Re: Error while retiring breathe

[Dave Johansen]

On Thu, Apr 7, 2016 at 8:44 AM, Kevin Fenzi  wrote:

> On Wed, 6 Apr 2016 21:09:11 -0700
> Dave Johansen  wrote:
>
> > I'm renaming breathe [1] to python-breathe [2]. I just tried to retire
> > breathe in f22 using the instructions on the wiki [3] and got the
> > following error:
> > Could not retire package: Error while decoding JSON: Expecting value:
> > line 1 column 1 (char 0)
> >
> > Am I doing something wrong?
>
> This seems to be a bug in pkgdb's openid handling that we are having
> trouble tracking down to fix. ;(
>
> Workaround:
>
> rm -f ~/.fedora/openidbaseclient-sessions.cache
>
> and re-run the retire.
>
> The bug is:
> https://bugzilla.redhat.com/show_bug.cgi?id=1317579


When trying that, I got this error:
$ fedpkg retire "Renamed to python-breathe"
dead.package found, package probably already retired - will not remove
files from git or overwrite existing dead.package file
Everything up-to-date
FAS password for user daveisfera:
Could not retire package: HTTPSConnectionPool(host='admin.fedoraproject.org',
port=443): Max retries exceeded with url: /pkgdb//api/package/retire/
(Caused by ResponseError('too many 500 error responses',))
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora rawhide compose report: 20160408.n.2 changes

[Fedora Rawhide Report]

OLD: Fedora-Rawhide-20160408.n.1
NEW: Fedora-Rawhide-20160408.n.2

= SUMMARY =
Added packages:  4
Dropped packages:0
Upgraded packages:   55
Downgraded packages: 0

Size of added packages:  4.62 MiB
Size of dropped packages:0.00 B
Size of upgraded packages:   257.14 MiB
Size of downgraded packages: 0.00 B

Size change of upgraded packages:   -8.56 MiB
Size change of downgraded packages: 0.00 B

= ADDED PACKAGES =
Package: chck-0-1.20160408git2efd6cd.fc25
Summary: Collection of C utilities
RPMs:chck chck-devel
Size:343104 bytes

Package: mkdocs-bootswatch-0.4.0-1.fc25
Summary: Bootswatch themes for MkDocs
RPMs:mkdocs-bootswatch
Size:188274 bytes

Package: nacl-gcc-4.4.3-17.20150504gitf80d6b9.fc25
Summary: C and C++ compilers for nacl
RPMs:nacl-gcc
Size:4020414 bytes

Package: plasma-integration-5.6.1-1.fc25
Summary: Qt Platform Theme integration plugin for Plasma
RPMs:plasma-integration
Size:287518 bytes


= DROPPED PACKAGES =

= UPGRADED PACKAGES =
Package:  beust-jcommander-1.47-3.fc25
Old package:  beust-jcommander-1.47-3.fc24
Summary:  Java framework for parsing command line parameters
RPMs: beust-jcommander beust-jcommander-javadoc
Size: 141696 bytes
Size change:  -2544 bytes

Package:  bluedevil-5.6.1-1.fc25
Old package:  bluedevil-5.5.5-1.fc25
Summary:  Bluetooth stack for KDE
RPMs: bluedevil
Size: 1224658 bytes
Size change:  -4688 bytes
Changelog:
  * Fri Apr 08 2016 Rex Dieter  - 5.6.1-1
  - 5.6.1


Package:  breeze-gtk-5.6.1-1.fc25
Old package:  breeze-gtk-5.5.5-1.fc25
Summary:  Breeze widget theme for Gtk2 and Gtk3
RPMs: breeze-gtk
Size: 1341618 bytes
Size change:  -69312 bytes
Changelog:
  * Fri Apr 08 2016 Rex Dieter  - 5.6.1-1
  - 5.6.1


Package:  checkpolicy-2.5-2.fc25
Old package:  checkpolicy-2.5-1.fc24
Summary:  SELinux policy compiler
RPMs: checkpolicy
Size: 889842 bytes
Size change:  -5344 bytes
Changelog:
  * Fri Apr 08 2016 Petr Lautrbach  - 2.5-2
  - Add support for portcon dccp protocol


Package:  ed-1.13-1.fc25
Old package:  ed-1.12-2.fc24
Summary:  The GNU line editor
RPMs: ed
Size: 231274 bytes
Size change:  -2972 bytes
Changelog:
  * Tue Apr 05 2016 Karsten Hopp  1.13-1
  - update to 1.13


Package:  eog-3.20.0-2.fc25
Old package:  eog-3.20.0-1.fc25
Summary:  Eye of GNOME image viewer
RPMs: eog eog-devel eog-tests
Size: 11903286 bytes
Size change:  -636 bytes
Changelog:
  * Fri Apr 08 2016 Debarshi Ray  - 3.20.0-2
  - Prevent a crash when queueing a new draw (GNOME #665897)


Package:  gap-pkg-genss-1.6.4-1.fc25
Old package:  gap-pkg-genss-1.6.3-2.fc24
Summary:  Randomized Schreier-Sims algorithm
RPMs: gap-pkg-genss
Size: 322894 bytes
Size change:  -824 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.6.4-1
  - New upstream version


Package:  gap-pkg-gpd-1.43-1.fc25
Old package:  gap-pkg-gpd-1.34-2.fc24
Summary:  Groupoids, group graphs, and groupoid graphs
RPMs: gap-pkg-gpd
Size: 519226 bytes
Size change:  19460 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.43-1
  - New upstream version (bz 1284892)


Package:  gap-pkg-orb-4.7.6-1.fc25
Old package:  gap-pkg-orb-4.7.5-2.fc24
Summary:  Methods to enumerate orbits in GAP
RPMs: gap-pkg-orb
Size: 2126406 bytes
Size change:  -5168 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 4.7.6-1
  - New upstream version (bz 1315679)


Package:  gap-pkg-semigroups-2.7.4-1.fc25
Old package:  gap-pkg-semigroups-2.6-2.fc24
Summary:  GAP methods for semigroups
RPMs: gap-pkg-semigroups
Size: 1335734 bytes
Size change:  39788 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 2.7.4-1
  - New upstream version (bz 1287388)


Package:  gap-pkg-spinsym-1.5-5.fc25
Old package:  gap-pkg-spinsym-1.5-4.fc24
Summary:  GAP package for Brauer tables of spin-symmetric groups
RPMs: gap-pkg-spinsym
Size: 401030 bytes
Size change:  -1080 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.5-5
  - Rebuild for gap 4.8.3


Package:  jackcess-2.1.3-1.fc25
Old package:  jackcess-2.1.2-2.fc24
Summary:  Java library for reading from and writing to MS Access databases
RPMs: jackcess jackcess-javadoc
Size: 1128492 bytes
Size change:  608 bytes
Changelog:
  * Fri Apr 08 2016 gil cattaneo  2.1.2-3
  - rebuilt with bcprov 1.54

  * Fri Apr 08 2016 gil cattaneo  2.1.3-1
  - update to 2.1.3


Package:  jackcess-encrypt-2.1.1-1.fc25
Old package:  jackcess-encrypt-2.1.0-3.fc25
Summary:  Java implementation of the encryption service for MS Access
RPMs: jackcess-encrypt jackcess-encrypt-javadoc
Size: 173784 bytes
Size change:  6372 bytes

Package:  jasypt-1.9.2-4.fc25
Old package:  jasypt-1.9.2-3.fc24
Summary:  Java Simplified Encryption
RPMs: jasypt jasypt

Fedora 24-20160408.n.1 compose check report

[Fedora compose checker]

Missing expected images:

Cloud_base raw-xz x86_64
Cloud_base raw-xz i386
Atomic raw-xz x86_64

Images in this compose but not 24-20160408.n.0:

Kde live i386
Xfce live x86_64
Mate live i386
Mate live x86_64
Scientific_kde live x86_64
Kde live x86_64
Jam_kde live x86_64
Cinnamon live i386
Games live x86_64
Jam_kde live i386
Scientific_kde live i386
Astronomy_kde live i386
Astronomy_kde live x86_64
Games live i386
Xfce live i386
Workstation live x86_64
Robotics live x86_64
Workstation live i386
Robotics live i386
Cinnamon live x86_64

No images in 24-20160408.n.0 but not this.

