infrastructure October 2018

infrastructure@lists.fedoraproject.org

29 participants
54 discussions

FBR: Switch Pagure over to aclchecker
by Patrick マルタインアンドレアス Uiterwijk 11 Oct '18

11 Oct '18

Hi, This is the next step of preparing pagure.io for repoSpanner: switch the entry command to aclchecker, which is a small script that calls either repoBridge for repos on repoSpanner (none at this moment) or gitolite for all others. This adds some configuration for repobridge, but that won't be used yet. This can be reverted by switching the SSH config back to no longer calling keyhelper. Patrick commit 6d313b60b05b022c1ae04dc81f9956cff33fb5b5 (HEAD -> master) Author: Patrick Uiterwijk <patrick(a)puiterwijk.org> Date: Thu Oct 11 20:19:11 2018 +0200 Switch Pagure.io over to aclchecker This will make it possible to migrate repositories to repoSpanner. Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org> diff --git a/roles/pagure/frontend/templates/pagure.cfg b/roles/pagure/frontend/templates/pagure.cfg index 4fddd17e7..54e28930b 100644 --- a/roles/pagure/frontend/templates/pagure.cfg +++ b/roles/pagure/frontend/templates/pagure.cfg @@ -313,4 +313,21 @@ THEME = 'pagureio' MIRROR_SSHKEYS_FOLDER='/srv/mirror/ssh' SSH_KEYS_USERNAME_EXPECT = "git" -SSH_KEYS_OPTIONS = 'command="/usr/share/gitolite3/gitolite-shell %(username)s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty' +SSH_KEYS_OPTIONS = 'restrict,command="/usr/libexec/pagure/aclchecker.py %(username)s"' + +SSH_COMMAND_REPOSPANNER = ([ + "/usr/libexec/repobridge", + "--extra", "username", "%(username)s", + "--extra", "repotype", "%(repotype)s", + "--extra", "project_name", "%(project_name)s", + "--extra", "project_user", "%(project_user)s", + "--extra", "project_namespace", "%(project_namespace)s", + "%(cmd)s", + "'pagure/%(repotype)s/%(reponame)s'", +], {"REPOBRIDGE_CONFIG": "/etc/repobridge/rpms.json"}) +SSH_COMMAND_NON_REPOSPANNER = ([ + "/usr/share/gitolite3/gitolite-shell", + "%(username)s", + "%(cmd)s", + "%(reponame)s", +], {})

