devel October 2014

devel@lists.centos.org

56 participants
52 discussions

Koji/CBS infra and sslv3/Poodle important notification
by Fabian Arrotin 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, As most of you already know, there is an important SSLv3 vulnerability (CVE-2014-3566 - see https://access.redhat.com/articles/1232123) , known as Poodle. While it's easy to disable SSLv3 in the allowed Protocols at the server level (for example SSLProtocol All -SSLv2 -SSLv3 for apache), some clients are still defaulting to SSLv3, and Koji does that. We currently have disabled SSLv3 on our cbs.centos.org koji instance, so if you're a cbs/koji user, please adapt your local koji package (local fix !) At the moment, there is no available upstream package, but the following patch has been tested by Fedora people too (and credits go to https://lists.fedoraproject.org/pipermail/infrastructure/2014-October/01497…) ===================================================== - --- SSLCommon.py.orig 2014-10-15 11:42:54.747082029 +0200 +++ SSLCommon.py 2014-10-15 11:44:08.215257590 +0200 @@ -37,7 +37,8 @@ if f and not os.access(f, os.R_OK): raise StandardError, "%s does not exist or is not readable" % f - - ctx = SSL.Context(SSL.SSLv3_METHOD) # SSLv3 only + #ctx = SSL.Context(SSL.SSLv3_METHOD) # SSLv3 only + ctx = SSL.Context(SSL.TLSv1_METHOD) # TLSv1 only ctx.use_certificate_file(key_and_cert) ctx.use_privatekey_file(key_and_cert) ctx.load_client_ca(ca_cert) @@ -45,7 +46,8 @@ verify = SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT ctx.set_verify(verify, our_verify) ctx.set_verify_depth(10) - - ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1) + #ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1) + ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1 | SSL.OP_NO_SSLv3) return ctx ===================================================== We'll keep you informed about possible upstream koji packages that would default to at least TLSv1 If you encounter a problem, feel free to drop into #centos-devel channel on irc.freenode.net and have a chat with us - -- Fabian Arrotin gpg key: 56BEC54E | twitter: @arrfab -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlQ+TPYACgkQnVkHo1a+xU7anwCeOxVUTLBLbUAP8K8qsLF+Xpom 79EAniQjrE/64TZT7b9zG76ti9GVcRND =buU9 -----END PGP SIGNATURE-----

2 1

Today's Atomic SIG Meeting
by Joe Brockmeier 14 Oct '14

14 Oct '14

Hi all, KB and I are at LinuxCon EU this week, and I think things are currently moving - do we want to skip the meeting this week, or are there any urgent issues we need to tackle today? Best, jzb -- Joe Brockmeier | Principal Cloud & Storage Analyst jzb(a)redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/

1 0

CBS/Infra Meeting 13-Oct-2014 13:00UTC
by Brian Stinson 13 Oct '14

13 Oct '14

Hi All, It's time for another CBS/Infra meeting on 13-Oct-2014 at 13:00 UTC in #centos-devel on freenode. Agenda: #info Topic: Status Updates #info Topic: Blockers and work on the Lookaside Cache #info Topic: Serving koji repos over https #info Topic: Open Floor Cheers! Brian -- Brian Stinson bstinson(a)ksu.edu | IRC: bstinson | Bitbucket/Twitter: bstinsonmhk

5 4

Re: [CentOS-devel] Contents of CentOS-devel digest..."
by Alemesegd GIDEY 11 Oct '14

