[14:55]  * skaet waves hello, and goes to line up her starting remarks  ;)
[14:55]  * smartboyhw waves
[14:55] <skaet> :)
[14:56] <mdeslaur> hello
[14:56] <davmor2> skaet: are they, are you sitting comfortably then I'll begin......?
[14:56] <smartboyhw> ow two weeks before release
[14:57] <skaet> davmor2,  I'll start the meeting at the top of the hour.
[14:57] <skaet> hiya mdeslaur
[14:58] <smartboyhw> Uh oh skaet did balloons sent his release team mail?
[14:58] <skaet> smartboyhw,  afraid not.
[14:58] <skaet> or at least I didn't see anything when I did a final check 10 minutes ago
[14:58] <smartboyhw> skaet, I told him to do so for a part in the marathon clearly he didn't listen to the advice oh man
[14:59] <smartboyhw> Hmm....
[15:00] <ogra_> yo
[15:00] <skaet> smartboyhw,  if you know of any issues that he may have been concerned about,  feel free to bring up during the meeting.
[15:00] <skaet> #startmeeting
[15:00] <meetingology> Meeting started Fri Oct  5 15:00:14 2012 UTC.  The chair is skaet. Information about MeetBot at http://wiki.ubuntu.com/meetingology.
[15:00] <meetingology> Available commands: #accept #accepted #action #agree #agreed #chair #commands #endmeeting #endvote #halp #help #idea #info #link #lurk #meetingname #meetingtopic #nick #progress #rejected #replay #restrictlogs #save #startmeeting #subtopic #topic #unchair #undo #unlurk #vote #voters #votesrequired
[15:00] <skaet> https://wiki.ubuntu.com/ReleaseTeam/Meeting/2012-10-05.
[15:00] <skaet> Upcoming dates:
[15:00] <skaet> 12.10
[15:00] <skaet>     2012/10/04: Kernel Freeze and Desktop Infrastructure Freeze at 2100 UTC
[15:00] <skaet>     2012/10/09: Translation Deadline at 1030 UTC and Final Freeze at 2100 UTC
[15:00] <skaet>     2012/10/11 - Release Candidate, and Release Note Content Freeze
[15:00] <skaet>     2012/10/16 - Unseeded Universe Final Freeze
[15:00] <skaet>     October 18 - 12.10 Release
[15:00] <skaet> .
[15:00] <skaet> Bugs:
[15:00] <skaet> Development teams are trying to fix: http://reports.qa.ubuntu.com/reports/rls-mgr/rls-q-tracking-bug-tasks.html
[15:00] <skaet> To be considered for fixing: http://reports.qa.ubuntu.com/reports/rls-mgr/rls-q-incoming-bug-tasks.html
[15:00] <skaet> .
[15:00] <skaet> Work Items:
[15:00] <skaet> 2012/10/05 -  2997 (was 2997  - 2012/09/28):   Thank you for the recent push to clean up the feature status.  :)
[15:00] <skaet> We are still behind the trendline for some of the projects.  Please help get us back where we should be by making sure https://launchpad.net/~/+upcomingwork is up to date for your tasks. If something is clearly not going to make it this cycle, please mark it POSTPONED.
[15:00] <skaet> .
[15:00] <skaet> Thanks to those who sent in status emails,  if there are recent additions, could you please paste the link here in the channel,  since there weren’t that many when I checked earlier this morning...
[15:00] <skaet> .
[15:00] <skaet> Weekly Status Received:
[15:00] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/001997.html  - QA - plars
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/001999.html - desktop - didrocks
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/001996.html - security - mdeslaur
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002010.html  - HWCert - roadmr https://lists.ubuntu.com/archives/ubuntu-release/2012-October/001998.html - kernel - ogasawara
[15:01] <skaet> - ubuntu one
[15:01] <skaet> - community - balloons
[15:01] <skaet> - server - arosales
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002000.html - linaro - fabo
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002002.html - Unity - popey
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002008.html - foundations - ogra_
[15:01] <skaet> https://lists.ubuntu
[15:01] <skaet> hmm... seem to have run into a buffer limit,  :P,  here's the rest
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002001.html  - kubuntu - RIddell
[15:01] <skaet> - edubuntu - stgraber
[15:01] <skaet> - xubuntu - knome
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002009.html- Ubuntu Studio - smartboyhw
[15:01] <skaet> https://lists.ubuntu.com/archives/ubuntu-release/2012-October/002003.html  - Lubuntu - gilir
[15:01] <skaet> #topic Comments and Questions
[15:02] <highvoltage> skaet: stgraber and myself are at a hackfest so apologies for missing the Edubuntu notes
[15:02] <highvoltage> skaet: afaict there wasn't something specifically noteworthy to report this week
[15:02] <skaet> thanks highvoltage,   if there are issues,  bring it up today.  But glad things seem to be smooth.