Failed openQA tests: 7/63 (x86_64), 16/17 (i386)

ID: 12361   Test: x86_64 Server-dvd-iso base_service_manipulation
URL: https://openqa.fedoraproject.org/tests/12361
ID: 12360   Test: x86_64 Server-dvd-iso base_services_start
URL: https://openqa.fedoraproject.org/tests/12360
ID: 12359   Test: x86_64 Server-dvd-iso base_selinux
URL: https://openqa.fedoraproject.org/tests/12359
ID: 12352   Test: i386 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/12352
ID: 12350   Test: i386 universal upgrade_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/12350
ID: 12349   Test: i386 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/12349
ID: 12348   Test: i386 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/12348
ID: 12347   Test: i386 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/12347
ID: 12346   Test: i386 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/12346
ID: 12345   Test: i386 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/12345
ID: 12344   Test: i386 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/12344
ID: 12343   Test: i386 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/12343
ID: 12342   Test: i386 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/12342
ID: 12307   Test: x86_64 universal install_kickstart_hdd
URL: https://openqa.fedoraproject.org/tests/12307
ID: 12301   Test: x86_64 universal install_delete_partial@uefi
URL: https://openqa.fedoraproject.org/tests/12301
ID: 12294   Test: i386 Workstation-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12294
ID: 12293   Test: i386 Server-dvd-iso install_default
URL: https://openqa.fedoraproject.org/tests/12293
ID: 12292   Test: i386 Workstation-live-iso install_default
URL: https://openqa.fedoraproject.org/tests/12292
ID: 12291   Test: i386 Server-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12291
ID: 12285   Test: x86_64 Workstation-live-iso install_default@uefi
URL: https://openqa.fedoraproject.org/tests/12285
ID: 12284   Test: x86_64 Workstation-live-iso install_default_upload
URL: https://openqa.fedoraproject.org/tests/12284
ID: 12283   Test: i386 Everything-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12283
ID: 12282   Test: i386 KDE-live-iso install_default
URL: https://openqa.fedoraproject.org/tests/12282

Passed openQA tests: 53/63 (x86_64), 1/17 (i386)

Skipped openQA tests: 3 of 80
-- 
Mail generated by check-compose:
https://git.fedorahosted.org/cgit/fedora-qa.git/tree/check-compose
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora Rawhide-20160408.n.1 compose check report

[Fedora compose checker]

Missing expected images:

Kde live i386
Workstation live i386
Kde live x86_64
Cloud_base raw-xz x86_64
Cloud_base raw-xz i386
Atomic raw-xz x86_64
Kde raw-xz armhfp
Workstation live x86_64

No images in this compose but not Rawhide-20160408.n.0

Images in Rawhide-20160408.n.0 but not this:

Docker_base docker x86_64

Failed openQA tests: 5/53 (x86_64), 15/15 (i386)

ID: 12272   Test: i386 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/12272
ID: 12271   Test: i386 universal upgrade_2_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/12271
ID: 12270   Test: i386 universal upgrade_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/12270
ID: 12269   Test: i386 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/12269
ID: 12268   Test: i386 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/12268
ID: 12267   Test: i386 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/12267
ID: 12266   Test: i386 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/12266
ID: 12265   Test: i386 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/12265
ID: 12264   Test: i386 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/12264
ID: 12263   Test: i386 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/12263
ID: 12262   Test: i386 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/12262
ID: 12258   Test: x86_64 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/12258
ID: 12244   Test: x86_64 universal install_kickstart_user_creation
URL: https://openqa.fedoraproject.org/tests/12244
ID: 12237   Test: x86_64 universal install_kickstart_firewall_configured
URL: https://openqa.fedoraproject.org/tests/12237
ID: 12235   Test: x86_64 universal install_european_language
URL: https://openqa.fedoraproject.org/tests/12235
ID: 12227   Test: x86_64 universal install_kickstart_hdd
URL: https://openqa.fedoraproject.org/tests/12227
ID: 12215   Test: i386 Server-dvd-iso install_default
URL: https://openqa.fedoraproject.org/tests/12215
ID: 12209   Test: i386 Everything-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12209
ID: 12208   Test: i386 Server-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12208
ID: 12207   Test: i386 Workstation-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12207

Passed openQA tests: 48/53 (x86_64)

-- 
Mail generated by check-compose:
https://git.fedorahosted.org/cgit/fedora-qa.git/tree/check-compose
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora 24 compose report: 20160408.n.1 changes

[Fedora Branched Report]

OLD: Fedora-24-20160408.n.0
NEW: Fedora-24-20160408.n.1

= SUMMARY =
Added packages:  1
Dropped packages:0
Upgraded packages:   74
Downgraded packages: 0

Size of added packages:  484.57 KiB
Size of dropped packages:0.00 B
Size of upgraded packages:   686.37 MiB
Size of downgraded packages: 0.00 B

Size change of upgraded packages:   -2.55 MiB
Size change of downgraded packages: 0.00 B

= ADDED PACKAGES =
Package: ghc-pipes-safe-2.2.2-1.fc24
Summary: Safety for the pipes ecosystem
RPMs:ghc-pipes-safe ghc-pipes-safe-devel
Size:496204 bytes


= DROPPED PACKAGES =

= UPGRADED PACKAGES =
Package:  GeoIP-GeoLite-data-2016.04-1.fc24
Old package:  GeoIP-GeoLite-data-2016.03-1.fc24
Summary:  Free GeoLite IP geolocation country database
RPMs: GeoIP-GeoLite-data GeoIP-GeoLite-data-extra
Size: 25373356 bytes
Size change:  -89132 bytes
Changelog:
  * Wed Apr 06 2016 Paul Howarth  - 2016.04-1
  - Update to April 2016 databases


Package:  NetworkManager-1:1.2.0-0.8.rc1.fc24
Old package:  NetworkManager-1:1.2.0-0.8.beta3.fc24
Summary:  Network connection manager and user applications
RPMs: NetworkManager NetworkManager-adsl NetworkManager-bluetooth 
NetworkManager-config-connectivity-fedora NetworkManager-config-server 
NetworkManager-glib NetworkManager-glib-devel NetworkManager-libnm 
NetworkManager-libnm-devel NetworkManager-team NetworkManager-tui 
NetworkManager-wifi NetworkManager-wwan
Size: 21673526 bytes
Size change:  279880 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1:1.2.0-0.7.rc1
  - Update to NetworkManager 1.2-rc1


Package:  NetworkManager-fortisslvpn-1.2.0-0.4.rc1.fc24
Old package:  NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24
Summary:  NetworkManager VPN plugin for Fortinet compatible SSLVPN
RPMs: NetworkManager-fortisslvpn NetworkManager-fortisslvpn-gnome
Size: 315216 bytes
Size change:  532 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1.2.0-0.4.rc1
  - Update to NetworkManager-fortisslvpn 1.2-rc1


Package:  NetworkManager-libreswan-1.2.0-0.4.rc1.fc24
Old package:  NetworkManager-libreswan-1.2.0-0.4.beta3.fc24
Summary:  NetworkManager VPN plug-in for IPsec VPN
RPMs: NetworkManager-libreswan NetworkManager-libreswan-gnome
Size: 425408 bytes
Size change:  -72 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1.2.0-0.4.rc1
  - Update to NetworkManager-libreswan 1.2-rc1


Package:  NetworkManager-openconnect-1.2.0-0.3.rc1.fc24
Old package:  NetworkManager-openconnect-1.2.0-0.3.beta3.fc24
Summary:  NetworkManager VPN plugin for openconnect
RPMs: NetworkManager-openconnect
Size: 1229558 bytes
Size change:  240 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1:1.2.0-0.3.rc1
  - Update to NetworkManager-openconnect 1.2-rc1


Package:  NetworkManager-openvpn-1:1.2.0-0.3.rc1.fc24
Old package:  NetworkManager-openvpn-1:1.2.0-0.3.beta3.fc24
Summary:  NetworkManager VPN plugin for OpenVPN
RPMs: NetworkManager-openvpn NetworkManager-openvpn-gnome
Size: 874660 bytes
Size change:  13532 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1:1.2.0-0.3.rc1
  - Update to NetworkManager-openvpn 1.2-rc1


Package:  NetworkManager-pptp-1:1.2.0-0.3.rc1.fc24
Old package:  NetworkManager-pptp-1:1.2.0-0.3.beta3.fc24
Summary:  NetworkManager VPN plugin for PPTP
RPMs: NetworkManager-pptp NetworkManager-pptp-gnome
Size: 539364 bytes
Size change:  520 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1:1.2.0-0.3.rc1
  - Update to NetworkManager-pptp 1.2-rc1


Package:  NetworkManager-vpnc-1:1.2.0-0.4.rc1.fc24
Old package:  NetworkManager-vpnc-1:1.2.0-0.4.beta3.fc24
Summary:  NetworkManager VPN plugin for vpnc
RPMs: NetworkManager-vpnc NetworkManager-vpnc-gnome
Size: 599500 bytes
Size change:  228 bytes
Changelog:
  * Tue Apr 05 2016 Lubomir Rintel  - 1:1.2.0-0.4.rc1
  - Update to NetworkManager-vpnc 1.2-rc1


Package:  bijiben-3.20.0-2.fc24
Old package:  bijiben-3.20.0-1.fc24
Summary:  Simple Note Viewer
RPMs: bijiben
Size: 1442122 bytes
Size change:  -4156 bytes
Changelog:
  * Sun Apr 03 2016 Mathieu Bridon  - 3.20.0-2
  - Drop the Zeitgeist dependency.


