SSL: CERTIFICATE_VERIFY_FAILED

[gil]

Hi

i get :

$ KRB5_TRACE=/dev/stdout kinit gil(a)FEDORAPROJECT.ORG

[2285] 1482484266.902495: Getting initial credentials for 
gil(a)FEDORAPROJECT.ORG
[2285] 1482484266.902725: Sending request (194 bytes) to FEDORAPROJECT.ORG
[2285] 1482484266.902911: Resolving hostname id.fedoraproject.org
[2285] 1482484267.583802: TLS certificate name matched 
"id.fedoraproject.org"
[2285] 1482484267.800894: Sending HTTPS request to https 209.132.181.16:443
[2285] 1482484268.32078: Received answer (270 bytes) from https 
209.132.181.16:443
[2285] 1482484268.32097: Terminating TCP connection to https 
209.132.181.16:443
[2285] 1482484268.33672: Response was not from master KDC
[2285] 1482484268.33717: Received error from KDC: -1765328359/Additional 
pre-authentication required
[2285] 1482484268.33774: Processing preauth types: 136, 19, 2, 133
[2285] 1482484268.33782: Selected etype info: etype aes256-cts, salt 
"<\dUU>-'9OMNb")7", params ""
[2285] 1482484268.33786: Received cookie: MIT
Password for gil(a)FEDORAPROJECT.ORG:
[2285] 1482484284.346052: AS key obtained for encrypted timestamp: 
aes256-cts/9D63
[2285] 1482484284.346102: Encrypted timestamp (for 1482484284.235522): 
plain 301AA011180F32303136313232333039313132345AA1050203039802, 
encrypted 
9440A234EB9CA0BDC41D60BF4F08AB1ABE4890F15918ABD1305E93775D2FBF81946C7AD58A68B4019244A1B4A6E8F5F31D3759FD58842F1D
[2285] 1482484284.346124: Preauth module encrypted_timestamp (2) (real) 
returned: 0/Success
[2285] 1482484284.346131: Produced preauth for next request: 133, 2
[2285] 1482484284.346150: Sending request (289 bytes) to FEDORAPROJECT.ORG
[2285] 1482484284.346186: Resolving hostname id.fedoraproject.org
[2285] 1482484284.918643: TLS certificate name matched 
"id.fedoraproject.org"
[2285] 1482484285.136809: Sending HTTPS request to https 209.132.181.16:443
[2285] 1482484285.382621: Received answer (781 bytes) from https 
209.132.181.16:443
[2285] 1482484285.382646: Terminating TCP connection to https 
209.132.181.16:443
[2285] 1482484285.383957: Response was not from master KDC
[2285] 1482484285.384015: Processing preauth types: 19
[2285] 1482484285.384022: Selected etype info: etype aes256-cts, salt 
"<\dUU>-'9OMNb")7", params ""
[2285] 1482484285.384027: Produced preauth for next request: (empty)
[2285] 1482484285.384036: AS key determined by preauth: aes256-cts/9D63
[2285] 1482484285.384505: Decrypted AS reply; session key is: 
aes256-cts/0AE8
[2285] 1482484285.384523: FAST negotiation: available
[2285] 1482484285.384539: Initializing KEYRING:persistent:1000:1000 with 
default princ gil(a)FEDORAPROJECT.ORG
[2285] 1482484285.384571: Storing gil(a)FEDORAPROJECT.ORG -> 
krbtgt/FEDORAPROJECT.ORG(a)FEDORAPROJECT.ORG in KEYRING:persistent:1000:1000
[2285] 1482484285.384865: Storing config in KEYRING:persistent:1000:1000 
for krbtgt/FEDORAPROJECT.ORG(a)FEDORAPROJECT.ORG: fast_avail: yes
[2285] 1482484285.384908: Storing gil(a)FEDORAPROJECT.ORG -> 
krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG(a)X-CACHECONF:

in KEYRING:persistent:1000:1000
[2285] 1482484285.384946: Storing config in KEYRING:persistent:1000:1000 
for krbtgt/FEDORAPROJECT.ORG(a)FEDORAPROJECT.ORG: pa_type: 2
[2285] 1482484285.384956: Storing gil(a)FEDORAPROJECT.ORG -> 
krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG(a)X-CACHECONF: 
in KEYRING:persistent:1000:1000

$ koji build --scratch --arch-override x86_64 rawhide 
/home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed 
(_ssl.c:590)

$ klist -e
Ticket cache: KEYRING:persistent:1000:1000
Default principal: gil(a)FEDORAPROJECT.ORG

Valid starting       Expires              Service principal
23/12/2016 10:11:32  24/12/2016 10:11:07 
host/koji.fedoraproject.org(a)FEDORAPROJECT.ORG
         renew until 30/12/2016 10:11:07, Etype (skey, tkt): 
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
23/12/2016 10:11:25  24/12/2016 10:11:07 
krbtgt/FEDORAPROJECT.ORG(a)FEDORAPROJECT.ORG
         renew until 30/12/2016 10:11:07, Etype (skey, tkt): 
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96

$ fedora-cert -v
Verifying Certificate
cert expires: 2017-05-26
Traceback (most recent call last):
   File "/usr/bin/fedora-cert", line 85, in <module>
     main(opts)
   File "/usr/bin/fedora-cert", line 63, in main
     fedora_cert.verify_cert()
   File "/usr/lib/python2.7/site-packages/fedora_cert/__init__.py", line 
69, in verify_cert
     revoked = crl.get_revoked()
   File "/usr/lib/python2.7/site-packages/OpenSSL/crypto.py", line 1921, 
in get_revoked
     revoked_stack = self._crl.crl.revoked
AttributeError: '_cffi_backend.CData' object has no attribute 'crl'

what's wrong?

thanks in advance

regards

.g

[Pierre-Yves Chibon]

On Fri, Dec 23, 2016 at 10:18:50AM +0100, gil wrote:
>  Hi
>  
>  i get :
>  
>  $ KRB5_TRACE=/dev/stdout kinit gil(a)FEDORAPROJECT.ORG 
[...]
 
>  $ koji build --scratch --arch-override x86_64 rawhide
>  /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
>  SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
>  (_ssl.c:590) 
rpm -q koji fedora-packager ?

>  $ fedora-cert -v
>  Verifying Certificate
>  cert expires: 2017-05-26 
With the move to kerberos, fedora-cert becomes un-needed.


Pierre

[gil]

Il 23/12/2016 10:42, Pierre-Yves Chibon ha scritto:
>  On Fri, Dec 23, 2016 at 10:18:50AM +0100, gil wrote:
> > Hi
> >
> > i get :
> >
> > $ KRB5_TRACE=/dev/stdout kinit gil(a)FEDORAPROJECT.ORG
>  [...]
>    
> > $ koji build --scratch --arch-override x86_64 rawhide
> > /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
> > SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
> > (_ssl.c:590)
>  rpm -q koji fedora-packager ?
>  
$ rpm -q koji fedora-packager
koji-1.11.0-1.fc24.noarch
fedora-packager-0.6.0.0-1.fc24.noarch
> > $ fedora-cert -v
> > Verifying Certificate
> > cert expires: 2017-05-26
>  With the move to kerberos, fedora-cert becomes un-needed.
>
>
>  Pierre
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org 
Thanks &
Merry Xmas
.g

[Patrick Uiterwijk]

Hi,

> >> $ koji build --scratch --arch-override x86_64 rawhide
> >> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
> >> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
> >> (_ssl.c:590) 
This message indicates that you have an outdated koji config file.
Do you have koji 1.11.0?
If you do, you most likely have a /etc/koji.conf.rpmnew, please try
moving that to /etc/koji.conf.

If not, can you please email back your koji.conf?

