Bug #1926987 “Download_mirror.sh fails on 'flockflock'” : Bugs : StarlingX

Scott Little (slittle1) on 2021-05-03

Changed in starlingx:
assignee:	nobody → Scott Little (slittle1)

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-03: Fix proposed to tools (master)

#1

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/789389

Changed in starlingx:
status:	New → In Progress

Revision history for this message

Ghada Khalil (gkhalil) wrote on 2021-05-04:

#2

screening: Marking as critical for both stx master and the r/stx.5.0 release branch. Issue with mirror download.

tags:

added: stx.5.0 stx.6.0 stx.build

Ghada Khalil (gkhalil) on 2021-05-04

Changed in starlingx:
importance:	Undecided → Critical

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-04: Fix merged to tools (master)

#3

Reviewed: https://review.opendev.org/c/starlingx/tools/+/789389
Committed: https://opendev.org/starlingx/tools/commit/b96ebc83d859a4a7802a462504817ecec6182a7b
Submitter: "Zuul (22348)"
Branch: master

commit b96ebc83d859a4a7802a462504817ecec6182a7b
Author: Scott Little <email address hidden>
Date: Mon May 3 13:16:53 2021 -0400

fix bad flockflock url

download_mirror.sh fails due to a bad path containing
‘stx-tools/centos-mirror-tools/config/centos/flockflock’

    The path is constructed, and the trigger is when an EOL is missing
    from a centos_build_layer.cfg file, causing 'cat' to merge the last
    line of the offending file with the first line of the next file.

Switch 'cat' to 'grep', which will always ensure an EOL is present.
Along the way, we can filter out empty lines and comments.

    Closes-bug: 1926987
    Signed-off-by: Scott Little <email address hidden>
    Change-Id: I2404b3415f0f3e2f395c2bcb7a527aa01a488f61

Changed in starlingx:
status:	In Progress → Fix Released

Bill Zvonar (billzvonar) on 2021-05-05

tags:

added: stx.cherrypickneeded

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-05: Fix proposed to tools (master)

#4

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/789841

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-05: Fix merged to tools (master)

#5

Reviewed: https://review.opendev.org/c/starlingx/tools/+/789841
Committed: https://opendev.org/starlingx/tools/commit/7b5f3a45e663866a3c0ca3ca86eb3c92bc7f0210
Submitter: "Zuul (22348)"
Branch: master

commit 7b5f3a45e663866a3c0ca3ca86eb3c92bc7f0210
Author: Scott Little <email address hidden>
Date: Wed May 5 09:56:33 2021 -0400

fix bad flockflock url pt 2

    A stray '}' character found it's way into my prior update
    titled 'fix bad flockflock url' after testing. The result was
    the following error

sed: -e expression #1, char 15: unexpected `}'

This removes the unwanted '}', restoring the prior update
to its intended form.

    Closes-bug: 1926987
    Signed-off-by: Scott Little <email address hidden>
    Change-Id: I48f4721ccaf121679916b01747243deedf5836cd

Revision history for this message

Ghada Khalil (gkhalil) wrote on 2021-05-06:

#6

@Scott Little, please cherry-pick this to the r/stx.5.0 release since you've indicated it affects that branch as well.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-11: Fix proposed to tools (r/stx.5.0)

#7

Fix proposed to branch: r/stx.5.0
Review: https://review.opendev.org/c/starlingx/tools/+/790700

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-12: Fix merged to tools (r/stx.5.0)

#8

Reviewed: https://review.opendev.org/c/starlingx/tools/+/790700
Committed: https://opendev.org/starlingx/tools/commit/07aeed694edd3139c4b19020ddcc73baa341998b
Submitter: "Zuul (22348)"
Branch: r/stx.5.0

commit 07aeed694edd3139c4b19020ddcc73baa341998b
Author: Scott Little <email address hidden>
Date: Mon May 3 13:16:53 2021 -0400

fix bad flockflock url

download_mirror.sh fails due to a bad path containing
‘stx-tools/centos-mirror-tools/config/centos/flockflock’

    The path is constructed, and the trigger is when an EOL is missing
    from a centos_build_layer.cfg file, causing 'cat' to merge the last
    line of the offending file with the first line of the next file.

Switch 'cat' to 'grep', which will always ensure an EOL is present.
Along the way, we can filter out empty lines and comments.

    Closes-bug: 1926987
    Signed-off-by: Scott Little <email address hidden>
    (cherry picked from commit b96ebc83d859a4a7802a462504817ecec6182a7b)
    (cherry picked from commit 7b5f3a45e663866a3c0ca3ca86eb3c92bc7f0210)
    Change-Id: I79a96ddc8333a2465ba03b1d2abbad9a8b3b58f0

Bill Zvonar (billzvonar) on 2021-05-13

tags:

added: in-r-stx50
removed: stx.cherrypickneeded

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-19: Fix proposed to tools (f/centos8)

#9

Fix proposed to branch: f/centos8
Review: https://review.opendev.org/c/starlingx/tools/+/792229

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-28: Change abandoned on tools (f/centos8)

#10

Change abandoned by "Chuck Short <email address hidden>" on branch: f/centos8
Review: https://review.opendev.org/c/starlingx/tools/+/792229
Reason: Updated merge coming

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-05-28: Fix proposed to tools (f/centos8)

#11

Fix proposed to branch: f/centos8
Review: https://review.opendev.org/c/starlingx/tools/+/793627

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2021-06-04: Fix merged to tools (f/centos8)

#12

Download full text (30.4 KiB)

Reviewed: https://review.opendev.org/c/starlingx/tools/+/793627
Committed: https://opendev.org/starlingx/tools/commit/d701c6f896dfe440566cc942e3dd71be1f19ae5d
Submitter: "Zuul (22348)"
Branch: f/centos8

commit 7b5f3a45e663866a3c0ca3ca86eb3c92bc7f0210
Author: Scott Little <email address hidden>
Date: Wed May 5 09:56:33 2021 -0400

fix bad flockflock url pt 2

    A stray '}' character found it's way into my prior update
    titled 'fix bad flockflock url' after testing. The result was
    the following error

sed: -e expression #1, char 15: unexpected `}'

This removes the unwanted '}', restoring the prior update
to its intended form.