Package:  bip-0.8.9-10.fc24
Old package:  bip-0.8.9-9.fc24
Summary:  IRC Bouncer
RPMs: bip
Size: 422826 bytes
Size change:  -256 bytes
Changelog:
  * Thu Mar 31 2016 Brian C. Lane  0.8.9-10
  - Use %{_tmpfilesdir} macro instead of /etc/tmpfiles.d


Package:  catfish-1.4.2-1.fc24
Old package:  catfish-1.4.1-1.fc24
Summary:  A handy file search tool
RPMs: catfish
Size: 177998 bytes
Size change:  -376 bytes
Changelog:
  * Mon Apr 04 2016 Mamoru TASAKA  - 1.4.2-1
  - 1.4.2


Package:  ccsm-1:0.8.12.3.0-2.fc24
Old package:  ccsm-1:0.8.12.3.0-1.fc24
Summary:  Plugin and configuration tool - Compiz Fusion Project
RPMs

[Test-Announce] 2016-04-11 @ 15:00 UTC - Fedora QA Meeting

[Adam Williamson]

# Fedora Quality Assurance Meeting
# Date: 2016-04-11
# Time: 15:00 UTC
(https://fedoraproject.org/wiki/Infrastructure/UTCHowto)
# Location: #fedora-meeting on irc.freenode.net

Greetings testers!

It's meeting time again on Monday! We have a few follow ups from last
week and an upcoming Test Day, so we can have a quick meeting to check
in. I'm hoping we'll be done in 30-40 minutes so we can have a break
before blocker review.

If anyone has any other items for the agenda, please reply to this
email and suggest them! Thanks.

== Proposed Agenda Topics ==

1. Previous meeting follow-up
   * sumantro and arvind (new RH interns) to set up Test Day for Fedora
     Media Writer before Beta freeze
   * adamw and pschindl to oversee the Test Day and make sure planning
     is well underway by next week (2016-04-11), otherwise step in
   * adamw to get dgilmore to chime in on the ticket with his thoughts
2. Fedora 24 status
3. Test Day status
4. Open Floor
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net
___
test-announce mailing list
test-annou...@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/test-annou...@lists.fedoraproject.org
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

[Test-Announce] 2016-04-04 @ 16:00 UTC - Fedora 24 Blocker Review

[Adam Williamson]

# F24 Blocker Review meeting
# Date: 2016-04-11
# Time: 16:00 UTC
# Location: #fedora-blocker-review on irc.freenode.net

Hi folks! We have a few proposed blockers to review, so let's take a
look at them. There is 1 proposed Beta blocker and there are 2 proposed
Final blockers...so it might be a short meeting! (OK, OK, famous last
words).

If you have time this weekend, you can take a look at the proposed or
accepted blockers before the meeting -  the full lists can be found
here: https://qa.fedoraproject.org/blockerbugs/ . Remember to check
each outstanding milestone (Beta and Final).

We'll be evaluating these bugs to see if they violate any of the 
Release Criteria and warrant the blocking of a release if they're not 
fixed. Information on the release criteria for F24 can be found on the 
wiki [0].

For more information about the Blocker and Freeze exception process, 
check out these links:
 - https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process
 - https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process

And for those of you who are curious how a Blocker Review Meeting 
works - or how it's supposed to go and you want to run one - check out 
the SOP on the wiki:
 - https://fedoraproject.org/wiki/QA:SOP_Blocker_Bug_Meeting

Have a good weekend and see you on Monday!

[0] https://fedoraproject.org/wiki/Fedora_Release_Criteria
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net
___
test-announce mailing list
test-annou...@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/test-annou...@lists.fedoraproject.org
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora rawhide compose report: 20160408.n.1 changes

[Fedora Rawhide Report]

OLD: Fedora-Rawhide-20160408.n.0
NEW: Fedora-Rawhide-20160408.n.1

= SUMMARY =
Added packages:  0
Dropped packages:0
Upgraded packages:   80
Downgraded packages: 0

Size of added packages:  0.00 B
Size of dropped packages:0.00 B
Size of upgraded packages:   1.13 GiB
Size of downgraded packages: 0.00 B

Size change of upgraded packages:   4.32 MiB
Size change of downgraded packages: 0.00 B

= ADDED PACKAGES =

= DROPPED PACKAGES =

= UPGRADED PACKAGES =
Package:  GAPDoc-1.5.1-10.fc25
Old package:  GAPDoc-1.5.1-9.fc24
Summary:  GAP documentation tool
RPMs: GAPDoc GAPDoc-latex
Added RPMs:   GAPDoc-latex
Size: 1401740 bytes
Size change:   bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.5.1-10
  - Rebuild for gap 4.8.3
  - Split out LaTeX dependencies into a -latex subpackage


Package:  apache-poi-3.14-1.fc25
Old package:  apache-poi-3.13-2.fc24
Summary:  The Java API for Microsoft Documents
RPMs: apache-poi apache-poi-javadoc
Size: 14021336 bytes
Size change:  650084 bytes
Changelog:
  * Wed Mar 16 2016 gil cattaneo  3.14-1
  - Update to 3.14


Package:  apacheds-2.0.0-0.3.M21.fc25
Old package:  apacheds-2.0.0-0.2.M21.fc24
Summary:  Apache Directory Server
RPMs: apacheds apacheds-core apacheds-http-integration apacheds-i18n 
apacheds-javadoc apacheds-kerberos apacheds-osgi apacheds-protocols 
apacheds-server apacheds-service apacheds-wrapper
Size: 4675922 bytes
Size change:  -1096 bytes
Changelog:
  * Fri Apr 08 2016 gil cattaneo  - 2.0.0-0.3.M21
  - rebuilt


Package:  atoum-2.6.1-1.fc25
Old package:  atoum-2.6.0-1.fc25
Summary:  PHP Unit Testing framework
RPMs: atoum
Size: 403198 bytes
Size change:  128 bytes
Changelog:
  * Fri Apr 08 2016 Remi Collet  - 2.6.1-1
  - update to 2.6.1


Package:  autossh-1.4e-3.fc25
Old package:  autossh-1.4e-2.fc24
Summary:  Utility to autorestart SSH tunnels
RPMs: autossh
Size: 105118 bytes
Size change:  2720 bytes
Changelog:
  * Wed Mar 23 2016 Ville Skytt  - 1.4e-3
  - Add systemd service


Package:  fontforge-20160404-2.fc25
Old package:  fontforge-20160404-1.fc25
Summary:  Outline and bitmap font editor
RPMs: fontforge fontforge-devel fontforge-doc
Size: 21308986 bytes
Size change:  4484 bytes
Changelog:
  * Wed Apr 06 2016 Parag Nemade  - 20160404-2
  - Move from python2 to python3 support


Package:  gap-4.8.3-1.fc25
Old package:  gap-4.7.9-2.fc24
Summary:  Computational discrete algebra
RPMs: gap gap-core gap-devel gap-libs gap-online-help gap-vim
Size: 59513566 bytes
Size change:  1781964 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 4.8.3-1
  - New upstream release


Package:  gap-pkg-aclib-1.2-5.fc25
Old package:  gap-pkg-aclib-1.2-4.fc24
Summary:  Almost Crystallographic groups library for GAP
RPMs: gap-pkg-aclib
Size: 255418 bytes
Size change:  -1008 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.2-5
  - Rebuild for gap 4.8.3


Package:  gap-pkg-alnuth-3.0.0-6.fc25
Old package:  gap-pkg-alnuth-3.0.0-5.fc24
Summary:  Algebraic number theory for GAP
RPMs: gap-pkg-alnuth
Size: 397246 bytes
Size change:  -1272 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 3.0.0-6
  - Rebuild for gap 4.8.3


Package:  gap-pkg-atlasrep-1.5.1-1.fc25
Old package:  gap-pkg-atlasrep-1.5.0-5.fc24
Summary:  GAP interface to the Atlas of Group Representations
RPMs: gap-pkg-atlasrep
Size: 24257610 bytes
Size change:  69028 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.5.1-1
  - New upstream version


Package:  gap-pkg-autodoc-2016.03.08-1.fc25
Old package:  gap-pkg-autodoc-2016.02.16-1.fc24
Summary:  Generate documentation from GAP source code
RPMs: gap-pkg-autodoc
Size: 405970 bytes
Size change:  29728 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 2016.03.08-1
  - New upstream version (bz 1314938)


Package:  gap-pkg-autpgrp-1.6-5.fc25
Old package:  gap-pkg-autpgrp-1.6-4.fc24
Summary:  Compute the automorphism group of a p-Group in GAP
RPMs: gap-pkg-autpgrp
Size: 198478 bytes
Size change:  -1268 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.6-5
  - Rebuild for gap 4.8.3


Package:  gap-pkg-browse-1.8.6-6.fc25
Old package:  gap-pkg-browse-1.8.6-5.fc24
Summary:  GAP browser for 2-dimensional arrays of data
RPMs: gap-pkg-browse
Size: 3860906 bytes
Size change:  -1792 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 1.8.6-6
  - Rebuild for gap 4.8.3


Package:  gap-pkg-carat-2.1.4-4.fc25
Old package:  gap-pkg-carat-2.1.4-3.fc24
Summary:  GAP interface to CARAT
RPMs: gap-pkg-carat
Size: 179034 bytes
Size change:  -1256 bytes
Changelog:
  * Thu Apr 07 2016 Jerry James  - 2.1.4-4
  - Rebuild for gap 4.8.3


Package:  gap-pkg-congruence-1.1.1-4.fc25
Old package

Planned Outage: buildsystem and related - 2016-04-12 21:00 UTC

[Kevin Fenzi]

 Planned Outage: buildsystem and related - 2016-04-12 21:00 UTC

 There will be an outage starting at 2016-04-12 21:00 UTC, which will
 last approximately 4 hours.

