devel

devel@lists.centos.org

5 participants
4641 discussions

C5: yum-metadata and non-yum yum-metadata
by Karanbir Singh 11 Mar '07

11 Mar '07

firstly, we slipped on shipping beta out yesterday, but we hit a couple of issues that needed to be resolved before we could get the iso's out. Most of the things are now fixed and the final bits are building as I write this email. there is one issue that was raised by Johnny that really does need fixing, perhaps not something for beta-public, but something that does need to get fixed for Final release. <background> The way things stand right now, anaconda uses yum in c5, so the media now contains a local repository metadata but its not the standard meta data used by yum. Anaconda and pirut need a specific string added in ( the mediaid fluffage, some of the fedora guys will be familiar with ) so that they can use the media at installtime and also be able to use the same media post install to add packages. The issue is, that this now creates a problem in that you can no longer loop mount the DVD iso under a http/ftp server and just use that as a remote repository to pull packages from using yum. </background> So now the thing is - for us to facilitate this there are three options. 1. We ship 2 repodata/'s on the media and use one for anaconda and use the other for yum ( ugly fix ) 2. We change anaconda to not need that media stuff in the repodata/, and get that from somewhere else ( not gonna happen : too much work, and too much potential to change from upstream in ways not even imaginable ) 3. We fix yum to use the media fluff'd repodata/ ( potentially a few lines fix and should just work ). This will allow yum + anaconda, pirut and friends to essentially just use the same repository metadata. What does everyone else think about this ? I think from this email, my own personal preference is easy to make out. Also, is this really an issue we even need to worry about ? For me, its an issue since I use loop mounted media right off the block. Does anyone else do the same, or is everyone just coping the tree's out and doing createrepo foo ? -- Karanbir Singh : http://www.karan.org/ : 2522219@icq

4 6

Re: [CentOS] RHWAS rebuild efforts
by Karanbir Singh 10 Mar '07

10 Mar '07

Leonardo Vilela Pinheiro wrote: > Maybe this thread should go to centos-devel list. sure, and moved! > Can you give us more details on what packages need JDK, and which JDK? > I'd like to understand what is going on, which packages are not ported > to Centosplus yet and why. There are bits of jboss and mod_jk stuff form rhwas4as that need the java stuff. > Do we have to build (compile) JDK? if you want to, but considering its unlikely we will get the sources for 1.5.x jdk, I'd say we might need the route of nosrc.rpm instead :) > Can't we use JPackage.org's and give users instructions on how to > install and enable their repository? Maybe thats possible ( I know at least the mysql-jdbc package has its origins in jpp ) , would you like to take this effort on ? Jim and HughesJr have been looking at the rhwas stuff, if you are interested in taking this up, maybe we can start a wiki page with details. - KB -- Karanbir Singh : http://www.karan.org/ : 2522219@icq

1 0

Octave for CentOS5
by Phil Schaffner 08 Mar '07

08 Mar '07

Apparently Octave has been orphaned by the upstream for EL5 , although it is still in Fedora Extras. It does successfully build from FC6/7 src.rpm packages under CentOS5 beta, albeit with a few additional requirements... SRPMS: fftw-3.1.2-3.fc6.src.rpm glpk-4.13-1.fc6.src.rpm hdf5-1.6.5-7.fc7.src.rpm octave-2.9.9-1.fc6.src.rpm ufsparse-2.1.1-1.fc6.src.rpm RPMS: fftw-3.1.2-3.el5.i386.rpm fftw-debuginfo-3.1.2-3.el5.i386.rpm fftw-devel-3.1.2-3.el5.i386.rpm glpk-debuginfo-4.13-1.el5.i386.rpm glpk-devel-4.13-1.el5.i386.rpm glpk-utils-4.13-1.el5.i386.rpm hdf5-1.6.5-7.el5.i386.rpm hdf5-debuginfo-1.6.5-7.el5.i386.rpm hdf5-devel-1.6.5-7.el5.i386.rpm octave-2.9.9-1.el5.i386.rpm octave-debuginfo-2.9.9-1.el5.i386.rpm octave-devel-2.9.9-1.el5.i386.rpm ufsparse-2.1.1-1.el5.i386.rpm ufsparse-debuginfo-2.1.1-1.el5.i386.rpm ufsparse-devel-2.1.1-1.el5.i386.rpm Is there interest in adding this to centosplus? Or perhaps Dag or Karanbir will pick it up? I will be building it locally anyway, if it is not available elsewhere, so could help with keeping updated. Phil

13 30

Centosplus release and updates cycle
by Leonardo Vilela Pinheiro 08 Mar '07

08 Mar '07

Hi, I´d like to understand better the release cycle of Centosplus packages. >From http://mdw1982.com/pipermail/centos_search/2006-March/006556.html : "Packages for centosplus are submitted to the developers, we check package quality, build, stability, etc. We discuss the packages, and they go to the development repository. If they get enough positive feedback, they move to centosplus. If not, they sit there because ostensibly there is no one using/pushing for them." For every package in Centosplus, is there a responsible person in charge, which should release security updates/patches for it? Do you know how is this process inside Red Hat, and how our process compare to theirs? Thanks

2 1

CentOS 5 Beta Initial Test Release?
by Andreas Boschke 05 Mar '07

05 Mar '07

On Wed, 2007-02-21 at 13:14 +0000, Lance Davis wrote: > We are about to release an initial internal test release of CentOS 5 beta > to our qa team. > > If folks here want to be a part of that test they need to join the > centos-qa list (http://lists.centos.org/mailman/listinfo/centos- qa) and > send a message to this list (centos-devel) saying that > they would like to be a part of the qa process and join the qa team, > with details of relevant experience if you are not known to the core > developers. > > Membership of the centos-qa list will then be approved. Hi: I'm interested in CentOS 5 QA, and would appreciate membership into centos-qa. I've wrestled both willing and unwilling computers into running CentOS. Like any good systems administrator, rarely can our hundreds of users find me, nor do our computing services fail. Thanks, -Andreas Boschke -Senior Systems Administrator -Computer Science, UCSB -andreas(a)cs.ucsb.edu