Regards,
Patrick

[gil]

Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
>  Hi,
>
> >>> $ koji build --scratch --arch-override x86_64 rawhide
> >>> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
> >>> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
> >>> (_ssl.c:590) 
Hi
>  This message indicates that you have an outdated koji config file.
>  Do you have koji 1.11.0? 
$ rpm -q koji fedora-packager
koji-1.11.0-1.fc24.noarch
fedora-packager-0.6.0.0-1.fc24.noarch
>  If you do, you most likely have a /etc/koji.conf.rpmnew, please try
>  moving that to /etc/koji.conf. 
koji.conf.rpmnew is not available
content of koji.conf:
[koji]

;configuration for koji cli tool

;url of XMLRPC server
server = https://koji.fedoraproject.org/kojihub

;url of web interface
weburl = https://koji.fedoraproject.org/koji

;url of package download site
topurl = https://kojipkgs.fedoraproject.org/

;path to the koji top directory
;topdir = /mnt/koji

authtype = kerberos
krb_rdns = false

Thanks & merry xmas
.g
>  If not, can you please email back your koji.conf?
>
>  Regards,
>  Patrick
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org

[Pierre-Yves Chibon]

On Fri, Dec 23, 2016 at 12:53:25PM +0100, gil wrote:
>  
>  
>  Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
>  > Hi,
>  > 
>  > > > > $ koji build --scratch --arch-override x86_64 rawhide
>  > > > > /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
>  > > > > SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
>  > > > > (_ssl.c:590)
>  Hi
>  > This message indicates that you have an outdated koji config file.
>  > Do you have koji 1.11.0?
>  $ rpm -q koji fedora-packager
>  koji-1.11.0-1.fc24.noarch
>  fedora-packager-0.6.0.0-1.fc24.noarch
>  > If you do, you most likely have a /etc/koji.conf.rpmnew, please try
>  > moving that to /etc/koji.conf.
>  
>  koji.conf.rpmnew is not available
>  content of koji.conf:
>  [koji]
>  
>  ;configuration for koji cli tool
>  
>  ;url of XMLRPC server
>  server = https://koji.fedoraproject.org/kojihub
>  
>  ;url of web interface
>  weburl = https://koji.fedoraproject.org/koji
>  
>  ;url of package download site
>  topurl = https://kojipkgs.fedoraproject.org/
>  
>  ;path to the koji top directory
>  ;topdir = /mnt/koji
>  
>  authtype = kerberos
>  krb_rdns = false 
Do you have by any chances a ~/.koji/config?

Pierre

[gil]

Il 23/12/2016 14:38, Pierre-Yves Chibon ha scritto:
>  On Fri, Dec 23, 2016 at 12:53:25PM +0100, gil wrote:
> >
> > Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
> >> Hi,
> >>
> >>>>> $ koji build --scratch --arch-override x86_64 rawhide
> >>>>> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
> >>>>> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
> >>>>> (_ssl.c:590)
> > Hi
> >> This message indicates that you have an outdated koji config file.
> >> Do you have koji 1.11.0?
> > $ rpm -q koji fedora-packager
> > koji-1.11.0-1.fc24.noarch
> > fedora-packager-0.6.0.0-1.fc24.noarch
> >> If you do, you most likely have a /etc/koji.conf.rpmnew, please try
> >> moving that to /etc/koji.conf.
> > koji.conf.rpmnew is not available
> > content of koji.conf:
> > [koji]
> >
> > ;configuration for koji cli tool
> >
> > ;url of XMLRPC server
> > server = https://koji.fedoraproject.org/kojihub
> >
> > ;url of web interface
> > weburl = https://koji.fedoraproject.org/koji
> >
> > ;url of package download site
> > topurl = https://kojipkgs.fedoraproject.org/
> >
> > ;path to the koji top directory
> > ;topdir = /mnt/koji
> >
> > authtype = kerberos
> > krb_rdns = false
>  Do you have by any chances a ~/.koji/config? 
which changes?
content of .koji/config:
[koji]

