Commit Graph

213 Commits

Author SHA1 Message Date
Scott Little d51f8050cd Build layering, script and lst update
Script changes to download content by layer.
Valid options are 'all', 'compiler', 'distro', 'flock'.

Current .lst and yum files under directory centos-mirror-tools
are relocated.  Generic package dependencies are relocated to
centos-mirror-tools/config/<os>/<layer>/ .

Lst entries for compilable content have been relocated to other
git repos by prior updates.  i.e.  those that list tarballs or
srpms to be compiled within that repo.

The original .lst files are deleted to make it easier
to identify new content during development.

Layer 'all' builds all layers in a single workspace.  The
lst files are identical to current content, minus the src.rpm and
tarball entries.

Other layers get only a subset of packages download. The minimum
required to build the layer.  The 'flock' layer will have additional
content to satisfy the run time requirements as well as the build
time requirements.

An upper layer does not need to list rpms known to be provided by
a lower layer.  Instead the config file 'required_layer_pkgs.cfg'
lists urls for lst files for lower layer build outputs.
These build outputs are generated and published by cengn for
each layer.

A second layer config file, 'required_layer_iso_inc.cfg' lists
image.inc files for lower layer builds.  These build outputs are
generated and published by cengn for each layer, summarizing
the image.inc files found in individual git repos.

Image.inc files inform the build-iso process, listing rpms that
that provide services and commands that need to be included in
the iso.  The transitive list of required rpms need not be listed.

Finally the layer config should include a yum.repos.d
directory in which supplementary yum repos are defined to
pick up cengn built content from lower layers.

To allow a designer to do cross-layer building using local sources
rather than those provided by CENGN, there are several options.

The designer can modify the urls for lower layer build outputs,
as found in the .cfg and .repo files within the config directory
'stx-tools/centos-mirror-tools/config/<distro>/<layer-to-build>'
directly within the git.  Substitute urls can use the file:///
syntax.  Just be sure to remove these changes before submitting.

Alternatively new args have been added to download_mirror.sh,
generate-cgcs-centos-repo.sh and commands that override the
normal config.

The easiest to use is a command argurement that substitutes a new
config directory, replacing stx-tools/centos-mirror-tools/config.
The intent is for the designer to do a recursive copy of that
directory into a side location. make his changes there, outside of
git, and provide the path to that directory as an extra arguement
to download_mirror.sh and generate-cgcs-centos-repo.sh.

e.g. For simplicity I'll only list the 'extra' arguements

download_mirror.sh -C <my-config-dir> \
                   -l <layer> \
                   ...

generate-cgcs-centos-repo.sh --config-dir=<my-config-dir> \
                             --layer=<layer> \
                             ...

populate_downloads.sh --config-dir=<my-config-dir> \
                      --layer=<layer> \
                      ...

These arguements can also be suplied via the environment.
For the purpose of containerized builds, these arguements
should be defined in your localrc.

e.g.
export STX_CONFIG_DIR=<my-config-dir>
export LAYER=<layer>

The final alternative is to override things at a more granular level,
replacing a single lst file of image.inc file.  Here you can replace
a single line found in a required_layer_pkgs.cfg or
required_layer_iso_inc.cfg file.

e.g. We are doing a flock build and want to modify the content picked up
from the distro layer's rt build, and that content delivers a service
we want in the iso.  For simplicity I'll only list the 'extra' arguments

./download_mirror.sh -l flock \
    -L distro,rt,file:///<my-distro-workspace>/rt/rpmbuild/RPMS/rpm.lst \
    -I distro,std,file:///<my-distro-workspace>/rt/image.inc \
    ...

generate-cgcs-centos-repo.sh --layer=flock \
    --layer-pkg-url=distro,rt,file:///<my-distro-workspace>/rt/rpmbuild/RPMS/rpm.lst \
    --layer-inc-url=distro,std,file:////<my-distro-workspace>/rt/image.inc \
    ...

NOTE: The triplet syntax for a package list url is
    <lower-layer>,<build-type>,<url-to-rpm.lst>

    lower-layer: 'compiler', 'distro'
    build-type: 'std', 'rt', 'installer'

    Also if 'file:///' syntax is used, a matching change is made to
    the yum *.repo file.  This assumes that the rpm.lst is co-resident with
    repodata directory, as is the norm for our build outputs.

