November 2008 - infrastructure - Fedora mailing-lists

Fixing CSRF exploits in Infrastructure
by Toshio Kuratomi 03 Dec '08

03 Dec '08

Greetings all, I've been researching the CSRF exploit and how it affects our web apps recently. The short story is that our code is pretty open to this at the moment. I've written up a proposal for fixing this but it will require a lot of coding so I'd love to have some more eyes on it to make sure I'm not making any stupid mistakes. The proposal is here:: https://fedorahosted.org/fas/wiki/CSRF The ticket for the overall CSRF fixing is here:: https://fedorahosted.org/fedora-infrastructure/ticket/992 I consider fixing this to be a fairly high priority so I'll be starting work on implementing this for a few pkgdb methods very soon. Assuming the technique works we'll need to port every method that can change data in every app to use this. -Toshio

5 22

Patch to fix EPEL dep scripts
by Michael Stahnke 02 Dec '08

02 Dec '08

I think I solved the repo-closure/deps scripts issues. Now it should be back to sending only one email, (instead of 6). Also, there was an indentation issue in the reporting program that was causing the dependencies problems to be cleared. Please test this once before putting in production. I tested the best I could on publictest16 and my home systems, but I didn't have full access to all yum repos anywhere. Additionally, I changed the shell script to reference local copies of yum.conf and rc-report.cfg. I think that is probably ok, but somebody should verify. stahnma

4 8

Change request: SELinux tweaks.
by Luke Macken 01 Dec '08

01 Dec '08

Attached are some patches that will fix many AVC's that are currently happening within our infrastructure. Patch 0010-Fix-our-semanage_fcontext-function-to-work-on-symlin.patch /should/ fix the problem introduced in 41acfbc83c80d12d915a0d6087e841aba2c7e78c that caused restorecon to flip out when trying to apply context to a symlink. The rest should all be fairly straight-forward fixes that involve flipping booleans, setting context, and creating custom policy modules. Apologies for the binary blobs in the diffs :) luke

5 8

DNS changes
by Jon Stanley 30 Nov '08

30 Nov '08

Someone just came into #fedora-admin and noted that the MNAME in our SOA's was incorrect - for every domain, the MNAME was set to be the domain itself, whereas RFC1035 3.3.13 states: MNAME The <domain-name> of the name server that was the original or primary source of data for this zone. Being a DNS guy myself, I've modified every zone to be in compliance by changing the MNAME to be ns1.fedoraproject.org. The patch is below, I'd like some consensus before pushing it. diff --git a/configs/dns/master/fedora.us b/configs/dns/master/fedora.us index 4ff3a54..4e2d296 100644 --- a/configs/dns/master/fedora.us +++ b/configs/dns/master/fedora.us @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedora.us. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007102600 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedorahosted.org b/configs/dns/master/fedorahosted.org index bf3c281..40f9afc 100644 --- a/configs/dns/master/fedorahosted.org +++ b/configs/dns/master/fedorahosted.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedorahosted.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedorahosted.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008030601 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoralinux.com b/configs/dns/master/fedoralinux.com index 65bca06..6af3736 100644 --- a/configs/dns/master/fedoralinux.com +++ b/configs/dns/master/fedoralinux.com @@ -1,5 +1,5 @@ $TTL 86400 -@ IN SOA fedoralinux.com. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). 2007072101 ; Serial diff --git a/configs/dns/master/fedoralinux.net b/configs/dns/master/fedoralinux.net index d19ac15..5865336 100644 --- a/configs/dns/master/fedoralinux.net +++ b/configs/dns/master/fedoralinux.net @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoralinux.net. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoralinux.org b/configs/dns/master/fedoralinux.org index 333fac5..5865336 100644 --- a/configs/dns/master/fedoralinux.org +++ b/configs/dns/master/fedoralinux.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoralinux.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedorapeople.org b/configs/dns/master/fedorapeople.org index c9ff7c3..edb0055 100644 --- a/configs/dns/master/fedorapeople.org +++ b/configs/dns/master/fedorapeople.org @@ -1,6 +1,6 @@ $TTL 3600 -@ IN SOA fedorapeople.org. hostmaster.fedorapeople.org. ( - 2008101301 ; Serial +@ IN SOA ns1.fedoraproject.org. hostmaster.fedorapeople.org. ( + 2008112901 ; Serial 8H ; refresh 2H ; retry 4W ; expire diff --git a/configs/dns/master/fedoraproject.com b/configs/dns/master/fedoraproject.com index f92146c..5865336 100644 --- a/configs/dns/master/fedoraproject.com +++ b/configs/dns/master/fedoraproject.com @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoraproject.com. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoraproject.net b/configs/dns/master/fedoraproject.net index d51cef8..5865336 100644 --- a/configs/dns/master/fedoraproject.net +++ b/configs/dns/master/fedoraproject.net @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoraproject.net. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoraproject.org b/configs/dns/master/fedoraproject.org index 42f6173..58ce69f 100644 --- a/configs/dns/master/fedoraproject.org +++ b/configs/dns/master/fedoraproject.org @@ -1,6 +1,6 @@ $TTL 3600 -@ IN SOA fedoraproject.org. hostmaster.fedoraproject.org. ( - 2008112601 ; Serial +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( + 2008112901 ; Serial 8H ; refresh 2H ; retry 4W ; expire diff --git a/configs/dns/master/fedoraproject.org.uk b/configs/dns/master/fedoraproject.org.uk index eab98af..5865336 100644 --- a/configs/dns/master/fedoraproject.org.uk +++ b/configs/dns/master/fedoraproject.org.uk @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoraproject.org.uk. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/k12linux.org b/configs/dns/master/k12linux.org index 75ef0b7..9c92383 100644 --- a/configs/dns/master/k12linux.org +++ b/configs/dns/master/k12linux.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA k12linux.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008110801 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/nspluginwrapper.org b/configs/dns/master/nspluginwrapper.org index f56c9e9..73db73c 100644 --- a/configs/dns/master/nspluginwrapper.org +++ b/configs/dns/master/nspluginwrapper.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA nspluginwrapper.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008101301 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/smolts.org b/configs/dns/master/smolts.org index 88cc971..91189e9 100644 --- a/configs/dns/master/smolts.org +++ b/configs/dns/master/smolts.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA smolts.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008100601 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/vpn.fedoraproject.org b/configs/dns/master/vpn.fedoraproject.org index a129209..303d0bd 100644 --- a/configs/dns/master/vpn.fedoraproject.org +++ b/configs/dns/master/vpn.fedoraproject.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA vpn.fedoraproject.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008110501 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire [jstanley@puppet1 master]$ vim fedoralinux.com [jstanley@puppet1 master]$ git diff diff --git a/configs/dns/master/fedora.us b/configs/dns/master/fedora.us index 4ff3a54..4e2d296 100644 --- a/configs/dns/master/fedora.us +++ b/configs/dns/master/fedora.us @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedora.us. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007102600 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedorahosted.org b/configs/dns/master/fedorahosted.org index bf3c281..40f9afc 100644 --- a/configs/dns/master/fedorahosted.org +++ b/configs/dns/master/fedorahosted.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedorahosted.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedorahosted.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008030601 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoralinux.com b/configs/dns/master/fedoralinux.com index 65bca06..5865336 100644 --- a/configs/dns/master/fedoralinux.com +++ b/configs/dns/master/fedoralinux.com @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoralinux.com. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoralinux.net b/configs/dns/master/fedoralinux.net index d19ac15..5865336 100644 --- a/configs/dns/master/fedoralinux.net +++ b/configs/dns/master/fedoralinux.net @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoralinux.net. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoralinux.org b/configs/dns/master/fedoralinux.org index 333fac5..5865336 100644 --- a/configs/dns/master/fedoralinux.org +++ b/configs/dns/master/fedoralinux.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoralinux.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedorapeople.org b/configs/dns/master/fedorapeople.org index c9ff7c3..edb0055 100644 --- a/configs/dns/master/fedorapeople.org +++ b/configs/dns/master/fedorapeople.org @@ -1,6 +1,6 @@ $TTL 3600 -@ IN SOA fedorapeople.org. hostmaster.fedorapeople.org. ( - 2008101301 ; Serial +@ IN SOA ns1.fedoraproject.org. hostmaster.fedorapeople.org. ( + 2008112901 ; Serial 8H ; refresh 2H ; retry 4W ; expire diff --git a/configs/dns/master/fedoraproject.com b/configs/dns/master/fedoraproject.com index f92146c..5865336 100644 --- a/configs/dns/master/fedoraproject.com +++ b/configs/dns/master/fedoraproject.com @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoraproject.com. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoraproject.net b/configs/dns/master/fedoraproject.net index d51cef8..5865336 100644 --- a/configs/dns/master/fedoraproject.net +++ b/configs/dns/master/fedoraproject.net @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoraproject.net. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/fedoraproject.org b/configs/dns/master/fedoraproject.org index 42f6173..58ce69f 100644 --- a/configs/dns/master/fedoraproject.org +++ b/configs/dns/master/fedoraproject.org @@ -1,6 +1,6 @@ $TTL 3600 -@ IN SOA fedoraproject.org. hostmaster.fedoraproject.org. ( - 2008112601 ; Serial +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( + 2008112901 ; Serial 8H ; refresh 2H ; retry 4W ; expire diff --git a/configs/dns/master/fedoraproject.org.uk b/configs/dns/master/fedoraproject.org.uk index eab98af..5865336 100644 --- a/configs/dns/master/fedoraproject.org.uk +++ b/configs/dns/master/fedoraproject.org.uk @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA fedoraproject.org.uk. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2007072101 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/k12linux.org b/configs/dns/master/k12linux.org index 75ef0b7..9c92383 100644 --- a/configs/dns/master/k12linux.org +++ b/configs/dns/master/k12linux.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA k12linux.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008110801 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/nspluginwrapper.org b/configs/dns/master/nspluginwrapper.org index f56c9e9..73db73c 100644 --- a/configs/dns/master/nspluginwrapper.org +++ b/configs/dns/master/nspluginwrapper.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA nspluginwrapper.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008101301 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/smolts.org b/configs/dns/master/smolts.org index 88cc971..91189e9 100644 --- a/configs/dns/master/smolts.org +++ b/configs/dns/master/smolts.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA smolts.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008100601 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire diff --git a/configs/dns/master/vpn.fedoraproject.org b/configs/dns/master/vpn.fedoraproject.org index a129209..303d0bd 100644 --- a/configs/dns/master/vpn.fedoraproject.org +++ b/configs/dns/master/vpn.fedoraproject.org @@ -1,8 +1,8 @@ $TTL 86400 -@ IN SOA vpn.fedoraproject.org. hostmaster.fedoraproject.org. ( +@ IN SOA ns1.fedoraproject.org. hostmaster.fedoraproject.org. ( ; Make SURE to update the serial # when changes are made. Format is YYYYMMDDNN ; (NN is just a counter to handle multiple changes in one day). - 2008110501 ; Serial + 2008112901 ; Serial 28800 ; Refresh 14400 ; Retry 1000000 ; Expire

3 3

meeting tomorrow
by Mike McGrath 27 Nov '08

27 Nov '08

I won't be able to attend the meeting tomorrow. Many of us in the US will be celebrating thanksgiving. I certainly do not want to stop others from hosting the meeting. If you're around and want to hold a meeting, please do. -Mike

2 1

F-10 : Other Planetary Systems
by Chitlesh GOORAH 26 Nov '08

26 Nov '08

Hello there, While astronomers took first ever pictures of other planetary systems [1] last month, the fedora community was building its own planetary systems. Some say one planet isn't enough, other strive to enlarge their own planet. While F-10 Cambridge elevates the performance barrier and much more, other planetary spins have been geared to specific applications. Ladies and Gentlemen, the following spins have also been released together with Fedora 10 Cambridge release to ensure that you will be the most productive in your specific work environment with opensource software: - Fedora Electronic Lab - Fedora KDE - Fedora Edu-Math - Fedora XFCE - Fedora AOS - Fedora Developer - Fedora BrOffice For more details, please visit https://fedoraproject.org/wiki/SIGs/Spins/10 All these official spins can be downloaded at http://spins.fedoraproject.org/ for both i386 and x86_64 architectures as LiveCDs or LiveDVDs. [1]: http://gizmodo.com/5086678/astronomers-take-first-ever-pics-of-other-planet… Kind regards, Chitlesh GOORAH

1 0

Outage Notification - Fedorapeople.org 2008-11-30 06:00 UTC -> 2008-11-30 18:00 UTC
by Seth Vidal 26 Nov '08

26 Nov '08

Outage Notification - 2008-11-30 06:00 UTC There will be an outage starting at 2008-11-30 06:00 UTC, which will last approximately 12 hours. To convert UTC to your local time, take a look at http://fedoraproject.org/wiki/Infrastructure/UTCHowto or run: date -d '2008-11-30 06:00 UTC' Affected Services: fedorapeople.org planet.fedoraproject.org Reason for Outage: The building where the system is housed is losing power for 12 hours for renovation work Contact Information: Please join #fedora-admin in irc.freenode.net or respond to this email to track the status of this outage. -sv

1 0

Re: Errors while syncing bugzilla with the PackageDB
by Toshio Kuratomi 26 Nov '08

26 Nov '08

accounts(a)fedoraproject.org wrote: > The following errors were encountered while updating bugzilla with information > from the Package Database. Please have the problems taken care of: > > (106, 'Sorry, entering a bug into the\n product Fedora OLPC has been disabled.') I'm looking into special casing 'Fedora OLPC' to not attempt to sync to bugzilla now. Talking to OLPC people about whether we need to disable bugzilla acls in the pkgdb for OLPC and just manage cvs for them or if re-enabling the bugzilla component is what they want to do. For reference, the bugzilla ticket for this change was here: https://bugzilla.redhat.com/show_bug.cgi?id=438171 -Toshio

1 0

I am Linux Fresher but at the sametime Student of RHCE
by Phadke Omkar Ashok 26 Nov '08

26 Nov '08

Basic Commands in Linux and the following things Filesystem Structure Basic Partition Structure Types of Installation & Kickstart Booting Sequence User Administration & SUDO & PAM File Permissions & Special Permissions [Setuid,Setgid,Stickybit] Umask & ACL Hardware Management Kernel Compilation Disk Management [creating,deleting] Disk quota Management Process Management RPM & Tarball Management [Package Mangement], YUM XWindows Management , VNC RAID & LVM Management Setting up one or many ip Address to Lan card Setting up Router Setting up DHCP Server NFS Server Administration FTP Server Administration SAMBA Server Administration DNS Server Administration Apache Server Administration Sendmail Server Administration Squid Proxy Server Administration NIS Server Administration Hope I get a positive response and get a chance to work with Fedora Team (Thnks GOD)... -- Phadke Omkar Ashok omkarphadke(a)fastmail.in -- http://www.fastmail.fm - mmm... Fastmail...

2 1

Ian is vacationing
by Ian Weller 26 Nov '08

26 Nov '08

So I'm pretty sure I'm like others, but I'll be on vacation for about a week with my family on Thanksgiving. If my packages need fixed, go ahead and fix 'em ;) -- Ian Weller <ianweller(a)gmail.com> http://ianweller.org GnuPG fingerprint: E51E 0517 7A92 70A2 4226 B050 87ED 7C97 EFA8 4A36 "Technology is a word that describes something that doesn't work yet." ~ Douglas Adams

1 0

[Fwd: Fedora wiki login issues]
by Ignacio Vazquez-Abrams 26 Nov '08

26 Nov '08

For your consideration. -------- Forwarded Message -------- > From: Tim Abbott <tabbott(a)MIT.EDU> > To: webmaster(a)fedoraproject.org > Subject: Fedora wiki login issues > Date: Tue, 25 Nov 2008 12:27:18 -0500 (EST) > > Hello, > > I just registered for an account (username: tabbott) with the Fedora > Account System, but the Fedora Wiki refuses to let me login, giving "Login > error: Incorrect password entered. Please try again.". I am quite > confident that I am providing the same password to the Fedora Wiki and the > Fedora Account System (with which I have tested logging out and in again); > is there some sort of delay for information to propagate to the Fedora > Wiki? > > -Tim Abbott -- Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>

2 1

Re: Fixing CSRF exploits in Infrastructure
by John (J5) Palmieri 25 Nov '08

25 Nov '08

I've read the document and it is pretty well thought out. A couple of comments - for the JavaScript parts wouldn't that be better to setup as an included file which also pulls in a JS library? Just so people aren't copying and pasting? That way you will also be able to extend the functionality if need be and app developers would have to worry about one line of code instead of 10. As for myfedora this is pretty straight forward as we can use the middleware layer to inject the javascript variables and do the hashing and double authentication. Most of our modification requests will be going over json so a javascript layer would work there too. We can then simply have our proxies pass the hash onto the ProxyClients. It is still a chain of trust where you trust our servers have implemented the protocol correctly and we aren't just hashing the cookie when it has to pass it to the proxy client. The only way to fix the man in the middle trust issue would be to have the client somehow sign the session hash, but even then, the client would have to register a public key on a server you trust. ----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote: > Greetings all, > > I've been researching the CSRF exploit and how it affects our web > apps > recently. The short story is that our code is pretty open to this at > the moment. I've written up a proposal for fixing this but it will > require a lot of coding so I'd love to have some more eyes on it to > make > sure I'm not making any stupid mistakes. > > The proposal is here:: > https://fedorahosted.org/fas/wiki/CSRF > > The ticket for the overall CSRF fixing is here:: > https://fedorahosted.org/fedora-infrastructure/ticket/992 > > I consider fixing this to be a fairly high priority so I'll be > starting > work on implementing this for a few pkgdb methods very soon. > Assuming > the technique works we'll need to port every method that can change > data > in every app to use this. > > -Toshio > > > _______________________________________________ > Fedora-infrastructure-list mailing list > Fedora-infrastructure-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list -- -- John (J5) Palmieri Software Engineer Red Hat, Inc.

2 1

Change request
by Mike McGrath 25 Nov '08

25 Nov '08

I need to add the following: AddType image/svg+xml .svg AddType image/svg+xml .svgz AddEncoding gzip .svgz <FilesMatch \.svgz$> <IfModule mod_gzip.c> mod_gzip_on No </IfModule> </FilesMatch> Into a general config file for our app servers. At present it is in our wiki config. This is causing problems for some of our docs sites that use svg that are not on a machine that are on the wiki. -Mike

4 3

release day change request
by Mike McGrath 25 Nov '08

25 Nov '08

Ugh, well poop. proxy3 was built with the wrong arch and we didn't realize it until today. We've taken it out of rotation. I'd like to: 1) rebuild proxy3 as i686 2) leave it out of rotation unless we need it. can I get 2 +1's? In theory it can add 25% capacity to how many requests we can serve in a given time. We may not need it. -Mike

4 4

proper way to update /var/lib/puppet/application/mirrors/releases.txt
by Jesse Keating 25 Nov '08

25 Nov '08

This looks like it is its own git repo, but apparently you need to be in the sysadmin-web group to edit this. I'm not in the group, so in order for me to manage this we either need to add me to the group (yuck, more groups) or move this to a different ownership set, or something else. Either way a couple things need to be done to the file. 1) removing F10 Preview and Beta 2) adding F10 itself. These will need to be done by the release tomorrow. -- Jesse Keating Fedora -- Freedom² is a feature! identi.ca: http://identi.ca/jkeating

3 3

Congratulations to Nigel Jones
by Mike McGrath 25 Nov '08

25 Nov '08

I'm happy to announce I've just approved Nigel Jones in to the sysadmin-main group. He's the first new member we've had to that group since Ricky Zhou was approved in May earlier this year. For those that don't know sysadmin-main is for our core dedicated admins. It typically takes many months (sometimes years) of commitment to get in to this group. Nigel is on his way to doing a great job with re-inventing our monitoring environment. He's spent a lot of time on many of our bits of infrastructure and regularly puts in many hours a week doing Fedora related tasks. He's a great volunteer and we're happy and lucky to have him on. Nigel is currently based out of Brisbane which makes him the first non-US member to be in sysadmin-main. This is an important change in focus for us and greatly helps the stability/coverage of our environment. Thanks Nigel! -Mike

9 8

Re: Change Request - Update Website Languages
by Nigel Jones 25 Nov '08

25 Nov '08

+1, I find it a bit disappointing that French & Dutch is getting removed, but if we can't help it, we can't help it. Also, I'd point out that the SOP says that standard release procedures don't need to be voted on/announced (unless I misread it) - Nigel ----- Original Message ----- From: "Ricky Zhou" <ricky(a)fedoraproject.org> To: fedora-infrastructure-list(a)redhat.com Sent: Tuesday, November 25, 2008 9:47:19 PM GMT +10:00 Brisbane Subject: Change Request - Update Website Languages Hi, I need to update all of the language.conf files for the final set of languages for the F10 website. This is necessary for the release, so can I get two +1s? The config patch is available at http://ricky.fedorapeople.org/0001-Update-all-website-languages.patch Thanks, Ricky _______________________________________________ Fedora-infrastructure-list mailing list Fedora-infrastructure-list(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list

1 0

Change Request - Update Website Languages
by Ricky Zhou 25 Nov '08

25 Nov '08

Hi, I need to update all of the language.conf files for the final set of languages for the F10 website. This is necessary for the release, so can I get two +1s? The config patch is available at http://ricky.fedorapeople.org/0001-Update-all-website-languages.patch Thanks, Ricky

2 1

Informal survey
by Mike McGrath 25 Nov '08

25 Nov '08

Hey guys, completely voluntary but I thought I'd ask because I'm curious For personal use, how many of you use something like linode or slicehost or an individual provider? If you do use a provider which one is it? For me, I do use one and I use slicehost. -Mike

10 15

Bodhi 10k bug
by Luke Macken 25 Nov '08

25 Nov '08

As some of you may have noticed, the last batch of updates contained 209 updates with the ID of 'FEDORA-2008-10000'. This is is due to a flaw in the way bodhi's PackageUpdate.assign_id() method finds the current update with the highest id. Presently, it does a PackageUpdate.select(..., orderBy=PackageUpdate.q.updateid). Since PackageUpdate.updateid is a unicode column, and due to the fact that u'FEDORA-2008-10000' < u'FEDORA-2008-9999', this started to fail miserably. Attached is a patch that has the assign_id method order the query by the date_pushed DateTimeCol in order to find the highest updateid. However, it seems that SQLObject completely ignore milliseconds: if datetime: def DateTimeConverter(value, db): return "'%04d-%02d-%02d %02d:%02d:%02d'" % ( value.year, value.month, value.day, value.hour, value.minute, value.second) The problem with this is that we must now take into account multiple updates that were pushed at the same second. The "proper" way to fix this is at the model level, and probably to use an integer for the updateid column. I'm in the process of finishing up the SQLAlchemy port, which will properly solve this problem. In the mean time, this hack will not require any database changes. This patch also includes a test case for this 10k bug. [lmacken@x300 bodhi]$ nosetests bodhi/tests/test_model.py:TestPackageUpdate.test_id . ---------------------------------------------------------------------- Ran 1 test in 0.084s OK Once approved and applied, I will push out a fixed package (to releng2 only), fix the existing updates from the last push, and send out an errata containing the new update IDs. +1's ? luke

4 4

Re: An introduction
by Mike McCarthy 24 Nov '08

24 Nov '08

> > Hi all, > > > > My name is Mike and I'm a sysadmin based in the UK. I work mainly with RHEL, TRU64 and AIX systems professionally but > > have a few Fedora boxes at home that I experiment with generally to save me trashing any of the corporate systems :) . > > I moved into administration about 5 years ago from a development background and so feel quite comfortable playing around > > with code and generally scripting too. I started as a C developer and worked with a few flavours of assembly but these > > days mostly lurk around Perl. I understand that Python plays a big part in the Fedora project and so would really like > > to learn a bit more about it. If there is any way I can help and hopefully at the same time pick up a few new skills > > that would be excellent but at the end of the day I'd really just like the chance to contribute something of value to > > the project wherever I can. > > > If you're looking to do more development there's a bunch of open bugs just > asking for patches on https://fedorahosted.org/ specifically in our > package database, bodhi and the accounts system. Great, I'll have a dig through when I can and hopefully get a few bugs squished along the way.

1 0

An introduction
by Mike McCarthy 24 Nov '08

24 Nov '08

Hi all, My name is Mike and I'm a sysadmin based in the UK. I work mainly with RHEL, TRU64 and AIX systems professionally but have a few Fedora boxes at home that I experiment with generally to save me trashing any of the corporate systems :) . I moved into administration about 5 years ago from a development background and so feel quite comfortable playing around with code and generally scripting too. I started as a C developer and worked with a few flavours of assembly but these days mostly lurk around Perl. I understand that Python plays a big part in the Fedora project and so would really like to learn a bit more about it. If there is any way I can help and hopefully at the same time pick up a few new skills that would be excellent but at the end of the day I'd really just like the chance to contribute something of value to the project wherever I can. Hopefully speak to you all soon Mike

2 1

Self Introduction:Balaji
by "G" 24 Nov '08

24 Nov '08

Hi My name is Balaji and i live in chennai which is a city in India. i am a software developer working for a private firm in chennai. I ve been contribtuting to fedora as a member of the bug-triage team, Testing packages from the bodhi repository, the Docs team(garderning and wiki editing) and also as one of the Fedora-Ambassadors for chennai. Though i must also admit honestly that the past few months were so hectic that i couldn't contribute much for fedora other than servicing the DVD requests and acknowledging them. I have again started off my contributions to fedora and on the verge of the Fedora 10 release as well as the planning for F11 release it would be a good time to enter this. I would like to be part of the infrastructure team by testing few stuff like bodhi,koji etc using some virtualization stuff and ofcourse starting to solve trivial bugs in those allied tools as it would help me to learn python more better though i know little bit of python. I am really excited to be part of this team and hope i have a good and challenging time with you all. Cheers, Balaji

2 1

Fwd: [Fedora-sysadmin-list] Web Security
by Dennis Gilmore 24 Nov '08

24 Nov '08

forwarding to the correct list ---------- Forwarded Message ---------- Subject: [Fedora-sysadmin-list] Web Security Date: Friday 21 November 2008 From: "Damian Myerscough" <damian.myerscough(a)gmail.com> To: "Fedora Administration and Infrastructure project" <fedora-sysadmin- list(a)redhat.com> Hello All, I have managed to get a bit of free time to create some simple rules for mod_security which would be suitable for the web servers which we are currently running. I have wrote some generic rules which should be compatible with all the web servers. However, we could write rules which are much stricter for the web applications that are hosted off the web servers. Let me know what people think about the rules that I have attached. Just a note, the final rule should point to maybe a security notice... it would currently just redirect users to fedoraproject.org. -- Regards, Damian Myerscough -------------------------------------------------------

3 2

Change Request [mod_rewrite/wiki]
by Nigel Jones 23 Nov '08

23 Nov '08

When proxy5 got added, the IP didn't get added to Mediawiki which meant MW associated changes by anonymous users got credited to the proxy IP address. ARGH! Last two patches fix it, and the first is just to fix a weird thing in Apache's mod_rewrite. Can I get two amens? (+1s will do) - Nigel

4 3

Change request: Increase the size of audit logs (on bastion)
by Luke Macken 22 Nov '08

22 Nov '08

The attached patch will allow the audit system to utilize 100mb for its logs, as opposed to 20mb. Due to the sheer number of SELinux denials that we're hitting on bastion (which will be resolved after a reboot, and my patches from the previous mail), bastion is only storing 1-2 days worth of audit logs. This patch will only effect bastion, as it is currently the only machine that is configured with 'include prelude::sensor::audisp' luke

3 2

Change request, F10 updates
by Jesse Keating 21 Nov '08

21 Nov '08

In order to push out the first round of Fedora 10 updates, a few changes need to be made in the infrastructure. 1) add the 10 release to fedora-updates-push in puppet 2) Update bodhi with 10 mash configs Can I get a few +1s on this? -- Jesse Keating Fedora -- Freedom² is a feature! identi.ca: http://identi.ca/jkeating

4 3

Introduction
by Satyajit Ranjeev 21 Nov '08

21 Nov '08

Hi, I am Satyajit Ranjeev working as a systems administrator for a International school in Bangkok, Thailand. I am also currently creating a web application for the school based on Perl, MySQL, Apache running on fedora 8. I am a RHCE also and have been an ardent fan and user of Linux for four years. I have experience in scripting too. I am also an Ambassador: http://fedoraproject.org/wiki/User:Satyajit I would really love to contribute in some way and would be glad if someone could guide me where to start with. Satyajit Ranjeev http://satyajitranjeev.wordpress.com

1 0

[Fwd: User signup not working?]
by Ignacio Vazquez-Abrams 20 Nov '08

20 Nov '08

For your consideration. -------- Forwarded Message -------- > From: Rick Noelle <Rick.Noelle(a)definition6.com> > To: webmaster(a)fedoraproject.org > Subject: User signup not working? > Date: Thu, 20 Nov 2008 12:19:25 -0500 > > Hi, > > > > I’m trying to sign up for a fedora login but I did not receive my > initial email with my password. I tried the “Forgot Password” link as > well and it reported that a password reminder has been sent but I did > not receive it. I’ve tested the recipient email address and made sure > spam filters are disabled, etc. but not having much luck. The login I > created is “jdictionary” and the email address is > rick(a)jdictionary.com. > > > > Thanks a lot, > > Rick Noelle > > > > -- Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>

2 1

Meeting in 30 minutes
by Mike McGrath 20 Nov '08

20 Nov '08

Just a reminder we have a meeting in 30 minutes at 20:00 UTC. This is another F10 release meeting for us so please to be attending! -Mike

1 0

Introduction
by Nils Philippsen 20 Nov '08

20 Nov '08

Hi there, "I'm the new one", as they say. I've been messing with RHL, RHEL and Fedora since RHL 4.0, nowadays as a developer, formerly as consultant, support person and sysadmin (paid gigs that is, unpaid it's still a mix of all these). I'm experienced in software and database design and have used and still use among others C, Python, Perl, SQL for that. I've also done web programming with PHP (which I'd rather forget) and nowadays TurboGears and Co. My motivation to show up here is that until now I've only caused you people work and I thought that I could help out with things for a change; I thought about the web, hosted, devel/tools (what's the difference?) FIGs. I can't say how much I can spare for Fedora Infrastructure work and I'll probably only occasionally be able to join the meeting (which is a tad late in my timezone), but I should still be able to work on the odd ticket or two. My Fedora moniker as well as IRC nickname on Freenode is "nphilipp". Nils -- Nils Philippsen "Those who would give up Essential Liberty to purchase Red Hat a little Temporary Safety, deserve neither Liberty nils(a)redhat.com nor Safety." -- Benjamin Franklin, 1759 PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011

2 1

Re: Request for test data based off of obfuscated live data
by John (J5) Palmieri 19 Nov '08

19 Nov '08

----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote: > John Palmieri wrote: > > ----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote: > > > A note on the code drop, by requiring the author to modify a spec > file if needed in order to deploy their changes into their environment > (revision numbers would be automated) patches would include spec file > changes instead of the maintainer having to sync by hand. This would > also make sure the build files are kept up to date as the author would > have to make their changes work in an RPM environment just to test > them as opposed to just installing from their source tree which often > leads to annoying bugs (like missing files in a distributed tarball). > Also by making it easy to generate a patch and submit it to trac we > will get more consistent formatted patches (such as using the VCS's > patch format) and most likely more people getting involved as the > overhead shrinks a bit (how many people want to go to individual trac > instances to file a patch?). > > > I'm not sure that this is a logical outcome of having an > infrastructure-apps image. It seems more like guidelines that would > need to be established per-project. For instance, there is > absolutely > nothing stopping someone from installing the packagedb from the rpm, > checking out the development source to their home directory, and then > changing the config file to run that instead. > > -Toshio I'm more talking about newcomers who don't have a process of their own. If it is all setup with scripts and tutorials right off the livecd (could be a locally running url) submitting well formatted patches by new developers becomes trivial. The key is to make it easy to find the documentation and make the process somewhat easier, or at least more convenient then having to figure out the steps to get the code, change the configs and then restart the servers. I don't want to put process ahead of getting code contributions, it would just be a more integrated workflow where a developer wouldn't have to learn each step separately (well except for the actual development and various vcs workflows). Anyway just an idea. I plan on writing a script for pulling down each piece of infrastructure code and another script for diffing, packaging and deploying the service in the test instance. If others find it useful I will add other workflow scripts. -- John (J5) Palmieri Software Engineer Red Hat, Inc.

1 0

Re: Request for test data based off of obfuscated live data
by John (J5) Palmieri 19 Nov '08

19 Nov '08

----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote: > Mike McGrath wrote: > > We're actually in a pretty unique situation in that most of our data > is > > public anyway, replicating pkgdb and bodhi data for example should > be > > fairly easy. Replicating the fas stuff should be easy too. > > > > We're going to need to replicate not only the data but access to the > data > > and this, to me at least, sounds like another development > environment that > > is more mature then the pt setup but still not as strict as the > staging > > environment. > > > > > Yep, that seems to be where the need fits in. > > > What do others think on this? I like the low overhead of the pt > servers > > since people are kind of on their own in getting stuff done and it > doesn't > > cause extra work to the sysadmin-web guys. But there are drawbacks > to it. > > > I'm not sure what's best. There's a lot of problems with doing this > in > a shared development environment. Even if we're controlling the > access > to the data we'd still be more open with it here than in production > or > staging. For instance, people who are not primary fas authors or > system > admins would have access to make modifications to fas. So I think > we'd > still end up wanting to modify the data before it hits this > environment. > We'd also have to devote resources to it.... another db server, host > to > run koji-web,hub,builder, etc. We'd have to update them. We'd have > to > work out conflicts between different developers, for instance if we > work > on CSRF fixes in this environment and it makes developing other apps > like myfedora just flat out fail for a while. > > If we can munge the data enough to be comfortable releasing it to the > public, it seems like that would cost us less man hours. However, it > isn't entirely free. We'd still have to make new dumps of data, > modify > it for changes in the data model, etc. Then the developer would > become > responsible for downloading the sanitised data and running it on > their > network. Which is good because it isn't us but bad because it's not > trivial to set all this up. I would be willing to write scripts and a kickstart file to make this trivial to get a qemu image or test machine up and running in a couple of hours (mostly waiting for download and installs to happen). What I was thinking was an environment that setup a stable fedora infrastructure environment complete with puppet scripts to configure the services to work with one another and a set of scripts for pulling fresh data, modifying common pieces of the various dbs (like changing dates to stay current or setting up one of the users as your test user), and pulling down code from the various source trees for hacking on particular pieces of the infrastructure while integrating them into the environment. A note on the code drop, by requiring the author to modify a spec file if needed in order to deploy their changes into their environment (revision numbers would be automated) patches would include spec file changes instead of the maintainer having to sync by hand. This would also make sure the build files are kept up to date as the author would have to make their changes work in an RPM environment just to test them as opposed to just installing from their source tree which often leads to annoying bugs (like missing files in a distributed tarball). Also by making it easy to generate a patch and submit it to trac we will get more consistent formatted patches (such as using the VCS's patch format) and most likely more people getting involved as the overhead shrinks a bit (how many people want to go to individual trac instances to file a patch?). -- John (J5) Palmieri Software Engineer Red Hat, Inc.

