Bug 664575 - Packages install out of compliance
Summary: Packages install out of compliance
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: subscription-manager
Version: 6.1
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Dennis Gregorovic
QA Contact: John Sefler
Depends On:
Blocks: Entitlement-Beta
TreeView+ depends on / blocked
Reported: 2010-12-20 19:53 UTC by J.C. Molet
Modified: 2011-05-19 13:38 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-05-19 13:38:20 UTC
Target Upstream Version:

Attachments (Terms of Use)
installed software (205.27 KB, image/png)
2010-12-20 19:53 UTC, J.C. Molet
no flags Details
Entitlement certificate extensions. (28.43 KB, text/plain)
2010-12-22 18:29 UTC, Devan Goodwin
no flags Details

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2011:0611 normal SHIPPED_LIVE new package: subscription-manager 2011-05-18 17:56:21 UTC

Description J.C. Molet 2010-12-20 19:53:08 UTC
Created attachment 469843 [details]
installed software

Description of problem:
When a package has been installed via yum using one of the repos that an entitlement provides, it does not show that the installed package is in compliance.

Version-Release number of selected component (if applicable):

Steps to Reproduce:
1.  Install rhsm on rhel6 server
2.  Register rhsm and subscribe to an entitlement
3.  Install a package associated to that entitlement
Actual results:
Package installs from the repo that the entitlement provides but the installed package does not show that it has met compliance.

Expected results:
Installed package shows that it is in compliance.

Additional info:

# Server hostname:
hostname = candlepin1.devlab.phx1.redhat.com
# Content base URL:

[root@jmolet-vm1 ~]# subscription-manager unregister
System has been un-registered.
[root@jmolet-vm1 ~]# subscription-manager register --user=user5 --password=redhat
79581a8a-1bc1-4aa0-a2a5-5be607a0eecd user5
[root@jmolet-vm1 ~]# subscription-manager list --available
    Available Subscriptions

ProductName:       	Red Hat Enterprise Linux Entitlement Beta (1-2 Sockets)
                        (Unlimited Virtualization)
ProductId:         	RH3036913                
PoolId:            	8a878c912ceba4d7012cf54eaec5064d
Quantity:          	10                       
Expires:           	2011-12-02               

[root@jmolet-vm1 ~]# subscription-manager subscribe --pool=8a878c912ceba4d7012cf54eaec5064d
[root@jmolet-vm1 ~]# yum groupinstall "Load Balancer"
Loaded plugins: product-id, refresh-packagekit, rhnplugin, subscription-manager
Updating Red Hat repositories.
INFO:repolib:repos updated: 30
rhel-6-entitlement                                                                                                                                           | 4.0 kB     00:00     
rhel-6-entitlement-ha                                                                                                                                        | 4.0 kB     00:00     
rhel-6-entitlement-ha-updates                                                                                                                                |  951 B     00:00     
rhel-6-entitlement-lb                                                                                                                                        | 3.9 kB     00:00     
rhel-6-entitlement-lb-updates                                                                                                                                |  951 B     00:00     
rhel-6-entitlement-rs                                                                                                                                        | 4.0 kB     00:00     
rhel-6-entitlement-rs-updates                                                                                                                                |  951 B     00:00     
rhel-6-entitlement-sfs                                                                                                                                       | 4.0 kB     00:00     
rhel-6-entitlement-sfs-updates                                                                                                                               |  951 B     00:00     
rhel-6-entitlement-updates                                                                                                                                   |  951 B     00:00     
Setting up Group Process
Resolving Dependencies
--> Running transaction check
---> Package ipvsadm.x86_64 0:1.25-9.el6 set to be updated
---> Package piranha.x86_64 0:0.8.5-7.el6 set to be updated
--> Processing Dependency: php for package: piranha-0.8.5-7.el6.x86_64
--> Running transaction check
---> Package php.x86_64 0:5.3.2-6.el6 set to be updated
--> Processing Dependency: php-common = 5.3.2-6.el6 for package: php-5.3.2-6.el6.x86_64
--> Processing Dependency: php-cli = 5.3.2-6.el6 for package: php-5.3.2-6.el6.x86_64
--> Running transaction check
---> Package php-cli.x86_64 0:5.3.2-6.el6 set to be updated
---> Package php-common.x86_64 0:5.3.2-6.el6 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

 Package                                  Arch                                 Version                                    Repository                                           Size
 ipvsadm                                  x86_64                               1.25-9.el6                                 rhel-6-entitlement-lb                                41 k
 piranha                                  x86_64                               0.8.5-7.el6                                rhel-6-entitlement-lb                               619 k
Installing for dependencies:
 php                                      x86_64                               5.3.2-6.el6                                rhel-6-entitlement                                  1.1 M
 php-cli                                  x86_64                               5.3.2-6.el6                                rhel-6-entitlement                                  2.2 M
 php-common                               x86_64                               5.3.2-6.el6                                rhel-6-entitlement                                  515 k

Transaction Summary
Install       5 Package(s)
Upgrade       0 Package(s)