[15:03] <skaet> usual conventions apply,  please raise hand 'o/', if you have question.
[15:03] <highvoltage> ok will do
[15:03] <skaet> welcome everyone
[15:03] <Riddell> hi
[15:03] <skaet> we're entering the final push of bug fixes before we go into final freeze next Tuesday.
[15:04] <seb128> skaet, (desktop -> I'm back from holidays so didrocks->-seb128)
[15:04] <skaet> Thanks seb,  sorry about that on the summary.
[15:04] <seb128> (np ;-)
[15:04] <skaet> any other corrections or additons to the list of status?
[15:04] <skaet> Daviey,  are you covering for arosales this week?
[15:05] <skaet> hmm... while we wait to hear from Daviey (and find out if there are any concerns on the server side)
[15:06] <skaet> want to know if anyone else has concerns not in the weekly status already they want to bring up?
[15:06] <skaet> key bug fixes needed,  etc.?
[15:06] <Daviey> skaet: yes
[15:06] <skaet> Thanks Daviey,   what's on the radar to land between now and Final Freeze?   anything critical?
[15:07] <Riddell> I've had a mysterious report of installs not finishing which I can't recreate - bug 1062180
[15:07] <Daviey> skaet: I would be expecting at least one more maas upload (on cd), and various openstack uploads (archive only)
[15:08] <Daviey> There are a few bugs being caught at the moment, which are a little nasty
[15:08] <skaet> ok.   we have mozilla decision (and possible upload)  on Tuesday next week.   Can you avoid it?
[15:09] <skaet> ie.  can we get the maas issues mostly landed by EOD monday?
[15:11] <skaet> Daviey, ^?
[15:12] <Daviey> skaet: unlikely
[15:12] <Daviey> skaet: I wouldn't be surprised if there are a couple of smallish things still trickling in towards the end of the week
[15:13] <skaet> Daviey, we're spinning release candidates up on Thursday, so SRU time after tuesday (Final Freeze),  unless they are release critical.
[15:13] <Daviey> right!
[15:13] <skaet> ..
[15:13] <Daviey> (thanks)
[15:14] <Laney> is freeipmi in a position to be MIRed?
[15:14] <skaet> plars, have you seen any sign of bug Riddell mentions?
[15:14] <Laney> Daviey: ^
[15:14]  * plars looks
[15:14] <plars> doesn't sound familiar
[15:14] <skaet> Riddell,  anyone else able to confirm it?
[15:15] <plars> I just finished up an amd64 installation a few minutes ago, and I know psivaa has done some this morning also, but we'll keep an eye out for it
[15:15] <skaet> (and yeah if there is something weird going on, and its common,  nows the time to know ;) )
[15:15] <Riddell> skaet: xnox had no initial ideas
[15:15] <skaet> thanks plars.  :)
[15:15] <jibel> plars, Riddell skaet sounds like bug 1059619
[15:16] <Riddell> jibel: mm could be, I'll pass that to the reporter
[15:17] <skaet> thanks jibel,  Riddell
[15:17] <skaet> ..
[15:17] <plars> jibel: you have a reliable way to reproduce?
[15:17] <jibel> plars, yes my 2 laptops
[15:18] <Daviey> Laney: it was in progress, checking state.. Needed one more fix.
[15:20] <Daviey> (I'm sure it will be fixed today)
[15:20] <Daviey> ..
[15:21] <Laney> ok, just wondering as that component mismatch has been around for quite some time ..
[15:21] <Daviey> .. but not forgot.
[15:22] <skaet> ogra_, plars - how are the arm desktop and server test results looking?
[15:22] <ogra_> pretty good i think
[15:23] <plars> I'm looking at desktop right now
[15:23] <plars> about to take a look at server
[15:23]  * ogra_ doesnt expect any regressions
[15:24] <ogra_> it will be as speedy and blingy as it was in beta on desktop :)
[15:24] <plars> I was just discussing an audio issue, and a keyboard issue with ogra_ but nothing affecting installation on desktop at the moment
[15:24] <plars> for server, I had an issue with the keyboard not working at all, and I know that some people have reported that their hdmi monitor doesn't work on install with -server
[15:24] <plars> mine works though
[15:24] <skaet> plars,  thanks.   Can you send an update to your weekly status that summarizes the results of the testing on arm after you finish looking?  Want to make sure we all have a clean picture of what should be good, and what needs to be release noted.
