February 2016 - Arch-devops - lists.archlinux.org

[arch-devops] Moving projects.archlinux.org to luna.archlinux.org
by Sébastien Luttringer 23 Apr '16

23 Apr '16

Hello, Florian suggested to move cgit and archweb to nymeria or luna. In this mail, I will only focus on cgit, better known as projects.archlinux.org. Currently: - the web interface is a cgit on gudrun. - http server is apache and run cgit via cgi-bin - cgit scan /srv/git for repositories - /srv/git is a NFS mountpoint from gerolde - so, the git repositories are on gerolde - users push to repos via ssh directly on gerolde. They will have to update their remotes url. - the total space of git repositories is about 730MiB Currently, my preference would be to move the storage and the web interface on the same host. I see more benefits than moving web interface on luna and git repo on nymeria. We don't eat the space twice and we have all the repo accessible under the projects.al.org dns. Nonetheless, if we move the storage to nymeria, we save the configuration of ssh access to all devs + externals to luna. Not sure if this is relevant if we move to accounts to ldap. Thoughts? Here is a short planning if we go through this option: 1) setup a new cgit on luna (with nginx and uwsgi) 2) copy repos for testing purpose 3) create gitshell access to users 4) plan official migration date 5) reduce dns ttl of projects.al.org 6) wait for it 7) cut write access to gerolde repo 8) final repo sync 9) update dns records and restore ttl 10) take a beer I see there is also dev.archlinux.org on gudrun that I could also move to luna too. Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

6 13

[arch-devops] Upgrade SSL CAs to SHA-2
by Sébastien Luttringer 29 Feb '16

29 Feb '16

Hello, I upgraded the luna intermediate CA and RootCA to the new StartSSL certs with SHA-2 signatures. The *.archlinux.org certs is still using SHA-1 signature (so no green bar) which expire this April. Should we move to Letsencrypt or do we still want to use the star certificate? Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

2 1

[arch-devops] [RFC] Planning testing of the new dbscripts
by Florian Pritz 24 Feb '16

24 Feb '16

Hi, CC'in arch-dev-public just so everyone gets a heads-up. Please send all discussion to arch-devops. A long long time ago in a galaxy far, far away.... No wait, just a long long time ago. Work on improving dbscripts[1] has resumed and thanks to Gabriel Souza Franco we finally have something[2] that should easily support git packages as well as debug packages, split packages across multiple repos and with different arches. It has lots of new tests, but it could really use a field test and we need to figure out how we want to deploy it once we are satisfied. Please note that the wiki page is not entirely up to date, especially everything other than the migration plan. [1] https://wiki.archlinux.org/index.php/User:Bluewind/dbscripts-rewrite [2] https://github.com/gbsf/dbscripts/commits/master The new dbscripts no longer change the svn repo so the repos subdir is not needed any more. All they require is some form of a tag (like a git tag) to fetch the PKGBUILD. This means we are pretty much free to use whatever we like (including git) as long as we can tag stuff. For the time being we can stick with svn if we like. Using tags obviously requires that the existing repositories are migrated and that devs/TUs use the new scripts that generate them. This migration is required for the new svn layout and if we switch to git. It is probably a good idea to do both at once so people don't have to update twice, but I'll only do that if we plan this thoroughly. Currently we treat also extra/core and community separately, but I think there is no real reason for that apart from that we migrated it like that from gerolde. If possible, I'd like to get rid of this distinction. RFC: As for testing, I'd like some input on my (rather preliminary) migration plan[3] and opinions on whether we want to test it directly on nymeria or somewhere else. [3] https://wiki.archlinux.org/index.php/User:Bluewind/dbscripts-rewrite#Migr= ation_Plan Florian

2 1

[arch-devops] Arch Linux ISO Checksums on archlinux.org
by Christian Rebischke 24 Feb '16

24 Feb '16

Hello, Linux Mint had a security breach [1] and was serving an infected ISO. I think this would be a good moment for thinking about our Arch Linux Download-page on [2]. I recommend to change the checksums. MD5 and SHA1 are both broken.[3][4] What do you think about using SHA256 ( or even better SHA512 ) for this? Maybe we should also sign the ISO with a GPG-Key. I don't mean that we should remove the MD5 checksum but we should add some other checksum and sign the ISO. You can call me paranoid but I don't want too see such a security fail on archlinux.org Best regards, Chris Arch Linux Security Team [1] http://arstechnica.com/security/2016/02/linux-mint-hit-by-malware-infection… [2] https://www.archlinux.org/download/ [3] http://www.mathstat.dal.ca/~selinger/md5collision/ [4] https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html

5 5

[arch-devops] Arch DevOps mailing list
by Sébastien Luttringer 23 Feb '16

23 Feb '16

Hello, A new arch-devops mailing list has been added to lists.archlinux.org. The list should be used to discuss Arch Linux infrastructure and operations topics. Permission scheme are based on arch-dev-public; list is open for subscription to anyone and writing only for Arch Linux Staff. So, the moderation flag should be removed by mail to be able to write. If you can't do it, ping me. Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

6 7

[arch-devops] Email delivery issues to Microsoft
by Florian Pritz 12 Feb '16

12 Feb '16

Hi, Just a quick update to our email situation: Microsoft seems to think we are sending spam mails. I believe this to be related to spam comments posted on the aur. SNDS shows that spam started to be sent on February 6th/7th. Can we track down if a spam comment has been posted on that day? I've enabled Microsoft's Junk Mail Reporting Program (I get the reports I think) and I've contacted their postmaster support. Let's hope they fix the problem or reply. Apart from that I also noticed that I forgot to disable soft_bounce again after I set up DKIM. This might be related since a single mail that is rejected would end up retrying for days even if it is rejected with 550. Yahoo is also still blocking us and doesn't seem impressed that we now have DKIM. Florian

1 1

[arch-devops] DKIM on luna and nymeria
by Florian Pritz 02 Feb '16

02 Feb '16

Hi, Just a quick note: I've set up opendkim on luna and nymeria in the hope that this will help us deliver mail to yahoo again. Florian

2 2