[Spacewalk-list] Ubuntu/Deb Support

Fri Sep 28 05:11:01 UTC 2018

Am 27. September 2018 22:55:40 MESZ schrieb "Randall R. Sargent" <rrsargent at pilotcat.com>:
>I'm still unable to update packages on Xenial. I've updated
>'/usr/lib/python2.7/site-packages/spacewalk/server/rhnRepository.py' to
>include Release files, I'm using spacewalk-debian-sync.pl &
>spacewalk-add-debian-multiarch-header.py to sync repos and
>'secureApt.sh' to sign the files. Running 'apt update' on the client
>gives zero errors on the Spacewalk repos. Still not working.

Also no warning anymore about low security SHA1?

Well...I would tail the http logs while trying to update a package on the client. As it is trying to update the cache, you should find requests to your release and package files.

Finally.. Debug python. Schedule a package install via SW and run "python -i -m pdb $(which rhn_check)" on the client

You need to know the line within the python-apt module you want to start debug. (I think it's the "update" function within the "cache.py" file). Set a breakpoint within debugger with "break <full_path_to_file>:<line_number>"

Robert
>
>Does anyone have ideas? How can I debug to get the reason why the
>rhnpush-initiated update is failing?
>
>/etc/rhn/spacewalk-debian-sync.pl
>--url=http://us.archive.ubuntu.com/ubuntu/dists/xenial/main/binary-amd64/
>--channel=xenial-main --username=xxxx --password=xxxx
>
>/etc/rhn/spacewalk-add-debian-multiarch-header.py
>/var/cache/rhn/repodata/xenial-main/Packages
>/var/satellite/sat-tmp/xenial-main
>
>gzip -c /var/cache/rhn/repodata/xenial-main/Packages.new >
>/var/cache/rhn/repodata/xenial-main/Packages.gz && touch -r
>/var/cache/rhn/repodata/xenial-main/Packages 
>
>/var/cache/rhn/repodata/xenial-main/Packages.gz 
>
>/etc/rhn/secureApt.sh xenial-main Xenial
>
>-----Original Message-----
>From: Randall R. Sargent 
>Sent: Thursday, September 27, 2018 8:40 AM
>To: 'Robert Paschedag' <robert.paschedag at web.de>;
>spacewalk-list at redhat.com
>Cc: spacewalk-list at redhat.com
>Subject: RE: [Spacewalk-list] Ubuntu/Deb Support
>
>The other issue I'm having is the sync script keeps keeps giving me
>"rhnpush failed". The first time it was permissions issues for the
>apache process on /tmp. I fixed that and got about 75% of the way
>finished syncing, then it did it again. Next I tried running it as
>'apache' and now I'm getting permission issues writing to
>'/usr/share/httpd/.rhnpushcache'.
>
>-----Original Message-----
>From: Robert Paschedag <robert.paschedag at web.de>
>Sent: Thursday, September 27, 2018 12:07 AM
>To: spacewalk-list at redhat.com; Randall R. Sargent
><rrsargent at pilotcat.com>
>Cc: spacewalk-list at redhat.com
>Subject: Re: [Spacewalk-list] Ubuntu/Deb Support
>
>Am 27. September 2018 07:03:19 MESZ schrieb Robert Paschedag
><robert.paschedag at web.de>:
>>Am 26. September 2018 18:01:16 MESZ schrieb "Randall R. Sargent"
>><rrsargent at pilotcat.com>:
>>>Thanks Robert.
>>>
>>>I applied the patch for rhnRepository.py and verified the client 
>>>version is up to date using the criteria gave (spacewalk.list). I did
>
>>>follow Phil's blog and have been able to create Release & Release.gpg
>
>>>files. I did not do any of the patching he mentioned though because
>>I'm
>>>assuming my versions are updated since he wrote the post.
>>>
>>>Attempting to patch after that gives me the same error.
>>>
>>>Next I am trying to run your add-multiarch-header script but am
>>getting
>>>the following error: 
>>>
>>>/etc/rhn/spacewalk-add-debian-multiarch-header.py
>>>/var/cache/rhn/repodata/xenial-main/Packages /tmp/xenial-main
>>>Error: Inputfile '/tmp/xenial-main' not available.
>>>
>>>Am I just running your modified script, or do I need to run 
>>>spacewalk-debian-sync.pl before?
>>
>>Of course you must sync the repos with the modified sync script (as 
>>stated). This extracts the Multi-Arch headers from the original Ubuntu
>
>>/ Debian repos and writes them to temporary files within /tmp.
>
>But you should check your repos are signed correctly by running apt-get
>update.
>
>If this does not work correctly or complains about missing release
>files, you made a mistake somewhere.
>
>Robert
>>
>>Robert
>>>
>>>Thanks again.
>>>
>>>-----Original Message-----
>>>From: Robert Paschedag <robert.paschedag at web.de>
>>>Sent: Wednesday, September 26, 2018 10:10 AM
>>>To: Randall R. Sargent <rrsargent at pilotcat.com>
>>>Cc: spacewalk-list at redhat.com
>>>Subject: Aw: RE: [Spacewalk-list] Ubuntu/Deb Support
>>>
>>>
>>>
>>>> Gesendet: Mittwoch, 26. September 2018 um 15:16 Uhr
>>>> Von: "Randall R. Sargent" <rrsargent at pilotcat.com>
>>>> An: "Robert Paschedag" <robert.paschedag at web.de>, 
>>>> "spacewalk-list at redhat.com" <spacewalk-list at redhat.com>, 
>>>> "spacewalk-list at redhat.com" <spacewalk-list at redhat.com>
>>>> Betreff: RE: [Spacewalk-list] Ubuntu/Deb Support
>>>>
>>>> I'm having no luck getting my xenial clients to recognize the
>>Release
>>>& Release.gpg files in my repos. I resorted to modifying the 
>>>pre-invoke.py script to write [trusted=yes] for each line in 
>>>spacewalk.list, now I'm no longer getting complaints about missing 
>>>Release files when I do an apt update. I am still unable to upgrade
>>any
>>>packages though:
>>>> 
>>>> # rhn_check -vvvv
>>>> D: check_action{'action': "<?xml
>>>>
>>>version='1.0'?>\n<methodCall>\n<methodName>packages.update</methodName
>>>>
>>>>\n<params>\n<param>\n<value><array><data>\n<value><array><data>\n<val
>>>>
>>>ue><string>bind9-host</string></value>\n<value><string>9.10.3.dfsg.P4<
>>>>
>>>/string></value>\n<value><string>8ubuntu1.11</string></value>\n<value>
>>>>
>>><string>1</string></value>\n<value><string>amd64-deb</string></value>\
>>>>
>>>n</data></array></value>\n</data></array></value>\n</param>\n</params>
>>>> \n</methodCall>\n", 'version': 2, 'id': 26}
>>>> updateLoginInfo() login info
>>>> D: login(forceUpdate=True) invoked
>>>> logging into up2date server
>>>> D: rpcServer: Calling XMLRPC up2date.login
>>>> D: writeCachedLogin() invoked
>>>> D: Wrote pickled loginInfo at 1537966985.67 with expiration of
>>>1537970585.67 seconds.
>>>> successfully retrieved authentication token from up2date server
>>>> D: logininfo:{'X-RHN-Server-Id': 1000010000,
>>>'X-RHN-Auth-Server-Time': 
>>>> '1537966985.69', 'X-RHN-Auth': 
>>>> '8okffYSJDt+fznMR/PhU4rZCo31NCg9sFe84Gx6oRVo=',
>>>'X-RHN-Auth-Channels': 
>>>> [['xenial-main', '20180925171652', '1', '1'], ['xenial-security', 
>>>> '20180925175349', '0', '1'], ['xenial-updates', '20180925172643',
>>>'0',
>>>> '1']], 'X-RHN-Auth-User-Id': '', 'X-RHN-Auth-Expire-Offset':
>>>'3600.0'}
>>>> D: handle_action{'action': "<?xml
>>>>
>>>version='1.0'?>\n<methodCall>\n<methodName>packages.update</methodName
>>>>
>>>>\n<params>\n<param>\n<value><array><data>\n<value><array><data>\n<val
>>>>
>>>ue><string>bind9-host</string></value>\n<value><string>9.10.3.dfsg.P4<
>>>>
>>>/string></value>\n<value><string>8ubuntu1.11</string></value>\n<value>
>>>>
>>><string>1</string></value>\n<value><string>amd64-deb</string></value>\
>>>>
>>>n</data></array></value>\n</data></array></value>\n</param>\n</params>
>>>> \n</methodCall>\n", 'version': 2, 'id': 26}
>>>> D: handle_action actionid = 26, version = 2
>>>> D: do_call packages.update([['bind9-host', '9.10.3.dfsg.P4', 
>>>> '8ubuntu1.11', '1', 'amd64-deb']],){'cache_only': None}
>>>> D: Called update[['bind9-host', '9.10.3.dfsg.P4', '8ubuntu1.11',
>>'1',
>>>
>>>> 'amd64-deb']]
>>>> Apt-Spacewalk: Updating sources.list
>>>
>>>Error starts here
>>>
>>>> D: Sending back response(1, 'update failed', {})
>>>
>>>The python-apt module failes to verify the repos.
>>>
>>>You said, your are using SW 2.8. Release? If yes, you are missing a 
>>>patch to support "signed" debian repos. See PR 
>>>https://github.com/spacewalkproject/spacewalk/pull/636. This is the 
>>>part you need to patch on the server.
>>>
>>>You also need to patch the clients. If you installed the newest 
>>>packages (as stated within this thread), your clients should be ok.
>>You
>>>can check this within your /etc/apt/sources.list.d/spacewalk file. If
>
>>>this file contains one line for each channel your client subscribes, 
>>>you are fine.
>>>
>>>Now you still need to create the "InRelease" or "Release.gpg" files.
>>>@Phil has written in his blog years ago. See 
>>>http://www.devops-blog.net/spacewalk/gpg-signing-apt-repository-in-spa
>>>cewalk
>>>
>>>You need to create these files for each repo, of course.
>>>
>>>But even if this all works, you might still hit another bug with
>newer 
>>>Ubuntu / Debian distros using newer APT version, which got some 
>>>"improvements".
>>>The error you might hit is the missing "Multi-Arch" header missing 
>>>within the repo meta data for each channel.
>>>
>>>So.....what I currently do (on my SW 2.7) system is.
>>>
>>>- Use the "old" sync script from Steve Meier in a modified version.
>>>(see my repo
>>>https://github.com/rpasche/spacewalk-debian-sync/tree/add-multiarch-he
>>>ader)
>>>- wait some minutes after the sync finshed to let SW recreate the 
>>>"packages.gz" for each channel (here, the "Multi-Arch" headers are
>>>missing)
>>>- now run my spacewalk-add-debian-multiarch-header script to add the 
>>>missing headers to the packages.gz for each Debian channel I synced 
>>>before.
>>>- now sign the repos
>>>
>>>Now, if all went well, clients have been patched (apt-spacewalk), 
>>>server has been patched (rhnRepository.py - see PR 636), your clients
>
>>>should work.
>>>
>>>Robert
>>>
>>>> D: do_call packages.checkNeedUpdate('rhnsd=1',){}
>>>> D: Called refresh_list
>>>> Updating package profile
>>>> D: rpcServer: Calling XMLRPC registration.welcome_message
>>>> D: rpcServer: Calling XMLRPC registration.update_packages
>>>> D: local action status: (0, 'package list refreshed', {})
>>>> D: rpcServer: Calling XMLRPC registration.welcome_message
>>>> 
>>>> Does anyone have any ideas?
>>>> 
>>>> 
>>>> 
>>>> -----Original Message-----
>>>> From: Robert Paschedag <robert.paschedag at web.de>
>>>> Sent: Monday, September 24, 2018 2:28 PM
>>>> To: spacewalk-list at redhat.com; Randall R. Sargent 
>>>> <rrsargent at pilotcat.com>; spacewalk-list at redhat.com
>>>> Subject: Re: [Spacewalk-list] Ubuntu/Deb Support
>>>> 
>>>> Am 24. September 2018 21:07:58 MESZ schrieb "Randall R. Sargent"
>>><rrsargent at pilotcat.com>:
>>>> >Thanks much for this. I’m not seeing any difference in the
>behavior
>>
>>>> >of my 16.04 clients. They are able to register, but doing a
>package
>>
>>>> >update fails (any package):
>>>> >
>>>> >[cid:image001.png at 01D4540F.FE7E7510]
>>>> >
>>>> 
>>>> I'm pretty sure, you are not using signs repos.
>>>> 
>>>> Newer "apt", especially the python "apt" module fails while
>checking
>>>the signatures of the repo, thus the "update" fails.
>>>> 
>>>> Note: it is the update ("apt-get update") within the call to
>install
>>>the package that fails.
>>>> 
>>>> I also had this error with Debian 9, because I did not yet "sign"
>my
>>>repos and used "Allow unsigned = true" within apt.conf.
>>>> 
>>>> But these settings seem to be ignored, hence, the "apt" python
>>module
>>>"requires" the repos to be signed. It took me a while to debug this.
>>>> 
>>>> In case you "are" using signs repos, you should provide some more
>>>info...e.g. "rhn_check -vvvv" while trying to install a package via
>>SW.
>>>> 
>>>> Robert
>>>> 
>>>> >From: spacewalk-list-bounces at redhat.com 
>>>> ><spacewalk-list-bounces at redhat.com> On Behalf Of Neal Gompa
>>>> >Sent: Monday, September 24, 2018 12:49 PM
>>>> >To: spacewalk-list at redhat.com
>>>> >Subject: Re: [Spacewalk-list] Ubuntu/Deb Support
>>>> >
>>>> >On Mon, Sep 24, 2018 at 10:59 AM Randall R. Sargent 
>>>> ><rrsargent at pilotcat.com<mailto:rrsargent at pilotcat.com>> wrote:
>>>> >Hi all,
>>>> >
>>>> >*Newbie* to Spacewalk here. At the risk of beating a dead horse,
>>has
>>>
>>>> >anyone been able to successfully manage Ubuntu clients on 2.8? We 
>>>> >have
>>>> >14.04 & 16.04 clients and it would make my life so much easier if
>I
>>
>>>> >could get them to reliably work. I have been able to get 14.04 to 
>>>> >register, and even update (with minor issues), but not 16.x.
>>>> >Documentation is spotty out there in Google-land.
>>>> >
>>>> >Any help is appreciated!
>>>> >
>>>> >
>>>> >Hey, yeah, it's possible to successfully manage Ubuntu clients
>with
>>
>>>> >Spacewalk 2.8.
>>>> >
>>>> >A couple of months ago, my colleague and I fixed the clients to
>>work
>>>
>>>> >in Spacewalk git master (upcoming Spacewalk 2.9), and we
>backported
>>
>>>> >this to the 2.8 clients.
>>>> >
>>>> >The sources are here:
>>>>
>>>>https://gitlab.com/datto/engineering/spacewalk-debian-client-packages
>>>> >
>>>> >We also built the packages and published them on OBS. You can use 
>>>> >them by doing the following:
>>>> >
>>>> ># If you have older clients from Debian/Ubuntu repos $ sudo apt
>>>purge
>>>> >apt-transport-spacewalk rhnsd $ sudo apt autoremove # Installing
>>the
>>>
>>>> >new packages $ sudo bash -c 'echo "deb
>>>>
>>>>http://download.opensuse.org/repositories/systemsmanagement:/spacewalk:
>>>> >/2.8:/debclients/xUbuntu_16.04/ /" > 
>>>> >/etc/apt/sources.list.d/spacewalk2.8-debclients.list'
>>>> >$ sudo apt-key adv --fetch-keys
>>>>
>>>>http://download.opensuse.org/repositories/systemsmanagement:/spacewalk:
>>>> >/2.8:/debclients/xUbuntu_16.04/Release.key
>>>> >$ sudo apt-get update
>>>> >$ sudo apt install rhn-client-tools rhn-check rhn-setup rhnsd 
>>>> >apt-transport-spacewalk rhncfg rhncfg-actions
>>>> >
>>>> >There are builds for xUbuntu 16.04 and 18.04, as well as Debian
>8.0
>>
>>>> >and 9.0. Just swap "xUbuntu_16.04" in the instructions above for 
>>>> >"xUbuntu_18.04" or "Debian_8.0" or "Debian_9.0".
>>>> >
>>>> >Future development of the clients are going into Spacewalk's next 
>>>> >release.
>>>> >
>>>> >
>>>> >
>>>> >--
>>>> >真実はいつも一つ！/ Always, there's only one truth!
>>>> 
>>>> 
>>>> --
>>>> sent from my mobile device
>>>> 
>>>>
>>
>>
>>--
>>sent from my mobile device
>>
>>_______________________________________________
>>Spacewalk-list mailing list
>>Spacewalk-list at redhat.com
>>https://www.redhat.com/mailman/listinfo/spacewalk-list
>
>
>--
>sent from my mobile device

-- 
sent from my mobile device