- Devel - libvirt List Archives

Re: download.libvirt.org HTTPS certificate expired causing download failures
by Daniel P. Berrangé 18 Jul '25

18 Jul '25

On Fri, Jul 18, 2025 at 10:36:53AM +0000, Song, Jiaying (CN) wrote: > Hello libvirt team, > > I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. > > This causes download failures in automated builds and package fetching processes. For example, wget reports: > > wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz > ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': > Issued certificate has expired. > > Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? > > Thank you very much for your help! FYI, we connected on IRC and I got this sorted out. It was a result of us having to move to a new physical server on short notice a few weeks ago, combined with an OS upgrade from RHEL 7 to 9. We copied the certs, but failed to setup acme-tiny again on the new machine to renew them. In 3 months time we'll find out if I got the acme-tiny config correct, so if anyone notices problems at that time let me know.... With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

[PATCH 0/7] tls: Improve validation of certificates if multiple certs are concatenated in one file
by Peter Krempa 18 Jul '25

18 Jul '25

Our code handled properly only multiple CA certs in one file. This patch extends the validation also to multiple client/server certs in one file. Peter Krempa (7): rpc: virnettlscontext: Fix formatting of function definitions virNetTLSContextNewPath: Refactor temporary variable usage virNetTLSCertCheckPair: Fix function definition formatting rpc: virnettlscert: Rename virNetTLSCertLoadCAListFromFile to virNetTLSCertLoadListFromFile virPKIValidateIdentity: Validate all concatenated certificates virNetTLSCertSanityCheck: Validate all concatenated certs Remove unused 'virNetTLSCertLoadFromFile' src/rpc/virnettlscert.c | 94 ++++++++++++-------------------------- src/rpc/virnettlscert.h | 6 ++- src/rpc/virnettlscontext.c | 89 +++++++++++++++++------------------- tools/virt-pki-validate.c | 20 ++++++-- 4 files changed, 90 insertions(+), 119 deletions(-) -- 2.50.0

2 16

download.libvirt.org HTTPS certificate expired causing download failures
by Song, Jiaying (CN) 18 Jul '25

18 Jul '25

Hello libvirt team, I am a user trying to fetch packages from https://download.libvirt.org/, but I encountered an issue where the HTTPS certificate issued by Let's Encrypt (CN=R10) appears to have expired. This causes download failures in automated builds and package fetching processes. For example, wget reports: wget https://download.libvirt.org/python/libvirt-python-11.1.0.tar.gz ERROR: cannot verify download.libvirt.org's certificate, issued by 'CN=R10,O=Let's Encrypt,C=US': Issued certificate has expired. Could you please update or renew the TLS certificate for download.libvirt.org at your earliest convenience to avoid further disruptions? Thank you very much for your help! Best regards, Jiaying.

1 0

[PATCH 0/6] Make virConnectBaselineHypervisorCPU a bit more sane
by Jiri Denemark 18 Jul '25

18 Jul '25

See 2/6 for description of the issue this series is trying to deal with. Jiri Denemark (6): cpu: Show input CPU model names in debug log Clarify documentation of virConnectBaselineHypervisorCPU Change documentation style of virConnectBaselineCPUFlags Introduce VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag qemu: Implement VIR_CONNECT_BASELINE_CPU_IGNORE_HOST virsh: Add support for VIR_CONNECT_BASELINE_CPU_IGNORE_HOST flag docs/manpages/virsh.rst | 20 +++++++++++++++----- include/libvirt/libvirt-host.h | 9 +++++++-- src/cpu/cpu.c | 2 +- src/libvirt-host.c | 30 +++++++++++++++++++++--------- src/qemu/qemu_driver.c | 30 +++++++++++++++++++++--------- tools/virsh-host.c | 8 ++++++++ 6 files changed, 73 insertions(+), 26 deletions(-) -- 2.50.0