3 3

FBR: Enable keyhelper for pagure01
by Patrick マルタインアンドレアス Uiterwijk 11 Oct '18

11 Oct '18

Hi, Can I get +1s to the following patch? This would enable keyhelper.py on pagure.io, which is an alternative to authorized_keys file, which need a gitolite recompile to get changes activated. If anything goes wrong with it, sshd will fall back to the authorized_keys file, which will still be updated. Note that due to the fact that sshd_config is a file (instead of template), it needs a copy of the file (I have a todo to fix this), but the only change from the EL7 one to this is the last two lines, addition of AuthorizedKeysCommand. Patrick commit 95523df6b2ed99a170cac19f6e84daf43b81b617 Author: Patrick Uiterwijk <patrick(a)puiterwijk.org> Date: Wed Oct 10 17:37:16 2018 +0200 Add keyhelper to pagure.io Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org> diff --git a/roles/basessh/files/ssh/sshd_config.pagure b/roles/basessh/files/ssh/sshd_config.pagure new file mode 100644 index 000000000..8fca2d49f --- /dev/null +++ b/roles/basessh/files/ssh/sshd_config.pagure @@ -0,0 +1,166 @@ +# $OpenBSD: sshd_config,v 1.90 2013/05/16 04:09:14 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# If you want to change the port on a SELinux system, you have to tell +# SELinux about this change. +# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER +# +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +# The default requires explicit activation of protocol 1 +#Protocol 2 + +# HostKey for protocol version 1 +#HostKey /etc/ssh/ssh_host_key +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub +#HostKey /etc/ssh/ssh_host_dsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key + +# Lifetime and size of ephemeral version 1 server key +#KeyRegenerationInterval 1h +#ServerKeyBits 1024 + +# Ciphers and keying +#RekeyLimit default none + +# Logging +# obsoletes QuietMode and FascistLogging +#SyslogFacility AUTH +SyslogFacility AUTHPRIV +#LogLevel INFO +LogLevel VERBOSE + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin yes +#StrictModes yes +PermitRootLogin without-password +StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#RSAAuthentication yes +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#RhostsRSAAuthentication no +# similar for protocol version 2 +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# RhostsRSAAuthentication and HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no +PasswordAuthentication no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes +ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no +#KerberosUseKuserok yes + +# GSSAPI options +#GSSAPIAuthentication no +GSSAPIAuthentication yes +#GSSAPICleanupCredentials yes +GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several +# problems. +#UsePAM no +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +UsePrivilegeSeparation sandbox # Default for new installations. +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#ShowPatchLevel no +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Accept locale-related environment variables +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE +AcceptEnv XMODIFIERS + +# override default of no subsystems +Subsystem sftp /usr/libexec/openssh/sftp-server + +# Uncomment this if you want to use .local domain +#Host *.local +# CheckHostIP no + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# ForceCommand cvs server + + +# For repospanner/git +AuthorizedKeysCommandUser git +AuthorizedKeysCommand /usr/libexec/pagure/keyhelper.py "%u" "%h" "%t" "%f" diff --git a/roles/pagure/frontend/templates/pagure.cfg b/roles/pagure/frontend/templates/pagure.cfg index 942712f83..09df7561f 100644 --- a/roles/pagure/frontend/templates/pagure.cfg +++ b/roles/pagure/frontend/templates/pagure.cfg @@ -311,3 +311,6 @@ FEDMSG_NOTIFICATIONS = True THEME = 'pagureio' MIRROR_SSHKEYS_FOLDER='/srv/mirror/ssh' + +SSH_KEYS_USERNAME_EXPECT = "git" +SSH_KEYS_OPTIONS = 'command="/usr/share/gitolite3/gitolite-shell %(username)s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty'

3 2

Meeting agenda for 2018-10-11
by Kevin Fenzi 11 Oct '18

11 Oct '18

This shared document is for the next fedora infrastructure meeting. = Preamble = The infrastructure team will be having its weekly meeting tomorrow, 2018-10-04 at 14:00 UTC in #fedora-meeting-1 on the freenode network. We have a gobby document (see: https://fedoraproject.org/wiki/Gobby ) fedora-infrastructure-meeting-next is the document. Please try and review and edit that document before the meeting and we will use it to have our agenda of things to discuss. A copy as of today is included in this email. If you have something to discuss, add the topic to the discussion area with your name. If you would like to teach other folks about some application or setup in our infrastructure, please add that topic and your name to the learn about section. = Introduction = We will use it over the week before the meeting to gather status and info and discussion items and so forth, then use it in the irc meeting to transfer information to the meetbot logs. = Meeting start stuff = #startmeeting Infrastructure (2018-10-11) #meetingname infrastructure #topic aloha #chair nirik pingou puiterwijk relrod smooge tflink threebean cverna = Let new people say hello = #topic New folks introductions #info This is a place where people who are interested in Fedora Infrastructure can introduce themselves = Status / Information / Trivia / Announcements = (We put things here we want others on the team to know, but don't need to discuss) (Please use #info <the thing> - your name) #topic announcements and information #info tflink is on extended PTO #info smooge is on PTO 2018-10-06->2018-10-09 #info nirik is on PTO 2018-10-24->2018-10-28 #info Final Freeze has started 2018-10-09 = Things we should discuss = We use this section to bring up discussion topics. Things we want to talk about as a group and come up with some consensus /suor decision or just brainstorm a problem or issue. If there are none of these we skip this section. (Use #topic your discussion topic - your username) #topic Oncall #info bowlofeggs is on call from 2018-10-04 -> 2018-10-11 #info smooge is on call from 2018-10-11 -> 2018-10-18 #info relrod is on call from 2018-10-18 -> 2018-10-25 #info smooge is on call from 2018-10-25 -> 2018-11-01 #info ??? is on call from 2018-11-01 -> 2018-11-?? #info Summary of last week: (from bowlofeggs) #topic RFR revamp - kevin #topic Tickets discussion #info https://pagure.io/fedora-infrastructure/report/Meetings%20ticket Go thru each ticket one by one = Apprentice office hours = #topic Apprentice Open office minutes #info A time where apprentices may ask for help or look at problems. Here we will discuss any apprentice questions, try and match up people looking for things to do with things to do, progress, testing anything like that. = Learn about some application or setup in infrastructure = (This section, each week we get 1 person to talk about an application or setup that we have. Just going over what it is, how to contribute, ideas for improvement, etc. Whoever would like to do this, just add the i/nfo in this section. In the event we don't find someone to teach about something, we skip this section and just move on to open floor.) #info = Meeting end stuff = #topic Open Floor #endmeeting