 To convert UTC to your local time, take a look at
 http://fedoraproject.org/wiki/Infrastructure/UTCHowto
 or run:

 date -d '2016-04-12 21:00 UTC'

 Reason for outage:

 We will be applying system updates and rebooting servers. During the
 outage window services may be up and down again as we reboot various
 servers.

 Affected Services:

 koji.fedoraproject.org
 pkgs.fedoraproject.org
 bodhi.fedoraproject.org
 apps.fedoraproject.org/koschei
 apps.fedoraproject.org/mdapi

 Services not listed are not affected by this outage.

 Contact Information:

 Ticket Link: https://fedorahosted.org/fedora-infrastructure/ticket/5226

 Please join #fedora-admin or #fedora-noc on irc.freenode.net or add
 comments to the ticket for this outage above.


pgpzrUceeTPA5.pgp
Description: OpenPGP digital signature
___
devel-announce mailing list
devel-annou...@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel-annou...@lists.fedoraproject.org
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: Summary/Minutes for today's FESCo meeting (2016-04-08)

[Matthew Miller]

On Sat, Apr 09, 2016 at 12:08:21AM +0530, Parag Nemade wrote:
> https://meetbot.fedoraproject.org/fedora-meeting/2016-04-08/fesco.2016-04-08-17.00.log.html

[...]
18:01:51  No one reads the FESCo minutes...

^ FALSE!

:)


-- 
Matthew Miller

Fedora Project Leader
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Summary/Minutes for today's FESCo meeting (2016-04-08)

[Parag Nemade]

===
#fedora-meeting: FESCO (2016-04-08)
===


Meeting started by paragan at 17:00:07 UTC. The full logs are available
at
https://meetbot.fedoraproject.org/fedora-meeting/2016-04-08/fesco.2016-04-08-17.00.log.html
.



Meeting summary
---
* init process  (paragan, 17:00:07)

* #1518 Software packaged in Fedora should not be allowed to implement
  DRM schemes that cannot be disabled  (paragan, 17:03:11)
  * LINK: https://fedorahosted.org/fesco/ticket/1518   (paragan,
17:03:12)
  * AGREED: FESCo asserts that Firefox in its current incarnation meets
its standard for Free Software for inclusion in Fedora. Other
packages may be proposed on a case-by-case basis (5, 0, 0)
(paragan, 17:11:47)

* #1565 Fedora schedule must continue to track core library ABI or risk
  serious ABI implications  (paragan, 17:13:32)
  * LINK: https://fedorahosted.org/fesco/ticket/1565   (paragan,
17:13:33)
  * AGREED: Fedora Schedule should always schedule mass rebuilds (if
needed) after glibc final freeze. (5, 1, 0)  (paragan, 18:12:30)
  * LINK: https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle
(nirik, 18:20:41)

* Next week's chair  (paragan, 18:28:46)
  * nirik to chair next week meeting  (paragan, 18:30:10)

* Open Floor  (paragan, 18:30:22)

Meeting ended at 18:34:44 UTC.




Action Items






Action Items, by person
---
* **UNASSIGNED**
  * (none)




People Present (lines said)
---
* sgallagh (94)
* dgilmore (71)
* paragan (65)
* codonell (61)
* nirik (34)
* number80 (19)
* zodbot (13)
* maxamillion (7)
* kalev (0)
* jwb (0)
* jsmith (0)

Generated by `MeetBot`_ 0.1.4

.. _`MeetBot`: http://wiki.debian.org/MeetBot
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Matthew Garrett]

On Fri, Apr 08, 2016 at 11:36:33AM +0200, Florian Weimer wrote:
> On 04/08/2016 10:28 AM, Matthew Garrett wrote:
> > With what we now know about malicious actors targeting the system boot 
> > chain (even down to the firmware), this kind of TPM-based work is a 
> > vital part of helping keep our users secure.
> 
> On the other hand, it can easily be abused to restrict user freedom.
> For example, video streaming sites might not be willing to serve content
> to users who cannot cryptographically prove they are running an approved
> operating system with an approved browser.

The practical issues around enforcing this kind of remote attestation 
have proven to be sufficiently intractable that literally nobody has 
ever ended up doing it (I thought Netflix had for ChromeOS devices - it 
turned out I was wrong).

> Remote attestation only works with a trusted counterpart who rejects
> access once a breach is detected.  Who do you expect to be the
> counterpart for Fedora users?  Is there anyone who offers such a service
> without also requiring to use their own operating system?

Openstack has some support for this, although I wouldn't recommend using 
it. The setup I'm envisaging is for server deployments within a single 
administrative domain - this way it's entirely under the control of 
whoever controls the machines anyway.

-- 
Matthew Garrett | mj...@srcf.ucam.org
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Matthew Garrett]

On Fri, Apr 08, 2016 at 09:23:07AM +, Petr Pisar wrote:

> I'm curious how you would predict hash of initramfs because it is
> generated on the host and depends on dracut configuration and presence
> of various optionally installed packages.

initrd is certainly a more difficult one. One thing we can do is work on 
making dracut builds reproducible - that way they should be consistent 
across identical machines in a cluster.

-- 
Matthew Garrett | mj...@srcf.ucam.org
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Matthew Garrett]

On Fri, Apr 08, 2016 at 09:09:23AM +, Gregory Maxwell wrote:

> The TPM style of remote attest is quite unfriendly to free software.
> It puts basically the entire operating system in the trusted domain,
> and you cannot change even a bit of it without "breaking the seal".
> So if you want any use of remote attest at all, there is a huge swath
> of your system which are are "compelled" under threat of loss of
> access to whatever functionality remote-attest was providing to make
> no modification-- or even, potentially, no upgrade to a very new or
> less common version.

Remote attestation is primarily useful within a single administrative 
domain. Outside that case it's far too easy to subvert (easiest 
approach: simply add a second TPM to your system and program whatever 
PCRs you want), and the privacy concerns remain sufficiently problematic 
that I don't see anybody pushing for it in the near future.

> I think any time invested to make remote attest of any kind work would
> better be spent on support for Intel SGX, which creates limited
> remote-attestable sandboxes which (assuming Intel made no mistakes :)
> ) have strong security and confidentiality regardless of what else is
> running on the system. These sandboxes also have no outside access
> except via limited channels, so (again assuming no mistakes/backdoors
> on Intel's part); and the published security model is stronger (e.g.
> encrypted ram) and more suitable for user-friendly uses (for example,
> it would be straight-forward to use SGX to implement a bitcoin wallet
> that could enforce user specified transfer limits, even against a
> total security compromise of the host-- and if the RA part is as
> usuable as it could be, even prove to third party auditors that your
> keys have these security properties (the RA functionality for SGX is
> not yet documented in public, AFAIK)).

SGX has some interesting properties, but it's unhelpful in the rather 
more common case of "I'm running a bunch of servers and I want to know 
that they're trustworthy before I give them access to resources". 
Rearchitecting a large number of apps into a more SGXy world is a far 
from trivial task.

-- 
Matthew Garrett | mj...@srcf.ucam.org
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: weakdeps and the buildroot

[Dennis Gilmore]

On Friday, April 8, 2016 1:02:40 PM CDT Vít Ondruch wrote:
> This applies just for Rawhide, right?
> 
> Vít
Nope,  we have no way to set it for just one target. everything using dnf has 
it set.

