June 2021 - openSUSE Build Service - openSUSE Mailing Lists

OSCP server for download.opensuse.org down?
by Philipp Wagner 09 Jun '21

09 Jun '21

Hi, Could it be that the OSCP (SSL cert revocation) server for download.opensuse.org is down? apt, by default, requires OSCP responses and fails to install otherwise (in contrast to browsers, for example), making the repository unavailable for me. This started this morning (Europe): Apt error message: Err:9 https://download.opensuse.org/repositories/home:/phiwag:/edatools/xUbuntu_1… Release Certificate verification failed: The certificate is NOT trusted. The received OCSP status response is invalid. Could not handshake: Error in the certificate verification. [IP: 195.135.221.134 443] Curl agrees with apt (note the "Invalid OCSP response status: trylater"): ❯ curl --cert-status -sLO --verbose https://download.opensuse.org/repositories/home:/phiwag:/edatools/xUbuntu_1… * Trying 195.135.221.134:443... * Connected to download.opensuse.org (195.135.221.134) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 } [5 bytes data] * TLSv1.3 (OUT), TLS handshake, Client hello (1): } [512 bytes data] * TLSv1.3 (IN), TLS handshake, Server hello (2): { [122 bytes data] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): { [19 bytes data] * TLSv1.3 (IN), TLS handshake, Certificate (11): { [2744 bytes data] * TLSv1.3 (IN), TLS handshake, CERT verify (15): { [520 bytes data] * TLSv1.3 (IN), TLS handshake, Finished (20): { [52 bytes data] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): } [1 bytes data] * TLSv1.3 (OUT), TLS handshake, Finished (20): } [52 bytes data] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN, server accepted to use h2 * Server certificate: * subject: CN=opensuse.org * start date: Apr 27 00:52:15 2021 GMT * expire date: Jul 26 00:52:15 2021 GMT * subjectAltName: host "download.opensuse.org" matched cert's "*.opensuse.org" * issuer: C=US; O=Let's Encrypt; CN=R3 * SSL certificate verify ok. * Invalid OCSP response status: trylater (3) * Closing connection 0 } [5 bytes data] * TLSv1.3 (OUT), TLS alert, close notify (256): } [2 bytes data] What's the best way to inform someone who can fix this? Thanks! Philipp

1 1

Re: exclude paths in _service file broken
by Frank Schreiner 09 Jun '21

09 Jun '21

Am Dienstag, dem 08.06.2021 um 14:56 +0200 schrieb Olaf Hering: > Am Tue, 08 Jun 2021 14:35:02 +0200 > schrieb Frank Schreiner <fschreiner(a)suse.de>: > > > Do you have an example for me? > > I guess server:mail/imapsync is broken, unless 'osc service lr' runs on > 15.1. I see the excluded file ChangeLog in *.obscpio. suggested fix: https://github.com/openSUSE/obs-service-tar_scm/pull/414 but I want to improve test before I merge - test it - feedback welcome > > Apparently tar_scm still works. > Yep - different implementation > Olaf

1 0

Leap 15.3 as DoD repo gives "The repository setup is broken, build or publish not possible"
by Till Dörges 08 Jun '21

08 Jun '21

Hello all, since the release of 15.3 is near I'd like to test it on our internal OBS (2.10). I created a new project with a download on demand repository like this --- snip --- <project name="openSUSE.org:Leap:15.3"> <title>openSUSE Leap 15.3 OSS (DoD)</title> <description>dod</description> <person userid="x" role="maintainer"/> <repository name="standard"> <download arch="x86_64" url="http://download.opensuse.org/distribution/leap/15.3/repo/oss/" repotype="rpmmd"/> <arch>x86_64</arch> </repository> </project> --- snap --- I also copied the project configuration from api.opensuse.org/openSUSE:Leap:15.3. But when I try to use my new repo all I get in the webgui is a red warning sign and the message The repository setup is broken, build or publish not possible Looking into /srv/obs/log/dodup.log only gives me --- snip --- obs:/srv/obs/log # grep 15.3 dodup.log 2021-05-10 00:37:34: [1622] checking openSUSE.org:Leap:15.3/standard/x86_64... updating metadata for rpmmd repo at http://download.opensuse.org/distribution/leap/15.3/repo/oss/ 2021-05-10 00:44:34: [1622] checking PRESENSE/openSUSE_Leap_15.3/x86_64... updating metadata for rpmmd repo at http://download.opensuse.org/distribution/leap/15.3/repo/oss/ 2021-05-10 00:49:57: [1622] checking openSUSE.org:Leap:15.3/standard/x86_64... updating metadata for rpmmd repo at http://download.opensuse.org/distribution/leap/15.3/repo/oss/ --- snap --- The same worked perfectly for openSUSE Leap 15.*2*. Has anything changed or how do I proceed to pinpoint the error? Thanks and regards -- Till -- Dipl.-Inform. Till Dörges doerges(a)pre-sense.de PRESENSE Technologies GmbH Nagelsweg 41, D-20097 HH Geschäftsführer/Managing Directors AG Hamburg, HRB 107844 Till Dörges, Jürgen Sander USt-IdNr.: DE263765024

