text:
Switch from go-logging to logrus

Switching from go-logging to use logrus which will match bundle-lib and make our logs a bit more consistent. The one things that doesn't quite work is color log output.

OLD log file, shows the broker logs using go-logging and the logs from bundle-lib which use logrus
Using config file mounted to /etc/ansible-service-broker/config.yaml
============================================================
==           Creating Ansible Service Broker...           ==
============================================================
[2018-05-18T22:36:39.37Z] [NOTICE] - Initializing clients...
[2018-05-18T22:36:39.371Z] [DEBUG] - Connecting to Cluster
time="2018-05-18T22:36:39Z" level=info msg="OpenShift version: %vv3.10.0-alpha.0+18dfae9-1209"
time="2018-05-18T22:36:39Z" level=info msg="unable to retrieve the network plugin, defaulting to not joining networks - clusternetworks.network.openshift.io \"default\" not found"
time="2018-05-18T22:36:39Z" level=info msg="Kubernetes version: %vv1.10.0+b81c8f8"
time="2018-05-18T22:36:39Z" level=info msg="== REGISTRY CX == "
time="2018-05-18T22:36:39Z" level=info msg="Name: dh"
time="2018-05-18T22:36:39Z" level=info msg="Type: dockerhub"
time="2018-05-18T22:36:39Z" level=info msg="Url: docker.io"
time="2018-05-18T22:36:39Z" level=info msg="== REGISTRY CX == "
time="2018-05-18T22:36:39Z" level=info msg="Name: localregistry"
time="2018-05-18T22:36:39Z" level=info msg="Type: local_openshift"
time="2018-05-18T22:36:39Z" level=info msg="Url: "
[2018-05-18T22:36:39.38Z] [DEBUG] - Connecting Dao
[2018-05-18T22:36:39.38Z] [DEBUG] - Connecting Registry
[2018-05-18T22:36:39.381Z] [DEBUG] - Initializing WorkEngine
[2018-05-18T22:36:39.382Z] [DEBUG] - Creating AnsibleBroker
============================================================
==           Starting Ansible Service Broker...           ==
============================================================
[2018-05-18T22:36:39.383Z] [INFO] - Initiating Recovery Process
[2018-05-18T22:36:39.408Z] [INFO] - Recovery complete
[2018-05-18T22:36:39.409Z] [NOTICE] - recover called
[2018-05-18T22:36:39.409Z] [INFO] - Broker configured to bootstrap on startup
[2018-05-18T22:36:39.409Z] [INFO] - Attempting bootstrap...
[2018-05-18T22:36:39.409Z] [INFO] - AnsibleBroker::Bootstrap
[2018-05-18T22:36:39.409Z] [DEBUG] - Dao::BatchGetSpecs

logrus at INFO level only, no color
Using config file mounted to /etc/ansible-service-broker/config.yaml
============================================================
==           Creating Ansible Service Broker...           ==
============================================================
time="2018-05-18T22:15:49Z" level=info msg="Initializing clients..."
time="2018-05-18T22:15:49Z" level=info msg="OpenShift version: %vv3.10.0-alpha.0+18dfae9-1209"
time="2018-05-18T22:15:49Z" level=info msg="unable to retrieve the network plugin, defaulting to not joining networks - clusternetworks.network.openshift.io \"default\" not found"
time="2018-05-18T22:15:49Z" level=info msg="Kubernetes version: %vv1.10.0+b81c8f8"
time="2018-05-18T22:15:49Z" level=info msg="== REGISTRY CX == "
time="2018-05-18T22:15:49Z" level=info msg="Name: dh"
time="2018-05-18T22:15:49Z" level=info msg="Type: dockerhub"
============================================================
time="2018-05-18T22:15:49Z" level=info msg="Url: docker.io"
time="2018-05-18T22:15:49Z" level=info msg="== REGISTRY CX == "
time="2018-05-18T22:15:49Z" level=info msg="Name: localregistry"
time="2018-05-18T22:15:49Z" level=info msg="Type: local_openshift"
time="2018-05-18T22:15:49Z" level=info msg="Url: "
time="2018-05-18T22:15:49Z" level=info msg="Initiating Recovery Process"
==           Starting Ansible Service Broker...           ==
============================================================
time="2018-05-18T22:15:49Z" level=info msg="Recovery complete"
time="2018-05-18T22:15:49Z" level=info msg="recover called"
time="2018-05-18T22:15:49Z" level=info msg="Broker configured to bootstrap on startup"
time="2018-05-18T22:15:49Z" level=info msg="Attempting bootstrap..."
time="2018-05-18T22:15:49Z" level=info msg="AnsibleBroker::Bootstrap"

You are a hero.

logrus at DEBUG level for BOTH broker and bundle-lib, no color
Using config file mounted to /etc/ansible-service-broker/config.yaml
============================================================
==           Creating Ansible Service Broker...           ==
============================================================
time="2018-05-19T03:16:59Z" level=info msg="Initializing clients..."
time="2018-05-19T03:16:59Z" level=debug msg="Connecting to Cluster"
time="2018-05-19T03:16:59Z" level=info msg="OpenShift version: %vv3.10.0-alpha.0+18dfae9-1209"
time="2018-05-19T03:16:59Z" level=debug msg="plugin for the network - "
time="2018-05-19T03:16:59Z" level=info msg="unable to retrieve the network plugin, defaulting to not joining networks - clusternetworks.network.openshift.io \"default\" not found"
time="2018-05-19T03:16:59Z" level=info msg="Kubernetes version: %vv1.10.0+b81c8f8"
time="2018-05-19T03:16:59Z" level=debug msg="Connecting Dao"
time="2018-05-19T03:16:59Z" level=debug msg="Connecting Registry"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get user from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get pass from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get images from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get namespaces from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get fail_on_error from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get black_list from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get auth_type from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get auth_name from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get runner from config"
time="2018-05-19T03:16:59Z" level=info msg="== REGISTRY CX == "
time="2018-05-19T03:16:59Z" level=info msg="Name: dh"
time="2018-05-19T03:16:59Z" level=info msg="Type: dockerhub"
time="2018-05-19T03:16:59Z" level=info msg="Url: docker.io"
time="2018-05-19T03:16:59Z" level=debug msg="Creating filter for registry: %sdh"
time="2018-05-19T03:16:59Z" level=debug msg="whitelist: %v[.*-apb$]"
time="2018-05-19T03:16:59Z" level=debug msg="blacklist: %v[]"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get url from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get user from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get pass from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get org from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get tag from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get images from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get fail_on_error from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get black_list from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get auth_type from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get auth_name from config"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get runner from config"
time="2018-05-19T03:16:59Z" level=info msg="== REGISTRY CX == "
time="2018-05-19T03:16:59Z" level=info msg="Name: localregistry"
time="2018-05-19T03:16:59Z" level=info msg="Type: local_openshift"
time="2018-05-19T03:16:59Z" level=info msg="Url: "
time="2018-05-19T03:16:59Z" level=debug msg="Creating filter for registry: %slocalregistry"
time="2018-05-19T03:16:59Z" level=debug msg="whitelist: %v[.*]"
time="2018-05-19T03:16:59Z" level=debug msg="blacklist: %v[]"
time="2018-05-19T03:16:59Z" level=debug msg="Initializing WorkEngine"
time="2018-05-19T03:16:59Z" level=debug msg="Unable to get secrets from config"
time="2018-05-19T03:16:59Z" level=debug msg="Creating AnsibleBroker"
============================================================
==           Starting Ansible Service Broker...           ==
============================================================
time="2018-05-19T03:16:59Z" level=info msg="Initiating Recovery Process"
time="2018-05-19T03:16:59Z" level=info msg="Recovery complete"
time="2018-05-19T03:16:59Z" level=info msg="recover called"
time="2018-05-19T03:16:59Z" level=info msg="Broker configured to bootstrap on startup"
time="2018-05-19T03:16:59Z" level=info msg="Attempting bootstrap..."
time="2018-05-19T03:16:59Z" level=info msg="AnsibleBroker::Bootstrap"

logrus with color (NOTE: I disabled this because the formatting needs work)
Using config file mounted to /etc/ansible-service-broker/config.yaml
============================================================
==           Creating Ansible Service Broker...           ==
============================================================
INFO[0000] Initializing clients...
DEBU[0000] Connecting to Cluster
INFO[0000] OpenShift version: %vv3.10.0-alpha.0+18dfae9-1209
DEBU[0000] plugin for the network -
INFO[0000] unable to retrieve the network plugin, defaulting to not joining networks - clusternetworks.network.openshift.io "default" not found
INFO[0000] Kubernetes version: %vv1.10.0+b81c8f8
DEBU[0000] Connecting Dao
DEBU[0000] Connecting Registry
DEBU[0000] Unable to get user from config
DEBU[0000] Unable to get pass from config
DEBU[0000] Unable to get images from config
DEBU[0000] Unable to get namespaces from config
DEBU[0000] Unable to get fail_on_error from config
DEBU[0000] Unable to get black_list from config
DEBU[0000] Unable to get auth_type from config
DEBU[0000] Unable to get auth_name from config
DEBU[0000] Unable to get runner from config
INFO[0000] == REGISTRY CX ==
INFO[0000] Name: dh
INFO[0000] Type: dockerhub
INFO[0000] Url: docker.io
DEBU[0000] Creating filter for registry: %sdh
DEBU[0000] whitelist: %v[.*-apb$]
DEBU[0000] blacklist: %v[]
DEBU[0000] Unable to get url from config
DEBU[0000] Unable to get user from config
DEBU[0000] Unable to get pass from config
DEBU[0000] Unable to get org from config
DEBU[0000] Unable to get tag from config
DEBU[0000] Unable to get images from config
DEBU[0000] Unable to get fail_on_error from config
DEBU[0000] Unable to get black_list from config
DEBU[0000] Unable to get auth_type from config
DEBU[0000] Unable to get auth_name from config
DEBU[0000] Unable to get runner from config
INFO[0000] == REGISTRY CX ==
INFO[0000] Name: localregistry
INFO[0000] Type: local_openshift
INFO[0000] Url:
DEBU[0000] Creating filter for registry: %slocalregistry
DEBU[0000] whitelist: %v[.*]
DEBU[0000] blacklist: %v[]
DEBU[0000] Initializing WorkEngine
DEBU[0000] Unable to get secrets from config
DEBU[0000] Creating AnsibleBroker
============================================================
==           Starting Ansible Service Broker...           ==
============================================================
INFO[0000] Initiating Recovery Process
INFO[0000] Recovery complete
INFO[0000] recover called
INFO[0000] Broker configured to bootstrap on startup
INFO[0000] Attempting bootstrap...
INFO[0000] AnsibleBroker::Bootstrap

