Re: RHEL9?

Much gratitude to you David for testing things out and getting back.

Yes, I hear you about latest versus stable and agree.

I will do some research to see if we can make our packages a bit more 
adaptable. SELinux is the real culprit here I think. Either that or our 
understanding of how to work with it and packaging.

Be well, and hope to get back to you soon,
Craig

On Thursday, February 23, 2023 at 8:17:44 AM UTC-6 
[email protected] wrote:

> Craig,
>
> Many thanks for the update.  Apologies for the delay in acknowledging (I 
> do a three day week, usually Wed-Fri).
>
> I've successfully grabbed the 3.18 and 3.21 RPMs from the "nightly" URL at 
> the end of your email.  Thanks.
>
> With both versions, my "yum install ...." from that file fails quickly at 
> the "selinux" point that you mention.  Yet a subsequent "yum upgrade" says 
> "Nothing to do. Complete!"  A "yum list" reports that our Satellite channel 
> is at version "34.1.29-1.el9_0.2".
>
> Is there a particular reason why your RPMs requires the very, very latest 
> version of that RH "selinux-policy" RPM?  Is there some unavoidably 
> essential feature of it that is absent at 34.1.29?
>
> I know that developers love working on the very latest things.  But could 
> I, as an end-user (not developer) of the product, suggest that the release 
> environment (as perhaps distinct from the development environment) that is 
> packaging these RPMs be accepting of somewhat earlier versions?  End-user 
> sites, such as us, often have very good reasons (local stability, etc.) for 
> deliberately being a little behind latest releases.  And if we're having 
> that trouble, doubtless other sites, too, will also encounter it.
>
> Happy to continue that particular conversation off-list if you wish.  Use 
> my Diamond email address for that.
>
> Anyway, if you could package with a more flexible/generous dependency, 
> that would be useful.
>
> All the best.
>
> -- David Lee
>
>
> On Friday, 17 February 2023 at 15:44:30 UTC [email protected] wrote:
>
>> Hi David,
>>
>> We have just fixed up our nightly community packages for rhel8 and rhel9 
>> and these builds should ierrornclude the fix for selinux policy module 
>> import during install.
>>
>> If the selinux policy included in our package is newer than the version 
>> in the OS you will get an error with instructions 
>> <https://github.com/cfengine/buildscripts/blob/master/packaging/common/cfengine-non-hub/postinstall.sh#L121-L150> 
>> on what to do. The source for the selinux policy is included in the RPM now 
>> so you can build it custom for your system if need be.
>>
>> For example, on an rhel 9 system that is not upgraded I get:
>>
>> Error:
>>   Problem: conflicting requests
>>     - nothing provides selinux-policy >= 34.1.43 needed by 
>> cfengine-community-3.21.1a.921398ce3-25452.el9.x86_64
>>
>> The best option is to upgrade your system which should ensure that your 
>> selinux and kernel are the same or newer than the policy included in our 
>> package.
>>
>> cf-remote can show you the package URL:
>>
>> $ cf-remote --version 3.21.x list --edition community el9 Available 
>> releases: master, 3.21.x, 3.21.0, 3.18.x, 3.18.3, 3.18.2, 3.18.1, 3.18.0 
>> Using 3.21.x LTS: 
>> http://buildcache.cfengine.com/packages/testing-pr/jenkins-community-nightly-3.21.x-42/PACKAGES_x86_64_linux_redhat_9/cfengine-community-3.21.1a.921398ce3-25452.el9.x86_64.rpm
>>
>> or can install if the host has nopasswd sudo access:
>>
>> $ cf-remote --version 3.21.x install --edition community --clients 
>> vagrant@rhel-9
>>
>> Also available on the website: 
>> https://cfengine.com/downloads/cfengine-community-nightly/
>>
>> Let us know how it goes!
>> -Craig
>>
>> On Thursday, January 19, 2023 at 9:31:49 AM UTC-6 
>> [email protected] wrote:
>>
>>> Craig,
>>>
>>> Many thanks.  In this context, we are simply end-users.  We'd like to 
>>> get RHEL9 prepared, but we can probably wait until you have an RPM 
>>> (assuming the next few weeks).  That said, when you believe your RPM is in 
>>> a reasonable beta (or release-candidate or pre-release) state let me know 
>>> and I can give it a try and report back.  This would apply both to 3.21 and 
>>> to 3.18 backport.
>>>
>>> Thanks.
>>>
>>> -- David Lee
>>>
>>> On Friday, 6 January 2023 at 21:30:47 UTC [email protected] wrote:
>>>
>>>> Hi David,
>>>>
>>>> I am working on this right now and have worked up a solution.
>>>>
>>>> Essentially our compiled cfengine-enterprise.pp selinux policy is 
>>>> compiled to a certain policydb version.
>>>>
>>>> Probably the best work-around for you right now is to re-compile the 
>>>> policy yourself from sources in the cfengine core repository.
>>>>
>>>> $ git clone https://github.com/cfengine/core --depth 1 # or use what 
>>>> you have already checked out
>>>> $ sudo yum install selinux-policy-devel
>>>> $ cd core/misc/selinux
>>>> $ make -f /usr/share/selinux/devel/Makefile -j1
>>>> $ sudo semodule -n -i cfengine-enterprise.pp
>>>>
>>>> See this pair of PRs for core and buildscripts for my pretty close to 
>>>> done work in progress for solving this in the installer package:
>>>>
>>>> https://github.com/cfengine/core/pull/5146
>>>> https://github.com/cfengine/buildscripts/pull/1187
>>>>
>>>> Where I have added a Requires for the version of selinux-policy package 
>>>> that we use when we build the package and similar work-around notes as 
>>>> above if the module fails to import.
>>>>
>>>> Cheers,
>>>> Craig
>>>>
>>>>
>>>> On Friday, January 6, 2023 at 12:37:49 PM UTC-6 Nick Anderson wrote:
>>>>
>>>>> "t.d…@servicemusic.org.uk" <[email protected]> writes: 
>>>>>
>>>>> I observe that the community download page 
>>>>> https://cfengine.com/downloads/cfengine-community/ offers 
>>>>> RHEL9/CentOS9 for 3.21.0 LTS (good) but not for 3.18.3 LTS. If 3.18.3 now 
>>>>> supports RHEL9, could that page be investigated and rectified, please? 
>>>>> (Because of "rxdirs" I'd rather avoid 3.21 for the moment… there's plenty 
>>>>> of other catch-up for me to do prior to that! So if a 3.18/RHEL9 RPM s 
>>>>> available that would be great.) 
>>>>>
>>>>> That's because we have not released a 3.18 package for el9. The 3.18.x 
>>>>> output I showed you was from nightly builds, so 3.18.4 (hopefully). 
>>>>>
>>>>> Meanwhile: a possible "semodule" bug report for 3.21 on RHEL9. Latest 
>>>>> OS (yum upgrade); I had installed before Christmas. I hit the problem just 
>>>>> now; then did a yum upgrade (lots of packages upgraded), then rebooted, 
>>>>> then tried again. Problem still there. This is the latest:: 
>>>>>
>>>>> Yeah, we have noticed some issues with el9 and needing to be updated 
>>>>> in order for the package to install. We are still looking at how to best 
>>>>> address it. 
>>>>>
>>>>> – Nick Anderson | Doer of Things | (+1) 785-550-1767 
>>>>> <(785)%20550-1767> | https://northern.tech 
>>>>>
>>>>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/de1302bf-881e-4fa4-a3d9-791dd7192ffen%40googlegroups.com.