2 1

Re: Request for test data based off of obfuscated live data
by John (J5) Palmieri 19 Nov '08

19 Nov '08

----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote: <snip> > > > Getting koji data munged and transferred may be a problem as it is > just > so darn big. If we don't have to make changes to the data in koji, > just > get it distributed, then we could give access to a backup... but > that's > still a lot of information to transfer. We would only need a portion of the data. Ideally everything since the last supported version of each distribution (or one after so we get obsolete data to test against) but in reality the last month of activity should be suitable. > pkgdb, fas, and bodhi are relatively small. > > fas is where we'd have our major security problems. We can't give > the > information out unmunged. I've munged it before, though, so it's > doable. How strict we need to be is an issue, though. If we remove > all > the identifying information in the people table except for the > userid, > is that sufficient? *Note: We probably also need to munge data in > the > configs table. As long as we randomly generate data for that (well username at least). Note that UID's are easily mapped back to usernames so you might want randomize that. Also I believe packagedb and bodhi use usernames as the key instead of UID's so those would have to match accounts in the munged FAS db. I would suggest generating a list of names from a dictionary and using that list to randomize names in the other services. Of course the names need to correspond to group permissions so some logic would be needed to make sure records associated with a give name are valid. However having the ability to recreate the associated user names may not be an issue since all of that data is public. More importantly we need to make sure we aren't giving out addresses, phone numbers, password hashes and other such keys. > pkgdb and bodhi don't have information that is privacy policy > sensitive. > (Which doesn't mean that some users won't like it... just that I > think > we're covered.) Mike's suggestion of running it by legal sounds like the best route. -- John (J5) Palmieri Software Engineer Red Hat, Inc.

2 1

Request for test data based off of obfuscated live data
by John (J5) Palmieri 18 Nov '08

18 Nov '08

Hey guys, On IRC the other day there was a discussion where I had requested the ability to use live data stripped of all personal identification and data, for creating a test bed for development of MyFedora. It was asked I write up a reason for needing this data as it was hard to explain in detail on IRC. Current Development First lets go over my current development process. Right now I work on live data. Since most of my code involves reading data this isn't an issue except for perhaps putting a load on the servers when testing. This however becomes less ideal as I need to test code that modifies data, such as pushing a build. Even more daunting is if I need to add functionality to one of the other apps, creating data that would somewhat reflect the real word is time consuming and often a blocker which has me move to something else. Why I need the data So why is it important to have real world data - or at least a semblance of it? Working on something that will consolidate a lot of the data into one interface, I hit a vast majority of our infrastructure while treating it as one entity. If each piece of infrastructure lived in isolation, it wouldn't be as big of an issue but as it stands the data has keys which link each record in one piece of infrastructure to a record in another. For instance Fas usernames link to builds in Koji who's build numbers link to releases in Bodhi. I need data with those links intact so I can follow the workflow from one tool to another, test access rights and simulate the progression of various data through the pieces of infrastructure without worrying about stomping on the data because I can quickly restore it to its initial state. Also, I can't hit every edge case, I need to concentrate on how the data most commonly flows and having something that resembles what we see on the production servers is key there. What I am asking for As stated above, I would like a data set representing the data one would see in our infrastructure. Ideally this would mean a secure process that would dump data from koji, bodhi, fas and pkgdb while obfuscating all personally identifying data. This could include switching package owners and uids at random so as not to be able to trace the data back (though in reality one could gather this data slowly by querying each of the infrastructure pieces). I only need a relatively small sampling of say a months worth of data and a semi random drawing of the most active contributors and their packages. I can update dates to keep the data "current" for testing purposes. Every once in awhile I would need a fresh sampling to make sure the code didn't just work with my sample set. Why pure random data isn't sufficient Random data does not produce the relationships needed to work with the entire fedora infrastructure and even if it did the data would not cover real world scenarios and most likely the relationships would be largely invalid (like a build tagged for F-8 released in F-9). Also things like koji tags and group information need to absolutely conform to the structure we have setup. For instance I key off of the string "updates-candidate" to determine if I should show a button to push the build to bodhi. The button also relies on FAS telling bodhi that the current logged in user is in the correct group to push. If it is not an updates candidate or the user is not in the correct group, the button does not show. What I would do with this data I would be able to accelerate development of the more interesting bits of myfedora while also being able to experiment and quickly produce patches to various bits of infrastructure. For instance, FAS already had all the API I need to edit my profile except it is not exposed outside of fas because of the lack of a simple @allow_json decorator so I had to drop that feature until after the development freeze and a new FAS with the patch is put into production. Even then modifying data on a production server, even if it is my own profile, is not an ideal way to test. If I had a data set I could set up my own test environment, apply the patch and test before we deploy. I could then go and patch other parts of the infrastructure to say speed up a query, add queries I needed and generally improve the base infrastructure as I developed MyFedora. The patches would then be sent to trac and accepted or rejected in the usual manner. Others could also more easily get into hacking on infrastructure bits as they would have a place to start instead of a daunting blank slate. If I can get the data I am more than happy to write scripts and kickstart files to easily setup and teardown a Fedora Infrastructure test and development instance. Whatever solution the infrastructure team thinks is good for what I need will be workable. Above is what I think I need and an explanation on why it is needed. Hopefully there will be some solution we can agree on to move forward fairly quickly. Thanks for your time. -- John (J5) Palmieri Software Engineer Red Hat, Inc.

3 4

outage at ibilio
by Mike McGrath 18 Nov '08

18 Nov '08

Hey guys, we're having connection issues to ibiblio again, I've taken their IP out of our proxy DNS setup so users don't hit it. They still will with torrent. The issue seems less of a total outage and more of a packet loss, I got about 52% loss earlier so torrent users should still be able to connect, just slower then they'd expect for now. Keeping an eye on things. -Mike

3 5

Memory increase for proxy1
by Mike McGrath 18 Nov '08

18 Nov '08

I'd like to double the memory in proxy1. Seth pointed out to me a week ago or so it's built 64 bit unlike the rest of our proxies. This means, generally, it consumes twice the amount of memory. The way we have httpd tuned I'm worried it'll start to swap on release day. After the release I'll rebuild this host. 2 +1's? -Mike

4 3

Re: sspp (server-status php parses)
by Mike Putnam 18 Nov '08

18 Nov '08

Serghey's script (http://sspp.googlecode.com/) requires mod_status be enabled... (delivered disabled in Apache/2.0.52 at least) #<Location /server-status> # SetHandler server-status # Order deny,allow # Deny from all # Allow from .example.com #</Location> ...and... #ExtendedStatus On (also delivered disabled in Apache/2.0.52) ...as well as write access to the /tmp file mentioned in the code in order to work. Once these prerequisites are satisfied, it's a handy little script. Thanks, Serghey! -Mike Putnam http://wisconsinlinux.org/

2 1

Change Request - Add website languages
by Ricky Zhou 18 Nov '08

18 Nov '08

I'd like to add some new languages in preparation for the F10 website. This change has been tested on publictest15. Here's the patch: http://ricky.fedorapeople.org/languages.conf.patch Thanks, Ricky

3 2

Re: sspp (server-status php parses)
by Mike Putnam 18 Nov '08

18 Nov '08

Serghey's script (http://sspp.googlecode.com/) requires mod_status be enabled... (delivered disabled in Apache/2.0.52 at least) #<Location /server-status> # SetHandler server-status # Order deny,allow # Deny from all # Allow from .example.com #</Location> ...and... #ExtendedStatus On (also delivered disabled in Apache/2.0.52) ...as well as write access to the /tmp file mentioned in the code in order to work. Once these prerequisites are satisfied, it's a handy little script. Thanks, Serghey! -Mike Putnam http://wisconsinlinux.org/

1 0

sspp (server-status php parses)
by Serghey Rodin 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello guys, I'm trying to reading all posts and stay in touch with fig's activity, but time is working against me :) I would like to contribute my little script that (I believe) makes apache monitoring easier. This parser can sort server-status by any field, and it also make some usage analytics. http://sspp.googlecode.com/files/sspp_0.4.php And big thanks to everybody who makes fedora infrastructure live. - -- best regards, Serghey Rodin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFJIimcbMru6vVD0KkRAm0TAJ9vvnRLiZ/VTMSjmFNKH0N/NieEgwCfcUJv jtKzHgnVZvI7YT+5blpadwM= =3tfR -----END PGP SIGNATURE-----

1 0

Statistics
by Paul W. Frields 17 Nov '08

17 Nov '08

Can anyone either generate, or tell me specifically how to generate, the following statistics? Keep in mind that I don't have access to any admin passwords, but I do have sysadmin group privileges and the ability to get to hosts such as log1. Unique visitors to fedoraproject.org - for September + October 2008 Total edits to fp.o wiki - monthly for May through October 2008 -- Paul W. Frields gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233 5906 ACDB C937 BD11 3717 http://paul.frields.org/ - - http://pfrields.fedorapeople.org/ irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug

2 2

Intro for Leo Albert Jackson Jr (lajjr)
by Leo Jackson 17 Nov '08

17 Nov '08

My name is Leo Albert Jackson Jr I have worked with a multitude of different systems. I have a Masters in Computer Science. I have a lot of equipment for testing. I have created my companies infrastructure. I created software and scripts for keeping everything running. I personally oversee 780 persons in different fields software engineering, security, admin, web development, tech docs, packaging software for distribution. I have hacked a ton of software and hardware to fix repair improve. I have built custom tools and software for my company and have systems that I built from the ground up. Thank You, Leo Albert Jackson Jr Owner Head Programmer LJ's Electronics and Software

2 1

Change Request: press alias
by Mike McGrath 17 Nov '08

17 Nov '08

I've had a request from paul to add someone to the press(a)fp.o alias. Can I get 2 +1's? -Mike

3 2

Asgeir is away until 16 Dec
by Asgeir Frimannsson 17 Nov '08

17 Nov '08

Hi all, Just a quick note to let you know that I'm mostly off-line for the next 4 weeks as I'm exploring New Zealand. Yes, life's tough... cheers, asgeir

1 0

Change request?
by Mike McGrath 13 Nov '08

13 Nov '08

I'm not really making a change but it might affect fedora hosted so I thought it best to ask. There's some restorecon jobs that started piling up on fedorahosted, and puppet is causing the issue. I'd like to 1) stop puppet on hosted 2) run the job and let it complete on its own. 3) start puppet again 4) make sure the jobs aren't running anymore. Can I get 2+1's? If we don't do this we'll have to make a change to disable the jobs until later because they do cause problems. -Mike

3 5

Change Request - fingerprints.html
by Ricky Zhou 13 Nov '08

13 Nov '08

This is just a content change, so it should have no risk at all: It fixes ticket 814 (https://fedorahosted.org/fedora-infrastructure/ticket/814) diff --git a/configs/system/fingerprints.html b/configs/system/fingerprints.html index f8d9cc7..01d4e43 100644 --- a/configs/system/fingerprints.html +++ b/configs/system/fingerprints.html @@ -25,26 +25,9 @@ </div> <div id="content"> <h1>Package Signing Keys</h1> - <table> - <tr> - <th>Key Purpose</th> - <th>Identified As</th> - <th>Fingerprint</th> - <th>Last Updated (UTC)</th> - </tr> - <tr> - <td>Fedora Project Releases</td> - <td>Fedora Project <fedora(a)redhat.com></td> - <td>CAB4 4B99 6F27 744E 8612 7CDF B442 69D0 4F2A 6FD2</td> - <td>2008-08-19 00:00:00</td> - </tr> - <tr> - <td>Fedora Rawhide</td> - <td>Fedora Project (Test Software) <rawhide(a)redhat.com></td> - <td>3166 C14A AE72 30D9 3B7A B2F6 DA84 CBD4 30C9 ECF8</td> - <td>2008-08-19 00:00:00</td> - </tr> - </table> + <p> + Please refer to the <a href="https://fedoraproject.org/keys">keys page</a> for updated information about package signing keys. + </p> <h1>SSH Host Fingerprints</h1> <table> <tr> @@ -109,9 +92,8 @@ <div id="bottom"> <div id="footer"> <p class="copy"> - Copyright © 2008 Red Hat, Inc. and others. All Rights Reserved. Please send any comments or corrections to the <a href="mailto:webmaster@fedoraproject.org">websites te + Copyright © 2008 Red Hat, Inc. and others. All Rights Reserved. For comments or queries, please <a href="http://fedoraproject.org/en/contact">contact us</a>. </p> - <p class="disclaimer"> The Fedora Project is maintained and driven by the community and sponsored by Red Hat. This is a community maintained site. Red Hat is not responsible for content. </p> Can I get two +1s? Thanks, Ricky

4 3

Meeting Log - 2008-11-13
by Ricky Zhou 13 Nov '08

13 Nov '08

19:59 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Meeting. Who's here? 19:59 < limburgher> The New Guy. 19:59 * jds2001 ,but in a $DAYJOB meeting too 20:00 * f13 20:00 * wakko666 finally remembers to show up. 20:00 * SmootherFrOgZ here 20:00 -!- susmit [n=susmit(a)59.93.196.29] has joined #fedora-meeting 20:00 * skvidal is 20:00 * susmit is 20:01 * ricky 20:01 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Fedora 10 release 20:01 < mmcgrath> So as you all know the F10 release is less then 2 weeks away. I'm going to spend most of this meeting time getting tickets assigned for who's doing what. 20:01 * lmacken rolls in 20:01 < mmcgrath> The release tickets are at: https://fedorahosted.org/fedora-infrastructure/report/9 20:02 < mmcgrath> I'm going to pay extra attention to the tickets this time around to make sure nothing gets forgotten or lost. 20:02 * abadger1999 here until power goes out 20:02 < mmcgrath> We didn't have a particularly good preview release. 20:02 < mmcgrath> abadger1999: solid. 20:02 < mmcgrath> So first ticket 20:02 < mmcgrath> .ticket 976 20:02 < zodbot> mmcgrath: #976 (New website) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/976 20:02 < mmcgrath> ricky: you all set there? 20:03 < ricky> Yup 20:03 < mmcgrath> k 20:03 < mmcgrath> .ticket 977 20:03 < zodbot> mmcgrath: #977 (Mirror space verification) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/977 20:03 < mmcgrath> SmootherFrOgZ: do you want to take this one? Its different from what you did for the preview release. 20:04 < mmcgrath> SmootherFrOgZ: if not let me know and I'll take it. 20:04 < SmootherFrOgZ> mmcgrath: no pb, go ahead and assign it to me 20:04 < jds2001> mmcgrath: what's involved here? 20:04 < jds2001> oh, SmootherFrOgZ has it, great :) 20:04 < mmcgrath> jds2001: basically to work with releng to find out how much space we need for the F10 launch... and make sure we have that much space. 20:04 < mmcgrath> it's almost always more complicated then it seems ;) 20:05 * mmcgrath will assign and provide some details. 20:05 < mmcgrath> next ticket 20:05 < mmcgrath> .ticket 985 20:05 < f13> I should have some good ideas around the first part of next week 20:05 < zodbot> mmcgrath: #985 (Let Mirror Manager know about the new release) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/985 20:05 < mmcgrath> f13: this one's usually you or mdomsch, should I assign it to you? 20:05 < f13> I honestly don't know what to do for that, is there an SOP? 20:06 -!- alexxed [n=alex(a)dyn-86.105.67.31.tm.upcnet.ro] has quit "Leaving." 20:06 < ricky> There's a partial mirrormanager SOP 20:06 < ricky> Not sure if it has 100% of the steps necessary for release, though 20:06 -!- alexxed [n=alex(a)dyn-86.105.67.31.tm.upcnet.ro] has joined #fedora-meeting 20:06 < ricky> mdomsch: Mind checking over that when you have a chance? 20:06 < mmcgrath> f13: its just letting the mirrors know 1) when the bits are ready and 2) when the bit flips. 20:07 < ricky> (https://fedoraproject.org/wiki/Infrastructure/SOP/MirrorManager) 20:07 < f13> mmcgrath: er, that's let "mirrors" know, and that's a ticket filed in releng, not "let mirror manager know" which sounds like touching something inside mirrormanager 20:07 < mmcgrath> SmootherFrOgZ: I reassigned it to you, if you still want it go ahead and accept it. 20:07 < SmootherFrOgZ> k 20:07 < mmcgrath> f13: sorry you're right, I got my tickets mixed up. 20:07 -!- mcgarnicle [n=janderso(a)66.170.4.46] has joined #fedora-meeting 20:08 < mmcgrath> f13: ignore what I just said for now :) 20:08 < f13> okiedokie 20:08 < mmcgrath> ricky: do you want to take ticket 985 and work with mdomsch to verify its correct? It'd be good to have someone other then mdomsch do it to verify for correctness. 20:09 < ricky> Sure 20:09 < mmcgrath> k 20:09 < mmcgrath> next ticket 20:09 < mmcgrath> .ticket 179 20:09 < zodbot> mmcgrath: #179 (RFI for hosting capabilities) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/179 20:09 < mmcgrath> no 20:09 < mmcgrath> .ticket 979 20:09 < mmcgrath> :) 20:09 < zodbot> mmcgrath: #979 (Mirror Coordination) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/979 20:09 < ricky> Hehe 20:10 * dgilmore is here 20:10 < mmcgrath> f13: ok, this one I think is normally you or mdomsch 20:10 < dgilmore> need to update schedule 20:10 < f13> mmcgrath: I'll take 979, although that's a dupe of a ticket I'll have in releng queue 20:10 < mmcgrath> f13: k, should I remove this from our release SOP? 20:12 < f13> yeah, please do 20:12 < mmcgrath> k 20:12 < Southern_Gentlem> !isnt it better to be left as a doublecheck? 20:12 < mmcgrath> next ticket 20:12 < f13> Southern_Gentlem: you could leave it as "make sure releng has a ticket for this" 20:13 -!- nim-nim [n=nim-nim@fedora/nim-nim] has quit Remote closed the connection 20:13 < mmcgrath> .ticket 908 20:13 < mmcgrath> err 20:13 < mmcgrath> damnit 20:13 < zodbot> mmcgrath: #908 (Deletion of /cvs/fedora/l10n/) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/908 20:13 < mmcgrath> .ticket 980 20:13 < zodbot> mmcgrath: #980 (Verify Mirror permissions (no leaking)) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/980 20:13 < mmcgrath> nirik: you around? 20:13 < nirik> yeah, somewhat... whats up? 20:13 -!- nim-nim [n=nim-nim@fedora/nim-nim] has joined #fedora-meeting 20:13 < dgilmore> mmcgrath: thats something really out of our control 20:13 -!- stickster is now known as stickster_afk 20:13 < mmcgrath> nirik: interested in taking a ticket for our release? 20:14 < dgilmore> mmcgrath: well making sure we dont open them up early again is in our control 20:14 < mmcgrath> dgilmore: we leaked last time. 20:14 < dgilmore> mmcgrath: i fogot we mesed up also 20:14 < f13> yeah, that was my fault 20:14 < mmcgrath> dgilmore: we're not controling it, we're ensuring it gets done correctly. 20:14 < f13> I've changed how we stage stuff so that should be less of a problem. 20:14 < mmcgrath> nirik: would you be interested in 20:14 < nirik> well, what does that entail? I can check perms on our mirror, etc. 20:14 < mmcgrath> .ticket 980 20:14 < zodbot> mmcgrath: #980 (Verify Mirror permissions (no leaking)) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/980 20:14 * nirik looks 20:15 * mdomsch is back 20:15 < mmcgrath> nirik: when you get the email from f13 that the bits are ready, sync those bits, verify they've got the right permissions, (not world readable) 20:15 < nirik> sure, I could look at that. 20:15 < mmcgrath> then when the bit flip happens make sure you can read them. 20:15 < nirik> s/look at/do/ 20:15 < nirik> sure. 20:15 < mmcgrath> SmootherFrOgZ did it for the preview but he's got a different task this time so I figured I'd see if you could do it. 20:15 < nirik> go ahead and assign it to me... 20:15 < mmcgrath> nirik: I'll assign it to you, if you want it accept it, if not leave it alone and I'll pass it along :) 20:15 < mmcgrath> k 20:16 < nirik> mdomsch: should I report leaky mirrors to you this cycle? I am sure #fedora will hear about them... 20:16 < dgilmore> nirik: if a mirror leaks we really cant do much 20:16 < mdomsch> we always leak 20:16 -!- JSchmitt [n=s4504kr@fedora/JSchmitt] has quit Remote closed the connection 20:16 < mmcgrath> nirik: report them to mdomsch, myself and f13, whoever you can get ahold of first. Use https://admin.fedoraproject.org/pager if you have to :) 20:16 < dgilmore> nirik: but we should not be the source of the leak 20:16 < nirik> right. 20:16 < mdomsch> dgilmore, right 20:16 < f13> mmcgrath: only page if we're the source of the leak 20:16 < mmcgrath> nirik: well, if its us that leaks, if its a mirrors just leave it be unless its really wide spread or something ;) 20:16 < nirik> mostly I was thinking for purposes of notifying them... 20:17 < f13> mmcgrath: I really don't care to be paged if some mirror admin leaks manually 20:17 -!- dwmw2 is now known as dwmw2_gone 20:17 < mmcgrath> yeah 20:17 < nirik> ie, if they don't know they have something messed up and are going to get a ton of BW sucked down. 20:17 < mdomsch> let the fanboyz get their bits early 20:17 < nirik> or should we just not care at all if it's not out fault? 20:17 < mdomsch> MM won't direct to mirrors at that point 20:17 < mdomsch> so if they leak and it's their fault, well, not much we can do to help them 20:17 < mmcgrath> nirik: we care, but not much we can do about it. 20:18 -!- Smoother1rOgZ [n=laxathom(a)41.6.70-86.rev.gaoland.net] has joined #fedora-meeting 20:18 < mmcgrath> ok, anything else on ticket 980? 20:18 -!- kushal [n=kdas(a)122.169.75.28] has quit "Leaving" 20:18 < nirik> well, notify them if we have contact info, but I guess thats a loosing propsition. 20:18 < mmcgrath> next ticket is 20:18 < mmcgrath> .ticket 981 20:18 < zodbot> mmcgrath: #981 (Add Mirror Manager repository redirects) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/981 20:18 < mmcgrath> mdomsch: I always forget exactly what this one is, care to explain? 20:19 < mmcgrath> this is to send pre-release people to F10 or to send them on to rawhide? 20:19 < mmcgrath> if they yum upgrade 20:19 < mdomsch> mmcgrath, sure - it's done 20:19 < mdomsch> right 20:19 < mdomsch> f10-preview and later rawhide 20:19 < mmcgrath> ah 20:19 < mmcgrath> k 20:19 < mdomsch> have fedora-release file pointing at fedora-10 20:19 < mdomsch> repo 20:19 -!- SmootherFrOgZ [n=laxathom(a)73.125.206-77.rev.gaoland.net] has quit Read error: 104 (Connection reset by peer) 20:19 < mdomsch> but it doesn't exist, so MM redirects them to rawhide for now 20:19 < mdomsch> on release day, we need to drop the redirect 20:20 < mdomsch> there's a script to run on bapp1 to do so 20:20 < mmcgrath> ah, k. 20:20 < mmcgrath> mdomsch: would you mind accepting that ticket? If not can you make a note in it to the SOP on what to do and I'll do it? 20:20 < mdomsch> I"m on it 20:20 < mmcgrath> solid, thanks. 20:20 < mmcgrath> next ticket 20:20 < mmcgrath> .ticket 982 20:20 < zodbot> mmcgrath: #982 (Communicate with RHIS) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/982 20:20 < mmcgrath> this one's done, they've known for a long time. 20:20 < mmcgrath> .ticket 983 20:20 < zodbot> mmcgrath: #983 (Infrastructure Change Freeze) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/983 20:20 < mmcgrath> This one is in progress. I'm going to accept it now. 20:21 < mmcgrath> This freeze was interesting. 20:21 < mmcgrath> there was so little time between our last freeze and the final freeze. 20:21 < mmcgrath> I tried to squeeze a bunch of stuff in and it obviously had problems. 20:21 < mmcgrath> so far I don't think we've had any negative affects related to the release though. 20:22 < mmcgrath> Its something we'll want to talk about after the release to discuss exactly what could have been better from our point of view. 20:22 < mmcgrath> anywho. 20:22 -!- abadger1999 [n=abadger1(a)65.78.187.8] has quit Read error: 104 (Connection reset by peer) 20:22 < mmcgrath> .ticket 987 20:22 < zodbot> mmcgrath: An error has occurred and has been logged. Please contact this bot's administrator for more information. 20:22 < mmcgrath> .ticket 987 20:22 < zodbot> mmcgrath: An error has occurred and has been logged. Please contact this bot's administrator for more information. 20:22 < mmcgrath> .ticket 978 20:22 * mmcgrath is sorry 20:22 < zodbot> mmcgrath: #978 (F10 Release Day ticket (2008-11-25)) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/978 20:22 < mmcgrath> This is a tracker ticket. I'll accept that now and close it when we're done. 20:22 < f13> ticket 987 is a ticket about zodbot not handling unknown tickets well. 20:22 < mmcgrath> .ticket 984 20:22 -!- sdziallas [n=sebastia(a)p57A2BEE0.dip.t-dialin.net] has quit "Ex-Chat" 20:22 < zodbot> mmcgrath: #984 (Wiki Common Issues) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/984 20:23 < mmcgrath> quaid: ping 20:23 < mmcgrath> ricky: ping 20:23 < ricky> mmcgrath: pong 20:23 * mmcgrath isn't quite sure who to assign this to. 20:23 * ricky isn't too familiar with the Common issues docs 20:23 < mmcgrath> ricky: It's odd that this is an infrastructure task but it is something that has to get done so I'm happy to leave it here but who actually owns that page? 20:24 < quaid> mmcgrath: pong 20:24 < ricky> Doesn't https://fedoraproject.org/wiki/Bugs/Common just get updated manually? 20:24 * mmcgrath suspects its here because it wasn't done last time. 20:24 < mmcgrath> quaid: see the last few lines of scrollbak, who owns the common bugs page? 20:24 < quaid> good question 20:24 < quaid> Bug Triage perhaps? 20:25 < mmcgrath> jds2001: ? 20:25 < quaid> honestly, it's been a joint effort, no clear ownership, iirc 20:25 < jds2001> hmm 20:25 -!- alexxed [n=alex(a)dyn-86.105.67.31.tm.upcnet.ro] has quit Remote closed the connection 20:25 * mmcgrath notes jds2001 was asking questions about tickets earlier 20:25 < mmcgrath> jds2001: you want this ticket? :) 20:25 < jds2001> Is there something there now? 20:25 < quaid> yeah, it redirects to f9 bugs 20:25 < jds2001> I guess, whast's the ticket about? 20:25 < quaid> well, it highlights F9, I guess 20:26 < mmcgrath> .ticket 984 20:26 < zodbot> mmcgrath: #984 (Wiki Common Issues) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/984 20:26 < jds2001> OK, I think that quaid and I could jointly take that. 20:26 * quaid adds himself to the ticket 20:26 < jds2001> since that's really a docs/triage collaboration thing 20:26 < mmcgrath> k, just make sure it gets accepted by someone otherwise I'll keep bugging you two about it :) 20:27 < ricky> I think these are the pages to be edited: 20:27 < ricky> https://fedoraproject.org/wiki/Template:FedoraVersion 20:27 < ricky> https://fedoraproject.org/wiki/Template:FedoraVersionNumber 20:27 < mmcgrath> ricky: thats related to 984 you mean? put them in the ticket if so so we don't forget. 20:27 < ricky> Sure. 20:27 < mmcgrath> rock. 20:28 < mmcgrath> And with that, we should have a smooth release. 20:28 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Open Floor (specific to the release) 20:28 * quaid waits for ricky to do his thing 20:28 < mmcgrath> does anyone have any questions directly related to the release? 20:28 < quaid> can someone i) sponsor me for sysadmin-web, and ii) teach me how to work the magic on docs.fedoraproject.org? 20:28 -!- knurd is now known as knurd_afk 20:29 * quaid wants to fix the CSS and be able to move Docs more quickly to publish 20:29 < mmcgrath> quaid: I can do that, ping me after the meeting. 20:29 < quaid> ok 20:29 < mmcgrath> Ok, and with that.. 20:29 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Open Floor 20:30 < mmcgrath> anyone have anything they'd like to discuss? 20:30 < limburgher> What FIG should I apply to to help with things like 931? 20:30 < mmcgrath> .ticket 931 20:30 < zodbot> mmcgrath: #931 (1 package missing from mirrors) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/931 20:31 < mmcgrath> limburgher: that I think is releng and then sysadmin-releng. I think f13 or lmacken would be able to sponsor you better. 20:31 < mmcgrath> well better then I anyway. 20:31 < limburgher> Fair enough. 20:31 -!- ldimaggi_office [n=ldimaggi@nat/redhat/x-6596a14d8985cdca] has joined #fedora-meeting 20:32 < mmcgrath> Anyone have anything else? 20:32 < mmcgrath> If not we'll close in 30 20:32 < dgilmore> mmcgrath: id like to propose we change meeting time with DST 20:33 < mmcgrath> anyone have any thoughts / opinions on that? 20:33 < f13> limburgher: you don't need to be in any group to help out with that ticket. All it took was logging into bodhi, investigating where those packages were supposed to be pushed out, and looking at the koji tagging. None of those things required any admin level. 20:34 < Smoother1rOgZ> dgilmore: which time would you like ? 20:34 < mmcgrath> We started with UTC to ensure that we were internationally focused (because its hard enough to participate if you're not in a US timezone as it is) so I thought for the meeting times we should shift that burden on to us. 20:34 < ricky> Smoother1rOgZ: It means we'd push it back one hour during DST 20:34 -!- ubertibbs [n=tibbs@fedora/tibbs] has quit "Konversation terminated!" 20:34 * dgilmore always messes up when we change from dST to normal time 20:34 < mmcgrath> but I don't know that UTC really helps or hurts those not in the US. 20:34 < Smoother1rOgZ> just a lillte :) 20:34 * ricky probably won't be able to make meetings at 3:00 PM before the next DST change next semester 20:35 < Smoother1rOgZ> it's 9:35pm here 20:35 < dgilmore> mmcgrath: :) thats fair. I need to work out how to have it recorded in UTC so it changes for me 20:35 < mmcgrath> dgilmore: heh 20:35 < ricky> The gnome-panel clock needs UTC support :-) 20:35 < Smoother1rOgZ> ricky: +1 20:36 < dgilmore> i actually looked at switching my computers to just be UTC but it messed a few things up on me 20:36 < mmcgrath> dgilmore: send an email to the list about it, could be we find a better time altogether. 20:36 < ricky> I set irssi to use UTC so that's my source for UTC info 20:36 < jds2001> ricky: it has it :) 20:36 < mmcgrath> k, anyone have anything else? 20:36 < dgilmore> not from me 20:36 < jds2001> set your clock to UTC :) 20:36 < mdomsch> yeah 20:37 < ricky> jds2001: Hehe 20:37 * mdomsch wants to introduce Scott Collier aka boodle 20:37 < mmcgrath> boodle: make yourself known! 20:37 < ricky> boodle: Welcome :-) 20:37 -!- abadger1999 [n=abadger1(a)65.78.187.8] has joined #fedora-meeting 20:37 < dgilmore> boodle: welcome 20:37 -!- Khaytsus [n=Khaytsus@fedora/khaytsus] has joined #fedora-meeting 20:37 < mdomsch> he works at Dell and oversees a lot of our Linux support queues 20:37 < mmcgrath> mdomsch: I know this boodle, he's the one that pushes all his work on to David Ulbrich when he's not around :) 20:37 < mdomsch> he's about to get his RHCA (one or two tests to go) 20:37 < boodle> Heh. This is my first meeting, trying to wrap my head around your infrastructure / processes 20:37 < boodle> lol 20:37 < boodle> exactly 20:38 * mmcgrath got an out of office message from him not to long ago :) 20:38 < ricky> Hehe 20:38 < mdomsch> so, now when things break with our Dell gear, you know who to bug 20:38 < mdomsch> :-) 20:38 < mmcgrath> boodle: what time zone are you in? 20:38 < boodle> CST 20:38 < boodle> work out of Round Rock 20:38 < mmcgrath> solid, k. good to know. 20:38 < mmcgrath> welcome boodle. 20:38 -!- notting [n=notting@redhat/notting] has joined #fedora-meeting 20:38 < boodle> thx 20:38 < mmcgrath> ok, anyone have anything else to discuss for the meeting? If not we'll close in 30. 20:39 -!- ezq [n=ezq(a)200-127-101-170.cab.prima.net.ar] has joined #fedora-meeting 20:39 < mmcgrath> 10 20:39 -!- mmcgrath changed the topic of #fedora-meeting to: Infrastructure -- Meeting End

1 0

Meeting reminder
by Mike McGrath 13 Nov '08

13 Nov '08

We always have our meetings at 20:00UTC on Thursday. We're still doing that today but I'm sending a reminder because it focuses on the F10 release so be there! http://fedoraproject.org/wiki/Infrastructure/Meetings -Mike

