Bug 1211122

Summary: No closest mirror can be found from behind a proxy
Product: [Fedora] Fedora Reporter: A.J. Werkman <aj.werkman>
Component: anacondaAssignee: Brian Lane <bcl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 22CC: aj.werkman, anaconda-maint-list, awilliam, dgay, g.kaviyarasu, jonathan, pschindl, robatino, vanmeeuwen+fedora
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: RejectedBlocker
Fixed In Version: python-blivet-1.0.9-1.fc22 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-05-13 01:17:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Workstation mirrorlist error
none
Packaging.log
none
Program.log
none
ifcfg.log
none
Netinstall Server product
none
Packaging.log
none
Syslog
none
Program.log none

Description A.J. Werkman 2015-04-13 05:30:24 UTC 
Description of problem:
When installing in an environment, where internet connectivity depends on a proxy, 'closest mirror' does not work.

Version-Release number of selected component (if applicable):
22 Beta RC1

How reproducible:
Every time

Steps to Reproduce:
1. Installation context is where internet connectivity depends on a proxy and you have no repo tree on the boot media
2. Start the installation with a proxy defined on the kernel commandline
3. Use the defaults when anaconda gives you a choice

Actual results:
Anaconda tries to find mirror information and fails

Expected results:
Anaconda should find a mirror and use it as an instalation tree

Additional info:
This bug is the outcome of bug #1196953


 Seth Jennings 2015-04-09 14:52:12 EDT

A.J.,

I just tested proxy operation with Beta RC1 and it works for me.

From your packaging log:
> Failed to connect to mirrors.fedoraproject.org port 443: No route to host

It seems like you might not have network (or internet) connectivity.

[reply] [−] Comment 17 A.J. Werkman 2015-04-09 15:55:22 EDT

I already thought about that and checked. I do have network and nameserving functional. I tested this with a request for a local mirror. After your remark I retested with an url to dl.fedoraproject and find that proxy is working. IT looks like there is sommething wrong with the 'closest mirror' option in my test case.

[reply] [−] Comment 18 A.J. Werkman 2015-04-09 16:43:50 EDT

Can it be, that there is something wrong with the mirrorlist mechanism behind a proxy.
I see a curl error 'no route to host' and at the same time 'Ping mirroring.fedoraproject.org' resolves to an ip address. Obviously behind the proxy iT Will not ping and without proxy also curl Will fail.

Looks to me that the mirror request does not use the proxy settings.

[reply] [−] Comment 19 bcl 2015-04-10 19:00:54 EDT

The mirror list uses https. The mirrors themselves are all http. I don't think proxy will work like you expect unless you've turned off sslverify when using the mirror.
Comment 1 A.J. Werkman 2015-04-13 05:33:34 UTC 
Regarding comment #19:

I tried this using the anaconda boot option noverifyssl and it still fails.
Comment 2 A.J. Werkman 2015-04-13 05:39:03 UTC 
I propose this as a blocker following the QA:Testcase install repository Mirrorlist graphical criterion.
Comment 3 Adam Williamson 2015-04-13 07:21:08 UTC 
Is this something different from https://bugzilla.redhat.com/show_bug.cgi?id=1206472 ?

Alpha was already shipped, there is no point putting things on the Alpha blocker list.
Comment 4 A.J. Werkman 2015-04-13 09:54:32 UTC 
(In reply to awilliam from comment #3)
> Is this something different from
> https://bugzilla.redhat.com/show_bug.cgi?id=1206472 ?

Yes, bug 1206472 has been solved in my case. It was about the fact that packages could not be downloaded using a proxy.

This bug is about the retrival of the mirror list. At this moment everything goes well if I use a literal inst.repo. But if I want anaconda to found the best repo by querying the mirrolist I see a curl error 'no route to host' in the logs. I ruled out network failure and DNS issues. As far as I can think, this leaves the case that the retrieval of the mirror list is not directed to the proxy.
 
> Alpha was already shipped, there is no point putting things on the Alpha
> blocker list.
Ah, I put it in Alpha because it is an Alpha criterion.
Comment 5 Petr Schindler 2015-04-13 17:28:12 UTC 
Discussed at today's blocker review meeting [1].

This bug was rejected as Blocker - there seems to be a lot of grey area in this bug, lots of information we need from the reporter, but even in the worst possible case people seem inclined to fudge this with a CommonBugs note suggesting explicit repo configuration for Beta.

[1] http://meetbot.fedoraproject.org/fedora-blocker-review/2015-04-13/
Comment 6 A.J. Werkman 2015-04-13 18:34:44 UTC 
Created attachment 1014028 [details]
Workstation mirrorlist error

I use dd to put 22 Beta RC1 Workstation netinstall on a USB drive.

After booting into the bootloader I added repo=<url> to to command line and booted. After accepting the keyborad lay-out and entering in the main screen, anaconda gave an error on the repo screen. 

I enclose the logs.
Comment 7 A.J. Werkman 2015-04-13 18:35:14 UTC 
Created attachment 1014029 [details]
Packaging.log
Comment 8 A.J. Werkman 2015-04-13 18:35:42 UTC 
Created attachment 1014030 [details]
Program.log
Comment 9 A.J. Werkman 2015-04-13 18:36:22 UTC 
Created attachment 1014031 [details]
ifcfg.log
Comment 10 A.J. Werkman 2015-04-13 19:19:20 UTC 
Created attachment 1014036 [details]
Netinstall Server product

I reproduced with Server netinstall and see the same issue
Comment 11 A.J. Werkman 2015-04-13 19:19:53 UTC 
Created attachment 1014037 [details]
Packaging.log
Comment 12 A.J. Werkman 2015-04-13 19:20:22 UTC 
Created attachment 1014044 [details]
Syslog
Comment 13 A.J. Werkman 2015-04-13 19:21:33 UTC 
Created attachment 1014045 [details]
Program.log
Comment 14 A.J. Werkman 2015-04-13 19:27:27 UTC 
After I ran into the mirrore error in the central pane, I switched to tty2.
There I ran

'export https_proxy=<url>'

and

'curl -o metalink.xml https://mirrors.fedoraproject.org/metalink?repo=fedora-22&arch=x86_64'

and could succesfully retrieve the metalink list.
Comment 15 A.J. Werkman 2015-04-23 07:21:29 UTC 
This one was rejected as a blocker for Beta

<adamw> so, i guess i'm a provisional -1, i'm willing to reconsider with more data...

<adamw> propose #agreed #1211122 - RejectedBlocker - there seems to be a lot of grey area in this bug, lots of information we need from the reporter, but even in the worst possible case people seem inclined to fudge this with a CommonBugs note suggesting explicit repo configuration for Beta.

Considering the above stated, I would like to have this reconsidered for Final.
Comment 16 DO NOT USE account not monitored (old adamwill) 2015-04-23 14:27:29 UTC 
Part of the discussion at the meeting, IIRC, was that others tested with proxy setups and had no problem like this, so we figure it's in part related to the details of your proxy setup. So, can you provide some more details on it?
Comment 17 A.J. Werkman 2015-04-23 20:56:17 UTC 
I think I have given more info on the proxy in comment #14.

As far as I saw the discussion this was about using a particular repo url and not retrieving the url form a mirrolist.

This proxy I use is a squid proxy on a fedora linux system, standard operating on port 3128.

As I pointed out in comment #14, I don't think the problem in my case is the proxy, since I can retrieve the metalink list when I operate curl manually. In my test situation when using a repo url instead of mirrorlist, the installtion runs succesfully. But when trying to download a mirrorlist it fails. Can it be, that the mirrorlist code is not using the declared proxy?

If you look for more specific information, please let me know.
Comment 18 Brian Lane 2015-04-23 23:45:07 UTC 
Give this updates.img a try against the beta:

https://bcl.fedorapeople.org/updates/1211122.img

Ends up the dnf config didn't have its proxy settings setup from inst.proxy, so it would only work if individual repos had a proxy set.
Comment 19 A.J. Werkman 2015-04-24 06:51:16 UTC 
Tried the updates.img and it is successfull for me. I used it on a Server installation with repo determined by the mirrorlist retriever throughout the proxy.
Comment 20 David Gay 2015-04-28 20:36:53 UTC 
Discussed at the 2015-04-28 blocker review meeting.[1] Voted as RejectedBlocker.

This is a problem for those using proxies. However, it would be sufficiently workaroundable. (In practice the fix is landing anyway.)

[1]: http://meetbot.fedoraproject.org/fedora-blocker-review/2015-04-28/
Comment 21 Fedora Update System 2015-05-07 19:10:07 UTC 
anaconda-22.20.12-1.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/anaconda-22.20.12-1.fc22
Comment 22 Fedora Update System 2015-05-11 00:01:09 UTC 
Package python-blivet-1.0.9-1.fc22, anaconda-22.20.12-1.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing python-blivet-1.0.9-1.fc22 anaconda-22.20.12-1.fc22'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-7827/python-blivet-1.0.9-1.fc22,anaconda-22.20.12-1.fc22
then log in and leave karma (feedback).
Comment 23 Fedora Update System 2015-05-13 01:17:13 UTC 
python-blivet-1.0.9-1.fc22, anaconda-22.20.12-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.