i686 build OOMing
by David Airlie
https://kojipkgs.fedoraproject.org//work/tasks/3814/68223814/build.log
cd /builddir/build/BUILD/Vulkan-ValidationLayers-sdk-1.2.176.1/i686-redhat-linux-gnu/layers
&& /usr/bin/g++ -DAPI_NAME=\"Vulkan\" -DVK_ENABLE_BETA_EXTENSIONS
-DVK_USE_PLATFORM_WAYLAND_KHR -DVK_USE_PLATFORM_WAYLAND_KHX
-DVK_USE_PLATFORM_XCB_KHR -DVK_USE_PLATFORM_XCB_KHX
-DVK_USE_PLATFORM_XLIB_KHR -DVK_USE_PLATFORM_XLIB_KHX
-DVK_USE_PLATFORM_XLIB_XRANDR_EXT -DVkLayer_khronos_validation_EXPORTS
-I/builddir/build/BUILD/Vulkan-ValidationLayers-sdk-1.2.176.1/layers
-I/builddir/build/BUILD/Vulkan-ValidationLayers-sdk-1.2.176.1/layers/generated
-I/usr/include/glslang -I/usr/include/spirv/include
-I/builddir/build/BUILD/Vulkan-ValidationLayers-sdk-1.2.176.1/i686-redhat-linux-gnu
-I/builddir/build/BUILD/Vulkan-ValidationLayers-sdk-1.2.176.1/i686-redhat-linux-gnu/layers
-O2 -flto=auto -ffat-lto-objects -fexceptions -g1
-grecord-gcc-switches -pipe -Wall -Werror=format-security
-Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS
-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
-fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
-m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign
-fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
-Wpointer-arith -Wno-unused-function -Wno-sign-compare -DNDEBUG -fPIC
-Wall -Wextra -Wno-unused-parameter -Wno-missing-field-initializers
-fno-strict-aliasing -fno-builtin-memcmp -fvisibility=hidden
-Wimplicit-fallthrough=0 -std=gnu++11 -MD -MT
layers/CMakeFiles/VkLayer_khronos_validation.dir/generated/chassis.cpp.o
-MF CMakeFiles/VkLayer_khronos_validation.dir/generated/chassis.cpp.o.d
-o CMakeFiles/VkLayer_khronos_validation.dir/generated/chassis.cpp.o
-c /builddir/build/BUILD/Vulkan-ValidationLayers-sdk-1.2.176.1/layers/generated/chassis.cpp
cc1plus: out of memory allocating 65536 bytes after a total of 3310292992 bytes
We already use -g1 to try and reduce memory usage, and I tried not
doing parallel jobs in case it was too much? any suggestions, is this
LTO?
Dave.
3 years
F35 Change: Drop the the "Allow SSH root login with password" option
from the installer GUI (Self-Contained Change proposal)
by Ben Cotton
https://fedoraproject.org/wiki/Changes/Drop_Rootpw_SSH_From_Installer
== Summary ==
Since 2019 the Anaconda installer GUI hosted an option called "Allow
SSH root login with password", that made it possible to enable
password based root logins over SSH on the installed system. This was
always meant as a temporary option to help users transition to either
using key authentication or normal users with admin privileges. And
after two years of transition period it is now time to drop the option
from the GUI.
== Owner ==
* Name: [[User:M4rtink| Martin Kolman]]
== Detailed Description ==
At the moment the Anaconda installer used by Fedora contains an option
called "Allow SSH root login with password" on the root password
configuration screen.
This is how it looks like at the moment, on latest Fedora Rawhide
installer image:
https://m4rtink.fedorapeople.org/screenshots/fedora/rawhide_f35/root_pass...
For some backstory - in 2015 the OpenSSH upstream decided to disable
password based root logins by default. This was done for security
reasons as an attacker needs to only guess password to gain access to
the root account. For a user account the attacker needs to guess both
the username and password and the user account not even have admin
privileges, making the remote password guessing attack both harder and
less useful.
The Fedora OpenSSH package carried downstream patches to revert this
upstream change up until summer 2019 when it was decided to restore the
upstream behavior and drop the downstream patches as enough tools that
required password based SSH login have been migrated to use either key
authentication or user based login methods.
Now back to the "Allow SSH root login with password" checkbox in
the installer GUI. :)
The option was added in 2019 when Fedora disabled password based root
SSH login by default, as a temporary migration aid for users of the
graphical installer.