;configuration for koji cli tool

;url of XMLRPC server
server = http://koji.fedoraproject.org/kojihub

;url of web interface
weburl = http://koji.fedoraproject.org/koji

;url of package download site
topurl = https://kojipkgs.fedoraproject.org/

;path to the koji top directory
;topdir = /mnt/koji

;configuration for Kerberos authentication

;the service name of the principal being used by the hub
;krbservice = host

;configuration for SSL authentication

;client certificate
cert = ~/.fedora.cert

;certificate of the CA that issued the client certificate
ca = ~/.fedora-server-ca.cert

;certificate of the CA that issued the HTTP server certificate
serverca = ~/.fedora-server-ca.cert

anon_retry = yes

.g
>  Pierre
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org

[Pierre-Yves Chibon]

On Fri, Dec 23, 2016 at 03:00:03PM +0100, gil wrote:
>  
>  
>  Il 23/12/2016 14:38, Pierre-Yves Chibon ha scritto:
>  > On Fri, Dec 23, 2016 at 12:53:25PM +0100, gil wrote:
>  > > 
>  > > Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
>  > > > Hi,
>  > > > 
>  > > > > > > $ koji build --scratch --arch-override x86_64 rawhide
>  > > > > > >
> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
>  > > > > > > SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate
> verify failed
>  > > > > > > (_ssl.c:590)
>  > > Hi
>  > > > This message indicates that you have an outdated koji config file.
>  > > > Do you have koji 1.11.0?
>  > > $ rpm -q koji fedora-packager
>  > > koji-1.11.0-1.fc24.noarch
>  > > fedora-packager-0.6.0.0-1.fc24.noarch
>  > > > If you do, you most likely have a /etc/koji.conf.rpmnew, please try
>  > > > moving that to /etc/koji.conf.
>  > > koji.conf.rpmnew is not available
>  > > content of koji.conf:
>  > > [koji]
>  > > 
>  > > ;configuration for koji cli tool
>  > > 
>  > > ;url of XMLRPC server
>  > > server = https://koji.fedoraproject.org/kojihub
>  > > 
>  > > ;url of web interface
>  > > weburl = https://koji.fedoraproject.org/koji
>  > > 
>  > > ;url of package download site
>  > > topurl = https://kojipkgs.fedoraproject.org/
>  > > 
>  > > ;path to the koji top directory
>  > > ;topdir = /mnt/koji
>  > > 
>  > > authtype = kerberos
>  > > krb_rdns = false
>  > Do you have by any chances a ~/.koji/config?
>  which changes? 
Do you actually need this file?

If so, then you'll need to update the URLs to use http*s*, drop the lines
referring to the cert, and include the lines: ``krb_rdns = false`` and
``authtype = kerberos`` which is required.

Well, making a diff -u between the two files will show you the diff better than
I would :)

Pierre

[gil]

Il 23/12/2016 16:00, Pierre-Yves Chibon ha scritto:
>  On Fri, Dec 23, 2016 at 03:00:03PM +0100, gil wrote:
> >
> > Il 23/12/2016 14:38, Pierre-Yves Chibon ha scritto:
> >> On Fri, Dec 23, 2016 at 12:53:25PM +0100, gil wrote:
> >>> Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
> >>>> Hi,
> >>>>
> >>>>>>> $ koji build --scratch --arch-override x86_64 rawhide
> >>>>>>>
> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
> >>>>>>> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify
> failed
> >>>>>>> (_ssl.c:590)
> >>> Hi
> >>>> This message indicates that you have an outdated koji config file.
> >>>> Do you have koji 1.11.0?
> >>> $ rpm -q koji fedora-packager
> >>> koji-1.11.0-1.fc24.noarch
> >>> fedora-packager-0.6.0.0-1.fc24.noarch
> >>>> If you do, you most likely have a /etc/koji.conf.rpmnew, please try
> >>>> moving that to /etc/koji.conf.
> >>> koji.conf.rpmnew is not available
> >>> content of koji.conf:
> >>> [koji]
> >>>
> >>> ;configuration for koji cli tool
> >>>
> >>> ;url of XMLRPC server
> >>> server = https://koji.fedoraproject.org/kojihub
> >>>
> >>> ;url of web interface
> >>> weburl = https://koji.fedoraproject.org/koji
> >>>
> >>> ;url of package download site
> >>> topurl = https://kojipkgs.fedoraproject.org/
> >>>
> >>> ;path to the koji top directory
> >>> ;topdir = /mnt/koji
> >>>
> >>> authtype = kerberos
> >>> krb_rdns = false
> >> Do you have by any chances a ~/.koji/config?
> > which changes?
>  Do you actually need this file?
>
>  If so, then you'll need to update the URLs to use http*s*, drop the lines
>  referring to the cert, and include the lines: ``krb_rdns = false`` and
>  ``authtype = kerberos`` which is required.
>
>  Well, making a diff -u between the two files will show you the diff better than
>  I would :) 
$ diff -u ~/.koji/config ~/.koji/config.old
no changes ....

