July 2020 - Devel - libvirt List Archives

[PATCH] virnettlshelpers: Update private key
by Michal Privoznik 01 Jul '20

01 Jul '20

With the recent update of Fedora rawhide I've noticed virnettlssessiontest and virnettlscontexttest failing with: Our own certificate servercertreq-ctx.pem failed validation against cacertreq-ctx.pem: The certificate uses an insecure algorithm This is result of Fedora changes to support strong crypto [1]. RSA with 1024 bit key is viewed as legacy and thus insecure. Generate a new private key then. Moreover, switch to EC which is not only shorter but also not deprecated that often as RSA. Generated using the following command: openssl genpkey --outform PEM --out privkey.pem \ --algorithm EC --pkeyopt ec_paramgen_curve:P-384 \ --pkeyopt ec_param_enc:named_curve 1: https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2 Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- According to our CI all systems support ecliptic curves: https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/161932641 but maybe this should be merged only after the release? tests/virnettlshelpers.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/tests/virnettlshelpers.c b/tests/virnettlshelpers.c index e2b8e8359a..979afed307 100644 --- a/tests/virnettlshelpers.c +++ b/tests/virnettlshelpers.c @@ -47,22 +47,10 @@ extern const ASN1_ARRAY_TYPE pkix_asn1_tab[]; gnutls_x509_privkey_t privkey; # define PRIVATE_KEY \ "-----BEGIN PRIVATE KEY-----\n" \ - "MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALVcr\n" \ - "BL40Tm6yq88FBhJNw1aaoCjmtg0l4dWQZ/e9Fimx4ARxFpT+ji4FE\n" \ - "Cgl9s/SGqC+1nvlkm9ViSo0j7MKDbnDB+VRHDvMAzQhA2X7e8M0n9\n" \ - "rPolUY2lIVC83q0BBaOBkCj2RSmT2xTEbbC2xLukSrg2WP/ihVOxc\n" \ - "kXRuyFtzAgMBAAECgYB7slBexDwXrtItAMIH6m/U+LUpNe0Xx48OL\n" \ - "IOn4a4whNgO/o84uIwygUK27ZGFZT0kAGAk8CdF9hA6ArcbQ62s1H\n" \ - "myxrUbF9/mrLsQw1NEqpuUk9Ay2Tx5U/wPx35S3W/X2AvR/ZpTnCn\n" \ - "2q/7ym9fyiSoj86drD7BTvmKXlOnOwQJBAPOFMp4mMa9NGpGuEssO\n" \ - "m3Uwbp6lhcP0cA9MK+iOmeANpoKWfBdk5O34VbmeXnGYWEkrnX+9J\n" \ - "bM4wVhnnBWtgBMCQQC+qAEmvwcfhauERKYznMVUVksyeuhxhCe7EK\n" \ - "mPh+U2+g0WwdKvGDgO0PPt1gq0ILEjspMDeMHVdTwkaVBo/uMhAkA\n" \ - "Z5SsZyCP2aTOPFDypXRdI4eqRcjaEPOUBq27r3uYb/jeboVb2weLa\n" \ - "L1MmVuHiIHoa5clswPdWVI2y0em2IGoDAkBPSp/v9VKJEZabk9Frd\n" \ - "a+7u4fanrM9QrEjY3KhduslSilXZZSxrWjjAJPyPiqFb3M8XXA26W\n" \ - "nz1KYGnqYKhLcBAkB7dt57n9xfrhDpuyVEv+Uv1D3VVAhZlsaZ5Pp\n" \ - "dcrhrkJn2sa/+O8OKvdrPSeeu/N5WwYhJf61+CPoenMp7IFci\n" \ + "MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDD39t6GRLeEmsYjRGR6\n" \ + "iQiIN2S4zXsgLGS/2GloXdG7K+i/3vEJDt9celZ0DfCLcG6hZANiAAQTJIe13jy7\n" \ + "k4KTXMkHQHEJa/asH263JaPL5kTbfRa6tMq3DS3pzWlOj+NHY/9JzthrKD+Ece+g\n" \ + "2g/POHa0gfXRYXGiHTs8mY0AHFqNNmF38eIVGjOqobIi90MkyI3wx4g=\n" \ "-----END PRIVATE KEY-----\n" /* -- 2.26.2

2 2

[libvirt PATCH v3 0/1] cirrus: Add templates and refresh script
by Andrea Bolognani 01 Jul '20