NOTE: The triplet syntax for a image inc url is
    <lower-layer>,<include-type>,<url-to-image.inc>

    lower-layer: 'compiler', 'distro'
    build-type: 'std', 'dev'

A typical user is likely only working in the flock layer on the master
branch.  He should be content to use the compiler and distro layer
outputs from cengn.

His workflow looks like ...

1, sync code for flock layer
$ repo init -u https://opendev.org/starlingx/manifest.git -b master -m flock.xml
$ repo sync

2, download rpms for flock layer, and populate a local mirror
$ LOCAL_MIRROR=/import/mirrors/starlingx
$ cd stx-tools/centos-mirror-tools
$ ./download_mirror.sh -n -g -c yum.conf.sample -S -l flock
$ cp -r output/stx-r1/CentOS/pike/* $LOCAL_MIRROR/

3, Prepare a virtual repo and downloads directory for building
$ cd ../toCOPY
$ ./generate-cgcs-centos-repo.sh --layer=flock $LOCAL_MIRROR
$ ./populate_downloads.sh --layer=flock $LOCAL_MIRROR

4, rpm package and iso building
$ build-pkgs && build-iso && build-helm-charts.sh

Building all layers in a single workspace is still supported, and
looks identical to the previous workflow.

1, sync code
$ repo init -u https://opendev.org/starlingx/manifest.git -b master
$ repo sync

2, download rpms for flock layer, and populate a local mirror
$ LOCAL_MIRROR=/import/mirrors/starlingx
$ cd stx-tools/centos-mirror-tools
$ ./download_mirror.sh -n -g -c yum.conf.sample -S
$ cp -r output/stx-r1/CentOS/pike/* $LOCAL_MIRROR/

3, create repo named "StxCentos7Distro" for building
$ cd ../toCOPY
$ generate-cgcs-centos-repo.sh $LOCAL_MIRROR
$ populate_downloads.sh $LOCAL_MIRROR

4, rpm package and iso building
$ build-pkgs && build-iso && build-helm-charts.sh

Only a cross-layer developer should setup two or three copies of the
building environment, one per layer.  We suggest you use seperate shells
for each layer, as the various paths (MY_REPO, MY_WORKSPACE ...) need to
be unique,

Shell 1, compiler layer
$ LOCAL_MIRROR=/import/mirrors/starlingx
$ LOCAL_CONFIG=<some-dir>/config
$ MY_REPO_ROOT_DIR=<some-dir>/layer-compiler
$ MY_REPO=$MY_REPO_ROOT_DIR/cgcs-root
$ MY_WORKSPACE=$MY_REPO_ROOT_DIR/workspace
  ...

$ mkdir -p $MY_REPO_ROOT_DIR
$ cd $MY_REPO_ROOT_DIR
$ repo init -u https://opendev.org/starlingx/manifest.git -b master -m compiler.xml
$ cd stx-tools/centos-mirror-tools
$ cp -r config/* $LOCAL_CONFIG
 ... edit urls in *.cfg and *.repo files under $LOCAL_CONFIG ...

$ ./download_mirror.sh -n -g -c yum.conf.sample -S -C $LOCAL_CONFIG -l compiler
$ cp -r output/stx-r1/CentOS/pike/* $LOCAL_MIRROR/
$ cd ../toCOPY
$ ./generate-cgcs-centos-repo.sh --config-dir=$LOCAL_CONFIG --layer=compiler $LOCAL_MIRROR
$ ./populate_downloads.sh --config-dir=$LOCAL_CONFIG --layer=flock $LOCAL_MIRROR
$ build-pkgs

Shell 2, distro layer
$ LOCAL_MIRROR=/import/mirrors/starlingx
$ LOCAL_CONFIG=<some-dir>/config
$ MY_REPO_ROOT_DIR=<some-dir>/layer-distro
$ MY_REPO=$MY_REPO_ROOT_DIR/cgcs-root
$ MY_WORKSPACE=$MY_REPO_ROOT_DIR/workspace
  ...
$ mkdir -p $MY_REPO_ROOT_DIR
$ cd $MY_REPO_ROOT_DIR
$ repo init -u https://opendev.org/starlingx/manifest.git -b master -m distro.xml
$ repo sync
$ cd stx-tools/centos-mirror-tools
$ ./download_mirror.sh -n -g -c yum.conf.sample -S -C $LOCAL_CONFIG -l distro
$ cp -r output/stx-r1/CentOS/pike/* $LOCAL_MIRROR/
$ cd ../toCOPY
$ ./generate-cgcs-centos-repo.sh --config-dir=$LOCAL_CONFIG --layer=distro $LOCAL_MIRROR
$ ./populate_downloads.sh --config-dir=$LOCAL_CONFIG --layer=flock $LOCAL_MIRROR
$ build-pkgs

