Skip to content
Snippets Groups Projects
Select Git revision
0 results
Search by author
  • Any Author
0 authors
  1. Dec 18, 2019
  3. Dec 04, 2019
  5. Nov 22, 2019
    • Emanuele Aina's avatar
      Jenkinsfile: Add missing def keywords where appropriate · 51fde8c6
      Emanuele Aina authored 
      
In light of e21ecdb6 fixing an issue caused by a missing `def` that makes a
variable to be global and thus unwillingly overridden, do a sanity check on the
whole file and add some missing `def`.

Even if their lack currenly seem harmless, it may prevent issues when moving
things around.

Signed-off-by: Emanuele Aina's avatarEmanuele Aina <emanuele.aina@collabora.com>
      51fde8c6
    • Emanuele Aina's avatar
      Jenkinsfile: Fix sysroot index file generation · e21ecdb6
      Emanuele Aina authored and Sjoerd Simons's avatar Sjoerd Simons committed 
      For a long time we had a race in the sysroot index files generation that
sometimes caused one of the links contained there to point to the wrong
architecture, for instance the `armhf` index pointing to `arm64`.

Commit a221b5f4 was an attempt to fix it, but didn't improve the situation.
Hovewer, it gave us some additional output that we could use to reason a bit
more about the issue.

For instance, the v2019 20191122.0 job has this in the logs at
https://jenkins.apertis.org/view/apertis-v2019/job/apertis-v2019/job/images/job/debos-image-build/140/consoleText:

    [Pipeline] echo
    sysroot sysroot/v2019/sysroot-apertis-v2019-armhf
    version=v2019 20191122.0
    url=https://images.apertis.org/daily/v2019/20191122.0/arm64/sysroot/sysroot-apertis-v2019-arm64-20191122.0.tar.gz

The relevant code:
    sysrootname = "sysroot-${osname}-${release}-${architecture}-${env.PIPELINE_VERSION}"
    sysrooturl = "${image_url_prefix}/daily/${release}/${env.PIPELINE_VERSION}/${architecture}/sysroot/${sysrootname}.tar.gz"
    sh(script: """
        cd ${PIPELINE_VERSION}/${architecture}/${type}
        debos ${debosarguments} \
          --show-boot \
          -t architecture:${architecture} \
          -t ospack:ospack_${release}-${architecture}-${type}_${PIPELINE_VERSION} \
          -t sysroot:${sysrootname} \
          ${WORKSPACE}/${osname}-sysroot.yaml; \
        """)

    // Generate sysroot metadata
    def metadata_file = "sysroot/${release}/sysroot-${osname}-${release}-${architecture}"
    def metadata_contents = "version=${release} ${PIPELINE_VERSION}\nurl=${sysrooturl}\n"
    echo "sysroot ${metadata_file}\n${metadata_contents}"
    writeFile file: metadata_file, text: metadata_contents

From the output we can conclude that `metadata_file` is correct, while
`metadata_contents` has the wrong arch, which comes from `sysrooturl`.

Note the lack of `def` before `sysrooturl`. That means that Groovy is creating
a **global** variable. So every time the stage is run, the shared global
variable is overridden: in this case, the stage is run for `armhf` first and
before it reaches the `Generate sysroot metadata` section the `arm64` stage is
run as well, overridding `sysrooturl`.

Adding a `def` there should finally fix this longstanding issue.

See https://phabricator.apertis.org/T6317

 for more details.

Signed-off-by: Emanuele Aina's avatarEmanuele Aina <emanuele.aina@collabora.com>
      e21ecdb6
  7. Nov 18, 2019
  9. Nov 04, 2019
  11. Oct 23, 2019
  13. Oct 11, 2019
  15. Oct 09, 2019
  17. Oct 02, 2019
  19. Sep 29, 2019
  21. Sep 23, 2019
  23. Sep 11, 2019
  25. Sep 10, 2019
    • Emanuele Aina's avatar
      Disable HTTP pipelining in APT to avoid "Hash Sum Mismatch" · c83063aa
      Emanuele Aina authored and Denis Pynkin's avatar Denis Pynkin committed 
      Work around issues with the APT downloader corrupting files and
causing "Hash Sum Mismatch" errors.

