Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-17 Thread Otto Liljalaakso
Tommy Nguyen kirjoitti 17.9.2022 klo 10.44: On Sat, 2022-09-17 at 10:40 +0300, Otto Liljalaakso wrote: Leigh Scott kirjoitti 17.9.2022 klo 10.27: On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: I found this: https://bugzilla.rpmfusion.org/show_bug.cgi?id=6410#c1 Again, not a very

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-17 Thread Tommy Nguyen
On Sat, 2022-09-17 at 10:40 +0300, Otto Liljalaakso wrote: > Leigh Scott kirjoitti 17.9.2022 klo 10.27: > > > On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: > > > > > > I found this: > > > https://bugzilla.rpmfusion.org/show_bug.cgi?id=6410#c1 > > > > > > Again, not a very friendly

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-17 Thread Otto Liljalaakso
Leigh Scott kirjoitti 17.9.2022 klo 10.27: On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: I found this: https://bugzilla.rpmfusion.org/show_bug.cgi?id=6410#c1 Again, not a very friendly response. The short is that they are currently in freeze so no action can be taken ATM. I did

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-17 Thread Leigh Scott
> On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: > > I found this: https://bugzilla.rpmfusion.org/show_bug.cgi?id=6410#c1 > > Again, not a very friendly response. The short is that they are > currently in freeze so no action can be taken ATM. The rpmfusion f36 release repo isn't

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-17 Thread Otto Liljalaakso
Tommy Nguyen kirjoitti 16.9.2022 klo 6.51: On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: RPM Fusion Fedora 37 repository seems to be all SHA256 already. Thanks for doing the research. I plan on upgrading to the F37 beta soon. Have you done so already and what are your results?

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Tommy Nguyen
On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: > Tommy Nguyen kirjoitti 15.9.2022 klo 17.40: > > > > > On Sep 15, 2022, at 10:26 AM, Otto Liljalaakso > > > wrote: > > > > > > So maybe it is just that, for Fedora 36 at least, RPM Fusion it > > > not compatible with the new crypto

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Tommy Nguyen
On Thu, 2022-09-15 at 22:42 +0300, Otto Liljalaakso wrote: > RPM Fusion Fedora 37 repository seems to be all SHA256 already. Thanks for doing the research. I plan on upgrading to the F37 beta soon. Have you done so already and what are your results? ___

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Otto Liljalaakso
Tommy Nguyen kirjoitti 15.9.2022 klo 17.40: On Sep 15, 2022, at 10:26 AM, Otto Liljalaakso wrote: So maybe it is just that, for Fedora 36 at least, RPM Fusion it not compatible with the new crypto settings. I also see the following key ids in the errors I reported in the original message.

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Tommy Nguyen
> On Sep 15, 2022, at 10:26 AM, Otto Liljalaakso > wrote: > > Tommy Nguyen kirjoitti 15.9.2022 klo 16.28: >>> On Thu, 2022-09-15 at 16:18 +0300, Otto Liljalaakso wrote: >>> To test this, I did enable TEST-FEDORA39 on my system, first >>> installed >>> as Fedora 24, now running 36. For some

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Otto Liljalaakso
Tommy Nguyen kirjoitti 15.9.2022 klo 16.28: On Thu, 2022-09-15 at 16:18 +0300, Otto Liljalaakso wrote: To test this, I did enable TEST-FEDORA39 on my system, first installed as Fedora 24, now running 36. For some rpm and dnf operations, I get the following kind of errors: error:

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Tommy Nguyen
On Thu, 2022-09-15 at 16:18 +0300, Otto Liljalaakso wrote: > To test this, I did enable TEST-FEDORA39 on my system, first > installed > as Fedora 24, now running 36. For some rpm and dnf operations, I get > the > following kind of errors: > > error: rpmdbNextIterator: skipping h# 740 >

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Otto Liljalaakso
Ben Cotton kirjoitti 29.8.2022 klo 21.30: https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 == Summary == Cryptographic policies will be tightened in Fedora ''38''-39, SHA-1 signatures will no longer be trusted by default. Fedora ''38'' will do a "jump scare",

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-15 Thread Panu Matilainen
On 9/15/22 00:59, Kevin Kofler via devel wrote: Alexander Sosedkin wrote: That's a reason why my initial thread [1] has been named "Landing a larger-than-release change (distrusting SHA-1 signatures)": flipping the switch is the easy part, unfortunately. IMHO, a change that breaks so many

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Kevin Kofler via devel
Alexander Sosedkin wrote: > That's a reason why my initial thread [1] has been named > "Landing a larger-than-release change (distrusting SHA-1 signatures)": > flipping the switch is the easy part, unfortunately. IMHO, a change that breaks so many things that you expect it to take more than 6

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Tommy Nguyen
On Wed, 2022-09-07 at 17:47 +, Maxwell G via devel wrote: > I think this is a bad idea. It's quite hostile to packagers. It will > break rawhide for months and make it very difficult to stabilize the > distro before the beta freeze or do any type of rebuild. It very well > may > affect

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Alexander Sosedkin
On Wed, Sep 14, 2022 at 6:40 PM Kevin Fenzi wrote: > > On Wed, Sep 14, 2022 at 11:45:16AM +0200, Alexander Sosedkin wrote: > > On Tue, Sep 13, 2022 at 7:35 PM Kevin Fenzi wrote: > > > > > > How about this: > > > > > > Drop the term 'jump scare' entirely. IMHO it just sounds bad. > > > > I'm open

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Kevin Fenzi
On Wed, Sep 14, 2022 at 11:45:16AM +0200, Alexander Sosedkin wrote: > On Tue, Sep 13, 2022 at 7:35 PM Kevin Fenzi wrote: > > > > How about this: > > > > Drop the term 'jump scare' entirely. IMHO it just sounds bad. > > I'm open for proposals on the wording. =) Well, I guess it depends on if you

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-14 Thread Alexander Sosedkin
On Tue, Sep 13, 2022 at 7:35 PM Kevin Fenzi wrote: > > How about this: > > Drop the term 'jump scare' entirely. IMHO it just sounds bad. I'm open for proposals on the wording. =) > Rework the change so it's basically planning on making this change in > f38. That makes it closer than currently,

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-13 Thread Ben Cotton
On Tue, Sep 13, 2022 at 1:35 PM Kevin Fenzi wrote: > > * setup a tracking bug to track the issues, so we can make a more > informed decision before f38 beta. This should be the tracker in the Changes Tracking component. Normally those are created after a proposal is approved by FESCo, but I can

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-13 Thread Kevin Fenzi
How about this: Drop the term 'jump scare' entirely. IMHO it just sounds bad. Rework the change so it's basically planning on making this change in f38. Before f38 beta freeze, change owners/fesco looks at the state of things and decides if it can remain on in f38 and if not, it gets reverted

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-09-07 Thread Maxwell G via devel
Aug 29, 2022 1:32:21 PM Ben Cotton : https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 == Summary == Cryptographic policies will be tightened in Fedora ''38''-39, SHA-1 signatures will no longer be trusted by default. Fedora ''38'' will do a "jump scare", introducing

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-30 Thread Richard W.M. Jones
On Mon, Aug 29, 2022 at 02:30:44PM -0400, Ben Cotton wrote: > https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 > > == Summary == > > Cryptographic policies will be tightened in Fedora ''38''-39, > SHA-1 signatures will no longer be trusted by default. > Fedora ''38'' will

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-30 Thread Alexander Sosedkin
On Mon, Aug 29, 2022 at 10:48 PM Miro Hrončok wrote: > > On 29. 08. 22 20:30, Ben Cotton wrote: > > https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 > > > > == Summary == > > > > Cryptographic policies will be tightened in Fedora ''38''-39, > > SHA-1 signatures will no

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-29 Thread Miro Hrončok
On 29. 08. 22 20:30, Ben Cotton wrote: https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 == Summary == Cryptographic policies will be tightened in Fedora ''38''-39, SHA-1 signatures will no longer be trusted by default. Fedora ''38'' will do a "jump scare", introducing

Re: F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-29 Thread Ben Cotton
On Mon, Aug 29, 2022 at 2:30 PM Ben Cotton wrote: > > * Release engineering: Not sure if mass-rebuild is required if we > land the change right after f38 branch-off. Maybe a "preview" > mass-rebuild can be done with a special build in the F37 timeframe to > cut down on F38 FTBFS. Please file an

F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-29 Thread Ben Cotton
https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 == Summary == Cryptographic policies will be tightened in Fedora ''38''-39, SHA-1 signatures will no longer be trusted by default. Fedora ''38'' will do a "jump scare", introducing the change but then reverting it in time

F38 proposal: Strong crypto settings: phase 3, forewarning 2/2 (System-Wide Change proposal)

2022-08-29 Thread Ben Cotton
https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning2 == Summary == Cryptographic policies will be tightened in Fedora ''38''-39, SHA-1 signatures will no longer be trusted by default. Fedora ''38'' will do a "jump scare", introducing the change but then reverting it in time