Bug 1049989

Description of problem:
oscap-anaconda-addon:
  https://fedorahosted.org/oscap-anaconda-addon/

provides capability to specify SCAP content to be used for system installation configuration when performing the Fedora OS install.

After a customized Fedora compose / boot.iso is created, and that install image is used for system installation, oscap-anaconda-addon presents new SECURITY section.

After click on the section, display to retrieve desired SCAP content (RPM or datastream) is presented. After entering the SCAP content URI, and clicking 'Fetch' button, a

"An unknown error has occurred"

  error message dialog with FetchError exception details is presented (detailing further information why the fetch actually failed).

The proposal is to get rid of raising FetchError message completely in case remote SCAP data retrieval failed, display error label above the SCAP content URI, and return back to the content retrieval dialog.

Version-Release number of selected component (if applicable):
oscap-anaconda-addon-0.3-1.fc20

How reproducible:
Always

Steps to Reproduce:
1. Boot customized Fedora install image / boot.iso with oscap-anaconda-addon Anaconda addon included.
2. During installation click on the 'SECURITY' section.
3. Provide invalid / un-resolvable SCAP content URI

Actual results:
Python traceback (An unknown error has occured) dialog is displayed, and whole installation needs to be aborted and retried.

Expected results:
FetchError message / exception is not raised. When the SCAP content / data retrieval fails, particular exception message (reason of the failure) is displayed in the label above the SCAP content URI and whole installation process control is returned back to the function expecting user to provide URI for remote SCAP content.

Additional info:
Current implementation of (/usr/share/anaconda/addons/org_fedora_oscap/data_fetch.py):

       96 def _fetch_http_data(url, out_file, ca_certs=None):

looks like the following (problem irrelevant code parts skipped for brevity):

    140     try:
    141         with open(out_file, "w") as fobj:
    142             curl.setopt(pycurl.WRITEDATA, fobj)
    143             curl.perform()
    144     except pycurl.error as err:
    145         # first arg is the error code
    146         if err.args[0] == pycurl.E_SSL_CACERT:
    147             msg = "Failed to connect to server and validate its "\
    148                   "certificate: %s" % err
    149             raise CertificateValidationError(msg)
    150         else:
    151             msg = "Failed to fetch data: %s" % err
    152             raise FetchError(msg)

So current implementation calls pycurl.Curl.perform() method to obtain the data. In case pycurl.error occurred in the attempt to retrieve them, FetchError (with underlying exception message) is raised further to Anaconda.

The proposal is to get rid of raising FetchError completely:

    152             raise FetchError(msg)

and instead of it, in case some error occurred when trying to retrieve SCAP data, originally invisible label, placed above the SCAP data URI location field would be:
1) made visible,
2) filed with the error message (from traceback) itself, so user can correct reason of the failure (for messages like "Could not resolve host: my.host.name") and retry the retrieval.
3) the SCAP content retrieval process control would be moved back to the point where providing SCAP content URI is expected.

Advantage to the end user:
--------------------------
In case of above proposal being implemented, the user would not need to abort the whole Anaconda install (like it is the case currently), and could fix the reason (set up proper DNS resolving) and retry to obtain the remote SCAP data.