content of ~/.koji/config.old:

[koji]

;configuration for koji cli tool

;url of XMLRPC server
server = http://koji.fedoraproject.org/kojihub

;url of web interface
weburl = http://koji.fedoraproject.org/koji

;url of package download site
topurl = https://kojipkgs.fedoraproject.org/

;path to the koji top directory
;topdir = /mnt/koji

;configuration for Kerberos authentication

;the service name of the principal being used by the hub
;krbservice = host

;configuration for SSL authentication

;client certificate
cert = ~/.fedora.cert

;certificate of the CA that issued the client certificate
ca = ~/.fedora-server-ca.cert

;certificate of the CA that issued the HTTP server certificate
serverca = ~/.fedora-server-ca.cert

anon_retry = yes

.g
>  Pierre
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org

[Pierre-Yves Chibon]

On Fri, Dec 23, 2016 at 04:19:35PM +0100, gil wrote:
>  
>  
>  Il 23/12/2016 16:00, Pierre-Yves Chibon ha scritto:
>  > On Fri, Dec 23, 2016 at 03:00:03PM +0100, gil wrote:
>  > > 
>  > > Il 23/12/2016 14:38, Pierre-Yves Chibon ha scritto:
>  > > > On Fri, Dec 23, 2016 at 12:53:25PM +0100, gil wrote:
>  > > > > Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
>  > > > > > Hi,
>  > > > > > 
>  > > > > > > > > $ koji build --scratch --arch-override x86_64
> rawhide
>  > > > > > > > >
> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
>  > > > > > > > > SSLError: [SSL: CERTIFICATE_VERIFY_FAILED]
> certificate verify failed
>  > > > > > > > > (_ssl.c:590)
>  > > > > Hi
>  > > > > > This message indicates that you have an outdated koji config
> file.
>  > > > > > Do you have koji 1.11.0?
>  > > > > $ rpm -q koji fedora-packager
>  > > > > koji-1.11.0-1.fc24.noarch
>  > > > > fedora-packager-0.6.0.0-1.fc24.noarch
>  > > > > > If you do, you most likely have a /etc/koji.conf.rpmnew, please
> try
>  > > > > > moving that to /etc/koji.conf.
>  > > > > koji.conf.rpmnew is not available
>  > > > > content of koji.conf:
>  > > > > [koji]
>  > > > > 
>  > > > > ;configuration for koji cli tool
>  > > > > 
>  > > > > ;url of XMLRPC server
>  > > > > server = https://koji.fedoraproject.org/kojihub
>  > > > > 
>  > > > > ;url of web interface
>  > > > > weburl = https://koji.fedoraproject.org/koji
>  > > > > 
>  > > > > ;url of package download site
>  > > > > topurl = https://kojipkgs.fedoraproject.org/
>  > > > > 
>  > > > > ;path to the koji top directory
>  > > > > ;topdir = /mnt/koji
>  > > > > 
>  > > > > authtype = kerberos
>  > > > > krb_rdns = false
>  > > > Do you have by any chances a ~/.koji/config?
>  > > which changes?
>  > Do you actually need this file?
>  > 
>  > If so, then you'll need to update the URLs to use http*s*, drop the lines
>  > referring to the cert, and include the lines: ``krb_rdns = false`` and
>  > ``authtype = kerberos`` which is required.
>  > 
>  > Well, making a diff -u between the two files will show you the diff better than
>  > I would :)
>  $ diff -u ~/.koji/config ~/.koji/config.old
>  no changes .... 
And diff -u ~/.koji/config /etc/koji.conf (the later being the one of interest).