[15:24] <plars> skaet: yep
[15:24] <skaet> thanks plars!  :)
[15:24] <ogra_> plars, yeah, as paolo just said, kbd should be fixed ... wrt HDMI i would blame the monitors
[15:24]  * Daviey doesn't write regressive code.
[15:25]  * ogra_ knows there are still a few that dont work with the driver due to broken EDIDs
[15:25] <ogra_> ..
[15:25] <skaet> ..
[15:26] <skaet> seb128,  are we likely to get a fix for fontconfig in next day or so,  so we can put ubuntu medium font back in?
[15:27] <seb128> skaet, not that I know about, we don't have anyone in desktop who knows about fonts/fontconfig
[15:27] <seb128> not sure if foundation,slangasek is looking at that
[15:27] <Laney> there's a fontconfig fix needed?
[15:27] <ogra_> longstanding ...
[15:27] <seb128> Laney, the libreoffice issue seems to be a fontconfig issue
[15:27]  * skaet nods
[15:28] <seb128>  https://bugs.freedesktop.org/show_bug.cgi?format=multiple&id=38737
[15:28] <Laney> I thought somebody worked around that in the font itself
[15:28] <slangasek> seb128: we don't have anyone in foundations who knows about fontconfig either
[15:29] <seb128> (slangasek, sorry, I keep thinking  (wrongly) that you maintain fontconfig as well as freetype in Debian which is why I listed your name ;-)
[15:29] <slangasek> :)
[15:29] <seb128> Laney, who is working on the font?
[15:29] <skaet> popey,  is thre anyone in your organization that can help here?
[15:29] <seb128> Laney, well, Sweetshark wrote:
[15:29] <seb128> "
[15:29] <seb128> this seems not to be an issue in LibreOffice, but in fontconfig. If I read that
[15:29] <seb128> bug right, it would need to be fixed either in fontconfig or workarounded in
[15:29] <seb128> the Ubuntu font itself, but not in LibreOffice." "
[15:30] <popey> skaet, we had one guy looking at it, but unfortunately had vacation before he could get to the bottom of it
[15:30] <seb128> Laney, skaet: I've no clue who is in charge of the font or could "workaround in the font itself" there
[15:30] <slangasek> seems to me that this should be reverted in the font then
[15:30] <popey> then it was passed to Sweetshark to investigate
[15:30] <slangasek> it seems very unlikely we're going to fix it on the software side before release
[15:30] <popey> we have nobody internally who can work directly on the font - we have to contact DM
[15:30] <seb128> popey, yeah, Sweetshark concluded that there is nothing libreoffice could do there
[15:30] <popey> yeah
[15:30] <seb128> and he has been fighting lo-appmenu stuff the whole week
[15:31] <slangasek> popey: is there a compelling reason NOT to revert the medium change?
[15:31] <popey> yes, he's busy, we were lucky to get a slice of him
[15:31] <Laney> slangasek: it already has been
[15:31] <slangasek> oh, then what's still outstanding for the release?
[15:31] <Laney> putting it back
[15:31] <slangasek> I thought this was only about the medium-weight font
[15:31] <popey> we would like it in, that's all
[15:31] <skaet> trying to get all the bugs fixed.
[15:31] <seb128> slangasek, I think the sabdfl was pushing on the bug for us to resolve the issues and restore the font
[15:31] <slangasek> ah
[15:31] <popey> that's right
[15:32] <seb128> I'm not sure how unhappy he and others are going to be if that's not the case...
[15:32] <seb128> ..
[15:33] <skaet> popey,  will you take it up with your management and see if we can come up with other options for getting this sorted?
[15:33] <popey> yup
[15:33] <skaet> Thanks popey
[15:33] <Laney> one second
[15:33] <Laney> https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/1054204
[15:33] <Laney> That's the bug with the workaround
[15:34] <Laney> but I understand that we don't have the preferred form for modification for the font, so the change had to be done some other way
[15:36] <Laney> ..!
