Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #59721 > unrolled thread

Xen packaging in Debian

Back to article view | Back to linux.debian.kernel

Contents

  Xen packaging in Debian Hans van Kranenburg <hans@knorrie.org> - 2017-12-22 02:20 +0100
    Re: Xen packaging in Debian - Progress update Hans van Kranenburg <hans@knorrie.org> - 2018-01-09 23:10 +0100
      Xen security update [was: Re: [Pkg-xen-devel] Xen packaging in Debian - Progress update] Wolodja Wentland <debian@babilen5.org> - 2018-01-10 09:00 +0100
        Re: Xen security update [was: Re: [Pkg-xen-devel] Xen packaging in  Debian - Progress update] Hans van Kranenburg <hans@knorrie.org> - 2018-01-10 10:40 +0100

#59721 — Xen packaging in Debian

To: Debian xen and kernel team list, Ian Jackson
Cc: Stefan Bader, maintainer of xen packages in Ubuntu

Hi all,

Short version: Hi! I'd like to help with the Xen packaging in Debian.

Long version:

Q: Who are you? How are you related to Debian an the Xen project?
A: Hi, I'm Hans van Kranenburg, nickname Knorrie, I live in the
Netherlands. I'm a Debian user since 2002, and have been using Debian
and Xen at work (Mendix) since 2006, which has grown from a handful
dom0s with 4GiB memory each to a bunch of clusters with let's say
somewhere between 10TiB and 20TiB of physical memory in the dom0s
together, running a production environment for customer application hosting.

My general interests are filesystems and networking and I like
programming in Python. At work, we've been maintaining our own debian
repository for many years, with our own packages, changed Debian
packages and custom backports, which caused me to pick up some Debian
packaging skills along the way.

Q: And why the sudden interest?
A: Some problems we ran into in the last year+ caused me to have a
better look at the Xen releases and the packages in Debian.

The situation I ran into is best described as: "Wait... I'm running a
Xen version from Debian Stable (at the time of realizing that's Jessie)
that was released before the type of hardware I have here was invented
and manufactured, it's out of support and out of security support
upstream and I'm surprised weird things are going on?" Maybe we should
reverse this a bit and see if we can keep up to date with Xen stable
releases that know about certain quirks of the hardware.

The sad part is that I quickly discovered the xen packages aren't really
actively maintained in Debian. Luckily we got a newer version in Stretch
just before the freeze and currently Ian Jackson is keeping everything
on life support (thanks!!). Current packaging is not tracked in version
control (well, not on a level of granularity that I would deem
acceptable) and the contents are being changed based on unpacking the
previous upload and changing old generated files in place, disregarding
the way how the package was set up in the past (which is quite similar
to how the linux kernel packaging for Debian works).

Q: So, let's sit in a corner and cry?
A: No, we can do better. A few days ago I started reaching out to see if
I could find members of the Xen team and ended up talking to Ian Jackson
in #debian-kernel. He encouraged me to take a further look and was
immediately available to help and answer any questions I would have.

What I did in the last few days is basically clean up the packaging to
get it back to a state where it's usable again. So, move the packaging
back to git, import the latest release and then fix enough things to be
able to at least produce new security updates for Stretch and get a
newer package into unstable.

I uploaded the work it to github [0] for now. It can be moved anywhere
else later. I tend to write things in commit messages, so please have a
look.

Besides preparing a new version for stretch-security as an example, I
moved the packaging forward to Xen 4.9, by taking the relevant changes
done by Stefan Bader in Ubuntu (thanks!!) and merge them back into the
packaging.

I (smoke)tested the resulting packages in my test environment at work.
To be able to properly test I put them in a repository at [1].

Note that I'm not a Debian Maintainer (yet). I do have packages in
Debian with my work on btrfs, the uploads are sponsored by Adam
Borowski. [2]

I guess that it'd be good to finally take the step to apply for Debian
Maintainer status when starting to work on low level security sensitive
packages like this. Luckily, we have a Debian keysigning party in the
next days in The Netherlands, so I have a quick opportinity to get
things in order. :]

I have already identified quite a few topics I'd like to discuss next,
but, let's take it one step at a time, I typed enough already here. :)

Regards,
Hans van Kranenburg

[0] https://github.com/knorrie/debian-xen/
[1] https://packages.knorrie.org/xen/debian/pool/main/x/xen/
[2] https://qa.debian.org/developer.php?login=hans%40knorrie.org

[toc] | [next] | [standalone]

#59926 — Re: Xen packaging in Debian - Progress update

[Multipart message — attachments visible in raw view] — view raw

Hi,

On 12/22/2017 02:01 AM, Hans van Kranenburg wrote:
> To: Debian xen and kernel team list, Ian Jackson

I'm replying to my own email, since there has not been a reply on the
lists to it yet.