    Closes-bug: 1926987
    Signed-off-by: Scott Little <email address hidden>
    Change-Id: I48f4721ccaf121679916b01747243deedf5836cd

commit ac05493480f6df6f31d071d29380c1b4f35b70a9
Author: Scott Little <email address hidden>
Date: Tue May 4 12:42:36 2021 -0400

fix git-review within docker build environment

'tb create' fails to create a build environment since
upstream git-review was updated of Apr 26.

Fix is to install/update pbr ahead of git-review.

    Also, to reduce the likelyhood of this recurring, lock
    down specific versions of the pypi supplied tools we
    know to work.

    Closes-bug: 1927137
    Signed-off-by: Scott Little <email address hidden>
    Change-Id: Ib9fe6fd33de4d637f254ac421cc0427ee6131b65

commit b96ebc83d859a4a7802a462504817ecec6182a7b
Author: Scott Little <email address hidden>
Date: Mon May 3 13:16:53 2021 -0400

fix bad flockflock url

download_mirror.sh fails due to a bad path containing
‘stx-tools/centos-mirror-tools/config/centos/flockflock’

    The path is constructed, and the trigger is when an EOL is missing
    from a centos_build_layer.cfg file, causing 'cat' to merge the last
    line of the offending file with the first line of the next file.

Switch 'cat' to 'grep', which will always ensure an EOL is present.
Along the way, we can filter out empty lines and comments.

    Closes-bug: 1926987
    Signed-off-by: Scott Little <email address hidden>
    Change-Id: I2404b3415f0f3e2f395c2bcb7a527aa01a488f61

commit 4c3ee114bcbff710c2049626044dd1ddc756cbd9
Author: Joe Slater <email address hidden>
Date: Tue Apr 27 18:50:53 2021 -0400

screen: fix CVE-2021-26937 segfault

Advance to screen-4.1.0-0.27.20120314git3c2946.el7_9.x86_64.rpm.

    Closes-bug: 1926372
    Change-Id: I41834e7b1e16153b0632751f59f7ac9f503389da
    Signed-off-by: Joe Slater <email address hidden>

commit e31e0dda7a4c09143d41cd518ab97ea6112d7fb5
Author: Li Zhou <email address hidden>
Date: Tue Apr 13 04:53:50 2021 -0400

systemd: Upgrade to version 219-78.el7_9.3

Refer the lst entries to the new version.

    Partial-Bug: #1924691
    Signed-off-by: Li Zhou <email address hidden>
    Change-Id: I557eff6a47f341cc67de02fd59024b28bb6cac84

commit 26db2859dd3a5c060c337b886fd16c4d2d9f93af
Author: Scott Little <email address hidden>
Date: Mon Apr 12 11:21:31 2021 -0400

Replace basearch references in y...

Reviewed:  https://review.opendev.org/c/starlingx/tools/+/793627
Committed: https://opendev.org/starlingx/tools/commit/d701c6f896dfe440566cc942e3dd71be1f19ae5d
Submitter: "Zuul (22348)"
Branch:    f/centos8

commit 7b5f3a45e663866a3c0ca3ca86eb3c92bc7f0210
Author: Scott Little <scott.little@windriver.com>
Date:   Wed May 5 09:56:33 2021 -0400

fix bad flockflock url pt 2
    
    A stray '}' character found it's way into my prior update
    titled 'fix bad flockflock url' after testing. The result was
    the following error
    
    sed: -e expression #1, char 15: unexpected `}'
    
    This removes the unwanted '}', restoring the prior update
    to its intended form.
    
    Closes-bug: 1926987
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I48f4721ccaf121679916b01747243deedf5836cd

commit ac05493480f6df6f31d071d29380c1b4f35b70a9
Author: Scott Little <scott.little@windriver.com>
Date:   Tue May 4 12:42:36 2021 -0400

fix git-review within docker build environment
    
    'tb create' fails to create a build environment since
    upstream git-review was updated of Apr 26.
    
    Fix is to install/update pbr ahead of git-review.
    
    Also, to reduce the likelyhood of this recurring, lock
    down specific versions of the pypi supplied tools we
    know to work.
    
    Closes-bug: 1927137
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: Ib9fe6fd33de4d637f254ac421cc0427ee6131b65

commit b96ebc83d859a4a7802a462504817ecec6182a7b
Author: Scott Little <scott.little@windriver.com>
Date:   Mon May 3 13:16:53 2021 -0400

fix bad flockflock url
    
    download_mirror.sh fails due to a bad path containing
    ‘stx-tools/centos-mirror-tools/config/centos/flockflock’
    
    The path is constructed, and the trigger is when an EOL is missing
    from a centos_build_layer.cfg file, causing 'cat' to merge the last
    line of the offending file with the first line of the next file.
    