2 3

download pkg directly from UI - not working
by Renato _ 07 Jun '21

07 Jun '21

Hey Everyone . We have on-prem OBS installation 2.10 . and All is working perfectly fine. There is something that bothers me. From the interface, we can't download the packages that we/someone built. When we build a package, the pkg replicates process on our NFS server works. no problem at this level. This is only from the UI. i.e.: https://obs.internet.com/package/binary/download/home:jack/pkg_nagios-0.77/… when I curl here the apache logs : node1:/var/log/apache2 # tail -f ssl_request_log [04/Jun/2021:09:13:45 +0000] 10.x.y.z TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "GET /package/binary/download/home:jack/pkg_nagios-0.77/xUbuntu_20.04/x86_64/nagios-config_0.77_amd64.deb HTTP/1.1" - "-" "curl/7.64.1" if someone can point me to where the configuration takes place. (I'm not very familiar with Apache. 😞 ) Thank you very much. -r # cat /etc/issue Welcome to Open Build Service(OBS) Appliance 2.10.1 based on openSUSE Leap 15.1 # httpd -V Server version: Apache/2.4.33 (Linux/SUSE) Server built: 2020-02-25 09:51:10.000000000 +0000 Server's Module Magic Number: 20120211:76 Server loaded: APR 1.6.3, APR-UTIL 1.6.1 Compiled using: APR 1.6.3, APR-UTIL 1.6.1 Architecture: 64-bit Server MPM: prefork threaded: no forked: yes (variable process count) Server compiled with.... -D APR_HAS_SENDFILE -D APR_HAS_MMAP -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled) -D APR_USE_PROC_PTHREAD_SERIALIZE -D APR_USE_PTHREAD_SERIALIZE -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT -D APR_HAS_OTHER_CHILD -D AP_HAVE_RELIABLE_PIPED_LOGS -D DYNAMIC_MODULE_LIMIT=256 -D HTTPD_ROOT="/srv/www" -D SUEXEC_BIN="/usr/sbin/suexec" -D DEFAULT_PIDLOG="/run/httpd.pid" -D DEFAULT_SCOREBOARD="logs/apache_runtime_status" -D DEFAULT_ERRORLOG="/var/log/apache2/error_log" -D AP_TYPES_CONFIG_FILE="/etc/apache2/mime.types" -D SERVER_CONFIG_FILE="/etc/apache2/httpd.conf"

2 1

/var/cache/obs/worker/root_1/.pkgs/liblua5_4-5.rpm: Input/output error
by Andreas Schwab 07 Jun '21

07 Jun '21

Looks like clould115 has a broken disk. Andreas. -- Andreas Schwab, schwab(a)linux-m68k.org GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1 "And now for something completely different."

1 0

/usr/sbin/lsprop conflicts on openSUSE:Factory:PowerPC
by Marcus Schäfer 04 Jun '21

04 Jun '21

Hi, since a few days the integration image test builds for Power on Tumbleweed fails in the early phase of the build worker install process: ... [ 68s] [318/325] cumulate python3-dnf-4.7.0-1.1 [ 68s] [319/325] cumulate dnf-4.7.0-1.1 [ 68s] [320/325] cumulate kiwi-systemdeps-core-9.23.34-1.2 [ 68s] [321/325] cumulate kiwi-systemdeps-bootloaders-9.23.34-1.2 [ 68s] [322/325] cumulate python3-kiwi-9.23.34-1.2 [ 68s] [323/325] cumulate kiwi-systemdeps-filesystems-9.23.34-1.2 [ 68s] [324/325] cumulate kiwi-systemdeps-iso-media-9.23.34-1.2 [ 68s] [325/325] cumulate kiwi-systemdeps-disk-images-9.23.34-1.2 [ 68s] now installing cumulated packages [ 68s] Preparing... ######################################## [ 68s] file /usr/sbin/lsprop conflicts between attempted installs of powerpc-utils-1.3.8-8.2.ppc64le and powerpc-utils-1.3.8-8.2.ppc64le [ 69s] exit ... Does somebody have an idea how this type of conflict happened ? For details, here is the project build: https://build.opensuse.org/project/show/Virtualization:Appliances:Images:Te… Thanks Regards, Marcus -- Public Key available via: https://keybase.io/marcus_schaefer/key.asc keybase search marcus_schaefer ------------------------------------------------------- Marcus Schäfer (Res. & Dev.) SUSE Software Solutions Germany GmbH Tel: 0911-740 53 0 Maxfeldstrasse 5 FAX: 0911-740 53 479 D-90409 Nürnberg HRB: 21284 (AG Nürnberg) Germany GF: Felix Imendörffer, Jane Smithard, Graham Norton http://www.suse.de -------------------------------------------------------

2 2

Bad /lib/modules/5.12.4-2-default/build link cause module to failed to build
by Michael Pujos 04 Jun '21

