Re: Switching XZ for ZSTD?

2024-04-04 Thread Alexander Sosedkin
On Thu, Apr 4, 2024 at 8:00 PM Arnie T via devel wrote: > > Hello Kevin, > > > I'm hopeful some things will come out of this as it's a chance for us to > > look at our processes and improve them. > > I'm glad that's happening. It seems to me that improving those processes > would be Distro

Re: F41 Change Proposal: Disable openSSL Engine Support (system-wide)

2024-03-20 Thread Alexander Sosedkin
On Wed, Mar 20, 2024 at 6:52 PM Ali Erdinc Koroglu wrote: > > > > On 08/03/2024 22:37, Aoife Moloney wrote: > > Wiki - https://fedoraproject.org/wiki/Changes/OpensslNoEngine > > > > This is a proposed Change for Fedora Linux. > > This document represents a proposed Change. As part of the Changes

Re: So you can't just copy 'sources' from one package to another?

2024-03-08 Thread Alexander Sosedkin
On Fri, Mar 8, 2024 at 5:19 PM Richard W.M. Jones wrote: > > For mingw-* packages we (sometimes) have a separate package from the > native package, eg. libgcrypt vs mingw-libgcrypt. Therefore two > different packages are sometimes built with the exact same sources. > > However I discovered

Re: status openssl1.1

2023-10-16 Thread Alexander Sosedkin
On Mon, Oct 16, 2023 at 8:55 AM josef radinger via devel wrote: > openssl1.1 reached EOS on recently (11th September 2023 I assume) > https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/ > > according to > https://www.openssl.org/source/: > ... > The previous LTS version (the 1.1.1 series) is

Re: Intention to tighten RPM crypto-policy back

2023-09-27 Thread Alexander Sosedkin
On Tue, Sep 19, 2023 at 11:19 AM Alexander Sosedkin wrote: > > Hello, > > 6 months ago, there's been a F38 blocker: https://pagure.io/fesco/issue/2960 > Long story short: > RPM has moved to sequoia, > sequoia has started respecting crypto-policies, > Google repos have bee

Re: Intention to tighten RPM crypto-policy back

2023-09-27 Thread Alexander Sosedkin
On Wed, Sep 27, 2023 at 2:38 PM Stephen Gallagher wrote: > > On Wed, Sep 27, 2023 at 7:06 AM Alexander Sosedkin > wrote: > ... > > Feel free to strike down these proposals > > using whatever mechanisms Fedora governance offers. > > https://fedoraproject.org/wiki

Re: Intention to tighten RPM crypto-policy back

2023-09-27 Thread Alexander Sosedkin
On Tue, Sep 26, 2023 at 7:40 PM Kevin Kofler via devel wrote: > > Alexander Sosedkin wrote: > > Because of that, I'd like to revert that RPM policy relaxation > > https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/a12f7b20638be8f872ad1995c7d2edce41c227b5 &g

Re: Intention to tighten RPM crypto-policy back

2023-09-27 Thread Alexander Sosedkin
On Tue, Sep 26, 2023 at 7:47 PM Peter Robinson wrote: > > On Tue, Sep 19, 2023 at 10:20 AM Alexander Sosedkin > wrote: > > > > Hello, > > > > 6 months ago, there's been a F38 blocker: https://pagure.io/fesco/issue/2960 > > Long story short: > > RPM

Re: Intention to tighten RPM crypto-policy back

2023-09-26 Thread Alexander Sosedkin
On Tue, Sep 19, 2023 at 7:47 PM Kevin Fenzi wrote: > > On Tue, Sep 19, 2023 at 11:19:18AM +0200, Alexander Sosedkin wrote: > > Hello, > > > > 6 months ago, there's been a F38 blocker: https://pagure.io/fesco/issue/2960 > > Long story short: > > RPM has moved

