Bug 1112833 - Enabling the extras repo immediately causes 403 Forbidden errors for all repos
Summary: Enabling the extras repo immediately causes 403 Forbidden errors for all repos
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: katello-agent
Version: 6.0.3
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: Unspecified
Assignee: Jason Montleon
QA Contact: Katello QA List
URL: d
Whiteboard:
: 1126318 (view as bug list)
Depends On:
Blocks: rhsm-rhel66 1112837 GSS_Sat6Beta_Tracker, GSS_Sat6_Tracker 1120431
TreeView+ depends on / blocked
 
Reported: 2014-06-24 19:02 UTC by Justin Sherrill
Modified: 2019-09-26 13:47 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1112837 1120431 (view as bug list)
Environment:
Last Closed: 2014-09-11 12:21:25 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 1162633 0 None None None Never

Description Justin Sherrill 2014-06-24 19:02:19 UTC
Description of problem:

Enabling the extras repo causes all other repos to stop working for a client.


This was tested on a RHEL 7 client

How reproducible:
always

Steps to Reproduce:
1. Enable  RHEL 7Desktop RPMs
2. Register a 7Desktop client and attach it to your subscription for RHEL 7
3. Enable 'Red Hat Enterprise Linux 7 Desktop - Extras (RPMs)'
4. Go into the Content host's product content page and enable the extras content for the host
5. subscription-manager refresh on the host
6. yum repolist 

Actual results:

rhel-7-desktop-extras-rpms                                                         | 2.5 kB  00:00:00     
https://katello.devel/pulp/repos/ACME_Corporation/Library/content/dist/rhel/client/7/7Client/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
rhel-7-desktop-extras-rpms/x86_64/primary                                          |  324 B  00:00:00     
https://katello.devel/pulp/repos/ACME_Corporation/Library/content/dist/rhel/client/7/7Client/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.
https://katello.devel/pulp/repos/ACME_Corporation/Library/content/dist/rhel/client/7/7Client/x86_64/supplementary/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden
Trying other mirror.


Expected results:

yum repolist works fine and the client can yum install content.

Additional info:

I believe this has to do with the fact that Extras has a content URL of:
  /content/dist/rhel/client/7/7Client/$basearch/extras/os

while most every other repo has a content url like:
  /content/dist/rhel/client/7/$releasever/$basearch/os


The Extras uses 7Client, whereas everything else uses $releasever

Comment 1 Justin Sherrill 2014-06-24 19:06:23 UTC
The code here is to blame:


/usr/lib64/python2.6/site-packages/rhsm/pathtree.py


            if words[0] in tree:
                words_to_try = [words[0]]
            else:
                # we allow any word to match against entitlement variables
                # such as "$releasever".
                words_to_try = [word for word in tree.keys() if word.startswith('$')]



Essentially it matches on 7Client first, and ignores the checking for things starting with '$'

Comment 2 RHEL Program Management 2014-06-24 19:14:40 UTC
Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Comment 4 Ivan Necas 2014-07-15 13:12:57 UTC
I've hit the same issues with "Red Hat Enterprise Virtualization Agents for RHEL 6 Server RPMs x86_64 6Server" repository

Comment 5 Bryan Kearney 2014-07-15 18:05:25 UTC
interesting, I do not see this using susbcription manager against hosted. Are you sure the extras repo is actually publishe?

Comment 6 Justin Sherrill 2014-07-15 23:11:02 UTC
I assume this is because hosted is not using python-rhsm to validate clients.  Alikens wasn't even aware that this code was used by anyone.

Comment 7 Justin Sherrill 2014-07-15 23:18:46 UTC
To clarify this isn't a client side issue even though it is with python-rhsm.  Pulp uses python-rhsm to validate client access to repos.

There are two possible fixes for this:

a) Fix python-rhsm to do the correct behavior
b) modify the content within the product to include $releasever

if b) is not an option we'll likely need to patch python-rhsm and build a custom version for satellite 6 GA.

Comment 9 Justin Sherrill 2014-08-04 15:03:15 UTC
*** Bug 1126318 has been marked as a duplicate of this bug. ***

Comment 10 Mike McCune 2014-08-14 03:12:55 UTC
looks like the upstream bug is ON_QA, can we move this to ON_QA as well?

Comment 11 Justin Sherrill 2014-08-14 13:22:14 UTC
Well that version of python-rhsm is on_qa for rhel 6.6, so in order to test this we'd need to ensure that that version of rhsm is installed. And until 6.6 is released we'd have to ship that version with Sat 6 and make it a requirement.

