devel March 2022

devel@lists.centos.org

26 participants
24 discussions

CentOS Stream 9 Build environment outage today
by Brian Stinson 21 Mar '22

21 Mar '22

Hi Folks, We have a migration in progress for the CentOS Stream 9 environment today. This will affect access to kojihub.stream.centos.org while we work on this. I'll post a note here when our outage is clear. Mirror content will remain available, composes.stream.centos.org may be affected periodically throughout the day. --Brian

1 0

Re: [CentOS-devel] RHEL moving to issues.redhat.com only long term
by Josh Boyer 15 Mar '22

15 Mar '22

On Mon, Mar 14, 2022 at 2:59 PM Dan Čermák <dan.cermak(a)cgc-instruments.com> wrote: > > Hi Adam, > > Adam Williamson <adamwill(a)fedoraproject.org> writes: > > > snip > > > That could obviously have pretty significant consequences for Fedora. > > Bugzilla isn't only an issue tracker for Fedora; we run some > > significant processes through it, notably the Change process, the > > blocker/FE bug process, and the prioritized bug process. In A World > > Without Bugzilla all of those would need adapting (and their > > documentation updating). There's fairly tight integration between Bodhi > > and Bugzilla, which would need to be redesigned. Those are just things > > I can think of off the top of my head. There are also a couple of > > decades worth of internet links to Fedora issues on RH Bugzilla, of > > course. > > > > I guess the two big choices for Fedora if RH said "we're not > > maintaining Bugzilla any more" would be 1) take over maintaining > > Bugzilla or 2) switch to something else. 1) would probably be the path > > of least resistance, I guess. > > Short term it is the path of the least resistance, but at least what > I've heard from $dayjob, maintaining a Bugzilla instance is no easy > task, as they are often customized (via non-upstream patches) and this > all needs to be maintained. I cannot speak for our infra team, but I > really don't know if they'd like yet another huge service, because this > effectively means they'd have to take over maintenance of > bugzilla.redhat.com... > > > > > This does also kinda lead to a larger question for me, trying to wear > > both Red Hat and Fedora hats at the same time[0]. I wonder if we're > > kind of lacking a...mechanism, for want of a better word, to handle the > > *generic* case here. Let's rewind to Ye Olde Days, when "the Fedora > > project" first started. At that point Fedora and Red Hat shared a lot > > of tooling and infrastructure, and this was useful to both sides in > > many ways; it saves on development costs and it makes it easy for > > people to work in both worlds. With my Red Hat on, I think I'm allowed > > to say that internally we often talk about this being desirable - > > having consistency between how X is done in Fedora and how it's done > > for RHEL - and it obviously has benefits to Fedora too (it means we > > don't have to find the resources to do that same work at Fedora level). > > > > However, situations like this make me wonder if we might have an issue > > with keeping shared infra/tooling where it's desirable. It seems like > > this is a decision/conversation that's been happening within RH, about > > what makes sense for RH in terms of RHEL development. AFAIK this is the > > first time it's been formally talked about in a Fedora context, and the > > messaging is "RH has already decided to stop using Bugzilla for RHEL > > after 9". In other words, RH has decided on its own to move away from > > something that is part of the shared RH/Fedora "heritage way of doing > > things". > > > > I'm not saying that's wrong, but as I said it does make me wonder > > whether, if both sides do find shared tooling/approaches beneficial, we > > might want to approach this kind of potential change differently in > > future. Otherwise it does seem like we could sort of gradually drift > > apart, with no explicit intention to do so, and lose the benefits of > > shared tooling and process. Unless the ultimate outcome of this is > > "Fedora adopts issues.redhat.com for bug tracking" - which would be a > > possibility, but doesn't seem like a certainty - the result will be > > that we go from having a shared bug tracker, with the benefits of > > shared maintenance and being able to easily clone or reference bugs > > between Fedora and RHEL, to each maintaining our own bug tracker and > > not having those benefits. > > > > Of course, there would be sensitivities in developing such a process - > > it could look a lot like Red Hat telling Fedora how to do stuff, which > > I think isn't exactly the relationship we want to have. But at the same > > time I'm not sure "Red Hat or Fedora just deciding unilaterally to stop > > using this thing they'd previously both used" is always the best choice > > either. > > No, certainly not. I think it would have been nice if the tooling > discussion happened before RH decided to drop Bugzilla so that we can > all use a common tooling. However, I also know that in a business RHEL is choosing not to use Bugzilla for future versions of RHEL. I need to be clear in wording there, because Red Hat is a company, RHEL is one of its products, and we're only talking about newer versions of that product. I am not aware of any plans for Red Hat to drop Bugzilla. I am aware of plans for newer versions of RHEL to no longer use Bugzilla. > sometimes reaching such a consensus is everything but easy. It would > have been nice if someone at least tried though. Tried what, to be precise? If you mean try to find common tooling between Fedora and RHEL, well we have off and on for years. Several things work. Many didn't. If you mean try to use bugzilla, we've been trying for the last 5 years internally to make it work in conjunction with issues.redhat.com. It's not working and it's time to consolidate to a single tool. That decision has no direct bearing on Fedora though. If you mean try having a conversation with the community before something goes into effect... that's what this thread is. Depending on how you count, at least a year in advance if not 3. If you meant something else, I've missed it. josh

