16:17:31 #startmeeting F33-blocker-review 16:17:31 Meeting started Mon Aug 10 16:17:31 2020 UTC. 16:17:31 This meeting is logged and archived in a public location. 16:17:31 The chair is adamw. Information about MeetBot at http://wiki.debian.org/MeetBot. 16:17:31 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:17:31 The meeting name has been set to 'f33-blocker-review' 16:17:31 #meetingname F33-blocker-review 16:17:31 The meeting name has been set to 'f33-blocker-review' 16:17:31 #topic Roll Call 16:17:34 ONE MORE TIME 16:17:35 .hello2 16:17:36 bcotton: bcotton 'Ben Cotton' 16:17:39 .hello lruzicka 16:17:39 .hello2 16:17:39 lruzicka2: lruzicka 'Lukáš Růžička' 16:17:42 kparal: kparal 'Kamil Páral' 16:17:44 .hello salimma 16:17:45 michel_slm: salimma 'Michel Alexandre Salim' 16:17:45 more like hello3, amirite? 16:17:47 .hello2 16:17:48 pwhalen: pwhalen 'Paul Whalen' 16:17:49 I heard there was a meeting here 16:17:59 hello 2 never works for me 16:17:59 .fire coremodule 16:17:59 adamw fires coremodule 16:18:05 .hello chrismurphy 16:18:06 cmurf: chrismurphy 'Chris Murphy' 16:18:07 dammit! 16:18:11 michel_slm: it only works if your irc nick is your fas nick 16:18:12 https://images.app.goo.gl/mCnbdKfXwLqAJEvg7 16:18:12 .fire zodbot 16:18:12 adamw fires zodbot 16:18:18 or you set a magic mapping somewhere, i think 16:18:21 .hello2 16:18:23 coremodule: coremodule 'Geoffrey Marr' 16:18:24 michel_slm, you need to be logged as your primary nickname 16:18:27 .hello2 16:18:28 tablepc: tablepc 'Pat Kelly' 16:18:46 lruzicka2: I am, I thought? but I'm using Matrix so who knows if the mapping works or not now 16:19:19 if I can give karma to people then this is the right account 16:19:29 adamw++ 16:19:29 michel_slm: Karma for adamwill changed to 7 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 16:19:38 michel_slm, not sure, do not know about matrix :) but I only use lruzicka with irc and fas and it works 16:20:06 the mysteries of zodboty 16:20:07 okay 16:20:13 ah yeah, so hello2 does not do the magic IRC->FAS mapping if they are different. might be worth looking into 16:20:25 .hello 16:20:25 cmurf: (hello ) -- Alias for "hellomynameis $1". 16:20:25 #chair coremodule bcotton 16:20:25 Current chairs: adamw bcotton coremodule 16:20:29 hmm 16:20:36 coremodule: i believe you volunteered to secretarialize? 16:20:52 .hello2 16:20:55 cmurf: Sorry, but you don't exist 16:21:00 i *did*, but that was in the *other* meeting \said with incredible sass 16:21:00 haha that's my favorite 16:21:13 but fine, I'll secretarialize here 16:21:28 coremodule++ for incredible sass 16:21:29 =) 16:21:35 #info coremodule will secretarialize 16:21:38 lol 16:21:47 impending boilerplate alert! 16:21:49 #topic Introduction 16:21:49 Why are we here? 16:21:49 #info Our purpose in this meeting is to review proposed blocker and nice-to-have bugs and decide whether to accept them, and to monitor the progress of fixing existing accepted blocker and nice-to-have bugs. 16:21:49 #info We'll be following the process outlined at: 16:21:51 #link https://fedoraproject.org/wiki/QA:SOP_Blocker_Bug_Meeting 16:21:51 #info The bugs up for review today are available at: 16:21:53 #link http://qa.fedoraproject.org/blockerbugs/current 16:21:55 #info The criteria for release blocking bugs can be found at: 16:21:57 #link https://fedoraproject.org/wiki/Basic_Release_Criteria 16:21:59 #link https://fedoraproject.org/wiki/Fedora_33_Beta_Release_Criteria 16:22:01 #link https://fedoraproject.org/wiki/Fedora_33_Final_Release_Criteria 16:22:10 #info for Beta, we have: 16:22:10 #info 4 Proposed Blockers 16:22:10 #info 2 Accepted Blockers 16:22:14 #info 1 Proposed Freeze Exceptions 16:22:18 #info for Final, we have: 16:22:28 #info 1 Accepted Blockers 16:23:36 let's get started with... 16:23:40 #topic Proposed Beta blockers 16:23:48 #topic (1830343) Network manager started stuck