    Switch 'cat' to 'grep', which will always ensure an EOL is present.
    Along the way, we can filter out empty lines and comments.
    
    Closes-bug: 1926987
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I2404b3415f0f3e2f395c2bcb7a527aa01a488f61

commit 4c3ee114bcbff710c2049626044dd1ddc756cbd9
Author: Joe Slater <joe.slater@windriver.com>
Date:   Tue Apr 27 18:50:53 2021 -0400

screen: fix CVE-2021-26937 segfault
    
    Advance to screen-4.1.0-0.27.20120314git3c2946.el7_9.x86_64.rpm.
    
    Closes-bug: 1926372
    Change-Id: I41834e7b1e16153b0632751f59f7ac9f503389da
    Signed-off-by: Joe Slater <joe.slater@windriver.com>

commit e31e0dda7a4c09143d41cd518ab97ea6112d7fb5
Author: Li Zhou <li.zhou@windriver.com>
Date:   Tue Apr 13 04:53:50 2021 -0400

systemd: Upgrade to version 219-78.el7_9.3
    
    Refer the lst entries to the new version.
    
    Partial-Bug: #1924691
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I557eff6a47f341cc67de02fd59024b28bb6cac84

commit 26db2859dd3a5c060c337b886fd16c4d2d9f93af
Author: Scott Little <scott.little@windriver.com>
Date:   Mon Apr 12 11:21:31 2021 -0400

Replace basearch references in yum repos
    
    Some of our yum repos are using $basearch, rather than explicitly
    nameing x86_64, the only supported arch for StarlingX.  This means
    yum downloads may fail if the download host not x86_64, or if
    $basearch is left undefined.
    
    This update replaces '$basearch' with 'x86_64' within the openstack
    repo definitions, making it consistent with all other repo definitions.
    
    Closes-Bug: 1923458
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I071c674bf79d7a98f0cf2493b88fe54d2b9d6efa

commit 8d236c574317426c4180ac375faa3a709f2f2cc4
Author: Carmen Rata <carmen.rata@windriver.com>
Date:   Mon Apr 5 13:03:25 2021 -0400

Update openscap rpms version in StarlingX build
    
    In order to be up-to-date with openscap tools used to scan
    for security violations we need to update the openscap rpms
    from:
    openscap-scanner-1.2.17-2.el7.x86_64
    openscap-1.2.17-2.el7.x86_64
    to:
    openscap-1.2.17-13.el7_9.x86_64.rpm
    openscap-scanner-1.2.17-13.el7_9.x86_64.rpm
    
    Story: 2008668
    Task: 41956
    
    Signed-off-by: Carmen Rata <carmen.rata@windriver.com>
    Change-Id: I043904a6a8a6e77ed6204e0015e33876ddf7a77a

commit 9507d97d2a15eed3602454bea0c8da3e94e3df85
Author: Scott Little <scott.little@windriver.com>
Date:   Wed Mar 10 09:58:54 2021 -0500

Parallel downloads
    
    Download_mirror.sh takes 15 hours to download all the rpms and
    tarballs required to build StarlingX into a fresh workspace.
    It should be much faster than that.
    
    Replace the current serial download algorithm with one that is
    parallel.  I'll cap it at 8 parallel downloads for now.  I'm
    a little worried about overwelming CENGN.  This is sufficient
    to drop download times from 15 to 3 hours for a fresh workspace,
    and 30 min to 5 min to refresh an existing workspace.
    
    Closes-Bug: 1918477
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I469b4fee3cb304fe2984aa697ce2dc6cec52e79e

commit eeef5c451d72b1ac557e1e149d4732d1bc040785
Author: Scott Little <scott.little@windriver.com>
Date:   Thu Mar 18 10:03:21 2021 -0400

Disable linuxsoft.cern.ch repos that are no longer responding
    
    failure: repodata/repomd.xml from
    Starlingx-linuxsoft.cern.ch_cern_centos_7.5_rt_Sources: [Errno 256] No
    more mirrors to try.
    http://linuxsoft.cern.ch/cern/centos/7.5/rt/Sources/repodata/repomd.xml:
    [Errno 14] curl#7 - "Failed to connect to 2001:1458:d00:1a::391: Network
    is unreachable"
    
    Closes-Bug: 1920024
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: Ia741b02fa10522309a30548b9879a471639db033

commit f1010717c7d09a4e55fceeface747f49fcb4f446
Author: Scott Little <scott.little@windriver.com>
Date:   Fri Mar 5 10:32:37 2021 -0500

fix for tb.sh dies on rmdir /var/lib/mock
    
    tb.sh create might fail to create the builder docker image.
    Yum install of the mock package failed, but yum did not report
    the failure because other packages in the instalation set succeeded.
    A subsequent command in the dockerfile fails when it tries to
    remove/relocate /var/lib/mock, but failes because it is not present.
    
    The yum error reporting was corrected in a recent update.
    But this does not address cached copies of old and broken
    yum install steps that pre-date the fix.
    
    The mock package is paricularly sensitive as it has cengn as
    the only source, where as other packages have multiple sources.
    
    One option is to force docker to not use the cache at all, which
    is slow.
    
    The second option is to change the docker file, placing the
    yum command to install mock under a seperate docker RUN command.
    The altered build instructions ensure that the docker cache
    with the broken install can't be used.  While we are at it,
    move the user/project customization steps as far down as possible
    to improve cache usage.
    
    This change implements both.
    
    Closes-Bug: 1917901
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I28041bb44af53384c00a750b7162c6c6808c4e2d

commit ec5110928c5013177dc593d1df293a01ac033a0f
Author: Joe Slater <joe.slater@windriver.com>
Date:   Tue Mar 9 13:08:35 2021 -0500

perl: fix CVE-2020-10878 - integer overflow
    
    Update to
    
    perl-5.16.3-299.el7_9.x86_64.rpm
    perl-devel-5.16.3-299.el7_9.x86_64.rpm
    perl-libs-5.16.3-299.el7_9.x86_64.rpm
    perl-macros-5.16.3-299.el7_9.x86_64.rpm
    perl-ExtUtils-Embed-1.30-299.el7_9.noarch.rpm
    perl-ExtUtils-Install-1.58-299.el7_9.noarch.rpm
    perl-Pod-Escapes-1.04-299.el7_9.noarch.rpm
    
    Closes-Bug: 1918154
    Change-Id: I28bb5dd732209153080c93b3098397338d8552c3
    Signed-off-by: Joe Slater <joe.slater@windriver.com>

commit d968dcaec856a9dc9f8a65b1874ddeb78aad017d
Author: Scott Little <scott.little@windriver.com>
Date:   Fri Mar 5 09:20:36 2021 -0500

Add missing centos 7.9 rt source repo
    
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I81b9127900a45be8bc4b47e2aca5cb1aa02c3d20

commit 965746b9d4224b6a34c7a0ac3d026393abb57c4b
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Sun Jan 24 20:55:34 2021 -0500

bind: fix five CVE issues
    
    Upgrade to the below packages to fix the CVE issues:
     bind-libs-lite-9.11.4-26.P2.el7.x86_64.rpm
     bind-license-9.11.4-26.P2.el7.noarch.rpm
     bind-lite-devel-9.11.4-26.P2.el7.x86_64.rpm
     bind-utils-9.11.4-26.P2.el7.x86_64.rpm
     bind-libs-9.11.4-26.P2.el7.x86_64.rpm
     bind-export-libs-9.11.4-26.P2.el7.x86_64.rpm
     bind-export-devel-9.11.4-26.P2.el7.x86_64.rpm
    
    Meanwhile this patch need to be merged with the upgraded dhcp togother.
    
    CVE: CVE-2018-5741 CVE-2018-5742 CVE-2018-5743 CVE-2019-6477
         CVE-2020-8617
    
    Story: 2008532
    Task: 41642
    Change-Id: If3bbac8f7d992f6a1f8e2f4df88b563d58feeffc
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 5279d637150f8f8a1a8b4b64dc268f6549290b3f
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 03:28:14 2021 -0500

glibc: fix CVE-2016-10739
    
    Upgrade the below packages to:
     glibc-2.17-317.el7.x86_64.rpm
     glibc-devel-2.17-317.el7.x86_64.rpm
     glibc-static-2.17-317.el7.x86_64.rpm
     glibc-common-2.17-317.el7.x86_64.rpm
     glibc-headers-2.17-317.el7.x86_64.rpm
     nscd-2.17-317.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41663
    Change-Id: Ia589fdb5ae0208053b12eafd23ef8183664b92be
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 9c01064e16700bb253c1f1607bfb7c75b2571745
Author: Li Zhou <li.zhou@windriver.com>
Date:   Tue Jan 26 07:46:07 2021 +0000

openssh: fix CVE-2018-15473 from repo list
    
    Update below packages to:
    openssh-7.4p1-21.el7.x86_64.rpm
    openssh-clients-7.4p1-21.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41668
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I6876364bd86e520ccf49d3de2ef342b162247d8f

commit 4665c2250dbb1691105a00482ed841f0237bbf94
Author: Li Zhou <li.zhou@windriver.com>
Date:   Tue Jan 26 19:35:23 2021 -0800

python: fix CVE-2019-9636 CVE-2019-10160 CVE-2019-9948 CVE-2019-16056 in rpm list
    
    Python is upgraded to version 2.7.5-89 in srpm build to fix above CVEs.
    Update below packages for the updated depencies of python upgrading:
    python2-rpm-macros-3-34.el7.noarch.rpm
    python-rpm-macros-3-34.el7.noarch.rpm
    python-srpm-macros-3-34.el7.noarch.rpm
    
    Update below packages to below versions too in rpm list:
    python-2.7.5-89.el7.x86_64.rpm
    python-devel-2.7.5-89.el7.x86_64.rpm
    python-libs-2.7.5-89.el7.x86_64.rpm
    
    This commit need work together with the commit
    <python: fix CVE-2019-9636 CVE-2019-10160 CVE-2019-9948 CVE-2019-16056
    in srpm build> for repository starlingx/compile.
    
    Story: 2008532
    Task: 41665
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I280cbc0408b41008ec2e07f2453d20fd6226c54a

commit d427e90a1c33fb3355c08614d3661b4519f35654
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Wed Feb 10 21:27:17 2021 -0500

Revert "Add the bind-export packages for dhcp CVE issue"
    
    This reverts commit 97c63675dab3957bcaff3718e8606ee13096f93e.
    
    Since we revert the dhcp new version in integ layer, so we also
    revert this dependence.
    