Re: Intention to tighten RPM crypto-policy back

2023-09-26 Thread Alexander Sosedkin
On Tue, Sep 19, 2023 at 12:44 PM Miroslav Suchý wrote: > > Dne 19. 09. 23 v 11:19 Alexander Sosedkin napsal(a): > > Because of that, I'd like to revert that RPM policy relaxation > > https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/a12f7b20638be8f872ad19

Re: Intention to tighten RPM crypto-policy back

2023-09-19 Thread Alexander Sosedkin
On Tue, Sep 19, 2023 at 11:19 AM Alexander Sosedkin wrote: > > Hello, > > 6 months ago, there's been a F38 blocker: https://pagure.io/fesco/issue/2960 > Long story short: > RPM has moved to sequoia, > sequoia has started respecting crypto-policies, > Google repos have bee

Intention to tighten RPM crypto-policy back

2023-09-19 Thread Alexander Sosedkin
Hello, 6 months ago, there's been a F38 blocker: https://pagure.io/fesco/issue/2960 Long story short: RPM has moved to sequoia, sequoia has started respecting crypto-policies, Google repos have been signed with a 1024-bit DSA key, Google Chrome was not installable => F38 blocker. Back at the

Re: RPM Sequoia: A Sequoia-based backend for the RPM Package Manager

2023-04-27 Thread Alexander Sosedkin
On Thu, Apr 27, 2023 at 12:52 PM Neal H. Walfield wrote: > A year and a half ago, I began working with Panu on using Sequoia as > RPM's OpenPGP parser. I wrote up our journey from the initial > analysis, to adding the code to RPM, and to getting it into Fedora 38 > (yay!) in a blog post. I'm

Re: How to migrate database format during package update?

2023-02-01 Thread Alexander Sosedkin
On Wed, Feb 1, 2023 at 1:57 PM Milan Crha wrote: > this is a query for an opinion and a best-practice experience for a > case when a package needs to change its internal database format > between versions, in an environment, which does not allow real > migration, aka the app cannot read both

Re: Potential kTLS issue with TLS-PSK, GnuTLS + Rawhide - how to debug it?

2022-11-25 Thread Alexander Sosedkin
On Fri, Nov 25, 2022 at 1:14 PM Richard W.M. Jones wrote: > > Hi Daiki & Frantisek, > > There's a new error that is appearing in the libnbd test suite when > testing TLS-PSK. Regular TLS (with X.509 certs) works fine. It seems > to have started since I upgraded the kernel on my machine from

Re: F38 proposal: Reproducible builds: Clamp build mtimes to $SOURCE_DATE_EPOCH (System-Wide Change proposal)

2022-11-11 Thread Alexander Sosedkin
On Fri, Nov 11, 2022 at 2:03 PM Florian Weimer wrote: > > * Alexander Sosedkin: > > > On Fri, Nov 11, 2022 at 11:53 AM Petr Pisar wrote: > >> An RPM package itself carry a build time in its RPM header. > >> Are we also going to fake this time in the name of

Re: F38 proposal: Reproducible builds: Clamp build mtimes to $SOURCE_DATE_EPOCH (System-Wide Change proposal)

2022-11-11 Thread Alexander Sosedkin
On Fri, Nov 11, 2022 at 11:53 AM Petr Pisar wrote: > > V Thu, Nov 10, 2022 at 03:23:49PM -0500, Ben Cotton napsal(a): > > https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes > > > > == Summary == > > > > The `%clamp_mtime_to_source_date_epoch` RPM macro will be set to `1`. > >

Re: F40 proposal: Porting Fedora to Modern C (System-Wide Change proposal)

2022-10-25 Thread Alexander Sosedkin
On Tue, Oct 25, 2022 at 7:42 PM Florian Weimer wrote: > > * Alexander Sosedkin: > > > Since it's a build-time-only change, > > can it be rolled out under controlled pressure like this? > > > > 1. every package explicitly opts out (with some macro in specfile

Re: F40 proposal: Porting Fedora to Modern C (System-Wide Change proposal)