when I tries connecting to VPN (openconnect) after upgrade gnome-shell to 3.37.1-1.fc33 version 16:23:48 #link https://bugzilla.redhat.com/show_bug.cgi?id=1830343 16:23:48 #info Proposed Blocker, gnome-shell, NEW 16:24:08 not sure if it's reproducible 16:24:25 we talked about that last time 16:24:30 you need an openconnect vpn, presumably 16:24:55 i meant to poke at it but never got down to it in my list of things on fire 16:24:57 did anyone else? 16:25:43 btw gnome megaupdate coming in ~5-6 days 16:26:09 * kparal uses openvpn 16:26:23 yeah me too is that the same thing as openconnect? 16:27:28 looks like they are different things 16:27:43 if the version jump from 3.x to 40 does that mean it's 10x better? ;) 16:27:48 cmurf: no they're different 16:27:55 i guess we have to punt again here 16:28:00 but i should probably put out a call for testing or smth 16:28:12 #action adamw to send out testing call for #1830343 16:28:15 new versioning is still a while out 16:28:20 thats not happening for f33 16:28:25 +1 call for testing and punt 16:28:30 adamw: we use openconnect at work, if needed I can... sacrifice one of my laptops and put rawhide on it 16:28:41 proposed #agreed 1830343 - punt (delay decision) - we still didn't get any further info on this yet, so need to punt again. we will send out a call for testing to try and get more info 16:28:46 michel_slm: can't you just try it in a vm? 16:28:54 michel_slm: it needs to also use the same 2FA config as the reporter, though, i think 16:29:01 as the freeze happens during the 2FA challenge/response process 16:29:19 brb 16:30:11 ugh yeah. so.. our VM setup used to work, but now hits an IPv6 snag with newer virtualbox. haven't got round to getting it to work with libvirt yet 16:31:59 fun 16:32:02 ack/nack/patch? 16:32:31 I'm good with that, ack 16:32:47 ack 16:33:08 ack 16:33:22 ack 16:33:32 ack 16:36:15 #agreed 1830343 - punt (delay decision) - we still didn't get any further info on this yet, so need to punt again. we will send out a call for testing to try and get more info 16:36:17 sorry 16:36:25 #topic (1866570) FreeIPA deployment fails in current Rawhide due to various issues with Java 11 16:36:25 #link https://bugzilla.redhat.com/show_bug.cgi?id=1866570 16:36:25 #info Proposed Blocker, resteasy, NEW 16:36:29 this is a pretty obvious +1 16:36:35 agreed +1 16:36:44 we're still figuring out the corners of everything that needs changing, but the big picture is: freeipa broken, that's in the criteria 16:36:53 +1 16:37:13 proposed #agreed 1866570 - AcceptedBlocker (Beta) - clear violation of Basic criterion "It must be possible to configure a Fedora Server system installed according to the above criteria as a FreeIPA domain controller, using the official deployment tools provided in the distribution FreeIPA packages..." 16:37:18 +1 16:37:19 ack 16:37:55 ack 16:38:51 any more acks 16:38:54 any more acks 16:38:58 any any any more aa-acks 16:39:11 ack 16:39:33 that cr-acks me up 16:39:59 (it's sung to the tune of "any old iron", which you probably don't know!) 16:40:04 anyone can ack, or just QA people? 16:40:09 #agreed 1866570 - AcceptedBlocker (Beta) - clear violation of Basic criterion "It must be possible to configure a Fedora Server system installed according to the above criteria as a FreeIPA domain controller, using the official deployment tools provided in the distribution FreeIPA packages..." 16:40:14 michel_slm: it depends entirely on my whims 16:40:17 so...yes. :D 16:40:39 michel_slm: in theory, you get a vote if you're part of qa, releng, devel or 'management' (fpm, fpl etc) 16:41:10 devel == I'm a Fedora developer? or it's a specific group 16:41:11 in practice i just take votes from whoever shows up and is not obviously crazy (sorry kparal, i've been ignoring your votes all these years) 16:41:17 michel_slm: yeah, that's good enough! 