Bug 885159 - yum don't warning for cert. files with the same basename
Summary: yum don't warning for cert. files with the same basename
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: yum
Version: 6.4
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Packaging Maintenance Team
QA Contact: Patrik Kis
URL:
Whiteboard:
: 887241 887322 (view as bug list)
Depends On:
Blocks: 841211
TreeView+ depends on / blocked
 
Reported: 2012-12-07 16:01 UTC by Patrik Kis
Modified: 2014-01-21 06:25 UTC (History)
10 users (show)

Fixed In Version: yum-3.2.29-37.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-21 10:13:12 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:0406 normal SHIPPED_LIVE yum bug fix and enhancement update 2013-02-20 20:50:44 UTC

Description Patrik Kis 2012-12-07 16:01:08 UTC
Description of problem:
Yum should display a warning when sslclientcert values with the same basename are configured in a repo.
This was reported and fixed in bug 695427.

Version-Release number of selected component (if applicable):
yum-3.2.29-36.el6.noarch

How reproducible:
always

Steps to Reproduce:
1. Configure a repo like this:
cat > /etc/yum.repos.d/bz695427.repo <<EOF
[bz695427_1]
name=bz695427_1
baseurl=https://localhost/bz695427repo
enabled=1
gpgcheck=0
#sslverify=false
sslcacert=$TmpDir/myca.crt
sslclientcert=/tmp/foo/cert.pem

[bz695427_2]
name=bz695427_2
baseurl=https://localhost/bz695427repo
enabled=1
gpgcheck=0
#sslverify=false
sslcacert=$TmpDir/myca.crt
sslclientcert=/tmp/bar/cert.pem

EOF
2. Check the result
# yum --disablerepo='*' --enablerepo=bz695427_1 --enablerepo=bz695427_2 check-update; echo $?
Loaded plugins: downloadonly, fastestmirror, product-id, security, subscription-manager, tmprepo
Updating certificate-based repositories.
Unable to read consumer identity
Repo bz695427_1 forced skip_if_unavailable=True due to: /tmp/tmp.h7rRc1HyBc/myca.crt
Repo bz695427_1 forced skip_if_unavailable=True due to: /tmp/foo/cert.pem
Repo bz695427_2 forced skip_if_unavailable=True due to: /tmp/tmp.h7rRc1HyBc/myca.crt
Repo bz695427_2 forced skip_if_unavailable=True due to: /tmp/bar/cert.pem
Loading mirror speeds from cached hostfile
https://localhost/bz695427repo/repodata/repomd.xml: [Errno 14] PYCURL ERROR 7 - "couldn't connect to host"
Trying other mirror.
https://localhost/bz695427repo/repodata/repomd.xml: [Errno 14] PYCURL ERROR 7 - "couldn't connect to host"
Trying other mirror.
0

NOTE: In previous verison the pycurl errors did not appeared so it seams that the configuration was evaluated before the url is touched. See the details in expected results.

3. Even if the rep is correctly configured there is no warning:
# yum --disablerepo='*' --enablerepo=bz695427_1 --enablerepo=bz695427_2 check-update; echo $?
Loaded plugins: downloadonly, fastestmirror, product-id, security, subscription-
              : manager, tmprepo
Updating certificate-based repositories.
Unable to read consumer identity
Repo bz695427_1 forced skip_if_unavailable=True due to: /tmp/foo/cert.pem
Repo bz695427_2 forced skip_if_unavailable=True due to: /tmp/bar/cert.pem
Loading mirror speeds from cached hostfile
0
#

Actual results:
no warning like, sslclientcert basename shared between foo and bar

Expected results:

# yum --disablerepo='*' --enablerepo=bz695427_1 --enablerepo=bz695427_2 check-update; echo $?
Loaded plugins: downloadonly, fastestmirror, product-id, security, subscription-
              : manager, tmprepo
Updating certificate-based repositories.
Unable to read consumer identity
Repo bz695427_1 forced skip_if_unavailable=True due to: /tmp/foo/cert.pem
Repo bz695427_2 forced skip_if_unavailable=True due to: /tmp/bar/cert.pem


sslclientcert basename shared between bz695427_2 and bz695427_1
1
#
# # rpm -q yum
yum-3.2.29-30.el6.noarch

Comment 2 Zdeněk Pavlas 2012-12-10 15:03:47 UTC
1) Confirmed regression, the code that checks for duplicated basenames is dead, as _getRepos() is never called with doSetup = True.

2) This probably never worked, UNLESS at least one --enablerepo option was used.  Patch BZ-880968-verify-options-before-diiung.patch removes self.base._getRepos(doSetup=True) call when handling --enablerepo option, so it manifests as a regression.

3) This bug is also present in HEAD.

Comment 3 Zdeněk Pavlas 2012-12-10 15:26:10 UTC
Fixing this is probably simple: http://lists.baseurl.org/pipermail/yum-devel/2012-December/009818.html

Comment 4 James Antill 2012-12-11 21:05:47 UTC
 Added the latest patch that's ACKd.

Comment 11 Zdeněk Pavlas 2012-12-17 08:30:32 UTC
Added missing imports and checks to the backport.  Fixed in 3.2.29-38.

http://bulk-mail.corp.redhat.com/archives/cvs-commits-list/2012-December/msg04653.html

Comment 12 Zdeněk Pavlas 2012-12-17 09:01:57 UTC
*** Bug 887322 has been marked as a duplicate of this bug. ***

Comment 13 Zdeněk Pavlas 2012-12-17 16:36:31 UTC
*** Bug 887241 has been marked as a duplicate of this bug. ***

Comment 16 errata-xmlrpc 2013-02-21 10:13:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0406.html


Note You need to log in before you can comment on or make changes to this bug.