[15:36] <skaet> Laney,  that looks to me like the workaround could be applied,  and we'd get by this impass.   Am I missing something?>
[15:37] <seb128> we should probably defer to next cycle at this point
[15:37] <Laney> skaet: I think he did some binary hacking to do it
[15:37] <Laney> it's not really very satisfactory
[15:37] <seb128> hey rickspencer3
[15:37] <rickspencer3> hey seb128
[15:37] <Laney> seb128: yeah, if that's an option then we should indeed
[15:37] <seb128> I was asking rickspencer3 how problematic that is if we don't get the font in quantal
[15:37] <Laney> we fixed the Qt side at least
[15:38] <rickspencer3> hi
[15:38] <Laney> ahoy
[15:38] <skaet> rickspencer3, opinion?
[15:38] <seb128> right, progress, it doesn't seem likely the libreoffice issue will be sorted out soon though...
[15:38] <rickspencer3> I think it would be a shame not to include it after all that was invested in it, but it doesn't sound ready
[15:38] <Laney> perhaps mirv could enlighten us about his fix
[15:38] <Laney> it does seem a bit sad that we're not really able to modify the font
[15:39] <rickspencer3> skaet, does that help?
[15:40] <skaet> rickspencer3, yes it doesn't sound ready.   Any thoughts on ways we can get it ready in next few days?
[15:40] <rickspencer3> skaet, not really, it just sounds too late to get it integrated
[15:40] <rickspencer3> if it's not working with Libre Office when we drop it in, it just seems like we need to move on to release without it
[15:41] <skaet> rickspencer3, ok.  putting it on the shelf then for R,  rather than introducing bugs into quantal.
[15:41] <skaet> ..
[15:41] <rickspencer3> if we start going around fixing this, fixing that, I fear we will get a cascade of knock on regressions
[15:41]  * skaet nods
[15:41] <rickspencer3> this would distract us from perhaps fixing critical bugs
[15:41] <rickspencer3> sorry
[15:41] <rickspencer3> I just think we need to move on
[15:41] <skaet> ..?
[15:42] <rickspencer3> (sorry to the people who worked hard on it and are passionate about it, I mean)
[15:42] <popey> sorry, asked pmcgowan to join us
[15:43] <popey> pmcgowan, feeling is introducing this back in means we divert focus from other critical bugs right now.. and we don't have a fix for this, and no obvious way to get one
[15:43] <Daviey> Did i missunderstand that it sounds like we have a solution, but involves uploading binary modification..  Is this not a reasonable stop-gap?
[15:44] <seb128> is that a solution or a workaround?
[15:45] <seb128> how confident are we that there are not going to be other issues?
[15:45] <seb128> to me it just seems reality late and we might need to focus the resources on blocker issues next week
[15:45] <seb128> ..
[15:46] <pmcgowan> sorry to arrive late
[15:46] <pmcgowan> best result would be to fomrulate a real fix for LO or fontconfig once and for all
[15:47] <pmcgowan> do you feel the current symptom is critical enough to not ship with?
[15:47] <Laney> we "just" don't have the medium weight
[15:47] <Laney> I think it's fine to defer
[15:48] <pmcgowan> would we add the font back in SRU with a fix to LO?
[15:48] <Laney> it's not LO that needs to be fixed, but fontconfig
[15:48] <pmcgowan> fine
[15:49] <Laney> I'm not sure that is something the SRU team would accept though
[15:49] <Laney> slangasek can maybe comment
[15:49] <seb128> pmcgowan, do you think it's important? SRU worth?
[15:50] <pmcgowan> there are elements of the UI which never were able to match design because of this, and seems to me an issue that could be resolevd safely by SRU
[15:51] <rickspencer3> it's nice that our quality situation is such that we can consider changes like this at this late game, but realistically, there are still other moving parts
[15:51] <slangasek> Laney: I think it would have to be a sadfl in to do it as an SRU
[15:51] <pmcgowan> you all know the history, its been 2 years and no fix to fontconfig
[15:51] <rickspencer3> I think introducing this is too much churn
[15:51] <slangasek> because that's not sanely regression-testable
[15:52] <rickspencer3> let's ensure that we fix this properly in 13.10, get it banked early in 13.10, and move on
[15:52] <Laney> 13.04? :-)
[15:52] <rickspencer3> dang it
[15:52] <rickspencer3> lol
[15:52] <skaet> :)
[15:52] <rickspencer3> yeah
[15:52] <Laney> fine. Speaking of moving on:
[15:52] <Laney> ..
[15:52] <pmcgowan> oh well
[15:53] <skaet> Thanks all,  I think we have our plan for 12.10 and this issue, unless sabdfl wants to weigh in.
[15:53] <skaet> ..
[15:54] <skaet> anyone else have other critical bug issues to bring up to discuss before I end the meeting?