If you do not need ~/.koji/config I would advice dropping them entirely.


Pierre

[gil]

Il 23/12/2016 16:35, Pierre-Yves Chibon ha scritto:
>  On Fri, Dec 23, 2016 at 04:19:35PM +0100, gil wrote:
> >
> > Il 23/12/2016 16:00, Pierre-Yves Chibon ha scritto:
> >> On Fri, Dec 23, 2016 at 03:00:03PM +0100, gil wrote:
> >>> Il 23/12/2016 14:38, Pierre-Yves Chibon ha scritto:
> >>>> On Fri, Dec 23, 2016 at 12:53:25PM +0100, gil wrote:
> >>>>> Il 23/12/2016 12:04, Patrick Uiterwijk ha scritto:
> >>>>>> Hi,
> >>>>>>
> >>>>>>>>> $ koji build --scratch --arch-override x86_64
> rawhide
> >>>>>>>>>
> /home/gil/springframework/springframework-3.2.18-1.fc26.src.rpm
> >>>>>>>>> SSLError: [SSL: CERTIFICATE_VERIFY_FAILED]
> certificate verify failed
> >>>>>>>>> (_ssl.c:590)
> >>>>> Hi
> >>>>>> This message indicates that you have an outdated koji config
> file.
> >>>>>> Do you have koji 1.11.0?
> >>>>> $ rpm -q koji fedora-packager
> >>>>> koji-1.11.0-1.fc24.noarch
> >>>>> fedora-packager-0.6.0.0-1.fc24.noarch
> >>>>>> If you do, you most likely have a /etc/koji.conf.rpmnew, please
> try
> >>>>>> moving that to /etc/koji.conf.
> >>>>> koji.conf.rpmnew is not available
> >>>>> content of koji.conf:
> >>>>> [koji]
> >>>>>
> >>>>> ;configuration for koji cli tool
> >>>>>
> >>>>> ;url of XMLRPC server
> >>>>> server = https://koji.fedoraproject.org/kojihub
> >>>>>
> >>>>> ;url of web interface
> >>>>> weburl = https://koji.fedoraproject.org/koji
> >>>>>
> >>>>> ;url of package download site
> >>>>> topurl = https://kojipkgs.fedoraproject.org/
> >>>>>
> >>>>> ;path to the koji top directory
> >>>>> ;topdir = /mnt/koji
> >>>>>
> >>>>> authtype = kerberos
> >>>>> krb_rdns = false
> >>>> Do you have by any chances a ~/.koji/config?
> >>> which changes?
> >> Do you actually need this file?
> >>
> >> If so, then you'll need to update the URLs to use http*s*, drop the lines
> >> referring to the cert, and include the lines: ``krb_rdns = false`` and
> >> ``authtype = kerberos`` which is required.
> >>
> >> Well, making a diff -u between the two files will show you the diff better than
> >> I would :)
> > $ diff -u ~/.koji/config ~/.koji/config.old
> > no changes ....
>  And diff -u ~/.koji/config /etc/koji.conf (the later being the one of interest). 
$
diff -u ~/.koji/config /etc/koji.conf
--- /home/gil/.koji/config      2015-07-23 10:27:53.000000000 +0200
+++ /etc/koji.conf      2016-12-09 15:47:23.000000000 +0100
@@ -3,10 +3,10 @@
  ;configuration for koji cli tool

  ;url of XMLRPC server
-server = http://koji.fedoraproject.org/kojihub
+server = https://koji.fedoraproject.org/kojihub

  ;url of web interface
-weburl = http://koji.fedoraproject.org/koji
+weburl = https://koji.fedoraproject.org/koji

  ;url of package download site
  topurl = https://kojipkgs.fedoraproject.org/
@@ -14,20 +14,6 @@
  ;path to the koji top directory
  ;topdir = /mnt/koji

-;configuration for Kerberos authentication
+authtype = kerberos
+krb_rdns = false

-;the service name of the principal being used by the hub
-;krbservice = host
-
-;configuration for SSL authentication
-
-;client certificate
-cert = ~/.fedora.cert
-
-;certificate of the CA that issued the client certificate
-ca = ~/.fedora-server-ca.cert
-
-;certificate of the CA that issued the HTTP server certificate
-serverca = ~/.fedora-server-ca.cert
-
-anon_retry = yes
>  If you do not need ~/.koji/config I would advice dropping them
> entirely. 
this mean remove entirely folder or only config* files?

$ cd ~/.koji/
.koji]$ ls
config  config.old
>  Pierre
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org 
.g

[Patrick Uiterwijk]

Hi,

On Fri, Dec 23, 2016 at 4:07 PM, gil <puntogil(a)libero.it&gt; wrote:
>  this mean remove entirely folder or only config* files? 
Either way works. The important part is that ~/.koji/config doesn't
exist, since that
overrides /etc/koji.conf. Whether you remove the directory itself is up to you.

>  $ cd ~/.koji/
>  .koji]$ ls
>  config  config.old
> > 
Regards,
Patrick

[Pierre-Yves Chibon]

On Fri, Dec 23, 2016 at 05:07:46PM +0100, gil wrote:
>  >If you do not need ~/.koji/config I would advice dropping them
> entirely.
>  this mean remove entirely folder or only config* files? 
Seeing what is in that folder, I think the entire folder could go (I do not have
it on any of my machines)
 
>  $ cd ~/.koji/
>  .koji]$ ls
>  config  config.old 
Pierre

[Vít Ondruch]

Dne 23.12.2016 v 10:42 Pierre-Yves Chibon napsal(a):
>  On Fri, Dec 23, 2016 at 10:18:50AM +0100, gil wrote:
>
> > $ fedora-cert -v
> > Verifying Certificate
> > cert expires: 2017-05-26
>  With the move to kerberos, fedora-cert becomes un-needed. 
The dependency from fedora-packager should be dropped then ... or the
package entirely retired?


Vít

[Till Maas]

On Fri, Dec 23, 2016 at 10:42:36AM +0100, Pierre-Yves Chibon wrote:

>  With the move to kerberos, fedora-cert becomes un-needed. 
Is there a way to get the FAS username from kerberos using another
python module? fedora-easy-karma uses fedora-cert to get the current FAS
username.

Kind regards
Till

[Adam Williamson]

On Sat, 2016-12-24 at 09:28 +0100, Till Maas wrote:
>  On Fri, Dec 23, 2016 at 10:42:36AM +0100, Pierre-Yves Chibon wrote:
>  
>  > With the move to kerberos, fedora-cert becomes un-needed.
>  
>  Is there a way to get the FAS username from kerberos using another
>  python module? fedora-easy-karma uses fedora-cert to get the current FAS
>  username. 
Oh, yeah, I stole that same code for wikitcms, too. It'd be handy.
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net

[Kevin Fenzi]

On Sat, 24 Dec 2016 00:33:19 -0800
Adam Williamson <adamwill(a)fedoraproject.org&gt; wrote:

>  On Sat, 2016-12-24 at 09:28 +0100, Till Maas wrote:
>  > On Fri, Dec 23, 2016 at 10:42:36AM +0100, Pierre-Yves Chibon wrote:
>  >   
>  > > With the move to kerberos, fedora-cert becomes un-needed.  
>  > 
>  > Is there a way to get the FAS username from kerberos using another
>  > python module? fedora-easy-karma uses fedora-cert to get the
>  > current FAS username.  
>  
>  Oh, yeah, I stole that same code for wikitcms, too. It'd be handy. 
rpkg uses Patricks cccolutils ( https://pagure.io/cccolutils , in
Fedora as python2-cccolutils) to do this. 

https://pagure.io/rpkg/blob/master/f/pyrpkg/__init__.py#_823

kevin

[Till Maas]

On Sat, Dec 24, 2016 at 12:33:19AM -0800, Adam Williamson wrote:
>  On Sat, 2016-12-24 at 09:28 +0100, Till Maas wrote:
>  > On Fri, Dec 23, 2016 at 10:42:36AM +0100, Pierre-Yves Chibon wrote:
>  > 
>  > > With the move to kerberos, fedora-cert becomes un-needed.
>  > 
>  > Is there a way to get the FAS username from kerberos using another
>  > python module? fedora-easy-karma uses fedora-cert to get the current FAS
>  > username.
>  
>  Oh, yeah, I stole that same code for wikitcms, too. It'd be handy. 
I just learned from Patrick that fedora-cert also supports reading the
FAS username from

~/.fedora.upn (User Principal Name)

And the problem with trying to get the FAS username from kerberos is
that it only works while the use has a valid ticket for kerberos since
MIT kerberos removes expired tickets. Therefore IMHO it would be a good
idea for all Fedora users to setup the FAS username in the file.

Kind regards
Till

[Alexander Ploumistos]

On Sun, Jan 8, 2017 at 2:10 PM, Till Maas <opensource(a)till.name&gt; wrote:
>  ~/.fedora.upn (User Principal Name)
>
>  And the problem with trying to get the FAS username from kerberos is
>  that it only works while the use has a valid ticket for kerberos since
>  MIT kerberos removes expired tickets. Therefore IMHO it would be a good
>  idea for all Fedora users to setup the FAS username in the file. 
So we just run

echo "FAS_username" > ~/.fedora.upn

or is there a more elaborate syntax to that file?

[Alec Leamas]

On 08/01/17 13:30, Alexander Ploumistos wrote:
>  On Sun, Jan 8, 2017 at 2:10 PM, Till Maas
> <opensource(a)till.name&gt; wrote:
> >
> > ~/.fedora.upn (User Principal Name)
> >
> > And the problem with trying to get the FAS username from kerberos is
> > that it only works while the use has a valid ticket for kerberos since
> > MIT kerberos removes expired tickets. Therefore IMHO it would be a good
> > idea for all Fedora users to setup the FAS username in the file.
>
>  So we just run
>
>  echo "FAS_username" > ~/.fedora.upn
>  
Looks so, according the the documentation [1]  ;)

Cheers!

--alec

https://pagure.io/fedora-packager/c/715483c1bbdf5cceaeb63e90410139

[Alexander Ploumistos]

On Sun, Jan 8, 2017 at 10:55 PM, Alec Leamas <leamas.alec(a)gmail.com&gt; wrote:
>  On 08/01/17 13:30, Alexander Ploumistos wrote:
> >
> > On Sun, Jan 8, 2017 at 2:10 PM, Till Maas <opensource(a)till.name&gt; wrote:
> >>
> >>
> >> ~/.fedora.upn (User Principal Name)
> >>
> >> And the problem with trying to get the FAS username from kerberos is
> >> that it only works while the use has a valid ticket for kerberos since
> >> MIT kerberos removes expired tickets. Therefore IMHO it would be a good
> >> idea for all Fedora users to setup the FAS username in the file.
> >
> >
> > So we just run
> >
> > echo "FAS_username" > ~/.fedora.upn
> >
>
>  Looks so, according the the documentation [1]  ;)
>
>  Cheers!
>
>  --alec
>
>  https://pagure.io/fedora-packager/c/715483c1bbdf5cceaeb63e90410139 
Well, thanks!