infrastructure March 2009

infrastructure@lists.fedoraproject.org

58 participants
86 discussions

Introducing: Alin Crețu
by Alin Cretu 17 Mar '09

17 Mar '09

Hello Fedora Infrastructure, I'd like to use my first e-mail to introduce myself. The name is Alin Crețu, I'm 33 years old, Romanian citizen, currently living in Germany. I've been working/playing with Red Hat Linux since RH 5.2 and with Fedora since it's first release 10 years ago. For the last 9 years I was working with Linux/Unix in different production environments, from small departmental (2 systems) up to large enterprise (200+ Linux/Unix machines with High Availability requirements). Since June 2007 I'm also certified as "IBM Certified Advanced Technical Expert -- IBM System p5 2006" and I can find my way around BASH and ksh scripting. Also I have considerable understanding and some real life experience with large SAN installations. I'd like to take this opportunity to give something back to Fedora by helping the Infrastructure team running the servers that make the Fedora Project possible. As of now, I'm also looking to find a sponsor that will be willing guide my first steps towards this community. Regards, Alin Crețu

2 2

Outage Notification - 2009-03-19 04:00 UTC
by Mike McGrath 17 Mar '09

17 Mar '09

There will be an outage starting at 2009-03-19 04:00 UTC, which will last approximately 30 minutes. To convert UTC to your local time, take a look at http://fedoraproject.org/wiki/Infrastructure/UTCHowto or run: date -d '2009-03-19 04:00 UTC' Affected Services: Buildsystem (EPEL/Plague only) Fedora Talk Gobby lists.fedoraproject.org DNS (ns1 only) Unaffected Services: CVS / Source Control Database Fedora Hosted Fedora People Mail Mirror System Torrent Translation Services Websites Ticket Link: https://fedorahosted.org/fedora-infrastructure/ticket/1271 Reason for Outage: One of our sponsors, ServerBeach (http://serverbeach.com) provides hosting for the above affected services and has scheduled an outage to conduct network maintenance on the switch our servers are on. This will cause them to be unavailable for a period of time. Contact Information: Please join #fedora-admin in irc.freenode.net or respond to this email to track the status of this outage.

1 0

Free Software Policy
by Mike McGrath 17 Mar '09

17 Mar '09

It dawns on me that I talked about this briefly at one of the meetings but never sent it too the list. I'd like to propose the following software policy: http://infrastructure.fedoraproject.org/csi/free-software-policy/en-US/ There's a lot of background information there that should be familiar to all of us already. The table info at the bottom is probably more important. This is very close to what we're doing now, just written down. Give it a read over and let me know what you all think before we formally adopt it. -Mike

1 0

Change Request - Change transifex to run under the transifex user
by Ricky Zhou 17 Mar '09

17 Mar '09

This should be a pretty safe security change to make transifex run under the separate transifex user, instead of the apache user. I've tested it out on publictest14. The django transifex isn't 100% in puppet yet, so here are the steps I'd like to take: mv ~ricky/tx.conf /etc/httpd/conf.d /etc/init.d/httpd restart mv /var/www/.ssh /var/lib/transifex chown -R transifex:transifex /var/lib/transifex/.ssh find /var/lib/transifex -user apache -exec chown transifex:transifex {} \; mv ~ricky/ssh-add.sh /var/lib/transifex # restart ssh-agent to run under the transifex user Here's the diff between my edited tx.conf and the original one: --- /etc/httpd/conf.d/tx.conf 2009-03-12 13:46:14.000000000 +0000 +++ /home/fedora/ricky/tx.conf 2009-03-17 14:29:36.000000000 +0000 @@ -1,6 +1,8 @@ WSGIRestrictStdout Off WSGIRestrictStdin Off +WSGIDaemonProcess transifex processes=8 threads=2 maximum-requests=50000 user=transifex group=transifex display-name=transifex inactivity-timeout=300 + Alias /site_media /usr/share/transifex/site_media <Directory /usr/share/transifex/site_media> @@ -10,5 +12,9 @@ SetEnv SSH_AUTH_SOCK /var/lib/transifex/ssh-agent-sock-transifex +<Directory /usr/share/transifex> + WSGIProcessGroup transifex +</Directory> + WSGIScriptAlias /tx /usr/share/transifex/tx-django.wsgi Thanks, Ricky

3 2

svn-to-git mirroring
by Jim Meyering 17 Mar '09

17 Mar '09

I've been lurking here for some time, and have seen some recent opportunities to help make a difference, so have just applied for membership to the sysadmin group. For example, Fabio Di Nitto and I would like to set up an svn-to-git mirror for a project on fedorahosted. While I set up and maintain git.et.redhat.com, it's not open for ssh access to people outside of Red Hat, so it's rather limited.

3 11

Hosted requests
by Mike McGrath 17 Mar '09

17 Mar '09

Hey all, there's a lot of outstanding fedorahosted requests. Some are assigned and have been left uncommitted for some time. Just following up with everyone to make sure they don't get forgotten about. if you're in the sysadmin-hosting group and cannot complete these requests any longer please let me know or unassign them so they don't go uncompleted. -Mike

2 3

Fedora 11 tickets
by Mike McGrath 16 Mar '09

16 Mar '09

Just a reminder, we've still got 31 active tickets to complete: https://fedorahosted.org/fedora-infrastructure/milestone/Fedora%2011 If any of those has been done already, please do close them. Many are unowned so there's always work to di. -Mike

1 0

Re: [Change Request] Add redirect from /legal/trademarks/guidelines to http://fedoraproject.org/wiki/Legal:Trademark_guidelines.
by Dennis Gilmore 16 Mar '09

