Re-review F45 Change: RelocateRpmRepoConfigsToUsr #3676
Labels
No labels
document it
fast track
meeting
next release
nonresponsive maintainer
packager revocation
pending announcement
provenpackager
python 2 exception
self contained change
stalled
Status
Accepted
Status
Duplicate
Status
Insufficient data
Status
Invalid
Status
Rejected
system wide change
updates policy exception
vote-in-progress
No milestone
No project
No assignees
7 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
fesco/tickets#3676
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
(in the spirit of avoiding ticket necromancy, I've made a new ticket and put it on next week's agenda)
Originally posted by @adamwill in #3606 (comment)
Did anyone ever check everything that depends on python3-dnf - i.e. the DNF 4 Python bindings - to see how they would be affected by this?
There are several important things in there: fedora-easy-karma, fedora-review, fedrq, kiwi, osbuild, pungi, mock...any of those that rely on the system repository definitions is now likely broken. I'm quite worried this change was not sufficiently reviewed.
Additional details about some packages in the above list:
@system. This should be unaffected.dnfbut still defaults to usinglibdnf5.dnf4CLI plugins. As far as I understand, it's already known that this Change means thednf4CLI (and the old dnf Python API) won't be able to read system repositories anymore, but dnf4 is considered deprecated in favor of dnf5. It would be really nice to have a compat mechanism here while we still have python3-dnf around.fedora-review. I thought there were efforts to fully port it to dnf5, but I'm not sure if those were completed. I recall there was some shelling out to /usr/bin/dnf-3.read_all_repos()anywhere, so that shouldn't be affected either.It looks like there are some outdated comments about needing dnf-3, but it is not actually used anymore.
fedora-reviewdoes not read system repositories. It uses mock and reads installed packages.Note this change is currently live in newly-branched F45 and Rawhide, because @ngompa landed it earlier today and then builds that included it were pushed through as part of branching (test failures on the F45 update were incorrectly waived, F46 update was not gated because the F46 release was created wrong in Bodhi and so it had no critical path definition for a while).
Not only dnf4 is affected; ELN post-branching compose failed due to this change too: https://koji.fedoraproject.org/koji/taskinfo?taskID=148984307
Both lorax-templates-generic and lorax-templates-rhel would be affected.
Container image composes are failing due to
# https://bugzilla.redhat.com/show_bug.cgi?id=1400682echo "Import RPM GPG key"releasever=$(rpm --eval '%{?fedora}')# When building ELN containers, we don't have the %{fedora} macroif [ -z $releasever ]; thenreleasever=elnfirpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-primary(keys are no longer in /etc/pki/rpm-gpg).
I've fixed the kiwi-descriptions thing in rawhide and f45 branches.
AFAIK we default to dnf5 on Fedora (but can conditionally switch to the dnf4 API) so we 'should be OK' in Fedora-land at least that was my assumption when I read the change. I'll go over if anything broke.
We have a lot of tests related to these paths but it seems most of those are related to reading RHSM secrets which should still be written to
/etcby subman and we use these paths to write custom repositories for users but that's still correct.we have also found this bit in lorax which is now broken; installer images now have an empty
/etc/anaconda.repos.dand the fedora repo definitions are in/usr/share/dnf5/repos.d. corresponding anaconda bit is here:that's used as the
reposdirfor the installer's DNF 5 base object config, here.There's also another bit of anaconda that hardcodes /etc/yum.repos.d as the location to write repo config files on the installed system, whenever the installer does that for any reason (I don't know offhand when it does this exactly, haven't followed out all the codepaths yet). I suppose that might actually be OK if that location is still read from, just not used as the location for our own configs any more?
On the whole, this probably needed to be landed and the kinks worked out sooner. Or at least not while we're trying to branch. We might have to revert it. If we do we should also revert the kiwi-descriptions change.
Can we fix Lorax and Anaconda instead? In Ananconda, the list can be trivially extended with the new location. In Lorax, the strange logic might need more work, but since it's been identified, the fix shouldn't be that hard. Maybe just make it conditional on the existence of the new path?
Non-packaged repo config files must stay in
/etc/yum.repos.d. Anaconda should not change where it writes new repo files. If repos are being copied then it just needs another lookup directory.well the thing is it's not clear what repo files it's writing. The ones it writes might be considered "pre-packaged" in some sense as they're written by the installer, it really depends on the details I think.
At least some paths seem to be that it will write through repos from kickstarts(?) and interactive installation source configuration(?), which I guess probably make more sense in
/etc. But I don't know if there are other paths.@zbyszek sure, we can, but this is substantially complicating things during gating, because we're trying to fix this in-flight in order to really complete the gating process and have working composes of branched-45 and rawhide-46. It would have been a lot less messy to do these two things separately. There's the risk that we fix lorax and anaconda and find more stuff after that, and this just keeps dragging out. But for now we will try that.
@adamwill wrote in #3676 (comment):
At least in that example, it's writing fresh repo config files into
/etc, which is perfectly fine. The tricky thing is if it's modifying repo files in place, that would have to move to override.d files in/etcto set overrides from base configuration.Okay, here's where we are now:
/usr/bin/dnf-3and/usr/bin/dnf4still can't read system repositories anymore. I believe the issues with dnf4 compatibility were already on the table when this Change was originally discussed, so I don't think it makes sense to relitigate them unless something else significant is known to be broken since it still relies on the dnf4 CLI.base.read_all_repos()to read system repositories will no longer work. I did not identify any API user in the list @adamwill provided that does this. Nothing in releng scripts either. There could of course be other usages we don't know about.Am I missing anything? It was nonideal that this happened right before/during branching, but it seems like we're in an okay shape to keep this in F45?
I guess I'll also note that all of the yum compatibility commands in dnf-utils are potentially affected by this.
Is it likely that users are still relying on those or were they automatically Obsoleted when dnf5 became the default?
They were supposed to be obsoleted, if not, that needs fixing.
I still have dnf-utils installed on my system that's been running since before dnf5 was made default, but I don't remember if I took special action to keep it around. dnf-utils is still in rawhide right now.
It looks like this change has played a lot of havoc with (rpm-)ostree. Both overlay and rebase tests are currently failing in ways that suggest this change is the cause. CC @walters . Filed https://github.com/coreos/rpm-ostree/issues/5623
That makes sense given that rpm-ostree bundles libdnf.
This was discussed in today's meeting (meeting log).
I've reached out to @jmarrero (
rpm-ostree's upstream maintainer) and they've said they'll be looking into this.jmarrero has proposed a fix now. I'm currently testing it.
rpm-ostree fixes are looking good, but now I found a bunch of hardcoded references to the old locations in two coreos projects:
CC @dustymabe .
I'll note that at this point, this claim in the Change under "Scope":
"Other developers: N/A (not needed for this Change)"
has obviously proved to not be correct.
I'll try to look at the two coreos issues you opened tomorrow.
Thank you @adamwill
https://github.com/coreos/fedora-coreos-config/pull/4318 was merged 12 h ago.
https://github.com/coreos/fedora-coreos-tracker/issues/2172 is still open.
I think things are progressing, but not 100% done yet. @dustymabe could you give a short summary here?
We're still working through some issues related to the change, but I haven't encountered anything yet that we haven't been able to workaround.
I'm actively trying to get new rawhide and f45 based CoreOS and bootc images produced.
quay.io/bootc-devel/fedora-bootc-45-standard:latestexists now andquay.io/bootc-devel/fedora-bootc-rawhide-standardis F46.I'm working through getting CoreOS (downstream of the bootc images mentioned above) updated today.
We discussed this during the meeting today. The conclusion is that it looks good and the ticket can be closed.