3 9

[PATCH] src: fix typo in fixup_name()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Similar branches in the if-else structure look like bad copy-paste. Fix the typo. Fixes: a559ffec44 (src: rewrite ACL rule checker in Python) Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- scripts/check-aclrules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check-aclrules.py b/scripts/check-aclrules.py index ed6805058b..13aed99243 100755 --- a/scripts/check-aclrules.py +++ b/scripts/check-aclrules.py @@ -88,7 +88,7 @@ def fixup_name(name): elif name.endswith("Mac"): name = name[:-3] + "MAC" elif name.endswith("Cpu"): - name = name[:-3] + "MAC" + name = name[:-3] + "CPU" elif name.endswith("Os"): name = name[:-2] + "OS" elif name.endswith("Nmi"): -- 2.39.2

2 1

[PATCH v2 0/5] bhyve: TCP console support
by Roman Bogorodskiy 17 Jul '25

17 Jul '25

Changes since v1: I misunderstood semantics of the 'mode' attribute of the <source> element, and used 'connect' while I should have used 'bind', because bhyve listens on the TCP socket and client connects to using using netcat (or any other similar tool). Now it's using the 'bind' value. Other changes: added validation to bhyve_domain.c, and unified error messages used in bhyve_command.c and bhyve_domain.c Roman Bogorodskiy (5): bhyve: support serial type 'tcp' bhyve: increase number of supported consoles to 4 docs: drvbhyve: document TCP console support bhyve: validate serial devices validation bhyve: sync error messages docs/drvbhyve.rst | 19 ++++++ src/bhyve/bhyve_capabilities.c | 3 +- src/bhyve/bhyve_command.c | 42 +++++++++----- src/bhyve/bhyve_domain.c | 27 +++++++++ .../bhyvexml2argv-4-consoles.args | 15 +++++ .../bhyvexml2argv-4-consoles.ldargs | 4 ++ .../bhyvexml2argv-4-consoles.xml | 35 +++++++++++ .../bhyvexml2argv-serial-invalid-port.args | 12 ++++ .../bhyvexml2argv-serial-invalid-port.ldargs | 4 ++ .../bhyvexml2argv-serial-invalid-port.xml | 28 +++++++++ .../bhyvexml2argv-serial-tcp.args | 12 ++++ .../bhyvexml2argv-serial-tcp.ldargs | 4 ++ .../bhyvexml2argv-serial-tcp.xml | 27 +++++++++ tests/bhyvexml2argvtest.c | 3 + .../bhyvexml2xmlout-4-consoles.xml | 58 +++++++++++++++++++ .../bhyvexml2xmlout-serial-tcp.xml | 46 +++++++++++++++ tests/bhyvexml2xmltest.c | 2 + tests/domaincapsdata/bhyve_basic.x86_64.xml | 1 + tests/domaincapsdata/bhyve_fbuf.x86_64.xml | 1 + tests/domaincapsdata/bhyve_uefi.x86_64.xml | 1 + 20 files changed, 328 insertions(+), 16 deletions(-) create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-4-consoles.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-invalid-port.xml create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.args create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.ldargs create mode 100644 tests/bhyvexml2argvdata/bhyvexml2argv-serial-tcp.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-4-consoles.xml create mode 100644 tests/bhyvexml2xmloutdata/bhyvexml2xmlout-serial-tcp.xml -- 2.49.0

2 8

[PATCH] virshFindDisk: fix NULL-dereference of xmlCopyNode() result
by Anastasia Belova 17 Jul '25

17 Jul '25

xmlCopyNode() may return NULL. Add a check and log an error in this case. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 22766a1a53 ("virshFindDisk: Sanitize use of 'tmp' variable") Signed-off-by: Anastasia Belova <abelova(a)astralinux.ru> --- tools/virsh-domain.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 7253596f4a..8752294784 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -12875,6 +12875,10 @@ virshFindDisk(const char *doc, STREQ_NULLABLE(sourceDir, path) || STREQ_NULLABLE(sourceName, path)) { xmlNodePtr ret = xmlCopyNode(nodes[i], 1); + if (!ret) { + vshError(NULL, "%s", _("Failed to copy node")); + return NULL; + } /* drop backing store since they are not needed here */ virshDiskDropBackingStore(ret); return ret; -- 2.43.0

3 2

[PATCH] network: fix memory leak in networkAddFirewallRules()
by Elizaveta Tereshkina 17 Jul '25

