devel February 2021

devel@lists.centos.org

62 participants
46 discussions

RFC: Stream Kernel SIG Proposal
by redbaronbrowser 19 May '21

19 May '21

There are four main goals of this SIG: First, break down changes in the Stream version 4.18.0 kernel into individual patches. When possible, document the source the patch is from and the purpose of the patch. Moving forward also document which Stream kernel package revision introduced the patch. Second, build CentOS Plus kernel for Stream. Third, package newer LTS kernels during the LTS lifespan. These would be available as alternative kernels for Stream similar to the CentOS Plus kernel. Fourth, work on tools for better delivery of live security patches to be applied via kpatch. The reasoning for this SIG is to improve the openness of kernels available through Stream. Normally a distribution upstream would have access to which patch or commit each addition to the kernel belongs to. The patch name or commit comment would also give information as to the purpose of the patch. Stream's kernel reports to be 4.18.0 but uses a tar that is 110% the size of a true 4.18.0 tar. A breakdown of the additional 10% is not provided. Hence Stream's kernel still functions similar to a downstream rather than providing what is expected for a successful upstream project. This SIG would help close the kernel openness gap by documenting the changes. Stream users would then be in a better position to track down individual patches that cause regressions or bugs. This SIG would also help smooth the adoption of Stream for users that depend on CentOS Plus kernel features. Next, this SIG should help improve feedback to the LTS kernel developers. Tracking LTS kernel changes may also help with documenting some changes in the primary Stream kernel. Lastly, this SIG should help improve kernel security by promoting methods to enable kernel security updates even when a reboot of the system is not possible.

12 42

Announcing ROSI - RHEL for Open Source Infrastructure
by Mike McGrath 03 Mar '21

03 Mar '21

Hi all, as I did last month I thought I'd keep the list up to date with today's free RHEL announcement: https://www.redhat.com/en/blog/extending-no-cost-red-hat-enterprise-linux-o… This one is targeted at Open Source projects and organizations. I know some of you, in particular, are interested in academic or non-profit uses. Today's announcement is *not* the one you're looking for so stay tuned, we're still evaluating some of the feedback and more announcements are planned. -- Mike McGrath Linux Engineering - Chicago Red Hat mmcgrath(a)redhat.com T: (312)-660-3547

12 21

Re: [CentOS-devel] re CVE errata in CentOS Stream
by redbaronbrowser 02 Mar '21

02 Mar '21

On Friday, February 19, 2021 5:47 PM, Josh Boyer <jwboyer(a)redhat.com> wrote: > On Fri, Feb 19, 2021 at 5:47 PM redbaronbrowser > redbaronbrowser(a)protonmail.com wrote: > > > I'm not asking for anything ahead of RHEL customers getting it. All I am asking for is pre-approval from management to get access as an Upstream once a problem with RHEL is confirmed. > > If you mean "get access to the fixed code" or "get access to a fixed > build", in a situation like the post-Boot Hole scenario there is no > pre-approval necessary. We will do our best to resolve the issue in > Stream as quickly as possible. You keep coming back to the Fix for the Broken-Fix. I believe you when you say Red Hat has always been working as quickly as possible to Fix any Broken-Fixes. However, once they have the fix the lifecycle of the bug is over. Stream isn't interesting from the perspective of completed bug lifecycles. The interesting aspect to closing the openness gap is the mid-lifecycle of the bug. I am trying to focus on how quickly will Stream users be able to contribute to the fixing of a Broken-Fix. I am sorry if I am parsing too much into Mike's response, but it read to me like it is possible for the code to a Broken-Fix to, by policy, be withheld to only the "entitled" RHEL subscribers to access. I'm asking to what degree Red Hat expects to be able to take advantage us while an active Bugzilla entry exist because a CVE "fix" had unintended side-effects. Can we get quick transparency into accessing broken packages and code even if that broken build is a CVE "fix" related? Or is the policy that we will sit on the sidelines for Red Hat by itself to fix broken security patches much like CentOS has always operated before Stream?

9 32

CPE Weekly Report: 2021-02-26
by Aoife Moloney 26 Feb '21

26 Feb '21

Hi Everyone, If you would like to see this report and toggle to the section you are most interested in, I would suggest visiting this link https://hackmd.io/8iV7PilARSG68Tqv8CzKOQ?view and use the header bar on your left to skip to where you want to go! ## Initiative FYI Links Initiatives repo here: https://pagure.io/cpe/initiatives-proposal 2021 Quarterly Planning timetable here: https://docs.fedoraproject.org/en-US/cpe/time_tables/ so you know when I need it in by to review it. Details on initiative requesting/how to work with us on new projects here: https://docs.fedoraproject.org/en-US/cpe/initiatives/ ### Misc I hope you all enjoyed DevConf.cz last week! There were some great talks and I am looking forward to catching up on the ones I unfortunately missed when they are posted in a few weeks! Also if you missed the CentOS Dojo at FOSDEM, you can watch all talks on the CentOS YouTube channel here https://www.youtube.com/playlist?list=PLuRtbOXpVDjC7RkMYSy-gk47s5vZyKPbt ## Project Updates *The below updates are pulled directly from our CPE team call we have every week.* ## CentOS Updates ### CentOS * CentOS CI updated OCP to 4.6.17 * Rolled out security fixes to ci.centos.org Jenkins and cert update ### CentOS Stream * Documentation updated on the shortened CentOS Linux -> CentOS Stream conversion, see the demo here https://asciinema.org/a/393875 * CentOS Extras is now separately delivered for Stream and Linux * CentOS Stream 8 container images are published now to quay.io ### Fedora * We are now in F34 freeze! All changes to frozen hosts take 2 +1s * Bodhi updates-testing activated for F34 * Fedscm-admin work started on default branches * Openh264 repos are hosted on Cisco CDN ### Noggin/AAA * User migration script has been successfully re-run * Lots of docs updates - check out the docs section for more information https://noggin-aaa.readthedocs.io/en/latest/ * PR opened for changes to docs to add pkinit to docs to allow applicable certs be shipped for packages but it seems fedora-packager Fedora package has to be built with the change applied https://pagure.io/fedora-packager/pull-request/166 * If you are experiencing any issues with your application authenticating with Noggin, please reach out to the team on IRC channel #fedora-aaa * The work tracker for this project can be found here https://github.com/orgs/fedora-infra/projects/6 * And please report any issues you find in the repo https://github.com/fedora-infra/noggin ## Team Info ### Background: The Community Platform Engineering group, or CPE for short, is the Red Hat team combining IT and release engineering from Fedora and CentOS. Our goal is to keep core servers and services running and maintained, build releases, and other strategic tasks that need more dedicated time than volunteers can give. See our wiki page here for more information:https://docs.fedoraproject.org/en-US/cpe/ As always, feedback is welcome, and we will continue to look at ways to improve the delivery and readability of this weekly report. Have a great weekend! Aoife Source: https://hackmd.io/8iV7PilARSG68Tqv8CzKOQ?view -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA Communications House Cork Road Waterford

1 0

[CloudSiG] Meeting notes from 2021-02-25
by Amy Marrich 25 Feb '21

25 Feb '21

Congratulations to new co-chairs Alfredo Moralejo Alonso and Paul B. Isaacs. Also, please note the SiG will be moving to a bi-weekly meeting cadence on even weeks. And lastly, but not least importantly! Welcome to our new SiG members - davdunc, hrw, and konkan Thanks, Amy ====================================================== #centos-meeting: CentOS Cloud SIG meeting (2021-02-25) ====================================================== Meeting started by spotz at 15:00:31 UTC. The full logs are available athttps://www.centos.org/minutes/2021/February/centos-meeting.2021-02-25-15… . Meeting summary --------------- * Roll Call (spotz, 15:00:52) * LINK: https://etherpad.opendev.org/p/centos-cloud-sig (spotz, 15:01:50) * Close Nominaations (spotz, 15:13:43) Meeting ended at 16:00:09 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * spotz (40) * amoralej (32) * paulbisaacs (19) * apevec (9) * centbot (7) * ykarel (4) * jcapitao (2) * jpena (2) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot *Amy Marrich* She/Her/Hers Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> amy(a)redhat.com Mobile: 954-818-0514 Slack: amarrich IRC: spotz <https://www.redhat.com/>

1 0

[NFVSIG] NFV SIG meeting minutes - 2021-02-24
by Alfredo Moralejo Alonso 24 Feb '21

24 Feb '21

============================================== #centos-meeting: NFV SIG meeting - 2021-02-24 ============================================== Meeting started by tfherbert at 15:00:35 UTC. The full logs are available athttps://www.centos.org/minutes/2021/February/centos-meeting.2021-02-24-15… . Meeting summary --------------- * agenda bashing (tfherbert, 15:01:00) * current topic is agenda bashing -- by for now. (tfherbert, 15:03:20) * FDP 21.A followup (amoralej, 15:06:52) * builds for openvswitch 2.11 and 2.13, ovn 2.13 and openvswitch-selinux-extra-policy for 21.A were pushed to CentOS mirrors (amoralej, 15:08:08) * https://access.redhat.com/errata/RHSA-2021:0497 was published with CVE (amoralej, 15:10:44) * openvswitch2.13-2.13.0-79.5.1.el8 and ovn2.13-20.12.0-17.el8 have been built and pushed to -testing (amoralej, 15:11:49) * promotion to -release is currently in CI https://review.rdoproject.org/r/#/c/32083/ (amoralej, 15:12:09) * CentOS 8 Stream status (amoralej, 15:13:23) * LINK: https://cbs.centos.org/koji/buildinfo?buildID=32074 (amoralej, 15:13:57) * AGREED: to use disttag el8s in nfv8s-openvswitch-2-el8 build root (amoralej, 15:27:08) * AGREED: to create and promote separated builds for C8 and C8S in nfv sig tags (amoralej, 15:27:36) * Status of automation and CI (amoralej, 15:29:39) * it was agreed to use gerrit based approach for automation in tag and test using gerrit reviews (amoralej, 15:30:19) * automation is implemented and functional for 2.13 stream (amoralej, 15:37:21) * ACTION: NFVSIG members willing to review and approve promotions, please create your account in https://review.rdoproject.org (amoralej, 15:38:22) * LINK: https://cbs.centos.org/koji/buildinfo?buildID=31847 (amoralej, 15:56:34) * LINK: https://access.redhat.com/solutions/3358 (santana, 15:58:03) Meeting ended at 16:01:03 UTC. Action Items ------------ * NFVSIG members willing to review and approve promotions, please create your account in https://review.rdoproject.org Action Items, by person ----------------------- * **UNASSIGNED** * NFVSIG members willing to review and approve promotions, please create your account in https://review.rdoproject.org People Present (lines said) --------------------------- * amoralej (123) * santana (24) * ykarel (12) * tfherbert (10) * centbot (6) * dholler (5) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot

1 0

[Cloud] Cloud SiG Meeting Reminder and Chair/Co-Chair Nominations and Elections
by Amy Marrich 24 Feb '21

24 Feb '21

Just a reminder that the Cloud SiG will meet this Thursday (fourth Thursday of the month) at 15:00 UTC in the #centos-meeting room on Freenode. With the SiG membership[0] cleanup completed, we would like to take nominations for the chair and co-chair roles. Please reply to this email with your self-nominations and nominations for other members of the SiG. If you are nominated by another member of the SiG please re[;y to this mail as well with your acceptance. Nominations will conclude during this week's meeting. If we have a quorum, we will hold elections during this week's meeting. If a quorum is not met, we will ask for 1-2 volunteers and hold an election outside our regular meetings in the next week. Any questions please reach out. Thanks, Amy (spotz) 0 - https://accounts.centos.org/group/members/sig-cloud/ *Amy Marrich* She/Her/Hers Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> amy(a)redhat.com Mobile: 954-818-0514 Slack: amarrich IRC: spotz <https://www.redhat.com/>

3 2

Simplified CS8 upgrade steps
by Carl George 24 Feb '21

24 Feb '21

Howdy everyone, Previously it was a three step process to upgrade from CentOS Linux 8 (CL8) to CentOS Stream 8 (CS8). We have reduced it to a two step process by adding the centos-stream-repos package to the Extras repo in CL8. You can now upgrade from CL8 to CS8 by running just these two commands. [root@centos ~]# dnf swap centos-linux-repos centos-stream-repos [root@centos ~]# dnf distro-sync The instructions have been updated on the main website. I recorded a short screencast to demonstrate the process. https://asciinema.org/a/393875 -- Carl George

2 1

[Promo] Call for content: March newsletter
by Rich Bowen 22 Feb '21

22 Feb '21

Hi, folks, If there is something that you would like to highlight in the March newsletter - or, indeed, if there's something that you think that *I* should highlight - please speak up here, or even better, over on the centos-promo mailing list - https://lists.centos.org/mailman/listinfo/centos-promo Thanks! --Rich

