August 2018 - Heroes - openSUSE Mailing Lists

[heroes] api for status.opensuse.org?
by Ludwig Nussel 30 Aug '18

30 Aug '18

Hi, Looking at the upstream cachet documentation there seems to be api support to automate updating the status of services. What needs to be done to get a token there and hook up services? cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

4 6

[heroes] paste.opensuse.org
by Knurpht-openSUSE 28 Aug '18

28 Aug '18

Hi, Could you please have a look at, or contact the right persons to look at paste.opensuse.org ? We're using it to let forums users post output etc, but the page only shows 'Disallowed Key Characters'. -- Gertjan Lettink a.k.a. Knurpht openSUSE Board Member openSUSE Forums Team -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

4 4

[heroes] mirrordb3 ?
by Per Jessen 08 Aug '18

08 Aug '18

I'm getting some weird results when trying to initiate a mirror scan for mirror.umd.edu : # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: /update/leap/*-test Completed in 2 seconds # mb scan mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: /SL-OSS-factory-debug/ Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: update/openSUSE-stable/repodata Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: update/openSUSE-stable/src Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: distribution/openSUSE-stable/iso Completed in 2 seconds # mb scan -e mirror.umd.edu You specified some disabled mirror_ids, use -f to scan them all. __DIE__: (=> =>) serverid not found: update/openSUSE-current/nosrc Completed in 2 seconds Those 'serverid's are weird, any chance we have some corrupted data? -- Per Jessen, Zürich (20.8°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 0

[heroes] Proposal: Use Æ-DIR instead of FreeIPA
by Michael Ströder 07 Aug '18

07 Aug '18

HI! Watching the heroes talk videos at OSC I realized that your FreeIPA installation still runs on Fedora. Hmm... TL;DR: This is a proposal to replace FreeIPA with Æ-DIR (augmented by PowerDNS with LDAP back-end). I know that you're quite happy with your FreeIPA setup and thus this proposal likely seems rather disruptive. Be assured that I won't be upset if you just consider this to be a too crazy to even think about it. ldapwhoami: I'm a (open)SUSE user since 20 years or so. Because I like to stay near upstream code I'm running my own stuff with Tumbleweed and update openSUSE packages here and there. I work with OpenLDAP since quite a while. First of all: Æ-DIR is not a hobby project. It's seriously used. I'm committed to fix every bug in there ASAP. Æ-DIR is an integrated solution for all kinds of logins based on pure OpenLDAP. It differs from FreeIPA because its design strictly follows need to know and least privilege principles. Furthermore it allows to have fine-grained delegation of data maintenance. There are some introductive presentations available each with different focus (despite the German web page, some talks are in English): https://www.stroeder.com/publications.html#lectures I won't repeat the web site here, so please glance over it: https://www.ae-dir.com/ I've already talked to Christian about it and he said that you're using the DNS integration of FreeIPA. Well, Æ-DIR itself does not provide such a direct integration, but I'm running a setup based on PowerDNS with LDAP back-end myself. The authentication and authorization is integrated with Æ-DIR as shortly described here: https://www.ae-dir.com/apps.html#slapd-ldap (Note that as of PowerDNS 4.0+ LDAP backend is fully supported again.) Æ-DIR has integrated 2-factor authentication based on OATH-LDAP which allows to enable OATH-based MFA with e.g. password and Yubikey for every simple LDAP enabled application. For NSS and PAM you can use the usual suspects like sssd and nss-pam-ldapd. Note that every integrated system, no exception(!), needs a aeHost or aeService entry with password to get appropriate read access to Æ-DIR. This can be a challenge if you're integrating lots of systems. So this one of the reasons why I've developed a custom component for Æ-DIR, called aehostd: https://www.ae-dir.com/aehostd.html Æ-DIR is installed with the help of an ansible role. I know that you use SaltStack. IMHO this is not an issue because the ansible role stays away from base configuration of the OS. So you can use your normal salt states for base setup and after that play this ansible role. In opposite to FreeIPA Æ-DIR deliberately does not support Kerberos. For SSH logins I strongly prefer temporary OpenSSH certs (not X.509) and for web-based logins there are already too many decent WebSSO systems out there. BTW: I've read your "openSUSE:Infrastructure policy" page. AppArmor is supported out-of-the-box. So here's the deal how to support openSUSE project: 1. You provide installation prequisites. (see https://www.ae-dir.com/install.html#prereq) 2. I will install Æ-DIR providers and consumers with initial data. 3. You play with it. I will help migrating systems to use Æ-DIR. 4. You provide a couple of PowerDNS servers which I will setup with LDAP backend. 5. I will assist developing a SaltStack state for client integration (up to now I only have ansible roles) Well, that's all for now. Let me know if you have further questions. Looking forward to your feedback. Ciao, Michael.

