Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upqubes-download-dom0-updates.sh gets confused by dns resolution issues #1168
Comments
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
marmarek
Sep 5, 2015
Member
This would be much less of an issue if we had newer yum in debian template - then yum --downloadonly could be used which is much more robust than manually constructing packages list and download them using yumdownloader. There is already a code to detect if yum is new enough.
Yum exit code 100 means "updates available", not an error:
check-update
Implemented so you could know if your machine had any updates
that needed to be applied without running it interactively.
Returns exit value of 100 if there are packages available for an
update. Also returns a list of the packages to be updated in
list format. Returns 0 if no packages are available for update.
Returns 1 if an error occurred. Running in verbose mode also
shows obsoletes.The problem is that yum is one of that software that uses stdout for errors...
I think the grep -v Obsoleting line could be improved to match actual packages instead of filtering out non-packages lines.
|
This would be much less of an issue if we had newer check-update
Implemented so you could know if your machine had any updates
that needed to be applied without running it interactively.
Returns exit value of 100 if there are packages available for an
update. Also returns a list of the packages to be updated in
list format. Returns 0 if no packages are available for update.
Returns 1 if an error occurred. Running in verbose mode also
shows obsoletes.The problem is that yum is one of that software that uses stdout for errors... |
marmarek
added this to the Release 3.1 milestone
Sep 5, 2015
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
adrelanos
Sep 5, 2015
Member
Then yum is also affected by a similar issue as Debian Template: build script security - deal with 'apt-get update' unreliable exit codes (#1107).
|
Then |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
marmarek
Sep 6, 2015
Member
Not really, in case of error, it returns 1. You can explicitly
configure repository to be ignored in case of errors, but unless you do,
you'll get return code 1 if yum isn't able to check such repo. Note
that if yum have cached (not expired) data, it will use it instead of
failing. By default cache expire after 6 hours (according to man yum.conf).
This means that qubes-download-dom0-updates.sh should check if exit
code is 1.
Example error message after breaking repo and cleaning cache:
[root@testvm user]# yum clean all
Loaded plugins: langpacks, post-transaction-actions, yum-qubes-hooks
Cleaning repos: fedora qubes-vm-r3.0-current rpmfusion-free
: rpmfusion-free-updates rpmfusion-nonfree
: rpmfusion-nonfree-updates tor tor-source updates
Cleaning up everything
[root@testvm user]# yum check-update
Loaded plugins: langpacks, post-transaction-actions, yum-qubes-hooks
One of the configured repositories failed (Fedora 21 - x86_64),
and yum doesn't have enough cached data to continue. At this point the only
safe thing yum can do is fail. There are a few ways to work "fix" this:
1. Contact the upstream for the repository and get them to fix the problem.
2. Reconfigure the baseurl/etc. for the repository, to point to a working
upstream. This is most often useful if you are using a newer
distribution release than is supported by the repository (and the
packages for the previous distribution release still work).
3. Disable the repository, so yum won't use it by default. Yum will then
just ignore the repository until you permanently enable it again or use
--enablerepo for temporary usage:
yum-config-manager --disable fedora
4. Configure the failing repository to be skipped, if it is unavailable.
Note that yum will try to contact the repo. when it runs most commands,
so will have to try and fail each time (and thus. yum will be be much
slower). If it is a very temporary problem though, this is often a nice
compromise:
yum-config-manager --save --setopt=fedora.skip_if_unavailable=true
Cannot retrieve metalink for repository: fedora/21/x86_64. Please verify
its path and try again
[root@testvm user]# echo $?
1
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
|
Not really, in case of error, it returns This means that Example error message after breaking repo and cleaning cache: Best Regards, |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
marmarek
Oct 10, 2015
Member
Back to the original issue - it seems that yum prints that error to stdout instead of stderr. But I can't reproduce it on Debian 8 VM - error is properly printed on stderr. Anything special in Whonix Gw that would matter here?
|
Back to the original issue - it seems that yum prints that error to stdout instead of stderr. But I can't reproduce it on Debian 8 VM - error is properly printed on stderr. Anything special in Whonix Gw that would matter here? |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
adrelanos
Oct 10, 2015
Member
Anything special in Whonix Gw that would matter here?
No. Stderr/stdout just works normal.
No. Stderr/stdout just works normal. |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
marmarek
Oct 10, 2015
Member
I wanted to say that Debian have the same yum version as Fedora 21 (3.4.3), but then I've checked yum source package in Fedora - there are 7 patches. One of them is named yum-HEAD.patch and have almost 6MB... Yes, you've guessed correctly.
Can we ignore this problem? Just add error code checking (which actually I've already done, just not pushed yet).
|
I wanted to say that Debian have the same yum version as Fedora 21 (3.4.3), but then I've checked yum source package in Fedora - there are 7 patches. One of them is named Can we ignore this problem? Just add error code checking (which actually I've already done, just not pushed yet). |
added a commit
to marmarek/old-qubes-core-agent-linux
that referenced
this issue
Oct 11, 2015
added a commit
to marmarek/old-qubes-core-agent-linux
that referenced
this issue
Oct 11, 2015
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
adrelanos
Oct 11, 2015
Member
Marek Marczykowski-Górecki:
Can we ignore this problem?
Yes. Let's not go in circles. Just wait until a "better" yum version
gets available in Debian.
|
Marek Marczykowski-Górecki:
Yes. Let's not go in circles. Just wait until a "better" yum version |
adrelanos commentedSep 5, 2015
/usr/lib/qubes/qubes-download-dom0-updates.shgets confused by dns resolution issues.(This happened while using a Qubes-Whonix-Gateway.)
The problematic line seems to be.
It gets confused by lines such as.
A related issue seems to be, that exit codes aren't checked in that script.
Fortunately, it looks like
yumwould exit non-zero (100) in such cases. So actually checking the exit codes before using output byyumcould solve this issue.Full xtrace.