16:41:33 kparal: so that filter does exist 16:41:40 =) 16:41:55 #topic (1861700) login stuck when changing users repeatedly (log out, log in a different one) 16:41:55 #link https://bugzilla.redhat.com/show_bug.cgi?id=1861700 16:41:55 #info Proposed Blocker, sddm, NEW 16:42:27 huh, "It was performed on The Muppet Show by Kermit the Frog, joined by Fozzie Bear, two whatnots, and the audience." 16:42:33 so depending on when you were a kid, maybe you *do* know it 16:42:34 haha 16:42:37 I'm not crazy, my mother had me tested 16:43:40 i'm definitely unwell but adamw always accepts my acks 16:43:51 cmurf: or so you think 16:44:07 well now i can relax 16:44:11 playing the song now 16:44:46 so, +1 from me based on that criterion we'll put live soon(tm) 16:44:51 +1 16:44:55 +1 16:45:04 this is the one from the QA meeting just now, right? 16:45:06 +1 16:45:10 +1 16:46:18 yeah 16:46:28 +1 16:46:29 +1 16:46:42 #info we agreed in the QA meeting today that we will accept one of the proposed criteria relating to this, or a similar one which still requires "log out as A, log in as B" to work 16:46:59 #info we can treat this bug as violating that to-be-accepted criterion 16:47:44 proposed #agreed 1861700 - AcceptedBlocker (Beta) - this is accepted as a violation of the in-progress but accepted-in-principle logout criterion, see thread https://lists.fedoraproject.org/archives/list/test@lists.fedoraproject.org/message/PTRPHWTMVEKLTCMVDBGIWYYMYVIBAJYB/ 16:48:40 ack 16:48:52 ack 16:49:13 ack 16:49:14 ack 16:49:23 ack 16:49:28 #agreed 1861700 - AcceptedBlocker (Beta) - this is accepted as a violation of the in-progress but accepted-in-principle logout criterion, see thread https://lists.fedoraproject.org/archives/list/test@lists.fedoraproject.org/message/PTRPHWTMVEKLTCMVDBGIWYYMYVIBAJYB/ 16:49:42 #topic (1862686) SELinux is preventing systemd-machine from 'create' accesses on the sock_file io.systemd.Machine. 16:49:42 #link https://bugzilla.redhat.com/show_bug.cgi?id=1862686 16:49:43 #info Proposed Blocker, selinux-policy, NEW 16:50:34 so i'm pretty sure this is a final blocker 16:51:05 not beta? 16:51:06 are libvirt machines broken? 16:51:06 i'm less completely sure about the libvirt thing (and also whether it might be specific to some element of my desktop virt setup, i haven't tried reproducing it ootb yet) 16:51:21 cmurf: sorry, i meant i'm pretty sure it's *at least* final 16:51:24 i'm less sure about beta 16:51:29 it'd be good if others can try too 16:51:33 let's accept for final and leave it proposed for beta 16:51:41 i just noticed i hit the denials when running VMs locally and doing 'setenforce Permissive' fixed it 16:51:50 can we edit the title? it's systemd-machined, not systemd-machine, right? 16:51:55 but that's on my day-to-day desktop with god-knows-how-old machine definitions and stuff 16:52:08 nevermind what I said 16:52:09 michel_slm: don't think so 16:52:11 I got a message about this Selinux issue from Abrt when I ran my VM today, but did not try it on bare metal to run virtualization yet 16:52:19 it's an autogenerated report, the names should be right 16:52:30 trying to look up the man pages and machined was the nearest match 16:52:35 kparal: that sounds reasonable to me (accept for final, punt for beta) 16:52:45 michel_slm: it's all part of the same thing i think 16:52:48 let's do it then 16:52:54 but the actual process being blocked here is called systemd-machine apparently 16:53:03 yeah, must be an internal name not exposed as a binary 16:53:15 blocking final sounds reasonable 16:53:38 hmm i haven't hit this on f33 on baremetal with remote virt-manager 16:53:53 i'll try and block off some time to look into it a bit more too 16:54:52 lemme check something quickly... 