Note that the checkbox is not ticked by default, the user needs to make
a conscious choice to allow this security problematic SSH login
behavior.
Now fast forward to today, it's 2021, any use cases that needed
password based root login via SSH had 2 more years to migrate while the
amount of password guessing attacks certainly didn't get any lower.
For that reason we in the Anaconda development team feel like it's a
good time to finally drop the "Allow SSH root login with password" from
the Anaconda GUI.
== Feedback ==
* it has been suggested to keep the "Allow SSH root login with
password" available per Fedora variant (eq. for Fedora Server, etc.) -
this is doable at the cost of some code complexity and we can consider
doing that if there is enough demand & confirmation the given SiG is
OK with it
* it has been suggested that making it easier to import SSH keys from
popular code hosting platforms (Pagure, GitHub, GitLab, etc.) could
provide a nice alternative to the dropped option - this seems like a
nice idea, but it's unclear if any Anaconda team members will have
time to work on this before F35 release; on the other hand, (good)
patches welcome! :)
== Benefit to Fedora ==
This change makes the Fedora systems installed by Anaconda more secure
from remote password guessing attacks targeting the root account as it
would no longer be possible to configure a system that allows root to
login via SSH with password.
A smaller benefit is making the root password configuration screen
less confusing by removing the "Allow SSH root login with password" &
Anaconda code cleanup related removing code related to setting up the
override in sshd.
== Scope ==
* Proposal owners:
Remove the "Allow SSH root login with password" and any related
backend code that configures the sshd override.
* Other developers:
* Release engineering:
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
== How To Test ==
Boot a Fedora netinst image, enter the root password configuration
screen. Check that "Allow SSH root login with password" option is not
present.
== User Experience ==
The users will no longer be able to use the unsecure "Allow SSH root
login with password" option on the root password configuration screen
of the installer and the root password configuration screen will be a
bit cleaner.
== Dependencies ==
== Contingency Plan ==
Revert the commit that removes the "Allow SSH root login with
password" option and do a new Anaconda build.
* Contingency mechanism: (What to do? Who will do it?) N/A (not a
System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A
== Documentation ==
Original change that resulted in the "Allow SSH root login with
password" to be added:
https://fedoraproject.org/wiki/Changes/DisableRootPasswordLoginInSshd
A workaround for kickstart users that still need to enable password
based root login over SSH for some reason:
https://anaconda-installer.readthedocs.io/en/latest/common-bugs.html#enab...
== Release Notes ==
* The "Allow SSH root login with password" option has been removed
from the installer GUI, making it no longer possible to configure the
installed system to allow root to login with password over SSH. If you
need to login remotely with super user privileges please use key based
authentication or normal user with admin rights instead.
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
3 years
Non-responsive maintainer: jdulaney
by Vitaly Zaitsev
Hello.
According to non-responsive maintainer procedure, I'm asking if anyone
knows how to contact jdulaney?
--
Sincerely,
Vitaly Zaitsev (vitaly(a)easycoding.org)
3 years
ELN SIG Meeting Minutes (2021-05-21)
by Stephen Gallagher
============================================
#fedora-meeting: Fedora ELN SIG (2021-05-21)
============================================
Meeting started by sgallagh at 16:03:31 UTC. The full logs are available
at
https://meetbot.fedoraproject.org/fedora-meeting/2021-05-21/eln.2021-05-2...
.
Meeting summary
---------------
* init process (sgallagh, 16:04:02)
* Old Business (sgallagh, 16:05:43)
* New Business (sgallagh, 16:10:05)
* Rawhide vs. EL-specific changes (sgallagh, 16:16:58)
* Proposal: The ELN SIG strongly prefers the use of specfile
conditionals over the use of an 'eln' branch for packages.
(sgallagh, 16:42:00)
* AGREED: The ELN SIG strongly prefers the use of specfile
conditionals over the use of an 'eln' branch for packages. (+6, 0,
-0) (sgallagh, 16:43:15)
* Proposal: The ELN SIG will establish a process to request the use of
an 'eln' branch, including how such requests are approved or
rejected. (sgallagh, 16:44:42)
* AGREED: Proposal: The ELN SIG will establish a process to request
the use of an 'eln' branch, including how such requests are approved
or rejected. (+6, 0, -0) (sgallagh, 16:47:19)
* Proposal: Approved ELN branches will be versioned to the EL release
and lifecycled with it; the package will reset to building from
Rawhide when the next CentOS Stream cycle becomes available.