COLOR output in terminal

RAW log file
Using config file mounted to /etc/ansible-service-broker/config.yaml
============================================================
==           Creating Ansible Service Broker...           ==
============================================================
INFO[0000] Initializing clients...
DEBU[0000] Connecting to Cluster
INFO[0000] OpenShift version: %vv3.10.0-alpha.0+18dfae9-1209
DEBU[0000] plugin for the network -
INFO[0000] unable to retrieve the network plugin, defaulting to not joining networks - clusternetworks.network.openshift.io "default" not found
INFO[0000] Kubernetes version: %vv1.10.0+b81c8f8
DEBU[0000] Connecting Dao
DEBU[0000] Connecting Registry
DEBU[0000] Unable to get user from config
DEBU[0000] Unable to get pass from config
DEBU[0000] Unable to get images from config
DEBU[0000] Unable to get namespaces from config
DEBU[0000] Unable to get fail_on_error from config
DEBU[0000] Unable to get black_list from config
DEBU[0000] Unable to get auth_type from config
DEBU[0000] Unable to get auth_name from config
DEBU[0000] Unable to get runner from config
INFO[0000] == REGISTRY CX ==
INFO[0000] Name: dh
INFO[0000] Type: dockerhub
INFO[0000] Url: docker.io
DEBU[0000] Creating filter for registry: %sdh
DEBU[0000] whitelist: %v[.*-apb$]
DEBU[0000] blacklist: %v[]
DEBU[0000] Unable to get url from config
DEBU[0000] Unable to get user from config
DEBU[0000] Unable to get pass from config
DEBU[0000] Unable to get org from config
DEBU[0000] Unable to get tag from config
DEBU[0000] Unable to get images from config
DEBU[0000] Unable to get fail_on_error from config
DEBU[0000] Unable to get black_list from config
DEBU[0000] Unable to get auth_type from config
DEBU[0000] Unable to get auth_name from config
DEBU[0000] Unable to get runner from config
INFO[0000] == REGISTRY CX ==
INFO[0000] Name: localregistry
INFO[0000] Type: local_openshift
INFO[0000] Url:
DEBU[0000] Creating filter for registry: %slocalregistry
DEBU[0000] whitelist: %v[.*]
DEBU[0000] blacklist: %v[]
DEBU[0000] Initializing WorkEngine
DEBU[0000] Unable to get secrets from config
DEBU[0000] Creating AnsibleBroker
============================================================
==           Starting Ansible Service Broker...           ==
============================================================
INFO[0000] Initiating Recovery Process
INFO[0000] Recovery complete
INFO[0000] recover called
INFO[0000] Broker configured to bootstrap on startup
INFO[0000] Attempting bootstrap...
INFO[0000] AnsibleBroker::Bootstrap

@mhrivnak meant to put you on this as a reviewer

authors: jmrodri mhrivnak

repo: openshift/ansible-service-broker


text:
Add a default flag for ConsoleYamlSample

Suggested API change here. The operator framework is planning a move to using embedded YAML CRs instead of a CSV and this would remove the need for the alm-examples annotation on CSVs. Once this is in the API, I would plan to make a PR to the console that would use this flag to populate the initial YAML editor when creating new CRs via the UI.
This is partly me working out how this api is updated - I would expect to write a proposal to be discussed somewhere before actually PRing the API repo, but didn't see any contributor guidance, so please feel free to point me at a proper process!
The alternative to this could be to annotate a ConsoleYamlSample to say it is the default, in the same style as annotating a cluster default storage class.

@jhadvig @spadgett - our Red Hat TAM assures me you are the right people to have this discussion with. Can you tell me how to go about discussion of this API?
We're looking to move away from alm-examples within OLM towards using ConsoleYAMLSamples because they allow users to select appropriate templates, and because the CSV within the operator bundle is targetted for removal.
The ALM examples are attached to an operator CSV, so when the operator is installed, the examples for that operator are installed with it. If operator version 1.0.0 is installed in namespace op-100, and operator version 1.0.1 is installed in namespace op-101, then each namespace will have its own samples that match the capabilities of that operator, including features that might not have affected the CRD schema.
With ConsoleYamlSamples, the sample is associated with the CRD schema version. If operator 1.0.0 and 1.0.1 use the same schema (v1beta1), then the same samples will be used for each operator, regardless of the operator capabilities. If we go one step further and say operator 1.0.2 includes a new version of the schema (v1beta2), then the samples could include new schema fields that imply to the user those fields are supported, even when that resource is going to be controlled by the 1.0.0 operator, which does not understand the new fields.
I'd like to have a discussion about the implications, and how to handle them. At the moment the OpenShift console can imply things to our customers that don't work. I know this message is outside the scope of the PR (which only addresses part of the concern), but I'm not sure where else to go :)

/remove-lifecycle stale We're still interested in this discussion.

/remove-lifecycle stale
We're still interested in this discussion

/remove-lifecycle stale
We're still interested in this discussion

source: gharchive/pull-request

repo: openshift/api

license_type: permissive

license_source: github-api


text:
MGMT-15673: set core pass on installation step

Added a service for setting the user core password (when specified). This is required to ensure the pass is set after reboot (i.e. as opposed to setting using the ignition).

/retest

repo: openshift/appliance


text:
Make sure to add federated role label to existing accounts if not present

Small miss from https://github.com/openshift/aws-account-operator/pull/751.
Catches an edge case where the awsFederatedRole label would not be applied to existing awsfederatedaccountaccess CRs.

/hold
I need to investigate the impact of my changes to JoinLabelMaps more.

/label tide/merge-method-squash

/unhold

Was able to test this by doing the following:

Create the FederatedRoles.
Create an account.
Create a FederatedAccountAccess
Delete the awsFederatedRoleName label out of the FederatedAccountAccess
Checkout this PR
Start the operator
Validate that the label is applied to the FederatedAccountAccess CR.

/lgtm
/hold
Unhold this in the morning.

/hold cancel

authors: AlexVulaj fahlmant iamkirkbater

repo: openshift/aws-account-operator


text:
[release-4.3] Bug 1802894: bump(github.com/mtrmac/gpgme): v0.1.2

Fixes CVE-2020-8945

/lgtm

/bugzilla refresh

authors: adambkaplan gabemontero

repo: openshift/builder


text:
Library go bump

Bumping the library-go dependency to latest, this should take advantage of leader election changes for SNO clusters proposed in this library-go PR and performance improvements in this PR.
Changes:

updated library-go to use latest master branch
updated handler structs to use the new explicit handler structs

/retest-required

Is it part of a Jira story or a BZ?

TestLeaderElection needs to be adjusted, apparently the new leader election is slower and the test needs to wait until these pods join the election process.

Is it part of a Jira story or a BZ?

The Jira story this is tied to is CNF-3684

TestLeaderElection needs to be adjusted, apparently the new leader election is slower and the test needs to wait until these pods join the election process.

That's interesting, for non-SNO clusters the timing of 137/107/26 should not have been changed. Looking into it

/retest-required

/retest-required

/retest-required

/retest-required

/retest-required

/assign @dmage

/retest-required

/approve

/lgtm

authors: dmage eggfoobar ggiguash


text:
Bug 1852964: account for nil DaemonSet returned from library-go

See https://github.com/openshift/library-go/blob/master/pkg/operator/resource/resourceapply/apps.go#L125
Just going to account for nil rets from library-go in ocm-o
/assign @adambkaplan

update to no longer use goto pushed @sttts - thanks

/approve
@gabemontero nit on the name of the return function, otherwise looks good.

update of method name pushed @adambkaplan

/cherrypick release-4.5


text:
BUILD-1168: Remove Operator-owned RBAC

With the fixes in BUILD-1171 [1], cluster admins no longer need to create ClusterRole/ClusterRoleBindings for the Shared Resource CSI Driver. The updated instructions mostly require the creation of Role and RoleBinding objects, with the exception of creating the ClusterRole for the Shared Resource object.
[1] https://issues.redhat.com/browse/BUILD-1171

/assign @sayan-biswas
/cc @shivanisathe25 @ayushsatyam146 @avinal

repo: openshift/csi-driver-shared-resource


text:
Publish lib utils 1.0.3 for API discovery redux action helpers

Publishes https://github.com/openshift/dynamic-plugin-sdk/pull/191

Codecov Report
Base: 38.41% // Head: 38.41% // No change to project coverage :thumbsup:

Coverage data is based on head (bb03044) compared to base (364a2d7).
Patch has no changes to coverable lines.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #194   +/-   ##
=======================================
  Coverage   38.41%   38.41%
=======================================
  Files          64       64
  Lines        1588     1588
  Branches      353      353
=======================================
  Hits          610      610
  Misses        943      943
  Partials       35       35

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

/lgtm

authors: codecov-commenter florkbr vojtechszocs

repo: openshift/dynamic-plugin-sdk


text:
OCPBUGS-26924: Add node registrat healthcheck

Fixes OCPBUGS-26924

/jira refresh

/lgtm

authors: gnufied mpatlasov

repo: openshift/gcp-pd-csi-driver-operator


text:
reduce konnectivity-agent log verbosity

konnectivity-agent is overly verbose as currently configured. Dropped loglevel from 4 to 3, removes lines
received DATA
write to remote
close connection
received DIAL_REQ

/lgtm

/retest-required

authors: jparrill sjenning

repo: openshift/hypershift


text:
ACM-5173 [backport 4.12] get pull secret instead of dockerconfigjson from mce credentials

Backport of https://github.com/openshift/hypershift/commit/142d91e6b81858adbfd50907674c59d9f016c447
Issue: https://issues.redhat.com/browse/ACM-5173

/area hypershift-operator
/ok-to-test

/retest-required

@bryan-cox is this an issue with the PR or the test? The failure doesn't provide much info

@o-farag - I believe someone pushed a fix for that issue. Let me issue a retest.
/retest-required

/test ho-4.13-e2e-aws

/lgtm

/test ho-4.13-e2e-aws

/test ho-4.13-e2e-aws

/approve

authors: bryan-cox csrwng o-farag


text:
Revert "Merge pull request #2770 from dharaneeshvrd/upgrade-capi-ibmcloud

https://github.com/openshift/hypershift/pull/2770 took out CI with installer failing in the root CI cluster
https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/logs/periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn/1676933960199835648/artifacts/e2e-aws-ovn/dump-management-cluster/artifacts/namespaces/hypershift/core/pods/logs/installer-59cfd4cff9-9xdgj-installer-previous.log

/override ci/prow/e2e-aws
/override ci/prow/e2e-kubevirt-aws-ovn

/lgtm

@dharaneeshvrd
This is because we didn't account for transitions from existing HC/HOs.
See https://github.com/openshift/hypershift/pull/2000
https://github.com/openshift/hypershift/blob/main/api/v1beta1/capi_types.go#L5-L6
Also I'm not sure how this could work at all given you are pointing to v1 here https://github.com/openshift/hypershift/blob/main/cmd/install/assets/assets.go#L37-L41
If you don't want any kind of backward compatibility the hypershift install would need to account for removing existing CRDs first so apply command stop complaining about the stored version.

@enxebre
Apologies for the inconvenience caused and thanks for the input.
I have reworked on this and created a PR here https://github.com/openshift/hypershift/pull/2831
Tested the upgrade scenarios works fine.
Please review this PR

authors: dharaneeshvrd enxebre muraee sjenning


text:
skip e2e binary during image builds

make was changed to build the e2e test binary after we broke it once and realized that e2e binary build was not covered by CI.
However, we do not need the e2e binary in the image builds for hypershift
This PR switches to a make target that doesn't build e2e.
@ironcladlou @enxebre

This shouldn't affect e2e but let's be sure:
/test-e2e

/test e2e-aws

/lgtm

authors: ironcladlou sjenning


text:
HOSTEDCP-1569: test: e2e: skip unknown conditions instead of erroring

Rehearsal failure trying to use main HO with 4.16 release
https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/52306/rehearse-52306-periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn/1818008709683482624
    nodepool_test.go:289: correct condition: wanted ValidReleaseImage=True, got ValidReleaseImage=True: AsExpected(Using release image: registry.build01.ci.openshift.org/ci-op-0vx638ni/release@sha256:6f727aeaa9a820058419e293027d0d1c006d5776b32dbebd23d9180cc4b7e245)
    nodepool_test.go:298: Failed to validate NodePool conditions in 0s: unknown condition ValidArchPlatform
        --- FAIL: TestNodePool/Main/TestNodepoolMachineconfigGetsRolledout (1380.22s)

HO in main adds a condition that is not in the set of known conditions in 4.16 ValidArchPlatform.  The condition does, in fact, exist in 4.16, so we could add it to the set of known/validated conditions.  However, we do have the potential of the HO adding HC or NP conditions in the future that do not exist in 4.16 and we should just skip over the unknown condition instead of erroring on it.
cc @muraee

/test e2e-aws


text:
Handle volume layering

Any Dockerfile with a VOLUME must be two layers - one for the base
contents and one for the volume definitions. Add support for this and a
test.
First part of fixing #17

Important note - if Docker sees:
ADD file /var
VOLUME /var
ADD file2 /var

the final output will be:
/var/file
/var/file2

It's only RUN commands that don't get added.  This PR adds the framework and testing without actually changing existing behavior, but sets a bunch of preparation up for that PR.

repo: openshift/imagebuilder


text:
csi: Add Deployment, DaemonSet hooks for config map hash annotations

We already have these for secrets. Add them for config maps.
This is needed for the OpenStack Cinder CSI Driver Operator. See https://github.com/openshift/openstack-cinder-csi-driver-operator/pull/168/ for more information.

/retest-required
CI failures appear to be due to timeouts, not anything to do with this change.

non-binding lgtm

this looks ok, but would we better off by refactoring addObjectHash to take a metav1.Object  instead of a daemonset or deployment and then collapse the cases?
/approve
delegated to @dusk125

this looks ok, but would we better off by refactoring addObjectHash to take a metav1.Object instead of a daemonset or deployment and then collapse the cases?

Happy to do this here or in a follow-up PR, whatever works.

Happy to do this here or in a follow-up PR, whatever works.

I think it's fine to do that here. Thanks!

this looks ok, but would we better off by refactoring addObjectHash to take a metav1.Object instead of a daemonset or deployment and then collapse the cases?

Actually, looking into this more, metav1.Object is an interface meaning I can't access e.g. .Spec.Template.Annotations without a cast...which kind of defeats the whole point of DRYing things up. We'd also need to move the function to a common location and make it public. I'm not sure if we want to do that either.
Have I missed something?

this looks ok, but would we better off by refactoring addObjectHash to take a metav1.Object instead of a daemonset or deployment and then collapse the cases?

Actually, looking into this more, metav1.Object is an interface meaning I can't access e.g. .Spec.Template.Annotations without a cast...which kind of defeats the whole point of DRYing things up. We'd also need to move the function to a common location and make it public. I'm not sure if we want to do that either.
Have I missed something?
Edit: We could add two call to the new AddObjectHash, one for deployment and one for deployment.Spec.Template (ditto for daemonset) but again, that's not all that DRY.

Right, we'd need to use type assertion, like we do in the static resource controller here. Since the code duplication hasn't been introduced by this PR, I personally think  it's fine doing this refactoring in a separate PR.
/lgtm

repo: openshift/library-go


text:
update release version to 0.1.6

Description
update release version to 0.1.6
Type of change

[ ] Refactor
[ ] New feature
[ ] Bug fix
[ ] CVE fix
[ ] Optimization
[ ] Documentation Update
[ ] Configuration Update
[ ] Bump-up dependent library

Related Tickets & Documents

Related Issue #
Closes #

Checklist before requesting a review

[ ] I have performed a self-review of my code.
[ ] PR has passed all pre-merge test jobs.
[ ] If it is a core feature, I have added thorough tests.

Testing

Please provide detailed steps to perform tests related to this code change.
How were the fix/results from this change verified? Please provide relevant screenshots or results.

/override "Red Hat Konflux / ols-enterprise-contract / bundle"
/override "Red Hat Konflux / ols-enterprise-contract / test-bundle"

/override "Red Hat Konflux / ols-enterprise-contract / bundle"
/overide "Red Hat Konflux / ols-enterprise-contract / test-bundle"

/approve

authors: raptorsun xrajesh

repo: openshift/lightspeed-operator


text:
OLS-233: Use Optional type instead of | operator

Description
Seems we are using Optional instead of something | None.
Type of change

[X] Refactor

/lgtm

/approve

i had been pushing for the use of | syntax in PRs i reviewed because my understanding is that it is the newer/more modern syntax.
https://peps.python.org/pep-0655/ states:
Optional[] is too ubiquitous to deprecate, although use of it may fade over time in favor of the T|None notation specified by [PEP 604](https://peps.python.org/pep-0604/).

authors: bparees onmete tisnik

repo: openshift/lightspeed-service


text:
OCPBUGS-15576: fix: ensure panic safety in PVC controller for non set storageClassName

Otherwise if a PVC is created without storageClassName, LVM Operator will crash and cause a panic.
Also removes unnecessary API Reader in PVC controller and cleans up logging, introduces test cases for ignore cases

/jira refresh

/jira refresh

Codecov Report

Merging #369 (eda99c3) into main (f444ae9) will increase coverage by 2.16%.
Report is 9 commits behind head on main.
The diff coverage is 80.00%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #369      +/-   ##
==========================================
+ Coverage   14.38%   16.55%   +2.16%
==========================================
  Files          23       24       +1
  Lines        1932     2060     +128
==========================================
+ Hits          278      341      +63
- Misses       1630     1693      +63
- Partials       24       26       +2

Files Changed
Coverage Δ

controllers/persistent-volume-claim/controller.go
39.70% <80.00%> (ø)

... and 3 files with indirect coverage changes

/hold for one more review
/cc @brandisher @qJkee

@jeff-roche e2e test is still flaky right? Should we wait for them to be fixed or do you want to force this merge in?

@jeff-roche e2e test is still flaky right? Should we wait for them to be fixed or do you want to force this merge in?

I will run the e2e tests manually and report back

Manually tested
/override ci/prow/lvm-operator-bundle-e2e-aws

Manually tested
/override ci/prow/lvm-operator-bundle-e2e-aws

repo: openshift/lvm-operator


text:
OCPBUGS-5613: Bump goutils dependency from v1.1.0 to v1.1.1 for CVE-2021-4238

Description of the change:
Bump goutils dependency from v1.1.0 to v1.1.1
Motivation for the change:
https://nvd.nist.gov/vuln/detail/CVE-2021-4238
Checklist
If the pull request includes user-facing changes, extra documentation is required:

[ ] Add a new changelog fragment in changelog/fragments (see changelog/fragments/00-template.yaml)
[ ] Add or update relevant sections of the docs website in website/content/en/docs

@rashmigottipati the change in the PR looks correct. Nicely done.

/jira refresh

/label backport-risk-assessed

/label qe-approved

/label cherry-pick-approved

I added it manually. Thanks folks!

authors: emmajiafan everettraven jmrodri joelanford oceanc80 rashmigottipati

repo: openshift/ocp-release-operator-sdk


text:
4.6.0-0.okd-2020-11-27-200126: NetworkManager is not checking reverse lookups when setting a hostname

Describe the bug
On installation, the bootstrap process begins, but fails after the masters have restarted. I'm noticing that despite the "core" user being created on initial boot of each master, after the reboots, the "fedora" user is listed at the prompt. Attempts to ssh into the master nodes also fails, despite using the same key for creation which works to get into the bootstrap as expected. Is the Core OS install getting hosed on reboot? Since I can't get into the masters, I'm unable to get their logs.
The process I'm following is the same scripted process that has worked previously. In fact, I built a 4.5 two days ago using the process. Nothing has changed on this end that I can see.
Version
OKD: 4.6.0-0.okd-2020-11-27-200126
FCOS: fedora-coreos-32.20201104.3.0-vmware.x86_64.ova
How reproducible
Every time.
Log bundle
4.6.0-0.okd-2020-11-27-200126-Magiera.tar.gz

Are you sure its "fedora" user, not hostname? Do you have DHCP in the setup?

Ahh, yeah. You're right. It was the hostname. Sorry, I have "teething baby lack of sleep brain" at the moment. Yes, there is DHCP. It is working, as the first boot always have the correct hostname. A quick ping test shows all the nodes have the expected forward and reverse. Here's some quick logging on another install attempt...
==================== Before Installer ============================
[jaimelm1@lsa-linux-dev bin]$ ./pingMasters.sh -c spiritus -w 5 -m 4
Pinging nodes for cluster: spiritus
PING master-0.spiritus.my.company.edu (10.103.2.100) 56(84) bytes of data.
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=1 ttl=63 time=0.329 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=2 ttl=63 time=0.458 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=3 ttl=63 time=0.485 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=4 ttl=63 time=0.444 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=5 ttl=63 time=0.472 ms
--- master-0.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 103ms
rtt min/avg/max/mdev = 0.329/0.437/0.485/0.060 ms
PING master-1.spiritus.my.company.edu (10.103.2.101) 56(84) bytes of data.
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=1 ttl=63 time=0.365 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=2 ttl=63 time=0.461 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=3 ttl=63 time=0.396 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=4 ttl=63 time=0.430 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=5 ttl=63 time=0.556 ms
--- master-1.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 91ms
rtt min/avg/max/mdev = 0.365/0.441/0.556/0.069 ms
PING master-2.spiritus.my.company.edu (10.103.2.102) 56(84) bytes of data.
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=1 ttl=63 time=0.357 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=2 ttl=63 time=0.552 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=3 ttl=63 time=0.469 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=4 ttl=63 time=0.452 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=5 ttl=63 time=0.508 ms
--- master-2.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 91ms
rtt min/avg/max/mdev = 0.357/0.467/0.552/0.069 ms
PING master-3.spiritus.my.company.edu (10.103.2.103) 56(84) bytes of data.
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=1 ttl=63 time=0.413 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=2 ttl=63 time=0.491 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=3 ttl=63 time=0.530 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=4 ttl=63 time=0.909 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=5 ttl=63 time=0.455 ms
--- master-3.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 68ms
rtt min/avg/max/mdev = 0.413/0.559/0.909/0.180 ms
======================================================================
Oddly, after the reboot, their hostnames are wrong, but the nodes are still ping-able at the correct address. (I can check the DHCP server logs if need be but this looks legit)
============================== During Installer ==============================
[jmagiera@lsa-linux-dev bin]$ ./pingMasters.sh -c spiritus -w 5 -m 4
Pinging nodes for cluster: spiritus
PING master-0.spiritus.my.company.edu (10.103.2.100) 56(84) bytes of data.
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=1 ttl=63 time=0.391 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=2 ttl=63 time=0.432 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=3 ttl=63 time=0.474 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=4 ttl=63 time=0.327 ms
64 bytes from master-0.spiritus.my.company.edu (10.103.2.100): icmp_seq=5 ttl=63 time=0.455 ms
--- master-0.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 113ms
rtt min/avg/max/mdev = 0.327/0.415/0.474/0.058 ms
PING master-1.spiritus.my.company.edu (10.103.2.101) 56(84) bytes of data.
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=1 ttl=63 time=0.554 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=2 ttl=63 time=0.385 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=3 ttl=63 time=0.366 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=4 ttl=63 time=0.382 ms
64 bytes from master-1.spiritus.my.company.edu (10.103.2.101): icmp_seq=5 ttl=63 time=0.377 ms
--- master-1.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 91ms
rtt min/avg/max/mdev = 0.366/0.412/0.554/0.075 ms
PING master-2.spiritus.my.company.edu (10.103.2.102) 56(84) bytes of data.
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=1 ttl=63 time=0.411 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=2 ttl=63 time=0.470 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=3 ttl=63 time=0.491 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=4 ttl=63 time=0.434 ms
64 bytes from master-2.spiritus.my.company.edu (10.103.2.102): icmp_seq=5 ttl=63 time=0.404 ms
--- master-2.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 92ms
rtt min/avg/max/mdev = 0.404/0.442/0.491/0.033 ms
PING master-3.spiritus.my.company.edu (10.103.2.103) 56(84) bytes of data.
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=1 ttl=63 time=0.406 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=2 ttl=63 time=0.424 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=3 ttl=63 time=0.459 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=4 ttl=63 time=0.475 ms
64 bytes from master-3.spiritus.my.company.edu (10.103.2.103): icmp_seq=5 ttl=63 time=0.446 ms
--- master-3.spiritus.my.company.edu ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 90ms
rtt min/avg/max/mdev = 0.406/0.442/0.475/0.024 ms
==========================

Install fails with...
ERROR Cluster operator network Degraded is True with BootstrapError: Internal error while reconciling platform networking resources: Unable to bootstrap OVN, expected amount of control plane nodes (4) do not match found (1): timed out waiting for the condition
INFO Use the following commands to gather logs from the cluster
INFO openshift-install gather bootstrap --help
FATAL failed to wait for bootstrapping to complete: timed out waiting for the condition
=========================
So, hostname is changed on reboot and nodes become unavailable to the installer. I've had limited time this morning but can dig into the logs deeper if nothing stands out to you in what I shared earlier.

hostname changes are not rendered in the log bundle. Check NetworkManager logs

After a period, I'm able to log into the nodes. Immediately after sudo'ing, I'm presented with...
[core@fedora ~]$ sudo -s
[systemd]
Failed Units: 1
gcp-hostname.service
Digging deeper...
[root@fedora core]# systemctl status gcp-hostname.service > gcp-hostname.service.log
[root@fedora core]# cat gcp-hostname.service.log
● gcp-hostname.service - Set GCP Transient Hostname
Loaded: loaded (/etc/systemd/system/gcp-hostname.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Sat 2020-11-28 17:29:00 UTC; 6h ago
Process: 972 ExecStartPre=/usr/bin/afterburn --provider gcp --hostname=/run/afterburn.hostname (code=exited, status=1/FAILURE)
CPU: 55ms
Nov 28 17:29:00 fedora afterburn[972]: Caused by: writing hostname
Nov 28 17:29:00 fedora afterburn[972]: Caused by: maximum number of retries (10) reached
Nov 28 17:29:00 fedora afterburn[972]: Caused by: failed to fetch
Nov 28 17:29:00 fedora afterburn[972]: Caused by: error sending request for url (http://metadata.google.internal/computeMetadata/v1/instance/hostname): error trying to connect: dns error: failed to lookup address information: Name or service not known
Nov 28 17:29:00 fedora afterburn[972]: Caused by: error trying to connect: dns error: failed to lookup address information: Name or service not known
Nov 28 17:29:00 fedora afterburn[972]: Caused by: dns error: failed to lookup address information: Name or service not known
Nov 28 17:29:00 fedora afterburn[972]: Caused by: failed to lookup address information: Name or service not known
Nov 28 17:29:00 fedora systemd[1]: gcp-hostname.service: Control process exited, code=exited, status=1/FAILURE
Nov 28 17:29:00 fedora systemd[1]: gcp-hostname.service: Failed with result 'exit-code'.
Nov 28 17:29:00 fedora systemd[1]: Failed to start Set GCP Transient Hostname.
============
It's as if the installer or FCOS thinks this is a GCP node. I'll keep poking around.

Perhaps a red herring, but #393 looks awfully similar to what I'm seeing.

After a period, I'm able to log into the nodes. Immediately after sudo'ing, I'm presented with...
[core@fedora ~]$ sudo -s
[systemd]
Failed Units: 1
gcp-hostname.service

That's a minor issue - https://github.com/openshift/okd/issues/396

I am seeing the same. I commented on another issue, but i think this is more relevant.
https://github.com/openshift/okd/issues/153#issuecomment-735314786
`I have a similar thing happening @vrutkovs
Release - 4.6.0-0.okd-2020-11-27-200126
FCOS image - 32.20201104.3.0 stable
I have a dhcp server setup to give out hostnames. Bootstrap as well as the 3 node-cluster nodes lose hostname after reboot. Bootkube service goes into restart loop on bootstrap after a while, workers kubelet error message says node "fedora" not found.`
After installing a 4.5 cluster, and then upgrading to 4.6, all the nodes hostnames changed to fedora after reboot. So had to manually set hostnames, even though DHCP was handing them out

I have a dhcp server setup to give out hostnames
...
kubelet error message says node "fedora" not found

kubelet is using hostname as identifier. Did the node receive an expected hostname?

Looking at the NetworkManager log, I don't see anything out of the ordinary, just typical DORA with the DHCP server. I'm curious why the nodes were not immediately accessible after reboot. It seemed to take some time.
OKD-ISSUE394-NetworkManager.log

On one of my nodes I also have
Nov 29 11:01:23 neptr.vrutkovs.eu NetworkManager[900]: <info>  [1606647683.4489] hostname: hostname: using hostnamed
Nov 29 11:01:23 neptr.vrutkovs.eu NetworkManager[900]: <info>  [1606647683.4490] hostname: hostname changed from (none) to "neptr.vrutkovs.eu"

@vrutkovs nope, only stuck with fedora, and the likely red herring failed gcp-hostname.service which i disabled

As an added note, it only happens after the part where the nodes' FCOS version is updated

Indeed. Looking at the systemd-hostnamed logs, the first call to it on the initial boot sets the hostname as expected. However, on subsequent launches it's not reset. This would leave me to believe that either systemd-hostnamed is not getting a pertinent piece of information to trigger a reset and/or another service is changing the hostname. I think that depends on if FCOS hosts are expected to maintain hostname after an update-triggered reboot, or if they default to "fedora" again unless/until DHCP provides a hostname again or static IP/hostname were implemented.
[root@fedora core]# journalctl -u systemd-hostnamed
-- Logs begin at Sat 2020-11-28 17:14:37 UTC, end at Mon 2020-11-30 01:48:48 UTC. --
Nov 28 17:21:01 localhost systemd[1]: Starting Hostname Service...
Nov 28 17:21:01 localhost systemd[1]: Started Hostname Service.
Nov 28 17:21:02 master-1.spiritus.lsa.umich.edu systemd-hostnamed[2528]: Changed host name to 'master-1.spiritus.my.company.edu'
Nov 28 17:21:32 master-1.spiritus.my.company.edu systemd[1]: systemd-hostnamed.service: Succeeded.
-- Reboot --
Nov 28 17:28:16 fedora systemd[1]: Starting Hostname Service...
Nov 28 17:28:17 fedora systemd[1]: Started Hostname Service.
Nov 28 17:28:47 fedora systemd[1]: systemd-hostnamed.service: Succeeded.
Nov 28 23:57:18 fedora systemd[1]: Starting Hostname Service...
Nov 28 23:57:18 fedora systemd[1]: Started Hostname Service.
Nov 28 23:57:48 fedora systemd[1]: systemd-hostnamed.service: Succeeded.
Nov 30 01:44:46 fedora systemd[1]: Starting Hostname Service...
Nov 30 01:44:46 fedora systemd[1]: Started Hostname Service.
Nov 30 01:45:16 fedora systemd[1]: systemd-hostnamed.service: Succeeded.

same here
4.5 upgrade to 4.6,  it only  happens after the part where the nodes' FCOS version is updated
❯ oc get node
NAME                                   STATUS                        ROLES    AGE     VERSION
manage-dev-gzrpk-master-0              Ready                         master   6d21h   v1.19.0-rc.2+9f84db3-1075
manage-dev-gzrpk-master-1              Ready                         master   6d21h   v1.18.3
manage-dev-gzrpk-master-2              Ready                         master   6d21h   v1.18.3
manage-dev-gzrpk-worker-9vhmd          Ready                         worker   6d21h   v1.18.3
manage-dev-gzrpk-worker-n59h2          Ready                         worker   6d21h   v1.18.3
manage-dev-gzrpk-worker-t8b6m          Ready                         worker   6d21h   v1.19.0-rc.2+9f84db3-1075
master01.manage-dev.oc4.forchange.cn   NotReady,SchedulingDisabled   master   6d22h   v1.18.3
master02.manage-dev.oc4.forchange.cn   Ready                         master   6d22h   v1.18.3
master03.manage-dev.oc4.forchange.cn   Ready                         master   6d22h   v1.18.3
worker01.manage-dev.oc4.forchange.cn   Ready                         worker   6d21h   v1.18.3
worker02.manage-dev.oc4.forchange.cn   Ready                         worker   6d21h   v1.18.3
worker03.manage-dev.oc4.forchange.cn   Ready                         worker   6d21h   v1.18.3
worker04.manage-dev.oc4.forchange.cn   Ready                         worker   6d21h   v1.18.3
worker05.manage-dev.oc4.forchange.cn   NotReady,SchedulingDisabled   worker   6d21h   v1.18.3
worker06.manage-dev.oc4.forchange.cn   Ready                         worker   6d21h   v1.18.3

[root@fedora ~]# hostname
fedora
[root@fedora ~]#  journalctl -u systemd-hostnamed
-- Logs begin at Mon 2020-11-23 07:26:03 UTC, end at Mon 2020-11-30 06:13:29 UTC. --
11月 23 07:50:13 localhost systemd[1]: Starting Hostname Service...
11月 23 07:50:13 localhost systemd[1]: Started Hostname Service.
11月 23 07:50:13 worker05.manage-dev.oc4.forchange.cn systemd-hostnamed[1042]: Changed host name to 'worker05.manage-dev.oc4.forchange.cn'
11月 23 07:50:36 worker05.manage-dev.oc4.forchange.cn systemd[1]: systemd-hostnamed.service: Succeeded.
-- Reboot --
11月 23 08:00:09 localhost systemd[1]: Starting Hostname Service...
11月 23 08:00:09 localhost systemd[1]: Started Hostname Service.
11月 23 08:00:09 worker05.manage-dev.oc4.forchange.cn systemd-hostnamed[742]: Changed host name to 'worker05.manage-dev.oc4.forchange.cn'
11月 23 08:00:40 worker05.manage-dev.oc4.forchange.cn systemd[1]: systemd-hostnamed.service: Succeeded.
-- Reboot --
11月 30 04:35:29 fedora systemd[1]: Starting Hostname Service...
11月 30 04:35:29 fedora systemd[1]: Started Hostname Service.
11月 30 04:35:52 fedora systemd[1]: systemd-hostnamed.service: Succeeded.
11月 30 06:04:19 fedora systemd[1]: Starting Hostname Service...
11月 30 06:04:19 fedora systemd[1]: Started Hostname Service.
11月 30 06:04:52 fedora systemd[1]: systemd-hostnamed.service: Succeeded.

Resume normal work after manually set the hostname

Seems to be failed are FQDN host...

Looking at the NetworkManager log, I don't see anything out of the ordinary, just typical DORA with the DHCP server. I'm curious why the nodes were not immediately accessible after reboot. It seemed to take some time. Edit: And even after requesting and accepting the IP and the hostname, it doesn't update the hostname.
OKD-ISSUE394-NetworkManager.log

In your NetworkManager logs I don't see where the DHCP response included the host name. I would have expected something like:
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option dhcp_lease_time      => '3600'
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option domain_name          => 'ec2.internal'
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option domain_name_servers  => '10.0.0.2'
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option expiry               => '1606176868'
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option host_name            => 'ip-10-0-1-155'
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option interface_mtu        => '9001'
NetworkManager[629]: <info>  [1606173268.0436] dhcp4 (eth0): option ip_address           => '10.0.1.155'

I imagine you're relying on reverse DNS lookups. I just did some digging and yeah, this used to work. See https://github.com/coreos/fedora-coreos-tracker/issues/649#issuecomment-736104003

For folks following along in their hymnals, Dusty asked me to try bringing a straight up FCOS 33 (no OKD) node. Sure enough, the failure remained.
====================================
[jaimelm1@lsa-linux-dev fcos]$ host fcos-33-test.my.company.edu
fcos-33-test.my.company.edu has address xxx.xxx.xxx.xxx
[jaimelm1@lsa-linux-dev fcos]$ ssh -i ~/.ssh/coreadmin_rsa core@fcos-33-test.my.company.edu
Tracker: https://github.com/coreos/fedora-coreos-tracker
Discuss: https://discussion.fedoraproject.org/c/server/coreos/
Last login: Mon Nov 30 22:53:36 2020 from 141.211.211.32
[core@fedora ~]$ hostname
fedora
===========================================================
Following all the threads, it's an issue of Network Manager not falling back onto the reverse lookup due to the ordering of precedence. "Is it something other than localhost?" comes before reverse look-ups – and since the Fedora desktop folks in their infinite wisdom wanted to brand workstations by setting hostname to "fedora" when the hostname wasn't explicitly defined, here we are.
I hope the re-order makes it into Network Manager. There are a lot of services, both internal and external, that rely on proper reverse lookups. It seems to me that reverse should be higher up in the precedence.
Thanks for all the legwork on this Dusty.

As an aside, I wrote a quick script to reset hostnames on nodes that were changed to "fedora". Nothing fancy, but it simplifies the process if you have a lot of nodes to fix.
https://github.com/JaimeMagiera/oct/blob/master/repairClusterHostnames.sh

Following all the threads, it's an issue of Network Manager not falling back onto the reverse lookup due to the ordering of precedence. "Is it something other than localhost?" comes before reverse look-ups – and since the Fedora desktop folks in their infinite wisdom wanted to brand workstations by setting hostname to "fedora" when the hostname wasn't explicitly defined, here we are.

Seems NetworkManager expects localhost to be transient and doesn't fall back to reverse lookup? Do we have Fedora bug filed?

Update: I've successfully gotten past the installation stage by adding hostname entries into my DHCP configuration (DHCP client option code 12). We use BlueCat here. So, it involved a lot of clicks and was quite tedious. This isn't really a way forward for production environments.
Vadim, there is this...
https://bugzilla.redhat.com/show_bug.cgi?id=1892235#c9
There is a patch pending that reorders the precedence of hostname checks, putting reverse DNS first. If we could get that moved along somehow. Another bug report would just be marked as duplicate, maybe?
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/09c8387

Gotcha, so we need NM 1.29.2+ to test the commit

@JaimeMagiera - I got a build of FCOS with an updated NM (based off of the CI builds done in copr). Do you mind trying it by itself similar to how you did in https://github.com/openshift/okd/issues/394#issuecomment-736170526 and see if the reverse DNS bits work now?
https://dustymabe.fedorapeople.org/fedora-coreos-33.20201201.dev.1-vmware.x86_64.ova

@dustymabe You sir, are a scholar and a gentleman. Thank you.
[jaimelm1@lsa-linux-dev fcos]$ ssh -t core@fcos-33-test.my.company.edu "sudo hostnamectl status"
Static hostname: n/a
Transient hostname: fcos-33-test.my.company.edu
Icon name: computer-vm
Chassis: vm
Machine ID: 228cab6cf9d34ad6afb405a6c14abaa9
Boot ID: 9645fbc52fce4b988d7c6d9bd81f4e67
Virtualization: vmware
Operating System: Fedora CoreOS 33.20201201.dev.1
CPE OS Name: cpe:/o:fedoraproject:fedora:33
Kernel: Linux 5.9.11-200.fc33.x86_64
Architecture: x86-64

@JaimeMagiera - just checking, was that system getting the hostname from DHCP too, or did you revert those changes on the DHCP server so we could verify the reverse DNS lookups were working?

The DHCP server changes that I mentioned above have to be implemented on a per-host basis (which is why its so tedious). I did not implement that change on this testing host, only on my OKD cluster nodes. So, indeed, the success of this testing VM is due to your inclusion of the updated NM.

Do you mind sharing the NM logs from that boot? Something like journalctl -b 0 ?

This is maybe unrelated, but when I install 4.6 IPI on VMWare I also have the hostname set to fedora.  I am using DHCP but not assigning hostnames.  the hostnames are (should) being assigned via the vmware vm name via vsphere-hostname.service
which calls /usr/local/bin/vsphere-hostname.sh which only exists after vmtools is installed.
#!/usr/bin/env bash
set -e
if [ $(hostname -s) = "localhost" ]; then
  if hostname=$(/bin/vmtoolsd --cmd 'info-get guestinfo.hostname'); then
      /usr/bin/hostnamectl --transient --static set-hostname ${hostname}
  fi
fi

Note that it only gets changed if the current hostname is localhost
Here is the result after the node comes up and reboots:
journalctl -u vsphere-hostname.service
-- Logs begin at Wed 2020-12-02 20:30:44 UTC, end at Wed 2020-12-02 20:44:52 UTC. --
Dec 02 20:33:51 localhost systemd[1]: Started vSphere hostname.
Dec 02 20:33:51 localhost vsphere-hostname.sh[1717]: /usr/local/bin/vsphere-hostname.sh: line 5: /bin/vmtoolsd: No such file or directory
Dec 02 20:33:51 localhost systemd[1]: vsphere-hostname.service: Succeeded.
-- Reboot --
Dec 02 20:41:19 fedora systemd[1]: Started vSphere hostname.
Dec 02 20:41:19 fedora systemd[1]: vsphere-hostname.service: Succeeded.

When /usr/local/bin/vsphere-hostname.sh runs after the reboot, the hostname has already been changed to fedora and so the test fails and the hostname does not get changed...

Thanks for the info. I added that datapoint to the existing bug: https://bugzilla.redhat.com/show_bug.cgi?id=1892235#c11
So in your journalctl output, the first run is from before FCOS was upgraded to F33 where the hostname was localhost. In that case it did pass the if statement conditional logic but failed to set the hostname because there is no file at /bin/vmtoolsd. You might want to fix the script because it won't work even if the localhost versus fedora issue didn't exist.

You might want to fix the script because it won't work even if the localhost versus fedora issue didn't exist.

I'm not sure who owns the vsphere-hostname.service and /usr/local/bin/vsphere-hostname.sh.
Looks like /bin/vmtoolsd comes with vmtools (?)  package

not part of FCOS, maybe OKD is layering it in. A good indicator is the fact that the file is in /usr/local/bin/.

not part of FCOS, maybe OKD is layering it in. A good indicator is the fact that the file is in /usr/local/bin/.

That could be true...  I'm not sure...  I'll check the service file and see what it says

Yes, It's added during ignition:

[root@fedora etc]# journalctl  -u ignition-files.service  | grep vsphere-hostname
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: createFilesystemsFiles: createFiles: op(1f): [started]  writing file "/sysroot/var/usrlocal/bin/vsphere-hostname.sh"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: createFilesystemsFiles: createFiles: op(1f): [finished] writing file "/sysroot/var/usrlocal/bin/vsphere-hostname.sh"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: op(4b): [started]  processing unit "vsphere-hostname.service"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: op(4b): op(4c): [started]  writing unit "vsphere-hostname.service" at "/sysroot/etc/systemd/system/vsphere-hostname.service"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: op(4b): op(4c): [finished] writing unit "vsphere-hostname.service" at "/sysroot/etc/systemd/system/vsphere-hostname.service"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: op(4b): [finished] processing unit "vsphere-hostname.service"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: op(52): [started]  setting preset to enabled for "vsphere-hostname.service"
Dec 02 21:38:59 localhost ignition[1430]: INFO     : files: op(52): [finished] setting preset to enabled for "vsphere-hostname.service"

https://github.com/openshift/okd/issues/407#issuecomment-737520891

@dustymabe Actually, it's not working. Went I went to collect the NM log (journalctl -u NetworkManager), I noticed there were  "option host_name" responses. Sure enough, when I went to BlueCat (DHCP and DNS system), the client DHCP option was set further up in configuration (will have to investigate how that happens). I just did a fresh vm with new IP and MAC address. The build fails to get the hostname. So, it looks like we're not there yet.

I've got the problem with false hostnames since first installing OKD 4 (4.3) due to a funny behaviour of my KVM provider. They always showing up in DHCP with something like server1234433.myprovider.com. I've changed the DNS back resolving and everything else, but FCOS is not using the right name.
Here's my solution for the problem:

Generate an ignition for every node and add the following config at the end:

storage:
  files:
    - path: /etc/hostname
      mode: 0420
      overwrite: true
      contents:
        inline: mynodename.should.be.filled.in.here

Replace mynodename... with your real nodename
Generate the ignition with fcct
Be sure to use the right ignition for every node (either in bootp or static)

This is not a solution, but more a workaround for the problem, but it works for me.
:peter

Great find @fortinj66.
My concern with the vsphere-hostname.service, and the upstream changes to NetworkManager which started this debacle, is that for decades incorrect hostname has been a telltale sign of network problems and/or misconfigured DNS. When you open a shell or glance at the console and see "localhost", or "xyz-some-department-that-no-longer-exists", you know that the host is either not on the network or that DNS is misconfigured/stale. Changing that functionality removes a helpful signpost.

My concern with the vsphere-hostname.service, and the upstream changes to NetworkManager which started this debacle,

Slight correction. NetworkManager didn't change. There are a few things that happened in Fedora 33 that are causing some growing pains. In Fedora the systemd team changed to use fedora as the fallback hostname instead of localhost. At the same time there was also a system wide change to use systemd-resolved and there was a subsequent change make to nsswitch.conf to add in resolve and it also lowered the priority of dns to later than myhostname. Unfortunately it's several changes that are compounding.

Fixed.

@dustymabe Actually, it's not working. When I went to collect the NM log (journalctl -u NetworkManager), I noticed there were "option host_name" responses. Sure enough, when I went to BlueCat (DHCP and DNS system), the client DHCP option was set further up in configuration, attached to the IP as opposed to the MAC address where I usually do it (will have to investigate how that happens). I just did a fresh vm with new IP and MAC address. The build fails to get the hostname. So, it looks like we're not there yet.

On that fresh VM can you give me the output of:

grep hosts /etc/nsswitch.conf
systemctl is-active systemd-resolved
systemctl is-enabled systemd-resolved

I destroyed it last night while writing a testing system of this issue. (Script that downloads an ova from URL, installs the template in vSphere, spins up a host with predesigned .ign, and runs the hostname tests. If it fails, I get zipped files of the various logs) I'll add your items to my script and get that for you.

I wonder if we then still need this PR: https://github.com/openshift/machine-config-operator/pull/2282

I wonder if we then still need this PR: openshift/machine-config-operator#2282

I don't think the NM changes fix the issues in my case where we are not using DHCP for Hostnames...  I get the hostnames directly from vSphere and this will fail without the check for the fedora hostname change...

Does seem that it changed to fedora, however my hostnames are set correctly after reboot, but it might be too late. As I have same issues

@dustymabe Today was quite busy. Sorry for the delay.
Timestamp: 12-03-20-225253
FQDN: fcos-33-test.lsait.lsa.umich.edu
Transient Name: fedora
Transient hostname does not match DNS name
========== Grabbing hosts from nswitch ==========
Valid databases are: aliases, ethers, group, gshadow, hosts,
hosts:      files resolve [!UNAVAIL=return] myhostname dns
========== Checking active status of systemd-resolved ==========
active
========== Checking enabled status of systemd-resolved ==========
enabled
========== Checking rpm-ostree status ==========
State: idle
Deployments:
● ostree://fedora:fedora/x86_64/coreos/testing-devel
Version: 33.20201201.dev.1 (2020-12-01T17:14:54Z)
Commit: 05261ad8abe86bce155ec1b47dcc3c20b7d127a7af4d3382150c726c948303dc
GPGSignature: (unsigned)

If anyone else wants to test this issue quickly as new builds are made, they can grab this script. It outputs to file and console for easy pasting in here.
https://github.com/JaimeMagiera/oct/blob/master/test-hostname.sh

This issue appears to be addressed for vSphere UPI installs.

source: gharchive/issue

authors: JaimeMagiera LorbusChris alexanderniebuhr dustymabe fortinj66 klzsysy pflaeging rajinator vrutkovs

repo: openshift/okd


text:
Adding the option to use 'stack_state' to allow for easy de-provisioning

What does this PR do?
Submitting a role to allow for easy openstack/heat stack deletion
How should this be manually tested?
Read README + use the test.yml playbook in the tests directory
Is there a relevant Issue open for this?
N/A
Who would you like to review this?
cc: @tomassedovic @bogdando

@etsauer yeah, we can do that, but that means restructuring the main.yml to avoid a messy set of checks around generating the heat templates, etc. I figured it would be cleaner to keep it separate. Let me work it and see how it goes.

@bogdando @cooktheryan @tomassedovic Please let us know what we need to do to get this one merged. We'd like to cut another release to have a stable starting point, but would like to include this one + PR https://github.com/openshift/openshift-ansible-contrib/pull/769 in this release.

Sorry @oybed! I've started the end to end test, feel free to merge this when it passes (or I'll do it tomorrow)

All checks have passed. Going to go ahead and merge

authors: etsauer oybed tomassedovic

repo: openshift/openshift-ansible-contrib


text:
OADP-1057 add support for aws sts creds for registry

Todo:

[ ] read secret from bsl spec.

Highlights
https://github.com/openshift/openshift-velero-plugin/blob/1bbb24f5bd39bc601406b37618198d3103a3f80a/go.mod#L11
https://github.com/openshift/openshift-velero-plugin/blob/1bbb24f5bd39bc601406b37618198d3103a3f80a/go.mod#L242-L244
Signed-off-by: Tiger Kaovilai tkaovila@redhat.com

replaced by https://github.com/openshift/openshift-velero-plugin/pull/199

repo: openshift/openshift-velero-plugin


text:
chore(gomod): bump deps

related to

CVE-2021-42576
CVE-2015-3627

these packages were inner deps of some libraries we use. github suggested updating them.
this will resolve CVE's we don't currently have but it's better than waiting on a PR for a third party IMO (it can happen in parralel but still)

ran go mod tidy now so it would be clearer what happened

so this doesn't solve it like I hoped (now that I am looking into the go.sum)
so I will close and file an issue to the packages that introduced it

repo: openshift/osdctl


text:
Remove NFD runtime dependency

Remove runtime dependency from SRO to NFD labels in nodes. Now information is taken from the nodes nodeInfo struct in status.
Now NFD dependency comes from the recipes, not SRO.

cc @qbarrand @yevgeny-shnaidman

/cc @qbarrand @yevgeny-shnaidman

Hold until the downstream CI is merged.
/hold

/ok-to-test

/lgtm

Just realized a bug, dont remove the hold yet

Just realized a bug, dont remove the hold yet

what is the bug?

Just realized a bug, dont remove the hold yet

what is the bug?

Was not supporting double digit OCP versions in the regex, like 4.10 for example.

/retest

/unhold
d/s CI is operational

PTAL @qbarrand @pmtk @yevgeny-shnaidman @ybettan @enriquebelarte

/lgtm
🥳

authors: pacevedom qbarrand ybettan yevgeny-shnaidman

repo: openshift/special-resource-operator


text:
Fixed indentation in HttpApplication

Used the automatic indentaion functionality in JBDS.

merged: https://github.com/openshiftio/appdev-documentation/commit/0e1ad7e875042484f41b7baa0c309679c11cc6fe

authors: rhoads-zach tradej

repo: openshiftio/appdev-documentation


text:
Retrieving Data

How to change the names of the categories and their childs

Example i want to change Accessories to Electronics how can i change it??

CAtegories are retrieved from a service. Your should have your service on your server and change the url in the applicaiton to use your services. After that you can have whatever you want on categories list.

I don't have a service how should i get a service and how to change the urls.. Please explain me the steps how to do and if possible keep screenshots and if there is any link regarding this please inform me... Waiting for your reply..
Thank You..

authors: AshokKnv tugrulkarakaya

license: mit

license_source: bigquery


text:
Remove SmoothSphereHalfSpaceForce from Moco.

Brief summary of changes
SmoothSphereHalfSpaceForce is now in opensim-core; this PR removes this class from Moco.
CHANGELOG.md (choose one)

[x] updated

This change is

It's cool that the contact is now directly in opensim-core! I left one comment, and have just one other note:
While comparing example2Dwalking.m with the one on master, I noticed that the optional GRF tracking is gone from this version but didn't show up in the diff. Is this intentional?

Moco/Bindings/Java/Matlab/Examples/example2DWalking/example2DWalking.m, line 200 at r1 (raw file):
Previously, chrisdembia (Christopher Dembia) wrote…
Thanks for catching this! Done.

(oops; I didn't push the code yet)

Thanks @carmichaelong . You're up, @nickbianco !

@nickbianco I think we should include this change for the Moco paper. I'm happy to update the models in the mocopaper repository once this is merged.

Thanks; I'll merge this after we send our draft to Jen.

authors: carmichaelong chrisdembia

repo: opensim-org/opensim-moco


text:
Devcon 2024 talk proposal

What is it?
Due today
https://devcon.org/en/speaker-applications/

Submitted
https://docs.google.com/document/d/1DVuh4BenGd_88FCiB6NnApk_I42in0WAOMKLis3KGEY/edit

repo: opensource-observer/oso


text:
Debug developer activity metrics

Which area(s) are affected? (leave empty if unsure)
Indexer
To Reproduce
Here is a query in Clickhouse:
select
    m.metric_id,
    m.metric_name,
    t.sample_date,
    t.amount
from metrics.timeseries_metrics_by_project_v0 as t
join metrics.metrics_v0 as m
    on t.metric_id = m.metric_id
join default.projects_v1 as p
    on t.project_id = p.project_id
where
    p.project_name = 'opensource-observer'
    and t.sample_date = '2024-09-22'
order by m.metric_name

Describe the Bug
We get back the following, which shows 1s for most fields.

Expected Behavior
The calculations are not correct (should not be 1s across the board). Moreover, it is not clear how active_developers and developer_active_days relate to each other.

https://github.com/opensource-observer/oso/pull/2270/files


text:
index based access of elements using .loc on Series

we have this for DataFrame here, but missing for Series.
I just can't find a way to access an element at an index

@hemasunder Great request, I'm surprised we didn't add this. I'll fix this.

Fixed in #235

authors: hemasunder risenW

license: MIT


text:
🛑 Weblate is down

In 33ec89c, Weblate (https://translate.opensourcepos.org) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Weblate is back up in 50eeef3.

repo: opensourcepos/upptime


text:
[ServerSide] Sync the OpenSRP FHIR Gateway repo with the upstream Google FHIR Gateway repo

Reason

Latest updates on the upstream added the support for gzip
https://github.com/google/fhir-gateway/pull/147
Need for Gzip for the security audit that has been requested for the codebase that we’ll be deploying.

Implementation

[ ] Sync the current OpenSRP FHIR Gateway with the upstream Google FHIR Gateway.

Acceptance Criteria

[ ] The OpenSRP FHIR Gateway should only be ahead of the Google FHIR Gateway because of the changes we have added to the plugins and deployments.
[ ] All the current permission checking and sync filtering functionality should work as expected.

FYI @dubdabasoduba  @ndegwamartin  @f-odhiambo

Closing this since all the PRs are merged

authors: dubdabasoduba rehammuzzamil

repo: opensrp/fhircore


text:
Configure submit anyway button SDK API

Describe the feature request.
Configure the Submit anyway button visibility by leveraging the SDK's Questionnaire builder API.
Visual

SDK's Questionnaire builder API to show/hide the Submit anyway button
https://github.com/google/android-fhir/blob/92da65c313ed992e8ed3de24675ff9600a8bc46a/datacapture/src/main/java/com/google/android/fhir/datacapture/QuestionnaireFragment.kt#L422-L425

@f-odhiambo


text:
PNC Condition closure

IMPORTANT: Where possible all PRs must be linked to a Github issue
Partial fix for [Quest/eCHIS] - Event Management/PNC
Engineer Checklist

[ ] I have written Unit tests for any new feature(s) and edge cases for bug fixes
[ ] I have added any strings visible on UI components to the strings.xml file
[ ] I have updated the  CHANGELOG.md file for any notable changes to the codebase
[ ] I have run ./gradlew spotlessApply and ./gradlew spotlessCheck to check my code follows the project's style guide
[ ] I have built and run the FHIRCore app to verify my change fixes the issue and/or does not break the app
[ ] I have checked that this PR does NOT introduce breaking changes that require an update to Content and/or Configs? If it does add a sample here or a link to exactly what changes need to be made to the content.

Code Reviewer Checklist

[ ] I have verified Unit tests have been written for any new feature(s) and edge cases
[ ] I have verified any strings visible on UI components are in the strings.xml file
[ ] I have verifed the CHANGELOG.md file has any notable changes to the codebase
[ ] I have verified the solution has been implemented in a configurable and generic way for reuseable components
[ ] I have built and run the FHIRCore app to verify the change fixes the issue and/or does not break the app

We can merge this in and track the TD under #2488 cc @Rkareko

authors: Rkareko ndegwamartin


text:
OSSL_LIB_CTX_load_config is not thread safe

When OSSL_LIB_CTX_load_config is called simultaneously from multiple threads, the program abort with the following trace:
(gdb) where
#0  0x00007ffff7623387 in raise () from /lib64/libc.so.6
#1  0x00007ffff7624a78 in abort () from /lib64/libc.so.6
#2  0x00007ffff7665ed7 in __libc_message () from /lib64/libc.so.6
#3  0x00007ffff766c3e4 in malloc_printerr () from /lib64/libc.so.6
#4  0x00007ffff76716e0 in _int_realloc () from /lib64/libc.so.6
#5  0x00007ffff7672d82 in realloc () from /lib64/libc.so.6
#6  0x00000000004fa265 in CRYPTO_realloc (str=0x7ffff0006390, num=104, file=0x734de8 "crypto/stack/stack.c", line=210) at crypto/mem.c:214
#7  0x000000000052e1b8 in sk_reserve (st=0x7ffff0009570, n=1, exact=0) at crypto/stack/stack.c:210
#8  0x000000000052e2f4 in OPENSSL_sk_insert (st=0x7ffff0009570, data=0x7fffe8005ba0, loc=9) at crypto/stack/stack.c:254
#9  0x000000000052e79b in OPENSSL_sk_push (st=0x7ffff0009570, data=0x7fffe8005ba0) at crypto/stack/stack.c:368
#10 0x0000000000496625 in sk_CONF_IMODULE_push (sk=0x7ffff0009570, ptr=0x7fffe8005ba0) at crypto/conf/conf_mod.c:27
#11 0x00000000004970b6 in module_init (pmod=0x7ffff0002c10, name=0x7fffe80037e0 "providers", value=0x7fffe8003820 "provider_sect", cnf=0x7fffe8009770) at crypto/conf/conf_mod.c:390
#12 0x0000000000496b64 in module_run (cnf=0x7fffe8009770, name=0x7fffe80037e0 "providers", value=0x7fffe8003820 "provider_sect", flags=0) at crypto/conf/conf_mod.c:239
#13 0x0000000000496837 in CONF_modules_load (cnf=0x7fffe8009770, appname=0x0, flags=0) at crypto/conf/conf_mod.c:138
#14 0x00000000004969b0 in CONF_modules_load_file_ex (libctx=0x7fffe8009d00, filename=0x70ee50 "/tmp/openssl.cnf", appname=0x0, flags=0)
   at crypto/conf/conf_mod.c:181
#15 0x00000000004f52f8 in OSSL_LIB_CTX_load_config (ctx=0x7fffe8009d00, config_file=0x70ee50 "/tmp/openssl.cnf") at crypto/context.c:234

Each thread allocates its own library context and load config.
Please see the sample code below which reproduces the issue.  With mutex held while OSSL_LIB_CTX_load_config() is called, we don't see the issue.
#include <stdio.h>
#include <stdlib.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/ssl.h>

pthread_mutex_t lock;

void *libctx_init(void *arg)
{
  int           rv;
  int           i;
  int           num_loops = (int)arg;
  OSSL_LIB_CTX *libctx = NULL;
  const char   *path = "/ade/mmiyashi_network_openssl/oracle/crypto/lib/openssl.cnf";

  for (i= 0; i < num_loops; i++)
  {
    printf("[%u][%d] LoadConfig called\n", pthread_self(), i);

    libctx = OSSL_LIB_CTX_new();
    if (libctx == NULL)
    {
       printf("[%u] Failed to allocate LIB_CTX\n", pthread_self());
    }

    //pthread_mutex_lock(&lock);
    rv = OSSL_LIB_CTX_load_config(libctx, path);
    //pthread_mutex_unlock(&lock);
    if (rv != 1)
    {
       printf("[%u] Failed to load config\n", pthread_self());
    }

    printf("[%u][%d] LoadConfig successful\n", pthread_self(), i);
  }
}

int main(int argc, char *argv[])
{
  int        rv;
  int        i;
  int        num_loops = 1;
  int        num_threads = 5;
  pthread_t  threads[1024];

  if (argc >= 2)
  {
     num_threads = atoi(argv[1]);
     if (num_threads > 1024)
     {
         printf("num_threads[%d] too largs. Reset to 1024\n", num_threads);
         num_threads = 1024;
     }
  }
  if (argc >= 3)
  {
     num_loops = atoi(argv[2]);
  }
  if (pthread_mutex_init(&lock, NULL) != 0) {
    printf("mutex init has failed\n");
    return 1;
  }

  SSL_load_error_strings();
  SSL_library_init();

  fprintf(stderr, "Initialize libctx\n");
  for (i = 0; i < num_threads; i++)
  {
    rv = pthread_create(&threads[i], NULL, libctx_init, (void *)num_loops);
    if (rv != 0) {
      printf("[%d]: pthread_create filed\n", i);
    }
  }

  for (i = 0; i < num_threads; i++)
  {
    pthread_join(threads[i], NULL);
  }

  return 0;
}

Is this an multi-threaded issue in OpenSSL? or an issue in the test code.
The issue is seen with OpenSSL 3.0.0.
Thank you,
-- misaki

Seems like a bug.  I'd have expected this to work.
Long time no see!

Thanks for reviewing and evaluating, Pauli!
Yes, long time no see! :-)

The module_init function (called in the stack you gave) seems to access a global variable:
https://github.com/openssl/openssl/blob/cac250755efd0c40cc6127a0e4baceb8d226c7e3/crypto/conf/conf_mod.c#L382-L392
That looks like the culprit.

Possibly that should be held in the libctx instead

@mattcaswell CONF_modules_finish and CONF_modules_unload are public APIs. What would we do with these if we make initialized_modules libctx-specific?

Make them apply to the default libctx?

That would seem reasonable.

authors: hlandau mattcaswell mmiyashi paulidale

repo: openssl/openssl


text:
FIPS Mode is not getting enabled in Tomcat9 using Openssl 3.0.2 post successful FIPS module installation in windows

Good Evening,
I have a issue while enabling the FIPS mode in Tomcat9 for windows where it throws me an error "Failed to enter fips mode". Below are the detail explanation and content. Sorry for the length but I am trying to provide all of the relevant details in hopes that the solution to this issue will be easily identifiable.
I have installed the openssl version (3.0.2) along with the FIPS Module installation as per the steps mentioned in the wiki (https://wiki.openssl.org/index.php/OpenSSL_3.0#Installation_and_Compilation_of_OpenSSL_3.0).
The openssl 3.0.2 and fips module got installed successfully.
OpenSSL version:

I am using openssl 3.0.2 to enable the FIPS Mode in only Tomcat9 for windows. As per the steps mentioned in the wiki referenced above, I have executed the steps under the section for Using the FIPS Module in applications and have made the changes to the openssl.cnf file. Since i need only Tomcat9 Application to be FIPS enabled i have also followed next step to set the environment variable along with the application name.

Post these steps I tried enabling the FIPS mode in tomcat9, For that I have performed:

Added the FIPSMode="on"  for the APR listener:

Restarted the tomcat server and checked the catalina.log but i get a error which states "failed to enter fips mode".

Any help here would be greatly appreciated.
Thank you,
Rupesh P

Two things:
First, the value you are setting the OPENSSL_CONF environment variable is not correct. It should just be the path to the openssl config file - it should not include the Tomcat9.exe part (probably you are confused by the bash syntax shown on the wiki which sets the OPENSSL_CONF environment variable and runs "myapplication" all on the same line).
Whatever process your application is running in needs to have access to that environment variable.
Second, according to this page:
https://tomcat.apache.org/tomcat-9.0-doc/apr.html
the APR component depends on:
OpenSSL 1.0.2+ development headers (libssl-dev package)
So it looks like APR is written for OpenSSL 1.0.2 and will therefore use the old FIPS module not the new OpenSSL 3 one. Probably APR will need changes to support the OpenSSL 3 FIPS module.

Please do share your thoughts on to make Probably APR support OpenSSL 3.0 FIPS module for Tomcat 9.

This will almost certainly require some modification of the APR code. Unfortunately I know nothing about APR or Tomcat so I can't provide guidance as to specifically what would need to change.

authors: Rupeshkryz mattcaswell


text:
Double lock deadlock in fips_drbg_rand [1.0.2j]

When a thread locking is installed, OpenSSL 1.0.2j dead locks at fips_drbg_rand.c:124 when the RNG is reseeded. I found the bug with Python's test suite. The dead lock only occurs in FIPS mode. I used OPENSSL_FORCE_FIPS_MODE=1 and /etc/system-fips to enable FIPS mode. My platform is Fedora 24 on X86_64 with openssl-1.0.2j-1.fc24.x86_64.
Python 2.7
(gdb) bt
#0  0x00007f0d9f8470c7 in do_futex_wait.constprop () from /lib64/libpthread.so.0
#1  0x00007f0d9f847174 in __new_sem_wait_slow.constprop.0 () from /lib64/libpthread.so.0
#2  0x00007f0d9f84721a in sem_wait@@GLIBC_2.2.5 () from /lib64/libpthread.so.0
#3  0x000000000051e013 in PyThread_acquire_lock (lock=0x27433a0, waitflag=1) at Python/thread_pthread.h:324
#4  0x00007f0d937b0dce in _ssl_thread_locking_function (mode=5, n=18, file=0x7f0d96e417ac "fips_drbg_rand.c", line=124)
    at /home/heimes/dev/python/2.7/Modules/_ssl.c:4000
#5  0x00007f0d96df1d7e in fips_drbg_status () from /lib64/libcrypto.so.10
#6  0x00007f0d96d75b0e in drbg_rand_add () from /lib64/libcrypto.so.10
#7  0x00007f0d96d76645 in RAND_poll () from /lib64/libcrypto.so.10
#8  0x00007f0d96d75237 in ssleay_rand_bytes () from /lib64/libcrypto.so.10
#9  0x00007f0d96d75c33 in drbg_get_entropy () from /lib64/libcrypto.so.10
#10 0x00007f0d96df10c8 in fips_get_entropy () from /lib64/libcrypto.so.10
#11 0x00007f0d96df1226 in drbg_reseed () from /lib64/libcrypto.so.10
#12 0x00007f0d96d75bb8 in drbg_rand_seed () from /lib64/libcrypto.so.10
#13 0x00007f0d96d5da84 in ECDSA_sign_ex () from /lib64/libcrypto.so.10
#14 0x00007f0d96d5db00 in ECDSA_sign () from /lib64/libcrypto.so.10
#15 0x00007f0d96d3bc10 in pkey_ec_sign () from /lib64/libcrypto.so.10
#16 0x00007f0d96d81359 in EVP_SignFinal () from /lib64/libcrypto.so.10
#17 0x00007f0d96def373 in fips_pkey_signature_test () from /lib64/libcrypto.so.10
#18 0x00007f0d96d38fe0 in EC_KEY_generate_key () from /lib64/libcrypto.so.10
#19 0x00007f0d970d7d7c in ssl3_ctx_ctrl () from /lib64/libssl.so.10
#20 0x00007f0d937af934 in set_ecdh_curve (self=0x7f0d92a23f78, name='prime256v1') at /home/heimes/dev/python/2.7/Modules/_ssl.c:3110

Python 3.x
#0  0x00007f2be93dc0c7 in do_futex_wait.constprop () from /lib64/libpthread.so.0
#1  0x00007f2be93dc174 in __new_sem_wait_slow.constprop.0 () from /lib64/libpthread.so.0
#2  0x00007f2be93dc21a in sem_wait@@GLIBC_2.2.5 () from /lib64/libpthread.so.0
#3  0x0000000000433e5c in PyThread_acquire_lock_timed (lock=0x17c0b40, microseconds=-1, intr_flag=intr_flag@entry=0)
    at Python/thread_pthread.h:352
#4  0x0000000000433f5e in PyThread_acquire_lock (lock=<optimized out>, waitflag=waitflag@entry=1) at Python/thread_pthread.h:556
#5  0x00007f2be0870945 in _ssl_thread_locking_function (mode=<optimized out>, n=<optimized out>, file=<optimized out>,
    line=<optimized out>) at /home/heimes/dev/python/cpython/Modules/_ssl.c:5069
#6  0x00007f2be02f4d7e in fips_drbg_status () from /lib64/libcrypto.so.10
#7  0x00007f2be0278b0e in drbg_rand_add () from /lib64/libcrypto.so.10
#8  0x00007f2be0279645 in RAND_poll () from /lib64/libcrypto.so.10
#9  0x00007f2be0278237 in ssleay_rand_bytes () from /lib64/libcrypto.so.10
#10 0x00007f2be0278c33 in drbg_get_entropy () from /lib64/libcrypto.so.10
#11 0x00007f2be02f40c8 in fips_get_entropy () from /lib64/libcrypto.so.10
#12 0x00007f2be02f4226 in drbg_reseed () from /lib64/libcrypto.so.10
#13 0x00007f2be0278b39 in drbg_rand_add () from /lib64/libcrypto.so.10
#14 0x00007f2be0868870 in _ssl_RAND_add_impl (module=module@entry=<module at remote 0x7f2be0aa1a58>, view=view@entry=0x7ffd106c1420,
    entropy=75) at /home/heimes/dev/python/cpython/Modules/_ssl.c:4499

Lock trace
I added a small trace helper to Modules/_ssl.c:_ssl_thread_locking_function
    if (n == CRYPTO_LOCK_RAND) {
        fprintf(stderr, "%s%s %i %s:%i\n",
                (mode & CRYPTO_READ) ? "R" : "W",
                (mode & CRYPTO_LOCK) ? "LCK" : "UNL",
                n, file, line);
    }

and got this result for CRYPTO_LOCK_RAND. It looks like fips_drbg_rand.c:124 tries to acquire a lock that has been locked already:
WLCK 18 fips_drbg_rand.c:80
WUNL 18 fips_drbg_rand.c:109
WLCK 18 fips_drbg_rand.c:80
WUNL 18 fips_drbg_rand.c:109
WLCK 18 md_rand.c:230
WUNL 18 md_rand.c:262
WLCK 18 md_rand.c:311
WUNL 18 md_rand.c:324
RLCK 18 fips_drbg_rand.c:124
RUNL 18 fips_drbg_rand.c:126
WLCK 18 rand_lib.c:240
RLCK 18 fips_drbg_rand.c:124

Python bug report is https://bugs.python.org/issue28854

fips_drbg_rand.c?  don't build the FIPS version...

It's a downstream bug in Fedora. Tomas Mraz took care of it, https://bugzilla.redhat.com/show_bug.cgi?id=1400922

authors: richsalz tiran


text:
Import wycheproof tests

Google's project wycheproof has a large collection of test vectors, in json.  We should look at building a tool to import and convert them.
https://github.com/google/wycheproof

So all we need is a conf Parser that groks json, the rest seems to be a job for evptest.

... I meant stanza reader.

Closing since #7714 has more discussion.

authors: levitte richsalz


text:
generating .so for OpenSSL_1_0_2-stable branch

Hi,
I want .so files generated for OpenSSL_1_0_2-stable branch code. kindly any one help me to solve  this issue

When configuring, add the argument shared

authors: deekshith-elear levitte


text:
TEST: separate out NIST ECC tests from non-NIST

ECC keys with non-NIST group names aren't supported when running with
the FIPS provider.
Keys with such groups that are included in evp_test stanza files
aren't even possible to decode if provider side decoders are used,
since those depend on available EVP_KEYMGMT implementations and what
they support.
Those keys could only be decoded because the legacy decoders were
used.
To make these tests future proof, we separate out the stanzas having
keys with NIST approved group names into separate files, and adjust
the file lists in test/recipes/30-test_evp.t aaccordingly.

#12587 will depend on this

This pull request is ready to merge

Merged
e6ed04a9dcc2ead94e35c4a7400b9c998b5ad9ac TEST: separate out NIST ECC tests from non-NIST

authors: levitte openssl-machine


text:
Make EVP_PKEY_missing_parameters work properly on provided RSA keys

This requires changing semantics of the keymgmt_has()
function a little in the sense that it now returns 1
if the selection has no meaning for the key type. It
was already doing so for ECX keys for example.
The keymgmt_validate function semantics is changed
similarly to allow passing validation on the same
selection that the key returns 1 for.
Fixes #14509
Checklist

[x] documentation is added or updated
[x] tests are added or updated

Ping for review

fixup pushed

Rebased to fix trivial conflict in providers/implementations/keymgmt/rsa_kmgmt.c. No other changes. @mattcaswell still OK?

Merged to master. Thank you for the reviews.


text:
Remove redundant header crypto/types.h

Oracle linux build was not compiling due to duplicate typedefs for
ECX_KEY.
crypto/types.h was just a subset of openssl/types.h
ECX_KEY is typedefed in include/crypto/ecx.h
The error was:
In file included from ../include/crypto/evp.h:17,
from ../crypto/asn1/a_sign.c:23:
../include/crypto/ecx.h:79: error: redefinition of typedef 'ECX_KEY'
../include/crypto/types.h:22: note: previous declaration of 'ECX_KEY' was here

Checklist

[ ] documentation is added or updated
[ ] tests are added or updated

Now that the deprecated test has failed - I see why this was added..

I just looked back at the git history, and I've obviously failed to document the intent with that header.  Is a comment in that header enough, or should I create a doc/internal/man7/crypto-types.h.pod?

A comment is probably fine... It was my bad..

authors: levitte slontis


text:
ci: include cmd-nits in the documentation checks

Fixes #15250

[ ] documentation is added or updated
[ ] tests are added or updated

There is a known cmd-nit, so the test will fail for the moment.

CI failure is the known cmd-nits problem.

CI failure is the known cmd-nits problem.

Yes - this is going to be solved by #15053.

I'd strongly prefer to merge this PR after fixing these known failures.

I have no issue delaying the merge of this one.

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set.  Please review the updates and set the label manually.

I've made the change, it's not a quick test anymore.  Over four minutes instead of forty seconds.

I've made the change, it's not a quick test anymore. Over four minutes instead of forty seconds.

Doing cmd-nits was never fast.  However, if make doc-nits fails, that action will still fail fast.  In my view, this is the best compromise for now

I've made the change, it's not a quick test anymore. Over four minutes instead of forty seconds.

I would have expected less, but luckily this is in parallel with the other CI tests, so does not significantly prolong the total CI run time.
And when make cmd-nits is invoked locally, make apps (or equivalents) will likely be done anyway.

Why didn't you combine it with doc-nits, as done originally?

cmd-nits needs the build done to run.  doc-nits can fail faster if it is done separately before the build.
The run time will become more important once we start running into parallel job limits.

authors: DDvO beldmit levitte openssl-machine paulidale


text:
Prevents that OPENSSL_gmtime incorrectly signals success if gmtime_r …

…fails, and that struct* tm result's possibly uninitialized content is used

Example of gmtime_r failing:
#include "crypto/o_time.h"

int main(void)
{
    struct tm _tm;
    time_t t = 0xFF0F3D5300F0C2AC;
    OPENSSL_gmtime(&t, &_tm);
    return 0;
}

With regards to the preceding comment that says gmtime_r doesn't always return a pointer: if this is still true then it would be worth the effort to at least integrate this patch for systems where it does work and handle other systems with ifdefs. The use of this function extends into OCSP-related functions and it'd be a shame if things malfunctioned due to an uninitialized struct tm (that could have security ramifications as well if the purported time variables ever leave the system..).

It took me a while, but here it is.

I would apply this on all branches

In 1.0.2, b70dc3a; in 1.1.0 07bc93f; and in master, 7c12035.  thanks!

hi， @richsalz
In vxworks 5.5 system, I discover  the return value of gmtime_r is different in kernel mode and user mode.In kernel mode, gmtime_r always returns 0，and return pointer in user mode.Have you tested this?
How can I modify it?  Is there a macro to distinguish between kernel mode and user mode?
https://github.com/openssl/openssl/blob/8c00f267b8df1a8c70eff8198de40aa561299e48/crypto/o_time.c#L40-L43

I am only replying because you at'ed me. :)  To answer your questions: I do not know.

@levitte  hi,
https://github.com/openssl/openssl/pull/1613#issuecomment-516793955 The  issue，Can you help me answer the above question? and I would like to  modify my code  in the vxworks5.5. Do you have a better idea?
#elif defined(OPENSSL_SYS_VXWORKS)
     gmtime_r(timer, result);
     ts = result;
#elif defined(OPENSSL_THREADS) && !defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_SYS_MACOSX)
     if (gmtime_r(timer, result) == NULL)
         return NULL;
     ts = result;
#elif defined (OPENSSL_SYS_WINDOWS) && defined(_MSC_VER) && _MSC_VER >= 1400
    if (gmtime_s(result, timer))
        return NULL;
    ts = result;
#else
    ts = gmtime(timer);
    if (ts == NULL)
        return NULL;

authors: guidovranken levitte richsalz yangyangtiantianlonglong


text:
Exclude IPv6 code using OPENSSL_USE_IPV6 instead of AF_INET6

This replaces the usage of #ifdef AF_INET6 in bio/* with #if OPENSSL_USE_IPV6. By default this still uses AF_INET6, but it allows the exclusion of all IPv6 related code by setting OPENSSL_USE_IPV6=0.

Checklist

For this to be merged into our source, you either need to add a trailer CLA: trivial to your commit message (make sure to separate it from the rest of the message with an empty line), or submit a signed CLA

I did just submit a signed CLA. I would like to make the same change in openssl 1.1.1. Should I open a separate PR for this, or are changes between the 1.1.1 and master branch synced in some way?

I would like to make the same change in openssl 1.1.1. Should I open a separate PR for this, or are changes between the 1.1.1 and master branch synced in some way?

If it cherry-picks cleanly, we'll do it. If not, then another PR will be necessary

Ah okay thanks for pointing that out.

Merged, thanks for the contribution.

authors: bernd-edlinger levitte maxbachmann paulidale


text:
Support all five EdDSA instances from RFC 8032

Fixes #6277
Adds support for all five EdDSA instances from RFC 8032: Ed25519, Ed25519ctx, Ed25519ph, Ed448, Ed448ph.
Only Ed25519 was already fully supported (via the EVP APIs)
All instances, except for Ed25519, allow context strings as input.  Context strings can now be passed via an OSSL_PARAM.
The desired EdDSA instance can also be specified via an OSSL_PARAM.

Checklist

[ y ] documentation is added or updated
[ y ] tests are added or updated

@paulidale: could you take a look at the changes so far?

@slontis @mattcaswell :  thank-you for taking a look!

JFYI.
https://hdevalence.ca/blog/2020-10-04-its-25519am

@beldmit :  was there anything in particular from that blog that you wanted to point out?
Note that I do not intend to modify any curve arithmetic.  In particular, for edwards25519, the strict verification equation is used currently and I will not change that in this PR.

All five EdDSA instances are working now.  The HashEdDSA instances are supported only in "one-shot" mode.
This PR is close to being ready, but I still need to make some documentation updates and relocate my dev test.

@slontis @mattcaswell :  this PR is ready (i.e. it is no longer work-in-progress).
I believe I have addressed all your previous comments.
Please let me know if you have any additional concerns.

@hlandau :  thanks for your comments.
I believe I have addressed everything you raised.
Please let me know if you have other suggestions.

Strangely, the test buildbot/master:unix-macos11-x86_64 failed:
15-test_rsaoaep.t .................. ok
15-test_rsapss.t ................... ok
15-test_sha.t ...................... ok
20-test_app.t ...................... ok
20-test_cli_fips.t ................. skipped: Test only supported in a fips build with security checks
20-test_dgst.t ..................... ok
20-test_dhparam.t .................. ok

command timed out: 1200 seconds without output running [b'make', b'test'], attempting to kill
process killed by signal 9
program finished with exit code -1
elapsedTime=1952.749765

https://ci.buildbot.openssl.org/#/builders/16/builds/1736
I don't understand why this particular platform failed.
is this a test infrastructure issue?

buildbot runners seem to be unreliable currently.

@mattcaswell @hlandau:  thanks for the reviews you left on 18 Nov and 30 Nov.  Each of you requested changes, but I believe my updates have addressed all your comments.  Would you be able to update your reviews?

needs a rebase also.

Here is example converted test data for test vector https://github.com/openssl/openssl/pull/21 (using your .h file) that I appended to test/recipes/30-test_evp_data/evppkey_ecx.txt to test this works.

Thanks for providing this example.  I will give it a try.

I've added all 21 test vectors to evppkey_ecx.txt and confirmed that they are being exercised.  I've dropped the file rfc8032-test-vectors.h, as well as my changes to evp_extra_test.c.

You will need to add
FIPSversion = >=3.2.0 to each of the new tests in the .txt file..
We run the tests in master against older fips providers, so this new functionality needs to be skipped when this happens.

@slontis :  thanks for applying the "tests:present" label and the detailed comments you provided previously.
I am not sure what else I can do to move this PR forward.
Would you be willing to give an approval?

@hlandau will need to reapprove,

thanks, slontis, for approving these changes.
hlandau's previous approval appears to still be valid.
@mattcaswell :  do you have some time to revisit this PR?  You requested changes on 18 Nov 2022.  I believe all your comments have been addressed.

This pull request is ready to merge

Merged to master. Thank you.

authors: beldmit hlandau jamuir openssl-machine slontis


text:
Add include of e_os2.h in quictestlib.c to allow symbol definition consistency.

Fixes: #22178
Signed-of-by: Randall S. Becker randall.becker@nexbridge.ca

This should be applicable to other branches.

I have made this change NonStop-specific but I think it might apply to any c99 builds because the unspecified type, timeval, is rejected by the c99 compiler, not the platform. Please review and let me know if the include needs to move and what ifdef wrapping it otherwise needs.

This passed builds on our platform.

I originally called this "Move" instead of "Add" because it was in comparison to the proposed change by @mattcaswell. This just moves where the #include is done compared to commit b01151dfbd107bce6e88de64acc541178e520fa0 to make c99 happy.

FYI: This change, commit 71c7128, did pass build/test on NonStop with c99.

Pushed.

authors: mattcaswell rsbeckerca