16:55:05 proposed #agreed 1862686 - punt (delay decision) for Beta, AcceptedBlocker (Final) - this is a pretty clear violation of Final criterion "All system services present after installation with one of the release-blocking package sets must start properly, unless they require hardware which is not present", so we accept it as at least a Final blocker. we're less sure about whether and how badly it breaks virtualization, so we are delaying the 16:55:05 decision on Beta blocker status to look into that some more 16:55:09 d'oh 16:55:12 i'll wordsmith while you check :D 16:55:28 ok so, i'm enforcing=0 on that clean installed f33 baremetal system 16:55:32 proposed #agreed 1862686 - punt (delay decision) for Beta, AcceptedBlocker (Final) - this is a pretty clear violation of Final criterion "All system services present after installation with one of the release-blocking package sets must start properly...", so we accept it as at least a Final blocker. we're less sure about whether and how badly it breaks virtualization, so we are delaying the decision on Beta blocker status to look into that some 16:55:32 more 16:55:55 ack 16:56:00 proposed #agreed 1862686 - punt (delay decision) for Beta, AcceptedBlocker (Final) - this is a pretty clear violation of Final criterion "All system services present after installation with one of the release-blocking package sets must start properly...", so we accept it as at least a Final blocker. we're less sure about whether it breaks virtualization, so we will delay the decision on Beta blocker status to look into that some more 16:56:01 there. 16:56:12 even more 16:56:13 Admiral ACKbar 16:56:14 ack 16:56:32 ack 16:56:35 oh, I there was no full stop 16:56:35 ack 16:56:36 ack 16:57:34 i know i've run VMs though with default boot params and it worked though, but yeah 16:57:40 #agreed 1862686 - punt (delay decision) for Beta, AcceptedBlocker (Final) - this is a pretty clear violation of Final criterion "All system services present after installation with one of the release-blocking package sets must start properly...", so we accept it as at least a Final blocker. we're less sure about whether it breaks virtualization, so we will delay the decision on Beta blocker status to look into that some more 16:57:45 cmurf: try it with enforcing=1. :D 16:58:11 is that a thing 16:58:29 i think it works but obviously unnecessary on fedora 16:58:43 unless there's some sort of 'enforcing=0 blah blah blah ... enforcing=1' situation 16:58:46 ah, corner cases 16:58:58 hmm 16:59:37 #topic Accepted Beta blocker review 16:59:51 for info - the proposed FE is the openconnect bug we don't really know anything about, we need more info to review it for FE status too 16:59:58 and there are no proposed Final blockers 17:00:03 ok i'm rebooting without enforcing=0 17:00:11 #topic (1860616) abrt-server errors when processing zstd compressed core dumps produced by systemd-246~rc1-1.fc33 17:00:11 #link https://bugzilla.redhat.com/show_bug.cgi?id=1860616 17:00:11 #info Accepted Blocker, libreport, NEW 17:00:38 yeah i'm still +1 on this because there's a fix for abrt 17:00:58 otherwise i'd wonder if systemd should revert its default compression 17:01:02 we're not re-reviewing it 17:01:07 we're just checking on fix status 17:01:18 so there's a PR merged upstream but apparently no new release or backport 17:01:33 #info a PR that's alleged to help with this is merged upstream, but there has been no new release or backport 17:02:00 #action adamw to ping team to backport patch or cut a new release, do it himself if necessary 17:02:05 that should deal with it. :D 17:02:27 any other notes? 17:04:03 okay then! 17:04:10 #topic (1857043) FreeIPA server deployment fails in Fedora-Rawhide-20200714.n.0 due to pki-tomcat failing to run with "java.lang.ClassNotFoundException: org.apache.tomcat.util.modeler.modules.MbeansDescriptorsIntrospectionSource" 17:04:10 #link https://bugzilla.redhat.com/show_bug.cgi?id=1857043 17:04:10 #info Accepted Blocker, tomcat, MODIFIED 17:04:24 #info we think this is probably fixed, but it's hard to tell for sure due to the Java 11 changes complicating things 17:04:46 #info we'll continue to monitor it as part of the broader Make FreeIPA Work Again...thing 17:05:01 anything else? 17:05:42 I wonder if it would have been possible to catch this before the java 11 sidetag gets merged. probably difficult 17:05:55 this bug wasn't actually java 11 related 17:06:04 it's just the java 11 changes kinda make it hard to tell if this one is fully fixed or not 17:06:08 ah 17:06:12 because we never got a compose with the fix for this but *not* with java 11 17:07:58 okay then 17:08:00 #topic Open floor 17:08:03 any other business, concerns etc? 17:08:24 that earlier VM bug, i can reproduce it 17:08:39 ah 17:08:45 starts to smell more blocker-y then 17:08:46 i think we should take it as a beta blocker 17:08:54 let's circle back 17:09:05 #topic (1862686) SELinux is preventing systemd-machine from 'create' accesses on the sock_file io.systemd.Machine. 17:09:05 #link https://bugzilla.redhat.com/show_bug.cgi?id=1862686 17:09:05 #info Proposed Blocker, selinux-policy, NEW 17:09:19 #info circling back to this as cmurf says he can reproduce the 'VM won't run' element 17:10:00 i think the cause is pretty clear... 17:10:02 Aug 10 11:05:07 fmac.local systemd-machined[1851]: Failed to bind to varlink socket: Permission denied 17:10:04 Aug 10 11:05:07 fmac.local audit[1851]: AVC avc: denied { write } for pid=1851 comm="systemd-machine" name="userdb" dev="tmpfs" ino=18772 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=dir permissive=0 17:10:06 Aug 10 11:05:07 fmac.local systemd-machined[1851]: Failed to fully start up daemon: Permission denied 17:10:21 what i see i the GUI though is different 17:10:39 virt-manager pops up a dialog "Error starting domain: Remote peer disconnected" 17:10:53 but it's 100% reproducible 17:10:54 cmurf: yeah, that's what i get 17:11:10 there is a bit more debug info using 'virt-manager --debug' 17:11:16 but i don't think it's necessary 17:11:26 ^to add that to the bug 17:12:30 if you can reproduce, i'm +1 at least provisionally 17:12:35 anyone else still around to vote? 17:12:59 +1 17:13:11 +1 17:13:37 +1 17:14:05 thanks 17:14:06 i suppose it could be related to userdb changes in systemd 17:14:30 cmurf: it smells like a "confined process started doing stuff it didn't used to do" case to me 17:14:45 +1 17:15:03 +1 17:15:12 yeah 17:15:27 proposed #agreed 1862686 - AcceptedBlocker (Beta) - accepted as a violation of "The release must be able host virtual guest instances of the same release", since both adamw and cmurf have reported being unable to launch VMs with SELinux in enforcing mode. this overrides earlier acceptance as a Final blocker 17:15:31 +1 17:15:36 ack 17:15:38 ack 17:15:43 ack 17:15:49 Ackchoo! 17:15:55 ackamai 17:16:41 #agreed 1862686 - AcceptedBlocker (Beta) - accepted as a violation of "The release must be able host virtual guest instances of the same release", since both adamw and cmurf have reported being unable to launch VMs with SELinux in enforcing mode. this overrides earlier acceptance as a Final blocker 17:16:45 oo, i like that one 17:16:54 .hire michel_slm 17:16:54 adamw hires michel_slm 17:17:01 #topic Open floor 17:17:04 okey dokey, are we done this time? 17:17:47 Have a Great Day Everyone! 17:18:02 bye all! have a nice day 17:18:13 bye, have a good time 17:18:17 thanks for coming, folks, appreciate it 17:18:23 methinks so! thanks for hosting adamw 17:18:25 we...we couldn't do this without you *wipes tear from eye* 17:18:47 coremodule++ 17:18:47 michel_slm: Karma for coremodule changed to 4 (for the current release cycle): https://badges.fedoraproject.org/tags/cookie/any 17:19:45 just let me eat my lunch, then ill secretarialize. that salt from your tears will season my food 17:20:34 ...wow 17:20:37 and on that note 17:20:39 #endmeeting