- service-announce - lists.opendev.org

Retiring and shutting down the ethercalc.openstack.org service
by Clark Boylan 04 May '22

04 May '22

Hello, The https://ethercalc.openstack.org service has become problematic for several reasons: * Our configuration management for the service is still based on Puppet and needs to be modernized to continue running the service. * The service itself isn't well maintained. Its build system is apparently broken [0]. * The service does not capture a history of changes like etherpad, confusing users. * The service crashes semi frequently. The major known user of this service was the PTG planning process. We've talked to the folks that help organize and plan the PTG, and they think other tools (like PTGBot) can be used instead without major trouble. Considering all of this, the OpenDev team would like to retire and shutdown this service. The current plan is to keep the service up and running until the end of the month. Then on May 31, 2022 shut down the server hosting the service, snapshot this server, and finally delete it. Please back up any data you would like to preserve before May 31, 2022. [0] https://github.com/audreyt/ethercalc/pull/781 If you have any questions or concerns feel free to respond to this thread or reach out to the OpenDev team. Clark

1 0

A not so Short OpenDev Activity Update
by Clark Boylan 22 Apr '22

22 Apr '22

It has been a busy few weeks for the OpenDev team. We thought it would be a good idea to capture some of the more user facing aspects of what we have been doing lately. Git-review and Bindep both have new releases. Git-review 2.3.0 and 2.3.1 [0] bring better support for newer OpenSSH and signed Git commits, as well as drop compatibility with Python 3.5. Bindep 2.11.0 [1] adds support for AlmaLinux. Git fixed a security issue [2] that broke DevStack and other test jobs. The OpenDev team helped to quickly diagnose the problem and proposed fixes to projects once the issue was understood. If you have jobs with unexpected git operation failures or Python package install issues there is a good chance it is related to this update. You will want to ensure that the user running git commands in a repo is the same user that owns the files in the repo (typically "zuul"). Otherwise you will need to mark the repository as a "safe" repository. Our Twitter status account [3] has been resurrected to provide another way for our users to follow along as we make changes. Whenever we make `#status` messages in IRC that content gets mirrored to this account which you can follow on Twitter. We have also been doing quite a bit of Spring Cleaning (it is spring for some of us anyway). We no longer build Debian Buster or Python 3.7 versions of opendevorg/python-builder and opendevorg/python-base. We did our best to check that no one was using these images, but if you are, the images will remain on Docker Hub until Docker Hub times them out. You should update to a Bullseye Python 3.8 or newer image. Bullseye Python 3.10 images are newly available too. The OpenStack Health service was shut down some time ago, and its configuration management and source repositories have been retired or cleaned up as appropriate. The ELK system that powered elastic-recheck is in the process of being shutdown and retired in favor of a new OpenSearch hosted system managed by OpenStack more directly. Please read the documentation [4] for using the new system if you would like to continue to query job logs using Kibana. Our distro mirrors are getting a haircut to remove packages for unused architectures in our CI system, ISOs/images, and old distro releases. This cleanup will ensure we have plenty of room to add a Jammy Jellyfish mirror to our collection. We'd like to remind our users that while these mirrors are publicly available they are not intended for public consumption. We can and do modify them as our CI system needs change. Finally, looking ahead we'll begin to work on rolling out Jammy Jellyfish images for the CI system now that this latest Ubuntu LTS is available. Our Gerrit 3.5 upgrade should also pick up steam. Most of the changes we expect Gerrit users to see will be in the UI itself. You can read the release notes [5] to find out more. We aren't ready to set a date for this, but you should expect a short downtime which we will announce via service-announce(a)lists.opendev.org. Unfortunately, the Gerrit problems with SSH RSA keys won't be resolved until Gerrit 3.6. [0] https://lists.opendev.org/pipermail/service-announce/2022-April/000036.html [1] https://lists.opendev.org/pipermail/service-announce/2022-April/000035.html [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765 [3] https://twitter.com/opendevinfra/ [4] https://governance.openstack.org/sigs/tact-sig.html#opensearch [5] https://www.gerritcodereview.com/3.5.html