Total download size: 4.4 M
Installed size: 18 M
Is this ok [y/N]: y
Downloading Packages:
(1/5): ipvsadm-1.25-9.el6.x86_64.rpm                                                                                                                         |  41 kB     00:00     
(2/5): php-5.3.2-6.el6.x86_64.rpm                                                                                                                            | 1.1 MB     00:02     
(3/5): php-cli-5.3.2-6.el6.x86_64.rpm                                                                                                                        | 2.2 MB     00:03     
(4/5): php-common-5.3.2-6.el6.x86_64.rpm                                                                                                                     | 515 kB     00:01     
(5/5): piranha-0.8.5-7.el6.x86_64.rpm                                                                                                                        | 619 kB     00:01     
Total                                                                                                                                               382 kB/s | 4.4 MB     00:11     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Warning: RPMDB altered outside of yum.
  Installing     : php-common-5.3.2-6.el6.x86_64                                                                                                                                1/5 
  Installing     : php-cli-5.3.2-6.el6.x86_64                                                                                                                                   2/5 
  Installing     : php-5.3.2-6.el6.x86_64                                                                                                                                       3/5 
  Installing     : ipvsadm-1.25-9.el6.x86_64                                                                                                                                    4/5 
  Installing     : piranha-0.8.5-7.el6.x86_64                                                                                                                                   5/5 
duration: 421(ms)
installing: 406.pem
installing: 408.pem
Installed products updated.

  ipvsadm.x86_64 0:1.25-9.el6                                                              piranha.x86_64 0:0.8.5-7.el6                                                             

Dependency Installed:
  php.x86_64 0:5.3.2-6.el6                                php-cli.x86_64 0:5.3.2-6.el6                                php-common.x86_64 0:5.3.2-6.el6                               


[root@jmolet-vm1 ~]# subscription-manager-gui 

(see screenshot)

Also note that when I use the "become compliant" button, and select those two products into compliance, the search function doesn't return anything.

Comment 1 Devan Goodwin 2010-12-22 17:41:10 UTC
Ok so the Load Balancer product in the screenshot was not installed prior to the yum groupinstall run above.

Important thing to note, yum cannot make you compliant. It can install new products which can result in new product certs on the machine (as in this case). To be compliant however you must use Subscription Manager or some other tool to grab an entitlement which provides access to the product you just installed.

So I suspect what we are seeing here may be correct behavior, you installed something you don't have a subscription for, so once installed it is not compliant, and you have no subscriptions which could make it compliant, thus why that list is empty.

We do need to check:

(a) Should it be possible to install this Load Balancer product via yum. (what repo is it coming from? why can we access the content if we don't have an entitlement for it?)

(b) Should this alpha entitlement subscription actually be configured to provide the load balancer product:

ProductName:        Red Hat Enterprise Linux Entitlement Beta (1-2 Sockets)
                        (Unlimited Virtualization)
ProductId:          RH3036913                
PoolId:             8a878c912ceba4d7012cf54eaec5064d

Comment 2 Devan Goodwin 2010-12-22 17:44:29 UTC
I misunderstood somewhat, the expectation isn't that yum would install a new product and make you compliant, rather that if yum can install something, should it be compliant already given that the content was available in the first place?

Comment 3 Bryan Kearney 2010-12-22 17:54:00 UTC
(b) No, dont need it for alpha. The beta sku should allow it tho.
on (a) if the subscripion allows it, we should. I would assume if the beta exposes 4 products, one of which is LB, then installing LB should make make the numbers go to 2 of 4.

I think we should show 2 of 4 as "compliant" howeverr.

--b k

Comment 4 Devan Goodwin 2010-12-22 18:26:24 UTC
More debugging info, it seems like the entitlement cert does not provide the correct products to match what is coming down in the product certs when something is yum installed:

The product cert for RHEL: (note this says Alpha, the subscription says Beta)

       X509v3 extensions:
            X509v3 Basic Constraints: 
                .,Red Hat Enterprise Linux 6 Entitlement Alpha

The product cert for load balancer:

       X509v3 extensions:
            X509v3 Basic Constraints: 
                .?Red Hat Enterprise Linux Load Balancer (for RHEL 6 Entitlement)

I will attach the extensions for the entitlement cert because it's pretty huge bug the key things, I think there may be confusion on the product hashes vs content set IDs.

After the yum group install, he gets two product certs for 406 and 408. The entitlement does not provide either of these. 408 does appear as a content set ID, though for scalable file system, not load balancing. Similarly 406 is there as a content ID, but also for scalable file system rather than RHEL.

In the entitlement cert, it looks like RHEL 6 product ID should be 37, and load balancer product ID should be 47.

                .&Red Hat Enterprise Linux 6 Entitlement

                .?Red Hat Enterprise Linux Load Balancer (for RHEL 6 Entitlement)

But the product certs are for 406 and 408.

Comment 5 Devan Goodwin 2010-12-22 18:29:06 UTC
Created attachment 470276 [details]
Entitlement certificate extensions.

Comment 6 Devan Goodwin 2010-12-22 19:33:52 UTC
Assigning to Dennis, he thinks it should be fixed now, can we get a re-test?

Comment 8 J.C. Molet 2010-12-23 15:08:56 UTC
Tests now pass, all packages installed from subscription repos install under compliance.

Comment 9 errata-xmlrpc 2011-05-19 13:38:20 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.