Red Hat Bugzilla – Bug 1464571
subscription-manager release --list does not handle the case when two "rhel-#" products are coincidentally installed
Last modified: 2018-04-10 05:50:47 EDT
Description of problem: Arguably this situation (when multiple OS "rhel-#" product certs are installed) may not be officially supported. However this situation is easy to get into with High Touch Beta repositories because both the RHEL and the HTB product certs provide and require the same tags (which in my opinion is an oversight by upstream product definitions). Nevertheless, subscription-manager's release function should better handle this situation. It appears that subscription-manager is honoring only one "rhel-#" product cert (the last one found). Version-Release number of selected component (if applicable): [root@jsefler-rhel7 ~]# subscription-manager version server type: This system is currently not registered. subscription management server: 2.0.37-1 subscription management rules: 5.23 subscription-manager: 1.19.20-1.el7 python-rhsm: 1.19.9-1.el7 [root@jsefler-rhel7 ~]# rpm -q --whatprovides /etc/pki/product-default/230.pem redhat-release-server-7.4-15.el7.x86_64 How reproducible: Steps to Reproduce: 1. First you must get into a situation where more than one "rhel-#" product cert is installed. This was easy to do during the rhel7.4 snapshot testing phase when the redhat-release-server package provided HTB product cert /etc/pki/product-default/230.pem 2. Then register and manually attach a RHEL subscription and yum install a package from the rhel-7-server-rpms repo. This is cause product cert /etc/pki/product/69.pem to be installed by the yum productid plugin. Now I'll demonstrate the failure to release --list... [root@jsefler-rhel7 ~]# subscription-manager list --installed +-------------------------------------------+ Installed Product Status +-------------------------------------------+ Product Name: Red Hat Enterprise Linux Server Product ID: 69 Version: 7.4 Beta Arch: x86_64 Status: Unknown Status Details: Starts: Ends: Product Name: Red Hat Enterprise Linux 7 Server High Touch Beta Product ID: 230 Version: 7.4 HTB Arch: x86_64 Status: Unknown Status Details: Starts: Ends: [root@jsefler-rhel7 ~]# find /etc/pki/product* -name *.pem /etc/pki/product/69.pem /etc/pki/product-default/230.pem [root@jsefler-rhel7 ~]# rct cat-cert /etc/pki/product/69.pem | grep Tags Tags: rhel-7,rhel-7-server [root@jsefler-rhel7 ~]# rct cat-cert /etc/pki/product-default/230.pem | grep Tags Tags: rhel-7,rhel-7-server ^^^^^^^^^^^^^^^^^^^^ SIDE NOTE: BOTH 69.pem AND 230.pem PROVIDE THE SAME TAGS [root@jsefler-rhel7 ~]# subscription-manager register --auto-attach Registering to: subscription.rhsm.stage.redhat.com:443/subscription Username: stage_auto_testuser1 Password: The system has been registered with ID: 84c7dabd-c39a-430b-87cb-aaa4f437e0d6 Installed Product Current Status: Product Name: Red Hat Enterprise Linux Server Status: Subscribed Product Name: Red Hat Enterprise Linux 7 Server High Touch Beta Status: Subscribed [root@jsefler-rhel7 ~]# subscription-manager list --consumed +-------------------------------------------+ Consumed Subscriptions +-------------------------------------------+ Subscription Name: Red Hat Enterprise Linux for Virtual Datacenters, Premium (DERIVED SKU) Provides: Red Hat Software Collections (for RHEL Server) Red Hat EUCJP Support (for RHEL Server) - Extended Update Support Red Hat Beta Red Hat Software Collections Beta (for RHEL Server) Oracle Java (for RHEL Server) Red Hat Developer Toolset (for RHEL Server) Red Hat Enterprise Linux Scalable File System (for RHEL Server) - Extended Update Support Red Hat Enterprise Linux Server Oracle Java (for RHEL Server) - Extended Update Support Red Hat Enterprise Linux High Availability (for RHEL Server) - Extended Update Support Oracle Java (for RHEL Workstation) Red Hat Enterprise Linux Server - Extended Update Support Red Hat Enterprise Linux Load Balancer (for RHEL Server) - Extended Update Support dotNET on RHEL (for RHEL Server) Red Hat S-JIS Support (for RHEL Server) - Extended Update Support Red Hat Enterprise Linux High Performance Networking (for RHEL Server) - Extended Update Support Red Hat Enterprise Linux Resilient Storage (for RHEL Server) - Extended Update Support Red Hat Enterprise Linux Atomic Host Red Hat Enterprise Linux Atomic Host Beta SKU: RH00049 Contract: Account: 5699539 Serial: 1817720955935976863 Pool ID: 8a99f9875ccb556c015cd05736a93494 Provides Management: No Active: True Quantity Used: 1 Service Level: Premium Service Type: L1-L3 Status Details: Guest has not been reported on any host and is using a temporary unmapped guest subscription. Subscription Type: Standard (Temporary) Starts: 06/22/2017 Ends: 06/30/2017 System Type: Virtual Subscription Name: Red Hat Enterprise Linux High Touch Beta Provides: Red Hat Enterprise Linux 7 Workstation High Touch Beta Red Hat Enterprise Linux 7 Server High Touch Beta Red Hat Enterprise Linux 7 for IBM POWER High Touch Beta Red Hat Enterprise Linux 7 for IBM z Systems High Touch Beta Red Hat Enterprise Linux 7 for HPC Compute Node High Touch Beta Red Hat Enterprise Linux 7 Load Balancer High Touch Beta Red Hat Enterprise Linux 7 High Availability High Touch Beta Red Hat Container Images HTB Red Hat Enterprise Linux 7 Resilient Storage High Touch Beta Red Hat Enterprise Linux Atomic Host HTB Red Hat Enterprise Linux 7 Desktop High Touch Beta SKU: RH00076 Contract: Account: 5699539 Serial: 5008301556931402179 Pool ID: 8a99f9875ccb556c015cd0573c293499 Provides Management: No Active: True Quantity Used: 1 Service Level: Self-Support Service Type: L1-L3 Status Details: Subscription is current Subscription Type: Instance Based Starts: 06/22/2017 Ends: 07/06/2017 System Type: Physical [root@jsefler-rhel7 ~]# subscription-manager repos --list-enabled +----------------------------------------------------------+ Available Repositories in /etc/yum.repos.d/redhat.repo +----------------------------------------------------------+ Repo ID: rhel-7-server-rt-htb-rpms Repo Name: Red Hat Enterprise Linux for Real Time HTB (RHEL 7 Server) (RPMs) Repo URL: https://cdn.redhat.com/content/htb/rhel/server/7/$basearch/rt/os Enabled: 1 Repo ID: rhel-7-server-htb-rpms Repo Name: Red Hat Enterprise Linux 7 Server HTB (RPMs) Repo URL: https://cdn.redhat.com/content/htb/rhel/server/7/$basearch/os Enabled: 1 Repo ID: rhel-7-server-rpms Repo Name: Red Hat Enterprise Linux 7 Server (RPMs) Repo URL: https://cdn.redhat.com/content/dist/rhel/server/7/$releasever/$basearch/os Enabled: 1 [root@jsefler-rhel7 ~]# subscription-manager release --list No release versions available, please check subscriptions. Actual results: No release versions available, please check subscriptions. Expected results: [root@jsefler-rhel7 ~]# curl --stderr /dev/null --insecure --tlsv1 --cert /etc/pki/entitlement/1817720955935976863.pem --key /etc/pki/entitlement/1817720955935976863-key.pem https://cdn.redhat.com/content/dist/rhel/server/7/listing 7.0 7.1 7.2 7.3 7Server Additional info: Watch what happens after I effectively uninstall the HTB product cert.... [root@jsefler-rhel7 ~]# mv /etc/pki/product-default/230.pem /etc/pki/product-default/230.pem.uninstalled [root@jsefler-rhel7 ~]# subscription-manager release --list +-------------------------------------------+ Available Releases +-------------------------------------------+ 7.0 7.1 7.2 7.3 7Server VOILA, THE EXPECTED RELEASE LIST HAS RETURNED WHEN ONLY ONE RHEL-X PRODUCT IS INSTALLED. Note: This has been a known issue among the RHSM QE/DEV team for quite awhile. We believed that getting into this situation was a corner case that would only affect HTB consumers and felt that a HTB consumer would have no practical desire to set/pin their release while participating in the HTB program. We still believe this is true. Nevertheless changes during the RHEL7.4 Snapshot composes to provide the HTB product certs with the redhat-release packages (reference info in Bug 1455820) interfered with QE's ability to test the release function during the snapshot phase. Hence we are now opening this bug for the benefit of both QE and an HTB participant.
Devs, after discussion with stakeholders, I'm going to propose we do this instead: when the release command is run, detect this scenario, and emit an error informing them that we don't support the scenario (i.e. in this scenario both `release --list` and `release --set` should fail). This shouldn't cause a real problem with the scenario described in comment 0, because a) the scenario is an invalid one, and b) on a functional level, the behavior will be that you wouldn't be able to use release --set, which is the effect of comment 0.
Preliminary verification of the fix : ====================================== subscription-manager: 1.20.2-1.el7 python-rhsm: 1.20.2-1.el7 1) Have two product certs with product certs sharing same products [root@hp-sl4545g7-01 home]# rct cc /etc/pki/product/76.pem | grep Tags: Tags: rhel-7,rhel-7-computenode [root@hp-sl4545g7-01 home]# rct cc /etc/pki/product/69.pem | grep Tags: Tags: rhel-7,rhel-7-server 2) attach subscriptions [root@hp-sl4545g7-01 home]# subscription-manager attach --auto Installed Product Current Status: Product Name: Red Hat Enterprise Linux for Scientific Computing Status: Subscribed Product Name: Red Hat Enterprise Linux Server Status: Subscribed [root@hp-sl4545g7-01 home]# subscription-manager list --consumed +-------------------------------------------+ Consumed Subscriptions +-------------------------------------------+ Subscription Name: Red Hat Enterprise Linux Server, Standard (Physical Node with up to 4 Virtual Nodes) (L3 Only) Provides: Red Hat Software Collections (for RHEL Server) dotNET on RHEL Beta (for RHEL Server) dotNET on RHEL (for RHEL Server) Red Hat Beta Red Hat Software Collections Beta (for RHEL Server) Red Hat Developer Tools Beta (for RHEL Server) Red Hat Developer Toolset (for RHEL Server) Oracle Java (for RHEL Server) Red Hat Enterprise Linux Server Red Hat Developer Tools (for RHEL Server) SKU: RH00137F3 Contract: 11488972 Account: 6117003 Serial: 4860623779962757562 Pool ID: 8a99f9835f01e06a015f0a6bcb9c2c0c Provides Management: No Active: True Quantity Used: 1 Service Level: Standard Service Type: L3 Status Details: Subscription is current Subscription Type: Stackable Starts: 10/11/2017 Ends: 10/10/2020 System Type: Physical Subscription Name: Red Hat Enterprise Linux for HPC Compute Nodes, Basic (up to 2 sockets) Additional Nodes Provides: Red Hat Beta Oracle Java (for RHEL Client) Red Hat Hardware Certification Test Suite Oracle Java (for RHEL Server) Oracle Java (for RHEL Compute Node) Red Hat Enterprise Linux for Scientific Computing SKU: MCT0980 Contract: 11504433 Account: 6117003 Serial: 7993484902015760418 Pool ID: 8a99f9835f5e5538015f5e60c812001d Provides Management: No Active: True Quantity Used: 1 Service Level: Basic Service Type: L1-L3 Status Details: Subscription is current Subscription Type: Standard Starts: 10/27/2017 Ends: 10/26/2018 System Type: Physical 3) try to list /set release version [root@hp-sl4545g7-01 home]# subscription-manager release --list Error: More than one release product certificate installed. [root@hp-sl4545g7-01 home]# subscription-manager release --set=7.3 Error: More than one release product certificate installed. rhsm.log -------- # subscription-manager release --list 2017-10-27 11:15:08,400 [INFO] subscription-manager:13293:MainThread @managercli.py:453 - X-Correlation-ID: 64784c32dba146a286902e8b43597fb0 2017-10-27 11:15:08,400 [INFO] subscription-manager:13293:MainThread @managercli.py:342 - Client Versions: {'python-rhsm': '1.20.2-1.el7', 'subscription-manager': '1.20.2-1.el7'} 2017-10-27 11:15:08,402 [INFO] subscription-manager:13293:MainThread @connection.py:832 - Connection built: host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False 2017-10-27 11:15:08,403 [INFO] subscription-manager:13293:MainThread @connection.py:832 - Connection built: host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=none 2017-10-27 11:15:08,404 [INFO] subscription-manager:13293:MainThread @managercli.py:317 - Consumer Identity name=hp-sl4545g7-01.khw.lab.eng.bos.redhat.com uuid=b1be0058-47f6-4c2b-bbef-14edd62be30f 2017-10-27 11:15:08,866 [INFO] subscription-manager:13293:MainThread @connection.py:556 - Response: status=200, request="GET /subscription/" 2017-10-27 11:15:08,875 [ERROR] subscription-manager:13293:MainThread @managercli.py:1433 - Getting releases failed: More than one product with RHEL product tags found. Observed error message on terminal "Error: More than one release product certificate installed." is displayed and rhsm.log reports "Getting releases failed: More than one product with RHEL product tags found" We have following recommendations: 1) We feel it would be nice to display the product certificate location in the log 2) Also modify the terminal error message accordingly.
Created attachment 1347184 [details] Preference dialogue is frozen
Observation on GUI(Attachment in comment 7): [root@hp-ms-01-c43 ~]# subscription-manager version server type: Red Hat Subscription Management subscription management server: 2.0.43-1 subscription management rules: 5.26 subscription-manager: 1.20.2-1.el7 python-rhsm: 1.20.2-1.el7 Preference dialogue of GUI is frozen and cannot modify the service-level or enable/disable auto-attach preference and with a following traceback on terminal Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/subscription_manager/gui/preferences.py", line 101, in load_from_consumer_json self.load_releases(consumer_json) File "/usr/lib/python2.7/site-packages/subscription_manager/gui/preferences.py", line 144, in load_releases available_releases = self.release_backend.get_releases() File "/usr/lib/python2.7/site-packages/subscription_manager/release.py", line 52, in get_releases return provider.get_releases() File "/usr/lib/python2.7/site-packages/subscription_manager/release.py", line 103, in get_releases raise MultipleReleaseProductsError("More than one product with RHEL product tags found.") subscription_manager.release.MultipleReleaseProductsError: More than one product with RHEL product tags found. Would have preferred: 1)Error message pop up saying "Error: More than one release product certificate installed." 2) Instead of a traceback error message being logged in /var/log/rhsm/rhsm.log file
Moving bug back to new(failed_qa) as Preference dialogue of GUI is frozen and cannot modify the service-level or enable/disable auto-attach preference and with a following traceback on terminal as mentioned in comment 8
Clearing fixed-in-version. Next release will have a fix (see attached PR). I'll set to ON_QA and re-set the fixed-in-version once we get another build out.
Retested with ; subscription-manager: 1.20.7-1.el7 I could still see all the three failures mentioned (comment 8 and 6 ) 1) GUI preference dialog is frozen with traceback on terminal Traceback (most recent call last): File "/usr/lib64/python2.7/site-packages/subscription_manager/gui/preferences.py", line 101, in load_from_consumer_json self.load_releases(consumer_json) File "/usr/lib64/python2.7/site-packages/subscription_manager/gui/preferences.py", line 144, in load_releases available_releases = self.release_backend.get_releases() File "/usr/lib64/python2.7/site-packages/subscription_manager/release.py", line 52, in get_releases return provider.get_releases() File "/usr/lib64/python2.7/site-packages/subscription_manager/release.py", line 103, in get_releases raise MultipleReleaseProductsError("More than one product with RHEL product tags found.") subscription_manager.release.MultipleReleaseProductsError: More than one product with RHEL product tags found. 2) Also can you please confirm if the recommendations in comment 6 will be implemented or not a) would like to see the installed product id location being reported in the rhsm.log along with the error message ' [ERROR] subscription-manager:88108:MainThread @managercli.py:1437 - Getting releases failed: More than one product with RHEL product tags found.' b) to change the terminal error message from "Error: More than one release product certificate installed." to "Error: More than one product certificate installed."
Please note that we have not fixed the GUI freeze. Shwetha, please open a separate BZ for the GUI freeze. > a) would like to see the installed product id location being reported in the rhsm.log along with the error message ' [ERROR] subscription-manager:88108:MainThread @managercli.py:1437 - Getting releases failed: More than one product with RHEL product tags found.' Yes the next release of subscription-manager will contain the locations reported. > b) to change the terminal error message from "Error: More than one release product certificate installed." to "Error: More than one product certificate installed." We're going with the language: "More than one release product certificate installed."
Verification for GUI with following version of rhsm: [root@bkr-hv01-guest15 ~]# subscription-manager version server type: Red Hat Subscription Management subscription management server: 2.0.43-1 subscription management rules: 5.26 subscription-manager: 1.20.8-1.el7 Error dialog pops up saying "More than one release product certificate installed" P.S : Attachment : "Error Message" for complete error message Preference Dialogue of GUI no longer freezes P.S : Attachment : "Preference Dialogue of GUI no longer freezes" Error gets logged into rhsm.log file now: ----------------------------------------------- [root@bkr-hv01-guest15 ~]# tail -f /var/log/rhsm/rhsm.log 2017-12-13 08:11:18,961 [INFO] subscription-manager-gui:6526:MainThread @dmiinfo.py:75 - Using dmidecode dump file: /dev/mem 2017-12-13 08:11:19,903 [INFO] subscription-manager-gui:6526:MainThread @connection.py:586 - Response: status=200, requestUuid=cc846866-6434-457c-be06-636d813d1f96, request="GET /subscription/consumers/3720e1b5-6680-44c8-8d1c-8c3c7781168a/owner" 2017-12-13 08:11:33,510 [INFO] subscription-manager-gui:6526:AsyncWidgetUpdaterThread @connection.py:586 - Response: status=200, requestUuid=6c1465c4-d1eb-4505-877f-d1ee70345655, request="GET /subscription/consumers/3720e1b5-6680-44c8-8d1c-8c3c7781168a" 2017-12-13 08:11:33,511 [WARNING] subscription-manager-gui:6526:AsyncWidgetUpdaterThread @connection.py:590 - Clock skew detected, please check your system time 2017-12-13 08:11:33,512 [ERROR] subscription-manager-gui:6526:MainThread @preferences.py:148 - Getting releases failed: More than one release product certificate installed. Certificate paths: /etc/pki/product-default/69.pem, /etc/pki/product-default/71.pem, /etc/pki/product-default/76.pem 2017-12-13 08:11:34,155 [INFO] subscription-manager-gui:6526:MainThread @connection.py:586 - Response: status=200, requestUuid=79ca51fe-6864-4056-bc77-1866b948f868, request="GET /subscription/owners/11343157/servicelevels"
Created attachment 1367352 [details] Preference Dialogue of GUI no longer freezes
Created attachment 1367353 [details] Error Message
Verifying CLI error message and rhsm.log on : # subscription-manager version server type: Red Hat Subscription Management subscription management server: 2.0.43-1 subscription management rules: 5.26 subscription-manager: 1.20.8-1.el7 [root@dhcp180-233 ~]# subscription-manager release --list Error: More than one release product certificate installed. Certificate paths: /etc/pki/product-default/69.pem, /etc/pki/product/230.pem rhsm.log --------- [root@dhcp180-233 ~]# tail -f /var/log/rhsm/rhsm.log 2017-12-13 08:01:06,354 [INFO] subscription-manager:29445:MainThread @managercli.py:317 - Consumer Identity name=dhcp180-233.ml3.eng.bos.redhat.com uuid=e60a0881-6be6-4ebb-ade2-13a3c942a8b8 2017-12-13 08:01:06,842 [INFO] subscription-manager:29445:MainThread @connection.py:586 - Response: status=200, request="GET /subscription/" 2017-12-13 08:01:06,844 [ERROR] subscription-manager:29445:MainThread @managercli.py:1433 - Getting releases failed: More than one release product certificate installed. Certificate paths: /etc/pki/product-default/69.pem, /etc/pki/product/230.pem 2017-12-13 08:01:15,412 [INFO] subscription-manager:29457:MainThread @managercli.py:452 - X-Correlation-ID: 9a90cc90786644808cf59b2c43a8032f 2017-12-13 08:01:15,412 [INFO] subscription-manager:29457:MainThread @managercli.py:341 - Client Versions: {'subscription-manager': '1.20.8-1.el7'} 2017-12-13 08:01:15,413 [INFO] subscription-manager:29457:MainThread @connection.py:868 - Connection built: host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False 2017-12-13 08:01:15,413 [INFO] subscription-manager:29457:MainThread @connection.py:868 - Connection built: host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=none 2017-12-13 08:01:15,413 [INFO] subscription-manager:29457:MainThread @managercli.py:317 - Consumer Identity name=dhcp180-233.ml3.eng.bos.redhat.com uuid=e60a0881-6be6-4ebb-ade2-13a3c942a8b8 2017-12-13 08:01:15,901 [INFO] subscription-manager:29457:MainThread @connection.py:586 - Response: status=200, request="GET /subscription/" 2017-12-13 08:01:15,904 [ERROR] subscription-manager:29457:MainThread @managercli.py:1433 - Getting releases failed: More than one release product certificate installed. Certificate paths: /etc/pki/product-default/69.pem, /etc/pki/product/230.pem ^^^ notice the patch to the product certificate location Observed that now both CLI and rhsm.log displays the product certificate locations along with the error message " Error: More than one release product certificate installed" Based on comment 15 and comment 18 marking the bug as Verified!!
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0681