1 0

Re: [CentOS-devel] RHEL moving to issues.redhat.com only long term
by Josh Boyer 15 Mar '22

15 Mar '22

On Mon, Mar 14, 2022 at 11:12 AM Adam Williamson <adamwill(a)fedoraproject.org> wrote: > > On Mon, 2022-03-07 at 12:44 -0500, Josh Boyer wrote: > > Hi Fedora, CentOS, and EPEL Communities! > > > > As part of our continued 3 year major Red Hat Enterprise Linux release > > cadence, RHEL 9 development is starting to wrap up with the spring > > 2022 release coming soon. That means planning for the next release > > will start in earnest in the very near future. As some of you may > > know, Red Hat has been using both Bugzilla and Jira via > > issues.redhat.com for RHEL development for several years. Our > > intention is to move to using issues.redhat.com only for the major > > RHEL releases after RHEL 9. > > > > What does this mean for Fedora and CentOS? This discussion is in part > > to figure that out. Based on some very brief analysis, the following > > should hold: > > > > - RHEL customers should continue to file support cases through the Red > > Hat Customer portal, which will remain consistent regardless of the > > backend tooling used. > > > > - There is no imminent retirement of the Red Hat Bugzilla instance > > being planned at this time. RHEL 7, 8, and 9 will continue to use > > bugzilla in some form and RHEL 9 has a very long lifecycle. > > > > - Fedora Linux and EPEL have their own Bugzilla product families and > > are not directly impacted in their own workflows by the choice to use > > only issues.redhat.com for RHEL. > > - There will be impacts on existing documentation that provide > > guidance on requesting things from RHEL in various places like EPEL. > > We will be happy to help adjust these. > > > > - CentOS Stream contribution and bug reporting workflows will be > > adjusted to use issues.redhat.com instead of bugzilla in the relevant > > places. This should apply to all versions of CentOS Stream for a > > unified contributor workflow. This will happen gradually as we > > discover the best workflow to use. > > > > If there are other impacts that you can think of, please raise them on > > this thread. We’d like to ensure we’re covering as much as possible > > as this rolls out. > > So if I'm understanding this correctly, the ultimate consequence here > is "Red Hat Bugzilla might go away, or stop being maintained, at > whatever point it's no longer needed for RHEL 9", right? I have no idea, to be honest. There's a lot of assumption in that statement and it certainly could be an outcome, but I'm not aware of any plans towards that directly. > That could obviously have pretty significant consequences for Fedora. > Bugzilla isn't only an issue tracker for Fedora; we run some > significant processes through it, notably the Change process, the > blocker/FE bug process, and the prioritized bug process. In A World > Without Bugzilla all of those would need adapting (and their > documentation updating). There's fairly tight integration between Bodhi > and Bugzilla, which would need to be redesigned. Those are just things > I can think of off the top of my head. There are also a couple of > decades worth of internet links to Fedora issues on RH Bugzilla, of > course. Those all sound like the things I'm familiar with. > I guess the two big choices for Fedora if RH said "we're not > maintaining Bugzilla any more" would be 1) take over maintaining > Bugzilla or 2) switch to something else. 1) would probably be the path > of least resistance, I guess. > > This does also kinda lead to a larger question for me, trying to wear > both Red Hat and Fedora hats at the same time[0]. I wonder if we're > kind of lacking a...mechanism, for want of a better word, to handle the > *generic* case here. Let's rewind to Ye Olde Days, when "the Fedora > project" first started. At that point Fedora and Red Hat shared a lot > of tooling and infrastructure, and this was useful to both sides in > many ways; it saves on development costs