"make upload" broke in Aug 28th rawhide?

[Warren Togami]

This afternoon I was attempting to diagnose why clumens' attempts to 
upload new source tarballs were failing, while it continued to work on 
my machine and nobody else was complaining.

clumens@exeter:~/fedora-src/anaconda/devel$ make upload 
FILES=anaconda-11.3.0.23.tar.bz2
Checking : anaconda-11.3.0.23.tar.bz2 on 
https://cvs.fedoraproject.org/repo/pkgs/upload.cgi...
ERROR: could not check remote file status

/var/log/httpd/ssl_error_log says...

[Tue Aug 28 17:15:06 2007] [error] [client 66.187.230.200] access to 
/repo/pkgs/upload.cgi failed, reason: SSL requirement expression not 
fulfilled (see SSL logfile for more details)

I tried clumens' .fedora.cert on my F-7 laptop and it successfully 
uploaded the tarball.

clumens succeeded in uploading a tarball at 11:35AM eastern, then by the 
attached log excerpt yum update happened after 4:00PM.  Subsequent "make 
upload" attempts failed.

Didn't have time to isolate what exactly broke it, and I don't have a 
local rawhide install here to do so quickly.  Can somebody figure out 
what changed?

Thanks,
Warren Togami
wtogami(a)redhat.com

Aug 28 13:52:38 Installed: popt-static - 1.12-3.fc8.i386
Aug 28 14:13:48 Updated: kernel-headers - 2.6.23-0.142.rc3.git10.fc8.i386
Aug 28 14:13:49 Updated: python-urlgrabber - 3.0.0-2.fc8.noarch
Aug 28 14:14:20 Updated: glibc-common - 2.6.90-13.i386
Aug 28 14:14:41 Updated: glibc - 2.6.90-13.i686
Aug 28 14:14:42 Updated: audit-libs - 1.6-1.fc8.i386
Aug 28 14:14:46 Updated: pygtk2 - 2.11.0-1.fc8.i386
Aug 28 14:14:46 Updated: pygtk2-libglade - 2.11.0-1.fc8.i386
Aug 28 14:14:50 Updated: nash - 6.0.12-1.fc8.i386
Aug 28 14:14:55 Updated: newt - 0.52.7-4.fc8.i386
Aug 28 14:14:56 Updated: newt-python - 0.52.7-4.fc8.i386
Aug 28 14:14:57 Updated: libbdevid-python - 6.0.12-1.fc8.i386
Aug 28 14:15:07 Updated: util-linux-ng - 2.13-1.fc8.i386
Aug 28 14:15:08 Updated: audit-libs-python - 1.6-1.fc8.i386
Aug 28 14:15:11 Updated: opensp - 1.5.2-6.fc8.i386
Aug 28 14:15:12 Updated: pcsc-lite-libs - 1.3.3-1.fc8.i386
Aug 28 14:15:17 Updated: sendmail - 8.14.1-4.i386
Aug 28 14:15:18 Updated: readline - 5.2-7.fc8.i386
Aug 28 14:15:49 Updated: libgnome - 2.19.1-8.fc8.i386
Aug 28 14:15:51 Updated: libsmbios-libs - 0.13.9-1.fc8.i386
Aug 28 14:15:59 Updated: tn5250 - 0.17.3-16.fc8.i386
Aug 28 14:16:01 Updated: python-pyblock - 0.30-1.i386