01 Jul '20

This makes the Cirrus CI configurations as maintainable as the Dockerfiles, by shifting the responsability of keeping the list of dependencies and other details up to date to lcitool. Test pipeline: https://gitlab.com/abologna/libvirt/-/pipelines/161289292 For the refresh script to work, your copy of lcitool needs to include these patches: https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/30 Changes from [v2]: * 'lcitool dockerfile --variables' has been replaced with 'lcitool variables'. Changes from [v1]: * reduce duplication by only storing variables in the git repository and instantiating the template at runtime. [v2] https://www.redhat.com/archives/libvir-list/2020-June/msg01318.html [v1] https://www.redhat.com/archives/libvir-list/2020-June/msg01305.html Andrea Bolognani (1): cirrus: Generate jobs dynamically .gitlab-ci.yml | 36 ++++++++++++++- ci/cirrus/build.yml | 26 +++++++++++ ci/cirrus/freebsd-12.yml.j2 | 73 ------------------------------- ci/cirrus/libvirt-freebsd-12.vars | 7 +++ ci/cirrus/libvirt-macos-1015.vars | 7 +++ ci/cirrus/macos-1015.yml.j2 | 38 ---------------- ci/cirrus/refresh | 22 ++++++++++ 7 files changed, 97 insertions(+), 112 deletions(-) create mode 100644 ci/cirrus/build.yml delete mode 100644 ci/cirrus/freebsd-12.yml.j2 create mode 100644 ci/cirrus/libvirt-freebsd-12.vars create mode 100644 ci/cirrus/libvirt-macos-1015.vars delete mode 100644 ci/cirrus/macos-1015.yml.j2 create mode 100755 ci/cirrus/refresh -- 2.25.4

2 2

[PATCH 1/1] migration.html.in: fix 'Offline migration' description
by Daniel Henrique Barboza 01 Jul '20

01 Jul '20

'transfers inactive the definition of a domain' seems odd. Signed-off-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> --- docs/migration.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/migration.html.in b/docs/migration.html.in index 355f0e89af..e95ee9de6f 100644 --- a/docs/migration.html.in +++ b/docs/migration.html.in @@ -141,7 +141,7 @@ <h2><a id="offline">Offline migration</a></h2> <p> - Offline migration transfers inactive the definition of a domain + Offline migration transfers the inactive definition of a domain (which may or may not be active). After successful completion, the domain remains in its current state on the source host and is defined but inactive on the destination host. It's a bit more clever than -- 2.26.2

2 1

[PATCH 1/1] domain_conf.c: skip checking ZPCI address is incomplete if not present
by Daniel Henrique Barboza 01 Jul '20

01 Jul '20

Commit 076591009ad1 ("conf: fix zPCI address auto-generation on s390") is doing a check for virZPCIDeviceAddressIsIncomplete() prior to checking if the device has a ZPCI address at all. This results in errors like these when starting Libvirt: error : virDomainDeviceInfoFormat:7527 : internal error: Missing uid or fid attribute of zPCI address Fix it by moving virZPCIDeviceAddressIsIncomplete() after the check done by virZPCIDeviceAddressIsPresent(). Fixes: 076591009ad11ec108521b52a4945d0f895fa160 CC: Bjoern Walk <bwalk(a)linux.ibm.com> CC: Boris Fiuczynski <fiuczy(a)linux.ibm.com> CC: Shalini Chellathurai Saroja <shalini(a)linux.ibm.com> CC: Andrea Bolognani <abologna(a)redhat.com> Signed-off-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> --- src/conf/domain_conf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 31ba78b950..33f177b16f 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -7522,11 +7522,11 @@ virDomainDeviceInfoFormat(virBufferPtr buf, virTristateSwitchTypeToString(info->addr.pci.multi)); } - if (virZPCIDeviceAddressIsIncomplete(&info->addr.pci.zpci)) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Missing uid or fid attribute of zPCI address")); - } if (virZPCIDeviceAddressIsPresent(&info->addr.pci.zpci)) { + if (virZPCIDeviceAddressIsIncomplete(&info->addr.pci.zpci)) + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Missing uid or fid attribute of zPCI address")); + virBufferAsprintf(&childBuf, "<zpci uid='0x%.4x' fid='0x%.8x'/>\n", info->addr.pci.zpci.uid.value, -- 2.26.2

3 8