    Closes-Bug: #1915050
    Depends-On: https://review.opendev.org/c/starlingx/integ/+/775056
    
    Change-Id: Id7e9a42703cf1c14e04bbf1c1db931f4f05d7840
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 8be170ef575984b45d8822a89c0d645b6b4ec267
Author: Sanjay K Mukherjee <sanjay.k.mukherjee@intel.com>
Date:   Thu Jun 18 17:20:15 2020 -0400

cve_policy_filter.py supports CVSSV2 and CVSSV3 vulnerability report generation
    
    Added new files for CVSSv3 scan report generation
    
      Added new files:
           new file:   cve_policy_filter.py
           new file:   template_v3.txt
    
    Change-Id: I93978825f973435eb34a0c8e6b3d18e1ac580595
    Signed-off-by: Sanjay K Mukherjee <sanjay.k.mukherjee@intel.com>

commit ebc9f32d7de526b44234a56423dd6785243cc386
Author: Joe Slater <joe.slater@windriver.com>
Date:   Fri Feb 5 11:37:56 2021 -0500

nss: fix CVE-2019-17006 - crypto primitives missing length checks
    
    Update versions of nss, nss-utils, nss-tools, nss-sysinit,
    nss-softokn, nss-softokn-freebl, and nspr.
    
    All packages except the devel versions are on the default iso.
    
    The structure of all lst files was preserved.
    
    Closes-Bug: 1906471
    Change-Id: I98f1cf059cb1f91c1836f0f62807ba345668450f
    Signed-off-by: Joe Slater <joe.slater@windriver.com>

commit 6f4738643d710e0031f3f916e4bcb7bb441a5db1
Author: Joe Slater <joe.slater@windriver.com>
Date:   Tue Jan 19 17:00:57 2021 -0500

libxslt: fix CVE-2019-11068 - bypass of protection mechanism
    
    Move to
    
    libxslt-1.1.28-6.el7.x86-64.rpm
    libxslt-devel-1.1.28-6.el7.x86-64.rpm  (unused for iso build)
    libxslt-python-1.1.28-6.el7.x86-64.rpm  (unused for iso build)
    
    Closes-Bug: 1906470
    Change-Id: Iac627c89d7dfb115c869bc9b8b52b0ece38ea796
    Signed-off-by: Joe Slater <joe.slater@windriver.com>

commit 6ed078685c413b7199cd18bdde6cb8ad33fdb711
Author: Li Zhou <li.zhou@windriver.com>
Date:   Mon Jan 25 07:49:54 2021 +0000

nspr/nss/nss-softokn/nss-util: CVE-2018-12404 and CVE-2019-11745
    
    Update below packages to:
    nspr-4.25.0-2.el7_9.x86_64.rpm
    nspr-devel-4.25.0-2.el7_9.x86_64.rpm
    nss-3.53.1-3.el7_9.x86_64.rpm
    nss-devel-3.53.1-3.el7_9.x86_64.rpm
    nss-softokn-3.53.1-6.el7_9.x86_64.rpm
    nss-softokn-devel-3.53.1-6.el7_9.x86_64.rpm
    nss-softokn-freebl-3.53.1-6.el7_9.x86_64.rpm
    nss-softokn-freebl-devel-3.53.1-6.el7_9.x86_64.rpm
    nss-sysinit-3.53.1-3.el7_9.x86_64.rpm
    nss-tools-3.53.1-3.el7_9.x86_64.rpm
    nss-util-3.53.1-1.el7_9.x86_64.rpm
    nss-util-devel-3.53.1-1.el7_9.x86_64.rpm
    
    Story: 2008532
    Task: 41680
    Task: 41700
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I0c17c36418f55db9dd7c9ed6567c74d828564bff
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 511859ef18129b3ac830c9f609f0324996e7c432
Author: Davlet Panech <davlet.panech@windriver.com>
Date:   Wed Jan 27 19:06:41 2021 -0500

Dockerfile: fail in "yum install" on missing packages
    
    By default "yum install" ignores packages that can't be downloaded and
    return 0 to the shell.
    
    In a Dockerfile such falsely successful commands are cached by
    "docker build", so that the next time we run "docker build" the
    "yum install" is not even attempted:
    
      # this "succeeds" and gets cached during the first "docker build",
      # even if the URL returns an error (eg DNS error or HTTP 404).
      # During a second "docker build" this bringis back the FS layer
      # from the cache and doesn't attempt to re-download the package
      # from that URL
      RUN yum install python3 http://some/url.rpm
      ...
    
    This patch avoids the problem in case CENGN mirror is down.
    
    Change-Id: I65f2185ce8a1832f3fc1be4135b0a49653654b5b
    Closes-Bug: 1912682
    Signed-off-by: Davlet Panech <davlet.panech@windriver.com>

commit 5440eb14768cee3658c5c4d10279eb7e8ef6c0b1
Author: Li Zhou <li.zhou@windriver.com>
Date:   Mon Jan 25 07:25:13 2021 +0000

unzip: fix CVE-2018-18384 CVE-2019-13232
    
    Update below packages to:
    unzip-6.0-21.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41681
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: Iccd6a16cd573d96254d785ae9d3b44b42fd1a95d

commit 40af436ba5876569403a04534bd243ac32d11eb0
Author: Li Zhou <li.zhou@windriver.com>
Date:   Mon Jan 25 07:21:21 2021 +0000

openjpeg2: fix CVE-2020-6851 CVE-2020-8112
    
    Update below package to:
    openjpeg2-2.3.1-3.el7_7.x86_64.rpm
    
    Story: 2008532
    Task: 41678
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: Ic6a9211d72eb60e3377d036d5d796f9a4b0efd88