and it makes it easy for > people to work in both worlds. With my Red Hat on, I think I'm allowed > to say that internally we often talk about this being desirable - > having consistency between how X is done in Fedora and how it's done > for RHEL - and it obviously has benefits to Fedora too (it means we > don't have to find the resources to do that same work at Fedora level). Fedora and RHEL process and tooling has deviated significantly over the years. So much so that by the time I joined the RHEL team, it was already very different. That was almost 5 years ago, which means the individual decisions that led to it were even earlier. I don't really want to revisit those decisions because I wasn't around and can't speak to why they were made, but the connection between Fedora and RHEL via bugzilla is minimal at best. The commonality that brings the most shared benefit is the activities of our communities, the quality and rigor they bring into Fedora, and the sources we share. Tooling and process are orthogonal to those. Important, because they certainly lend themselves to aiding that quality and rigor, but orthogonal. > However, situations like this make me wonder if we might have an issue > with keeping shared infra/tooling where it's desirable. It seems like > this is a decision/conversation that's been happening within RH, about > what makes sense for RH in terms of RHEL development. AFAIK this is the > first time it's been formally talked about in a Fedora context, and the > messaging is "RH has already decided to stop using Bugzilla for RHEL > after 9". In other words, RH has decided on its own to move away from > something that is part of the shared RH/Fedora "heritage way of doing > things". I don't think this is the first instance of those kinds of decisions. It is perhaps one of the few instances where we've been up-front about it well in advance. > I'm not saying that's wrong, but as I said it does make me wonder > whether, if both sides do find shared tooling/approaches beneficial, we I think we do in some cases, and not in others. I don't find bugzilla to be one of those. Even the clone function is questionable. > might want to approach this kind of potential change differently in > future. Otherwise it does seem like we could sort of gradually drift > apart, with no explicit intention to do so, and lose the benefits of > shared tooling and process. Unless the ultimate outcome of this is >From my perspective, we minimally share tooling. Process is common in concepts, but RHEL process is far more additive and heavy-weight than anything Fedora does. > "Fedora adopts issues.redhat.com for bug tracking" - which would be a > possibility, but doesn't seem like a certainty - the result will be To be clear, it is not an explicit goal for Fedora to adopt issues.redhat.com. That's up to the Fedora project, much as adoption of gitlab was. > that we go from having a shared bug tracker, with the benefits of > shared maintenance and being able to easily clone or reference bugs > between Fedora and RHEL, to each maintaining our own bug tracker and > not having those benefits. Personally, I don't think we're taking advantage of perceived benefits at all. They are effectively separate. > Of course, there would be sensitivities in developing such a process - > it could look a lot like Red Hat telling Fedora how to do stuff, which > I think isn't exactly the relationship we want to have. But at the same > time I'm not sure "Red Hat or Fedora just deciding unilaterally to stop > using this thing they'd previously both used" is always the best choice > either. The Fedora decision is up to Fedora. RHEL is driven by product constraints and will evaluate based on those needs. Where we can align, we should. For a recent example of a decision to align more, look at the CKI project. Both Fedora and RHEL benefit greatly from maintaining the kernel in the CKI manner, and this is the closest the Fedora and RHEL kernels have ever been. josh