For Ian Jackson: There's a question for you below (section "Moving
packaging repository"), can you please answer that.

== Whaaaaat's happening? (skip this section if you're busy) ==

Three weeks ago, when I started working on this, I didn't remotely know
what would happen on Jan 3, but I like the rollercoaster ride.

In the past days:
* ...I've been working to get the packaging moved on from 4.9 to Xen 4.10.
* ...I could help the kernel team a bit with handling xen-related
regression bugs that were reported on the updated linux packages.
* ...replied to a few other open Xen bugs.
* Moritz from the security team mailed me like "Hey! Did you get any
response on that email? What's gonna happen to xen?" and I told him what
was going on and that I'd like to help wherever I can.
* ...the #debian-xen IRC channel on OFTC has become active again, others
have been joining and offering more help, and we're discussing all kind
of things, about packaging, but also about upgrade tactics for any size
Xen cluster we're managing ourselves.

== Security update for Stretch ==

On IRC I got some questions about the already earlier released XSA
patches, which still aren't in Stretch.

Question for security team: If you want to have it, I've prepared an
update for in the mean time. [0] [1] [2]. I'm not a Maintainer yet, but
at least I have some GPG signatures of Debian Developers now. ;]

== Xen 4.10 ==

We're still all looking at upstream to find out what they're going to do
in the next days.

My gut feeling is that a not-neglectible part of users is looking into
upgrading to Xen 4.10 and Linux 4.14 in the domU. It would be really
great if Debian could have Xen 4.10 in testing and stretch-backports.

So, in the meantime I'm trying to get a proper Xen 4.10 package in order
for unstable. The build doesn't work completely yet, but if there's a
dpkg-shlibdeps expert around, maybe you can help. More info on IRC.

In general, If someone with more intimate knowledge of Xen can help
review the changes, always welcome, as well as beta-testers for new
packages.

== Moving packaging repository ==

It makes sense to get the cleaned up packaging code moved to a new
Debian Xen team owned repo at the new Debian Gitlab hosting.

Ian: Can you please ACK that it's ok if we go on with this and take
ownership to get it set up? Thanks.

== Thanks for your time ==

Regards,
Hans van Kranenburg

[0]
https://github.com/knorrie/debian-xen/commit/d3922c423010894d5badfc5381a7312b90715cbf

[1]
https://github.com/knorrie/debian-xen/releases/tag/debian%2F4.8.2%2Bxsa245-0%2Bdeb9u2

[2] https://syrinx.knorrie.org/~knorrie/xen/stretch-security/

[toc] | [prev] | [next] | [standalone]

#59928 — Xen security update [was: Re: [Pkg-xen-devel] Xen packaging in Debian - Progress update]

Hans van Kranenburg <hans@knorrie.org> writes:

> == Security update for Stretch ==
>
> On IRC I got some questions about the already earlier released XSA
> patches, which still aren't in Stretch.

It would be a lovely if a security upload that includes patches for the
following XSAs could be prepared, given that many people will reboot
their hypervisors these days:

- https://xenbits.xen.org/xsa/advisory-248.html
- https://xenbits.xen.org/xsa/advisory-249.html
- https://xenbits.xen.org/xsa/advisory-250.html
- https://xenbits.xen.org/xsa/advisory-251.html

These are all single patches that apply cleanly to 4.8 (with some fuzz)
and will have been deployed in locally built packages by many.

Thanks for all your efforts!
-- 
Wolodja <debian@babilen5.org>

4096R/CAF14EFC
081C B7CD FF04 2BA9 94EA  36B2 8B7F 7D30 CAF1 4EFC

[toc] | [prev] | [next] | [standalone]

#59931 — Re: Xen security update [was: Re: [Pkg-xen-devel] Xen packaging in Debian - Progress update]

On 01/10/2018 08:54 AM, Wolodja Wentland wrote:
> Hans van Kranenburg <hans@knorrie.org> writes:
> 
>> == Security update for Stretch ==
>>
>> On IRC I got some questions about the already earlier released XSA
>> patches, which still aren't in Stretch.
> 
> It would be a lovely if a security upload that includes patches for the
> following XSAs could be prepared, given that many people will reboot
> their hypervisors these days:
> 
> - https://xenbits.xen.org/xsa/advisory-248.html
> - https://xenbits.xen.org/xsa/advisory-249.html
> - https://xenbits.xen.org/xsa/advisory-250.html
> - https://xenbits.xen.org/xsa/advisory-251.html
> 
> These are all single patches that apply cleanly to 4.8 (with some fuzz)
> and will have been deployed in locally built packages by many.

Yes, that's what that whole section was about. See the links in my
previous message.

Got reply from security team: "Thanks, I'll get back to you end of week."

Hans

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web