1 0

fedora-messaging v1.0
by Jeremy Cline 10 Oct '18

10 Oct '18

Hey folks, Today Aurélien and I tagged the v1.0 release for fedora-messaging. It's available on PyPI, Rawhide, F29[0], and in the infra staging repos for F28, F27, and EPEL7. The complete changelog and documentation is available on readthedocs[1]. The broker and messaging bridges between fedmsg and AMQP are running in staging, so we're ready for applications to begin porting. If you have any questions that the documentation doesn't answer, please don't hesitate to ask me or Aurélien. [0] https://bodhi.fedoraproject.org/updates/fedora-messaging-1.0.1-1.fc29 [1] https://fedora-messaging.readthedocs.io/ -- Jeremy Cline XMPP: jeremy(a)jcline.org IRC: jcline

2 1

Jenkies
by Randy Barlow 09 Oct '18

09 Oct '18

Greetings! I just wrote up a blog post about the recent work I've been doing to get Bodhi's CI setup to be much nicer, in case that interests any of you: https://blog.electronsweatshop.com/goodbye-jjb-hello-jenkies-pipeline.html

1 0

[Fedocal] Reminder meeting : Infra Office Hours
by cverna＠fedoraproject.org 08 Oct '18

08 Oct '18

Dear all, You are kindly invited to the meeting: Infra Office Hours on 2018-10-09 from 18:00:00 to 19:00:00 UTC At fedora-admin(a)irc.freenode.net The meeting will be about: Weekly hour dedicated to answer questions or help people with fixing tickets or implementing features. Source: https://apps.fedoraproject.org/calendar/meeting/9255/

1 0

Anitya 0.13.1 (release-monitoring.org) deployed on production
by Michal Konečný 08 Oct '18

08 Oct '18

Hi Everybody, I'm glad I could announce that Anitya 0.13.1 is now deployed on production (https://release-monitoring.org). This update was from version 0.11.0, so it's a big release with plenty of new features. You can see the changelog here: * 0.13.1 - https://github.com/release-monitoring/anitya/releases/tag/0.13.1 * 0.13.0 - https://github.com/release-monitoring/anitya/releases/tag/0.13.0 * 0.12.1 - https://github.com/release-monitoring/anitya/releases/tag/0.12.1 Main changes: - Update GitHub backend to GitHub API v4 - Add GitLab backend. This is implemented using GitLab API v4 - Anitya is now running in openShift instead of VM (thx kevin) - And bug fixes Known issues: - documentation links are broken (error 404) - many project are now incorrectly setup (caused by change in the GitHub backend) - admins lost their rights (caused by change in the users table) We will try to solve the known issues as fast as we can. Thanks to everyone who contributed to Anitya project and made this announcement a reality. Regards, mkonecny

1 0

Krita and Blender 2.8 packages .
by Cătălin George Feștilă 05 Oct '18

05 Oct '18

Dear team. I know somebody works with this packages: Krita and Blender. Both come with new versions: Krita - 4.1.3, Fedora has version 4.1.0-1 Blender 2.8, Fedora has 2.79b I don't make an upgrade of this packages. I know has changed Fedora development area with new spins and software and this is the reason I send this mail here. Best regards.

