I perform all of my Fedora packaging chores on a RHEL7 host. I haven't updated any of the 5 new "Flag Day" packages for running fedpkg, but given that a kerberos ticket is required as a prerequisite, I'm simply trying to get that to work first.
On my RHEL7 machine, in my /etc/kr5b.conf file, I have added this under [realms]:
FEDORAPROJECT.ORG = { kdc = https://id.fedoraproject.org/KdcProxy }
and this under [domain_realm]:
fedoraproject.org = FEDORAPROJECT.ORG .fedoraproject.org = FEDORAPROJECT.ORG
But my kinit attempts fail like so:
$ kinit crash@FEDORAPROJECT.ORG kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials $
With tracing, maybe there's a clue here as to what's going on?:
$ KRB5_TRACE=/dev/stdout kinit crash@FEDORAPROJECT.ORG [9826] 1481566653.803265: Resolving unique ccache of type KEYRING [9826] 1481566653.803305: Getting initial credentials for crash@FEDORAPROJECT.ORG [9826] 1481566653.803435: Sending request (196 bytes) to FEDORAPROJECT.ORG [9826] 1481566653.803535: Resolving hostname id.fedoraproject.org [9826] 1481566653.805718: Terminating TCP connection to https 2604:1580:fe00:0:dead:beef:cafe:fed1:443 [9826] 1481566653.807206: Terminating TCP connection to https 2607:f188::dead:beef:cafe:fed1:443 [9826] 1481566653.808450: Terminating TCP connection to https 2610:28:3090:3001:dead:beef:cafe:fed3:443 [9826] 1481566654.63381: TLS certificate name matched "id.fedoraproject.org" [9826] 1481566654.179120: Sending HTTPS request to https 140.211.169.206:443 [9826] 1481566654.292520: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:34 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a
The requested URL /KdcProxy was not found on this server.
That is a RHEL7.2 machine, which has a bug. This is fixed in the krb5-workstation that is in RHEL7.3.
(background information: the RHEL7.2 version of krb5-workstation does not have Server Name Indication (SNI), which means that the client is not hitting the right backend. This is indicated by the "The requested URL /KdcProxy was not found")
Thanks for the info -- I'll work on getting the packages up-to-date
Please let us know when you get it working.
:clock1230:
I sure will. I'm planning to do a full rhel-7.3 update tomorrow because my initial manual attempts resulted in yum dependency-hell. Thanks!
OK, I've successfully updated to rhel-7.3, and kinit crash@FEDORAPROJECT.ORG works OK. Thanks for that tip.
Now w/respect to:
python2-cccolutils-1.4-1 fedpkg-1.26-2 fedora-packager-0.6.0.0-1 pyrpkg-1.47-3 koji-1.11.0-1
I don't have python2-cccolutils at all, and the other 4 all need updating:
$ rpm -qa | grep -e fedpkg -e fedora-packager -e pyrpkg -e koji -e python2-cccolutils fedora-packager-0.5.10.7-1.el7.noarch brewkoji-1.13-1.el7.noarch koji-1.10.1-25.2.el7.noarch fedpkg-1.25-1.el7.noarch pyrpkg-1.46-3.el7eng.noarch $
I can go hunt these down, but is there a yum repo I can temporarily plug in to get these packages?
Thanks, Dave Anderson
----- Original Message -----
kevin added a new comment to an issue you are following: `` Please let us know when you get it working. :clock1230: `` To reply, visit the link below or just reply to this email https://pagure.io/fedora-infrastructure/issue/5618
kevin added a new comment to an issue you are following: `` Please let us know when you get it working.
:clock1230: ``
To reply, visit the link below or just reply to this email https://pagure.io/fedora-infrastructure/issue/5618
These updates should all be in epel7-testing at this moment. So if you run "yum update --enablerepo=epel7-testing", you should get them.
Can you please point me to the epel7-testing repo?
The epel7-testing repo definition is in the same file as epel7, so if you have epel7 you can just --enablerepo=epel7-testing.
OK, so again these are required:
I got the epel-testing.repo file from epel-release-latest-7.noarch.rpm, but am only able to get updates for 3 out of the 5 packages, i.e., fedpkg, pyrpkg and python2-cccolutils:
$ sudo yum list installed python2-cccolutils fedpkg fedora-packager pyrpkg koji Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Installed Packages fedora-packager.noarch 0.5.10.7-1.el7 @epel fedpkg.noarch 1.26-2.el7 @epel-testing koji.noarch 1.10.1-25.2.el7 @brew-dist-git pyrpkg.noarch 1.47-3.el7 @epel-testing python2-cccolutils.x86_64 1.4-1.el7 @epel-testing $
So I'm still looking for the updates to fedora-packager and koji:
$ yum provides fedora-packager Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager fedora-packager-0.5.10.7-1.el7.noarch : Tools for setting up a fedora maintainer environment Repo : epel
fedora-packager-0.5.10.7-1.el7.noarch : Tools for setting up a fedora maintainer environment Repo : @epel
$ yum provides koji Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager koji-1.10.1-10.el7.noarch : Build system tools Repo : epel
koji-1.10.1-13.el7.noarch : Build system tools Repo : epel-testing
koji-1.10.1-25.2.el7.noarch : Build system tools Repo : rcm-tools-rhel-7-workstation-rpms
koji-1.10.1-25.2.el7.noarch : Build system tools Repo : @brew-dist-git
$
So no references to fedora-packager-0.6.0.0-1 or koji-1.11.0-1.
Dave
Odd:
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-b92463563b
is the fedora-packager/koji update. It was pushed to testing about 12 hours ago. So, it might just be mirror lag I guess. Try a 'yum clean all' and see if they show up?
Nope, after "yum clean all", "yum provides" shows exactly the same as above.
ok. I guess you will need to either way a bit and try again, or just get the updates from koji...
Installed Packages fedora-packager.noarch 0.6.0.0-3.el7 @epel-testing koji.noarch 1.11.0-1.el7 @epel-testing
please do a yum --enablerepo=epel-testing list koji fedora-packager to see if that is the problem.
$ sudo yum --enablerepo=epel-testing list koji fedora-packager Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Installed Packages fedora-packager.noarch 0.5.10.7-1.el7 @epel koji.noarch 1.10.1-25.2.el7 @brew-dist-git $
So it looks like your system is hooked up to the internal brew and doesn't have access to the epel-testing. That being the case, I am not sure how to debug as I don't know what firewalls etc are in place to not have access to epel-testing
Except for the fact that I did get the other 3 packages from epel-testing:
$ yum provides fedpkg Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager fedpkg-1.25-1.el7.noarch : Fedora utility for working with dist-git Repo : epel
fedpkg-1.26-2.el7.noarch : Fedora utility for working with dist-git Repo : epel-testing
fedpkg-1.26-2.el7.noarch : Fedora utility for working with dist-git Repo : @epel-testing
$ yum provides pyrpkg Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager pyrpkg-1.46-3.el7eng.noarch : Python library for interacting with rpm+git Repo : rcm-tools-rhel-7-workstation-rpms
pyrpkg-1.46-5.el7.noarch : Python library for interacting with rpm+git Repo : epel
pyrpkg-1.47-3.el7.noarch : Python library for interacting with rpm+git Repo : epel-testing
pyrpkg-1.47-3.el7.noarch : Python library for interacting with rpm+git Repo : @epel-testing
$ yum provides python2-cccolutils Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager python2-cccolutils-1.4-1.el7.x86_64 : Python Kerberos Credential Cache Collection Utilities Repo : epel-testing
python2-cccolutils-1.4-1.el7.x86_64 : Python Kerberos Credential Cache Collection Utilities Repo : @epel-testing
$ rpm -qa | grep -e pyrpkg -e cccol -e fedpkg pyrpkg-1.47-3.el7.noarch fedpkg-1.26-2.el7.noarch python2-cccolutils-1.4-1.el7.x86_64 $
OK your system had access to epel-testing at one point. It does not now. [where now is defined as the moment you were checking earlier. ] I have checked several mirrors and they have the update and the mirrors are checking out that they are in sync with the metadata. I don't know what the network layout is between you and the mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=testing-epel7&arch=$basearch servers are so we need to figure out if there is a proxy problem in between you and them. You can try the following:
baseurl=http://dl.fedoraproject.org/pub/epel/testing/7/$basearch #mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=testing-epel7&arch=$basearch
Yes! That worked! Thanks!
Cool glad to hear it. I am sorry for my short original post. I am not sure why the package is stuck for you but hopefully the workaround will get you by for the time being.
Is everything working for you now?
:mahjong:
Everything's installed OK and kinit works, but I haven't tried anything. Other than doing the initial kinit, what else has to be performed?
I would suggest to try running "koji hello" to verify that your koji setup is working correctly.
$ kinit crash@FEDORAPROJECT.ORG Password for crash@FEDORAPROJECT.ORG: $ klist Ticket cache: KEYRING:persistent:3369:krb_ccache_09fH8Bu Default principal: crash@FEDORAPROJECT.ORG
Valid starting Expires Service principal 12/14/2016 09:24:32 12/15/2016 09:24:23 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG renew until 12/21/2016 09:24:23 $ koji hello tervehdys, crash!
You are using the hub at https://koji.fedoraproject.org/kojihub Authenticated via GSSAPI $
I had to google tervehdys, but am I good to go? ;-)
Great. Please let us know if there's anything else we can help with.
:telephone_receiver:
@kevin changed the status to Closed
Closed
I have to say that your help and response time is truly amazing. (I wish I could get this kind of service from our internal Red Hat release-engineering)