devel April 2022

devel@lists.centos.org

31 participants
25 discussions

New lookaside structure available
by Pierre-Yves Chibon 27 Apr '22

27 Apr '22

A while ago, we spoke about the structure of the lookaside cache used by Red Hat and SIGs [1]. We have made progress on this, there is now two ways SIGs can upload their tarball to the lookaside cache: - Using the current endpoint at: https://git.centos.org/sources/upload.cgi This works the way it always has, you can use `lookaside_upload` from [2] to interact with it, as before. In other words: nothing changes there. For the record, this uses the structure: `baseurl/pkgname/branch/hash`. Example: https://git.centos.org/sources/kernel/c8s/0c4e10577cfd4b4f8e3d83c0406da8ab0… - Using the new endpoint at: https://git.centos.org/sources/sig_upload.cgi This allows any SIG member to upload to the lookaside cache using the same structure as the one used in CentOS Stream and Fedora: `baseurl/pkgname/tarball/hashtype/hash/tarball`. Example: https://sources.stream.centos.org/sources/rpms/kernel/linux-5.14.0-62.el9.t… You can use the `lookaside_upload_sig` script from [3] to interact with it. So we can now either: - not change anything or - use the new endpoint to use the new lookaside structure What are the benefits of the new structure? - It allows to use a `sources` file similar to the one used in CentOS Stream and Fedora, which combined with the changes to support flat dist-git layout should make backporting from CentOS Stream or Fedora easier. - If two SIGs are using the same tarball, only one will be uploaded to the lookaside cache (so, it allows a little disk space saving on the server side). - It no longer ties sources uploaded to a specific git branch, which if you are using gitlab, means you no longer have to follow the branching structure that git.centos.org needs due to its dual purpose. Finally, the recent changes made to the infrastructure are all documented at: https://sigs.centos.org/guide/ More specifically, the changes for the lookaside and git repository structures can be found at: https://sigs.centos.org/guide/git/ The documentation on using gitlab is at: https://sigs.centos.org/guide/gitlab/ Happy hacking! Pierre [1] https://lists.centos.org/pipermail/centos-devel/2022-February/120226.html [2] https://git.centos.org/centos-git-common/blob/master/f/lookaside_upload [3] https://git.centos.org/centos-git-common/blob/master/f/lookaside_upload_sig

1 0

[Cloud] RDO Yoga Released
by Amy Marrich 27 Apr '22

27 Apr '22

The RDO community is pleased to announce the general availability of the RDO build for OpenStack Yoga for RPM-based distributions, CentOS Stream and Red Hat Enterprise Linux. RDO is suitable for building private, public, and hybrid clouds. Yoga is the 25th release from the OpenStack project, which is the work of more than 1,000 contributors from around the world. The release is already available on the CentOS mirror network: - For CentOS Stream 8 http://mirror.centos.org/centos/8-stream/cloud/x86_64/openstack-yoga - For CentOS Stream 9 http://mirror.stream.centos.org/SIGs/9-stream/cloud/x86_64/openstack-yoga/ The RDO community project curates, packages, builds, tests and maintains a complete OpenStack component set for RHEL and CentOS Stream and is a member of the CentOS Cloud Infrastructure SIG. The Cloud Infrastructure SIG focuses on delivering a great user experience for CentOS users looking to build and maintain their own on-premise, public or hybrid clouds. All work on RDO and on the downstream release, Red Hat OpenStack Platform, is 100% open source, with all code changes going upstream first. Interesting things in the Yoga release include: - RDO Yoga is the first RDO version built and tested for CentOS Stream 9. - In order to ease transition from CentOS Stream 8, RDO Yoga is also built and tested for CentOS Stream 8. Note that next release of RDO will be available only for CentOS Stream 9. The highlights of the broader upstream OpenStack project may be read via https://releases.openstack.org/yoga/highlights.html TripleO in the RDO Yoga release: Since the Xena development cycle, TripleO follows the Independent release model <https://specs.openstack.org/openstack/tripleo-specs/specs/xena/tripleo-inde…> and will only maintain branches for selected OpenStack releases. In the case of Yoga, TripleO will not support the Yoga release. For TripleO users in RDO, this means that: - RDO Yoga will include packages for TripleO tested at OpenStack Yoga GA time. - Those packages will not be updated during the entire Yoga maintenance cycle. - RDO will not be able to included patches required to fix bugs in TripleO on RDO Yoga. - The lifecycle for the non-TripleO packages will follow the code merged and tested in upstream stable/yoga branches. - There will not be any TripleO Yoga container images built/pushed, so interested users will have to do their own container builds when deploying Yoga. You can find details about this on the RDO Webpage <https://www.rdoproject.org/documentation/tripleo-in-xena/> *Contributors* During the Yoga cycle, we saw the following new RDO contributors: - Adriano Vieira Petrich - Andrea Bolognani - Dariusz Smigiel - David Vallee Delisle - Douglas Viroel - Jakob Meng - Lucas Alvares Gomes - Luis Tomas Bolivar - T. Nichole Williams - Karolina Kula Welcome to all of you and Thank You So Much for participating! But we wouldn’t want to overlook anyone. A super massive Thank You to all 40 contributors who participated in producing this release. This list includes commits to rdo-packages, rdo-infra, and redhat-website repositories: - Adriano Vieira Petrich - Alan Bishop - Alan Pevec - Alex Schultz - Alfredo Moralejo - Amy Marrich (spotz) - Andrea Bolognani - Chandan Kumar - Daniel Alvarez Sanchez - Dariusz Smigiel - David Vallee Delisle - Douglas Viroel - Emma Foley - Gaël Chamoulaud - Gregory Thiemonge - Harald - Jakob Meng - James Slagle - Jiri Podivin - Joel Capitao - Jon Schlueter - Julia Kreger - Kashyap Chamarthy - Lee Yarwood - Lon Hohberger - Lucas Alvares Gomes - Luigi Toscano - Luis Tomas Bolivar - Martin Kopec - mathieu bultel - Matthias Runge - Riccardo Pittau - Sergey - Stephen Finucane - Steve Baker - Takashi Kajinami - T. Nichole Williams - Tobias Urdin - Karolina Kula - User otherwiseguy - Yatin Karel *The Next Release Cycle* At the end of one release, focus shifts immediately to the next release i.e Zed. *Get Started* To spin up a proof of concept cloud, quickly, and on limited hardware, try an All-In-One Packstack installation. You can run RDO on a single node to get a feel for how it works. Finally, for those that don’t have any hardware or physical resources, there’s the OpenStack Global Passport Program. This is a collaborative effort between OpenStack public cloud providers to let you experience the freedom, performance and interoperability of open source infrastructure. You can quickly and easily gain access to OpenStack infrastructure via trial programs from participating OpenStack public cloud providers around the world. *Get Help* The RDO Project has the users(a)lists.rdoproject.org for RDO-specific users and operators. For more developer-oriented content we recommend joining the dev(a)lists.rdoproject.org mailing list. Remember to post a brief introduction about yourself and your RDO story. The mailing lists archives are all available at https://mail.rdoproject.org. You can also find extensive documentation on RDOproject.org. The #rdo channel on OFTC. IRC is also an excellent place to find and give help. We also welcome comments and requests on the CentOS devel mailing list and the CentOS and TripleO IRC channels (#centos, #centos-devel in Libera Chat network, and #tripleo on OFTC), however we have a more focused audience within the RDO venues. *Get Involved* To get involved in the OpenStack RPM packaging effort, check out the RDO contribute pages, peruse the CentOS Cloud SIG page, and inhale the RDO packaging documentation. Join us in #rdo and #tripleo on the OFTC IRC network and follow us on Twitter @RDOCommunity. You can also find us on Facebook and YouTube. *Amy Marrich* She/Her/Hers Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> amy(a)redhat.com Mobile: 954-818-0514 Slack: amarrich IRC: spotz <https://www.redhat.com/>

1 0

httpd CVEs in CentOS 8 Stream
by Ken Dreyer 24 Apr '22

24 Apr '22

RHEL 8.5 has the following fixes in the httpd package over the past couple of months: 2022-03-21 Luboš Uhliarik <luhliari(a)redhat.com> - 2.4.37-43.3 - Resolves: #2065247 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier 2022-02-25 Luboš Uhliarik <luhliari(a)redhat.com> - 2.4.37-43.2 - Resolves: #2059256 - CVE-2021-34798 httpd:2.4/httpd: NULL pointer dereference via malformed requests - Resolves: #2059257 - CVE-2021-39275 httpd:2.4/httpd: out-of-bounds write in ap_escape_quotes() via malicious input 2022-01-10 Luboš Uhliarik <luhliari(a)redhat.com> - 2.4.37-43.1 - Resolves: #2035062 - CVE-2021-44790 httpd:2.4/httpd: mod_lua: possible buffer overflow when parsing multipart content I don't see builds that correspond to this in https://koji.mbox.centos.org/koji/packageinfo?packageID=583 , and this URL hangs in my browser: https://git.centos.org/rpms/httpd When should I expect these CVE fixes in CentOS 8 Stream? - Ken

6 7

oVirt 4.5.0 Release Announcement
by Sandro Bonazzola 20 Apr '22

20 Apr '22

The CentOS Virtualization SIG on behalf of the oVirt Project Community is pleased to announce the general availability of the oVirt 4.5.0 build for CentOS Stream, Red Hat Enterprise Linux and derivatives. The release is already available on the CentOS mirror network. Read more on the announcement blog post at https://blogs.ovirt.org/2022/04/ovirt-4-5-0-is-now-generally-available/ Many thanks to the other CentOS Special Interest Groups involved in this release. Questions about the release? Please join the discussion on https://lists.ovirt.org/archives/list/users@ovirt.org/ Thanks, -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

1 0

Board meeting recording and office hours
by Shaun McCance 19 Apr '22

19 Apr '22

Hi folks, I've uplaoded the recording of last week's board meeting: https://youtu.be/ubv6tOWGyzE If you'd like to discuss any issues with the board, we'll have an open board office hours this Thursday, April 21, at 14:00 UTC. https://meet.google.com/dax-yfpm-zxh Email me directly if you need dial-in info instead. Thanks, Shaun

1 0

How to compile modular SRPMs for CentOS 8?
by Nico Kadel-Garcia 15 Apr '22

15 Apr '22

I admit to disliking "modularity" for RPMs, especially because there are various modularity RPMs I'd like to compile for python 3.9 compatibility. ansible-core requires at least python 3.8, but there are a stack of dependencies for ansible-core which have never been provided for python 3.9, such as python39-sphinx and python39-pytest.. Can anyone offer me suggestions or guidance on how to build those? The SRPMs for python3-pytest and others seem to support modularity, but I'd like to use "mock" locally to test them out.

6 11

Kernel topics at the 13-Apr CentOS Stream office Hours
by Brian Stinson 14 Apr '22

14 Apr '22

Hi Folks, For this month's office hours we're going to have some folks from the Kernel team at Red Hat to chat about kernel maintainer workflows, contributing to the kernel, and cover questions you may have about using or building against the kernel in your SIG. Office Hours are on Wednesday, 13-Apr at 17UTC https://centos.org/community/calendar/#centos-stream-office-hours-meetopens… See you there! --Brian

3 2

[REPORT] Automotive SIG
by Jeffrey Osier-Mixon 13 Apr '22

13 Apr '22

January 2022 Quarterly report submitted by: Jefro Osier-Mixon, Red Hat - acting chair _____________________________________ Membership update This SIG does not have a formal membership process. The mailing list currently has 89 subscribers representing at least 12 companies, though not all subscribers use corporate emails and some are participating as individuals. _____________________________________ Releases in the most recent quarter (or most recent release, if none in that quarter) The SIG now provides a new distribution: Automotive Stream Distribution (AutoSD), a CentOS Stream derivative designed specifically around the needs of an automotive OS, and transparently the upstream project for Red Hat's eventual in-vehicle OS product. AutoSD has been downloaded and used by several organizations who have commented or asked for help, so we know it is getting some traction though of course we don't have exact metrics on usage. _____________________________________ Health report and general activity narrative. The SIG has had two public meetings per month, one formal and one informal "office hours", each with 25-40 attendees, with visible participation from 7-10 separate organizations. This SIG is intended to be a community effort with contributions and shared benefits from all participants. Several Red Hat employees made the first contributions to the project as well as the infrastructure required to build and test it. We now occupy a gitlab repository building software regularly using CI, with build instructions provided. Sample images are present and downloadable along with customization and build instructions. This is a high-level summary of current activity: - The work is migrating to a CentOS namespace within GitLab in order to cement our intention as a community project: https://gitlab.com/centos/automotive - CI/CD infrastructure is in place - Downloadable images are available: https://autosd.sig.centos.org/ - Documentation has been greatly expanded with both community and corporate contributions: https://sigs.centos.org/automotive/ - Documentation now includes detailed contribution guidelines: https://sigs.centos.org/automotive/contributing/contributing-to-auto-sig-re… - Ongoing discussions within the meetings have centered around supported hardware and expectations for documentation - A new meetings page contains recordings of all meetings: https://wiki.centos.org/SpecialInterestGroup/Automotive/Meetings - Synchronous communications have moved from IRC to Matrix thanks to some help from Fedora: https://app.element.io/#/room/#centos-automotive-sig:fedoraproject.org _____________________________________ Issues for the board to address, if any None, keep up the excellent work :) Jeffrey "Jefro" Osier-Mixon | jefro(a)redhat.com Red Hat Office of the CTO | Sr. Principal Community Architect, Automotive

1 0

Please update images on VagrantCloud
by Mike DePaulo 08 Apr '22

08 Apr '22

Hi, Could you please update/add the images on VagrantCloud? Your project has already built and uploaded the images, but to cloud.centos.org rather than VagrantCloud. Vagrant has an issue if we try to use cloud.centos.org manual URLs instead of VagrantCloud. VagrantCloud (https://app.vagrantup.com/centos) has: - 8 Stream from 2021-02-10, but the latest manual URL image is 2022-01-25 - 8 from 2020-12-04, but the latest manual URL image is 2021-06-03 - 9 Stream isn't on VagrantCloud at all, but the latest manual URL image is 2022-03-30 The latest images available via for manual URLs: - https://cloud.centos.org/centos/8-stream/x86_64/images/ - https://cloud.centos.org/centos/8/x86_64/images/ - https://cloud.centos.org/centos/9-stream/x86_64/images/ - Mike -- Mike DePaulo He / Him / His Service Reliability Engineer, Pulp Red Hat <https://www.redhat.com/> IM: mikedep333 GPG: 51745404 <https://www.redhat.com/>

1 0

[Openssl]incorrect CVE mentioned in openssl changelog
by Akshar Kanak 08 Apr '22

08 Apr '22

Dear team in latest openssl openssl-1.0.2k-25.el7_9.x86_64 , looks like there is an issue with change logs . rpm -qi --changelog openssl-1.0.2k-25.el7_9.x86_64 shows me " * Wed Mar 23 2022 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:1.0.2k-25 - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates - Related: rhbz#2067160 " The CVE number should be CVE-2022-0778 . Right ? reference : https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Thanks and regards Akshar

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel April 2022