Shell 3, flock layer
$ LOCAL_MIRROR=/import/mirrors/starlingx
$ LOCAL_CONFIG=<some-dir>/config
$ MY_REPO_ROOT_DIR=<some-dir>/layer-flock
$ MY_REPO=$MY_REPO_ROOT_DIR/cgcs-root
$ MY_WORKSPACE=$MY_REPO_ROOT_DIR/workspace
  ...
$ mkdir -p $MY_REPO_ROOT_DIR
$ cd $MY_REPO_ROOT_DIR
$ repo init -u https://opendev.org/starlingx/manifest.git -b master -m flock.xml
$ repo sync
$ cd stx-tools/centos-mirror-tools
$ ./download_mirror.sh -n -g -c yum.conf.sample -S -C $LOCAL_CONFIG -l flock
$ cp -r output/stx-r1/CentOS/pike/* $LOCAL_MIRROR/
$ cd ../toCOPY
$ ./generate-cgcs-centos-repo.sh --config-dir=$LOCAL_CONFIG --layer=flock $LOCAL_MIRROR
$ ./populate_downloads.sh --config-dir=$LOCAL_CONFIG --layer=flock $LOCAL_MIRROR
$ build-pkgs && build-iso && build-helm-charts.sh

Story: 2006166
Task: 37103

Depends-On: https://review.opendev.org/698756
Depends-On: https://review.opendev.org/700819
Depends-On: https://review.opendev.org/700821
Change-Id: I088020b81f08656e50aa29b5584bbc1dd1378f12
Signed-off-by: Scott Little <scott.little@windriver.com>
2020-02-10 10:45:40 -05:00
David Sullivan 86490a651d PTP Configuration Enhancements
Upversion linuxptp to support newer features/standards

Change-Id: I935b35fb9200c9feee2fd858222e9388835097a5
Story: 2006759
Task: 38669
Signed-off-by: David Sullivan <david.sullivan@windriver.com>
2020-02-05 15:51:38 -05:00
Don Penney 4cb7bee3f8 Add DNF packages
Update the rpms_centos.lst file to include the DNF packages.

The patching framework currently uses the smart package manager for
managing in-release software updates, while CentOS 8 is using DNF. In
order to facilitate the upgrade to CentOS 8 and python3, the use of
smartpm by the patch-agent is being replaced with the python2 dnf
modules. This should allow for an easier transition to python3.

Change-Id: Ie9d2387158833e0f76504a6d764a69c209d01458
Story: 2006227
Task: 37933
Signed-off-by: Don Penney <don.penney@windriver.com>
2020-01-03 20:33:01 +00:00
Zuul efd8f0521f Merge "Upgrade std/rt kernel to version 1062.1.2 for fixing CVE bug" 2020-01-02 06:00:20 +00:00
Bart Wensley d885f802e7 Switch eventlet and requests to binary RPMs
Switching python-eventlet and python-requests to binary RPMs
because we no longer need to patch these packages. Also
upversioning eventlet, which is necessary to support the
python kubernetes client.

Adding in python-dns and python2-monotonic as these are
required by the upversioned eventlet.

Change-Id: I8af559d90add35d51ef7b1054264169ea4134f3c
Story: 2006781
Task: 37583
Depends-On: https://review.opendev.org/#/c/700195/
Signed-off-by: Bart Wensley <barton.wensley@windriver.com>
2019-12-20 10:29:35 -06:00
Robin Lu c69bc1ef1e Upgrade std/rt kernel to version 1062.1.2 for fixing CVE bug
To fix below kernel CVE, std/rt kernel will be upgraded to a
higher version than current version.
So we will upgrade kernel srpm to below version, which will
cover this issue.
std kernel: kernel-3.10.0-1062.1.2.el7.src.rpm
https://lists.centos.org/pipermail/centos-announce/2019-October/023457.html
rt kernel: kernel-rt-3.10.0-1062.1.2.rt56.1025.el7.src.rpm
https://access.redhat.com/errata/RHSA-2019:2830

linux-firmware is brought forward due to a kernel spec file
build dependency.

CVE bug: CVE-2019-11810:kernel: a NULL pointer dereference in
drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS
CVE bug: CVE-2019-11811: kernel: use-after-free in IPMI Edit
CVE bug: CVE-2019-14835: kernel: vhost-net: guest to host kernel
escape during migration

Closes-Bug: 1849206
Closes-Bug: 1849209
Closes-Bug: 1847817

Change-Id: Ic8c107e4850d0679470a4c8214c85c6d9a800beb
Signed-off-by: Robin Lu <bin1.lu@intel.com>
2019-12-19 09:27:47 +08:00
Zuul 2722d6ffbe Merge "Uprev ntp to version 4.2.6p5-29.el7" 2019-11-26 17:10:01 +00:00
Zuul 5ee70fb88c Merge "Update sudo srpm for CVE bug" 2019-11-26 04:53:45 +00:00
Jim Somerville d964e258be Uprev ntp to version 4.2.6p5-29.el7
This solves:
ntp: Stack-based buffer overflow in ntpq and ntpdc allows
denial of service or code execution (CVE-2018-12327)

See the announcement link:

https://lists.centos.org/pipermail/centos-cr-announce/2019-August/006016.html

for more details.

Change-Id: Ic92fd6af30bf05c6f40cb6a6c60e0bc3811ff22a
Partial-Bug: 1849197
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
2019-11-25 15:51:29 -05:00
Robin Lu c75164899f Update sudo srpm for CVE bug
To fix below CVE, we will use sudo-1.8.23-4.el7_7.1.src.rpm
https://lists.centos.org/pipermail/centos-announce/2019-October/023499.html

CVE bug: CVE-2019-14287: sudo: can bypass certain policy blacklists

Closes-Bug: 1852825

Change-Id: Iaafc053fe6e3b58468b5fa7c47dbc0f61a2d3c44
Signed-off-by: Robin Lu <bin1.lu@intel.com>
2019-11-25 09:42:14 +08:00
Jim Somerville ea25ae6f26 Uprev ruby and associated gems to subminor ver 36
All affected packages are moved forward to their -36 version.

This solves:
ruby: Unintentional directory traversal by poisoned NULL byte
in Dir (CVE-2018-8780)
rubygems: Improper verification of signatures in tarball
allows to install mis-signed gem (CVE-2018-1000076)

along with numerous other issues.

See the announcement link:

https://lists.centos.org/pipermail/centos-cr-announce/2019-August/006124.html

for more details.

Note that rubygem-json is moved back to version 1.7.7-36 as it
should never have been moved to 2.0.2-2 in the first place. That
appears to have occurred accidentally, taking the package from
opstools instead of os when moving to CentOS 7.6.

Change-Id: I732a0ddba6e2aa5ebda0e10f6e633f60c162890c
Closes-Bug: 1849195
Closes-Bug: 1849203
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
2019-11-22 16:53:53 -05:00
Zuul aea2212721 Merge "Update libX11 related rpms, due to CVE bugs" 2019-11-22 18:46:35 +00:00
Jim Somerville badc87aec3 Uprev wget to version 1.14-18.el7_6.1
This solves:
wget: do_conversion() heap-based buffer overflow
vulnerability (CVE-2019-5953)

See the announcement link:

https://lists.centos.org/pipermail/centos-announce/2019-May/023316.html

for more details.

Change-Id: I0e1c47f95b0cb643703d71367d1e9aa10870859b
Closes-Bug: 1849210
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
2019-11-22 12:15:24 -05:00
Jim Somerville 647676c202 Uprev polkit to version 0.112-22.el7
This solves:
polkit: Improper handling of user with uid > INT_MAX leading
to authentication bypass (CVE-2018-19788)

See the announcement link:

https://lists.centos.org/pipermail/centos-cr-announce/2019-August/006051.html

for more details.

Change-Id: I6eb69cd129b2b6d0e115f65b42f997d2b3f69d9a
Closes-Bug: 1849202
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
2019-11-22 11:59:19 -05:00
blu e4ea643e3c Update libX11 related rpms, due to CVE bugs
CVE bugs: CVE-2018-14599, CVE-2018-14600

Extra CVE bugs: CVE-2018-14598, CVE-2018-15853, CVE-2018-15854,
CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15859,
CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864
These extra CVE bugs are fixed together. Although libxkbcommon
has a low score, we are including it here anyway just to stay
consistent with RedHat's bundling decision.

The updated rpms are selected from the link provided by RedHat.
(https://access.redhat.com/errata/RHSA-2019:2079)

Tests:
simplex, duplex, multi-node

Closes-Bug: 1849198
Closes-Bug: 1849199

Change-Id: I184ff40d855c60d4824e28f2fe701230191d62b0
Signed-off-by: Robin Lu <bin1.lu@intel.com>
2019-11-22 09:11:50 +08:00
Zuul deefa5ba6a Merge "Uprev systemd to version 219-67.el7" 2019-11-21 22:21:38 +00:00
Jim Somerville 391b7d5e34 Uprev systemd to version 219-67.el7
This solves:
systemd: line splitting via fgets() allows for state injection
during daemon-reexec (CVE-2018-15686)

along with some other less critical issues.  See the security
announcement link:

https://lists.centos.org/pipermail/centos-cr-announce/2019-August/006149.html

for more details.

Change-Id: Ia0fcc7184efea5b31408d7514921b58377beb329
Partial-Bug: 1849200
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
2019-11-21 14:29:44 -05:00
Angie Wang e47f347e9f Upgrade botocore package
Upgrade botocore package from 1.6.0 to 1.12.75.
The new version fixed the ipv6 proxy management issue.

Change-Id: Ib82df18ed9ea72fcff9f029289dac2491fe80e81
Partial-Bug: 1853024
Signed-off-by: Angie Wang <angie.wang@windriver.com>
2019-11-19 13:49:53 -05:00
Zuul d9d0cb368f Merge "Add boto3 to build" 2019-09-19 18:32:46 +00:00
Jerry Sun f876a3252a Add boto3 to build
boto3 is a python package for interacting with AWS. we need this for
interacting with an Amazon Docker registry. This commit adds boto3 and
its dependencies to the build

Story: 2006274
Task: 36704

Change-Id: I79f893ad3df3a7f77ed9349e6816a1bd02e3a62a
Signed-off-by: Jerry Sun <jerry.sun@windriver.com>
2019-09-19 11:18:00 -04:00
Zuul 6a36dcd2ba Merge "Update packages to use new versions from upstream." 2019-09-16 17:40:03 +00:00
Kristine Bujold c778312d04 Add ntp-4.2.6p5-28.el7.centos.src.rpm
Remove the current ntp rpms and add the src.rpm. This is required to fix
a bug with ntpq and IPV6 addresses.

Partial-Bug: 1840687

Change-Id: I0196dda1eaae6d4da0aaa88aa8b487fe1397f3a7
Signed-off-by: Kristine Bujold <kristine.bujold@windriver.com>
2019-09-04 13:43:15 -04:00
Erich Cordoba 20f351a799 Update packages to use new versions from upstream.
These packages has been updated in upstream, this will cause
that whenever ./download_mirror.sh -u is used it will generate
a broken mirror.

This update has been tested generating a complete build and running
a provisioning in a duplex configuration.

Closes-Bug: 1817351

Change-Id: I80defd8f305377fd3660b32f18fa6459c5d4da20
Signed-off-by: Erich Cordoba <erich.cordoba.malibran@intel.com>
2019-08-31 10:11:30 -05:00
Long.Li cbcb28abb3 Upgrade curl to version 7.29.0-51.el7_6.3
curl version 7.29.0-51.el7 is vulnerable to a buffer overrun in
the NTLM authentication code, as per link
https://access.redhat.com/errata/RHSA-2019:1880
This issue is fixed in libcurl-7.29.0-51.el7_6.3.x86_64.rpm for
RHEL/CentOS.

Details:
https://nvd.nist.gov/vuln/detail/CVE-2018-14618
https://curl.haxx.se/docs/CVE-2017-8816.html
https://access.redhat.com/errata/RHSA-2019:1880

Closes-Bug: 1840771
Change-Id: Idb2237741e97abb63921a82b0f60213618230786
Signed-off-by: Long.Li <longx.li@intel.com>
2019-08-28 14:14:17 +08:00
Zuul 1540f11eaf Merge "Upgrade kernel to version kernel-3.10.0-957.21.3.el7" 2019-08-19 21:09:25 +00:00
John Kung b9ee1ac1c0 Fix socket growth on system application operations
There is an issue whereby docker exec_run commands do not close the TCP socket.
Thus on each kube application operation, such as application-apply, the docker
exec_run consumes 4 TCP sockets per iteration.  Thus, when it hits limit
of 1024 sockets, system can no longer perform application operations.

This updates the python-docker package. The source code was already in the
cengn mirror; and this update adds a patch to finally close socket in
docker client.

Tests performed:
Install AIO, Storage labs.
system application-upload stx-openstack, apply, remove
system application apply stress test of over 300 iterations
and verify no growth in sockets held by sysinv-conductor.

Change-Id: I8a8efbb372581c7ce13a0cf813f63c13d5186973
Closes-Bug: 1838088
Signed-off-by: John Kung <john.kung@windriver.com>
2019-08-09 15:41:26 -04:00
zhao.shuai 73025a11f3 Upgrade kernel to version kernel-3.10.0-957.21.3.el7
Security Fix(es):
(CVE-2019-11477)-
An integer overflow flaw was found in the way
the Linux kernel's networking subsystem processed
TCP Selective Acknowledgment (SACK) segments.
While processing SACK segments,
the Linux kernel's socket buffer (SKB) data structure
becomes fragmented. Each fragment is about TCP
maximum segment size (MSS) bytes.
To efficiently process SACK blocks, the Linux kernel merges
multiple fragmented SKBs into one, potentially overflowing
the variable holding the number of segments.
A remote attacker could use this flaw to crash the Linux kernel
by sending a crafted sequence of SACK segments on a TCP
connection with small value of TCP MSS,
resulting in a denial of service (DoS).

(CVE-2019-11478)-
Kernel: tcp: excessive resource consumption while processing
SACK blocks allows remote denial of service.

(CVE-2019-11479)-
Kernel: tcp: excessive resource consumption for TCP connections
with low MSS allows remote denial of service.

Details:
https://access.redhat.com/errata/RHSA-2019:1481
https://access.redhat.com/errata/RHSA-2019:1486
https://nvd.nist.gov/vuln/detail/

Closes-Bug: 1836685
Change-Id: If42765222e641218c2e2282bf7264f3a7f7b863c
Signed-off-by: zhao.shuai <zhaos@neusoft.com>
2019-07-17 15:14:13 +08:00
zhiguo.zhang ecf223e163 Upgrade kernel patch to CentOS7.6 3.10.0-957.12.2
New set of CVEs was reported against Intel CPUs: CVE-2018-12126,
CVE-2018-12127, CVE-2018-12130 and CVE-2019-11091.
For these CVEs there are RH and CentOS updates available.

CVE-2018-12126:
Microarchitectural Store Buffer Data Sampling (MSBDS):
Store buffers on some microprocessors utilizing speculative
execution may allow an authenticated user to potentially
enable information disclosure via a side channel with local access.
A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVE-2018-12127:
Microarchitectural Load Port Data Sampling (MLPDS):
Load ports on some microprocessors utilizing speculative execution
may allow an authenticated user to potentially enable information
disclosure via a side channel with local access. A list of impacted
products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVE-2018-12130:
Microarchitectural Fill Buffer Data Sampling (MFBDS):
Fill buffers on some microprocessors utilizing speculative execution
may allow an authenticated user to potentially enable information
disclosure via a side channel with local access. A list of impacted
products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVE-2019-11091:
Microarchitectural Data Sampling Uncacheable Memory(MDSUM):
Uncacheable memory on some microprocessors utilizing speculative
execution may allow an authenticated user to potentially enable
information disclosure via a side channel with local access.
A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

These are from the http://cve.mitre.org website.
These are the MDS security CVEs.

Closes-Bug: 1830487
Change-Id: I9c69ca78dc046128521d2a46b520f9c242fe6e56
Signed-off-by: zhiguo.zhang <zhiguox.zhang@intel.com>
2019-06-08 09:34:13 +08:00
Changcheng Liu dcbe99fcf8 Ceph v13.2.2 Mimic: add required packages
1. add boost library
2. add ceph/v13.2.2 dependent packages
3. bump scl-utils package version