1 0

NFV SIG - AVC denials with openvswitch
by Sandro Bonazzola 14 Mar '22

14 Mar '22

Hi, while testing oVirt for 4.5 alpha I noticed on the ovirt-engine side: # ausearch -m avc|grep den type=AVC msg=audit(1646758341.539:780): avc: denied { search } for pid=38783 comm="modprobe" name="events" dev="tracefs" ino=45 scontext=system_u:system_r:openvswitch_load_module_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1646758341.539:780): avc: denied { search } for pid=38783 comm="modprobe" name="events" dev="tracefs" ino=45 scontext=system_u:system_r:openvswitch_load_module_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1646881861.570:998): avc: denied { write } for pid=97466 comm="ovs-appctl" name="ovnnb_db.ctl" dev="tmpfs" ino=195196 scontext=system_u:system_r:openvswitch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1646881861.573:999): avc: denied { write } for pid=97467 comm="ovs-appctl" name="ovn-northd.38883.ctl" dev="tmpfs" ino=195260 scontext=system_u:system_r:openvswitch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1646881861.575:1000): avc: denied { write } for pid=97468 comm="ovs-appctl" name="ovnsb_db.ctl" dev="tmpfs" ino=198897 scontext=system_u:system_r:openvswitch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1646969461.086:1037): avc: denied { write } for pid=122222 comm="ovs-appctl" name="ovnnb_db.ctl" dev="tmpfs" ino=195196 scontext=system_u:system_r:openvswitch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1646969461.089:1038): avc: denied { write } for pid=122223 comm="ovs-appctl" name="ovn-northd.38883.ctl" dev="tmpfs" ino=195260 scontext=system_u:system_r:openvswitch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1646969461.091:1039): avc: denied { write } for pid=122224 comm="ovs-appctl" name="ovnsb_db.ctl" dev="tmpfs" ino=198897 scontext=system_u:system_r:openvswitch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1647265858.456:54): avc: denied { search } for pid=1245 comm="modprobe" name="events" dev="tracefs" ino=45 scontext=system_u:system_r:openvswitch_load_module_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1647265858.456:54): avc: denied { search } for pid=1245 comm="modprobe" name="events" dev="tracefs" ino=45 scontext=system_u:system_r:openvswitch_load_module_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 Involved packages are: dnf list installed "*openvswitch*" Installed Packages centos-release-nfv-openvswitch.noarch 1-3.el8 @extras openvswitch-selinux-extra-policy.noarch 1.0-28.el8 @centos-nfv-openvswitch openvswitch2.15.x86_64 2.15.0-81.el8s @centos-nfv-openvswitch ovirt-openvswitch.noarch 2.15-3.el8 @centos-ovirt45-testing ovirt-openvswitch-ovn.noarch 2.15-3.el8 @centos-ovirt45-testing ovirt-openvswitch-ovn-central.noarch 2.15-3.el8 @centos-ovirt45-testing ovirt-openvswitch-ovn-common.noarch 2.15-3.el8 @centos-ovirt45-testing ovirt-python-openvswitch.noarch 2.15-3.el8 @centos-ovirt45-testing python3-openvswitch2.15.x86_64 2.15.0-81.el8s @centos-nfv-openvswitch As the openvswitch packages are coming from centos-release-nfv-openvswitch reporting to centos devel (no more specific location mentioned on https://wiki.centos.org/ReportBugs ) -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