1 0

Introduction
by Jon Ciesla 13 Nov '08

13 Nov '08

Hi all; I've been a Fedora maintainer for nearly two years, and have been running Fedora as my primary OS since RH7.1. I've also been running servers for a small business on it since RH9, as well as a local yum mirror. In my professional life, I maintain internal workstations and the associated repos and mirrors for my employer, using a mix of RHEL and CentOS. Why am I telling you this? I've had a few tickets for infrastructure in the past, mostly revolving around packages missing from mirrors, and while these have invariably been resolved with high competence and professionalism by Mr. Macken and Mr. Keating, I would love to see them closed more quickly. Since I'm acutely aware of the extreme fullness of the collective Infrastructure plate (especially of late), and I initially became a Fedora maintainer so I could stop bitching and start helping, I'd like to offer my services on this sort of thing. I'm not sure which FIGs to apply to, other than sysadmin, obviously. If this goes well, not only will I stop bitching and start helping on mirror issues, but I'd be eager to take a crack at anything else in Trac that I might be able to assist with. Thanks, Jon Ciesla -- in your fear, speak only peace in your fear, speak only love -d. bowie

2 3

Change Request Koji
by Dennis Gilmore 12 Nov '08

12 Nov '08

inside of phx all machines are using koji2 for koji.fp.o koji2 is the new 32 bit guest. which is working fine except that it has 2gb ram. currently it is seeing a higher load than id like. 17:54:50 up 5 days, 22:11, 3 users, load average: 8.69, 6.68, 5.06 total used free shared buffers cached Mem: 2097328 2042660 54668 0 3868 704116 -/+ buffers/cache: 1334676 762652 Swap: 2096472 255224 1841248 its not heavily swapping but swapping enough. id like to change phx to point at koji1 when they are all back over to koji1 ill then take koji2 down allocate it 4gb ram koji1 has 8gb ram (and is 64 bit) then point everything inside phx back at koji2 koji1 has not been rebuilt yet as we are still waiting on load balancing to be setup. kojihub on koji1 is used only by people submitting builds. kojiweb and the builders are using koji2 as its hub. this change should have no visible user impact, but will lower the load on koji2. Dennis

3 4

change request (docs)
by Mike McGrath 12 Nov '08

12 Nov '08

Karsten noticed this. Its a minor cange and minor problem but: http://docs.fedoraproject.org/selinux-guide Isn't redirecting properly, I need a proxypassreverse section in the docs config. 2+1's? -Mike

3 2

change request (zabbix)
by Mike McGrath 12 Nov '08

12 Nov '08

I'd like to disable our balancer from checking zabbix on all but two of our servers. Its been filling mysql connections (currently 210) causing issues with our other applications and backups. This is a low risk change to fix an issue. 2+1's? -Mike

5 7

Change Request: AWStats on log1
by Ricky Zhou 11 Nov '08

11 Nov '08

AWStats has been going crazy on log1, so I'd like to make the cronjob run less often, and on far fewer log files: diff --git a/modules/awstats/manifests/site.pp b/modules/awstats/manifests/site.pp index 4df7974..6cb2944 100644 --- a/modules/awstats/manifests/site.pp +++ b/modules/awstats/manifests/site.pp @@ -1,5 +1,5 @@ define awstats::site($log_dir="proxy*", $record_redirects=false, $record_query_string=false) { - file { "/etc/cron.hourly/awstats.$name": + file { "/etc/cron.daily/awstats.$name": mode => 0755, content => template('awstats/awstats.cron.erb'), } diff --git a/modules/awstats/templates/awstats.conf.erb b/modules/awstats/templates/awstats.conf.erb index 66d2a66..931cbeb 100644 --- a/modules/awstats/templates/awstats.conf.erb +++ b/modules/awstats/templates/awstats.conf.erb @@ -1,4 +1,4 @@ -LogFile="/usr/share/awstats/tools/logresolvemerge.pl /var/log/hosts/<%= log_dir %>/*/*/*/http/<%= name %>-access.log |" +LogFile="/usr/share/awstats/tools/logresolvemerge.pl /var/log/hosts/<%= log_dir %>/%YYYY-24/%MM-24/%DD-24/http/<%= name %>-access.log |" LogType=W LogFormat=1 LogSeparator=" " Can I get two +1s for this? Thanks, Ricky

4 3

Infrastructure Change freeze announcement
by Mike McGrath 11 Nov '08

11 Nov '08

I guess I never actually sent this out. We are now in a full freeze until November 26th. http://fedoraproject.org/wiki/Infrastructure/SOP/Release#Change_Freeze For more info on exactly what is frozen -Mike

1 0

Change Request
by Dennis Gilmore 11 Nov '08

11 Nov '08

Id like to enable creating static repos for dist-olpc4-build the patch bellow is the change to the cronjob needed. Can I get a +1 diff --git a/configs/build/update-static-repos.py b/configs/build/update-static- repos.py index a6cd334..16ee6ac 100755 --- a/configs/build/update-static-repos.py +++ b/configs/build/update-static-repos.py @@ -4,7 +4,7 @@ import os import sys import koji -TAGS = ('dist-olpc2-build', 'dist-olpc3-build', 'dist-f8-build', 'dist-f9- build', 'dist-f10-build', 'dist-f11-build', 'dist-rawhide', 'olpc2-update1', 'olpc2-ship2') +TAGS = ('dist-olpc2-build', 'dist-olpc3-build', 'dist-olpc4-build', 'dist-f8- build', 'dist-f9-build', 'dist-f10-build', 'dist-f11-build', 'dist-rawhide', 'olpc2-update1', 'olpc2-ship2') STATICPATH = '/mnt/koji/static-repos' SUFFIX = '-current'

3 2

Change freeze request
by Mike McGrath 11 Nov '08

11 Nov '08

We need to update httpd on our servers. I'm not totally ready for this change yet but I'd like to get the approval for when its time. -Mike

3 2

another rsync change
by Mike McGrath 11 Nov '08

11 Nov '08

Another borked host from the rsync changes yesterday. secondary1 just needs to have rsync enabled in its xinetd.d/rsync file. +1? -Mike

3 2

Change freeze request
by Mike McGrath 11 Nov '08

11 Nov '08

One of my changes yesterday had a typo in it. on cvs1 I'd like to change line 14-15 from: [cvs] path = /srv/cache/lookaside to [pkgs] path = /cvs/pkgs/ 2+1's? -Mike

3 2

introduction - looking for contributing to Infra team
by Rakesh Pandit 10 Nov '08

10 Nov '08

Hello list, I am Rakesh Pandit, fedora package maintainer and would like to join infrastructure team and contribute. Still looking at *GetStarted* pages. :) A bit about myself, I maintain some packages for fedora, and contribute to few GNU Projects and Openoffice. I can write python, perl, bash scripts + can program in C/C++. But am not good at system administration. Thanks, -- rakesh

2 1

log1 and nagios cron alerts
by Jon Stanley 09 Nov '08

09 Nov '08

This should prevent us from executing the same awstats analysis at the same time, thereby eliminating the nagios alerts for crond on log1. Since I'm not in sysadmin-web, I don't feel real comfortable deploying this without someone telling me it's OK and that it looks sane :) diff --git a/modules/awstats/templates/awstats.cron.erb b/modules/awstats/templates/awstats.cron.erb index 7e41be0..7ea507b 100755 --- a/modules/awstats/templates/awstats.cron.erb +++ b/modules/awstats/templates/awstats.cron.erb @@ -1,6 +1,12 @@ #!/bin/bash # <%= name %> + +if [ -e /var/run/<%=name>.awstats.lock ] ; do + exit 1 +fi + +touch /var/run/<%= name%>.awstats.lock mkdir -p /srv/web/awstats/<%= name %> /usr/share/awstats/tools/awstats_buildstaticpages.pl \

2 2

Failed fas upgrade
by Toshio Kuratomi 07 Nov '08

07 Nov '08

I tried to upgrade our fas instance tonight and failed. There's something wrong with fasClient in 0.8.4.6+ and groups. I've downgraded the fas-Client package to 0.8.4.5 on the servers and removed the fas-client-0.8.4.6 and 0.8.4.7 packages from the infrastructure repo (they're in my home directory in case someone wants to run diff and figure out where the problem lies). The I left the fas servers running 0.8.4.6 for the moment. -Toshio

1 0

Freeze reminder
by Mike McGrath 07 Nov '08

07 Nov '08

Just a reminder the final "full freeze" starts on November 11th. That means we've got a week to get any changes we want in and ready. -Mike

7 10

Re: ** PROBLEM alert - cvs1.fedora.phx.redhat.com/Puppet is CRITICAL **
by Jon Stanley 07 Nov '08

07 Nov '08

I silenced this in nagios, it's expected as part of the mass branching. Actually I silenced all services on cvs1. I'll re-enable when the branching is complete. On Thu, Nov 6, 2008 at 10:25 PM, Nagios Monitoring User <nagios(a)fedoraproject.org> wrote: > ***** Nagios ***** > > Notification Type: PROBLEM > > Service: Puppet > Host: cvs1.fedora.phx.redhat.com > Address: cvs1.fedora.phx.redhat.com > State: CRITICAL > > Date/Time: Fri Nov 7 03:25:45 UTC 2008 > > Additional Info: > > PROCS CRITICAL: 0 processes with args /usr/bin/ruby /usr/sbin/puppetd, UID = 0 (root) > -- Jon Stanley Fedora Bug Wrangler jstanley(a)fedoraproject.org

1 0

Meeting Log - 2008-11-06
by Ricky Zhou 06 Nov '08

06 Nov '08

21:02 * ValHolla walks in 21:02 -!- sonar_logger3 [n=Who(a)adsl-074-171-066-196.sip.aby.bellsouth.net] has joined #fedora-meeting 21:03 < dgilmore> Everyone Ready ? 21:03 * ricky is half-here 21:03 -!- Sonar_Gal [n=Andrea@fedora/SonarGal] has joined #fedora-meeting 21:03 -!- dgilmore changed the topic of #fedora-meeting to: Fedora Infrastructure Meeting 21:04 -!- Evil_Sonar_Chick [n=Andrea@fedora/SonarGal] has quit Read error: 60 (Operation timed out) 21:04 < abadger1999> hey 21:05 -!- inode0 [n=inode0@fedora/inode0] has left #fedora-meeting [] 21:05 < dgilmore> .tiny https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assi… 21:05 < zodbot> dgilmore: http://tinyurl.com/2hyyz6 21:05 < dgilmore> lets start with tickets 21:06 < dgilmore> we have one .ticket 740 21:06 < dgilmore> .ticket 740 21:06 < zodbot> dgilmore: #740 (Loaning out system time to OLPC participants) - Fedora Infrastructure - Trac - https://fedorahosted.org/fedora-infrastructure/ticket/740 21:06 < dgilmore> and there really is not much to say on that right now 21:06 < dgilmore> well really nothing more to add right now 21:06 < dgilmore> I have one thing i want to go over 21:07 < dgilmore> Ive been working on koji2 21:07 < dgilmore> we have a request to have koji1 and koji2 load balanced 21:07 -!- ianweller_afk is now known as ianweller 21:07 < dgilmore> in the mean time koji2 is up 21:07 < dgilmore> and the builders are using it 21:07 < dgilmore> I created some classes in puppet 21:08 < dgilmore> kojira and some cron jobs should only be run on a single box 21:09 < ricky> So will those be run on koji2 so that koji1 can be rebuilt i686? 21:09 * ianweller rolls in 21:09 < dgilmore> ricky: right now they are on koji1 21:10 < dgilmore> there is 2 new classes kojipassivehub and kojiactivehub 21:10 < dgilmore> so its a matter of adjusting nodes to move where it gets run 21:10 < dgilmore> koji1 has 8gb ram and koji2 has 2gb 21:11 < dgilmore> I think ill swap everything to koji1 and increate the ram on koji2 to 4gb 21:11 < dgilmore> i need to check we have enough for it 21:11 < dgilmore> ricky: but ill switch them to koji2 before rebuilding koji1 21:11 < G_work> anything interesting? 21:12 < ricky> Ah, OK 21:12 < G_work> oh wait, it's just starting? 21:12 -!- cyberpear_ [n=cyberpea(a)machamp-37.dynamic.rpi.edu] has joined #fedora-meeting 21:13 < dgilmore> I need to add koiji2 to nagiso also 21:13 < abadger1999> yep 21:13 < dgilmore> but right now koji2 is up and running and serving the builders 21:14 < dgilmore> ill update the buildsys sop with info on changing the classes in puppet 21:14 < G_work> dgilmore: poke me in an hour and I'll sort out monitoring 21:14 < dgilmore> if anyone can think of a way to automate the cronjobs and kojira running moving to different hosts im all ears 21:15 < dgilmore> i guess its concievable that we could have 3 or 4 hubs/ web frontends 21:15 < dgilmore> and they just need to run on one 21:16 < dgilmore> so open floor? 21:16 < ValHolla> dgilmore: are they in active passive mode or are they "load balanced" *am confused* if they are in active/passive mode, have the cron/scripts check for node being active and exit gracefully if it is the passive one 21:16 -!- dgilmore changed the topic of #fedora-meeting to: Fedora Infrastructure Meeting - Open Floor 21:17 < dgilmore> ValHolla: they are load balanced 21:17 < dgilmore> not active passive 21:17 < ValHolla> bummer ;) 21:18 < dgilmore> anyone have anything they want to talk about? 21:18 -!- sonar_logger2 [n=Who(a)adsl-074-171-066-196.sip.aby.bellsouth.net] has quit Connection timed out 21:18 < dgilmore> price of tea in China? 21:19 < G_work> dgilmore: not really 21:19 < dgilmore> alrighty then 21:19 < G_work> except I'm now in Australia & working for Red Hat 21:19 < dgilmore> ill wrap up in 30 21:19 < abadger1999> G_work: Congratulations! 21:19 < dgilmore> G_work: :) 21:19 < dgilmore> abadger1999: he is in my old home town 21:19 < G_work> abadger1999: :) 21:19 < abadger1999> Cool 21:20 < ricky> Congrats again 21:20 < dgilmore> 20 21:20 < G_work> abadger1999: I'm actually on internal VPN because I left my USB stick behind 21:20 < dgilmore> 10 21:20 -!- rdieter is now known as rdieter_away 21:20 < dgilmore> ---Meeting ENd---

