Hi,
If anyone is interested I managed to modify the script found here -
http://blog.vmfarms.com/2013/12/inject-little-security-in-to-your.html to
successfully import CentOS errata into Katello. I tried it on a standalone
pulp server and worked out what fields were missing in order for Pulp to
accept the format.
I can post the modified script here if anyone is interested, still working
on getting Bugfixes and Enhancements into Katello but Security errata
appears to work.
Thanks
Marc
> Hi,
>
> If anyone is interested I managed to modify the script found here -
> VM Farms to
> successfully import CentOS errata into Katello. I tried it on a standalone
> pulp server and worked out what fields were missing in order for Pulp to
> accept the format.
>
> I can post the modified script here if anyone is interested, still working
> on getting Bugfixes and Enhancements into Katello but Security errata
> appears to work.
>
> Thanks
>
> Marc
Hey Marc,
That's really great! A lot of people are interested in this. You can
share the script here, or maybe we can get it added to the docs.
If you write up a blog post about it, we can link to it, or we can
even add it to the manual itself somewhere (GitHub - Katello/katello.org: ** WE'VE MOVED ** The Katello documentation has moved to https://github.com/theforeman/theforeman.org)
–
You received this message because you are subscribed to the Google Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send an email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.
–
Best Regards,
Stephen Benjamin
Red Hat Engineering
Not sure if anyone is interested or not but I created this:
It's poor code, but it's working for me. Only tested with 2.2 and very
little testing at that.
Hi and thanks for the script. I ran it and noticed today when i came in
this error on the katello web interface:
Warning!undefined method `type' for #<Katello::Erratum:0x007f0202207910>
i don't see anything in the error files but it seems like something might
be wrong with the formatting of the Errata. Has anyone experienced this?
Thanks!
Hi Eric,
I'll add some information to that request.
At the moment it's a bit of a long winded approach, I need to perform a
local reposync of the CentOS-6-Updates, download the Steve Meier errata
list, use sed to remove all the references in this file except for the link
to the redhat errata and finally run the python script to generate the
errata. Once the errata has been generated I've used modifyrepo to inject
the updateinfo.xml file into the local repository. Once that's all done I
point Katello at my repository, perform a sync and it then pulls everything
in for me. Not ideal and I'm sure someone with a little more knowledge of
python could modify the script to not require the sed statements.
Thanks
Marc
There is an issue for tracking this request that adding your information
and script to would be nice – Feature #8656: Ability to import errata data from an external source. - Katello - Foreman
Are you achieving this by exporting the CentOS errata into a yum repository
and then having Katello sync that?
Eric
On Thu, Apr 09, 2015 at 04:25:53AM -0700, mfarr1981@gmail.com wrote:
Hi,
If anyone is interested I managed to modify the script found here -
VM Farms
to
successfully import CentOS errata into Katello. I tried it on a
standalone
pulp server and worked out what fields were missing in order for Pulp to
accept the format.I can post the modified script here if anyone is interested, still
working
on getting Bugfixes and Enhancements into Katello but Security errata
appears to work.Thanks
Marc
Hey Marc,
That’s really great! A lot of people are interested in this. You can
share the script here, or maybe we can get it added to the docs.If you write up a blog post about it, we can link to it, or we can
even add it to the manual itself somewhere (
GitHub - Katello/katello.org: ** WE'VE MOVED ** The Katello documentation has moved to https://github.com/theforeman/theforeman.org)–
You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.–
Best Regards,Stephen Benjamin
Red Hat Engineering–
You received this message because you are subscribed to the Google Groups
“Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.
Hi Eric, Stephen,
Seem to have run into a small problem. The errata imports successfully into
Katello from CentOS and I can view the errata under content, I can also see
the applicable hosts. However when I come to create a content view it
completes but tells me there's 0 errata available. For example looking at
the synced repository I can see there's 500 errata available, going to
content->errata I can then see it all like I mentioned above, but just
won't copy over into the content view.
I can look at a host that's attached to the content view and it shows no
errata, but if I switch the view to Library/Synced content it'll show all
the errata available.
This is also the same for Amazon Linux. I can get the amazon repository
into katello but when I come to putting this into a content view all the
errata disappears and I'm left with just the packages. I can then attempt
to create a filter that's by errata ID. All the errata is listed to add but
as soon as I add the errata and publish I get 0 errata and 0 packages. This
is the same for both Amazon Linux and CentOS.