Aug 28 14:16:06 Updated: system-config-date - 1.9.7-1.fc8.noarch
Aug 28 14:16:28 Updated: vim-common - 2:7.1.87-1.fc8.i386
Aug 28 14:16:35 Updated: glibc-headers - 2.6.90-13.i386
Aug 28 14:16:44 Updated: kbd - 1.12-24.fc8.i386
Aug 28 14:16:49 Updated: fedora-logos - 7.90.1-1.fc8.noarch
Aug 28 14:16:50 Updated: crontabs - 1.10-16.fc8.noarch
Aug 28 14:16:53 Updated: openjade - 1.3.2-30.fc8.i386
Aug 28 14:16:54 Updated: newt-devel - 0.52.7-4.fc8.i386
Aug 28 14:16:56 Updated: perl-Date-Calc - 5.4-2.i386
Aug 28 14:16:57 Updated: curl - 7.16.4-3.fc8.i386
Aug 28 14:17:00 Installed: mdadm - 2.6.2-4.fc8.i386
Aug 28 14:17:01 Updated: mkinitrd - 6.0.12-1.fc8.i386
Aug 28 14:17:03 Updated: procps - 3.2.7-16.1.fc8.i386
Aug 28 14:17:04 Updated: SDL - 1.2.12-1.fc8.i386
Aug 28 14:17:05 Updated: perl-Crypt-SSLeay - 0.56-2.fc8.i386
Aug 28 14:17:06 Installed: isomd5sum - 11.3.0.22-1.i386
Aug 28 14:17:13 Updated: perl-DBI - 1.58-2.fc8.i386
Aug 28 14:17:14 Updated: pygtk2-codegen - 2.11.0-1.fc8.i386
Aug 28 14:17:21 Updated: pygtk2-devel - 2.11.0-1.fc8.i386
Aug 28 14:18:03 Installed: kernel - 2.6.23-0.142.rc3.git10.fc8.i686
Aug 28 14:18:04 Updated: newt-static - 0.52.7-4.fc8.i386
Aug 28 14:18:05 Updated: pm-utils - 0.99.3-11.fc8.i386
Aug 28 14:18:09 Updated: glibc-devel - 2.6.90-13.i386
Aug 28 14:18:15 Updated: vim-X11 - 2:7.1.87-1.fc8.i386
Aug 28 14:18:17 Updated: vim-enhanced - 2:7.1.87-1.fc8.i386
Aug 28 14:18:18 Updated: tn5250-devel - 0.17.3-16.fc8.i386
Aug 28 14:18:18 Updated: libsmbios-bin - 0.13.9-1.fc8.i386
Aug 28 14:18:20 Updated: libgnome-devel - 2.19.1-8.fc8.i386
Aug 28 14:18:21 Updated: readline-devel - 5.2-7.fc8.i386
Aug 28 14:18:22 Updated: sendmail-doc - 8.14.1-4.i386
Aug 28 14:18:25 Updated: sendmail-cf - 8.14.1-4.i386
Aug 28 14:18:26 Updated: sendmail-devel - 8.14.1-4.i386
Aug 28 14:18:27 Updated: audit - 1.6-1.fc8.i386
Aug 28 14:18:31 Updated: system-config-kickstart - 2.7.10-1.fc8.noarch
Aug 28 14:18:34 Updated: nscd - 2.6.90-13.i386
Aug 28 14:18:37 Updated: audit-libs-devel - 1.6-1.fc8.i386
Aug 28 14:18:38 Updated: pam_pkcs11 - 0.5.3-25.i386
Aug 28 14:18:40 Updated: wget - 1.10.2-16.fc8.i386
Aug 28 14:19:47 Updated: plt-scheme - 371-1.fc8.i386
Aug 28 14:19:49 Updated: mock - 0.7.6-1.fc8.i386
Aug 28 14:19:49 Updated: ed - 0.8-1.fc8.i386
Aug 28 14:19:51 Updated: star - 1.5a84-2.fc8.i386
Aug 28 14:19:52 Updated: vim-minimal - 2:7.1.87-1.fc8.i386
Aug 28 14:19:54 Updated: privoxy - 3.0.6-8.fc8.i386