1 0

[Fwd: Account Problem]
by Ignacio Vazquez-Abrams 06 Nov '08

06 Nov '08

For your consideration. -------- Forwarded Message -------- From: Stefa Nos <stefanos4555(a)gmail.com> To: webmaster(a)fedoraproject.org Subject: Account Problem Date: Thu, 06 Nov 2008 13:48:59 +0200 Hello, I don't know if you are in charge for this type of problems but I want to inform you for a situation I have been into.While I was completing the registration form to get a Fedora account I accidentally mistype my e-mail address. These are the information I did complete to registration form: Username: stefanos4555 Full Name: Stefanos Mpourtzoudis Email: stefanos4555(a)gmai.com I am 13 years of age or older: Yes So I wonder if the wrong email address can change to the correct stefanos4555(a)gmail.com so I can proceed with my registration. Thank you in advance for your time. -- Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>

2 1

[Fwd: [tx-devel] Roadmap thoughts]
by Toshio Kuratomi 06 Nov '08

06 Nov '08

FYI: Roadmap for Transifex's port to DJango and how long we have with the TurboGears version before we have to start thinking about making the new version work. -Toshio -------- Original Message -------- Subject: [tx-devel] Roadmap thoughts Date: Thu, 6 Nov 2008 01:26:06 +0200 From: Dimitris Glezos <dimitris(a)glezos.com> Reply-To: transifex-devel(a)googlegroups.com To: Transifex devel list <transifex-devel(a)googlegroups.com> References: <6d4237680811051433n55ef48d7x668f19b0a9dfd9b4(a)mail.gmail.com> <6d4237680811051519g7d149ba3x616957ff1ea10f55(a)mail.gmail.com> I'd like to share some thoughts on having a roadmap for the upcoming releases and next months. Get everyone is on the same page and make sure we have a consensus on our actions. Development on mainline is more or less frozen since we've been hammering the Django branch to shape, together with Diego. I'd like us to release a 0.4 major release from the TurboGears branch, based on the current tip of the mainline branch. This release can be maintained for bugfixes in the form of 0.4.x for a few months, in case there are deployments of it. I've documented the current features: http://docs.transifex.org/releases/0.4.html The Django branch, once it's mature enough release can become 0.5. This release will include at least everything the TG branch has and many more: http://docs.transifex.org/releases/0.5.html What does this mean to projects like Fedora and GNOME? I believe Fedora can install 0.4 right away, and take its time to deploy 0.5, since it's the first Django app on its Infrastructure. With GNOME we have enough time until the feature freeze to include the features we need (collections, releases, etc). With Django's pluggable architecture, it's much easier to start experimenting with these, without affecting the core functionality. One open issue is Christos' work on the submissions branch. I've ported this work on the VCS layer almost without any changes in the Django branch. It's our solid base for VCS support for all future releases. The Q is whether it's worth merging it into 0.4 as well, or if it's more efficient if we cherry-picked any bugfixes from that branch into mainline. I'm wondering whether we're better off keeping 0.4 stable and simple, given the fact that it will only exist for a few months. Roadmap to 0.5 -------------- Since we have a lot of work until reaching stability and the feature set of 0.4, we're splitting up the work in minor 0.5 releases or milestones, in the form of 0.5m1, etc. Aiming for a few of them: - 0.5-m1 (Finished): Bare minimum Code refactoring, Units, Project registration, Basic i18n, VCS layer complete, initial data there - 0.5-m2 (Finished): Announcment of the Django branch to the developers and core testers OpenID, Notifications, Deployment, non-master branches work, statistics, languages - 0.5-m3 (Half-finished): Announcement of Django branch to the general public OK: login_required for editing , use dynamic site_name, download POs Working on them: Catch most exceptions, all VCS work on tx.net - 0.5-m4: Ready for testing from projects Project Collections, User profiles, Better docs in the UI, Logging - 0.5-m5: File Submissions - 0.5-pre: Everything needing completion before 0.5 Gold Everything from TG branch works, documentation completion, wsgi deployment, admin panel refinements - 0.5 Gold Development from here will continue as usual: The goal is to have minor releases which will not break the ABI. In any way, we'll use django-evolution to allow schema evolution for model changes. A few draft ideas for minor releases: - 0.5.1: Comments, Sitemap, Invitations. Maybe: Msgmerged i18n support. - 0.5.2: More admin features, Basic CLI, AJAX. Work for better support for GNOME and Fedora. - 0.5.3: Full CLI+auth, fine-grained permissions, complex notifications, workflow, svn+https support - ... - 0.6: First release with major backwards-incompatible changes, like File monitoring, Project owners, etc. Important dates --------------- Given the fact that there are some big gaps in development time for a few of us, it's not easy to put some close hard dates on the above. But we're aiming in something like the following: - 2008-11-06: 0.4 released, branch off. - 2008-11-08: Finalize 0.5 feature set - 2008-11-15: 0.5-alpha (0.5-m3) - 2008-12-13: 0.5-beta (0.5-m5) - 2008-12-16: Feature Freeze (0.5-pre) - 2008-12-23: 0.5-rc1 - 2008-12-29: 0.5-rc2 - 2008-01-04: 0.5 final Thoughts, ideas, flames? -δ -- Dimitris Glezos Jabber ID: glezos(a)jabber.org, GPG: 0xA5A04C3B http://dimitris.glezos.com/ "He who gives up functionality for ease of use loses both and deserves neither." (Anonymous) -- -- Dimitris Glezos Jabber ID: glezos(a)jabber.org, GPG: 0xA5A04C3B http://dimitris.glezos.com/ "He who gives up functionality for ease of use loses both and deserves neither." (Anonymous) -- -- Dimitris Glezos Jabber ID: glezos(a)jabber.org, GPG: 0xA5A04C3B http://dimitris.glezos.com/ "He who gives up functionality for ease of use loses both and deserves neither." (Anonymous) --

1 0

Change Freeze Breakage
by Mike McGrath 04 Nov '08

04 Nov '08

The freeze doesn't technically end until tomorrow but because of the small window between this freeze and the next I'd like to get some bits done. 1) Change the smolt api to point to its new location in /var/www/smolt-wiki/ instead of /usr/share/mediawiki/ 2) fas-server update. This is a yum update with some testing. -Mike

6 12

space for more storage?
by Matt Domsch 02 Nov '08

02 Nov '08

Given the discussion on FAB: If we had more storage, where (physically) could we put it? Is there space in PHX? If so, how much? There's no particular reason why space for hosting a boatload of remixes would need to be in PHX. For bandwidth purposes, it would be good if it were elsewhere. I can try to drum up more sponsors, but want a coordinated plan for what we're asking for, and where it's going to go... -- Matt Domsch Linux Technology Strategist, Dell Office of the CTO linux.dell.com & www.dell.com/linux

2 1

Re: Cron <root@proxy3> /usr/local/bin/syncFiles.sh mirrors /srv/web/mirrors/
by Matt Domsch 02 Nov '08

02 Nov '08

On Sun, Nov 02, 2008 at 03:13:10AM -0500, Ricky Zhou wrote: > On 2008-11-02 08:00:02 AM, Cron Daemon wrote: > > rsync: read error: Connection reset by peer (104) > > rsync error: error in rsync protocol data stream (code 12) at io.c(614) [receiver=2.6.8] > Could these be due to the recent rsync rate limiting changes? Should we > make them only affect secondary1, perhaps? perhaps... though there aren't so many proxy* servers (are there) that they'd be seen as being >10, or >2 from a single IP? in fact, yes, >2 per IP. My guess is it's multiple syncFiles.sh running in parallel cronjobs simultaneously. I'll drop that bit for now. -- Matt Domscht Linux Technology Strategist, Dell Office of the CTO linux.dell.com & www.dell.com/linux

1 1

rsync fixups for secondary1
by Matt Domsch 01 Nov '08

01 Nov '08

I'd like to do the following to prevent our rsync hosts such as secondary1 from being overloaded. diff --git a/configs/system/rsync.xinetd b/configs/system/rsync.xinetd index 8976dd7..f5b5dbc 100644 --- a/configs/system/rsync.xinetd +++ b/configs/system/rsync.xinetd @@ -10,4 +10,7 @@ service rsync server = /usr/bin/rsync server_args = --daemon log_on_failure += USERID + instances = 10 + per_source = 2 + max_load = 20 } diff --git a/configs/system/rsyncd.conf.secondary b/configs/system/rsyncd.conf.secondary index 6c12db1..9101e05 100644 --- a/configs/system/rsyncd.conf.secondary +++ b/configs/system/rsyncd.conf.secondary @@ -3,6 +3,7 @@ syslog facility = daemon dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.bz2 *.iso use chroot = false transfer logging = false +timeout = 600 [fedora-secondary] path = /srv/pub/fedora-secondary This limits the number of simultaneous rsync clients to 10, at most 2 per IP (I had to kill a client with 10 open connections), establishes a max load above which it stops serving clients, and establishes a 10 minute I/O timeout (no I/O after 10 minutes, close the connection). These numbers are completely arbitrary, but should decrease the load seen on secondary1, which tonight was at 04:57:21 up 15 days, 11:42, 1 user, load average: 95.35, 136.54, 99.04 Acks please. Thanks, Matt -- Matt Domsch Linux Technology Strategist, Dell Office of the CTO linux.dell.com & www.dell.com/linux

4 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

infrastructure November 2008