86_64 1:3.32-511.fc41 rawhide 232.4 KiB perl-Symbol noarch 1.09-512.fc42 rawhide 6.8 KiB perl-Term-ANSIColor noarch 5.01-512.fc41 rawhide 97.5 KiB perl-Term-Cap noarch 1.18-511.fc41 rawhide 29.3 KiB perl-TermReadKey x86_64 2.38-23.fc41 rawhide 64.1 KiB perl-Text-ParseWords noarch 3.31-511.fc41 rawhide 13.6 KiB perl-Text-Tabs+Wrap noarch 2024.001-511.fc41 rawhide 22.6 KiB perl-Time-Local noarch 2:1.350-511.fc41 rawhide 69.0 KiB perl-URI noarch 5.31-1.fc42 rawhide 257.0 KiB perl-base noarch 2.27-512.fc42 rawhide 12.5 KiB perl-constant noarch 1.33-512.fc41 rawhide 26.2 KiB perl-if noarch 0.61.000-512.fc42 rawhide 5.8 KiB perl-interpreter x86_64 4:5.40.0-512.fc42 rawhide 122.3 KiB perl-lib x86_64 0.65-512.fc42 rawhide 8.5 KiB perl-libnet noarch 3.15-512.fc41 rawhide 289.4 KiB perl-libs x86_64 4:5.40.0-512.fc42 rawhide 9.9 MiB perl-locale noarch 1.12-512.fc42 rawhide 6.5 KiB perl-mro x86_64 1.29-512.fc42 rawhide 45.6 KiB perl-overload noarch 1.37-512.fc42 rawhide 71.5 KiB perl-overloading noarch 0.02-512.fc42 rawhide 4.8 KiB perl-parent noarch 1:0.242-1.fc42 rawhide 10.0 KiB perl-podlators noarch 1:6.0.2-2.fc41 rawhide 317.5 KiB perl-vars noarch 1.05-512.fc42 rawhide 3.9 KiB util-linux x86_64 2.40.2-8.fc42 rawhide 3.7 MiB Installing weak dependencies: perl-NDBM_File x86_64 1.17-512.fc42 rawhide 32.5 KiB Transaction Summary: Installing: 77 packages Total size of inbound packages is 19 MiB. Need to download 19 MiB. After this operation, 75 MiB extra will be used (install 75 MiB, remove 0 B). </pre> == Packages to review == === BuildRequire on git === <pre> $ grep -E '^BuildRequires:\s*git$' *.spec |cut -d ":" -f1 |sed 's:.spec::' 4Pane accountsservice adobe-mappings-cmap adobe-mappings-pdf ansible-bender anthy-unicode apptainer audacity bicon booth budgie-desktop build2 buildbot buildbox cantera capstone clipit clover2 cmake compat-readline6 container-storage-setup copr-rpmbuild crawl dc3dd dcm2niix delve diffoscope diff-so-fancy ding-libs dionaea doctest domoticz dosbox-staging dotnet8.0 dotnet9.0 doxygen edk2 efivar elixir enigma execstack fedpkg findutils fprintd fragments freeipa fros gawk gcab gdb-gef ghostscript git-annex git-cinnabar git-cola gmp gnome-extensions-app gnome-kiosk gnome-shell-extension-background-logo gnome-shell-extension-no-overview gnome-shell-extensions gnome-shell gnulib gotcha gpicview gqrx grilo-plugins grilo grub2 gssproxy hexchat-autoaway hipblaslt hipblas hiprand hpx ibus-anthy ibus-engine-gui-ci ibus-input-pad ibus-qt ibus iguanaIR initscripts intel-igc jd kmplot krb5 libabigail libblkio libcdson libcpuid libemu libfm libfprint libgovirt libijs libmongocrypt libosinfo libpcap libptytty libverto libvirt llama-cpp logrotate lxmusic lxpanel lxtask lxterminal maeparser malcontent mcomix3 mingw-pcre mingw-pdcurses mingw-portablexdr mingw-spice-gtk mingw-wine-gecko minicom mod_auth_gssapi mokutil mot-adms mpdscribble mpris-scrobbler muon-meson mysql-connector-java nano nbdkit nekovm netdata netgen-mesher newsboat ngspice nss-altfiles numberstation ocaml oci-seccomp-bpf-hook opencsd osbuild-composer osinfo-db-tools ostree pacemaker pack pam_wrapper parted pass-otp pcmanfm perl-Git-CPAN-Patch perl-Git-Repository perl-SOAP-WSDL perl-Sys-Virt pesign polkit poppler-data procps-ng psacct psmisc pure-ftpd python-breathe python-cookiecutter python-dbusmock python-dictdiffer python-dictdiffer python-gitapi