A typical occurence is like:

    Get:97 https://repositories.apertis.org/apertis v2019pre/target amd64 libsystemd-dev amd64 240-5co3bb1 [317 kB]
    Err:97 https://repositories.apertis.org/apertis

 v2019pre/target amd64 libsystemd-dev amd64 240-5co3bb1
      Hash Sum mismatch
      Hashes of expected file:
       - SHA256:39654a35430ef132537880d67cd906bc958e1282e5e2d267e0d9ea96198c3649
       - SHA1:3d358b67b624162c4737a619de078cb8ae6091f6 [weak]
       - MD5Sum:c9da96eacf456df58bd564ab587a7a22 [weak]
       - Filesize:317116 [weak]
      Hashes of received file:
       - SHA256:caf4eacc492e6e67651c6d4ace49ee2800c3166e8d630cddd35b87c94042f655
       - SHA1:9690ac45a5282cc04fcbfc6fc3d2ac2e4c6fa375 [weak]
       - MD5Sum:33dcb5800d6e0c3c4d86f0e37c3d134e [weak]
       - Filesize:317116 [weak]
      Last modification reported: Tue, 21 May 2019 14:59:26 +0000

The failures rate goes from hard-to-reproduce to reliably-fails.

Downloading the affected files with `wget` or `curl` has not reproduced
the issue, and only `apt` seems affected. The issue has hit jobs on
Jenkins as well as pipelines on GitLab, and from time to time people
have been able to remporarily reproduce it locally in image builder
Docker container.

From the captured network traffic it seems that HTTP pipelining is
involved, disabling its usage in APT so far prevented the issue to come
up in cases where it was reproducible.

Signed-off-by: Emanuele Aina's avatarEmanuele Aina <emanuele.aina@collabora.com>
      c83063aa
    • Denis Pynkin's avatar
      Jenkinsfile: sign ostree commit · 15a1e391
      Denis Pynkin authored 
      
Use secret file with base64 encoded ed25519 signature.

Signed-off-by: default avatarDenis Pynkin <denis.pynkin@collabora.com>
      15a1e391
    • Denis Pynkin's avatar
      ostree-images: enable signature verification · ed7a4c9a
      Denis Pynkin authored 
      
Enable signature verification for OTA updates by adding
`sign-verify` key for remote "origin".
After this only commits signed with known key will be used for
update, i.e. public key must be placed into well-known system places
or added into remote config by using keys `verification-key` or
`verification-file`.

Signed-off-by: default avatarDenis Pynkin <denis.pynkin@collabora.com>
      ed7a4c9a
    • Denis Pynkin's avatar
      ostree-commit: add layer with valid public key · 76a8f66a
      Denis Pynkin authored 
      
Add ed25519 public key to be used for validation.

Signed-off-by: default avatarDenis Pynkin <denis.pynkin@collabora.com>
      76a8f66a
  27. Sep 05, 2019
    • Emanuele Aina's avatar
      target,{base,}sdk: Drop auditd · 5c0cd834
      Emanuele Aina authored 
      The audit log can now be retrieved from the systemd journal and most if not all
the testcases have been switched to do that.

On the ostree images the auditd.service is failing because `/var/log/audit` is
not being created on boot.

	# systemctl status auditd.service
	● auditd.service - Security Auditing Service
	   Loaded: loaded (/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
	   Active: failed (Result: exit-code) since Thu 2019-09-05 22:55:59 UTC; 20s ago
	     Docs: man:auditd(8)
		   https://github.com/linux-audit/audit-documentation


	  Process: 335 ExecStart=/sbin/auditd (code=exited, status=6)

	Sep 05 22:55:59 apertis systemd[1]: Starting Security Auditing Service...
	Sep 05 22:55:59 apertis auditd[335]: Could not open dir /var/log/audit (No such file or directory)
	Sep 05 22:55:59 apertis auditd[335]: The audit daemon is exiting.
	Sep 05 22:55:59 apertis systemd[1]: auditd.service: Control process exited, code=exited, status=6/NOTCONFIGURED
	Sep 05 22:55:59 apertis systemd[1]: auditd.service: Failed with result 'exit-code'.
	Sep 05 22:55:59 apertis systemd[1]: Failed to start Security Auditing Service.

Any remaining non-ostree testcase still using `audit.log` can be ported to the
journal as the longer term solution or it can add a dependency on the `auditd`
package in the short term.

Signed-off-by: Emanuele Aina's avatarEmanuele Aina <emanuele.aina@collabora.com>
      5c0cd834
  29. Sep 04, 2019
  31. Sep 03, 2019
  33. Aug 13, 2019
  35. Aug 08, 2019
  37. Aug 05, 2019
  39. Jul 30, 2019
  41. Jul 29, 2019
  43. Jul 22, 2019
  45. Jul 18, 2019
  47. Jul 17, 2019
  49. Jul 02, 2019
  51. Jul 01, 2019
  53. Jun 21, 2019
  55. Jun 18, 2019
  57. Jun 11, 2019
Apertis Website Terms of Use Privacy Policy