devel

devel@lists.centos.org

1 participants
4605 discussions

[NFVSIG] NFV SIG meeting minutes - 2021-02-24
by Alfredo Moralejo Alonso 24 Feb '21

24 Feb '21

============================================== #centos-meeting: NFV SIG meeting - 2021-02-24 ============================================== Meeting started by tfherbert at 15:00:35 UTC. The full logs are available athttps://www.centos.org/minutes/2021/February/centos-meeting.2021-02-24-15… . Meeting summary --------------- * agenda bashing (tfherbert, 15:01:00) * current topic is agenda bashing -- by for now. (tfherbert, 15:03:20) * FDP 21.A followup (amoralej, 15:06:52) * builds for openvswitch 2.11 and 2.13, ovn 2.13 and openvswitch-selinux-extra-policy for 21.A were pushed to CentOS mirrors (amoralej, 15:08:08) * https://access.redhat.com/errata/RHSA-2021:0497 was published with CVE (amoralej, 15:10:44) * openvswitch2.13-2.13.0-79.5.1.el8 and ovn2.13-20.12.0-17.el8 have been built and pushed to -testing (amoralej, 15:11:49) * promotion to -release is currently in CI https://review.rdoproject.org/r/#/c/32083/ (amoralej, 15:12:09) * CentOS 8 Stream status (amoralej, 15:13:23) * LINK: https://cbs.centos.org/koji/buildinfo?buildID=32074 (amoralej, 15:13:57) * AGREED: to use disttag el8s in nfv8s-openvswitch-2-el8 build root (amoralej, 15:27:08) * AGREED: to create and promote separated builds for C8 and C8S in nfv sig tags (amoralej, 15:27:36) * Status of automation and CI (amoralej, 15:29:39) * it was agreed to use gerrit based approach for automation in tag and test using gerrit reviews (amoralej, 15:30:19) * automation is implemented and functional for 2.13 stream (amoralej, 15:37:21) * ACTION: NFVSIG members willing to review and approve promotions, please create your account in https://review.rdoproject.org (amoralej, 15:38:22) * LINK: https://cbs.centos.org/koji/buildinfo?buildID=31847 (amoralej, 15:56:34) * LINK: https://access.redhat.com/solutions/3358 (santana, 15:58:03) Meeting ended at 16:01:03 UTC. Action Items ------------ * NFVSIG members willing to review and approve promotions, please create your account in https://review.rdoproject.org Action Items, by person ----------------------- * **UNASSIGNED** * NFVSIG members willing to review and approve promotions, please create your account in https://review.rdoproject.org People Present (lines said) --------------------------- * amoralej (123) * santana (24) * ykarel (12) * tfherbert (10) * centbot (6) * dholler (5) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot

1 0

[Cloud] Cloud SiG Meeting Reminder and Chair/Co-Chair Nominations and Elections
by Amy Marrich 24 Feb '21

24 Feb '21

Just a reminder that the Cloud SiG will meet this Thursday (fourth Thursday of the month) at 15:00 UTC in the #centos-meeting room on Freenode. With the SiG membership[0] cleanup completed, we would like to take nominations for the chair and co-chair roles. Please reply to this email with your self-nominations and nominations for other members of the SiG. If you are nominated by another member of the SiG please re[;y to this mail as well with your acceptance. Nominations will conclude during this week's meeting. If we have a quorum, we will hold elections during this week's meeting. If a quorum is not met, we will ask for 1-2 volunteers and hold an election outside our regular meetings in the next week. Any questions please reach out. Thanks, Amy (spotz) 0 - https://accounts.centos.org/group/members/sig-cloud/ *Amy Marrich* She/Her/Hers Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> amy(a)redhat.com Mobile: 954-818-0514 Slack: amarrich IRC: spotz <https://www.redhat.com/>

3 2

Simplified CS8 upgrade steps
by Carl George 24 Feb '21

24 Feb '21

Howdy everyone, Previously it was a three step process to upgrade from CentOS Linux 8 (CL8) to CentOS Stream 8 (CS8). We have reduced it to a two step process by adding the centos-stream-repos package to the Extras repo in CL8. You can now upgrade from CL8 to CS8 by running just these two commands. [root@centos ~]# dnf swap centos-linux-repos centos-stream-repos [root@centos ~]# dnf distro-sync The instructions have been updated on the main website. I recorded a short screencast to demonstrate the process. https://asciinema.org/a/393875 -- Carl George