Aug 28 14:19:55 Updated: pam_smb - 1.1.7-7.2.2.i386
Aug 28 14:19:57 Updated: iproute - 2.6.22-2.fc8.i386
Aug 28 14:22:13 Installed: kernel-devel - 2.6.23-0.142.rc3.git10.fc8.i686
Aug 28 14:22:55 Updated: xorg-x11-server-debuginfo - 1.3.0.0-22.fc8.i386
Aug 28 14:23:02 Updated: xorg-x11-fonts-syriac - 7.2-3.fc8.noarch
Aug 28 14:23:07 Updated: xorg-x11-fonts-truetype - 7.2-3.fc8.noarch
Aug 28 14:23:09 Updated: xorg-x11-fonts-cyrillic - 7.2-3.fc8.noarch
Aug 28 14:23:13 Updated: xorg-x11-fonts-ISO8859-1-75dpi - 7.2-3.fc8.noarch
Aug 28 14:23:14 Updated: fonts-KOI8-R-100dpi - 1.0-10.fc8.noarch
Aug 28 14:23:16 Updated: kde-filesystem - 3.5-13.fc8.noarch
Aug 28 14:23:18 Updated: fonts-KOI8-R - 1.0-10.fc8.noarch
Aug 28 14:23:22 Updated: dhcp-debuginfo - 12:3.0.6-3.fc8.i386
Aug 28 14:23:26 Updated: xorg-x11-fonts-75dpi - 7.2-3.fc8.noarch
Aug 28 14:23:29 Updated: xorg-x11-fonts-ISO8859-1-100dpi - 7.2-3.fc8.noarch
Aug 28 14:23:32 Updated: xorg-x11-fonts-100dpi - 7.2-3.fc8.noarch
Aug 28 14:23:33 Updated: perl-DateManip - 5.44-4.fc8.noarch
Aug 28 14:23:42 Updated: xorg-x11-fonts-misc - 7.2-3.fc8.noarch
Aug 28 14:23:46 Updated: xorg-x11-fonts-Type1 - 7.2-3.fc8.noarch
Aug 28 14:23:48 Updated: fonts-KOI8-R-75dpi - 1.0-10.fc8.noarch
Aug 28 14:23:53 Installed: dbus-libs - 1.1.2-3.fc8.i386
Aug 28 14:23:55 Updated: rpm-libs - 4.4.2.1-10.fc8.i386
Aug 28 14:23:57 Updated: pcsc-lite - 1.3.3-1.fc8.i386
Aug 28 14:24:03 Updated: rpm - 4.4.2.1-10.fc8.i386
Aug 28 14:24:03 Updated: rpm-python - 4.4.2.1-10.fc8.i386
Aug 28 14:24:05 Updated: ifd-egate - 0.05-19.i386
Aug 28 14:24:14 Updated: policycoreutils - 2.0.25-4.fc8.i386
Aug 28 14:24:20 Updated: dbus - 1.1.2-3.fc8.i386
Aug 28 14:24:22 Updated: ccid - 1.2.1-3.fc8.i386
Aug 28 14:24:23 Updated: coolkey - 1.1.0-4.fc8.i386
Aug 28 14:24:27 Updated: selinux-policy - 3.0.7-1.fc8.noarch
Aug 28 14:24:40 Updated: anaconda - 11.3.0.22-1.i386
Aug 28 14:24:44 Updated: anaconda-runtime - 11.3.0.22-1.i386
Aug 28 14:24:45 Updated: dbus-qt - 0.70-2.fc8.i386
Aug 28 14:24:51 Updated: dbus-devel - 1.1.2-3.fc8.i386
Aug 28 14:24:52 Updated: pungi - 1.0.0-2.fc8.noarch
Aug 28 14:25:33 Updated: selinux-policy-targeted - 3.0.7-1.fc8.noarch
Aug 28 14:25:40 Updated: dnsmasq - 2.40-0.1.rc2.fc8.i386
Aug 28 14:25:43 Updated: policycoreutils-gui - 2.0.25-4.fc8.i386
Aug 28 14:25:43 Updated: dbus-x11 - 1.1.2-3.fc8.i386
Aug 28 14:25:46 Updated: rpm-build - 4.4.2.1-10.fc8.i386

[Michael Schwendt]

On Tue, 28 Aug 2007 17:55:17 -0400, Warren Togami wrote:

>  This afternoon I was attempting to diagnose why clumens' attempts
> to 
>  upload new source tarballs were failing, while it continued to work on 
>  my machine and nobody else was complaining. 
>  Didn't have time to isolate what exactly broke it, and I
> don't have a 
>  local rawhide install here to do so quickly.  Can somebody figure out 
>  what changed? 
Uploads are still done with "curl" afaik. So:

* Tue Aug 28 2007 Jindrich Novy <jnovy(a)redhat.com&gt; 7.16.4-3
- don't use openssl, use nss instead

[Jindrich Novy]

Hi,

On Wed, Aug 29, 2007 at 12:07:21AM +0200, Michael Schwendt wrote:
>  On Tue, 28 Aug 2007 17:55:17 -0400, Warren Togami wrote:
>  
>  > This afternoon I was attempting to diagnose why clumens' attempts to 
>  > upload new source tarballs were failing, while it continued to work on 
>  > my machine and nobody else was complaining.
>  
>  > Didn't have time to isolate what exactly broke it, and I don't have a 
>  > local rawhide install here to do so quickly.  Can somebody figure out 
>  > what changed?
>  
>  Uploads are still done with "curl" afaik. So:
>  
>  * Tue Aug 28 2007 Jindrich Novy <jnovy(a)redhat.com&gt; 7.16.4-3
>  - don't use openssl, use nss instead
>   
Yes, it's likely caused by the openssl -> nss switch, more at rhbz#266021.

Jindrich

-- 
Jindrich Novy <jnovy(a)redhat.com&gt;   http://people.redhat.com/jnovy/

[Tomas Mraz]

On Fri, 2007-08-31 at 07:15 +0200, Jindrich Novy wrote:
>  Hi,
>  
>  On Wed, Aug 29, 2007 at 12:07:21AM +0200, Michael Schwendt wrote:
>  > On Tue, 28 Aug 2007 17:55:17 -0400, Warren Togami wrote:
>  > 
>  > > This afternoon I was attempting to diagnose why clumens' attempts to 
>  > > upload new source tarballs were failing, while it continued to work on 
>  > > my machine and nobody else was complaining.
>  > 
>  > > Didn't have time to isolate what exactly broke it, and I don't have a 
>  > > local rawhide install here to do so quickly.  Can somebody figure out 
>  > > what changed?
>  > 
>  > Uploads are still done with "curl" afaik. So:
>  > 
>  > * Tue Aug 28 2007 Jindrich Novy <jnovy(a)redhat.com&gt; 7.16.4-3
>  > - don't use openssl, use nss instead
>  > 
>  
>  Yes, it's likely caused by the openssl -> nss switch, more at rhbz#266021. 
See also workaround in
https://bugzilla.redhat.com/show_bug.cgi?id=266021#c3 which requires
some changes to the Makefile though.

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb

[Tomas Mraz]

On Fri, 2007-08-31 at 11:15 +0200, Tomas Mraz wrote:
>  On Fri, 2007-08-31 at 07:15 +0200, Jindrich Novy wrote:
>  > Hi,
>  > 
>  > On Wed, Aug 29, 2007 at 12:07:21AM +0200, Michael Schwendt wrote:
>  > > On Tue, 28 Aug 2007 17:55:17 -0400, Warren Togami wrote:
>  > > 
>  > > > This afternoon I was attempting to diagnose why clumens' attempts to 
>  > > > upload new source tarballs were failing, while it continued to work on 
>  > > > my machine and nobody else was complaining.
>  > > 
>  > > > Didn't have time to isolate what exactly broke it, and I don't
> have a 
>  > > > local rawhide install here to do so quickly.  Can somebody figure out 
>  > > > what changed?
>  > > 
>  > > Uploads are still done with "curl" afaik. So:
>  > > 
>  > > * Tue Aug 28 2007 Jindrich Novy <jnovy(a)redhat.com&gt; 7.16.4-3
>  > > - don't use openssl, use nss instead
>  > > 
>  > 
>  > Yes, it's likely caused by the openssl -> nss switch, more at rhbz#266021.
>  
>  See also workaround in
>  https://bugzilla.redhat.com/show_bug.cgi?id=266021#c3 which requires
>  some changes to the Makefile though. 
And the changes are here - supposed that the
NSS cert db is in ~/.nss,
the cert nickname is Fedora and the NSS cert db password is not password
protected.

