Bug 754255

Summary:	building a template from a katello export is unable to authenticate CA cert
Product:	Red Hat Satellite	Reporter:	wes hayutin <whayutin>
Component:	Content Management	Assignee:	Katello Bug Bin <katello-bugs>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Katello QA List <katello-qa-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.0.0	CC:	jlaska, mtaylor
Target Milestone:	Unspecified	Keywords:	Reopened
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	katello-0.1.174-2.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-01-17 21:32:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description wes hayutin 2011-11-15 20:53:19 UTC

Description of problem:
11-11-15 15:30:31,500 DEBUG oz.Guest.FedoraGuest pid(18072) Message: Could not do direct boot, fetching boot.iso instead (the following erro
r message is useful for bug reports, but can be ignored)
2011-11-15 15:30:31,500 DEBUG oz.Guest.FedoraGuest pid(18072) Message: (60, 'Peer certificate cannot be authenticated with known CA certificat
es')
2011-11-15 15:30:31,500 INFO oz.Guest.FedoraGuest pid(18072) Message: Generating install media
2011-11-15 15:30:31,500 INFO oz.Guest.FedoraGuest pid(18072) Message: Fetching the original media
2011-11-15 15:30:31,500 DEBUG oz.Guest.FedoraGuest pid(18072) Message: Attempting to get the lock for /home/var/lib/oz/isos/Fedora15x86_64-url
.iso
2011-11-15 15:30:31,501 DEBUG oz.Guest.FedoraGuest pid(18072) Message: Got the lock, doing the download
2011-11-15 15:30:31,954 INFO oz.Guest.FedoraGuest pid(18072) Message: Fetching the original install media from https://smqe-gkhachik.brq.redha
t.com/pulp/ks/ACME_Corporation/Locker/fedora15/f14-x86_64//images/boot.iso
2011-11-15 15:30:32,208 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Exception caught in ImageFactory
2011-11-15 15:30:32,208 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/imgfac/builders/Fedora_vsphere_Builder.py", line 85, in build_upload
    guest.generate_install_media(force_download=False)
  File "/usr/lib/python2.7/site-packages/oz/RedHat.py", line 743, in generate_install_media
    return self._iso_generate_install_media(fetchurl, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1478, in _iso_generate_install_media
    self._get_original_iso(url, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1173, in _get_original_iso
    self._get_original_media(isourl, self.orig_iso, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 758, in _get_original_media
    self._download_file(url, fd, True)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 645, in _download_file
    c.perform()
error: (60, 'Peer certificate cannot be authenticated with known CA certificates')

2011-11-15 15:30:32,208 DEBUG imgfac.BuildJob.BuildJob pid(18072) Message: Builder (aaac2310-f022-4528-acf7-44fea2309ff6) changed status from 
BUILDING to FAILED
2011-11-15 15:30:32,208 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Exception caught in ImageFactory
2011-11-15 15:30:32,209 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/imgfac/builders/Fedora_vsphere_Builder.py", line 49, in build_image
    self.build_upload(build_id)
  File "/usr/lib/python2.7/site-packages/imgfac/builders/Fedora_vsphere_Builder.py", line 85, in build_upload
    guest.generate_install_media(force_download=False)
  File "/usr/lib/python2.7/site-packages/oz/RedHat.py", line 743, in generate_install_media
    return self._iso_generate_install_media(fetchurl, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1478, in _iso_generate_install_media
    self._get_original_iso(url, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1173, in _get_original_iso
    self._get_original_media(isourl, self.orig_iso, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 758, in _get_original_media
    self._download_file(url, fd, True)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 645, in _download_file
    c.perform()
error: (60, 'Peer certificate cannot be authenticated with known CA certificates')

2011-11-15 15:30:32,209 DEBUG imgfac.BuildJob.BuildJob pid(18072) Message: Builder (aaac2310-f022-4528-acf7-44fea2309ff6) changed status from FAILED to FAILED

[root@qeblade31 ~]# rpm -qa | grep aeolus
aeolus-conductor-daemons-0.6.0-0.20111114172747gitde62906.fc15.noarch
aeolus-configure-2.3.0-0.20111111160331git9bde372.fc15.noarch
aeolus-all-0.6.0-0.20111114172747gitde62906.fc15.noarch
aeolus-conductor-0.6.0-0.20111114172747gitde62906.fc15.noarch
aeolus-conductor-devel-0.6.0-0.20111114172747gitde62906.fc15.noarch
rubygem-aeolus-cli-0.1.0-3.20111115145311git5ec94c5.fc15.noarch
rubygem-aeolus-image-0.1.0-4.20111024205454git6b2b696.fc15.noarch
aeolus-conductor-doc-0.6.0-0.20111114172747gitde62906.fc15.noarch

Comment 1 Ian McLeod 2011-11-16 22:32:23 UTC

Per a thread from the Katello guys, this is an error in their template generation.

Anaconda cannot, in the general case, install from an https location.

They should have an update already available that outputs "http" URLs for the <os> section of the TDL.

Cloding.

Comment 2 wes hayutin 2011-11-16 22:40:57 UTC

looking for some comments from Hugh or Chris

Comment 3 wes hayutin 2011-11-17 16:56:37 UTC

I've been told.. changing
<?xml version="1.0" encoding="UTF-8"?><template><name>t</name><os><name>Fedora</name><version>15</version><arch>x86_64</arch><rootpw>redhat</rootpw><install type="url"><url>htts:/

to 

<?xml version="1.0" encoding="UTF-8"?><template><name>t</name><os><name>Fedora</name><version>15</version><arch>x86_64</arch><rootpw>redhat</rootpw><install type="url"><url>http:/

should resolve this issue

Chris Alfonso mentioned tsanders and bkearney are aware of the issue

Comment 4 wes hayutin 2011-11-18 16:17:06 UTC

working this now

Comment 5 wes hayutin 2011-11-28 01:17:19 UTC

removing bugs from ce-sprint from the tracker.. you can find these bugs by querying the "qa whiteboard" for ce-sprint-60

Comment 6 wes hayutin 2011-11-30 15:11:42 UTC

moving to jlaska

Comment 7 James Laska 2012-01-17 14:07:41 UTC

This bug is currently assigned to rubygem-aeolus-cli.  I don't believe anything has been fixed here on the rubygem-aeolus-cli side.

For katello generated templates, the <install><url> now contains http *only* URLs (not https).  Also, all <repository><url> sections use https URLs.

This has been VERIFIED using katello-0.1.174-2.el6.  Unless I'm misunderstanding this report, I'm tempted to reassign this to katello, and mark it as VERIFIED -> CLOSED.

Comment 8 James Laska 2012-01-17 21:31:57 UTC

This problem was fixed by katello no longer generating <install> <url>'s that contain https.