1 1

Board office hours, March 16
by Shaun McCance 09 Mar '22

09 Mar '22

Hi all, First, I want to apologize if any guests were unable to join the board meeting today. We had technical issues and had to switch to a different room, and we might not have gotten the new URL to everybody. Minutes and recording will be posted shortly. We will have our monthly board office hours next week, so if you have questions, you can bring them there. Join us Wednesday, March 16 at 15:00 UTC. **NOTE** Some people will start daylight savings this weekend. The meeting time is in UTC. Double-check your local time. Local time: `date -d "2022-03-16 15:00 UTC"` Video call link: https://meet.google.com/wtn-zwwz-dca If you need dial-in details instead, just email me off-list. Thanks, Shaun

1 0

CPE Weekly Update – Week of February 28th – March 3rd
by Michal Konecny 04 Mar '22

04 Mar '22

Hi everyone, This is a weekly report from the CPE (Community Platform Engineering) Team. If you have any questions or feedback, please respond to this report or contact us on #redhat-cpe channel on libera.chat (https://libera.chat/). If you wish to read this in form of a blog post, check the post on Fedora community blog: https://communityblog.fedoraproject.org/cpe-weekly-update-week-of-february-… # Highlights of the week ## Infrastructure & Release Engineering Goal of this Initiative ----------------------- Purpose of this team is to take care of day to day business regarding CentOS and Fedora Infrastructure and Fedora release engineering work. It’s responsible for services running in Fedora and CentOS infrastructure and preparing things for the new Fedora release (mirrors, mass branching, new namespaces etc.). The ARC (which is a subset of the team) investigates possible initiatives that CPE might take on. Update ------ ### Fedora Infra * One new power9 online in iad2, second one needs hands on today. * Almost all bugzilla auth changes made, still need some changes to toddlers (ongoing) * Container builds broken again in an odd way ( https://pagure.io/releng/issue/10658) * Discussion on fedoraplanet.org on infrastructure list, please chime in if you have thoughts about it. ### CentOS Infra including CentOS CI * Migration of Pagure to new CentOS CI in progress * Openssl3 [late change](https://gitlab.com/redhat/centos-stream/rpms/openssl/-/commit/78fb7… in EL9 impacting SIGs and gpg keys ### Release Engineering * Work on SCM request automation in progress - [PR](https://pagure.io/fedora-infra/toddlers/pull-request/93) * Container builds failing on armhfp * Bussiness as usual ## CentOS Stream Goal of this Initiative ----------------------- This initiative is working on CentOS Stream/Emerging RHEL to make this new distribution a reality. The goal of this initiative is to prepare the ecosystem for the new CentOS Stream. Updates ------- * Investigating compose QA improvements both in the t-functional suite and changes we may want to implement later in the project. * Developing sync2gitlab service for 8, 9 workflow alignment * Business as usual activities around CentOS Linux 7 * Work continuing on content resolvers maintainer pages also ## CentOS Duffy CI Goal of this Initiative ----------------------- Duffy is a system within CentOS CI Infra which allows tenants to provision and access bare metal resources of multiple architectures for the purposes of CI testing. We need to add the ability to checkout VMs in CentOS CI in Duffy. We have OpenNebula hypervisor available, and have started developing playbooks which can be used to create VMs using the OpenNebula API, but due to the current state of how Duffy is deployed, we are blocked with new dev work to add the VM checkout functionality. Updates ------- * Demo/Status call * Deployment to staging (ongoing) * Documentation (ongoing) * Expiring sessions (ongoing) ## Image builder for Fedora IoT Goal of this Initiative ----------------------- Integration of Image builder as a service with Fedora infra to allow Fedora IoT migrate their pipeline to Fedora infra. Updates ------- * No updates ## Bodhi Goal of this Initiative ----------------------- This initiative is to separate Bodhi into multiple sub packages, fix integration and unit tests in CI, fix dependency management and automate part of the release process. Read ARC team findings in detail at: https://fedora-arc.readthedocs.io/en/latest/bodhi/index.html Updates ------- * No updates ## EPEL Goal of this initiative ----------------------- Extra Packages for Enterprise Linux (or EPEL) is a Fedora Special Interest Group that creates, maintains, and manages a high quality set of additional packages for Enterprise Linux, including, but not limited to, Red Hat Enterprise Linux (RHEL), CentOS and Scientific Linux (SL), Oracle Linux (OL). EPEL packages are usually based on their Fedora counterparts and will never conflict with or replace packages in the base Enterprise Linux distributions. EPEL uses much of the same infrastructure as Fedora, including buildsystem, bugzilla instance, updates manager, mirror manager and more. Updates ------- * EPEL9 up to 2059 source packages (increase of 71 from last week) * EPEL9 buildroot has switched to a snapshot of the CentOS Stream 9 mirror, to avoid building against any 9.1 changes prior to the RHEL 9.0 GA * [EPEL Office Hours](https://communityblog.fedoraproject.org/epel-office-hours/) were yestarday at 1700 UTC * epel-release (and epel-next-release) now available in CentOS Stream 9 Extras repo Kindest regards, CPE Team