(sgallagh, 16:52:27)
* AGREED: : Approved ELN branches will be versioned to the EL release
and lifecycled with it; the package will reset to building from
Rawhide when the next CentOS Stream cycle becomes available. (+6, 0,
-0) (sgallagh, 16:53:44)
* ACTION: dcavalca will create a first draft of the policy to request
ELN branches (sgallagh, 16:58:26)
* Open Floor (sgallagh, 16:58:38)
Meeting ended at 17:00:13 UTC.
Action Items
------------
* dcavalca will create a first draft of the policy to request ELN
branches
Action Items, by person
-----------------------
* dcavalca
* dcavalca will create a first draft of the policy to request ELN
branches
* **UNASSIGNED**
* (none)
People Present (lines said)
---------------------------
* sgallagh (106)
* dcavalca (52)
* Eighth_Doctor (35)
* michel_slm (27)
* zodbot (19)
* tdawson (12)
* tstellar_ (11)
* cyberpear (5)
* bookwar[m] (0)
Generated by `MeetBot`_ 0.1.4
.. _`MeetBot`: http://wiki.debian.org/MeetBot
3 years
F35 Change proposal: Smaller Container Base Image (remove
sssd-client, util-linux, shadow-utils) (Self-Contained Change)
by Ben Cotton
https://fedoraproject.org/wiki/Changes/SmallerContainerBase
== Summary ==
This change proposes to remove 3 packages (sssd-client, util-linux,
shadow-utils) from the Container Base Image (including the minimal
image). The Fedora Base Image is still quite large compared to other
distributions and the tools offered by these packages are not
essential in base image.
== Owner ==
* Name: [[User:cverna| Clément Verna]]
* Email: <cverna-at-fedoraproject.org>
== Detailed Description ==
This is a proposal to make the Fedora Container Base image smaller by
remove the following 3 packages:
* sssd-client
* util-linux
* shadow-utils
Current size of the base image and minimal base image :
{| class="wikitable"
|-
! REPOSITORY !! TAG !! IMAGE ID !! CREATED !! SIZE
|-
| registry.fedoraproject.org/fedora || 34 || eede0db319cc || 2 days
ago || 187 MB
|-
| registry.fedoraproject.org/fedora-minimal || 34 || 4ff120184ee4 ||
2 days ago || 122 MB
|}
The installed size of each package is :
{| class="wikitable"
|-
! Package !! Installed Size
|-
| util-linux || 13018140
|-
| shadow-utils || 3876259
|-
| sssd-client || 317948
|}
Removing these packages would allow to gain around 17MB in both images.
Each of these packages provides useful tools but the main goal of the
base image is for building layered images. Each of these packages can
easily be added in a layered image if needed.
More info and discussion happened for each package in the Container SIG tracker
sssd-client : https://pagure.io/ContainerSIG/container-sig/issue/44
util-linux : https://pagure.io/ContainerSIG/container-sig/issue/45
shadow-utils : https://pagure.io/ContainerSIG/container-sig/issue/46
== Benefit to Fedora ==
Reducing the size of the base image makes it a more interesting choice
for users to build layered images using Fedora. The base image is also
heavily used by CI systems so reducing the size makes it faster to be
pulled.
Removing packages from the base image also reduces the number of CVEs
our users have to care about.
== Scope ==
* Proposal owners:
Explicitly remove the 3 packages from the base image kickstart :
https://pagure.io/fedora-kickstarts/blob/main/f/fedora-container-base.ks
* Release engineering:
Approve and Merge the kickstart change.
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives: N/A
== Upgrade/compatibility impact ==
Some layered images that relied on these packages being provided by
the base image will fail to build. These images will now have to make
sure to install the required package in their Container/Dockerfile.
In most cases that will results in adding the following :
RUN dnf -y install sssd-client shadow-utils util-linux && dnf clean all
== How To Test ==
Once implemented, one can test this change by pulling the rawhide
image and verify that none of the above packages are present in the
image.
== User Experience ==
See Upgrade/compatibility impact
== Dependencies ==
== Contingency Plan ==
Kickstart changes can simply be reverted and packages added back in
the base image.
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
3 years