Dennis

> Dne 7.4.2016 v 18:40 Dennis Gilmore napsal(a):
> > Hi All,
> > 
> > Following the decision of FPC that weak deps must not be installed
> 
> into the
> 
> > buildroot[1] koji has been changed to set install_weak_deps to 0. What
> 
> this
> 
> > means is that some builds may fail due to missing things.  if you
> 
> encounter
> 
> > this the correct fix is to add BuildRequires to you package for
> 
> everything you
> 
> > explicitly need to build
> > 
> > Regards
> > 
> > Dennis
> > 
> > 
> > [1] https://meetbot.fedoraproject.org/fedora-meeting-1/2016-03-24/fpc.
> > 2016-03-24-16.01.log.html
> > 
> > 
> > ___
> > devel-announce mailing list
> > devel-annou...@lists.fedoraproject.org
> 
> http://lists.fedoraproject.org/admin/lists/devel-announce@lists.fedoraprojec
> t.org
> > --
> > devel mailing list
> > devel@lists.fedoraproject.org
> > http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org



signature.asc
Description: This is a digitally signed message part.
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora 24-20160408.n.0 compose check report

[Fedora compose checker]

Missing expected images:

Kde live i386
Workstation live i386
Kde live x86_64
Cloud_base raw-xz x86_64
Cloud_base raw-xz i386
Atomic raw-xz x86_64
Workstation live x86_64

No images in this compose but not 24-20160407.n.2

No images in 24-20160407.n.2 but not this.

Failed openQA tests: 3/53 (x86_64), 14/15 (i386)

ID: 12204   Test: x86_64 universal install_updates_img_local
URL: https://openqa.fedoraproject.org/tests/12204
ID: 12201   Test: i386 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/12201
ID: 12199   Test: i386 universal upgrade_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/12199
ID: 12198   Test: i386 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/12198
ID: 12197   Test: i386 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/12197
ID: 12196   Test: i386 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/12196
ID: 12195   Test: i386 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/12195
ID: 12194   Test: i386 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/12194
ID: 12193   Test: i386 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/12193
ID: 12192   Test: i386 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/12192
ID: 12191   Test: i386 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/12191
ID: 12190   Test: x86_64 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/12190
ID: 12172   Test: x86_64 universal install_kickstart_hdd
URL: https://openqa.fedoraproject.org/tests/12172
ID: 12148   Test: i386 Workstation-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12148
ID: 12147   Test: i386 Everything-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12147
ID: 12144   Test: i386 Server-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12144
ID: 12139   Test: i386 Server-dvd-iso install_default
URL: https://openqa.fedoraproject.org/tests/12139

Passed openQA tests: 50/53 (x86_64), 1/15 (i386)

-- 
Mail generated by check-compose:
https://git.fedorahosted.org/cgit/fedora-qa.git/tree/check-compose
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Colin Walters]

On Fri, Apr 8, 2016, at 05:36 AM, Florian Weimer wrote:

> Remote attestation only works with a trusted counterpart who rejects
> access once a breach is detected.  Who do you expect to be the
> counterpart for Fedora users?  Is there anyone who offers such a service
> without also requiring to use their own operating system?

A use case for this is having Kubernetes cluster masters request
attestation, and worker nodes provide it.

One could s/Kubernetes/any other clustering system/, but it's
a modern example.
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora Rawhide-20160408.n.0 compose check report

[Fedora compose checker]

Missing expected images:

Kde live i386
Workstation live i386
Kde live x86_64
Cloud_base raw-xz x86_64
Cloud_base raw-xz i386
Atomic raw-xz x86_64
Kde raw-xz armhfp
Workstation live x86_64

No images in this compose but not Rawhide-20160407.n.5

No images in Rawhide-20160407.n.5 but not this.

Failed openQA tests: 7/53 (x86_64), 15/15 (i386)

ID: 12133   Test: x86_64 universal install_updates_img_local
URL: https://openqa.fedoraproject.org/tests/12133
ID: 12129   Test: i386 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/12129
ID: 12128   Test: i386 universal upgrade_2_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/12128
ID: 12127   Test: i386 universal upgrade_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/12127
ID: 12126   Test: i386 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/12126
ID: 12125   Test: i386 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/12125
ID: 12124   Test: i386 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/12124
ID: 12123   Test: i386 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/12123
ID: 12122   Test: i386 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/12122
ID: 12121   Test: i386 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/12121
ID: 12120   Test: i386 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/12120
ID: 12119   Test: i386 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/12119
ID: 12118   Test: x86_64 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/12118
ID: 12110   Test: x86_64 universal install_kickstart_firewall_configured
URL: https://openqa.fedoraproject.org/tests/12110
ID: 12108   Test: x86_64 universal install_european_language
URL: https://openqa.fedoraproject.org/tests/12108
ID: 12101   Test: x86_64 universal upgrade_minimal_64bit
URL: https://openqa.fedoraproject.org/tests/12101
ID: 12100   Test: x86_64 universal install_kickstart_hdd
URL: https://openqa.fedoraproject.org/tests/12100
ID: 12089   Test: x86_64 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/12089
ID: 12076   Test: i386 Server-dvd-iso install_default
URL: https://openqa.fedoraproject.org/tests/12076
ID: 12071   Test: i386 Workstation-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12071
ID: 12070   Test: i386 Everything-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12070
ID: 12064   Test: i386 Server-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/12064

Passed openQA tests: 46/53 (x86_64)

-- 
Mail generated by check-compose:
https://git.fedorahosted.org/cgit/fedora-qa.git/tree/check-compose
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Colin Walters]

On Fri, Apr 8, 2016, at 05:23 AM, Petr Pisar wrote:

> I'm curious how you would predict hash of initramfs because it is
> generated on the host and depends on dracut configuration and presence
> of various optionally installed packages.

That's true for a system managed by yum/dnf, but rpm-ostree (as used by
Fedora Atomic Host), always uses host-independent initramfs images.
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: Schedule for Friday's FESCo Meeting (2016-04-08)

[Stephen Gallagher]

On 04/08/2016 12:30 AM, Parag Nemade wrote:
> Hi,
>Please note that I feel only one ticket is there in this week that
> need discussion. If any other existing open ticket need to be
> discussed then we can discuss that in the meeting but I am adding only
> one new ticket on the Agenda of this meeting.
> 
> 
> Following is the list of topics that will be discussed in the FESCo
> meeting Friday at 17:00UTC in #fedora-meeting on irc.freenode.net.
> 
> To convert UTC to your local time, take a look at
>   http://fedoraproject.org/wiki/UTCHowto
> 
> or run:
>   date -d '2016-04-08 17:00 UTC'
> 
> 
> Links to all tickets below can be found at:
> https://fedorahosted.org/fesco/report/9
> 
> = New business =
> 
> #topic #1565 Fedora schedule must continue to track core library ABI
> or risk serious ABI implications
> .fesco 1565
> https://fedorahosted.org/fesco/ticket/1565
> 

What happened to ticket 1518? I think we need to at least make a final decision
and assertion to answer the remaining question.




signature.asc
Description: OpenPGP digital signature
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora 24 compose report: 20160408.n.0 changes

[Fedora Branched Report]

OLD: Fedora-24-20160407.n.2
NEW: Fedora-24-20160408.n.0

= SUMMARY =
Added packages:  0
Dropped packages:0
Upgraded packages:   0
Downgraded packages: 0

Size of added packages:  0.00 B
Size of dropped packages:0.00 B
Size of upgraded packages:   0.00 B
Size of downgraded packages: 0.00 B

Size change of upgraded packages:   0.00 B
Size change of downgraded packages: 0.00 B