04 Jun '21

Hi, I maintain a kernel module that recently failed to build on Tumbleweed due to /lib/modules/5.12.4-2-default/build link being incorrect: 'osc build' error output: [ 21s] /usr/bin/make -j1 -C /lib/modules/5.12.4-2-default/build M=/home/abuild/rpmbuild/BUILD/CoreFreq modules [ 21s] make[1]: warning: -j1 forced in submake: resetting jobserver mode. [ 21s] make[1]: *** /lib/modules/5.12.4-2-default/build: No such file or directory. Stop. #ls -l /lib/modules/5.12.4-2-default/build abuild@p72:~> ls -l /lib/modules/5.12.4-2-default/build lrwxrwxrwx 1 root root 50 May 28 22:19 /lib/modules/5.12.4-2-default/build -> ../../../usr/src/linux-5.12.4-2-obj/x86_64/default Dereferencing the link: /usr/bin/make -j1 -C /lib/modules/5.12.4-2-default/build M=/home/abuild/rpmbuild/BUILD/CoreFreq modules [ 63s] make[1]: warning: -j1 forced in submake: resetting jobserver mode. [ 63s] make[1]: *** /lib/modules/5.12.4-2-default/build: No such file or directory. Stop. The correct target of the link should be../../../../usr/src/linux-5.12.4-2-obj/x86_64/default, (adding an extra ../) Is it a know issue and is there a workaround ?

2 3

password problem
by Peter Czanik 04 Jun '21

04 Jun '21

Hi, One of my friends (not on the list) forgot his password for OBS. He tried to reset it, but got an error message: Error sending token: (452, '4.3.1 Insufficient system storage', 'Password Reset Service <noreply(a)suse.de>') " Could you check what's wrong? Have a nice weekend, Peter

1 0

BEWARE: OBS may allow source change after review
by Ludwig Nussel 02 Jun '21

02 Jun '21

Hi, tl;dr if you rely on package reviews for your development process in OBS make sure requests have a revision. Only osc shows the information you are looking for. Turns out submit request in OBS do not necessarily refer to a specific revision in the originating package. Means the sources can change after a review passed. Unfortunately changing the sources does not reset reviews and reviews do not record the revision they were done for. That obviously defeats the purpose of source reviews. Accepting a request without revision may therefore lead to accepting something different from what was reviewed (resp staged). AFAIK this feature has been in OBS since the very beginning, it's just well hidden as the official interfaces osc and the webui do add a revision when creating requests. There is no way to turn that off either. Also tools such as bots that use osc as python module automatically generate submit request with revision. This is not because the server enforces it but because the client code does it. So anyone who wants to fool reviewers just has to use a custom client. According to the OBS team this hidden behavior is actually considered a feature. The security team doesn't treat it as security issue as it's kind of documented¹, even though osc doesn't behave in the documented way. There are plans to add a special attribute to disallow unversioned requests per project². IMHO a global setting to require revisions by default with the option for exceptions would have been more sensible. Anyway, apparently the fix needs some time to ripe still. Meanwhile the factory-auto bot was enhanced to decline unversioned requests to Factory (thanks Fabian). If you are using reviews in eg your devel project or run your own OBS you need to create your own bot or watch out manually. The webui does not seem to display any revision at all, so not helpful. In osc it looks like this: Request: #12345 submit: foo:bar/baz@42 -> blah Absence of the @number means no revision. cu Ludwig [1] https://openbuildservice.org/help/manuals/obs-user-guide/cha.obs.request_an… [2] https://github.com/openSUSE/open-build-service/pull/10992 -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer HRB 36809 (AG Nürnberg)

5 5

New feature: download on demand for container registries
by Michael Schroeder 01 Jun '21

01 Jun '21

Hi buildservice enthusiasts, we implemented a new feature in the build service: it is not possible to configure container registries as download on demand repositories. We already did that in out instance for two registries: registry.suse.com: available as project "SUSE:Registry" repository "standard" registry-1.docker.io (the official docker registry): available as project "Docker:Registry" repository "standard" To make use of them, you need to add a corresponding entry to your project path entry. (Do not make this the last entry, as this entry is "path expanded" and provides the packages of the base system. It's probably best to always put it first.) If OBS sees such a download on demand registry in the path, it will collect all of the needed container references and transmit them to the download on demand update daemon. This daemon will then periodically check if a new version is available, just like with a normal download on demand repository. This approach currently two limitations you should know: 1) Only the scheduler does this collection. This means that not yet requested containers will not work in "osc build". 2) Collecting currently does not work for remote OBS instances, e.g. you cannot get not yet requested containers in IBS via the OBS interconnect. (Both limitations may get lifted in the future.) Enjoy, Michael. -- Michael Schroeder SUSE Software Solutions Germany GmbH mls(a)suse.de GF: Felix Imendoerffer HRB 36809, AG Nuernberg main(_){while(_=~getchar())putchar(~_-1/(~(_|32)/13*2-11)*13);}

1 0