2 1

[Promo] Call for content: March newsletter
by Rich Bowen 22 Feb '21

22 Feb '21

Hi, folks, If there is something that you would like to highlight in the March newsletter - or, indeed, if there's something that you think that *I* should highlight - please speak up here, or even better, over on the centos-promo mailing list - https://lists.centos.org/mailman/listinfo/centos-promo Thanks! --Rich

1 0

Re: [CentOS-devel] re CVE errata in CentOS Stream
by redbaronbrowser 19 Feb '21

19 Feb '21

On Friday, February 19, 2021 2:26 PM, Josh Boyer <jwboyer(a)redhat.com> wrote: > On Fri, Feb 19, 2021 at 2:45 PM redbaronbrowser > redbaronbrowser(a)protonmail.com wrote: > > > > > On Wednesday, February 17, 2021 9:01 PM, Mike McGrath mmcgrath(a)redhat.com wrote: > > > > > > > > > There's a bit of nuance to this question in that policy states that CVEs should be fixed in RHEL before CentOS Stream. > I'm not sure what policies you're referring to. Can you point to > where they are documented? I suspect you mean the various blogs and > answers on the list, which are good discussions but I don't want to > assume that those are policies, nor do I want to assume that is what > you are referring to. I trimmed the coversation down to the policy I'm refering to. > Also, Stream and CI/CD are indeed important and related. However, > that doesn't mean there is a single universal approach to everything. I am not implying there is a single universal approach to everything. What I am asking is if exceptions to the policy Mike McGrath stated has already been established so the Stream community can get access to help quickly? Or would a RHEL user indicating a CVE fix cause a regression require seeking management approval before releasing the information to Stream? > > Will there be a way to expedite a CVE fix attempt into Stream after reports of a regression from RHEL users? > > Can you help me understand why an answer to that question matters > given that we are not providing an SLA on CVE fixes in Stream? I > understand that leaves things ambiguous, but even if the answer to > your question was "yes" it doesn't change anything in a manner that > matters from a Stream contributors perspective. I was not expecting an SLA on CVE fixes. If a CVE fix works as intended then I expect the policy MG stated to be the policy followed. I am not trying to object to that. A service-level agreement is between Red Hat and RHEL customers. There is no service agreement with Stream users so I never expected a SLA. Instead I was thinking more along the lines of an ULA (Upstream Level Agreement) that if a CVE "fix" is confirmed to be a CVE "breakage" similar to "Boot Hole," that management approval is already in place for the RHEL team to move access to that regression code to Stream users to be able to review. The SLA policy applying only to RHEL would continue to do so. But it sounds like as it stands now if a CVE "fix" causes unexpected problems, even after the problems are confirmed it may be weeks until management approves the Upstream getting access to help work on the issue. All I'm asking for a ULA which may only apply to 0.01% of updates so that management approval already pre-exists to release it to Upstream in a number of hours instead of weeks. > I am trying to be very clear here to avoid the mistake we made, > inadvertent or not, with the CentOS Linux lifecycle change. There is > no SLA on CVE fixes in Stream. Ok > > Will there be a repo for known problematic security updates such as a CR-broken? > > Not to my knowledge. > > > What would be the roll of Stream if "Boot Hole" could happen again? Why is Stef Walter bringing it up? Are we being asked to help prevent or reduce the impact of that should it occur? > > Stef can speak for himself as to why it was mentioned. It is perhaps > a confusing issue to raise in the context of Stream, because that > particular CVE was under embargo anyway. There is no call to action > nor opportunity for the Stream community to deal with embargoed CVEs > in Stream itself. That is the nature of embargoes. I think you mean the development of the "Boot Hole" patch took place during an embargo, right? Once "Boot Hole" was released and actually impacted RHEL customers, wasn't the embargo period already over? I'm not asking for anything ahead of RHEL customers getting it. All I am asking for is pre-approval from management to get access as an Upstream once a problem with RHEL is confirmed. > > Put another way, is Stream a true Upstream or a hybrid? Is it really the policy that Stream is strictly a downstream when it comes to CVEs? Or if something unexpect happens again, is the policy in place were we act as an Upstream for addressing it? > > With the nuance of CVEs in play, it's a hybrid. Mike already > explained that nuance above. In terms of closing the openness gap, that seems more than just a nuance. Of the CentOS 7 errata announced, 20% has been security updates. The existing information in the Stream FAQ and CentOS blog imply we are becoming the 100% Upstream. Instead the reality seems closer to being 80% Upstream and 20% Downstream.