11 Oct '14

On 10/11/14, centos-devel-request(a)centos.org <centos-devel-request(a)centos.org> wrote: > Send CentOS-devel mailing list submissions to > centos-devel(a)centos.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.centos.org/mailman/listinfo/centos-devel > or, , send a message with subject or body 'help' to > centos-devel-request(a)centos.org > > You can reach the person managing the list at > centos-devel-owner(a)centos.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of CentOS-devel digest..." > > > Today's Topics: > > 1. Missing upstream EL5 SRPMS (Orion Poplawski) > 2. Re: Missing upstream EL5 SRPMS (Orion Poplawski) > 3. CentOS artwork repository redesign proposal > (Alain Reguera Delgado) > 4. boxes in centos7 (Karanbir Singh) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 10 Oct 2014 11:48:03 -0600 > From: Orion Poplawski <orion(a)cora.nwra.com> > To: CentOS-devel(a)centos.org > Subject: [CentOS-devel] Missing upstream EL5 SRPMS > Message-ID: <54381BD3.3090009(a)cora.nwra.com> > Content-Type: text/plain; charset=utf-8 > > I'm trying to build a patched version of the firefox-31.1.0-6.el5.src.rpm > package for EL5, and am getting the following missing deps: > > DEBUG util.py:283: Error: No Package found for hunspell-devel > DEBUG util.py:283: Error: No Package found for libvpx-devel >= 1.3.0 > DEBUG util.py:283: Error: No Package found for system-bookmarks > > And indeed I cannot find any of those packages at > http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ (or > 5client). I realize this is more of an upstream issue, but was hoping > somebody here would have some insight from trying to build that for CentOS. > > -- > Orion Poplawski > Technical Manager 303-415-9701 x222 > NWRA, Boulder/CoRA Office FAX: 303-415-9702 > 3380 Mitchell Lane orion(a)nwra.com > Boulder, CO 80301 http://www.nwra.com > > > ------------------------------ > > Message: 2 > Date: Fri, 10 Oct 2014 12:51:54 -0600 > From: Orion Poplawski <orion(a)cora.nwra.com> > To: CentOS-devel(a)centos.org > Subject: Re: [CentOS-devel] Missing upstream EL5 SRPMS > Message-ID: <54382ACA.5020305(a)cora.nwra.com> > Content-Type: text/plain; charset=windows-1252 > > On 10/10/2014 11:48 AM, Orion Poplawski wrote: >> I'm trying to build a patched version of the firefox-31.1.0-6.el5.src.rpm >> package for EL5, and am getting the following missing deps: >> >> DEBUG util.py:283: Error: No Package found for hunspell-devel >> DEBUG util.py:283: Error: No Package found for libvpx-devel >= 1.3.0 >> DEBUG util.py:283: Error: No Package found for system-bookmarks >> >> And indeed I cannot find any of those packages at >> http://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ >> (or >> 5client). I realize this is more of an upstream issue, but was hoping >> somebody here would have some insight from trying to build that for >> CentOS. >> > > Looks like the centos src.rpm is modified quite a bit then. Using that as > my > base now. > > -- > Orion Poplawski > Technical Manager 303-415-9701 x222 > NWRA, Boulder/CoRA Office FAX: 303-415-9702 > 3380 Mitchell Lane orion(a)nwra.com > Boulder, CO 80301 http://www.nwra.com > > > ------------------------------ > > Message: 3 > Date: Fri, 10 Oct 2014 18:16:54 -0400 > From: Alain Reguera Delgado <alain.reguera(a)gmail.com> > To: "The CentOS developers mailing list." <centos-devel(a)centos.org> > Subject: [CentOS-devel] CentOS artwork repository redesign proposal > Message-ID: > <CANp_nwGa=6JHuAt-U=DarA_wDb3EjvdO28haiDq_OZOs96kh0A(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > > I've been working on a redesign of CentOS artwork repository based on > the suggestions made previously by Jim, Karsten, and Thoumas in the > mailing list. The initial proposal is at > > http://wiki.centos.org/ArtWork/Repository/Design > > and is ready for you to evaluate and improve. This is just a > proposition, so any feedback you could provide will be very useful and > appreciated. > > Thanks, > al. > > > ------------------------------ > > Message: 4 > Date: Sat, 11 Oct 2014 00:25:59 +0100 > From: Karanbir Singh <mail-lists(a)karan.org> > To: CentOS-devel(a)centos.org > Subject: [CentOS-devel] boxes in centos7 > Message-ID: <54386B07.7070808(a)karan.org> > Content-Type: text/plain; charset=ISO-8859-1 > > hi, > > almost every desktop install for CentOS-7 includes, boxes. The app to > help setup and manage virt instances. However we dont seem to actually > do anything to make it usable out of the box. > > should we ? if so, what would that be ? would pre-seeding an image list > in there be a worthwhile exercise ? > > - KB > > -- > Karanbir Singh > +44-207-0999389 | htt

1 0

When anyone has plan to have this patch to CentOS 6.5?
by Subscribe Ling 10 Oct '14

10 Oct '14

I am working my server project with libcurl on top of centos 6 for NTLM authentication HTTP request. Because of improper behavior of CURLOPT_FORBID_REUSE, I cannot have my server authenticate to IIS on behalf of AD users correctly. I found this issue has already been fixed in curl recently ( https://github.com/bagder/curl/commit/63a0bd4270decef04e64fbe497b42f2c9e26c…), is there anyone plan to patch this fix to centos 6? Thanks! Paul

2 2

Problem with initial-setup-text systemd job on headless server
by Bert 09 Oct '14

