June 2010 - openSUSE Build Service - openSUSE Mailing Lists

[opensuse-buildservice] OBS 2.0 Beta 3 released
by Adrian Schröter 08 Jun '10

08 Jun '10

OBS 2.0 Beta 3 is available =========================== The version tag of the release is "1.9.92". Beside a number of bugfixes the two following changes happened: * Backend has basic http proxy support for doing OBS interconnect. * OBS Appliance comes with pre-configured signing daemon. These come quite late, but were very often requested and we think the code is safe against regressions. Only possible known regression is that hardware without hardware random generator will take longer during key generation (when creating a project), what may lead to timeouts. Repositories are as usual http://download.opensuse.org/repositories/openSUSE:/Tools:/Unstable/ OBS Appliance can get downloaded via http://en.opensuse.org/Build_Service/OBS-Appliance I hope we can release this code drop just with release number changed on thursday. Note: The final release will happen in the openSUSE:Tools project. Users who want to stay at 1.7 need to switch to openSUSE:Tools:1.7 project. -- Adrian Schroeter SUSE Linux Products GmbH email: adrian(a)suse.de -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 2

[opensuse-buildservice] security improvement by signed build service for safe packages
by Hauke Laging 08 Jun '10

08 Jun '10

Hello, what I am going to suggest has been discussed in a German Usenet security group: http://groups.google.de/g/8957ff07/t/79e56c62c480852d/d/ccbd59ad3467714f As described on this page there are several components of "trust": http://wiki.opensuse.org/openSUSE:Build_Service_Concept_Trust My suggestion is about the technical part only: Can you trust a package not to contain malicious code if you don't know the packager but trust the (cryptographically known) developer or rather the organization providing the build service? My idea is that the build service introduces a new layer of trust by establishing mechanisms which prevent malicious code from being introduced in a package. The result would be that a user could download a package from an inofficial repository and verify this package not only by the repository signature (which often has unknown security value) but also by a signature from the build service. This OBS signature would guarantee that the package has been created in a way which has been designed to avoid certain security problems. This way would be: 1) SuSE would include all public keys of developers which they use for the creation of official packages in the OBS. (That's the easy part...) 2) SuSE would include all patches and spec files which they use for official packages in the OBS. 3) SuSE would define a whitelist of compiler options. 4) The OBS would allow the repo maintainer to upload source code which has been signed by a key which is known by the OBS. 5) The OBS would allow the repo maintainer to select any components from the official package and compiler options from the whitelist. 6) The resulting package would get signed by the OBS. The user would not know how up to date the source code is but he would know that it was safe (apart from bugs by the developer). The obvious problem is that this would be usable for a certain part of the inofficial packages only. 5%, 10%, 50%? I have no idea. But I am sure that this would have to be a long term approach. Based on the non-working packages the OBS configuration options would have to be improved permanently. This need not be done by SuSE alone. If a big number of knows developers signs a requested extension as safe then it could be added without SuSE spending money for an investigation by its own security employees. On the other hand I assume that the problem would decrease by itself. Developers would probably start paying attention to writing code in a BS friendly way. At least if other distributors offer similar services someday. I assume that the rules how to make source code BS friendly would be the same for all distributions. Another positive future influence would be that the official packages would be developed with BS friendlyness in mind. Thus every new openSUSE version would enable more packages to be signed by the OBS with quite little additional effort by SuSE. CU Hauke -- PGP: D44C 6A5B 71B0 427C CED3 025C BD7D 6D27 ECCB 5814

1 0

[opensuse-buildservice] Fate#309717: make osc to remember http authentication header
by JF Ding 08 Jun '10

08 Jun '10

Hi, I wonder if anyone noticed before, for each osc api access, two requests needed as I described in fate#309717: https://features.opensuse.org/309717 It might be a waste of network bandwidth, so I have tried to make osc record the authorization header of last 200 response, and insert the header to the following http requests (in the sub-domain of recorded one). The code can be reviewed at: http://gitorious.org/~jfding/opensuse/jfdings-osc/commit/62d705c29999856ec6… Any advice? thanks, jf.ding -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

1 0

[opensuse-buildservice] Distro-specific Debian files
by Rob Hasselbaum 08 Jun '10

08 Jun '10

Hi all. I'd like to use a different Debian changelog (and possibly a different control file) per OBS distribution repository. For example, I want one set for xUbuntu_10.04 and a different set for xUbuntu_9.10. I know that for RPM-based distros, I can have a different SPEC file per repository by following the "myproject-1.0.0-{repository}.spec" naming convention (e.g. "myproject-1.0.0-openSUSE_11.2.spec"), but the same trick doesn't seem to work for Debian files. Any advice? Thanks. -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 3

[opensuse-buildservice] obs-server: SPARC porting for 1.9.91
by Jan Engelhardt 07 Jun '10