Index: Makefile.common
===================================================================
RCS file: /cvs/pkgs/common/Makefile.common,v
retrieving revision 1.73
diff -u -r1.73 Makefile.common
--- Makefile.common     24 Jul 2007 17:10:44 -0000      1.73
+++ Makefile.common     31 Aug 2007 09:25:22 -0000
@@ -192,7 +192,7 @@
 
 # we hardwire curl in here because the upload rules are very dependent
 # on curl's behavior on missing pages, ISEs, etc.
-UPLOAD_CERT       = $(shell if test -f $(HOME)/.fedora.cert ; then echo " --cert
$(HOME)/.fedora.cert" ; fi)
+UPLOAD_CERT       = $(shell if test -d $(HOME)/.nss ; then echo " --cert Fedora
--cacert $(HOME)/.nss" ; else if test -f $(HOME)/.fedora.cert ; then echo "
--cert $(HOME)/.fedora.cert" ; fi ; fi)
 UPLOAD_CHECK      = curl -k $(UPLOAD_CERT) --fail --silent
 UPLOAD_CLIENT     = curl -k $(UPLOAD_CERT) --fail --show-error --progress-bar

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb

[Robert Relyea]

Tomas Mraz wrote:
>  On Fri, 2007-08-31 at 11:15 +0200, Tomas Mraz wrote:
>    
> > On Fri, 2007-08-31 at 07:15 +0200, Jindrich Novy wrote:
> >     
> >> Hi,
> >>
> >> On Wed, Aug 29, 2007 at 12:07:21AM +0200, Michael Schwendt wrote:
> >>       
> >>> On Tue, 28 Aug 2007 17:55:17 -0400, Warren Togami wrote:
> >>>
> >>>         
> >>>> This afternoon I was attempting to diagnose why clumens' attempts to
>
> >>>> upload new source tarballs were failing, while it continued to work on 
> >>>> my machine and nobody else was complaining.
> >>>>           
> >>>> Didn't have time to isolate what exactly broke it, and I don't
> have a 
> >>>> local rawhide install here to do so quickly.  Can somebody figure out 
> >>>> what changed?
> >>>>           
> >>> Uploads are still done with "curl" afaik. So:
> >>>
> >>> * Tue Aug 28 2007 Jindrich Novy <jnovy(a)redhat.com&gt; 7.16.4-3
> >>> - don't use openssl, use nss instead
> >>>
> >>>         
> >> Yes, it's likely caused by the openssl -> nss switch, more at
> rhbz#266021.
> >>       
> > See also workaround in
> > https://bugzilla.redhat.com/show_bug.cgi?id=266021#c3 which requires
> > some changes to the Makefile though.
> >     
>  And the changes are here - supposed that the NSS cert db is in ~/.nss,
>  the cert nickname is Fedora and the NSS cert db password is not password
>  protected.
>
>  Index: Makefile.common
>  ===================================================================
>  RCS file: /cvs/pkgs/common/Makefile.common,v
>  retrieving revision 1.73
>  diff -u -r1.73 Makefile.common
>  --- Makefile.common     24 Jul 2007 17:10:44 -0000      1.73
>  +++ Makefile.common     31 Aug 2007 09:25:22 -0000
>  @@ -192,7 +192,7 @@
>   
>   # we hardwire curl in here because the upload rules are very dependent
>   # on curl's behavior on missing pages, ISEs, etc.
>  -UPLOAD_CERT       = $(shell if test -f $(HOME)/.fedora.cert ; then echo " --cert
> $(HOME)/.fedora.cert" ; fi)
>  +UPLOAD_CERT       = $(shell if test -d $(HOME)/.nss ; then echo " --cert Fedora
> --cacert $(HOME)/.nss" ; else if test -f $(HOME)/.fedora.cert ; then echo "
> --cert $(HOME)/.fedora.cert" ; fi ; fi)
>   UPLOAD_CHECK      = curl -k $(UPLOAD_CERT) --fail --silent
>   UPLOAD_CLIENT     = curl -k $(UPLOAD_CERT) --fail --show-error --progress-bar
>
>     
We'll have the pem loading working shortly. We had it in 
nss_compat_ossl, but it didn't get included in curl.

 Longer term we should put the cert in the NSS db as tomas's patch show, 
that way more than just curl can access the certificate.

bob