Story: 2003605
Task: 28856

Depends-On: Ibfbecf0a8beb38009b9d7192ca9455a841402040
Change-Id: I6220a7cd27ebbde54d1d353b52cba80293d891df
Signed-off-by: Scott Little <scott.little@windriver.com>
Signed-off-by: Dehao Shang <dehao.shang@intel.com>
Signed-off-by: Changcheng Liu <changcheng.liu@intel.com>
Signed-off-by: Daniel Badea <daniel.badea@windriver.com>
2019-05-02 10:55:09 -04:00
Zuul 0e6b3efaa8 Merge "upgrade openvswitch to 2.11.0 version" 2019-05-02 13:58:08 +00:00
Zuul c265f2c02e Merge "Upgrade for systemd packages (CVE-2018-15688)" 2019-04-29 17:08:05 +00:00
Zuul 1d72eefc9d Merge "replace python-gunicorn srpm with rpm package" 2019-04-24 13:34:31 +00:00
Shuicheng Lin f0e30ec6c5 replace python-gunicorn srpm with rpm package
python-gunicorn-19.7.1-1 is available in CentOS 7.6 repo now.
And there is only 1 meta patch to disable python3 compilation. So it
is ok to replace the srpm with rpm package directly.

Story: 2005484
Task: 30578

Change-Id: I1a56c098741c6ddda466caa740a530d6e8468403
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2019-04-19 13:58:57 +08:00
Tyler Smith a552b3fe76 Upversioning Keystone and Barbican
Adding stein dependencies to the RPM list and adding the Stein centos repo
to our configured mirror repos.

Change-Id: I10669c7e7160217cc95c5e4811a0d7e3eab85772
Story: 2004765
Task: 28883
Depends-On: https://review.openstack.org/#/c/653082
Signed-off-by: Tyler Smith <tyler.smith@windriver.com>
2019-04-18 14:06:50 -04:00
Shuicheng Lin 2d17c61f08 move several packages from 3rdparties lst to centos lst
These packages could be found in centos repo also, so move them to
centos lst.

Story: 2005484
Task: 30577

Change-Id: I23abc56b962c2a5d0be2b170a59e67632c12083f
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2019-04-18 17:18:52 +08:00
Zuul 3e253a99c6 Merge "Upgrade for Perl packages (CVE-2018-18311: Perl Buffer Overflow)." 2019-04-17 16:14:41 +00:00
Zuul 83e1533e47 Merge "Upversion etcd from 3.2.22 rpm to 3.2.24 src tarball" 2019-04-11 18:51:28 +00:00
Mawrer Ramirez 443cc0bb5f Upgrade for systemd packages (CVE-2018-15688)
New version of packages updated:
 systemd-219-62.el7_6.5.src.rpm
 systemd-219-62.el7_6.5.x86_64.rpm
 systemd-devel-221-62.el7_6.5.x86_64.rpm
 systemd-libs-219-62.el7_6.5.x86_64.rpm
 systemd-sysv-219-62.el7_6.5.x86_64.rpm

Change-Id: I3fd97d9dabe2350a7af887a0c7de26ec95f7a7d9
Closes-Bug: #1820756
Signed-off-by: Mawrer Ramirez <mawrer.a.ramirez.martinez@intel.com>
2019-04-09 02:53:25 -05:00
Al Bailey de0f932a20 Upversion etcd from 3.2.22 rpm to 3.2.24 src tarball
There is no prebuilt version of etcd on centos for 3.2.24
so the src tarball for that version needs to be downloaded
and built using a spec file.

3.2.24 is required for kubernetes 1.13.5

Story: 2005198
Task: 30392
Change-Id: I8f7061a9577941c257046721dbf5e957375691ab
Signed-off-by: Al Bailey <Al.Bailey@windriver.com>
2019-04-08 12:52:51 -05:00
Mawrer Ramirez f3058ab20b Removing keepalived reference from rpms-centos.lst file
keepalived package is no longer required, since neutron was moved to a
container.

According the following change, it is safe remove the reference package:
http://git.starlingx.io/cgit/stx-upstream/commit/?id=ff5666d3

Change-Id: Ic0f0b21d7940669a01685b4ff0f9872087ba628d
Closes-Bug: #1820759
Signed-off-by: Mawrer Ramirez <mawrer.a.ramirez.martinez@intel.com>
2019-04-04 03:30:42 -06:00
Mawrer Ramirez 2b10c0f45a Upgrade for Perl packages (CVE-2018-18311: Perl Buffer Overflow).
Link to the CentOS announce for 'CESA-2019:0109 Important CentOS 7 perl Security Update':
https://lists.centos.org/pipermail/centos-announce/2019-January/023148.html

New version of packages updated:
 perl-5.16.3-294.el7_6.x86_64.rpm
 perl-devel-5.16.3-294.el7_6.x86_64.rpm
 perl-libs-5.16.3-294.el7_6.x86_64.rpm
 perl-macros-5.16.3-294.el7_6.x86_64.rpm
 perl-Pod-Escapes-1.04-294.el7_6.noarch.rpm
 perl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm
 perl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm

Change-Id: Ibb83fccd7cdd0f93e99f8c62fef87527241e5342
Closes-Bug: #1820757
Signed-off-by: Mawrer Ramirez <mawrer.a.ramirez.martinez@intel.com>
2019-04-03 07:37:21 -06:00
Tyler Smith d1905b4916 Upversioning platform horizon to master
Upversioning the dependencies for master horizon, including django 1.11
and its dependencies

Story: 2004765
Task: 28883
Depends-On: https://review.openstack.org/#/c/642797
Signed-off-by: Tyler Smith <tyler.smith@windriver.com>
Change-Id: I0e848bd0b2b2ce45138bf90d494aef5440d98bd4
2019-03-14 10:13:19 -04:00
Shuicheng Lin cdc3def5b7 upgrade openvswitch to 2.11.0 version
Switch to tarball since there is no srpm package in centos repo yet.
This upgrade is in order to support Mellanox NICs again.

Story: 2004743
Task: 29195

Change-Id: I61572318c5017a51a5eb196df15ee93cb3b05eb5
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2019-03-13 01:43:30 +08:00
Saul Wold 9409dbed85 Merge remote-tracking branch 'gerrit/master' into f/centos76
Change-Id: I8286210f39b3202777ba5dbc700b3207f8660864
Signed-off-by: Saul Wold <sgw@linux.intel.com>
2019-03-04 17:36:02 -08:00
Saul Wold 6a4cd915dc Merge remote-tracking branch 'gerrit/master' into f/centos76
Change-Id: I7b1596189f735623f21cfc231b289d08e4852d32
Signed-off-by: Saul Wold <sgw@linux.intel.com>
2019-02-12 08:00:06 -08:00
Scott Little 8a33d781fc Merge remote-tracking branch 'starlingx/master' into HEAD
Change-Id: Ib6ddf43321407d89541ee873a964026de0b08120
Signed-off-by: Scott Little <scott.little@windriver.com>
2019-02-07 12:10:09 -05:00
Tee Ngo c8e0636ad2 Pulling in RPMs for Ansible Playbook
Pulling in the needed RPMs in preparation for Ansible Playbook
inclusion in the image.

Tests conducted:
  - Test of download mirror scripts to pull the required packages
  - Successful installation

Story: 2004695
Task: 29376

Change-Id: Iaecd1dac75b34183cbaf7390d58ba057fdfabe7c
Signed-off by: Tee Ngo <tee.ngo@windriver.com>
2019-02-06 17:14:55 +00:00
Al Bailey 234a948033 Pulling in RPM for ceilometerclient
This client needed for Horizon (pike) to launch.
This client does not exist in stein, and so it
will be removed once a stein version of Horizon
is installed on the controller (story 2004765).

Story: 2004751
Task: 29287
Change-Id: Iee76e932383493aea7d9fa0d18425f01e2f6a65d
Signed-off-by: Al Bailey <Al.Bailey@windriver.com>
2019-02-01 13:03:16 -06:00
Shuicheng Lin 3faee2cdb0 Fix openvswitch script crash issue
When run openvswitch script "dpdk-pmdinfo.py", it will crash with Error:
"ImportError: cannot import name UBInt8". And this failure will cause
dpdk always return not supported for ethernet adapter.
It is due to new python-construct rpm doesn't have UBInt8.
Roll back python-construct to fix it.

Story: 2004522
Task: 29124

Change-Id: Iefa9d21bb81390b5bcf1d0605c0408b5869616f5
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2019-01-28 22:55:39 +08:00
Shuicheng Lin 494dd3f78e Roll back device-mapper-multipath version to fix build-iso failure
new lvm2 rpm causes AIO duplex deploy failure, so lvm2 is kept with
old version currently. device-mapper-multipath should be kept with
old version also to avoid dependency failure.

Move device-mapper packages to rpms_centos.lst since all packages
could be found in centos repo.

Story: 2004522
Task: 29099

Change-Id: I5cd4d434a629201934a48a551d4fb354f8d57318
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2019-01-25 20:02:22 +08:00