Thanks
Marc
Hi Eric,
It looks like the job to PurgeEmptyErrata is kicking in when I promote the
repository to a content view. I can see information such as the below. This
happens for CentOS and also for Amazon Linux.
pulp_tasks:
Instructions look solid to me but when I run it I get
NOTICE: Skipping errata CESA-2017:2563 (Moderate CentOS openssh Security
Update) – No packages found
for every errata. Any ideas?
It looks like the job to PurgeEmptyErrata is kicking in when I promote the
repository to a content view. I can see information such as the below. This
happens for CentOS and also for Amazon Linux.
pulp_tasks:
Hmm. I'm about to leave work, but it works for us with no major changes.
We run Foreman 1.15.3 and Katello 3.4.5
L.
Greg Bloom @greggish
https://twitter.com/greggish/status/873177525903609857
On 6 September 2017 at 05:49, Jon Dison jon.dison@gmail.com wrote:
Instructions look solid to me but when I run it I get
NOTICE: Skipping errata CESA-2017:2563 (Moderate CentOS openssh Security
Update) – No packages found
for every errata. Any ideas?On Friday, June 19, 2015 at 3:14:44 AM UTC-4, Rodrigo Menezes wrote:
Not sure if anyone is interested or not but I created this:
GitHub - rdrgmnzs/pulp_centos_errata_import: Imports CentOS (from http://cefs.steve-meier.de/) errata into Pulp / KatelloIt’s poor code, but it’s working for me. Only tested with 2.2 and very
little testing at that.–
You received this message because you are subscribed to the Google Groups
“Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com.
Visit this group at https://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.
> It looks like the job to PurgeEmptyErrata is kicking in when I promote
> the repository to a content view. I can see information such as the
> below. This happens for CentOS and also for Amazon Linux.
This task is expecting the errata to define 'filenames' of all the
packages in each errata. Can you check the errata structure your
scripts are generating and see if the filenames exist?
-Justin
pulp_tasks:
- exception:
task_type:
pulp.server.managers.repo.unit_association.unassociate_by_criteria
_href: /pulp/api/v2/tasks/25d069fc-471c-4522-8692-e7c97a5b1337/
task_id: 25d069fc-471c-4522-8692-e7c97a5b1337
tags:
- pulp:repository:THS_IPSWICH-CentOS-3_0-CentOS-CentOS6_Updates
- pulp:action:unassociate
finish_time: ‘2015-04-09T14:05:35Z’
_ns: task_status
start_time: ‘2015-04-09T14:05:35Z’
traceback:
spawned_tasks:
progress_report: {}
queue: reserved_resource_worker-1@xxxxx
state: finished
result:
units_successful:
- unit_key:
id: CESA-2011-1777
type_id: erratum- unit_key:
id: CESA-2011-1780
type_id: erratum- unit_key:
id: CESA-2011-1790
type_id: erratum- unit_key:
id: CESA-2011-1791
type_id: erratum- unit_key:
id: CESA-2011-1801
type_id: erratum- unit_key:
id: CESA-2011-1807
type_id: erratum- unit_key:
id: CESA-2011-1814
type_id: erratum- unit_key:
id: CESA-2011-1815
type_id: erratum- unit_key:
id: CESA-2011-1819
type_id: erratum- unit_key:
id: CESA-2011-1821
type_id: erratum- unit_key:
id: CESA-2011-1849
type_id: erratum- unit_key:
id: CESA-2011-1852
type_id: erratum- unit_key:
id: CESA-2012-0018
type_id: erratum- unit_key:
id: CESA-2012-0019
type_id: erratum- unit_key:
id: CESA-2012-0050
type_id: erratum- unit_key:
id: CESA-2012-0052
type_id: erratum- unit_key:
id: CESA-2012-0058
type_id: erratum- unit_key:
id: CESA-2012-0059
type_id: erratum- unit_key:
id: CESA-2012-0062
type_id: erratum- unit_key:
id: CESA-2012-0069
type_id: erratum- unit_key:
id: CESA-2012-0079
type_id: erratum- unit_key:
id: CESA-2012-0080
type_id: erratum- unit_key:
id: CESA-2012-0093
type_id: erratum- unit_key:
id: CESA-2012-0095
type_id: erratum- unit_key:
id: CESA-2012-0105
type_id: erratum- unit_key:
id: CESA-2012-0128
type_id: erratum- unit_key:
id: CESA-2012-0135
type_id: erratum- unit_key:
id: CESA-2012-0136On Thursday, April 16, 2015 at 7:45:25 AM UTC+1, marc_...@trimble.com > wrote:
Hi Eric, Stephen, Seem to have run into a small problem. The errata imports successfully into Katello from CentOS and I can view the errata under content, I can also see the applicable hosts. However when I come to create a content view it completes but tells me there's 0 errata available. For example looking at the synced repository I can see there's 500 errata available, going to content->errata I can then see it all like I mentioned above, but just won't copy over into the content view. I can look at a host that's attached to the content view and it shows no errata, but if I switch the view to Library/Synced content it'll show all the errata available. This is also the same for Amazon Linux. I can get the amazon repository into katello but when I come to putting this into a content view all the errata disappears and I'm left with just the packages. I can then attempt to create a filter that's by errata ID. All the errata is listed to add but as soon as I add the errata and publish I get 0 errata and 0 packages. This is the same for both Amazon Linux and CentOS. Thanks Marc–
You received this message because you are subscribed to the Google
Groups “Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send
an email to foreman-users+unsubscribe@googlegroups.com
mailto:foreman-users+unsubscribe@googlegroups.com.
