March 2022 - service-discuss - lists.opendev.org

OpenSSH 8.8, RSA keys, and Gerrit
by Clark Boylan 13 Oct '22

13 Oct '22

Hello, About a year ago Fedora 33 released and gave us a preview of OpenSSH's sha1 + RSA key deprecation fallout. Fedora 33 users noticed they could no longer use SSH RSA keys to connect to our Gerrit at review.opendev.org. This happens because Fedora 33's OpenSSH packaging has deprecated sha1 hashes for RSA, and despite both the client and server supporting rsa-sha2-* variants they couldn't negotiate their use between them. OpenSSH 8.8 released recently and did similar in the upstream software which means users with up to date OpenSSH installations are noticing similar problems (Arch Linux for example). There are a couple of workarounds that you can use. Probably the best option is to use an ed25519 or ecdsa key with our Gerrit. Modern clients and our Gerrit SSHD negotiate these keys without issue. Less optimal is to manually re-enable the use of the ssh-rsa hash, but we recommend against this as your software providers have decided this is no longer secure enough. On our end we've brought this up with the MINA SSHD devs [0] with the hope that the SSH implementation that Gerrit uses can be updated to negotiate the sha2 hashes properly. Also, the rsa-sha2 RFC indicates [1] clients may fallback to a sha2 variant instead of the sha1 variant which would workaround MINA's lack of support for negotiation in the protocol. If you are an OpenSSH>=8.8 or Fedora>=33 user you might consider filing bugs against your ssh clients to change the default fallback to a sha2 variant on your platforms. [0] https://issues.apache.org/jira/browse/SSHD-1141 [1] https://datatracker.ietf.org/doc/html/rfc8332#section-3.3 Hopefully I've put enough keywords in this email that the various search engines will index it, and the next time someone runs into these problems they'll find this explanation. Clark

1 1

[all] Dynamic Zuul results table in Gerrit 3
by Radosław Piliszek 04 Aug '22

04 Aug '22

Hello Fellow OpenStack and OpenDev Folks! TL;DR click on [3] and enjoy. I am starting this thread to not hijack the discussion happening on [1]. First of all, I would like to thank gibi (Balazs Gibizer) for hacking a way to get the place to render the table in the first place (pun intended). I have been a long-time-now user of [2]. I have improved and customised it for myself but never really got to share back the changes I made. The new Gerrit obviously broke the whole script so it was of no use to share at that particular state. However, inspired by gibi's work, I decided to finally sit down and fix it to work with Gerrit 3 and here it comes: [3]. Works well on Chrome with Tampermonkey. Not tested others. I hope you will enjoy this little helper (I do). I know the script looks super fugly but it generally boils down to a mix of styles of 3 people and Gerrit having funky UI rendering. Finally, I'd also like to thank hrw (Marcin Juszkiewicz) for linking me to the original Michel's script in 2019. [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-November/019051… [2] https://opendev.org/x/coats/src/commit/444c95738677593dcfed0cfd9667d4c4f0d5… [3] https://gist.github.com/yoctozepto/7ea1271c299d143388b7c1b1802ee75e Kind regards, -yoctozepto

7 11

Team Meeting Agenda for March 29, 2022
by Clark Boylan 28 Mar '22

28 Mar '22

We will meet with this agenda on March 29, 2022 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements ** OpenStack "Yoga" release on Wednesday (tomorrow relative to this meeting) ** Virtual PTG next week. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220329) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220329) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running containers with dedicated users. **** Our zuul insecure-ci-registry has been updated. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Upgrading Gitea (clarkb 20220329) *** We have another Gitea update to apply. *** https://review.opendev.org/c/opendev/system-config/+/835307 ** Spring cleaning for old reviews? (frickler 20220329) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old **** Some changes have been labeled with topic:system-config-cleanup and are worth landing: https://review.opendev.org/q/project:opendev/system-config+status:open+topi… *** Please look at your changes and update/rebase as necessary and set topic:system-config-cleanup and we can try to get through this backlog. Or abandon unnecessary changes. ** Retiring opendev/gerrit repo (ianw 20220329) *** Decided to delete branches and then set HEAD content to explanation of why the content has gone away. ** Scheduling project renames (clarkb 20220329) *** Penciled in April 15, 2022 we'll coordinate more as that date gets closer. * Open discussion

1 0

Regression in Gerrit regarding rebases from Gerrit UI
by Radosław Piliszek 22 Mar '22

22 Mar '22

Hi! It seems I am experiencing a regression in Gerrit regarding the rebase capability available from the Gerrit UI. Before, when a child patch (in a patch stack) had its parent patch modified, it was possible to quickly rebase on the current state of the parent patch via the rebase button. Now, Gerrit UI always claims "This change is up to date with its parent." and suggests rebasing on top of the branch or any other patch. Just reporting this issue to see if others also experience this behaviour or something broke on my side (however unlikely). -yoctozepto

2 2

Team Meeting Agenda for March 22, 2022
by Clark Boylan 21 Mar '22

21 Mar '22

We will meet with this agenda on March 22, 2022 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements ** OpenStack "Yoga" release about a week away. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220322) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220322) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running containers with dedicated users. **** Our zuul insecure-ci-registry has been updated. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning for old reviews? (frickler 20220322) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** Clarkb has been looking at opendev/system-config changes **** Many old changes have been abandoned: https://review.opendev.org/q/project:opendev/system-config+status:abandoned **** Some changes have been labeled with topic:system-config-cleanup and are worth landing: https://review.opendev.org/q/project:opendev/system-config+status:open+topi… *** Please look at your changes and update/rebase as necessary and set topic:system-config-cleanup and we can try to get through this backlog. Or abandon unnecessary changes. ** Retiring opendev/gerrit repo (ianw 20220322) *** Had some discussion bit inconclusive *** Delete branches? Merge retirement change? *** Want to ensure this repo falls out of search engines ** Scheduling project renames (clarkb 20220322) *** We have a request to rename a repo. Should schedule renames for some time after the OpenStack Release and PTG? * Open discussion

1 0

Infra Team Meeting Agenda for March 15, 2022
by Clark Boylan 14 Mar '22

14 Mar '22

Hello, We will meet with this agenda on March 15, 2022 at 19:00 UTC in #opendev-meeting. Note that for many of us in North America the DST time change happened over the weekend and the meeting time may have shifted relative to your local timezone. == Agenda for next meeting == * Announcements ** OpenStack is a couple weeks away from releasing "Yoga". * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220315) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220315) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running containers with dedicated users. **** Our zuul insecure-ci-registry has been updated. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning for old reviews? (frickler 20220315) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** https://review.opendev.org/c/openstack/project-config/+/831837 Finalize repo retirements. *** Next up looking at system-config. ** Gitea 1.16 (clarkb 20220315) *** https://review.opendev.org/c/opendev/system-config/+/828184 Change to upgrade to 1.16.x when we are ready. *** There are changes to how docker container processes are started. In particular change log calls out this may affect ssh. We update our testing to push content via ssh to simulate gerrit replication to cover this. ** Backup server pruning (clarkb 20220315) *** One of our backup servers needs to be pruned for disk space reasons. * Open discussion

1 0

Team Meeting Agenda for March 1, 2022
by Clark Boylan 28 Feb '22

28 Feb '22

We will meet with this agenda March 1, 2022 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements ** Skip meeting next week (March 8, 2022) due to travel. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220301) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220301) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning for old reviews? (frickler 20220301) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** https://etherpad.opendev.org/p/opendev-repo-retirements List of repos to retire. Please review for any that are inappropriate to remove. *** https://review.opendev.org/q/topic:retirement+status:open Changes to retire all unused the repos. *** Once the above changes land we'll abandon related changes and then remove the repos from zuul entirely. ** Gitea 1.16 (clarkb 20220301) *** https://review.opendev.org/c/opendev/system-config/+/828184 Change to upgrade to 1.16.x when we are ready. *** Bug fixes for diffs will be in 1.16.3 as well as some dependency updates. Probably worth waiting for 1.16.3. *** There are changes to how docker container processes are started. In particular change log calls out this may affect ssh. We update our testing to push content via ssh to simulate gerrit replication to cover this. ** Rocky Linux 8 Images (clarkb 20220301) *** Need to update DIB in our nodepool images https://review.opendev.org/c/zuul/nodepool/+/831108 ** zuul-registry bugs affecting system-config (clarkb 20220301) *** There are issues with concurrent uploads to zuul-registry. We notice them when making updates to Gerrit because we build multiple images with shared layers. *** https://review.opendev.org/c/zuul/zuul-registry/+/831235 should hopefully address these problems in zuul-registry. * Open discussion

1 0