Comment 12 Adrian Likins 2014-08-14 17:55:06 UTC
github master:

commit 33a7d2635d7cde7945dc4fc1b4437576063c9cab
Author: Bryan Kearney <bkearney>
Date:   Wed Jul 16 18:48:53 2014 -0400

    1120431: Support for complex path matching.
    
    RHUI is using this code server side. It was having issues matching paths such as
    /one/$release/two
    /one/three/four
    
    with the strings
    
    /one/three/two
    
    The issue was that the old algorithm would look at the second node, match the three, and
    not use the wildcard of the $release. The new alogithm fixes this.

Comment 15 Justin Sherrill 2014-08-27 14:02:01 UTC
I do not believe this is actually ON_QA as this requires an update to python-rhsm which i do not see in the latest snap.  (I'm under the impression that we need to ship our own patched release of python-rhsm for this to be resolved).

In addition satellite needs an rpm requires to pull in the new version (as it will be already installed by default).  We can't know what version to add as a requires until its built in brew. Moving back to POST

Comment 16 Jason Montleon 2014-08-27 14:55:50 UTC
python-rhsm-1.12.5-1.el[67] were tagged in this morning.

Comment 19 Kedar Bidarkar 2014-09-02 11:12:39 UTC
Tested with Sat6-GA-snap7

Installed Packages

    candlepin-0.9.23-1.el6_5.noarch
    candlepin-common-1.0.1-1.el6_5.noarch
    candlepin-scl-1-5.el6_4.noarch
    candlepin-scl-quartz-2.1.5-5.el6_4.noarch
    candlepin-scl-rhino-1.7R3-1.el6_4.noarch
    candlepin-scl-runtime-1-5.el6_4.noarch
    candlepin-selinux-0.9.23-1.el6_5.noarch
    candlepin-tomcat6-0.9.23-1.el6_5.noarch
    elasticsearch-0.90.10-6.el6sat.noarch
    katello-certs-tools-1.5.6-1.el6sat.noarch
    katello-default-ca-1.0-1.noarch
    katello-installer-0.0.64-1.el6sat.noarch
    katello-server-ca-1.0-1.noarch
    m2crypto-0.21.1.pulp-10.el6sat.x86_64
    mod_wsgi-3.4-1.pulp.el6sat.x86_64
    pulp-katello-0.3-4.el6sat.noarch
    pulp-nodes-common-2.4.1-0.5.rc1.el6sat.noarch
    pulp-nodes-parent-2.4.1-0.5.rc1.el6sat.noarch
    pulp-puppet-plugins-2.4.1-0.5.rc1.el6sat.noarch
    pulp-puppet-tools-2.4.1-0.5.rc1.el6sat.noarch
    pulp-rpm-plugins-2.4.1-0.6.beta.el6sat.noarch
    pulp-selinux-2.4.1-0.5.rc1.el6sat.noarch
    pulp-server-2.4.1-0.5.rc1.el6sat.noarch
    python-gofer-qpid-1.3.0-1.el6sat.noarch
    python-isodate-0.5.0-1.pulp.el6sat.noarch
    python-kombu-3.0.15-12.pulp.el6sat.noarch
    python-pulp-bindings-2.4.1-0.5.rc1.el6sat.noarch
    python-pulp-common-2.4.1-0.5.rc1.el6sat.noarch
    python-pulp-puppet-common-2.4.1-0.5.rc1.el6sat.noarch
    python-pulp-rpm-common-2.4.1-0.6.beta.el6sat.noarch
    python-qpid-0.22-14.el6sat.noarch
    python-qpid-qmf-0.22-37.el6.x86_64
    qpid-cpp-client-0.22-42.el6.x86_64
    qpid-cpp-server-0.22-42.el6.x86_64
    qpid-cpp-server-linearstore-0.22-42.el6.x86_64
    qpid-java-client-0.22-6.el6.noarch
    qpid-java-common-0.22-6.el6.noarch
    qpid-proton-c-0.7-1.el6.x86_64
    qpid-qmf-0.22-37.el6.x86_64
    qpid-tools-0.22-12.el6.noarch
    ruby193-rubygem-katello-1.5.0-86.el6sat.noarch
    rubygem-smart_proxy_pulp-1.0.1-1.1.el6sat.noarch
   
Also the needed new python-rhsm-1.12.5-1.el6.x86_64.rpm rpm is available now via the rhcommon repo, for both RHEL6 and RHEL7

Comment 20 Bryan Kearney 2014-09-11 12:21:25 UTC
This was delivered with Satellite 6.0 which was released on 10 September 2014.


Note You need to log in before you can comment on or make changes to this bug.