1 0

Infrastructure Meeting 2018-10-04 14:00 UTC proposed agenda
by Stephen John Smoogen 04 Oct '18

04 Oct '18

This shared document is for the next fedora infrastructure meeting. = Preamble = The infrastructure team will be having its weekly meeting tomorrow, 2018-10-04 at 15:00 UTC in #fedora-meeting-1 on the freenode network. We have a gobby document (see: https://fedoraproject.org/wiki/Gobby ) fedora-infrastructure-meeting-next is the document. Please try and review and edit that document before the meeting and we will use it to have our agenda of things to discuss. A copy as of today is included in this email. If you have something to discuss, add the topic to the discussion area with your name. If you would like to teach other folks about some application or setup in our infrastructure, please add that topic and your name to the learn about section. = Introduction = We will use it over the week before the meeting to gather status and info and discussion items and so forth, then use it in the irc meeting to transfer information to the meetbot logs. = Meeting start stuff = #startmeeting Infrastructure (2018-10-04) #meetingname infrastructure #topic aloha #chair nirik pingou puiterwijk relrod smooge tflink threebean cverna = Let new people say hello = #topic New folks introductions #info This is a place where people who are interested in Fedora Infrastructure can introduce themselves = Status / Information / Trivia / Announcements = (We put things here we want others on the team to know, but don't need to discuss) (Please use #info <the thing> - your name) #topic announcements and information #info tflink is on extended PTO #info smooge is on PTO 2018-10-06->2018-10-09 #info nirik is on PTO 2018-10-24->2018-10-28 #info Final Freeze will start 2018-10-09 #info Updates/reboots done except for QA/builders #info fedora-tagger/statscache retired - cverna/nirik = Things we should discuss = We use this section to bring up discussion topics. Things we want to talk about as a group and come up with some consensus /suor decision or just brainstorm a problem or issue. If there are none of these we skip this section. (Use #topic your discussion topic - your username) #topic Oncall #info Puiterwijk is on call from 2018-09-27->2018-10-04 #info ??? is on call from 2018-10-04 -> 2018-10-11 #info smooge is on call from 2018-10-11 -> 2018-10-18 #info Summary of last week: (from Puiterwijk) #topic torrents and their troubles - kevin #info used more than I realized #topic #topic Tickets discussion #info https://pagure.io/fedora-infrastructure/report/Meetings%20ticket Go thru each ticket one by one = Apprentice office hours = #topic Apprentice Open office minutes #info A time where apprentices may ask for help or look at problems. Here we will discuss any apprentice questions, try and match up people looking for things to do with things to do, progress, testing anything like that. = Learn about some application or setup in infrastructure = (This section, each week we get 1 person to talk about an application or setup that we have. Just going over what it is, how to contribute, ideas for improvement, etc. Whoever would like to do this, just add the i/nfo in this section. In the event we don't find someone to teach about something, we skip this section and just move on to open floor.) #info = Meeting end stuff = #topic Open Floor #endmeeting -- Stephen J Smoogen.

1 1

fedora-infrastructure#7267: "fedora-packager and statscache sunset" patch review.
by David Shier 03 Oct '18

03 Oct '18

All/sysadmin-main - Could someone please review the attached patch file for the removal of tagger and statscache from the ansible repos/proxy lists/ etc.? I was going to attach to issue, but pagure is only letting me do pictures, and this one is large and gnarly as a picture. Thanks, Dave Shier/odin

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure October 2018