1 0

No default stream configured for modules in powertools
by Peter Georg 19 Feb '21

19 Feb '21

Hi everyone, I just tried to install the new python39 stream on one of my systems. This includes the python39-Cython package. I realized that a simple "dnf install python39-Cython" does not work as the package is part of powertools (whereas python38-Cython is in appstream) [1]. Hence python39-Cython is not part of the "python39" module, but part of "python39-devel" - the corresponding module for python39 subpackages in powertools. Afaik this is required as a stream may only contain packages residing in one repository. Ultimately the install fails because the python39-devel module has not set a default stream. For the python39 module a default stream is set. I checked and can confirm that none of the modules in powertools has set a default stream. This is puzzling as all these modules have only one stream and the corresponding modules in appstream have a default stream set. Wouldn't it make more sense to use the same default for both the module in appstream and the corresponding module in powertools (or any other repository it may reside in)? Best Peter [1] Of course I could run a "dnf module enable python39-devel" before issuing the install command. However I use many scripts to setup systems that simply expect a list of packages to install, all these fail. Note that I do not even have to specify a stream to enable the correct one. While this makes sense as there is only one stream, it should not work according to the documentation (see man dnf): "In case stream is not specified, the enabled or the default stream is used, in this order." No stream is enabled and there is no default stream. This whole process just feels inconsistent.

1 0

re CVE errata in CentOS Stream
by Naoto Kobayashi 19 Feb '21

19 Feb '21

Dear community, I would like to ask a following question: - How are CVEs handled in CentOS Stream? The answer in faq page (https://centos.org/distro-faq <https://centos.org/distro-faq>) states that security issues will be updated in CentOS Stream after they are solved in the current RHEL release. However, CentOS Steam 8 solved CVE-2020-15437 (kernel) while RHEL 8 has not (as of February 17,2021). Does the order of security updates between RHEL and CentOS Stream depend on the situation? Best regards, --- Naoto Kobayashi

4 4

Cloud SiG Membership Cleanup - Completed
by Amy Marrich 19 Feb '21

19 Feb '21

Over the last few weeks I have reached out to everyone on the SiG's pending and current membership lists in preparation for the upcoming access merger. Everyone was asked if they wanted to remain a member and where their interests were to help drive the group. Based on replies or lack of a reply the lists have now been cleaned up. If anyone was removed and would still like to be a member please re-apply as we'd love to have you. If you never knew there was a Cloud SiG please apply as we welcome new members! Any questions please reach out! Thanks, Amy (spotz) *Amy Marrich* She/Her/Hers Principal Technical Marketing Manager - Cloud Platforms Red Hat, Inc <https://www.redhat.com/> amy(a)redhat.com Mobile: 954-818-0514 Slack: amarrich IRC: spotz <https://www.redhat.com/>

3 5

Cleaning up modulefailsafe/ stuff correctly - libuv saga from EPEL to AppStream
by Anthony Alba 19 Feb '21

19 Feb '21

Background : needing libuv-devel when AppStream/Devel versions were not in sync I installed modular libuv 1.36 from epel-modular. Subsequently when AppStream/Devel synced at 1.38 I had difficulty removing evidence of 1.36 due to /var/lib/dnf/modulefailsafe. dnf clean all didn't help there. What is the correct way to clean up modulefailsafe/ so that it unblocks non-modular packages? I had even removed all reference to EPEL repos but didn't realise the existence of the /var/lib/dnf/modulefailsafe/ lock files. Cheers Anthony

1 0

Non-modular libuv 1.38 is filtered out by modules
by Anthony Alba 19 Feb '21

19 Feb '21

Hi centos-devel, I can't figure out what is blocking libuv 1.38 from AppStream from being installed. * I have disabled EPEL Modular 8 as there is a modular libuv 1.36 inside there. * up to date CentOS 8 machine * using default CentOS-Linux*.repo files, and not using a local mirror dnf config-manager --disable epel-modular dnf module provides libuv Last metadata expiration check: 0:00:48 ago on Fri 19 Feb 2021 09:10:38 AM. # dnf install libuv Last metadata expiration check: 0:01:40 ago on Fri 19 Feb 2021 09:10:38 AM. All matches were filtered out by modular filtering for argument: libuv Error: Unable to find a match: libuv dnf repository-packages appstream list | grep libuv # shows nothing dnf install cmake Last metadata expiration check: 0:03:25 ago on Fri 19 Feb 2021 09:10:38 AM. Error: Problem: package cmake-3.11.4-7.el8.x86_64 requires libuv.so.1()(64bit), but none of the providers can be installed - conflicting requests - package libuv-1:1.38.0-2.el8.x86_64 is filtered out by modular filtering (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) Any ideas? Anthony

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel