devel

devel@lists.centos.org

9 participants
4635 discussions

CentOS Community Code of Conduct
by Rich Bowen 08 Jun '21

08 Jun '21

As per my email in April - https://lists.centos.org/pipermail/centos-devel/2021-April/076769.html - and per the approval of the Board of Directors, we have published the new CentOS Community Code of Conduct: https://www.centos.org/code-of-conduct/ This Code of Conduct is in effect immediately, and the reporting process described in there is in effect immediately. One note: The doc says that it is "a living document and will be updated when and if it is deemed necessary." One change that we forsee very soon is that, rather than me, as Community Architect, being the sole responsible party for reporting CoC incidents, I will be assembling a small CoC committee. While I have identified some of the people who will be part of that committee, I thought it was good to go ahead and publish the CoC as is, and modify it once that committee is all in place. Thanks to everyone that participated in the review process for this policy. --Rich, on behalf of the Board of Directors.

1 0

docker, CVE-2019-13139 and announcements for updates in extras
by Stefan Puiu 05 Jun '21

05 Jun '21

Hi, We run a CentOS 7-based (actually, CentOS 7 atomic host) image on our hardware boards. We ran a third party "security scan" that seems to look at the list of packages in the distro and check if fixes or advisories have been published for the package versions installed. I guess they have a database of CentOS / RHEL advisories and can cross check the versions there. For a while now, the tool has been complaining that the version of docker we ship is vulnerable to CVE-2019-13139. As far as I can tell, we have a version that includes the fix, based on the Red Hat advisory: https://access.redhat.com/errata/RHBA-2019:3092 says we need docker-1.13.1-104.git4ef4b30, and we have 204.git0be3e21. We've tried to raise this with the tool vendor, but they have asked if we have "vendor documentation" for that fix being applied. My understanding is that they mean something like the centos-announce emails announcing the integration of fixes from RHEL to CentOS, with something like, for example, RHSA-2021:0617 being labeled as CESA-2021:0617; they said they couldn't find the corresponding CEBA-2019:3092. Now, I've looked in the centos-announce list archives since October 2019, when the RH advisory was published, and didn't find anything related to Docker. I saw a mention of the CVE in a CentOS bug, though (https://bugs.centos.org/view.php?id=16804) I'm trying to work with the tool vendor to sort this out. As a developer, I think checking the code is the best way; I've found the Docker RH fork on github, which has a RHEL branch that seems to be used in both CentOS and RHEL (https://github.com/projectatomic/docker/tree/docker-1.13.1-rhel) However, probably the tool people have some kind of different process in place. So my question is: is it reasonable to expect any bugfix or security update fetched from RHEL to CentOS to come with an announcement on the centos-announce mailing list? Is there a filter for some packages? I see docker is in extras, not in CentOS-Base, maybe updates to those are not announced? Thanks, Stefan.

3 4

Announcing the latest release of CentOS Linux 8 (2105)
by Rich Bowen 04 Jun '21

04 Jun '21

Release for CentOS Linux 8 (2105) We are pleased to announce the general availability of the latest version of CentOS Linux 8. Effectively immediately, this is the current release for CentOS Linux 8 and is tagged as 2105, derived from Red Hat Enterprise Linux 8.4 Source Code. As always, read through the Release Notes at: http://wiki.centos.org/Manuals/ReleaseNotes/CentOS8.2105 - these notes contain important information about the release and details about some of the content inside the release from the CentOS QA team. These notes are updated constantly to include issues and incorporate feedback from users. ---------- Updates, Sources, and DebugInfos Updates released since the upstream release are all posted, across all architectures. We strongly recommend every user apply all updates, including the content released today, on your existing CentOS Linux 8 machine by just running 'dnf update'. As with all CentOS Linux 8 components, this release was built from sources hosted at git.centos.org. Sources will be available from vault.centos.org in their own dedicated directories to match the corresponding binary RPMs. Since there is far less traffic to the CentOS source RPMs compared with the binary RPMs, we are not putting this content on the main mirror network. If users wish to mirror this content they can do so using the reposync command available in the yum/dnf-utils package. All CentOS source RPMs are signed with the same key used to sign their binary counterparts. Developers and end users looking at inspecting and contributing patches to the CentOS Linux distro will find the code hosted at git.centos.org far simpler to work against. Details on how to best consume those are documented along with a quick start at: http://wiki.centos.org/Sources Debuginfo packages have been signed and pushed. Yum configs shipped in the new release file will have all the context required for debuginfo to be available on every CentOS Linux install. This release supersedes all previously released content for CentOS Linux 8, and therefore we highly encourage all users to upgrade their machines. Information on different upgrade strategies and how to handle stale content is included in the Release Notes. Note that older content, obsoleted by newer versions of the same applications are trim'd off from repos like extras/ and centosplus/ ---------- Download We produced the following installer images for CentOS Linux 8 # CentOS-8.4.2105-aarch64-boot.iso: 677838848 bytes SHA256 (CentOS-8.4.2105-aarch64-boot.iso) = 106d9ce13076441c52dc38c95e9977a83f28a4c1ce88baa10412c1e3cc9b2a2b # CentOS-8.4.2105-aarch64-dvd1.iso: 7325042688 bytes SHA256 (CentOS-8.4.2105-aarch64-dvd1.iso) = 6654112602beec7f6b5c134f28cf6b77aedc05b2a7ece2656dacf477f77c81df # CentOS-8.4.2105-ppc64le-boot.iso: 722780160 bytes SHA256 (CentOS-8.4.2105-ppc64le-boot.iso) = 4a83e12f56334132c3040491e5894e01dfe5373793e73f532c859b958aeeb900 # CentOS-8.4.2105-ppc64le-dvd1.iso: 8484990976 bytes SHA256 (CentOS-8.4.2105-ppc64le-dvd1.iso) = 9cfca292a59a45bdb1737019a6ac0383e0a674a415e7c0634262d66884a47d01 # CentOS-8.4.2105-x86_64-boot.iso: 758120448 bytes SHA256 (CentOS-8.4.2105-x86_64-boot.iso) = c79921e24d472144d8f36a0d5f409b12bd016d9d7d022fd703563973ca9c375c # CentOS-8.4.2105-x86_64-dvd1.iso: 9928966144 bytes SHA256 (CentOS-8.4.2105-x86_64-dvd1.iso) = 0394ecfa994db75efc1413207d2e5ac67af4f6685b3b896e2837c682221fd6b2 Information for the torrent files and sums are available at http://mirror.centos.org/centos/8/isos/ -------- Additional Images Vagrant and Generic Cloud images are available at: http://cloud.centos.org/centos/8/ Amazon Machine Images for Amazon Web Services are published by ID into a number of regions. A table of AMI IDs can be found here: https://wiki.centos.org/Cloud/AWS ---------- Getting Help The CentOS ecosystem is sustained by community driven help and guidance. The best place to start for new users is at http://wiki.centos.org/GettingHelp We are also on social media, you can find the project: on Twitter at :http://twitter.com/CentOS on Facebook at :https://www.facebook.com/groups/centosproject/ on LinkedIn at :https://www.linkedin.com/groups/22405 And you will find the core team and a majority of the contributors on irc, on irc.libera.chat in #centos ; talking about the finer points of distribution engineering and platform enablement. ---------- Contributors This release was made possible due to the hard work of many people, foremost on that list are the Red Hat Engineers for producing a great distribution and the CentOS QA team, without them CentOS Linux would look very different. Many of the team went further and beyond expectations to bring this release to you, and I would like to thank everyone for their help. We are also looking for people to get involved with the QA process in CentOS, if you would like to join this please introduce yourself on the centos-devel list (http://lists.centos.org/mailman/listinfo/centos-devel) Finally, please join me in thanking the donors who all make this possible for us. Enjoy the fresh new release! Thanks, Johnny Hughes

3 2

CentOS Stream 9 Buildsystem Paused over the weekend for power maintenance
by Brian Stinson 04 Jun '21

04 Jun '21

Hi Folks, There is power maintenance going on over this weekend in the datacenter hosting parts of kojihub.stream.centos.org We have paused the buildsystem, and the Merge Request pipelines in Gitlab until we're ready to come back. We expect to re-enable things on Monday morning US time. While this maintenance is ongoing, the web interfaces may also be down. Thanks for your patience, -- Brian Stinson brian(a)bstinson.com

1 0

kmods SIG Proposal
by David Duncan 02 Jun '21

02 Jun '21

Hi, The kmods SIG looks like a great place to introduce the out-of-tree versions of the ENA and EFA drivers for supporting Amazon EC2 instances. If this is the right place for that work, I would like to add my support by contributing effort to maintain them here. -- David Duncan | Working from Austin, TX A: The lost context. Q: What makes top-posted replies harder to read than bottom-posted?

3 3

[NFV SIG] NFV SIG meeting minutes - 2021-06-02
by Alfredo Moralejo Alonso 02 Jun '21

02 Jun '21

============================================= #centos-meeting: NFV SIG meeting - 2021-06-02 ============================================= Meeting started by amoralej at 15:06:15 UTC. The full logs are available athttps://www.centos.org/minutes/2021/June/centos-meeting.2021-06-02-15.06.… . Meeting summary --------------- * roll call (amoralej, 15:07:01) * remember that now centos IRC channels are in libera chat, meetings are in #centos-meeting (amoralej, 15:08:19) * status of OpenvSwitch and OVN 2.15 (amoralej, 15:09:01) * package ovn-2021 is compatible with openvswitch 2.15 (amoralej, 15:09:27) * ovn-2021 has been built for CentOS Stream 8 and it's available in testing repo https://buildlogs.centos.org/centos/8-stream/nfv/x86_64/openvswitch-2/ (amoralej, 15:10:18) * ovn-2021 has virtual provides on openvswitch2.13-ovn what can produce conflicts between ovn2.13 and ovn-2021 if the virtual provides is used to install (amoralej, 15:11:27) * gating jobs with openstack are being added to gate promotions of ovs2.15 and ovn-2021 (amoralej, 15:12:17) * once the jobs are set and can be used ovn-2021 will be promoted to the release repository (amoralej, 15:12:35) Meeting ended at 15:17:19 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * amoralej (10) * centbot (2) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot

1 0

Stream ISO retention
by Lance Albertson 01 Jun '21

01 Jun '21

What is the current policy for Stream ISO's? It seems that it's currently only one week which is problematic when trying to maintain your own packer templates and having to constantly update the filename and checksums. It seems as though long term, this method doesn't bode well for maintainability. Would it be possible to do one of the following? 1. Offer a filename symlink to the "current" build? 2. Offer an ISO that exists longer than a week? 3. Host archived ISOs on vault (or somewhere else) with some saner retention Thanks- -- Lance Albertson Director Oregon State University | Open Source Lab

3 10

CentOS Stream Feature SIG Meeting - Today @ 1600 UTC+1
by Aoife Moloney 01 Jun '21

01 Jun '21

Hi Everyone, Just as an fyi, the CentOS Stream Feature SIG will be meeting today @ 1600 UTC+1 on #centos-meeting. This will be the groups first meeting and is expected to focus on establishing the SIGs policies a little more. On the agenda is currently: - Identify chair(s) - Review meeting cadences and time are doable - How to expand membership - Verify feature process flow is in place and assign tasks to members to action if there are gaps - Establish an immediate goal (and longer term goals if there is time) You are all most welcome to join the meeting and I look forward to seeing you there over time! Kindest regards, Aoife, on behalf of the CentOS Stream Feature SIG -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA <https://www.redhat.com> Communications House Cork Road Waterford <https://www.redhat.com>

1 0

[Cloud SiG] RDO IRC Information
by Amy Marrich 26 May '21

26 May '21

Dear Cloud SiG and CentOS Community Members, As many of you know, there have been changes in Freenode which affect the RDO channel, OpenInfra channels, and the channels of many other communities we work closely with. After careful consideration, the OpenDev team has chosen to move the Open Infrastructure Foundation IRC related infrastructure to OFTC[0]. As of Monday, May 31st, OFTC will become the primary home of RDO (#rdo) including where we host our meeting. The Fedora and CentOS Communities have chosen to move to Libera[1] and due to our close relationship with these projects RDO will have a presence on this system as well also in #rdo. Our channel is already created on both systems and are ready for you to join them and it is recommended you register your Nick[2][3] on both these systems. While not a total solution, we would like to mention Matrix[4] which we hope in the future will be able to bridge OFTC and Libera.chat into one location. Thanks, Amy Marrich (spotz) 0 - https://www.oftc.net/ 1 - https://libera.chat/ 2 - https://www.oftc.net/Services/#register-your-account 3 - https://libera.chat/guides/registration 4 - https://matrix.org *Amy Marrich* She/Her/Hers Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> amy(a)redhat.com Mobile: 954-818-0514 Slack: amarrich IRC: spotz <https://www.redhat.com/>

3 2

Enabling PowerTools by default? (and proof-of-concept alternative)
by Michel Alexandre Salim 26 May '21

26 May '21

At the Hyperscale SIG, one of the repos we ship (centos-release- hyperscale-hotfixes, which we use to override modular content we need to fix as MBS is not available to SIGs) depends on EPEL (because the packages there, for example libvirt, needs dependencies in EPEL). EPEL's Quickstart recommends enabling codeready-builder on RHEL8, and the corresponding powertools repo on CentOS 8: https://fedoraproject.org/wiki/EPEL#Quickstart Could we possibly just enable powertools by default? CRB is on by default in RHEL8 UBI containers (but weirdly not in the related CentOS Stream containers!). There are multiple unactionable bugs in Bugzilla for EPEL about uninstallable packages, e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1890414 that ends up with the maintainer telling the reporter to just enable powertools. A proof-of-concept we tested in Hyperscale is to just enable PowerTools in %posttrans: https://git.centos.org/rpms/centos-release-hyperscale/c/03b6fd490be2571efa6… That way we can make sure that Powertools is already enabled for future transactions installing packages from our repos, but not potentially break the transaction itself by changing the set of packages available. (note: not shipped yet) But we'd rather not have to do this, and just have Powertools enabled to begin with. Failing that, have this kludge in epel-release so we get it for free for our packages that depend on EPEL. Looking at PowerTools, there's a lot of packages there, esp. in the Python stack, that I could imagine many Python library or application shipped in EPEL would be uninstallable if the repo is disabled. Best regards, -- Michel Alexandre Salim profile: https://keyoxide.org/michel@michel-slm.name

8 11

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel