664575 – Packages install out of compliance

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 664575 - Packages install out of compliance

Summary: Packages install out of compliance

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	subscription-manager
Sub Component:
Version:	6.1
Hardware:	Unspecified
OS:	Unspecified
Priority:	low
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Dennis Gregorovic
QA Contact:	John Sefler
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	Entitlement-Beta
TreeView+	depends on / blocked

Reported:	2010-12-20 19:53 UTC by J.C. Molet
Modified:	2011-05-19 13:38 UTC (History)
CC List:	1 user (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2011-05-19 13:38:20 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
installed software (205.27 KB, image/png) 2010-12-20 19:53 UTC, J.C. Molet	no flags	Details
Entitlement certificate extensions. (28.43 KB, text/plain) 2010-12-22 18:29 UTC, Devan Goodwin	no flags	Details
View All

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHEA-2011:0611	0	normal	SHIPPED_LIVE	new package: subscription-manager	2011-05-18 17:56:21 UTC

Description J.C. Molet 2010-12-20 19:53:08 UTC

Created attachment 469843 [details]
installed software

Description of problem:
When a package has been installed via yum using one of the repos that an entitlement provides, it does not show that the installed package is in compliance.

Version-Release number of selected component (if applicable):
subscription-manager-0.93.5-1.el6.x86_64
subscription-manager-gnome-0.93.5-1.el6.x86_64
redhat-release-server-6Server-6.0.0.37.el6.x86_64

Steps to Reproduce:
1.  Install rhsm on rhel6 server
2.  Register rhsm and subscribe to an entitlement
3.  Install a package associated to that entitlement
  
Actual results:
Package installs from the repo that the entitlement provides but the installed package does not show that it has met compliance.

Expected results:
Installed package shows that it is in compliance.

Additional info:

rhsm.conf:
# Server hostname:
hostname = candlepin1.devlab.phx1.redhat.com
# Content base URL:
baseurl=https://mockamai.devlab.phx1.redhat.com

[root@jmolet-vm1 ~]# subscription-manager unregister
System has been un-registered.
[root@jmolet-vm1 ~]# subscription-manager register --user=user5 --password=redhat
79581a8a-1bc1-4aa0-a2a5-5be607a0eecd user5
[root@jmolet-vm1 ~]# subscription-manager list --available
+-------------------------------------------+
    Available Subscriptions
+-------------------------------------------+


ProductName:       	Red Hat Enterprise Linux Entitlement Beta (1-2 Sockets)
                        (Unlimited Virtualization)
ProductId:         	RH3036913                
PoolId:            	8a878c912ceba4d7012cf54eaec5064d
Quantity:          	10                       
Expires:           	2011-12-02               

[root@jmolet-vm1 ~]# subscription-manager subscribe --pool=8a878c912ceba4d7012cf54eaec5064d
[root@jmolet-vm1 ~]# yum groupinstall "Load Balancer"
Loaded plugins: product-id, refresh-packagekit, rhnplugin, subscription-manager
Updating Red Hat repositories.
INFO:repolib:repos updated: 30
rhel-6-entitlement                                                                                                                                           | 4.0 kB     00:00     
rhel-6-entitlement-ha                                                                                                                                        | 4.0 kB     00:00     
rhel-6-entitlement-ha-updates                                                                                                                                |  951 B     00:00     
rhel-6-entitlement-lb                                                                                                                                        | 3.9 kB     00:00     
rhel-6-entitlement-lb-updates                                                                                                                                |  951 B     00:00     
rhel-6-entitlement-rs                                                                                                                                        | 4.0 kB     00:00     
rhel-6-entitlement-rs-updates                                                                                                                                |  951 B     00:00     
rhel-6-entitlement-sfs                                                                                                                                       | 4.0 kB     00:00     
rhel-6-entitlement-sfs-updates                                                                                                                               |  951 B     00:00     
rhel-6-entitlement-updates                                                                                                                                   |  951 B     00:00     
Setting up Group Process
Resolving Dependencies
--> Running transaction check
---> Package ipvsadm.x86_64 0:1.25-9.el6 set to be updated
---> Package piranha.x86_64 0:0.8.5-7.el6 set to be updated
--> Processing Dependency: php for package: piranha-0.8.5-7.el6.x86_64
--> Running transaction check
---> Package php.x86_64 0:5.3.2-6.el6 set to be updated
--> Processing Dependency: php-common = 5.3.2-6.el6 for package: php-5.3.2-6.el6.x86_64
--> Processing Dependency: php-cli = 5.3.2-6.el6 for package: php-5.3.2-6.el6.x86_64
--> Running transaction check
---> Package php-cli.x86_64 0:5.3.2-6.el6 set to be updated
---> Package php-common.x86_64 0:5.3.2-6.el6 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

====================================================================================================================================================================================
 Package                                  Arch                                 Version                                    Repository                                           Size
====================================================================================================================================================================================
Installing:
 ipvsadm                                  x86_64                               1.25-9.el6                                 rhel-6-entitlement-lb                                41 k
 piranha                                  x86_64                               0.8.5-7.el6                                rhel-6-entitlement-lb                               619 k
Installing for dependencies:
 php                                      x86_64                               5.3.2-6.el6                                rhel-6-entitlement                                  1.1 M
 php-cli                                  x86_64                               5.3.2-6.el6                                rhel-6-entitlement                                  2.2 M
 php-common                               x86_64                               5.3.2-6.el6                                rhel-6-entitlement                                  515 k

Transaction Summary
====================================================================================================================================================================================
Install       5 Package(s)
Upgrade       0 Package(s)

Total download size: 4.4 M
Installed size: 18 M
Is this ok [y/N]: y
Downloading Packages:
(1/5): ipvsadm-1.25-9.el6.x86_64.rpm                                                                                                                         |  41 kB     00:00     
(2/5): php-5.3.2-6.el6.x86_64.rpm                                                                                                                            | 1.1 MB     00:02     
(3/5): php-cli-5.3.2-6.el6.x86_64.rpm                                                                                                                        | 2.2 MB     00:03     
(4/5): php-common-5.3.2-6.el6.x86_64.rpm                                                                                                                     | 515 kB     00:01     
(5/5): piranha-0.8.5-7.el6.x86_64.rpm                                                                                                                        | 619 kB     00:01     
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                               382 kB/s | 4.4 MB     00:11     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Warning: RPMDB altered outside of yum.
  Installing     : php-common-5.3.2-6.el6.x86_64                                                                                                                                1/5 
  Installing     : php-cli-5.3.2-6.el6.x86_64                                                                                                                                   2/5 
  Installing     : php-5.3.2-6.el6.x86_64                                                                                                                                       3/5 
  Installing     : ipvsadm-1.25-9.el6.x86_64                                                                                                                                    4/5 
  Installing     : piranha-0.8.5-7.el6.x86_64                                                                                                                                   5/5 
duration: 421(ms)
installing: 406.pem
installing: 408.pem
Installed products updated.

Installed:
  ipvsadm.x86_64 0:1.25-9.el6                                                              piranha.x86_64 0:0.8.5-7.el6                                                             

Dependency Installed:
  php.x86_64 0:5.3.2-6.el6                                php-cli.x86_64 0:5.3.2-6.el6                                php-common.x86_64 0:5.3.2-6.el6                               

Complete!

[root@jmolet-vm1 ~]# subscription-manager-gui 

(see screenshot)

---------------
Also note that when I use the "become compliant" button, and select those two products into compliance, the search function doesn't return anything.

Comment 1 Devan Goodwin 2010-12-22 17:41:10 UTC

Ok so the Load Balancer product in the screenshot was not installed prior to the yum groupinstall run above.

Important thing to note, yum cannot make you compliant. It can install new products which can result in new product certs on the machine (as in this case). To be compliant however you must use Subscription Manager or some other tool to grab an entitlement which provides access to the product you just installed.

So I suspect what we are seeing here may be correct behavior, you installed something you don't have a subscription for, so once installed it is not compliant, and you have no subscriptions which could make it compliant, thus why that list is empty.

We do need to check:

(a) Should it be possible to install this Load Balancer product via yum. (what repo is it coming from? why can we access the content if we don't have an entitlement for it?)

(b) Should this alpha entitlement subscription actually be configured to provide the load balancer product:

ProductName:        Red Hat Enterprise Linux Entitlement Beta (1-2 Sockets)
                        (Unlimited Virtualization)
ProductId:          RH3036913                
PoolId:             8a878c912ceba4d7012cf54eaec5064d

Comment 2 Devan Goodwin 2010-12-22 17:44:29 UTC

I misunderstood somewhat, the expectation isn't that yum would install a new product and make you compliant, rather that if yum can install something, should it be compliant already given that the content was available in the first place?

Comment 3 Bryan Kearney 2010-12-22 17:54:00 UTC

(b) No, dont need it for alpha. The beta sku should allow it tho.
on (a) if the subscripion allows it, we should. I would assume if the beta exposes 4 products, one of which is LB, then installing LB should make make the numbers go to 2 of 4.

I think we should show 2 of 4 as "compliant" howeverr.

--b k

Comment 4 Devan Goodwin 2010-12-22 18:26:24 UTC

More debugging info, it seems like the entitlement cert does not provide the correct products to match what is coming down in the product certs when something is yum installed:

The product cert for RHEL: (note this says Alpha, the subscription says Beta)

X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
1.3.6.1.4.1.2312.9.1.406.1:
.,Red Hat Enterprise Linux 6 Entitlement Alpha
1.3.6.1.4.1.2312.9.1.406.2:
..
1.3.6.1.4.1.2312.9.1.406.3:
..
1.3.6.1.4.1.2312.9.1.406.4:
..

The product cert for load balancer:

X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
1.3.6.1.4.1.2312.9.1.408.1:
.?Red Hat Enterprise Linux Load Balancer (for RHEL 6 Entitlement)
1.3.6.1.4.1.2312.9.1.408.2:
..
1.3.6.1.4.1.2312.9.1.408.3:
..
1.3.6.1.4.1.2312.9.1.408.4:

I will attach the extensions for the entitlement cert because it's pretty huge bug the key things, I think there may be confusion on the product hashes vs content set IDs.

After the yum group install, he gets two product certs for 406 and 408. The entitlement does not provide either of these. 408 does appear as a content set ID, though for scalable file system, not load balancing. Similarly 406 is there as a content ID, but also for scalable file system rather than RHEL.

In the entitlement cert, it looks like RHEL 6 product ID should be 37, and load balancer product ID should be 47.

1.3.6.1.4.1.2312.9.1.37.1:
.&Red Hat Enterprise Linux 6 Entitlement

1.3.6.1.4.1.2312.9.1.47.1:
.?Red Hat Enterprise Linux Load Balancer (for RHEL 6 Entitlement)

But the product certs are for 406 and 408.

Comment 5 Devan Goodwin 2010-12-22 18:29:06 UTC

Created attachment 470276 [details]
Entitlement certificate extensions.

Comment 6 Devan Goodwin 2010-12-22 19:33:52 UTC

Assigning to Dennis, he thinks it should be fixed now, can we get a re-test?

Comment 8 J.C. Molet 2010-12-23 15:08:56 UTC

Tests now pass, all packages installed from subscription repos install under compliance.

Comment 9 errata-xmlrpc 2011-05-19 13:38:20 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2011-0611.html

Note You need to log in before you can comment on or make changes to this bug.