Bug 754255 - building a template from a katello export is unable to authenticate CA cert
Summary: building a template from a katello export is unable to authenticate CA cert
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Content Management
Version: 6.0.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified vote
Target Milestone: Unspecified
Assignee: Katello Bug Bin
QA Contact: Katello QA List
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-15 20:53 UTC by wes hayutin
Modified: 2019-09-26 13:24 UTC (History)
2 users (show)

Fixed In Version: katello-0.1.174-2.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-01-17 21:32:12 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description wes hayutin 2011-11-15 20:53:19 UTC
Description of problem:
11-11-15 15:30:31,500 DEBUG oz.Guest.FedoraGuest pid(18072) Message: Could not do direct boot, fetching boot.iso instead (the following erro
r message is useful for bug reports, but can be ignored)
2011-11-15 15:30:31,500 DEBUG oz.Guest.FedoraGuest pid(18072) Message: (60, 'Peer certificate cannot be authenticated with known CA certificat
es')
2011-11-15 15:30:31,500 INFO oz.Guest.FedoraGuest pid(18072) Message: Generating install media
2011-11-15 15:30:31,500 INFO oz.Guest.FedoraGuest pid(18072) Message: Fetching the original media
2011-11-15 15:30:31,500 DEBUG oz.Guest.FedoraGuest pid(18072) Message: Attempting to get the lock for /home/var/lib/oz/isos/Fedora15x86_64-url
.iso
2011-11-15 15:30:31,501 DEBUG oz.Guest.FedoraGuest pid(18072) Message: Got the lock, doing the download
2011-11-15 15:30:31,954 INFO oz.Guest.FedoraGuest pid(18072) Message: Fetching the original install media from https://smqe-gkhachik.brq.redha
t.com/pulp/ks/ACME_Corporation/Locker/fedora15/f14-x86_64//images/boot.iso
2011-11-15 15:30:32,208 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Exception caught in ImageFactory
2011-11-15 15:30:32,208 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/imgfac/builders/Fedora_vsphere_Builder.py", line 85, in build_upload
    guest.generate_install_media(force_download=False)
  File "/usr/lib/python2.7/site-packages/oz/RedHat.py", line 743, in generate_install_media
    return self._iso_generate_install_media(fetchurl, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1478, in _iso_generate_install_media
    self._get_original_iso(url, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1173, in _get_original_iso
    self._get_original_media(isourl, self.orig_iso, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 758, in _get_original_media
    self._download_file(url, fd, True)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 645, in _download_file
    c.perform()
error: (60, 'Peer certificate cannot be authenticated with known CA certificates')

2011-11-15 15:30:32,208 DEBUG imgfac.BuildJob.BuildJob pid(18072) Message: Builder (aaac2310-f022-4528-acf7-44fea2309ff6) changed status from 
BUILDING to FAILED
2011-11-15 15:30:32,208 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Exception caught in ImageFactory
2011-11-15 15:30:32,209 DEBUG imgfac.builders.BaseBuilder.Fedora_vsphere_Builder pid(18072) Message: Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/imgfac/builders/Fedora_vsphere_Builder.py", line 49, in build_image
    self.build_upload(build_id)
  File "/usr/lib/python2.7/site-packages/imgfac/builders/Fedora_vsphere_Builder.py", line 85, in build_upload
    guest.generate_install_media(force_download=False)
  File "/usr/lib/python2.7/site-packages/oz/RedHat.py", line 743, in generate_install_media
    return self._iso_generate_install_media(fetchurl, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1478, in _iso_generate_install_media
    self._get_original_iso(url, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 1173, in _get_original_iso
    self._get_original_media(isourl, self.orig_iso, force_download)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 758, in _get_original_media
    self._download_file(url, fd, True)
  File "/usr/lib/python2.7/site-packages/oz/Guest.py", line 645, in _download_file
    c.perform()
error: (60, 'Peer certificate cannot be authenticated with known CA certificates')

2011-11-15 15:30:32,209 DEBUG imgfac.BuildJob.BuildJob pid(18072) Message: Builder (aaac2310-f022-4528-acf7-44fea2309ff6) changed status from FAILED to FAILED

[root@qeblade31 ~]# rpm -qa | grep aeolus
aeolus-conductor-daemons-0.6.0-0.20111114172747gitde62906.fc15.noarch
aeolus-configure-2.3.0-0.20111111160331git9bde372.fc15.noarch
aeolus-all-0.6.0-0.20111114172747gitde62906.fc15.noarch
aeolus-conductor-0.6.0-0.20111114172747gitde62906.fc15.noarch
aeolus-conductor-devel-0.6.0-0.20111114172747gitde62906.fc15.noarch
rubygem-aeolus-cli-0.1.0-3.20111115145311git5ec94c5.fc15.noarch
rubygem-aeolus-image-0.1.0-4.20111024205454git6b2b696.fc15.noarch
aeolus-conductor-doc-0.6.0-0.20111114172747gitde62906.fc15.noarch

Comment 1 Ian McLeod 2011-11-16 22:32:23 UTC
Per a thread from the Katello guys, this is an error in their template generation.

Anaconda cannot, in the general case, install from an https location.

They should have an update already available that outputs "http" URLs for the <os> section of the TDL.

Cloding.

Comment 2 wes hayutin 2011-11-16 22:40:57 UTC
looking for some comments from Hugh or Chris

Comment 3 wes hayutin 2011-11-17 16:56:37 UTC
I've been told.. changing
<?xml version="1.0" encoding="UTF-8"?><template><name>t</name><os><name>Fedora</name><version>15</version><arch>x86_64</arch><rootpw>redhat</rootpw><install type="url"><url>htts:/

to 

<?xml version="1.0" encoding="UTF-8"?><template><name>t</name><os><name>Fedora</name><version>15</version><arch>x86_64</arch><rootpw>redhat</rootpw><install type="url"><url>http:/

should resolve this issue

Chris Alfonso mentioned tsanders and bkearney are aware of the issue

Comment 4 wes hayutin 2011-11-18 16:17:06 UTC
working this now

Comment 5 wes hayutin 2011-11-28 01:17:19 UTC
removing bugs from ce-sprint from the tracker.. you can find these bugs by querying the "qa whiteboard" for ce-sprint-60

Comment 6 wes hayutin 2011-11-30 15:11:42 UTC
moving to jlaska

Comment 7 James Laska 2012-01-17 14:07:41 UTC
This bug is currently assigned to rubygem-aeolus-cli.  I don't believe anything has been fixed here on the rubygem-aeolus-cli side.

For katello generated templates, the <install><url> now contains http *only* URLs (not https).  Also, all <repository><url> sections use https URLs.

This has been VERIFIED using katello-0.1.174-2.el6.  Unless I'm misunderstanding this report, I'm tempted to reassign this to katello, and mark it as VERIFIED -> CLOSED.

Comment 8 James Laska 2012-01-17 21:31:57 UTC
This problem was fixed by katello no longer generating <install> <url>'s that contain https.


Note You need to log in before you can comment on or make changes to this bug.