1 0

GPG check FAILED using CentOS Stream 9 Extras and other SIG Keys
by Brian Stinson 03 Mar '22

03 Mar '22

Hi Folks, OpenSSL in CentOS Stream and RHEL 9 intends to remove the sha1 algorithm, and recently a build landed that makes this change. When that build first went to testing we noticed that the CentOS SIG rpm signing keys (including the one enabled by default for Extras) contained a sha1 signature on one of the subkeys, which caused trouble validating rpms. We have begun to mitigate this by re-signing the offending subkey in the Extras signing key and are currently pushing a compose to the mirrors. If you've previously imported the Extras key (like if you've installed a SIG centos-release package on your system), you may notice messages during an rpm transaction like: `Key import failed (code 2)` followed by `Error: GPG check FAILED` To continue you will need to update to centos-gpg-keys-9.0-12.el9 (plus the corresponding centos-stream-release package) and perform a manual step: `rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512` Since all of the SIG keys are affected as well, we are working on re-signing subkeys for those SIGs that are currently shipping content for CentOS Stream 9. We will post links to the updated pubkeys and SIG leaders will need to rebuild their centos-release packages to include these new keys. We expect references to those new keys to be published in the next couple of days. If there are any questions please find us in #centos-devel or #centos-stream in libera, or reply here. Cheers! --Brian References: https://bugzilla.redhat.com/show_bug.cgi?id=2059424

4 4

Introducing the Automotive Stream Distribution
by Pierre-Yves Chibon 02 Mar '22

02 Mar '22

Good Morning Everyone! The CentOS Automotive SIG is excited to announce the Automotive Stream Distribution. This is a binary distribution developed within the SIG that serves as a public, in-development preview of the upcoming Red Hat in-vehicle OS. More information can be found at: https://blog.centos.org/2022/03/centos-automotive-sig-announces-new-autosd-… Best regards, Pierre PS: I had sent this email 13 hours ago but from the wrong account... and I didn't get an error that my messages had been discarded so I didn't notice that it had not reached the list, my apologies for this :(

1 0

CentOS Automotive SIG meeting this week
by Jeffrey Osier-Mixon 02 Mar '22

02 Mar '22

Hi all - just a quick reminder that the next SIG meeting is tomorrow, March 2, at 1500 UTC (10am EDT, 4pm CET). We will talk about the establishment of the AutoSD distro and how to use it. RSVP is not necessary, and everyone is welcome to join. The meeting will be held via Google Meet at this link: https://meet.google.com/hkx-btgd-dyc Please let me know if you would like to be added to the invitation going forward. best, Jeffrey "Jefro" Osier-Mixon | jefro(a)redhat.com Red Hat Office of the CTO | Sr. Principal Community Architect, Automotive

3 3

CS8 repos / repomd.xml.asc
by Leon Fauster 02 Mar '22

02 Mar '22

Hey. It seems that the mirrors do not have the repomd.xml.asc file. Does the main repo provide it? -- Thanks Leon

5 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel March 2022