09 Oct '14

Hi If my email is TL;DR then the jist of my question/issue is: On a headless machine, you are never presented with the prompt to set up a user or accept the license agreement. (initial-setup job/package). I do run VNC server, and had gone through the GNOME welcome wizard, as a standard user and as root. A systemd job keeps running on boot that's presumably outputting the initial-setup-text program to [somewhere] but there's no way (that I know of) to give it input to tell it to accept the agreement and continue. The initial-setup-text systemd job means systemd-analyze outputs "Bootup is not yet finished. Please try again later." Manually running initial-setup-text and accepting the license agreement didn't seem to affect any change. Running the program again just said the license agreement hadn't been accepted. I just removed the initial-setup package via yum. The systemd job went away and systemd-analyze now reports bootup in x seconds etc. Are there any unforeseeable ramifications of doing this? At least my machine isn't spontaneously rebooting... Does the initial-setup package change/mark something somewhere that should perhaps be done manually? ---------- More detailed version: Following a test upgrade from 6.5 to 7 on a headless server (worked fine btw) I ran into a bit of a SNAFU with systemd and services. I was trying to troubleshoot a couple of legacy init.d scripts for some programs that just wouldn't seem to start correctly via systemd using the chkconfig legacy compatibility 'thingy'. The systemd-analyze tool kept saying that my machine hadn't finished booting up. I had performed the upgrade mid-September. The server has been rebooted a few times, but even after 3 days, I still got that message. BS I said. I've read the docs thoroughly on how to manage services, and, well, no services were really causing any problems (a couple were failing on start up, resolved most of those, still stuck on one but I could disable that) so I couldn't understand why systemd-analyze would keep reporting that my system hadn't "finished booting". I then stumbled upon the "systemctl list-jobs". This listed - among a couple of other jobs - an initial-setup-text program running as a job that was "waiting" (from memory). Possibly waiting on input. I can't remember. Realizing what this was, I tried to run it manually from my ssh console. Press 2, accepting the license agreement, c, c ... the job wouldn't "go away". The license also was never accepted. I ran it again, accepted the agreement, c, went back again. Still no change. So I killed the job... [root@trixie bin]# systemctl status initial-setup-text initial-setup-text.service - Initial Setup configuration program (text mode) Loaded: loaded (/usr/lib/systemd/system/initial-setup-text.service; disabled) Active: active (exited) since Thu 2014-10-09 13:35:50 NZDT; 7min ago Main PID: 993 (code=killed, signal=TERM) CGroup: /system.slice/initial-setup-text.service ..... and re-booted. It came back (the job that is). FFS. Still couldn't really use systemd-analyze to try and find out what's going on with my "legacy services" that aren't playing nice. So I... yum remove initial-setup [reboot] ... and now the job has gone. YAY. Maybe I should have done something differently, Oh well. My systemd-analyze now reports my system boots OK, and systemd list-jobs reports no jobs running. So I guess my bug report would go something like.... The initial-setup-text systemd job keeps coming back after reboots. There's no way (easy way that I could find) to provide input to the initial-setup-text systemd job on a headless system. Short of redirecting output to a com port and ... yeah... too hard. systemd never reports a successful boot if you have a job that never completes (and that keeps coming back). Removing the initial-setup-text package was the only way I could think of to get rid of it. My system doesn't behave erratically after doing this. I would suggest (if possible) that the initial-setup-text gets run when you SSH into your machine for the first time for you to accept the license agreement etc. Maybe it's not even required. I did see a couple of bugzilla reports ( http://bugs.centos.org/view.php?id=7173) that maybe suggested that. Cheers, Bert