commit 7c08668f79e3c7003ad006bd0b0a42810cd19560
Author: Li Zhou <li.zhou@windriver.com>
Date:   Mon Jan 25 07:19:09 2021 +0000

microcode_ctl: fix CVE-2020-0549
    
    Update below package to:
    microcode_ctl-2.1-73.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41679
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I0df78aea2d38f27359b3f464b01a27637f91093f

commit 5f65806a263d58d7b031e71313b63cf8defc6619
Author: Li Zhou <li.zhou@windriver.com>
Date:   Sun Jan 24 04:06:03 2021 +0000

procps-ng: fix CVE-2018-1122
    
    Update below package to:
    procps-ng-3.3.10-28.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41667
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: Ic77255b742b691be041f9958609ed7bc227d0d49

commit 1ccf94214e3e65437b3162d88e2d0554a6987efd
Author: Li Zhou <li.zhou@windriver.com>
Date:   Sun Jan 24 04:04:38 2021 +0000

polkit: fix CVE-2018-1116
    
    Update below packages to:
    polkit-0.112-26.el7.x86_64.rpm
    polkit-devel-0.112-26.el7.x86_64.rpm
    polkit-docs-0.112-26.el7.noarch.rpm
    
    Story: 2008532
    Task: 41666
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I8b85c4fb02d951c016379594a93cda932f0f2483

commit 9509a95f6562313030922e93ead36ea48521f99d
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 03:37:39 2021 -0500

httpd: fix CVE-2018-1312 CVE-2019-0220 CVE-2018-17199
    
    Upgrade the below packages to:
     httpd-2.4.6-95.el7.centos.x86_64.rpm
     httpd-tools-2.4.6-95.el7.centos.x86_64.rpm
    
    Story: 2008532
    Task: 41661
    Change-Id: I09c5d73e384eb757d5907eda1b0df374c44acdcf
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit bd8cf5a79290db8c6efaaaba592c57b694c121a7
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 03:34:19 2021 -0500

cups: fix CVE-2018-4700
    
    Upgrade the below packages to:
     cups-client-1.6.3-51.el7.x86_64.rpm
     cups-libs-1.6.3-51.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41662
    Change-Id: I8d9f8fd7571f7e400b8ef203bcdcf76bbde274e7
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 71eb4028ee7b33ce594325a7a37a81e417c250b4
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 02:15:30 2021 -0500

ipmitool: fix CVE-2020-5208
    
    Upgrade the below package to:
     ipmitool-1.8.18-9.el7_7.x86_64.rpm
    
    Story: 2008532
    Task: 41660
    Change-Id: I4679321578500bfe1df12a036721f5338b13b2d2
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 677ab7fa3304da29d6eda2c366d4581fb9acc272
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 02:08:45 2021 -0500

libtiff: fix CVE-2018-8905
    
    Upgrade the below packages to:
     libtiff-4.0.3-35.el7.x86_64.rpm
     libtiff-devel-4.0.3-35.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41659
    Change-Id: I44776633cb8031f1d506c7216b0973c85bdae979
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 359c43c08328021e6757230e7093d80e740ede37
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 02:05:24 2021 -0500

libsndfile: CVE-2018-13139
    
    Upgrade the below packages to:
     libsndfile-1.0.25-12.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41658
    Change-Id: I7ca91731beb7afe7d7515f12392173fdb041c14a
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 9fad2088fe8f5e884d0ebf07c3e234123bbd34d8
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 02:02:03 2021 -0500

libjpeg-turbo: fix CVE-2018-14498
    
    Upgrade the below packages to:
     libjpeg-turbo-1.2.90-8.el7.x86_64.rpm
     libjpeg-turbo-devel-1.2.90-8.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41657
    Change-Id: Ic2083117eaf7f2ace4ca2c87a2e2a1e0fe8d5725
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit c9b3e4af17581571177611aaee60c13a1309fb20
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 01:59:47 2021 -0500

libcgroup: fix CVE-2018-14348
    
    Upgrade the below packages to:
     libcgroup-0.41-21.el7.x86_64.rpm
     libcgroup-tools-0.41-21.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41656
    Change-Id: I2aa7a300f269755c885e20530d8bf843f45c0837
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit f7384e32ae7549fbcae669782bd896ed68cc8c66
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 22 00:49:11 2021 -0500

dbus: fix CVE-2020-12049
    
    Upgrade the below packages to:
     dbus-1.10.24-15.el7.x86_64.rpm
     dbus-devel-1.10.24-15.el7.x86_64.rpm
     dbus-libs-1.10.24-15.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41655
    Change-Id: Idda21afb1247e0fdbcb5bbdf3cf38d7ea63a9d2a
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit b53edee359157a9efbfc1e2b295e1b0b97628115
Author: Li Zhou <li.zhou@windriver.com>
Date:   Fri Jan 22 06:21:20 2021 +0000

sqlite: fix CVE-2019-13734
    
    Update below packages to:
    sqlite-3.7.17-8.el7_7.1.x86_64.rpm provided by mock
    sqlite-devel-3.7.17-8.el7_7.1.x86_64.rpm
    
    Story: 2008532
    Task: 41640
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: Ia76daf7f82b8e9130cb6a7ca81ddb1633f14f3d9

commit 8440bb5d34bd22fd8c29f05d34e8452bc6cc0ea9
Author: Li Zhou <li.zhou@windriver.com>
Date:   Fri Jan 22 06:18:28 2021 +0000

spice: fix CVE-2019-3813
    
    Update below packages to:
    spice-server-0.14.0-9.el7.x86_64.rpm
    spice-server-devel-0.14.0-9.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41641
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: Iee263332b5886d915366b445e3bcb8044abbf24a

commit 7815964df2054b8de4ab04c47a0b15e537796f1e
Author: Li Zhou <li.zhou@windriver.com>
Date:   Fri Jan 22 03:32:18 2021 +0000

unbound: fix CVE-2020-10772 CVE-2020-12663
    
    Update below package to:
    unbound-libs-1.6.6-5.el7_8.x86_64.rpm
    
    Story: 2008532
    Task: 41622
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I51e8b2fe2e90009f1b508e2f8054c58ebe129578

commit ba7b1dea566181577e7c8d075135da7297684a47
Author: Li Zhou <li.zhou@windriver.com>
Date:   Fri Jan 22 02:37:28 2021 +0000

samba: fix CVE-2019-3880 CVE-2019-10218
    
    Update below packages to:
    samba-client-libs-4.10.16-5.el7.x86_64.rpm
    samba-common-4.10.16-5.el7.noarch.rpm
    samba-common-libs-4.10.16-5.el7.x86_64.rpm
    libwbclient-4.10.16-5.el7.x86_64.rpm
    
    Below packages are also updated for above packages' updated
    dependencies:
    libtdb-1.3.18-1.el7.x86_64.rpm
    libtevent-0.9.39-1.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41615
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: Ic4940f020e5ea063f1ca68787dbbb8e934fd5346

commit 2364efd18b8726eb95d637b4143e708abfecb968
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Thu Jan 21 05:10:12 2021 -0500

bash: fix CVE-2019-9924
    
    Upgrade to bash-4.2.46-34.el7.x86_64.rpm to fix CVE-2019-9924 issue.
    
    Story: 2008532
    Task: 41646
    Change-Id: Ie23a258aed42ce41b5c7629a5966cecff9bfb074
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 837e1dfe5590a97b6807c1811835fca5817dacd1
Author: Li Zhou <li.zhou@windriver.com>
Date:   Fri Jan 22 02:22:11 2021 +0000

vim: fix CVE-2019-12735
    
    Update below packages to:
    vim-common-7.4.629-7.el7.x86_64.rpm
    vim-enhanced-7.4.629-7.el7.x86_64.rpm
    vim-filesystem-7.4.629-7.el7.x86_64.rpm
    vim-minimal-7.4.629-7.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41621
    Change-Id: I0096997c93f94a93ca9e9c5cede094e147b5b010
    Signed-off-by: Li Zhou <li.zhou@windriver.com>

commit 6a786cda18dbeb17f1bc65e79f1e9503e79a00be
Author: Melissa Wang <melissa.wang@windriver.com>
Date:   Wed Jan 20 15:26:43 2021 -0500

Add cloud-init pack to lst file
    
    This update adds the cloud-init rpm to the lst file so that it can
    be added to the qcow2 in the automated build.
    
    Story ID: 2007858
    Task ID: 41654
    
    Change-Id: I5a081191dae5fa9b7b7c96d1223b029932bbfb55
    Signed-off-by: Melissa Wang <melissa.wang@windriver.com>

commit 97c63675dab3957bcaff3718e8606ee13096f93e
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Wed Jan 20 21:24:18 2021 -0500

Add the bind-export packages for dhcp CVE issue
    
    Add the following two packages:
      bind-export-libs-9.11.4-26.P2.el7.x86_64.rpm
      bind-export-devel-9.11.4-26.P2.el7.x86_64.rpm
    
    Since when we fix the dhcp CVE issue in integ repo by upgrade the
    dhcp rpm package version, it will depend on the bind-export package.
    
    Story: 2008532
    Task: 41638
    Change-Id: If8485b64b110914885af40b8d65d26009102bf70
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 73e3304c3c6be6bace95ca03ca5337f44c12ec61
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Tue Jan 19 21:13:44 2021 -0500

avahi: fix CVE-2017-6519
    
    Update to avahi-0.6.31-20.el7.x86_64.rpm
    
    Story: 2008532
    Task: 41620
    Change-Id: I67661e2107b4cd969569da51160c618cd5586d41
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit bdaa704f78daf10b9b343d5423ff6a697a528313
Author: Zhixiong Chi <zhixiong.chi@windriver.com>
Date:   Fri Jan 15 05:49:33 2021 -0500

file: fix CVE-2018-10360
    
    Update to the following packages to 5.11-37:
    file-5.11-37.el7.x86_64.rpm
    file-libs-5.11-37.el7.x86_64.rpm
    file-devel-5.11-37.el7.x86_64.rpm
    
    Closes-Bug: 1912156
    Change-Id: I34c1d4dc27afafd8fefb92a6e156cf75713262b0
    Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>

commit 0c23f5ac98df20115b579a25063fad1429a850c4
Author: Li Zhou <li.zhou@windriver.com>
Date:   Mon Jan 18 17:15:32 2021 +0800

tcpdump: fix CVE-2018-19519
    
    Update to tcpdump-4.9.2-4.el7_7.1.x86_64.rpm.
    