= ADDED PACKAGES =

= DROPPED PACKAGES =

= UPGRADED PACKAGES =

= DOWNGRADED PACKAGES =
Broken deps for armhfp
--
[IBSimu]
IBSimu-1.0.5-11.b.fc23.armv7hl requires libgsl.so.0
[IQmol]
IQmol-2.3.0-9.fc24.armv7hl requires libOpenMeshCore.so.3.2
IQmol-2.3.0-9.fc24.armv7hl requires libboost_iostreams.so.1.58.0
IQmol-2.3.0-9.fc24.armv7hl requires libboost_serialization.so.1.58.0
[ape]
ape-2.2.0-2.fc22.armv7hl requires libgsl.so.0
[bangarang]
bangarang-2.1-9.fc24.armv7hl requires libnepomuk.so.4
[coin-or-Bonmin]
coin-or-Bonmin-1.8.1-8.fc24.armv7hl requires libasl.so.1
coin-or-Bonmin-1.8.1-8.fc24.armv7hl requires libmp.so.1
[coin-or-Couenne]
coin-or-Couenne-0.5.2-6.fc23.armv7hl requires libasl.so.1
coin-or-Couenne-0.5.2-6.fc23.armv7hl requires libmp.so.1
[coin-or-OS]
coin-or-OS-2.9.3-5.fc23.armv7hl requires libasl.so.1
coin-or-OS-2.9.3-5.fc23.armv7hl requires libmp.so.1
[coot]
coot-0.8.2-1.fc24.armv7hl requires libgsl.so.0
[docker-registry]
docker-registry-0.9.1-5.fc24.noarch requires 
python-docker-registry-core >= 0:2.0.2-1
[eclipse-jbosstools]
eclipse-jbosstools-as-4.2.2-1.fc22.noarch requires 
osgi(org.eclipse.tm.terminal)
[ejabberd]
ejabberd-16.01-4.fc24.armv7hl requires erlang-asn1(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-cache_tab(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-compiler(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-crypto(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-eldap(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-erts(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-inets(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-jiffy(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-kernel(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-lager(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-mnesia(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-oauth2(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-odbc(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_iconv(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_mysql(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_pam(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_pgsql(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_sip(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_stringprep(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_stun(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_tls(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_utils(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_xml(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_yaml(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-p1_zlib(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-public_key(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-riak_client(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-sasl(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-ssl(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-stdlib(armv7hnl-32)
ejabberd-16.01-4.fc24.armv7hl requires erlang-syntax_tools(armv7hnl-32)
[erlang-basho_metrics]
erlang-basho_metrics-1.0.0-24.fc24.armv7hl requires 
erlang(erl_nif_version) = 0:2.10
erlang-basho_metrics-1.0.0-24.fc24.armv7hl requires 
erlang-erts(armv7hnl-32)
erlang-basho_metrics-1.0.0-24.fc24.armv7hl requires 
erlang-kernel(armv7hnl-32)
erlang-basho_metrics-1.0.0-24.fc24.armv7hl requires 
erlang-stdlib(armv7hnl-32)
[erlang-bitcask]
erlang-bitcask-1.6.3-10.fc24.armv7hl requires erlang(erl_nif_version) = 
0:2.10
erlang-bitcask-1.6.3-10.fc24.armv7hl requires erlang-erts(armv7hnl-32)
erlang-bitcask-1.6.3-10.fc24.armv7hl requires erlang-kernel(armv7hnl-32)
erlang-bitcask-1.6.3-10.fc24.armv7hl requires erlang-stdlib(armv7hnl-32)
[gcc-python-plugin]
gcc-python2-debug-plugin-0.15-2.fc24.armv7hl requires gcc = 
0:6.0.0-0.12.fc24
gcc-python2-plugin-0.15-2.fc24.armv7hl requires gcc = 0:6.0.0-0.12.f

Fwd: Broken dependencies: trustedqsl

[Richard Shaw]

I not sure what's going on here. I keep getting these emails but it's
showing fc24 but I've built a rawhide package since then (showing fc25 dist
tag):

http://koji.fedoraproject.org/koji/buildinfo?buildID=750028



trustedqsl has broken dependencies in the rawhide tree:
On x86_64:
tqsllib-devel-2.4-11.fc24.1.x86_64 requires tqsllib(x86-64) =
0:2.4-11.fc24
On i386:
tqsllib-devel-2.4-11.fc24.1.i686 requires tqsllib(x86-32) =
0:2.4-11.fc24
On armhfp:
tqsllib-devel-2.4-11.fc24.1.armv7hl requires tqsllib(armv7hl-32) =
0:2.4-11.fc24
Please resolve this as soon as possible.
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: No Rich boolean deps in Requires/Recommends for f24

[Honza Šilhan]

> From: "Kevin Fenzi" 
> On Thu, 7 Apr 2016 07:54:36 -0400
> Neal Gompa  wrote:
> > On Thu, Apr 7, 2016 at 7:37 AM, Stephen Gallagher
> >  wrote:
> > > On 04/06/2016 04:49 AM, Jason L Tibbitts III wrote:
> > >>> "PP" == Petr Pisar  writes:
> > >>  
> > >> PP> This changes meaning regarding to F25. Previous text banned
> > >> PP> rich strong dependencies in F24 only. This current text
> > >> PP> extends the ban to all Fedoras.
> > >>  
> > >> PP> Is that intentional?
> > >>
> > >> It's currently correct according to FESCo's request as I
> > >> understood it. While f25 might still be able to compose, if the
> > >> tools aren't fixed before the next branch then we'll have to back
> > >> things out or end up back in a situation where we can't mash
> > >> updates.
> > >
> > > I'd say it's fine for now. Our *hope* is that we will be able to
> > > support them for F25 at some point, but composes *right now*
> > > probably don't work, so I think this wording is fine.
>
> > So you don't expect that mash could be fixed/replaced before the F24
> > release in June, then?

I've talked to relengs and port of mash [1] will not happen any time soon.
In best case it should make composes for F25.

This is more complicated as pungi, mash and signed repos are linked
together and the replacement of whole releng tools will not happen in a
day. They plan bigger refactoring during the migration of these tools
and replace them one by one. We are trying to allocate resources to make
this done.

Pungi-5 is almost ready to replace current yum based version and making
a library from mash using DNF would probably take 1 man-month.


Honza

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1156546
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: weakdeps and the buildroot

[Vít Ondruch]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

This applies just for Rawhide, right?

Vít



Dne 7.4.2016 v 18:40 Dennis Gilmore napsal(a):
> Hi All,
>
> Following the decision of FPC that weak deps must not be installed
into the
> buildroot[1] koji has been changed to set install_weak_deps to 0. What
this
> means is that some builds may fail due to missing things.  if you
encounter
> this the correct fix is to add BuildRequires to you package for
everything you
> explicitly need to build
>
> Regards
>
> Dennis
>
>
> [1] https://meetbot.fedoraproject.org/fedora-meeting-1/2016-03-24/fpc.
> 2016-03-24-16.01.log.html
>
>
> ___
> devel-announce mailing list
> devel-annou...@lists.fedoraproject.org
>
http://lists.fedoraproject.org/admin/lists/devel-annou...@lists.fedoraproject.org
>
>
> --
> devel mailing list
> devel@lists.fedoraproject.org
> http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQIcBAEBCAAGBQJXB4/JAAoJEAzgnueZF7h8cT0P/jP4j18X6+aJ29K21FtsX9ND
N1kgEA4KzEfhPjawKgrN8s3qyc72KHZIQK8FBjLI2ZRx77NifwE96nOdH4JpGSpQ
OFosp6DCiYw0GEE9Tl5E23GNGe1hxrSFk4xKXk8djMU5F2+oKlbwbguZ3SL2felJ
smm7YayJ2BFK6grg8hgVcFQrhxlefbM/AS2ZRJhVJLFR4PeVv2OH5pZFcqW/tIik
ipKfYFZVj9NMyEro7HD5vV3dqqVrbz7dqo0WjTcAsk9aRcPP3RYnCK8f+7vnjfzo
7c5i1x783qEKwrlbkDY+zdPLhJgBSs5sOaMCmdbherQ+SRf1e9DWpxC7H97sDBrZ
vWtyS9ZpIoZAaYv2RLy/7QG6U5H11I/kAG+U33YCVk4kPA158RIQHHyfbHPvRLg7
ytswBwnAWV8vR7lwu8Dn2CLs59JSk/eT/n23io5MKXD6UM7fYt8RGuUQ1v8Ki4e5
F6vA579Z8p4TChF+Cc2uHE9srjuZjG1O2BGdjsBSwKXiiNeYuUKfJwYEfQRf4+VT
/JZsXo3Ogt3iMw4W/gZO2idWTQ3EPgZL5Umk+1i4cx0T+sGW9QxwUwOxHURVuN1R
6xkbQWMzQdXuzOVpOgzw7iONte9iDNuWWdtBVRbeiqcDDkfLeu3qua9qLdyfoaqM
auBnsfmEjjQACwnLEg1C
=f7lG
-END PGP SIGNATURE-

--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora rawhide compose report: 20160408.n.0 changes

[Fedora Rawhide Report]

OLD: Fedora-Rawhide-20160407.n.5
NEW: Fedora-Rawhide-20160408.n.0

= SUMMARY =
Added packages:  1
Dropped packages:1
Upgraded packages:   19
Downgraded packages: 0

Size of added packages:  340.24 KiB
Size of dropped packages:762.26 KiB
Size of upgraded packages:   324.88 MiB
Size of downgraded packages: 0.00 B

Size change of upgraded packages:   7.50 MiB
Size change of downgraded packages: 0.00 B

= ADDED PACKAGES =
Package: ndctl-52-1.fc25
Summary: Manage "libnvdimm" subsystem devices (Non-volatile Memory)
RPMs:ndctl ndctl-devel ndctl-libs
Size:348402 bytes


= DROPPED PACKAGES =
Package: cryptobone-1.0.1-10.fc25
Summary: Secure Communication Under Your Control
RPMs:cryptobone
Size:780550 bytes


= UPGRADED PACKAGES =
Package:  bouncycastle-mail-1.54-1.fc25
Old package:  bouncycastle-mail-1.52-7.fc24
Summary:  S/MIME and CMS libraries for Bouncy Castle
RPMs: bouncycastle-mail bouncycastle-mail-javadoc
Size: 238012 bytes
Size change:  40240 bytes
Changelog:
  * Thu Apr 07 2016 Mat Booth  - 1.54-1
  - Update to 1.54, fixes rhbz#1275175
  - Install with mvn_install
  - Allow tests to run


Package:  bouncycastle-pg-1.54-1.fc25
Old package:  bouncycastle-pg-1.52-9.fc24
Summary:  Bouncy Castle OpenPGP API
RPMs: bouncycastle-pg bouncycastle-pg-javadoc
Size: 610896 bytes
Size change:  5100 bytes
Changelog:
  * Thu Apr 07 2016 Mat Booth  - 1.54-1
  - Update to 1.54
  - Fix most of the test failures


Package:  bouncycastle-pkix-1.54-1.fc25
Old package:  bouncycastle-pkix-1.52-8.fc24
Summary:  Bouncy Castle PKIX, CMS, EAC, TSP, PKCS, OCSP, CMP, and CRMF APIs
RPMs: bouncycastle-pkix bouncycastle-pkix-javadoc
Size: 1265924 bytes
Size change:  48784 bytes
Changelog:
  * Thu Apr 07 2016 Mat Booth  - 1.54-1
  - Update to 1.54, fixes rhbz#1275172
  - Install with mvn_install
  - Move some tests that were erroneously in the main jar,
avoids a runtime dep on junit in OSGi metadata
  - Fix most of the test failures


Package:  kernel-4.6.0-0.rc2.git3.1.fc25
Old package:  kernel-4.6.0-0.rc2.git2.1.fc25
Summary:  The Linux kernel
RPMs: kernel kernel-PAE kernel-PAE-core kernel-PAE-devel 
kernel-PAE-modules kernel-PAE-modules-extra kernel-core kernel-cross-headers 
kernel-devel kernel-headers kernel-lpae kernel-lpae-core kernel-lpae-devel 
kernel-lpae-modules kernel-lpae-modules-extra kernel-modules 
kernel-modules-extra kernel-tools kernel-tools-libs kernel-tools-libs-devel 
perf python-perf
Size: 282496372 bytes
Size change:  1092 bytes
Changelog:
  * Thu Apr 07 2016 Justin M. Forbes  - 
4.6.0-0.rc2.git3.1
  - Linux v4.6-rc2-88-gc4004b0


Package:  libcdaudio-0.99.12p2-23.fc25
Old package:  libcdaudio-0.99.12p2-22.fc24
Summary:  Control operation of a CD-ROM when playing audio CDs
RPMs: libcdaudio libcdaudio-devel
Size: 202036 bytes
Size change:  12988 bytes
Changelog:
  * Thu Apr 07 2016 S??rgio Basto  - 0.99.12p2-23
  - Add license tag.
  - Add patch libcdaudio-0.99.12-segfault.patch, from
https://sourceforge.net/p/libcdaudio/patches/5/
  - Spec clean-up.


Package:  libmlx4-1.0.6-5.fc25
Old package:  libmlx4-1.0.6-4.fc24
Summary:  Mellanox ConnectX InfiniBand HCA Userspace Driver
RPMs: libmlx4 libmlx4-static
Size: 184940 bytes
Size change:  -13240 bytes
Changelog:
  * Thu Mar 31 2016 Honggang Li  - 1.0.6-5
  - Rebuild against latest libibverbs
  - Backport RHEL7 patches
  - Move modprobe and setup script to rdma package


Package:  libreswan-3.17-1.fc25
Old package:  libreswan-3.16-1.fc24
Summary:  IPsec implementation with IKEv1 and IKEv2 keying protocols
RPMs: libreswan
Size: 3424050 bytes
Size change:  -10256 bytes
Changelog:
  * Thu Feb 04 2016 Fedora Release Engineering  - 
3.16-1.1
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

  * Thu Apr 07 2016 Paul Wouters  - 3.17-1
  - Updated to 3.17 for CVE-2016-3071
  - Disable LIBCAP_NG as it prevents unbound-control from working properly
  - Temporarilly disable WERROR due to a few minor known issues


Package:  mapnik-3.0.10-2.fc25
Old package:  mapnik-3.0.10-1.fc25
Summary:  Free Toolkit for developing mapping applications
RPMs: mapnik mapnik-demo mapnik-devel mapnik-static mapnik-utils
Size: 17563394 bytes
Size change:  -50468 bytes
Changelog:
  * Thu Apr 07 2016 Tom Hughes  - 3.0.10-2
  - Add patch for regression round-tripping empty strings
  - Require libxml2-devel from mapnik-devel


Package:  maven-3.3.9-4.fc25
Old package:  maven-3.3.9-3.fc24
Summary:  Java project management and project comprehension tool
RPMs: maven maven-javadoc
Size: 2921856 bytes
Size change:  -2028 bytes
Changelog:
  * Thu Apr 07 2016 Mikolaj Izdebski  - 3.3.9-4
  - Force SLF4J SimpleLogger re-initialization
  - Resolves: rhbz#1324832


Package:  pki-console-10.3.0.a2-

Re: TPMs, measured boot and remote attestation in Fedora

[Florian Weimer]

On 04/08/2016 10:28 AM, Matthew Garrett wrote:
> With what we now know about malicious actors targeting the system boot 
> chain (even down to the firmware), this kind of TPM-based work is a 
> vital part of helping keep our users secure.

On the other hand, it can easily be abused to restrict user freedom.
For example, video streaming sites might not be willing to serve content
to users who cannot cryptographically prove they are running an approved
operating system with an approved browser.

Remote attestation only works with a trusted counterpart who rejects
access once a breach is detected.  Who do you expect to be the
counterpart for Fedora users?  Is there anyone who offers such a service
without also requiring to use their own operating system?

Florian
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Petr Pisar]

On 2016-04-08, Matthew Garrett  wrote:
> Doing this well involves knowing what the expected values are to begin 
> with. Some of these values come from the firmware, and so we can't do 
> much about them without the assistance of the system vendors. But these 
> values don't tend to change over the course of a system's lifetime 
> (unless you update the firmware), so it's much easier to do something 
> about that. Other components *do* change over time as we update grub or 
> the kernel, and it's immensely helpful to be able to identify these 
> ahead of time.
>
> In CoreOS we've started shipping bundles of the expected PCR values with 
> each release. I'd like to start exploring how to do the same in Fedora. 
> Things are much easier in CoreOS since we don't ship individual OS 
> components, and so the values are very much tied to OS releases - in 
> Fedora they'd mostly be associated with individual packages. It'd be 
> easy to bundle the values in with the packages themselves, but that's 
> harder for admins to extract. A central location to publish this kind of 
> metadata would be ideal.
>
I'm curious how you would predict hash of initramfs because it is
generated on the host and depends on dracut configuration and presence
of various optionally installed packages.

-- Petr
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Re: TPMs, measured boot and remote attestation in Fedora

[Gregory Maxwell]

On Fri, Apr 8, 2016 at 8:28 AM, Matthew Garrett  wrote:
[snip]
> Remote attestation is a mechanism by which a remote machine can request
> (but not compel) another machine to provide evidence of the PCR state.
> The TPM provides a signed bundle of information including the PCR values
> and the event log, and the remote machine verifies that the signature
> corresponds to the key it expected to see. The remote machine can then
> examine the log, ensure that it matches the PCR values and analyse each
> individual log entry to ensure that it matches an expected value. In a
> data centre, this means that it can then flag whether a machine is
> running in an expected state or not - if someone has tampered with the
> boot process, the information will not match the policy.
>
> Doing this well involves knowing what the expected values are to begin
> with. Some of these values come from the firmware, and so we can't do
> much about them without the assistance of the system vendors. But these
> values don't tend to change over the course of a system's lifetime
> (unless you update the firmware), so it's much easier to do something
> about that. Other components *do* change over time as we update grub or
> the kernel, and it's immensely helpful to be able to identify these
> ahead of time.

The TPM style of remote attest is quite unfriendly to free software.
It puts basically the entire operating system in the trusted domain,
and you cannot change even a bit of it without "breaking the seal".
So if you want any use of remote attest at all, there is a huge swath
of your system which are are "compelled" under threat of loss of
access to whatever functionality remote-attest was providing to make
no modification-- or even, potentially, no upgrade to a very new or
less common version.

Even if it is not overtly used in user-hostile ways, many applications
of this would make opaque proprietary operating systems on a much more
even playing field with Free Software.

I think any time invested to make remote attest of any kind work would
better be spent on support for Intel SGX, which creates limited
remote-attestable sandboxes which (assuming Intel made no mistakes :)
) have strong security and confidentiality regardless of what else is
running on the system. These sandboxes also have no outside access
except via limited channels, so (again assuming no mistakes/backdoors
on Intel's part); and the published security model is stronger (e.g.
encrypted ram) and more suitable for user-friendly uses (for example,
it would be straight-forward to use SGX to implement a bitcoin wallet
that could enforce user specified transfer limits, even against a
total security compromise of the host-- and if the RA part is as
usuable as it could be, even prove to third party auditors that your
keys have these security properties (the RA functionality for SGX is
not yet documented in public, AFAIK)).
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

TPMs, measured boot and remote attestation in Fedora

[Matthew Garrett]

Some people who installed the Fedora 24 Alpha from scratch on bare-metal 
BIOS-based systems may have found that their system didn't boot. Sorry 
about that - it's my fault, and it's fixed now. But it happened as a 
result of some new code in grub that gives us some really exciting 
functionality.

