As you may have seen, Red Hat Summit has been converted to a virtual
event - https://www.redhat.com/en/summit - and we, the community
projects that were to have a presence there - have been asked to supply
some of the content for that virtual event.
This is an opportunity to tell a wider audience about what we're doing
in this project. In particular, I invite SIG members to provide an
update, in the form of a video/slide presentation, about what your SIG
has been working on, what's planned for the coming year, and how new
participants can get involved.
If you are involved in a SIG, please discuss this with the other
participants, and put together 2-5 slides about the above topics, and
designate someone who can deliver this content. Get in touch with me,
and we can schedule a time to record this presentation via Google
Meeting, or Bluejeans.
I *think* that the "virtual summit" will be async, rather than live
presentations, but that is still being figured out at this time.
Meanwhile, gathering the content and identifying the speakers is an
important first step.
If you're interested in presenting some other (ie, non-SIG related)
content, please do get in touch with me.
Thanks!
--
Rich Bowen - rbowen(a)redhat.com
@CentOSProject // @rbowen
859 351 9166
Tied to the previous announce, the new signing system will not depend on
cbs-content-control, which itself was using repositories prepared by mash.
Those repositories, while normally not meant to be consumed, will so go
away.
So all https://cbs.centos.org/repos/* will disappear next wednesday (FWIW)
--
Fabian Arrotin
The CentOS Project | https://www.centos.org
gpg key: 17F3B7A1 | twitter: @arrfab
When working with Thomas on new signing process, we decided that we'd
use Koji/CBS as single source of truth, so new signing process should
only query koji/cbs and automatically act when there would be something
to do.
Creating so a different thread to discuss the koji tags we have. We
discovered some inconsistencies and we think that $now would be a good
time to fix/move those if needed.
The current proposal would be (and most of the existing tags are
following that convention) :
<sig><dist>-<sig_project>-<sig_project_rel>-<sig_level>
If we take an example for Gluster 7 for CentOS 7, built by Storage SIG,
that means the following tags :
storage7-gluster-7-{candidate,testing,release}
The path where new process would automatically push out (to mirror CDN)
would be so based on koji tag :
mirror.centos.org/{centos,altarch}/<dist>/<sig>/{arch}/<sig_project>-<sig_project_rel>/
Once again, if we take the gluster 7 as an example, that would mean that
process would automatically (for -release tag, with three enabled
arches), push to those paths (created if needed) :
* http://mirror.centos.org/centos/7/storage/x86_64/gluster-7/
* http://mirror.centos.org/altarch/7/storage/aarch64/gluster-7/
* http://mirror.centos.org/altarch/7/storage/ppc64le/gluster-7/
The full path is coming from the koji tag, but we see some issues for
some paths/SIGs (like NFV)
As we think that it would be good to have confirmations from all SIGs
(as they are responsible for content to be pushed out, and also good
time to have EOL content removed), we'd eventually "lock" koji tags for
which we have *not* received confirmation for final destination path.
Other thing we discovered : some SIGs (in the past) have asked for a
"common" tag but then have asked (through cbs-content-control) to have
content from that common tag to be added in other repo.
As we'll *not* use cbs-content-control anymore, the way to deal with
this would be :
- either we use koji tag inheritance (preferred solution)
- or you just "tag-build" yourself when needed from one to the other
The advantage of doing this through koji tag inheritance is the following :
When you request for some tags, and specify what they would need,
nothing else would have to be done and you can just tag-build from
-testing to -release to trigger the sign+push to mirrors (while
tag-build to -testing first would push unsigned pkgs automatically to
buildlogs.centos.org, as usual)
Can we ask each SIG Chair to see which projects/releases are still
needed and so come back (either in this thread of #centos-devel)
Thanks for your collaboration !
--
Fabian Arrotin
The CentOS Project | https://www.centos.org
gpg key: 17F3B7A1 | twitter: @arrfab
Hello Everyone,
I'm from IBM China Development Team and I'm working on a new initiative
that plan to enable a "*minimized*" or "full" CentOS operating system on
IBM LinuxONE / IBM System Z (s390x architect).
The reason why we start this topic is we are trying to contribute to the
RDO community with our OpenStack build on LInuxONE.
We have successfully finished the build job for OpenStack Train Version
on LinuxONE and passed the basic function verification tests recently.
Now, we already have a link for worldwide users & fans to reference for
their needs.
For "official official" contributing to the RDO community, community
admin stated that a TripleO CI env is a must for community release
criteria and
the OpenStack packages need to be built in the CentOS build system which
run on s390x arch.
So, we turn to here for help, we know CentOS community ever had releases
for s390x arch but for whatever reasons finally stopped for update.
We want to take this opportunity to enable it up again and therefore
want to know about the overall processes, skills required, hardware
requirements, manpowers and duration estimated and which parts need
IBM's team's input, etc.
Our target is to enable at least a *"minimized" CentOS* (which can
support the OpenStack CI work), is there a SIG fit for this purpose? or
a "full" CentOS with default feature sets.
Could anybody kindly give us some clue to start this journey?
Thanks everyone in advance!
The Howto of OpenStack Train Installation on IBM LinuxONE had been
merged to the RDO official website.
https://www.rdoproject.org/install/
--
FuLong Wang
fulong.wang(a)cn.ibm.com
IBM China Systems Lab, Beijing, China
_______________________________________________
Hi all (especially SIG members/contributors) ,
As announced by Jim some time ago, we wanted to redesign the current
signing process that is in place for https://cbs.centos.org for CentOS 6
and 7 (so quite some years now)
The goal is to automate as much as possible the workflow, and working
for all releases (yeah for CentOS 8 and Stream)
Thomas and myself have worked on the following idea and we're now happy
with the results (in our Dev environment) :
- when someone builds a pkg, and that it's tagged to -testing, koji
sends a notification (through koji callback -
https://fedoraproject.org/wiki/Koji/WritingKojiCode#Event_Plugin) to a bus
- signing machine listens to the bus, process the tag and push directly
to buildlogs
- when someone tag-build said pkg to -release, the node signs it with
correct gpg key id (from the SIG), push generated repository (including
for debuginfo/src.rpm packages) to mirror CDN
As we were working on such automation, we also confirm that if one uses
"untag-build", the same rule applies : it triggers automatically koji to
reprocess the tag/repo and so removes the pkg from mirror (we got some
requests for that in the past)
The process so would work 24/7, and also have monitoring built-in (so
that we can detect - the infra team - when something doesn't work, and
so we can still process the tag again)
We recently upgraded cbs.centos.org to newer koji version that permits
some of the needed operations for this to happen.
At this stage, we are just missing the SIG GPG private keys, but we were
promised to have those this week.
We don't have any ETA yet for the migration to new signing system, but
we were thinking about such plan:
- deploy and configure (automatically) new signing node (this week)
- import GPG keys in the new system and validate that we can sign (when
we get those)
- changes some flags/parameters on tags on cbs.centos.org (this week)
Once we have this in place, we'd like to start validating the signing
process but *not* pushing to mirror CDN (yet). Same for the bus : we'd
like to process all tags in advance as we'll have to import RPM
signatures back in koji/cbs.
After full validation, we announce that new system would be fully in
place, and kojihub restarted with the notification plugin.
From that point, the system would be fully operational and so when SIG
members would build/tag pkgs, that would trigger the push (and signing
if needed for -release tag)
Worth knowing that with the update to some components in the chain, the
directory layout will change a little bit (like people are already used
to if using Fedora and Epel) : the Packages will be splitted by first
letter.
Here is an example from our testing :
└── storage
└── x86_64
└── gluster-7
├── Packages
│  ├── g
│  │  ├── glusterfs-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-api-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-api-devel-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-cli-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-client-xlators-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-cloudsync-plugins-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-devel-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-events-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-extra-xlators-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-fuse-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-geo-replication-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-libs-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-rdma-7.2-1.el7.x86_64.rpm
│  │  ├── glusterfs-resource-agents-7.2-1.el7.noarch.rpm
│  │  ├── glusterfs-server-7.2-1.el7.x86_64.rpm
│  │  └── glusterfs-thin-arbiter-7.2-1.el7.x86_64.rpm
│  ├── p
│  │  └── python2-gluster-7.2-1.el7.x86_64.rpm
│  └── u
│  ├── userspace-rcu-0.7.16-3.el7.x86_64.rpm
│  └── userspace-rcu-devel-0.7.16-3.el7.x86_64.rpm
└── repodata
├──
047503df3313d596e14a1a0d097b6c2261b26690000ecd4260d212a6f5e5632d-other.sqlite.bz2
├──
34c1f5dd954099816d6cce289e52f96e61cc2e6430e13072194e35c063b0e3da-primary.xml.gz
├──
6293e07e4c5a7acc2c610beb5acb84b996329ef3c6d61c03e375f2afc6a71536-filelists.sqlite.bz2
├──
6f89e8b43fb7e384f86f041c4de84d9afeb15dca981559b15230cb48887095db-other.xml.gz
├──
bef236563d185417fbda48e3b4dd1d62714d1af2b7a7d6dc1a7213af5de1aa9b-primary.sqlite.bz2
├──
fb66c148e8e2738bd5d19b88d1b3507b0383aaab0938de3809b399babb1a0b44-filelists.xml.gz
├── repomd.xml
└── repomd.xml.asc
From a usage perspective that will not change the way pkgs can be
consumed, as repodata will always be at the right place, but in the case
of SCLs that will mean no subdirectory like before, but instead just
same "first letter" name (while repodata will be global)
So in the current stage, we'd like to deploy and fully validate the
signing setup and we'll announce on this list when we'll fully switch to
new system.
Also worth noting that with the new system in place, in theory we'll
*not* use the old cbs-content-control git repo (as we'll query
automatically koji for tags, enabled architectures, etc) so tagging to
-testing and -release should trigger automatically the "push to mirrors"
step
If you have questions, comments, feel free to answer in this thread
and/or #centos-devel on irc.freenode.net
Kind Regards,
Thomas and Fabian
--
Fabian Arrotin
The CentOS Project | https://www.centos.org
gpg key: 17F3B7A1 | twitter: @arrfab
Hi all SIG members,
When working in our "Staging" environment while validating the new
signing process (still to be announced when fully in use/prod), we
detected some SIGs having multiple variants/versions of their packages.
Just one example (already discussed with Niels and Kaleb in
#centos-devel but let's just this one a example):
Gluster has multiple versions still listed on mirror.centos.org :
http://mirror.centos.org/centos/7/storage/x86_64/
As the new process would automatically decide where to push content
based on koji/cbs tag name, we found the interesting corner case of
gluster312.
The CBS tag is storage7-gluster-312-release and so new process would
push to
centos/7/storage/x86_64/gluster-312/ instead of
http://mirror.centos.org/centos/7/storage/x86_64/gluster-3.12/ (see the
diff betwen koji/cbs tag and the final path/destination)
It seems that only Gluster was impacted for older releases, while it
should be good for new releases (tested).
But so that brings the following request : can you come with a list of
EOL repositories that you'd like us to trim/remove from
mirror.centos.org (they'll be archived to vault.centos.org) ?
Doing that at the same time as we launch the new signing/push process
would be a good idea.
Thanks a lot in advance for your collaboration !
--
Fabian Arrotin
The CentOS Project | https://www.centos.org
gpg key: 17F3B7A1 | twitter: @arrfab
TL;DR: We have postponed the upcoming Dojo at Facebook, and are
carefully watching the situation to determine any other event
participation in the coming months.
Due to the developing situation with the Corona virus and COVID-19, we
have made the decision to postpone our upcoming CentOS Dojo that was
scheduled to occur at Facebook on April 24th. Details of that event are
here - https://wiki.centos.org/Events/Dojo/Facebook2020 - and will be
updated once a new date has been selected.
Other upcoming events are still scheduled to occur, as they are farther
out. The next scheduled event will be at CERN on October 23rd, and we
will update details as we get closer. Details for that event are
available at https://wiki.centos.org/Events/Dojo/CERN2020 and the call
for presentations is still open.
Our planned booth presence at other upcoming events has been canceled
for the foreseeable future, and we will update our event listing at
https://wiki.centos.org/Events once the world situation improves and
travel is once again feasible. There are several other proposed Dojos in
the works at this time, but we are not going to publish any details
until the epidemic crisis has passed.
Thank you for your patience and understanding, and we'll send updates
here once things become clearer.
--
Rich Bowen - rbowen(a)redhat.com
@CentOSProject // @rbowen
859 351 9166