To post to this group, send email to foreman-users@googlegroups.com
mailto:foreman-users@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.
Hi Justin,
Looks like the script needs a little work, this is what was generated for
CentOS as an example:
<filename>{'release': u'2.209.el6_2.1', 'version': u'0.12.1.2', 'arch':
u'x86_64', 'name': u'qemu-kvm-tools'
For Amazon Linux the filename is as below in the updateinfo.xml file:
<filename>Packages/httpd-devel-2.2.21-1.18.amzn1.i686.rpm</filename>
Do all the packages for all the errata need to exist in the repository?
As a full example, here's the output from amazon linux updateinfo:
><status="final" type="security"
version="1.4"><id>ALAS-2011-1</id><title>Amazon Linux AMI 2011.09 -
ALAS-2011-1: medium priority package update for httpd</title><issued
date="2011-09-27 22:46" /><updated date="2014-09-14 14:25"
/><severity>medium</severity><description>Package updates are available for
Amazon Linux AMI that fix the following vulnerabilities:
CVE-2011-3192:
A flaw was found in the way the Apache HTTP Server handled Range
HTTP headers. A remote attacker could use this flaw to cause httpd to use
an excessive amount of memory and CPU time via HTTP requests with a
specially-crafted Range header.
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64,
and 2.2.x through 2.2.19 allows remote attackers to cause a denial of
service (memory and CPU consumption) via a Range header that expresse
s multiple overlapping ranges, as exploited in the wild in August 2011, a
different vulnerability than CVE-2007-0086.
</description><references><reference
href="ERROR;
id="CVE-2011-3192" title="" type="cve" /><reference
href="https://rhn.redhat.com/errata/RHSA-2011:1245.html"
id="RHSA-2011:1245" title="" type="redhat"
/></references><pkglist><collection short="amazon-linux-ami"><name>Amazon
Linux AMI</name><package arch="i686" epoch="0" name="httpd-devel"
release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-devel-2.2.21-1.18.amzn1.i686.rpm</filename></package><package
arch="i686" epoch="0" name="httpd-debuginfo" release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-debuginfo-2.2.21-1.18.amzn1.i686.rpm</filename></package><package
arch="i686" epoch="0" name="httpd" release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-2.2.21-1.18.amzn1.i686.rpm</filename></package><package
arch="i686" epoch="0" name="httpd-tools" release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-tools-2.2.21-1.18.amzn1.i686.rpm</filename></package><package
arch="i686" epoch="1" name="mod_ssl" release="1.18.amzn1"
version="2.2.21"><filename>Packages/mod_ssl-2.2.21-1.18.amzn1.i686.rpm</filename></package><package
arch="x86_64" epoch="1" name="mod_ssl" release="1.18.amzn1"
version="2.2.21"><filename>Packages/mod_ssl-2.2.21-1.18.amzn1.x86_64.rpm</filename></package><package
arch="x86_64" epoch="0" name="httpd-tools" release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-tools-.2.21-1.18.amzn1.x86_64.rpm</filename></package><package
arch="x86_64" epoch="0" name="httpd" release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-2.2.21-1.18.amzn1.x86_64.rpm</filename></package><package
arch="x86_64" epoch="0" name="httpd-devel" release="1.18.
