/srv/irclogs.ubuntu.com/2022/06/17/#ubuntu-security.txt

bittinnew podcast today?06:32
amurrayhey bittin - yep, I have just finished recording it in fact - will need a bit more time to edit it and publish it so expect something in an hour or two 😉06:51
bittinalright :)06:51
bittinlistening now10:15
ahasenackhi security, we have an FTBFS of mariadb-10.6 in jammy14:29
ahasenackuploading a fix just because of that might not be optimal for jammy users (restarting a db post-upgrade)14:30
ahasenackbut if you ever decide to do a security release, you will hit the problem14:30
ahasenackwhat's the best way to deal with this? Use a block proposed tag?14:30
ahasenack(and the ftbfs is only in launchpad, which is using a focal kernel as a base)14:38
ahasenackif you boot jammy, and rebuild it there, it will work14:38
ahasenackproblem is jammy with a focal kernel, which is what is used in the launchpad builders, ppas inclluded14:38
ahasenackso even less likely to be hit by users I think14:39
mdeslaurahasenack: yeah, a block in proposed seems reasonable14:43
mdeslaurahasenack: or just ping otto who usually does the mariadb updates that we sponsor14:43
ahasenackthe fix is included in the debian package already14:46
ahasenack(even though it only affects ubuntu)14:47
ahasenackbut does otto also do SRUs?14:47
ahasenackmdeslaur: ^14:49
mdeslaurI don't know if he does SRUs...filing a bug about it with a pointer to a patch is fine too, either we'll find it or he will14:55
mdeslaurahasenack: ^14:57
ahasenackoh, the bug exists14:57
ahasenackI'll go with the block proposed tag14:57
ahasenackam also waiting for one affected user to come back and say what exactly is his scenario14:57
mdeslaursounds good14:58
fricklerahasenack: the scenario is running mariadb in a docker container with jammy on a host running focal. this is part of migrating a kolla openstack deployment from focal to jammy. one could discuss whether updating the host first could be required to avoid this issue17:43
ahasenackfrickler: but I didn't see the bug happening with the current mariadb-server from jammy17:45
ahasenackfrickler: I tried with a jammy lxd on top of a focal host, thus the focal kernel17:45
ahasenackwhich should be very much like what you are describing17:45
ahasenackit did happen with the -3 release that was in jammy for a while, before the release17:45
ahasenackbut not with 2ubuntu1 which is in jammy now, unless I made a mistake17:45
fricklerahasenack: https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_bd5/839585/23/check/kolla-ansible-ubuntu-source/bd5a051/primary/logs/kolla/mariadb/mariadb.txt17:48
fricklerServer version: 10.6.7-MariaDB-2ubuntu1-log17:49
ahasenackfrickler: do you build that docker image?17:54
ahasenackor is it someone elses?17:54
ahasenackbecause if mariadb 2ubuntu1 is rebuilt on jammy, it will hit the bug17:55
ahasenackthe build process runs tests, and these tests fail, so you won't get a package out of it, unless the tests are skipped17:56
ahasenackfrickler: I guess I'm asking if the dockerfile rebuilds mariadb before putting it in the image, or just grabs the built package from ubuntu jammy17:57
fricklerahasenack: the latter, the build log is also there https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_bd5/839585/23/check/kolla-ansible-ubuntu-source/bd5a051/primary/logs/build/mariadb-server.log18:06
fricklerthose are upstream ubuntu pkgs just fetched from a local mirror18:06
* ahasenack scratches head18:07
ahasenackmaybe there is something wrong in my test case, let me run it again, carefully18:08
ahasenackfrickler: thanks for the data18:08
fricklerahasenack: sure thing, let me know if I can test something on our end18:09
ahasenackfrickler: well, this ppa has a build with the fix: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4871/+packages, for jammy18:11
ahasenackit might not be all published yet, it's waiting on riscv6418:11
ahasenackbut individual debs can certainly be downloaded18:11
fricklerahasenack: o.k., it's late here, will test tomorrow18:12
ahasenacknp18:13
ahasenackif you don't mind, I'll add your links (logs) to the bug18:13
fricklersure, just note that they'll expire after 30 days, so copy anything you want to keep for longer18:13
ahasenackah, reproduced it18:24
ahasenackcool, that makes it all simpler18:24

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!