17 Jul '25

Add g_clear_pointer() to networkAddFirewallRules() after using virSetError() to free errInitV4 and errInitV6 to avoid memory leaks. Fixes: ef760a4133 (Revert "network: support setting firewalld zone for bridge device of open networks") Signed-off-by: Elizaveta Tereshkina <etereshkina(a)astralinux.ru> --- src/network/bridge_driver_linux.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 86f6a5915f..93d4d2c8ee 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -413,6 +413,7 @@ networkAddFirewallRules(virNetworkDef *def, (virNetworkDefGetIPByIndex(def, AF_INET, 0) || virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { virSetError(errInitV4); + g_clear_pointer(&errInitV4, virFreeError); return -1; } @@ -421,6 +422,7 @@ networkAddFirewallRules(virNetworkDef *def, virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || def->ipv6nogw)) { virSetError(errInitV6); + g_clear_pointer(&errInitV6, virFreeError); return -1; } -- 2.39.2

2 1

[PATCH 0/2] Introduce hardware UUID (hwuuid) element
by Mark Cave-Ayland 17 Jul '25

17 Jul '25

Following on from the discussions at [1] and more recently [2], this series introduces a new hardware UUID (hwuuid) element that allows an external UUID to be provided to the guest, as opposed to the libvirt domain UUID. The use case for this feature is to allow a domain to cloned and then restarted without changing its guest-visible UUID e.g. via dmidecode. Patch 1 introduces the new hardware UUID (hwuuid) element along with an implementation for the QEMU driver, whilst patch 2 adds additional tests to ensure the hwuuid functionality is working as expected. Note that from reading the source it doesn't appear as if all virtualisation platforms will support this feature: I've included the relevant changes for the QEMU driver since that is what we use here at Nutanix. Signed-off-by: Mark Cave-Ayland <mark.caveayland(a)nutanix.com> [1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/YXN2… [2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/HGFT… Mark Cave-Ayland (2): conf: introduce hardware UUID (hwuuid) element qemuxmlconftest: add tests for new hardware UUID (hwuuid) element docs/formatdomain.rst | 7 ++++ src/conf/domain_conf.c | 38 +++++++++++++++-- src/conf/domain_conf.h | 1 + src/conf/schemas/domaincommon.rng | 5 +++ src/qemu/qemu_command.c | 6 ++- ...hwuuid-smbios-uuid-match.x86_64-latest.err | 1 + .../hwuuid-smbios-uuid-match.xml | 36 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.args | 35 ++++++++++++++++ .../qemuxmlconfdata/hwuuid.x86_64-latest.xml | 41 +++++++++++++++++++ tests/qemuxmlconfdata/hwuuid.xml | 30 ++++++++++++++ tests/qemuxmlconftest.c | 3 ++ 11 files changed, 199 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/hwuuid-smbios-uuid-match.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/hwuuid.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/hwuuid.xml -- 2.43.0

2 4

[RFC PATCH 0/6] Fix building of sparc/sparc32plus test cases
by Alex Bennée 17 Jul '25

17 Jul '25

We didn't have any reliable way to build sparc test cases. I have found someone who ships a compiler but the binaries still don't run due to the need for CASA. I'm posting mainly for those who actually care who might want to fix up the remaining cases. Alex. Alex Bennée (6): tests/tcg: special case sparc test cases tests/tcg: special case sparc32plus test cases configure: update sparc and sparc32plus target compiler detection tests/docker: add sparc-leon-cross container image configure: enable the container fallbacks for sparc/sparc32plus docs/about: deprecate add sparc/sparc32plus-*-user docs/about/deprecated.rst | 8 ++++ configure | 11 ++++- .../dockerfiles/sparc-leon-cross.docker | 40 +++++++++++++++++ tests/tcg/Makefile.target | 9 ++-- tests/tcg/sparc/Makefile.target | 45 +++++++++++++++++++ tests/tcg/sparc32plus | 1 + 6 files changed, 108 insertions(+), 6 deletions(-) create mode 100644 tests/docker/dockerfiles/sparc-leon-cross.docker create mode 100644 tests/tcg/sparc/Makefile.target create mode 120000 tests/tcg/sparc32plus -- 2.47.2

3 9