1 0

CentOS 5 Beta Initial Test Release
by Lance Davis 05 Mar '07

05 Mar '07

We are about to release an initial internal test release of CentOS 5 beta to our qa team. If folks here want to be a part of that test they need to join the centos-qa list (http://lists.centos.org/mailman/listinfo/centos-qa) and send a message to this list (centos-devel) saying that they would like to be a part of the qa process and join the qa team, with details of relevant experience if you are not known to the core developers. Membership of the centos-qa list will then be approved. Lance -- uklinux.net - The ISP of choice for the discerning Linux user.

34 38

hwinfo
by Jordi Espasa Clofent 05 Mar '07

05 Mar '07

Hi folks, ¿Is there some intention to include hwinfo[*] package in some repo (ie, contrib or centosplus)? At present moment we've a lswh, which is an excellent tool, but I consider howinfo more powerful. In fact, Debian project has adapted it since 2004. Thanks.

1 0

Interested in Beta testing CentOS 5
by Nad 03 Mar '07

03 Mar '07

Hi I would be very interested in beta testing CentOS 5 and report any issues. I currently run shared hosting servers using Fedora and want to switch to CentOS. I would be more than happy to verify advanced configurations of hosting environments applications using bind/postfix/dovecot/squirelmail/mysql/perl/httpd/php etc. Sign me up for the QA. Cheers Nad

2 1

Re: [CentOS-devel] may Centos be vulnerable to this bug?
by Roger Peña 02 Mar '07

02 Mar '07

--- Roger Peña <orkcu(a)yahoo.com> wrote: > > --- Johnny Hughes <mailing-lists(a)hughesjr.com> > wrote: > > > On Fri, 2007-03-02 at 09:39 -0800, Roger Peña > wrote: > > > --- Roger Peña <orkcu(a)yahoo.com> wrote: > > > > > > > As this bugtrack say "binaries from redhat" > are > > not > > > > vulnerables but what happen to recompilations? > > > > > > > > > > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200219 > > > > > > > > I understand that it is the compilation > process > > what > > > > make this bug not exploitable and not the > source > > > > code > > > > so, the question is: > > > > is the httpd binary from centos exploitable? > > > > > > > > > > > > I could not find any refence in the web about > > this > > > > topic. > > > > maybe I should ask in the centos-user mailling > > list > > > > but because it is a compilation thing ..... I > > guess > > > > centos developer are the right to anwser > > > > > > > sorry, I forgot to mention that I do test the > > > following "proof of concept" test: > > > > > > > > > http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded > > > > > > and httpd-2.0.52-28.ent.centos4 give the "302 > > Found" > > > page so at least with that test I could not > probe > > if > > > it is vulnerable or not > > > > > > > If it did do a "302 Found" ... then it is not > > vulnerable: > > > > from the article: > > > > "If your web server doesn't reply you with a '302 > > Found' page or a > > Segmentation Fault appears in your error_log, an > > apache child has > > crashed and your web server is vulnerable and > > exploitable." > > > > So a 302 found is good. > > > yes, I know it is good > > but can't see why this is a sufficient condition to > say "not vulnerable" > of course, what I can see is that if I got another > page or make a fault then I can say "it is > vulnerable" > > but, I am not saying that centos binary are > vulnerables!!! just that I can't find an explanation > to say "not vulnerable" because uptreams is not. > > also, I could not had the time yet to verify what is > the the following fix to mod_rewrite: > > * Tue Jun 20 2006 Joe Orton <jorton(a)redhat.com> > 2.0.52-26.ent > > - add mod_rewrite ldap scheme handling fix > > does anybody know if this is the source code fix to > this vulnerability (back ported)? > the date of this fix is before the date of the > redhat > bugtrack and before the CVS assignation (20060720) > so it looks not related but I could be wrong... well, it looks like a patch to the vulnerability, without see the source code yet, from the release changelog for httpd-2.0.59: Changes with Apache 2.0.59 *) SECURITY: CVE-2006-3747 (cve.mitre.org) mod_rewrite: Fix an off-by-one security problem in the ldap scheme handling. For some RewriteRules this could lead to a pointer being written out of bounds. Reported by Mark Dowd of McAfee. [Mark Cox] I guess Joe Orton from redhat release a patch a month before public disclosure of the vulnerability or just make a mistake (typo) when write the redhat httpd changelog ;-) so, right now I can "rest in peace" knowing that centos is not vulnerable because it has the fix (until somebody say the contrary :-) ) ;-) thanks anyway johnny I was in a hurry tracking down this for a client cu roger __________________________________________ RedHat Certified Engineer ( RHCE ) Cisco Certified Network Associate ( CCNA ) ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

1 0

may Centos be vulnerable to this bug?
by Roger Peña 02 Mar '07

02 Mar '07

As this bugtrack say "binaries from redhat" are not vulnerables but what happen to recompilations? https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200219 I understand that it is the compilation process what make this bug not exploitable and not the source code so, the question is: is the httpd binary from centos exploitable? I could not find any refence in the web about this topic. maybe I should ask in the centos-user mailling list but because it is a compilation thing ..... I guess centos developer are the right to anwser thanks in advance cu roger __________________________________________ RedHat Certified Engineer ( RHCE ) Cisco Certified Network Associate ( CCNA ) ____________________________________________________________________________________ Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail beta. http://new.mail.yahoo.com

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel