With the latest urllib3 the CN match is no longer used for hostname
verification and instead the use of subjectAltName is required. With
openssl 3.3.1 this is needed to be handled with both an additional
parameter when generating the cert/request and also some new
configuration for the ssl.cnf. It is also necessary to have extensions
copied so the SAN information is preserved down the cert chain.
Signed-off-by: William Douglas <william.douglas@intel.com>
Koji's koji-hub entrypoint has changed so update the deployjment
script to reflect the new entrypoint.
Signed-off-by: William Douglas <william.douglas@intel.com>
In koji 1.21.0, kojira began logging a deprecation warning for this
option, but it appears to have never had a functional use in the
codebase. Avoid the deprecation warning by removing the option from the
default config.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
This option was officially deprecated in koji 1.22.0 and removed in koji
1.24.0. It was internally deprecated a while before 1.22.0, and I've
confirmed that removing the config for koji 1.21.2 -- the current
version in Clear -- is a no-op.
(Note that removing the 'ca' option from the client config is optional,
since unknown options in that config appear to be ignored. But for
completeness, I removed it there as well.)
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Want to enable spinning up a development environment quickly.
Increasing the countryName_max SSL configuration did not allow a country
name of 'Example Country Code' to be used when generating a certificate.
Prefer to revert back to the original value for countryName_max and
supply shorter parameters for certificate generation.
Change challengePassword_max to be consistent with the other limits.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
Supply more reasonable maximum boundaries for country code and challenge
password length. This allows users to get going without modifying any
values from parameter.sh for SSL certificate generation.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
swupd should only be run during setup when on an officially released
version of Clear that has an upadate stream. Development versions are
usually indicated when the VERSION_ID is equal to 1 and do not have an
update stream. In these cases, the assumption is that all required
software is already installed prior to setup.
However, add checks for only the most critical dependencies before
continuing with the setup so that it more obvious to the user that these
are missing when they are.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
mod_wsgi is built and loaded with python3 by default. No longer provide
a configuration to load the python2 equivalent, since it is also no
longer included in the koji bundle.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
A deployment of a "koji" server consists of additional services that
support development beyond koji itself. These include
git/cgit/gitolite, a mash containing the current snapshot of the
packages in koji, and an upstreams package sources cache.
Because these are required for integration with a DevOps workflow, they
are not included by default in the ansible playbook.
OpenSSL complains if the RANDFILE does not exist when it is generating
certificates. Create an initial seed for this file from urandom.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
kojid will not be able to merge repos and mock will not be able to build
a chroot in an environment where proxy variables are used unless they
are defined in configuration files.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
Because the kojid capacity is difficult and error-prone to calculate
automatically, let the user define this. Default the kojid capacity to
what is listed in the pagure documentation.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
The capacity for kojid should scale according to the number of
processing units available because building packages is largely a
CPU-bound task. Defaulting to a safe capacity of one-fourth the number
of processing units.
Signed-off-by: George T Kramer <george.t.kramer@intel.com>
William Douglas