1 0

Re: [CentOS-devel] re CVE errata in CentOS Stream
by redbaronbrowser 19 Feb '21

19 Feb '21

On Friday, February 19, 2021 2:26 PM, Josh Boyer <jwboyer(a)redhat.com> wrote: > On Fri, Feb 19, 2021 at 2:45 PM redbaronbrowser > redbaronbrowser(a)protonmail.com wrote: > > > > > On Wednesday, February 17, 2021 9:01 PM, Mike McGrath mmcgrath(a)redhat.com wrote: > > > > > > > > > There's a bit of nuance to this question in that policy states that CVEs should be fixed in RHEL before CentOS Stream. > I'm not sure what policies you're referring to. Can you point to > where they are documented? I suspect you mean the various blogs and > answers on the list, which are good discussions but I don't want to > assume that those are policies, nor do I want to assume that is what > you are referring to. I trimmed the coversation down to the policy I'm refering to. > Also, Stream and CI/CD are indeed important and related. However, > that doesn't mean there is a single universal approach to everything. I am not implying there is a single universal approach to everything. What I am asking is if exceptions to the policy Mike McGrath stated has already been established so the Stream community can get access to help quickly? Or would a RHEL user indicating a CVE fix cause a regression require seeking management approval before releasing the information to Stream? > > Will there be a way to expedite a CVE fix attempt into Stream after reports of a regression from RHEL users? > > Can you help me understand why an answer to that question matters > given that we are not providing an SLA on CVE fixes in Stream? I > understand that leaves things ambiguous, but even if the answer to > your question was "yes" it doesn't change anything in a manner that > matters from a Stream contributors perspective. I was not expecting an SLA on CVE fixes. If a CVE fix works as intended then I expect the policy MG stated to be the policy followed. I am not trying to object to that. A service-level agreement is between Red Hat and RHEL customers. There is no service agreement with Stream users so I never expected a SLA. Instead I was thinking more along the lines of an ULA (Upstream Level Agreement) that if a CVE "fix" is confirmed to be a CVE "breakage" similar to "Boot Hole," that management approval is already in place for the RHEL team to move access to that regression code to Stream users to be able to review. The SLA policy applying only to RHEL would continue to do so. But it sounds like as it stands now if a CVE "fix" causes unexpected problems, even after the problems are confirmed it may be weeks until management approves the Upstream getting access to help work on the issue. All I'm asking for a ULA which may only apply to 0.01% of updates so that management approval already pre-exists to release it to Upstream in a number of hours instead of weeks. > I am trying to be very clear here to avoid the mistake we made, > inadvertent or not, with the CentOS Linux lifecycle change. There is > no SLA on CVE fixes in Stream. Ok > > Will there be a repo for known problematic security updates such as a CR-broken? > > Not to my knowledge. > > > What would be the roll of Stream if "Boot Hole" could happen again? Why is Stef Walter bringing it up? Are we being asked to help prevent or reduce the impact of that should it occur? > > Stef can speak for himself as to why it was mentioned. It is perhaps > a confusing issue to raise in the context of Stream, because that > particular CVE was under embargo anyway. There is no call to action > nor opportunity for the Stream community to deal with embargoed CVEs > in Stream itself. That is the nature of embargoes. I think you mean the development of the "Boot Hole" patch took place during an embargo, right? Once "Boot Hole" was released and actually impacted RHEL customers, wasn't the embargo period already over? I'm not asking for anything ahead of RHEL customers getting it. All I am asking for is pre-approval from management to get access as an Upstream once a problem with RHEL is confirmed. > > Put another way, is Stream a true Upstream or a hybrid? Is it really the policy that Stream is strictly a downstream when it comes to CVEs? Or if something unexpect happens again, is the policy in place were we act as an Upstream for addressing it? > > With the nuance of CVEs in play, it's a hybrid. Mike already > explained that nuance above. In terms of closing the openness gap, that seems more than just a nuance. Of the CentOS 7 errata announced, 20% has been security updates. The existing information in the Stream FAQ and CentOS blog imply we are becoming the 100% Upstream. Instead the reality seems closer to being 80% Upstream and 20% Downstream.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel February 2021