3 3

[heroes] publishing of distros from OBS to pontifex
by Ludwig Nussel 07 Aug '18

07 Aug '18

Hi, As most of you know, a reoccurring annoyance related to publishing the distro is the way we move the isos and repo from OBS to download.o.o (aka pontifex). In contrast to regular build service projects, products like TW and Leap are not pushed directly to pontfex. There's some script running on the obs backend that mangles the results, then pushes to pontifex upload-factory, upload-15.0 etc That script needs to match file names. So any change in product naming, new medias, new releases etc require modifying it. On pontifex files end up below /srv/ftp-stage. Again some script is running there to add the -Current symlinks and create the changes file. To simplify that process I'd like to suggest to drop the script on obs backend side and do all potentially necessary mangling on pontifex. For that we should not push to /srv/ftp-stage directly as mirrors pull from that right away. Any suggestions for a location? I guess /srv/bs is used for something else there already. What kind of information is needed for OBS to drop the script? Just a name for an rsync module on pontifex side? cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 1

[heroes] out of space mirrordb ?
by Per Jessen 06 Aug '18

06 Aug '18

# mb scan -e quantum-mirror.hu Sun Aug 5 10:10:02 2018 quantum-mirror.hu: starting Sun Aug 5 10:10:50 2018 quantum-mirror.hu: total files before scan: 0 __DIE__: (/usr/bin/scanner 315 main::rsync_readdir => /usr/bin/scanner 1095 (eval) => /usr/bin/scanner 1096 main::rsync_get_filelist) __DIE__: (/usr/bin/scanner 701 main::http_readdir => /usr/bin/scanner 701 main::http_readdir => /usr/bin/scanner 710 main::save_file) quantum-mirror.hu: ERROR: could not extend file "base/538229/30587226.32": wrote only 4096 of 8192 bytes at block 4207909 HINT: Check free disk space. CONTEXT: SQL statement "update filearr set mirrors = arr where id = fileid" PL/pgSQL function mirr_add_bypath(integer,text) line 21 at SQL statement at /usr/bin/scanner line 918. Completed in 2.0 minutes -- Per Jessen, Zürich (28.4°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 2

[heroes] Reminder: Heroes meeting next tuesday
by Christian Boltz 05 Aug '18

05 Aug '18

Hello, the next Heroes IRC meeting will be on Tuesday (2018-08-07) at 18:00 UTC / 20:00 CEST in the #opensuse-admin IRC channel. The planned topics are on https://progress.opensuse.org/issues/38162 If you have additional topics, please add them. Note that due to the IRC spam attack, currently only registered / logged in users can join #opensuse-admin. If you didn't register your IRC nickname yet, please do so [1] now ;-) Regards, Christian Boltz [1] https://freenode.net/kb/answer/registration -- > good luck, Usually "good luck" is going together with "as I told you before" :) [> Greg KH and Johannes Nohl in opensuse-project] -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

1 0

[heroes] Re: [opensuse-factory] Proposal: Let's move to a more modern platform
by Neal Gompa 02 Aug '18

02 Aug '18

On Thu, Aug 2, 2018 at 3:58 AM Ludwig Nussel <ludwig.nussel(a)suse.de> wrote: > > hellcp(a)opensuse.org wrote: > > W dniu wto, 31 lip 2018 o 19∶42 użytkownik Ronan Chagas <ronisbr(a)gmail.com> napisał: > >> [...] > >> > >> openSUSE has many mailing lists and some are very active. I, as a > >> developer, must follow some to make sure I did not miss an important > >> news. However, IMHO, mailing lists through e-mails are not that good > >> anymore. It is very difficult to search for a message (if you did not > >> archive everything, then you must rely on the on-line database), if > >> you delete a message, reply to that thread is not very > >> straightforward, etc. > > > > [...] For some nicer frontend for mailing list > > look at Fedora's hyperkitty [1], frontend for mailman. That would be a > > way better solution than this. Most importantly, don't cut off common > > Stallman (or Stallman in general) from engaging in ml conversations. > > Obviously the way openSUSE lists are handled is from the last > century. Outright intimidating not only for newcomers to our > community. This hyperkitty looks quite cool, who can make it happen? :-) > I'd be willing to help with such a thing, even though I have little idea how right now. :) -- 真実はいつも一つ！/ Always, there's only one truth! -- To unsubscribe, e-mail: heroes+unsubscribe(a)opensuse.org To contact the owner, e-mail: heroes+owner(a)opensuse.org

2 1