Trusted Platform Modules (or TPMs) are small devices that sit on many 
system motherboards. They're usually attached over the LPC bus, which 
means two things:

1) Communicating with them isn't very fast
2) There's no support for device-initiated DMA, which means there's no 
way they can directly read system state

Measured boot is a process whereby each component in the boot chain 
"measures" the next component. In the TPM 1.x world (which is where most 
of us still are), that measurement is in the form of a SHA1 hash of the 
next component. So, on a BIOS system, the firmware measures itself, the 
firmware measures its configuration, the firmware measures any option 
ROMs on plugin cards, the firmware measures the MBR of the disk, the MBR 
measures the grub stage 1, the grub stage 1 measures the grub stage 2, 
the grub stage 2 measures the kernel and so on.

Each of these measurements is written into a register on the TPM called 
a Platform Configuration Register, or PCR. Attempting to write to a PCR 
doesn't directly replace the old contents with the new value. Instead, 
the TPM concatenates the two values and stores the SHA1 of that 
concatenated value. Unless you've comprehensively broken SHA1, there's 
no way for you to set a PCR to a specific value unless you perform 
exactly the same set of writes.

Each of these writes is logged. The log includes the hash that was 
written to the TPM, an event type and a description of the event. TPMs 
initialise their PCRs in a known state, so by emulating the behaviour of 
the TPM and replaying the entries in the log, you can verify that the 
TPM reached the state it's in by performing the actions recorded in the 
log.

TPMs can be configured to encrypt data or keys in such a way that they 
will only decrypt or use them if the PCRs are set to specific values. 
With grub measuring the boot process, this means that you can encrypt a 
secret in such a way that the TPM will only decrypt it when the values 
match. An example of using this for boot security is TPMTOTP 
(https://github.com/mjg59/tpmtotp) which provides a direct mechanism for 
a user to verify that their boot process (including firmware) has not 
been tampered with.

Remote attestation is a mechanism by which a remote machine can request 
(but not compel) another machine to provide evidence of the PCR state. 
The TPM provides a signed bundle of information including the PCR values 
and the event log, and the remote machine verifies that the signature 
corresponds to the key it expected to see. The remote machine can then 
examine the log, ensure that it matches the PCR values and analyse each 
individual log entry to ensure that it matches an expected value. In a 
data centre, this means that it can then flag whether a machine is 
running in an expected state or not - if someone has tampered with the 
boot process, the information will not match the policy.

Doing this well involves knowing what the expected values are to begin 
with. Some of these values come from the firmware, and so we can't do 
much about them without the assistance of the system vendors. But these 
values don't tend to change over the course of a system's lifetime 
(unless you update the firmware), so it's much easier to do something 
about that. Other components *do* change over time as we update grub or 
the kernel, and it's immensely helpful to be able to identify these 
ahead of time.

In CoreOS we've started shipping bundles of the expected PCR values with 
each release. I'd like to start exploring how to do the same in Fedora. 
Things are much easier in CoreOS since we don't ship individual OS 
components, and so the values are very much tied to OS releases - in 
Fedora they'd mostly be associated with individual packages. It'd be 
easy to bundle the values in with the packages themselves, but that's 
harder for admins to extract. A central location to publish this kind of 
metadata would be ideal.

With what we now know about malicious actors targeting the system boot 
chain (even down to the firmware), this kind of TPM-based work is a 
vital part of helping keep our users secure. The remote attestation 
features also make it easier for admins to keep their data centres 
secure. We have an opportunity here to make Fedora the first 
general-purpose operating system to provide resistance to this kind of 
attack out of the box, and I think it's worth taking it.

There's still some additional work to do, such as making it possible to 
assign local policy to which things get logged into which PCR. But I 
think we're in a great position to start developing well-integrated 
features that take advantage of this kind of hardware-level secur

Re: weakdeps and the buildroot

[Miroslav Suchý]

Dne 8.4.2016 v 04:03 Ralf Corsepius napsal(a):
> Has this change and the mapping which buildroot uses dnf rsp. yum been 
> reflected to the mock packages [1]?

Yes. Mock used DNF for rawhide for ages to test this setup before it landed in 
Koji and we have been waiting for
necessary code change in Koji and once Koji enabled it for rawhide and F24 
targets, we enabled it for F24 in Mock too.

> [1] IMHO, the different incarnations of mock-packages and their target 
> mock-configurations should match the situation in
> the buildroots 1:1 as close as possible.

This is my goal too. If you are aware of some configuration in Koji, which 
differ from default Mock config, then feel
free to open BZ.

However there are some settings, which will likely remain different. E.g:
  Koji: config_opts['plugin_conf']['root_cache_enable'] = False
  Mock: config_opts['plugin_conf']['root_cache_enable'] = True
Disabling this by default will affect the packagers and have big impact on 
default performance. Lots of people will be
forced to enable it manually. So it is better that only Koji (and Copr) disable 
it.

-- 
Miroslav Suchy, RHCA
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org

Fedora Rawhide-20160407.n.5 compose check report

[Fedora compose checker]

Missing expected images:

Kde live i386
Workstation live i386
Kde live x86_64
Cloud_base raw-xz x86_64
Cloud_base raw-xz i386
Atomic raw-xz x86_64
Kde raw-xz armhfp
Workstation live x86_64

Images in this compose but not Rawhide-20160331.n.0:

Minimal raw-xz armhfp
Soas raw-xz armhfp
Xfce raw-xz armhfp
Lxde raw-xz armhfp
Server raw-xz armhfp
Docker_base docker x86_64

No images in Rawhide-20160331.n.0 but not this.

Failed openQA tests: 11/53 (x86_64), 15/15 (i386)

ID: 12059   Test: x86_64 universal install_updates_img_local
URL: https://openqa.fedoraproject.org/tests/12059
ID: 12058   Test: x86_64 Server-dvd-iso base_service_manipulation
URL: https://openqa.fedoraproject.org/tests/12058
ID: 12057   Test: x86_64 Server-dvd-iso base_services_start
URL: https://openqa.fedoraproject.org/tests/12057
ID: 12056   Test: x86_64 Server-dvd-iso base_selinux
URL: https://openqa.fedoraproject.org/tests/12056
ID: 12048   Test: x86_64 universal install_kickstart_hdd
URL: https://openqa.fedoraproject.org/tests/12048
ID: 11968   Test: i386 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/11968
ID: 11967   Test: i386 universal upgrade_2_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/11967
ID: 11966   Test: i386 universal upgrade_desktop_32bit
URL: https://openqa.fedoraproject.org/tests/11966
ID: 11965   Test: i386 universal install_lvmthin
URL: https://openqa.fedoraproject.org/tests/11965
ID: 11964   Test: i386 universal install_ext3
URL: https://openqa.fedoraproject.org/tests/11964
ID: 11963   Test: i386 universal install_btrfs
URL: https://openqa.fedoraproject.org/tests/11963
ID: 11962   Test: i386 universal install_software_raid
URL: https://openqa.fedoraproject.org/tests/11962
ID: 11961   Test: i386 universal install_simple_encrypted
URL: https://openqa.fedoraproject.org/tests/11961
ID: 11960   Test: i386 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/11960
ID: 11959   Test: i386 universal install_repository_http_graphical
URL: https://openqa.fedoraproject.org/tests/11959
ID: 11958   Test: i386 universal install_package_set_minimal
URL: https://openqa.fedoraproject.org/tests/11958
ID: 11957   Test: x86_64 universal install_scsi_updates_img
URL: https://openqa.fedoraproject.org/tests/11957
ID: 11956   Test: x86_64 universal install_kickstart_user_creation
URL: https://openqa.fedoraproject.org/tests/11956
ID: 11949   Test: x86_64 universal install_kickstart_firewall_configured
URL: https://openqa.fedoraproject.org/tests/11949
ID: 11948   Test: x86_64 universal install_kickstart_firewall_disabled
URL: https://openqa.fedoraproject.org/tests/11948
ID: 11947   Test: x86_64 universal install_european_language
URL: https://openqa.fedoraproject.org/tests/11947
ID: 11928   Test: x86_64 universal install_package_set_kde
URL: https://openqa.fedoraproject.org/tests/11928
ID: 11913   Test: i386 Everything-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/11913
ID: 11908   Test: i386 Server-dvd-iso install_default
URL: https://openqa.fedoraproject.org/tests/11908
ID: 11907   Test: i386 Workstation-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/11907
ID: 11901   Test: i386 Server-boot-iso install_default
URL: https://openqa.fedoraproject.org/tests/11901

Passed openQA tests: 42/53 (x86_64)

-- 
Mail generated by check-compose:
https://git.fedorahosted.org/cgit/fedora-qa.git/tree/check-compose
--
devel mailing list
devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/devel@lists.fedoraproject.org