    Closes-Bug: 1912139
    
    Signed-off-by: Li Zhou <li.zhou@windriver.com>
    Change-Id: I53b80f4daebe98dacbb288ee5828fd7b901d0aed

commit 3fdacd356ec55403face16b8c02786e1496d3a7d
Author: Chen, Haochuan Z <haochuan.z.chen@intel.com>
Date:   Fri Jan 8 10:03:05 2021 +0800

Add rpm for ceph performance tuning tool, fio and dstat
    
    Story: 2008497
    Task: 41555
    
    Change-Id: I6e0f9b61b6c6815b255f3d02bfc06c623c56532f
    Signed-off-by: Chen, Haochuan Z <haochuan.z.chen@intel.com>

commit 1d175ac9c9cfcdfebeadb9db532cd73a78342cd7
Author: Don Penney <don.penney@windriver.com>
Date:   Mon Jan 4 13:22:26 2021 -0500

Add python3 RPMs to compile layer
    
    The 'compile' layer build is failing due to missing python3 packages.
    These packages had been added to the distro and flock LST files
    previously, but not the compile layer.
    
    Closes-Bug: 1910130
    Signed-off-by: Don Penney <don.penney@windriver.com>
    Change-Id: I44d1225b5a6c9e8ddbbfa91f0980d7b1b21d425b

commit be49af95252f7fb5eb58232dcf80e8a3510e0bf2
Author: Scott Little <scott.little@windriver.com>
Date:   Thu Dec 17 16:14:49 2020 -0500

Add layer awareness to mirror-check.sh
    
    This tool was missed when layered builds were introduced.
    It looks for lst files under the wrong path. I've added
    a layer arguement and fixed the path.
    
    It also needs to ignore commented lines within lst files.
    
    I also add dnf support.  Cloned from pkg-manager-utils.sh
    since stx-tools is sometimes expected to stand on it's own.
    
    One gap that I'm not addressing in this update.  It only
    looks at the upstream repo, never at the cengn mirror.
    If a package has been dropped by upstream, it reports as
    missing.
    
    Closes-Bug: 1908751
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: Idf4c9010c195f2fe8f7d0432c41c94fab00aec2c

commit 1fd6f3f636ec7b0780815120f10e1beb545bc07f
Author: Scott Little <scott.little@windriver.com>
Date:   Tue Dec 15 14:17:34 2020 -0500

tidy stx/downloads directory
    
    $MY_REPO/stx/downloads contains links to tarballs and other files
    relevant to the build.  It is populated by populate_downloads.sh.
    On subsequent runs, new links might be added, but old links are
    not cleaned up.
    
    Adopt the convention used by generate-centos-repo.sh of moving
    the old content under a timestamp backup directory, leaving
    an empty directory to re-populate.
    
    Closes-bug: 1908297
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: Ib6c8b782db6c369cb00e8fe8c64be099d7a5d238

commit 1f3f3e08bc8fa33cf34541f408df4975c787367b
Author: Davlet Panech <davlet.panech@windriver.com>
Date:   Mon Dec 14 10:01:45 2020 -0500

Update CentOS vault URL to HTTPS
    
    CentOS vault HTTP url redirects to HTTPS, but yum displays misleading
    error messages when the secondary HTTPS request fails.
    Use HTTPS directly.
    
    Change-Id: I687c1de2378de11abb5ad981bc73b66d8c40ba2a
    Closes-Bug: 1908088
    Signed-off-by: Davlet Panech <davlet.panech@windriver.com>

commit c7f398e9ea89da5e016e8a17a284ce181f0b98e4
Author: Joe Slater <joe.slater@windriver.com>
Date:   Wed Nov 11 10:33:55 2020 -0500

curl: fix CVE-2019-5482 - heap overflow in tftp
    
    curl-7.29.0-59.el7
    libcurl-7.29.0-59.el7
    libcurl-devel-7.29.0-59.el7
    
    depends on
    
    libssh2-1.8.0-4.el7
    libssh2-devel-1.8.0-4.el7
    
    Closes-Bug: 190214
    Change-Id: I2755068e55dc8c70452894030404df3d936fa6a5
    Signed-off-by: Joe Slater <joe.slater@windriver.com>

commit bbf8b0402a5b428105ac6c476dbd2b15c1a48ff8
Author: Scott Little <scott.little@windriver.com>
Date:   Fri Dec 4 16:08:25 2020 -0500

tb.sh: container stuck in - Removal In Progress
    
    Systemd is once preventing a clean exit of the build
    container.
    
    Mapping /run and /tmp to tmpfs helps on some systems.
    
    Partial-bug: 1907119
    Change-Id: I3fc54792d18b632fbd5cab678ce4fa348bc96873
    Signed-off-by: Scott Little <scott.little@windriver.com>

commit 451b9513e4d224d47e3d4d2d543e1bc834b78794
Author: Scott Little <scott.little@windriver.com>
Date:   Wed Dec 2 12:08:27 2020 -0500

Fix selection of release specific mock prototype
    
    Commit https://review.opendev.org/c/starlingx/root/+/762700
    was intended to include the code to select the release specific
    mock config prototype.
    
        e.g. mock.cfg.centos7.proto
    
    As delivered, it would always select the default.
    
        e.g. mock.cfg.proto
    
    Other improvements:
    - remove some trailing whitespace
    - improved cleanup of temorary directories
    
    Closes-Bug: 1906547
    Signed-off-by: Scott Little <scott.little@windriver.com>
    Change-Id: I3e988fb0e861efcf9cd16b8a46b74398dbb1db17

tags:

added: in-f-centos8

StarlingX

Download_mirror.sh fails on 'flockflock'

Bug Description

CVE References

Other bug subscribers

Remote bug watches