2022-10-25 Thread Alexander Sosedkin
On Tue, Oct 25, 2022 at 5:09 PM Daniel P. Berrangé wrote: > So this change is talking about a new GCC landing in Fedora 40. > > To avoid massive disruption to Fedora though, we need to be doing > work way earlier than the Fedora 40 dev cycle though. > > Identifying all the places where

Re: F39 proposal: Replace DNF with DNF5 (System-Wide Change proposal)

2022-10-12 Thread Alexander Sosedkin
On Wed, Oct 12, 2022 at 4:47 PM Stephen Smoogen wrote: > On Wed, 12 Oct 2022 at 10:32, Kevin P. Fleming wrote: >> On 10/12/22 08:59, Stephen Smoogen wrote: >> > Maybe call it the Fedora Update Manager 'FUM' ? >> >> Unless we're going to call it RUM when it makes its way into RHEL, that >> name

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Alexander Sosedkin
On Wed, Sep 14, 2022 at 6:40 PM Kevin Fenzi wrote: > > On Wed, Sep 14, 2022 at 11:45:16AM +0200, Alexander Sosedkin wrote: > > On Tue, Sep 13, 2022 at 7:35 PM Kevin Fenzi wrote: > > > > > > How about this: > > > > > > Drop the term 'jump scare' ent

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Alexander Sosedkin
On Tue, Sep 13, 2022 at 7:35 PM Kevin Fenzi wrote: > > How about this: > > Drop the term 'jump scare' entirely. IMHO it just sounds bad. I'm open for proposals on the wording. =) > Rework the change so it's basically planning on making this change in > f38. That makes it closer than currently,

Re: rpm with sequoia pgp

2022-09-05 Thread Alexander Sosedkin
On Mon, Sep 5, 2022 at 10:55 AM Fabio Valentini wrote: > > On Mon, Sep 5, 2022 at 10:12 AM Alexander Sosedkin > wrote: > > > > Quoting Neal H. Walfield (2022-09-02 16:31:18) > > > rpm 4.18 is on the horizon and includes a new OpenPGP backend based on > >

Re: rpm with sequoia pgp

2022-09-05 Thread Alexander Sosedkin
Quoting Neal H. Walfield (2022-09-02 16:31:18) > rpm 4.18 is on the horizon and includes a new OpenPGP backend based on > Sequoia PGP. > > https://rpm.org/wiki/Releases/4.18.0 > https://sequoia-pgp.org/ > > Thanks to Fabio Valentini (decathorpe) for packaging not only > rpm-sequoia, but all of

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-30 Thread Alexander Sosedkin
On Mon, Aug 29, 2022 at 10:48 PM Miro Hrončok wrote: > > On 29. 08. 22 20:30, Ben Cotton wrote: > > https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 > > > > == Summary == > > > > Cryptographic policies will be tightened in Fedora ''38''-39, > > SHA-1 signatures will no

Re: [Fedocal] Reminder meeting : ELN SIG

2022-08-26 Thread Alexander Sosedkin
On Fri, Aug 26, 2022 at 5:09 PM Stephen Gallagher wrote: > On Fri, Aug 26, 2022 at 10:12 AM Alexander Sosedkin > wrote: > > On Fri, Aug 26, 2022 at 4:06 PM Troy Dawson wrote: > > > On Fri, Aug 26, 2022 at 6:55 AM Alexander Sosedkin > > > wrote: > >

Re: [Fedocal] Reminder meeting : ELN SIG

2022-08-26 Thread Alexander Sosedkin
On Fri, Aug 26, 2022 at 4:06 PM Troy Dawson wrote: > On Fri, Aug 26, 2022 at 6:55 AM Alexander Sosedkin > wrote: >> Not a full-blown meeting prompt, >> but I recall complaining about `fipscheck` missing from ELN repositories, >> and IIRC it was blocked on something th

Re: [Fedocal] Reminder meeting : ELN SIG

2022-08-26 Thread Alexander Sosedkin
On Fri, Aug 26, 2022 at 2:54 PM Stephen Gallagher wrote: > > On Thu, Aug 25, 2022 at 8:00 AM wrote: > > > > Dear all, > > > > You are kindly invited to the meeting: > >ELN SIG on 2022-08-26 from 12:00:00 to 13:00:00 US/Eastern > >At fedora-meet...@irc.libera.chat > > > > The meeting will

Re: Ruby FTBFS due to "SHA-1 jump scare"

2022-08-24 Thread Alexander Sosedkin
On Wed, Aug 24, 2022 at 4:33 PM Alexander Sosedkin wrote: > > On Wed, Aug 24, 2022 at 4:32 PM Fabio Valentini wrote: > > > > On Wed, Aug 24, 2022 at 4:28 PM Alexander Sosedkin > > wrote: > > > > > > On Wed, Aug 24, 2022 at 4:18 PM Vít

Re: Ruby FTBFS due to "SHA-1 jump scare"

2022-08-24 Thread Alexander Sosedkin
On Wed, Aug 24, 2022 at 4:32 PM Fabio Valentini wrote: > > On Wed, Aug 24, 2022 at 4:28 PM Alexander Sosedkin > wrote: > > > > On Wed, Aug 24, 2022 at 4:18 PM Vít Ondruch wrote: > > > > > > Alexander, > > > > > > Would you m

Re: Ruby FTBFS due to "SHA-1 jump scare"

2022-08-24 Thread Alexander Sosedkin
On Wed, Aug 24, 2022 at 4:18 PM Vít Ondruch wrote: > > Alexander, > > Would you mind to comment on your intentions with: > > https://src.fedoraproject.org/rpms/crypto-policies/c/2f33ffcfa7192037f969c6a28e092aca767a1415?branch=rawhide > > which just landed in Fedora and broke Ruby test suite (even

Re: ca-certificates latest updates and Mozilla NSS certdata.txt modifications

2022-08-19 Thread Alexander Sosedkin
On Thu, Aug 18, 2022 at 1:45 PM Yann Droneaud wrote: > I've noticed ca-certificates package was updated recently, and went looking > at the changes, and I have some questions. Not Bob Relyea, but I'll try to answer to the best of my knowledge: > The first issue is what certdata.txt was used ?

Re: help needed on AskFedora: OpenSSLv3 error when connecting to Eduroam

2022-06-30 Thread Alexander Sosedkin
Quoting Kevin Kofler via devel (2022-06-30 14:15:04) > You are making two doubtful assumptions: > > 1. That the users will bother reporting their issues to the server > administrators at all. I would expect them to just blame Fedora for it and > move to a different operating system that just

Re: help needed on AskFedora: OpenSSLv3 error when connecting to Eduroam

2022-06-30 Thread Alexander Sosedkin
Quoting Kevin Kofler via devel (2022-06-30 13:16:55) > Clemens Lang wrote: > > I hope you’re not suggesting we keep the defaults insecure because there > > are some institutions out there that don’t support modern standards. > > Sorry, but I am. > The defaults need to work out there in the real

Re: Package proposal: google-drive-ocamlfuse

2022-06-29 Thread Alexander Sosedkin
Quoting Marián Konček (2022-06-29 10:26:13) > I recently discovered this project: > https://github.com/astrada/google-drive-ocamlfuse > > Supposedly it makes it possible to mount google drive as a filesystem > using fuse. Not to devalue the request, but this requirement alone should be covered by

Re: Firefox/nss behaviour change in F36?

2022-06-06 Thread Alexander Sosedkin
On Mon, Jun 6, 2022 at 12:03 PM Bojan Smojver via devel wrote: > > Before I open a bug on this, the latest firefox/nss software that is in F36 - > is it not accepting SSL certificates without matching subjectAlternativeName > on purpose? > > I still have to complete more tests, but it seems

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-31 Thread Alexander Sosedkin
On Tue, May 31, 2022 at 4:09 PM Petr Pisar wrote: > > V Tue, May 31, 2022 at 03:51:26PM +0200, Alexander Sosedkin napsal(a): > > On Tue, May 31, 2022 at 3:45 PM Petr Pisar wrote: > > > > > > V Tue, May 31, 2022 at 02:56:56PM +0200, Alexander Sosedkin napsal(a): >

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-31 Thread Alexander Sosedkin
On Tue, May 31, 2022 at 3:45 PM Petr Pisar wrote: > > V Tue, May 31, 2022 at 02:56:56PM +0200, Alexander Sosedkin napsal(a): > > On Tue, May 31, 2022 at 12:28 PM Vitaly Zaitsev via devel > > wrote: > > > On 31/05/2022 10:21, Petr Pisar wrote: > > > > No

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-31 Thread Alexander Sosedkin
On Tue, May 31, 2022 at 12:28 PM Vitaly Zaitsev via devel wrote: > On 31/05/2022 10:21, Petr Pisar wrote: > > Not in current F37 FUTURE policy the user tested. > > Yes. If the new F37 cryptographic policy considers RSA-2048 to be weak, > it should be reverted. The actual proposal is in the OP.

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-31 Thread Alexander Sosedkin
On Mon, May 30, 2022 at 10:34 PM Garry T. Williams wrote: > > On Friday, April 29, 2022 5:49:05 PM EDT Ben Cotton wrote: > > Cryptographic policies will be tightened in Fedora 38-39, > > SHA-1 signatures will no longer be trusted by default. > > Fedora 37 specifically doesn't come with any change

Re: F37 proposal: Build all JDKs in Fedora against in-tree libraries and with static stdc++lib (System-Wide Change proposal)

2022-05-17 Thread Alexander Sosedkin
On Tue, May 17, 2022 at 5:09 PM Daniel P. Berrangé wrote: > > On Tue, May 17, 2022 at 04:20:56PM +0200, Tomasz Torcz wrote: > > On Tue, May 17, 2022 at 02:11:03PM +0200, Vitaly Zaitsev via devel wrote: > > > > First - our burden. We ahve to certify each binary. This is quite long > > > > and

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-04 Thread Alexander Sosedkin
On Wed, May 4, 2022 at 12:52 PM Vít Ondruch wrote: > > Dne 04. 05. 22 v 9:32 Alexander Sosedkin napsal(a): > > On Wed, May 4, 2022 at 12:43 AM David Woodhouse wrote: > >> On Mon, 2022-05-02 at 19:33 +0200, Clemens Lang wrote: > >>> This is the reason why the pr

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-04 Thread Alexander Sosedkin
On Wed, May 4, 2022 at 12:43 AM David Woodhouse wrote: > > On Mon, 2022-05-02 at 19:33 +0200, Clemens Lang wrote: > > This is the reason why the proposal contains extensive methods to test > > whether things are going to break by modifying the crypto-policy or using > > bpftrace. Unfortunately

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-03 Thread Alexander Sosedkin
On Tue, May 3, 2022 at 1:20 PM Kevin Kofler via devel wrote: > > Ian Pilcher wrote: > > It sure feels like we're reaching the point where anyone who has to work > > with any sort of older equipment or servers is going to to forced to > > switch their entire system to the LEGACY policy, which

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-02 Thread Alexander Sosedkin
On Mon, May 2, 2022 at 7:18 PM Robbie Harwood wrote: > > Alexander Sosedkin writes: > > > crypto-policies' goal is to define system-wide *defaults*. > > Well, that's certainly part of it, but... > > "The purpose is to unify the crypto policies used by differ

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-02 Thread Alexander Sosedkin
On Mon, May 2, 2022 at 6:28 PM Robbie Harwood wrote: > > JT writes: > > >> IMO, there's a rather desperate need to be able to override the > >> system-wide policy for individual processes, maybe via some sort of > >> wrapper around one of the containerization technologies. > > > > Alternatively

Re: F37 Proposal: Strong crypto settings: phase 3, forewarning 1/2 (System-Wide Change proposal)

2022-05-02 Thread Alexander Sosedkin
On Sat, Apr 30, 2022 at 4:28 PM David Woodhouse wrote: > On Fri, 2022-04-29 at 17:49 -0400, Ben Cotton wrote: > > This document represents a proposed Change. As part of the Changes > > process, proposals are publicly announced in order to receive > > community feedback. This proposal will only be

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-04-28 Thread Alexander Sosedkin
Another status update: 1. USDT/eBPF tracing turned out to be a fruitful logging approach. Clemens Lang has kindly added USDT probes to the latest openssl builds, traceable with a small tool [1] available from a copr [2]. Yes, this way it doesn't log into your face unpromptedly, like

Re: Change proposal: make Change proposals more obvious

2022-04-28 Thread Alexander Sosedkin
On Thu, Apr 28, 2022 at 3:33 PM Gary Buhrmaster wrote: > > On Wed, Apr 27, 2022 at 11:50 PM Adam Williamson > wrote: > > > Could we consider, in future, posting a clarification for journalists > > in flaming six-foot high letters (I exaggerate only slightly) at the > > top of *every* proposed

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-04-21 Thread Alexander Sosedkin
Another status update for transparency purposes: 1. openssl-3.0.2-3 and crypto-policies-20220412-1.git97fe449 now distrust SHA-1 signatures in FUTURE policy or NO-SHA1 subpolicy. Meaning that updating the packages and issuing `update-crypto-policies --set FUTURE` /

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-04-08 Thread Alexander Sosedkin
On Thu, Apr 7, 2022 at 9:06 PM Zbigniew Jędrzejewski-Szmek wrote: > > On Tue, Mar 29, 2022 at 03:34:49PM -0700, Kevin Fenzi wrote: > > On Tue, Mar 29, 2022 at 08:12:47PM +0200, Alexander Sosedkin wrote: > > > > > > "You know these lights in the theaters that go

Re: [Fedocal] Reminder meeting : ELN SIG

2022-04-07 Thread Alexander Sosedkin
On Thu, Apr 7, 2022 at 4:33 PM Alexander Sosedkin wrote: > > On Thu, Apr 7, 2022 at 4:11 PM Stephen Gallagher wrote: > > > > On Thu, Apr 7, 2022 at 8:52 AM wrote: > > > > > > Dear all, > > > > > > You are kindly invited to the meeting: >

Re: [Fedocal] Reminder meeting : ELN SIG

2022-04-07 Thread Alexander Sosedkin
On Thu, Apr 7, 2022 at 4:11 PM Stephen Gallagher wrote: > > On Thu, Apr 7, 2022 at 8:52 AM wrote: > > > > Dear all, > > > > You are kindly invited to the meeting: > >ELN SIG on 2022-04-08 from 12:00:00 to 13:00:00 US/Eastern > >At fedora-meet...@irc.libera.chat > > > > The meeting will

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-04-06 Thread Alexander Sosedkin
On Wed, Apr 6, 2022 at 1:00 PM Vít Ondruch wrote: > > > Dne 08. 03. 22 v 19:40 Alexander Sosedkin napsal(a): > > Hello, community, I need your wisdom for planning a disruptive change. > > > > Fedora 28 had https://fedoraproject.org/wiki/Changes/StrongCryptoSetti

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-29 Thread Alexander Sosedkin
On Tue, Mar 8, 2022 at 7:40 PM Alexander Sosedkin wrote: > > Hello, community, I need your wisdom for planning a disruptive change. > > Fedora 28 had https://fedoraproject.org/wiki/Changes/StrongCryptoSettings > Fedora 33 had https://fedoraproject.org/wiki/Changes/StrongCryp

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-23 Thread Alexander Sosedkin
On Wed, Mar 23, 2022 at 12:51 AM Josh Boyer wrote: > > On Tue, Mar 8, 2022 at 1:40 PM Alexander Sosedkin > wrote: > > > > Hello, community, I need your wisdom for planning a disruptive change. > > > > Fedora 28 had https://fedoraproject.org/wiki/Changes/Stron

Re: Can't fedpkg new-sources (403)

2022-03-16 Thread Alexander Sosedkin
On Wed, Mar 16, 2022 at 3:47 PM Neal Becker wrote: > > Sorry if this is a duplicate message, previous one was held for moderation. > > $ fedpkg new-sources ~/Downloads/unuran-1.9.0.tar.gz > Could not execute new_sources: Fail to upload files. Server returns status 403 > > I haven't been active in

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 7:19 PM Daniel P. Berrangé wrote: > > On Wed, Mar 09, 2022 at 01:05:38PM -0500, Matthew Miller wrote: > > On Wed, Mar 09, 2022 at 05:40:50PM +, Daniel P. Berrangé wrote: > > > > But: maybe if we logged it _and_ had a tool people could run to > > > > look specifically

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 7:05 PM Daniel P. Berrangé wrote: > > On Wed, Mar 09, 2022 at 06:45:49PM +0100, Alexander Sosedkin wrote: > > On Wed, Mar 9, 2022 at 6:22 PM Matthew Miller > > wrote: > > > > > > On Wed, Mar 09, 2022 at 12:14:28PM +0100, Alexander Sosed

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 6:22 PM Matthew Miller wrote: > > On Wed, Mar 09, 2022 at 12:14:28PM +0100, Alexander Sosedkin wrote: > > I left my crystal ball at home today, > > but I don't need it to say it'd be ~0 bugs filed if we log to syslog > > and ~3 if we log to

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 4:40 PM Robbie Harwood wrote: > > Alexander Sosedkin writes: > > > Daniel P. Berrangé wrote: > > > >> Perhaps a useful first step is to just modify the three main > >> crypto libs (gnutls, openssl, and nss) to send a scary warnihg

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 2:47 PM Richard W.M. Jones wrote: > > Previous tightening of crypto defaults caused problems with us > connecting to older ssh servers. > > I am particularly interested / worried about sshd from RHEL 5, 6 & 7 > for virt-p2v and virt-v2v conversions. This broke before,

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 10:57 AM Daniel P. Berrangé wrote: > > On Wed, Mar 09, 2022 at 10:46:21AM +0100, Alexander Sosedkin wrote: > > On Wed, Mar 9, 2022 at 10:20 AM Daniel P. Berrangé > > wrote: > > > > > > On Tue, Mar 08, 2022 at 07:40:15PM +0100, Alexande

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Wed, Mar 9, 2022 at 10:20 AM Daniel P. Berrangé wrote: > > On Tue, Mar 08, 2022 at 07:40:15PM +0100, Alexander Sosedkin wrote: > > We've been disabling it in TLS, but its usage is much wider than TLS. > > The next agonizing step is to restrict its usage for signatures > &

Re: Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-09 Thread Alexander Sosedkin
On Tue, Mar 8, 2022 at 8:52 PM Zbigniew Jędrzejewski-Szmek wrote: > > On Tue, Mar 08, 2022 at 07:40:15PM +0100, Alexander Sosedkin wrote: > > the only realistic way to weed out its reliance on SHA-1 signatures > > from all of its numerous dark corners is to break them.

Landing a larger-than-release change (distrusting SHA-1 signatures)

2022-03-08 Thread Alexander Sosedkin
Hello, community, I need your wisdom for planning a disruptive change. Fedora 28 had https://fedoraproject.org/wiki/Changes/StrongCryptoSettings Fedora 33 had https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2 I believe we should start planning for the next cryptographic defaults

Re: Packaging scrcpy with a precompiled APK dependency.

2022-02-17 Thread Alexander Sosedkin
On Wed, Feb 16, 2022 at 10:00 PM Diego Herrera wrote: > > Hi. I was checking if the scrcpy software [1] could get packaged, but to > continue I need to know how to package an APK package file. For context, this > project consists on a Linux client and an Android server app that is uploaded >

Re: Bugzilla email confirmation notices from FAS

2022-01-11 Thread Alexander Sosedkin
On Tue, Jan 11, 2022 at 6:04 PM Yaakov Selkowitz wrote: > > On Tue, 2022-01-11 at 11:58 -0500, Christopher wrote: > > Hi, > > > > Today, I received an email from f...@fedoraproject.org with the subject > > line "Fedora Account System: please verify your Bugzilla email > > address". This email has

Re: New top-level dir: /state [WAS: Re: F36 Change: Relocate RPM database to /usr (System-Wide Change] proposal)

2022-01-10 Thread Alexander Sosedkin
On Mon, Jan 10, 2022 at 5:20 PM David Cantrell wrote: > > On Wed, Dec 29, 2021 at 10:01:57AM -0500, Ben Cotton wrote: > >https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr > > > >== Summary == > >Currently, the RPM databases is located in `/var`. Let's move it to > >`/usr`. The move is

Re: F36 Change: Make Rescue Mode Work With Locked Root (System-Wide Change proposal)

2021-12-08 Thread Alexander Sosedkin
On Wed, Dec 8, 2021 at 6:10 PM Björn Persson wrote: > > Chris Adams wrote: > > Once upon a time, Björn Persson said: > > > Chris Adams wrote: > > > > If the admin has done one thing to lock down the system, then they can > > > > do another (removing the sulogin --force addition). > > > > > > How

Re: Schedule for Monday's FESCo Meeting (2021-08-23)

2021-08-27 Thread Alexander Sosedkin
On Fri, Aug 27, 2021 at 6:28 PM przemek klosowski via devel wrote: > > > On 8/25/21 4:54 AM, Alexander Sosedkin wrote: > > It's not ideal if one obsolete website forces downgrading the security > potentially for all the connections. I hope 5) is addressing that. > > That's

Re: Schedule for Monday's FESCo Meeting (2021-08-23)

2021-08-25 Thread Alexander Sosedkin
On Tue, Aug 24, 2021 at 8:57 PM przemek klosowski via devel wrote: > > > On 8/23/21 5:49 AM, Alexander Sosedkin wrote: > > Sure. Crypto-policies are there to give you control of what's enabled, > > ideally what's enabled by default. > > > > 1) There's a blan

Re: Schedule for Monday's FESCo Meeting (2021-08-23)

2021-08-24 Thread Alexander Sosedkin
On Tue, Aug 24, 2021 at 12:07 AM Chris Adams wrote: > > Once upon a time, Alexander Sosedkin said: > > Sure. Crypto-policies are there to give you control of what's enabled, > > ideally what's enabled by default. > > > > 1) There's a blanket `update-crypto-policie

Re: Schedule for Monday's FESCo Meeting (2021-08-23)

2021-08-23 Thread Alexander Sosedkin
On Sun, Aug 22, 2021 at 11:00 PM Chris Adams wrote: > > Once upon a time, Dan Čermák said: > > #2659 Arbitration request: Crypto policy prevents VPN connections > > https://pagure.io/fesco/issue/2659 > > VPN requirements are a problem for increasing the encryption strength. > I have to connect

Re: Fedora Source-git SIG report #1 (June 2021)

2021-06-30 Thread Alexander Sosedkin
On Tue, Jun 29, 2021 at 3:38 PM Tomas Tomecek wrote: > * Can you imagine maintaining Fedora's 30k+ packages in a single repo? > Without some git-fetch magic it would be unbearable to perform a > git-pull. I cannot imagine *not* doing this, maintaining a distro and preserving any sanity in the