1 0

Atomic SIG Meeting Minutes 7 October 2014
by Joe Brockmeier 07 Oct '14

07 Oct '14

Hi all, Please find minutes and link to the full log below. Thanks! ========================== #atomic: CentOS Atomic SIG ========================== Meeting started by jzb at 14:34:09 UTC. The full logs are available at http://meetbot.fedoraproject.org/atomic/2014-10-07/atomic.2014-10-07-14.34.… . Meeting summary --------------- * Hardware for bare metal work (jzb, 14:35:32) * LINK: https://github.com/CentOS/sig-atomic-buildscripts coming here (kbsingh, 15:20:14) * ACTION: imcleod Attempt to set up private builds, then a plan for getting Docker + Atomic updates into COPR or CBS (jzb, 15:26:04) * ACTION: imcleod work on plan to create regular Atomic builds (jzb, 15:26:32) * ACTION: Evolution add SIG members to github repo (jzb, 15:26:47) * ACTION: kbsingh upload JSON files for Atomic to https://github.com/CentOS/sig-atomic-buildscripts (jzb, 15:27:01) * ACTION: walters work with imcleod to see if we can get CentOS Atomic AMIs by AWS re:Invent. (jzb, 15:32:35) * ACTION: jzb get link to Docker CBS builds for walters (jzb, 15:35:11) Meeting ended at 15:35:26 UTC. Action Items ------------ * imcleod Attempt to set up private builds, then a plan for getting Docker + Atomic updates into COPR or CBS * imcleod work on plan to create regular Atomic builds * Evolution add SIG members to github repo * kbsingh upload JSON files for Atomic to https://github.com/CentOS/sig-atomic-buildscripts * walters work with imcleod to see if we can get CentOS Atomic AMIs by AWS re:Invent. * jzb get link to Docker CBS builds for walters Action Items, by person ----------------------- * Evolution * Evolution add SIG members to github repo * imcleod * imcleod Attempt to set up private builds, then a plan for getting Docker + Atomic updates into COPR or CBS * imcleod work on plan to create regular Atomic builds * walters work with imcleod to see if we can get CentOS Atomic AMIs by AWS re:Invent. * jzb * jzb get link to Docker CBS builds for walters * kbsingh * kbsingh upload JSON files for Atomic to https://github.com/CentOS/sig-atomic-buildscripts * walters * walters work with imcleod to see if we can get CentOS Atomic AMIs by AWS re:Invent. * jzb get link to Docker CBS builds for walters * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * jzb (64) * kbsingh (51) * jbrooks (41) * imcleod (32) * walters (26) * Evolution (7) * zodbot (6) * maxamillion (5) * centbot (3) * quaid (2) * dustymabe (1) * number80 (1) * dwalsh (1) * gregdek (0) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot -- Joe Brockmeier | Principal Cloud & Storage Analyst jzb(a)redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/

1 0

How to run cloud image for 6.5?
by Henning Sprang 07 Oct '14

07 Oct '14

Hi, On my way to run centOS 6.5 on OpenStack I found the cloud images at http://cloud.centos.org/centos/6.5/devel/ and while the corresponding image for centOS 7 seems to work fine, I still need the older version for some legacy application, but I cannot find a way to run the images provided in that directory. Especially I'm looking at http://cloud.centos.org/centos/6.5/devel/CentOS-6.5-x86_64-GA-03.img.gz, but as well uploading the unzppied .img file to OpenStack as image and trying to boot an instance with it, as well as runinng it locally with qemu-system-i386 CentOS-6.5-x86_64-GA-03.img both give me the same error - "Boot failed - not a bootable disk" Any idea what I could be doing wrong / should be doing to get it booting? Thanks, Henning

1 0

docker 1.2.0 packages on virt7-testing
by Lokesh Mandvekar 07 Oct '14

07 Oct '14

Sorry for creating a new thread about this. I switched my real email id for this alias, riseup email has been acting up for me for whatever reason. Anyway, RE: fetching docker 1.2.0 from virt7-testing, as was asked about on the previous thread, you can find them here: http://cbs.centos.org/repos/virt7-testing/x86_64/os/Packages/ (Thanks to MerlinTHP on #centos-devel :) ) HTH. -- Lokesh Freenode, OFTC: lsm5

3 2

Meeting Reminder: Atomic SIG 14:30 UTC Tuesday
by Joe Brockmeier 07 Oct '14

07 Oct '14

Hi all, Reminder that there's an Atomic SIG meeting scheduled for 14:30 tomorrow for the CentOS Atomic SIG. Meeting is held in the #atomic channel on Freenode. To get the time for your time zone*, use: date -d "2014-10-07 14:30 UTC" If you have any agenda items, please send them my way. Here's the action items from last week: * jzb ping SIG members on wiki access. * jzb open discussion on how Atomic should be listed in bugs.centos.org. (Done) * jzb to follow up with quaid on getting hardware for bare metal work under *centos.org. (Done) * bexelbie put out docs workflow to mailing list to see if there's any dissent/better ideads. * jzb get Atomic definition out by end of week to Project Atomic (SIG will want to review) (Done) Topics this week: * Status on key/signing. * Roadmap for next release/timeline. * Discuss Atomic definition. Best, jzb * Assuming your system's time is your local time. If your system time is already UTC, then it won't help much. But then you already know what UTC time it is, so... -- Joe Brockmeier | Principal Cloud & Storage Analyst jzb(a)redhat.com | http://community.redhat.com/ Twitter: @jzb | http://dissociatedpress.net/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel October 2014