python-git-revise python-google-auth python-kdcproxy python-murano-pkg-check python-openshift python-openshift python-os-client-config python-os-service-types python-pdm-pep517 python-pyside6 python-rosdistro python-rpmaut.spec python-rsdclient python-scikit-build-core python-setuptools_git python-shade python-sphinxcontrib-programoutput python-tinyrpc python-vcstool python-virtualbmc python-vobject python-yappi qemu qmc2 qtile-extras qtl866 qtpass racket rbenv rear repo reposurgeon reuse rocblas rocrand rpi-imager rpkg-macros rubygem-coveralls rubygem-pdfkit rubygem--core.spec rubygem--expectations.spec rubygem--mocks.spec rubygem--support.spec rubygem-sugarjar rxvt-unicode shadow-utils sile stargz-snapshotter syslinux sysstat tcsh timg tito tpm2-abrmd-selinux transifex-client udev-hid-bpf umockdev unclutter-xfixes unixODBC-gui-qt upower urw-base35-fonts vcs-diff-lint vcsh vhostmd virt-what vsftpd vxl vyper wasmedge web-eid webkit2gtk4.0 webkitgtk xmms2 xscreensaver yajl yara </pre> === Require on git === <pre> grep -E '^Requires:\s*git$' *.spec |cut -d ":" -f1 |sed 's:.spec::' anjuta bodhi-server build2 build2 build2 buildstream-plugins cekit clang13 clang15 clang17 clang18 cmake-fedora copr-rpmbuild dgit dist-git eg git2cl git-archive-all git-cola git-crypt git-evtag git-extras git-ftp gitolite3 git-tools gitweb-caching kdevelop llvm multi-git-status myrepos nfsometer packit perl-App-grindperl perl-Bisect-Perl-UsingGit perl-Code-TidyAll perl-Git-CPAN-Patch perl-Git-CPAN-Patch perl-Git-Repository perl-Menlo php-phpunit-git php-phpunit-Version php-sebastian-version3 php-sebastian-version4 pmbootstrap pungi python-diff-cover python-gitapi python-git-revise python-git-revise rancid repo rpkg-macros rpmgrill rubygem-sugarjar snotes source-to-image teamgit thunar-vcs-plugin vcs-diff-lint vcsh xfce4-dev-tools </pre> == Feedback == This change has been already proposed for `packit` in [https://src.fedoraproject.org/rpms/packit/pull-request/1307 PR1307], it was accepted [https://github.com/packit/packit/pull/2444 upstream] and will be part of F42. In November 2020 a [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… suggestion to switch to git-core] was discussed in the Development list. == Benefit to Fedora == For users it will reduce the amount of packages installed as transient dependency of the main package. For developers it should make builds a few seconds faster. Tests with podman on a local machine (i7-1270P) show 1 to 6 seconds less are required to install `git-core` vs `git`. == Scope == * Proposal owners: * Other developers: * Release engineering: [https://pagure.io/releng/issues #Releng issue number] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: == Upgrade/compatibility impact == == How To Test == * For those packages that have `git` as BuildRequire, testing the build can be automated using copr. Plan would be to fork the packages, switch to `git-core`, commit in the fork and build it in Copr. If builds fine open a PR. * For those packages that have `git` as Require, switch package to use `git-core` and test git related functionality. == User Experience == == Dependencies == None. == Contingency Plan == * Contingency mechanism: N/A * Contingency deadline: N/A * Blocks release? N/A == Documentation == N/A (not a System Wide Change) == Release Notes == -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney

2 1

F42 Change Proposal: DNF5 Expired Keys (System-Wide)
by Aoife Moloney 03 Dec '24

03 Dec '24

Wiki - https://fedoraproject.org/wiki/Changes/Dnf5ExpiredPGPKeys Discussion Thread - https://discussion.fedoraproject.org/t/f42-change-proposal-dnf5-expired-key… This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Implementing new logic in DNF5 to remove expired and obsolete repository keys from the system. == Owner == * Name: [[User:jkolarik| Jan Kolarik]] * Email: jkolarik(a)redhat.com == Detailed Description == We aim to address customer issues when installing RPM packages from repositories while outdated repository keys are present on the system. These issues include expired keys, obsolete signing algorithms (e.g., SHA1), or other problems that could be easily detected by tools like an RPM PGP linter. Currently, PGP checks fail, and users must manually remove expired keys using commands like `rpmkeys --delete`. The proposed solution is a new LIBDNF5 plugin. This plugin will act as a hook, checking for invalid repository PGP keys on the system before executing a DNF transaction. * '''Interactive mode''': The plugin will prompt the user to confirm the removal of each invalid key. * '''Non-interactive mode''' (e.g., with `-y` or `--assumeno`): The plugin will proceed automatically based on the specified user action, either removing the keys or retaining them. By default, this behavior will be enabled in DNF5, with the option to disable it through configuration. This enhancement stems from a request in [https://github.com/rpm-software-management/dnf5/issues/1192 upstream issue] and builds upon [https://github.com/rpm-software-management/dnf-plugins-core/pull/533 the existing solution in DNF4]. Unlike DNF4's implementation, which is not enabled by default, this change will be integral to the default DNF5 functionality, aligning with its role as the primary package manager in Fedora. == Feedback == The proposed solution has been discussed with affected users, including the Mock and Copr teams, as part of the discussions around [https://github.com/rpm-software-management/dnf-plugins-core/pull/533 the existing solution in DNF4]. == Benefit to Fedora == This change enables the automatic management of repository keys during software installation or upgrades. == Scope == * Proposal owners: ** Implement a new LIBDNF5 plugin to manage repository PGP keys automatically. * Other developers: ** No additional work identified at this time. * Release engineering: [https://pagure.io/releng/issue/12477 #12477] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) == Upgrade/compatibility impact == No compatibility or upgrade issues expected. == How To Test == A good reproducer is already described in [https://github.com/rpm-software-management/dnf5/issues/1192#issuecomment-20… this comment] within the upstream issue. You can list all installed key hashes along with their names using: `rpmkeys --list` To query the key block info, use: `rpm -q --qf "%{DESCRIPTION}" gpg-pubkey-<KEYHASH>` (note: `rpmkeys --export <KEYHASH>` on newer RPM releases) To get the end date in a human-readable format, run: `rpm -q --qf "%{DESCRIPTION}" gpg-pubkey-<KEYHASH> | gpg --show-keys --with-colon | cut -d':' -f7 | xargs -I{} date -d @{} ` Note that not all keys have a defined end of validity date. You can also try running a transaction using a COPR repository with the `faketime` command from `libfaketime`: `faketime '+10years' dnf install <pkg_name_from_copr>` The above should fail without the functionality introduced by this proposal. After deploying the new plugin, it should prompt the user about the expired PGP key and ask for removal. == User Experience == For interactive users, a prompt will appear informing them about each outdated key on the system and asking for confirmation to remove it. For non-interactive users, there will be no change to the workflow. == Dependencies == No additional work is expected. == Contingency Plan == * Contingency mechanism: Disable the new plugin from running by default. * Contingency deadline: Fedora 42 branching from Rawhide * Blocks release? No == Documentation == The new behavior will be documented in the upstream DNF5 documentation. == Release Notes == -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney

1 0

F42 Change Proposal: Deprecate pam-ssh-agent component (self-contained)
by Aoife Moloney 03 Dec '24

03 Dec '24

Wiki - https://fedoraproject.org/wiki/Changes/DeprecatePamSshAgent Discussion Thread - https://discussion.fedoraproject.org/t/f42-change-proposal-deprecate-pam-ss… This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Drop pam_ssh_agent_auth component from Fedora 42 == Owner == * Name: [[User:Dbelyavs| Dmitry Belyavskiy]] * Email: dbelyavs(a)redhat.com == Detailed Description == pam_ssh_agent_auth is a subpackage of openssh developed separately. Last years its development has effectively stopped and we are not aware of it being used actively. The goal of this proposal is to drop this package (as it will be done in RHEL10) to reduce the maintenance burden. == Feedback == == Benefit to Fedora == * Removing a package of limited use and maintenance * Reducing the maintenance burden == Scope == * Proposal owners: remove the corresponding files from OpenSSH package * Other developers: * Release engineering: [https://pagure.io/releng/issues #Releng issue number] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: == Upgrade/compatibility impact == The users can still use this package from previous distributions if they really need it. == Early Testing (Optional) == Do you require 'QA Blueprint' support? N == How To Test == == User Experience == I expect the user experience effects to be minor because of quite limited usage of this package == Dependencies == None == Contingency Plan == There are 2 relevant options: * Return the previous state of the package * build a more modern alternative, pam_rssh, https://github.com/z4yx/pam_rssh, for Fedora * Blocks release? No == Documentation == N/A (not a System Wide Change) == Release Notes == We drop pam_ssh_agent_auth module -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

devel-announce December 2024