amzn1"
version="2.2.21"><filename>Packages/httpd-devel-2.2.21-1.18.amzn1.x86_64.rpm</filename></package><package
arch="x86_64" epoch="0" name="httpd-debuginfo" release="1.18.amzn1"
version="2.2.21"><filename>Package
s/httpd-debuginfo-2.2.21-1.18.amzn1.x86_64.rpm</filename></package><package
arch="noarch" epoch="0" name="httpd-manual" release="1.18.amzn1"
version="2.2.21"><filename>Packages/httpd-manual-2.2.21-1.18.amzn1.noarch.
rpm</filename></package></collection></pkglist></update>
Here's some more output from the Centos updateinfo file:
<update from="you@your_domain.com" status="stable" type="security"
version="1.4"><id>CESA-2011-1777</id><issued date="2011-12-22 10:54:26"
/><reboot_suggested>False</reboot_suggested><title>Important CentOS
qemu-kvm Update</t
><release>CentOS 6</release><description>Important CentOS qemu-kvm
Update</description><severity>Important</severity><references><reference
href="https://rhn.redhat.com/errata/RHSA-2011-1777.html" id="" title=""
type="self" /></references><pkglist><collection short="EL-6"><name>CentOS
6</name><package arch="x86_64" epoch="0" name="qemu-img"
release="2.209.el6_2.1" src="" version="0.12.1.2"><filename>{'release':
u'2.209.el6_2.1', 'version': u' 0.12.1.2', 'arch': u'x86_64', 'name':
u'qemu-img'}</filename><reboot_suggested>False</reboot_suggested></package><package
arch="src" epoch="0" name="qemu-kvm" release="2.209.el6_2.1" src=""
version="0.12.1.2"><filename>{'release': u'2.209.el6_2.1', 'version':
u'0.12.1.2', 'arch': u'src', 'name':
u'qemu-kvm'}</filename><reboot_suggested>False</reboot_suggested></package><package
arch="x86_64" epoch="0" name="qemu-kvm" release="2.209.el6_2.1" src=" "
version="0.12.1.2"><filename>{'release': u'2.209.el6_2.1', 'version':
u'0.12.1.2', 'arch': u'x86_64', 'name':
u'qemu-kvm'}</filename><reboot_suggested>False</reboot_suggested></package><package
arch="x86_64" epoch="0" name="qemu-kvm-tools" release="2.209.el6_2.1"
src="" version="0.12.1.2"><filename>{'release': u'2.209.el6_2.1',
'version': u'0.12.1.2', 'arch': u'x86_64', 'name':
u'qemu-kvm-tools'}</filename><reboot_suggested>False</reboot_sugges
On Thursday, April 16, 2015 at 2:14:53 PM UTC+1, mfar...@gmail.com wrote:
Hi Justin,
Looks like the script needs a little work, this is what was generated for
CentOS as an example:{‘release’: u’2.209.el6_2.1’, ‘version’: u’0.12.1.2’, ‘arch’:
u’x86_64’, ‘name’: u’qemu-kvm-tools’For Amazon Linux the filename is as below in the updateinfo.xml file:
Packages/httpd-devel-2.2.21-1.18.amzn1.i686.rpm
Do all the packages for all the errata need to exist in the repository?
On Thursday, April 16, 2015 at 2:07:43 PM UTC+1, jsherril wrote:
On 04/16/2015 08:51 AM, mfar...@gmail.com wrote:
It looks like the job to PurgeEmptyErrata is kicking in when I promote
the repository to a content view. I can see information such as the below.
This happens for CentOS and also for Amazon Linux.This task is expecting the errata to define ‘filenames’ of all the
packages in each errata. Can you check the errata structure your scripts
are generating and see if the filenames exist?-Justin
pulp_tasks:
- exception:
task_type:
pulp.server.managers.repo.unit_association.unassociate_by_criteria
_href: /pulp/api/v2/tasks/25d069fc-471c-4522-8692-e7c97a5b1337/
task_id: 25d069fc-471c-4522-8692-e7c97a5b1337
tags:
- pulp:repository:THS_IPSWICH-CentOS-3_0-CentOS-CentOS6_Updates
- pulp:action:unassociate
finish_time: ‘2015-04-09T14:05:35Z’
_ns: task_status
start_time: ‘2015-04-09T14:05:35Z’
traceback:
spawned_tasks:
progress_report: {}
queue: reserved_resource_worker-1@xxxxx
state: finished
result:
units_successful:
- unit_key:
id: CESA-2011-1777
type_id: erratum- unit_key:
id: CESA-2011-1780
type_id: erratum- unit_key:
id: CESA-2011-1790
type_id: erratum- unit_key:
id: CESA-2011-1791
type_id: erratum- unit_key:
id: CESA-2011-1801
type_id: erratum- unit_key:
id: CESA-2011-1807
type_id: erratum- unit_key:
id: CESA-2011-1814
type_id: erratum- unit_key:
id: CESA-2011-1815
type_id: erratum- unit_key:
id: CESA-2011-1819
type_id: erratum- unit_key:
id: CESA-2011-1821
type_id: erratum- unit_key:
id: CESA-2011-1849
type_id: erratum- unit_key:
id: CESA-2011-1852
type_id: erratum- unit_key:
id: CESA-2012-0018
type_id: erratum- unit_key:
id: CESA-2012-0019
type_id: erratum- unit_key:
id: CESA-2012-0050
type_id: erratum- unit_key:
id: CESA-2012-0052
type_id: erratum- unit_key:
id: CESA-2012-0058
type_id: erratum- unit_key:
id: CESA-2012-0059
type_id: erratum- unit_key:
id: CESA-2012-0062
type_id: erratum- unit_key:
id: CESA-2012-0069
type_id: erratum- unit_key:
id: CESA-2012-0079
type_id: erratum- unit_key:
id: CESA-2012-0080
type_id: erratum- unit_key:
id: CESA-2012-0093
type_id: erratum- unit_key:
id: CESA-2012-0095
type_id: erratum- unit_key:
id: CESA-2012-0105
type_id: erratum- unit_key:
id: CESA-2012-0128
type_id: erratum- unit_key:
id: CESA-2012-0135
type_id: erratum- unit_key:
id: CESA-2012-0136On Thursday, April 16, 2015 at 7:45:25 AM UTC+1, marc_...@trimble.com >> wrote:
Hi Eric, Stephen,
Seem to have run into a small problem. The errata imports successfully
into Katello from CentOS and I can view the errata under content, I can
also see the applicable hosts. However when I come to create a content view
it completes but tells me there’s 0 errata available. For example looking
at the synced repository I can see there’s 500 errata available, going to
content->errata I can then see it all like I mentioned above, but just
won’t copy over into the content view.I can look at a host that’s attached to the content view and it shows no
errata, but if I switch the view to Library/Synced content it’ll show all
the errata available.This is also the same for Amazon Linux. I can get the amazon repository
into katello but when I come to putting this into a content view all the
errata disappears and I’m left with just the packages. I can then attempt
to create a filter that’s by errata ID. All the errata is listed to add but
as soon as I add the errata and publish I get 0 errata and 0 packages. This
is the same for both Amazon Linux and CentOS.Thanks
Marc
–
You received this message because you are subscribed to the Google Groups
“Foreman users” group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-user...@googlegroups.com.
To post to this group, send email to forema...@googlegroups.com.
Visit this group at http://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.
OK found another problem. Script will need a little longer to fix than I
thought.
Hadn't realised that Katello must have all the packages listed in an errata
for it to be available in a content view. Looks like the script places .el7
and .el5 packages in the filelists of the updateinfo.xml file so katello
will purge these as empty erratas. I'll get those removed and I think it'll
work after that.
Thanks
Marc
Hmm. I'm about to leave work, but it works for us with no major changes.
We run Foreman 1.15.3 and Katello 3.4.5
L.
------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic
civics is the insistence that we cannot ignore the truth, nor should we
panic about it. It is a shared consciousness that our institutions have
failed and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "
*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857
On 6 September 2017 at 05:49, Jon Dison <jon....@gmail.com <javascript:>> > wrote:
Instructions look solid to me but when I run it I get
NOTICE: Skipping errata CESA-2017:2563 (Moderate CentOS openssh Security
Update) -- No packages found
for every errata. Any ideas?
On Friday, June 19, 2015 at 3:14:44 AM UTC-4, Rodrigo Menezes wrote:
Not sure if anyone is interested or not but I created this:
It's poor code, but it's working for me. Only tested with 2.2 and very
little testing at that.
--
You received this message because you are subscribed to the Google Groups
"Foreman users" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to foreman-user...@googlegroups.com <javascript:>.
To post to this group, send email to forema...@googlegroups.com
<javascript:>.
Visit this group at https://groups.google.com/group/foreman-users.
For more options, visit https://groups.google.com/d/optout.
Hello Rodrigo,
I was going through a similar issue and saw your Script
Imports CentOS – On GitHub.
I was wondering, have you written something similar for python.
Hello,
I am using
Works great for us.