07 Jun '10

The following changes since commit 2f48e6b96ab048e0ec431c4e1cba4a353f337fff: handle missing package error correctly (2010-05-28 16:19:46 +0200) are available in the git repository at: git://dev.medozas.de/suse-build-service master Jan Engelhardt (4): bs_worker: force use of --target for SPARC bsconfig: update relsync for sparc64 bs_sched: rectify SPARC architecture compatibility definitions webui: remaining sparclets Please inspect and apply if ok. For p#1: While the use of --target has raised some concerns, it is ultimately required for sparcv9 building right now, and as openSUSE.org is not using that architecture at all, I guess I get the say :-) dist/sysconfig.obs-server | 2 +- docs/api/api/obs.rng | 2 ++ src/backend/BSConfig.pm.template | 2 ++ src/backend/bs_dispatch | 4 ++-- src/backend/bs_worker | 7 +++++-- 5 files changed, 12 insertions(+), 5 deletions(-) -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 7

[opensuse-buildservice] Error in OBS Release 1.8.0 RC3?
by victor.liu＠nokia.com 07 Jun '10

07 Jun '10

Hi, Just had a try on OBS 1.8.0 RC3(from project: openSUSE:Tools:MeeGo), found an error when trying to view the package source files on webui: ******************************************* openSUSE Webclient Error: Error Details: Errorcode: unknown Message: uncaught exception: undefined method `find_package' for #<DbProject:0xb67deb80> ******************************************** Same issue when using osc to checkout project. I just checked the API code(both for RC3 and 1.8 branch on git), there is no "find_package" definition in /srv/www/obs/api/app/models/db_project.rb, but this method is required by other codes: /srv/www/obs/api/app/controllers/source_controller.rb:137: pkg = prj.find_package(package_name) /srv/www/obs/api/app/controllers/build_controller.rb:177: pkg = prj.find_package params[:package] Could you pls help on this issue? It blocks our testing work... Thanks Victor Liu -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 1

[opensuse-buildservice] BuildService API error: ERROR: service is not installed !Can maybe solved with: zypper in obs-server-download_url
by Dominique Leuenberger 07 Jun '10

07 Jun '10

Hi everybody, A weird issue appeared, which I first though would be coming from my own BS instance, but it is also on OBS. Terminal output: $>osc co multimedia:libs libvpx A multimedia:libs A multimedia:libs/libvpx A multimedia:libs/libvpx/_service A multimedia:libs/libvpx/buildfix.diff A multimedia:libs/libvpx/libvpx.changes A multimedia:libs/libvpx/libvpx.spec A multimedia:libs/libvpx/upstream.diff $>cd multimedia:libs/libvpx $>osc up At revision 11. BuildService API error: ERROR: service is not installed !Can maybe solved with: zypper in obs-server-download_url $>cat _service <?xml version="1.0" ?> <services> <service name="download_url"> <param name="protocol">http</param> <param name="host">webm.googlecode.com</param> <param name="path">/files/libvpx-0.9.0.tar.bz2</param> </service> <service name="verify_file"> <param name="file">_service:download_url:libvpx-0.9.0.tar.bz2</param> <param name="verifier">sha256</param> <param name="checksum">a0096ac6859cfb61cf06dd9bc0a79a3333a4ec389ba311911d84df8ff2a1b9dc</param> </service> </services> $> Anything I can do here from my side? (I care less for libvpx on OBS than for the one linked to my own BS, but still). Dominique -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

2 5

[opensuse-buildservice] how to change list of repos in webui?
by Robert Xu 07 Jun '10

07 Jun '10

Hi all, Usually, there is /srv/www/obs/webui/config/repositories.rb that defines the list of default repos one can select. I noticed that this file is removed in webui 2.0. Is this defined in another place? -- later, Robert Xu Notice Changing Signatures? lol, I can't decide which one I like better. XD Ever Tried Linux? :) -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

3 2

[opensuse-buildservice] How to install OBS server from git source
by Leaf John 07 Jun '10

07 Jun '10

Hello Everyone, I git clone the sources from build service git repository, but there seems no install scripts. I osc co the obs-server package from build.opensuse.org, and I notice the installation operations was defined in the spec file. What I'm looking for Is some guide for installing obs from git sources? MY REASON TO DO THIS: I wanna setup a local server behind a http_proxy, and I find a patch provided by "Marcus Hüwe" <suse-tux(a)gmx.de>, this patch seems only suitable for the newest version in build service git repository. Regards, Leaf -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

3 2

[opensuse-buildservice] KDE 4.4.4 actually necessary?
by Mathias Homann 07 Jun '10

07 Jun '10

Hey, Is anyone building KDE 4.4.4 for 11.2 on OBS? ...on second thought, after a look at the changelog, is KDE 4.4.4 actually worth the effort (if you are already running 4.4.3)? bye, MH -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-buildservice+help(a)opensuse.org

1 0