16 Mar '09

+1 Ricky Zhou <ricky(a)fedoraproject.org> wrote: >As requested by Paul at >https://fedorahosted.org/fedora-infrastructure/ticket/1269. I tested >this on staging, so this should be relatively safe. >--- > configs/web/fedoraproject.org/modRewrite.conf | 1 + > 1 files changed, 1 insertions(+), 0 deletions(-) > >diff --git a/configs/web/fedoraproject.org/modRewrite.conf b/configs/web/fedoraproject.org/modRewrite.conf >index ad12573..037cd35 100644 >--- a/configs/web/fedoraproject.org/modRewrite.conf >+++ b/configs/web/fedoraproject.org/modRewrite.conf >@@ -15,6 +15,7 @@ RewriteRule ^/docs/(.*) http://docs.fedoraproject.org/$1 [R=301,L] > RewriteRule ^/Download/(.*) http://rhold.fedoraproject.org/Download/$1 [R=301,L] > RewriteRule ^/download/(.*) http://rhold.fedoraproject.org/Download/$1 [R=301,L] > RewriteRule ^/extras/(.*) http://download.fedora.redhat.com/pub/fedora/linux/extras/$1 [R=302,L] >+RewriteRule ^/([^/]+/)?legal/trademarks/guidelines$ http://fedoraproject.org/wiki/Legal:Trademark_guidelines [R=301,L] > # RedirectMatch ^/wiki/Releases/7 http://fedoraproject.org/static-tmp/7 > # RedirectMatch ^/wiki/$ http://fedoraproject.org/static-tmp/ > # RedirectMatch ^/wiki/FedoraMain$ http://fedoraproject.org/static-tmp/ >-- >1.5.5.6 > >_______________________________________________ >Fedora-infrastructure-list mailing list >Fedora-infrastructure-list(a)redhat.com >https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list -- Sent from my Android phone with K-9. Please excuse my brevity.

1 0

[Change Request] Add redirect from /legal/trademarks/guidelines to http://fedoraproject.org/wiki/Legal:Trademark_guidelines.
by Ricky Zhou 16 Mar '09

16 Mar '09

As requested by Paul at https://fedorahosted.org/fedora-infrastructure/ticket/1269. I tested this on staging, so this should be relatively safe. --- configs/web/fedoraproject.org/modRewrite.conf | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/configs/web/fedoraproject.org/modRewrite.conf b/configs/web/fedoraproject.org/modRewrite.conf index ad12573..037cd35 100644 --- a/configs/web/fedoraproject.org/modRewrite.conf +++ b/configs/web/fedoraproject.org/modRewrite.conf @@ -15,6 +15,7 @@ RewriteRule ^/docs/(.*) http://docs.fedoraproject.org/$1 [R=301,L] RewriteRule ^/Download/(.*) http://rhold.fedoraproject.org/Download/$1 [R=301,L] RewriteRule ^/download/(.*) http://rhold.fedoraproject.org/Download/$1 [R=301,L] RewriteRule ^/extras/(.*) http://download.fedora.redhat.com/pub/fedora/linux/extras/$1 [R=302,L] +RewriteRule ^/([^/]+/)?legal/trademarks/guidelines$ http://fedoraproject.org/wiki/Legal:Trademark_guidelines [R=301,L] # RedirectMatch ^/wiki/Releases/7 http://fedoraproject.org/static-tmp/7 # RedirectMatch ^/wiki/$ http://fedoraproject.org/static-tmp/ # RedirectMatch ^/wiki/FedoraMain$ http://fedoraproject.org/static-tmp/ -- 1.5.5.6

2 1

Change Request -- high risk, high reward
by Toshio Kuratomi 15 Mar '09

15 Mar '09

ricky and I have identified a piece of code in fas2's new safasprovider that's querying the database a lot. It's causing anything that checks identity to issue a query to the database to lookup the visit cookie. This is causing things that lookup information on the identity multiple times to take a lot of time. One of the functions that does this is filter_private(), the function that removes excess information according to privacy settings and who is looking for the data. Our test was the /user/list method which is currently running over 5 minutes for an otherwise non-database loop. Changing this caused the loop to run for 8 seconds. That's the benefit. The risk is that this is a change to the safasprovider, ie the portion of fas2 that authenticates the user. So if there's a reason this shouldn't be cached, we could potentially be breaking a lot of things. Ricky and I have both looked at the code in fas/safasprovider.py::SaFasIdentity and think that it's safe to cache this. The TG-1.0.8 saprovider on which safasprovider is based does not cache this but I've looked at the code and it seems like their provider only uses the variable in question a maximum of two times during a request. The CSRF protection that we've enabled needs to use this variable more often. Here's the code: --- a/fas/safasprovider.py +++ b/fas/safasprovider.py @@ -65,6 +65,7 @@ class SaFasIdentity(object): def __init__(self, visit_key=None, user=None, using_ssl=False): self.visit_key = visit_key + self._visit_link = None if user: self._user = user if visit_key is not None: @@ -201,9 +202,13 @@ class SaFasIdentity(object): ### TG: Same as TG-1.0.8 def _get_visit_link(self): '''Get the visit link to this identity.''' + if self._visit_link: + return self.visit_link if self.visit_key is None: - return None - return visit_class.query.filter_by(visit_key=self.visit_key).first() + self._visit_link = None + else: + self._visit_link = visit_class.query.filter_by(visit_key=self.visi t_key).first() + return self._visit_link visit_link = property(_get_visit_link) If we were outside of freeze, I would apply this as it is causing issues for some of the things that talk to fas (like zodbot and developer instances of pkgdb). -Toshio

5 5

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure March 2009