1 0

git-review 2.3.0 and 2.3.1
by Jeremy Stanley 19 Apr '22

19 Apr '22

It's my pleasure to announce the release of git-review 2.3.0 and follow-up fix version 2.3.1. These are the corresponding release notes since the previous release: ======= 2.3.1 ======= Bug Fixes --------- * Improved version string parsing for Git in order to no longer break on Mac OSX/Darwin systems (story 2010002). ======= 2.3.0 ======= Upgrade Notes ------------- * Python 3.5 is no longer supported. * Git 2.10.0 or later is required as git-review now needs the ``--no-show-signature`` option for git-log. Bug Fixes --------- * Git's log.ShowSignature option is now supported. Previously, setting it would confuse git-review into thinking there were twice as many changes to push. * OpenSSH has deprecated its use of scp/rcp protocol in favor of SFTP, which the embedded Apache mina-sshd in widely-deployed Gerrit versions does not yet support. The default officially changed in OpenSSH 9.0 (some distributions, such as Fedora and CentOS, switched their default behavior to this as early as OpenSSH 8.7 or 8.8), leading to a "subsystem request failed on channel 0" error during commit-msg hook retrieval. Now git-review will attempt to detect whether scp's -O option is available to force use of the legacy scp/rcp protocol, and apply it if so. Future git-review versions may change the fallback behavior once an SFTP subsystem is implemented and available for a new Gerrit release. As always, the latest version of git-review is available from PyPI: https://pypi.org/project/git-review Current documentation can be found here: https://docs.opendev.org/opendev/git-review Its source code can be obtained from the OpenDev Collaboratory: https://opendev.org/opendev/git-review Please don't hesitate to follow up through the service-discuss(a)lists.opendev.org mailing list or in the #opendev channel on the OFTC IRC network if you have any questions. -- Jeremy Stanley

1 0

bindep 2.11.0
by Jeremy Stanley 19 Apr '22

19 Apr '22

It's my pleasure to announce the release of bindep 2.11.0. These are the corresponding release notes since the previous release: New Features ------------ * Add support for AlmaLinux to Bindep. As always, the latest version of bindep is available from PyPI: https://pypi.org/project/bindep Current documentation can be found here: https://docs.opendev.org/opendev/bindep Its source code can be obtained from the OpenDev Collaboratory: https://opendev.org/opendev/bindep Please don't hesitate to follow up through the service-discuss(a)lists.opendev.org mailing list or in the #opendev channel on the OFTC IRC network if you have any questions. -- Jeremy Stanley

1 0

review.opendev.org Gerrit downtime for project renames April 15, 2022
by Clark Boylan 06 Apr '22

06 Apr '22

Hello, The OpenDev team will be renaming Gerrit projects on April 15, 2022 beginning at 15:00 UTC. This process requires a Gerrit downtime for the service running on review.opendev.org and is expected to last no more than an hour. If you would like to rename a project, now is the time to begin planning for that work ensuring the necessary changes are proposed. If you have any questions please feel free to respond to this email or reach out to the team. Clark

1 0

Zuul behavior change with Depends-On across queues
by Jeremy Stanley 05 Apr '22

05 Apr '22

A recent improvement to more accurately report Zuul's enqueuing has resulted in an unanticipated difference in behavior for changes declaring a Depends-On relationship between projects which don't share a dependent queue. If you approve the depending change before the dependency has merged, Zuul will now report a Verified -2 vote on the depending change (where previously it just ignored your approval entirely). As a result, because the openstack tenant is configured to require a positive Verified vote before enqueuing into the gate pipeline, this means the depending change will need to be rechecked in order to replace that -2 vote with a +1 in that tenant. For tenants without such a "clean check" rule, the change in behavior is entirely cosmetic. One thing you can do to avoid this is make sure any projects which regularly utilize Depends-On between their changes are configured to belong to the same named queue, which will result in Zuul enqueuing those approved changes into the gate pipeline together without needing to wait for one to merge before the other can be tested. Zuul expects related projects to share a queue and, on approval, will only look up parent and child changes to enqueue within the related projects list, as determined by the queue to which they belong. An alternative workaround is to only approve a change once you've confirmed that any Depends-On has merged, if that dependency is in another project which does not share the same queue. Feel free to follow up on the service-discuss ML with any comments/concerns, or find us in the #opendev channel on OFTC as usual. -- Jeremy Stanley

1 0

Temporary addition of unsigned tag permissions
by Jeremy Stanley 01 Feb '22

01 Feb '22

In the wake of yesterday's Gerrit 3.4 upgrade maintenance, we've observed a regression in behavior where signed Git tags are being misidentified as unsigned[*]. Since our ACLs normally disallow pushing of unsigned (annotated) tags, the result is tag pushes being rejected with a permissions error. As an emergency measure, and in an attempt to not roll back our Gerrit upgrade while working with their developers on a proper patch so solve this, we have updated the ACLs for all projects with a workaround so that they will be able to continue pushing tags. Unfortunately, this workaround means that projects will temporarily be able to push unsigned tags as well as signed ones, so we ask anyone manually tagging their projects be extra careful to remember to pass the -s option to git's tag subcommand. Once we have a proper fix in place, the temporary addition of unsigned tag permissions will be rolled back, and a follow-up announcement sent to this mailing list. [*] https://bugs.chromium.org/p/gerrit/issues/detail?id=15616 -- Jeremy Stanley

1 1

Gerrit Maintenance and Downtime January 24, 2022
by Clark Boylan 18 Jan '22

18 Jan '22

Hello, The OpenDev team will be taking the early year quiet as an opportunity to rename a few projects in Gerrit and upgrade Gerrit to 3.4 starting January 24, 2022 at 22:00 UTC. We expect to be done by 00:00 UTC January 25, 2022. If you would like to rename a project now is the time to get that preparation done. Please link any rename proposals in our list here: https://wiki.openstack.org/wiki/Meetings/InfraTeamMeeting#Upcoming_Project_… The Gerrit 3.4 release notes can be found at https://www.gerritcodereview.com/3.4.html. This upgrade does not require offline reindexing which means it should happen quickly. We are also automatically testing the 3.3 to 3.4 upgrade in our CI system. Additionally there is a downgrade process that we can use to fall back to 3.3 if necessary. Let us know if you have any questions or concerns, Clark

1 0

Changes to OpenDev's stable of CI images
by Clark Boylan 07 Dec '21

07 Dec '21

Hello, CentOS 8 reaches end of life on December 31, 2021. This means now is the time for you to convert jobs to CentOS 8|9 Stream or some other appropriate platform. The OpenDev team will plan to remove CentOS 8 images and mirrors from our infrastructure in early January, hopefully by January 14, 2022. Again, please update your jobs now so that you are prepared. These changes are necessary as the distro will no longer be supported, and there is no way for us to ensure that the images will be secure or that we'll even be able to build them. We've also got Fedora 35 lined up to replace Fedora 34. Due to Fedora's short support window we typically swap out one Fedora release with the next when the next is ready. If you are using the fedora-34 label please update it to fedora-35. If you are using fedora-latest we'll be updating that to use fedora-35 and the swap will happen automatically for you. We expect to have Fedora 34 cleaned up by the end of the year. Additionally both OpenSUSE 15 and Tumbleweed could use some help. For OpenSUSE 15 we need to update it to 15.3 as well as updating the associated mirrors if we plan to keep it around. I'm happy to keep this image around if we can get volunteers in the community that can help with that. If there isn't interest in modernizing the OpenSUSE 15 images I'd like to propose we clean them up in January along with the CentOS 8 images. For Tumbleweed, the images haven't received much use or attention. I'd like to propose that we simply retire this image and clean it up. We had thought it might be a good platform for monitoring upcoming changes in the Linux world, but the reality is that only works if you've got people active caring for it and adjusting to those changes. The Tumbleweed cleanup will likely begin before the end of the year. Finally, our Gentoo images bounce between being buildable and broken with more time spent being broken than not. I'd like to propose that this image also get cleaned up in the near future. Again, if there is interest in the community for keeping this alive I think we can make that happen. But as is this image is not in a sustainable place and it would be better for us to stop running jobs on it. Let us know if you have any questions or comments, Clark

1 0

git-review 2.2.0
by Jeremy Stanley 23 Nov '21

23 Nov '21

It's my pleasure to announce the release of git-review 2.2.0. These are the corresponding release notes since the previous release: Bug Fixes --------- * When checking for unstaged or uncommitted changes to avoid performing a test rebase, unstaged and uncommitted changes in Git submodules are now ignored since those won’t be rebased anyway. * git-review now handles the Git core.hooksPath configuration option correctly. Thus, it installs the commit-msg hook into the core.hooksPath directory, if that option is set. Otherwise, it continues to install the hook into .git/hooks, relative to the root of the checkout. * With Git 2.18.0 and later, the --rebase-merges (-r) option will be used in place of the deprecated --preserve-merges (-p) option. This fixes a critical error when git-review is used with Git versions 2.34.0 onward, where the old option is no longer available. As always, the latest version of git-review is available from PyPI: https://pypi.org/project/git-review Current documentation can be found here: https://docs.opendev.org/opendev/git-review Its source code can be obtained from the OpenDev Collaboratory: https://opendev.org/opendev/git-review Please don't hesitate to follow up through the service-discuss(a)lists.opendev.org mailing list or in the #opendev channel on the OFTC IRC network if you have any questions. -- Jeremy Stanley

1 0