[15:55] <skaet> just want to say thank you to everyone involved for all the hard work and passion on getting 12.04 ready.
[15:55] <smartboyhw> skaet, did you say anything wrong? 12.10 right?
[15:55] <ogra_> and 12.10 too
[15:55] <Riddell> that was 6 months ago :)
[15:55] <ogra_> :)
[15:56] <smartboyhw> :P
[15:56] <skaet> lol,  my turn now.
[15:56] <rickspencer3> someone forgot to update skeatbot
[15:56] <skaet> yes.  12.10
[15:56] <skaet> There will be a meeting next week,  and then there will be a break until they start up for 13.04.
[15:57] <skaet> date for that is TBD.
[15:57] <smartboyhw> Yay
[15:57] <skaet> Lets make 12.10 go out nice and with as much quality as we can squeeze in, over the next few days!!   bug fixes still welcome.  ;)
[15:58] <skaet> #endmeeting
[15:58] <Daviey> skaet announced 12.10 is canceled, and rickspencer3 announcing 13.04 is delayed until 13.10.. OMG! Ubuntu will have fun.
[15:58] <meetingology> Meeting ended Fri Oct  5 15:58:02 2012 UTC.
[15:58] <meetingology> Minutes (wiki):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2012/ubuntu-meeting.2012-10-05-15.00.moin.txt
[15:58] <meetingology> Minutes (html):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2012/ubuntu-meeting.2012-10-05-15.00.html
[15:58] <smartboyhw> Thanks skaet
[15:58] <Daviey> thanks skaet
[15:58] <skaet> Thanks for that commentary Daviey - :P
[15:58] <skaet> lol
[15:58] <Riddell> thanks for your hard work too skaet
[15:58] <mdeslaur> thanks skaet!
[15:58] <ogra_> thanks skaet
[15:59] <skaet> Thanks seb128, slangasek, smartboyhw, ogra_, plars, rickspencer3, pmcgowan, Laney, popey, Daviey, Riddell, highvoltage, mdeslaur
[15:59] <seb128> skaet, thanks
[15:59] <Laney> \o
[15:59] <skaet> have a good weekend all.
[15:59] <seb128> skaet, oh, a quick thing
[15:59] <Laney> o/
[16:00] <seb128> firefox 16 release is planned on tuesday
[16:00] <seb128> I don't know if that's something you want to try to get on quantal iso ?
[16:00] <skaet> yup seb128,   jdstrand is going to make the call on the mozilla drop for us on Tuesday
[16:00] <seb128> Chris said to talk to jdstrand about that
[16:00] <seb128> ok
[16:00] <seb128> I just wanted to point it
[16:00] <seb128> thanks
[16:01] <skaet> Thanks for pointing it out.  :)
[16:01]  * skaet linking Laney was waving bye-bye
[16:01] <Laney> yeah I realised we use that for raising hand :(
[16:01] <skaet> :)  no worries,  figured it out.
[16:04] <smartboyhw> Thanks skaet again:)


[00:00] <slangasek> bdrung: we generally expect the archive to be in sync with the ISOs during RC validation, so either you'd need to get sign-off from the responsible listed on https://wiki.ubuntu.com/LucidLynx/ReleaseManifest for a respin this late, or it waits until after RC
[00:01] <bdrung> ok, waiting is the solution. i just wanted to make sure that it hits the final release
[00:01] <bdrung> slangasek: thanks for the information
[00:03] <ScottK> bdrung: Is upstream planning to accept those changes or are the potientially permanent Ubuntu diff?
[00:03] <bdrung> ScottK: they want to adopt the icon - two patches are cherry-picked from upstream
[00:03] <ScottK> OK.
[00:04] <bdrung> no permanent ubuntu diff
[00:12] <slangasek> ScottK: opendkim in
[00:21] <slangasek> just sponsored python-virtualenv, would appreciate a review
[00:21] <slangasek> (when it lands in, say, 5 min)
[00:27] <ScottK> The means you have time to review opendkim, right?
[00:27] <slangasek> ScottK: already did it
[00:27] <ScottK> Nevermind
[00:27] <ScottK> Just noticed.
[00:28] <ScottK> Don't see virtualenv yet
[00:30] <slangasek> oh, because I failed to build with -sa
[00:30]  * slangasek tries again
[00:31] <doko__> slangasek, lamont: what about the glib2.0 update (fixing the sparc build). lamont, or did you have some kind of hack in mind?
[00:32] <ScottK> It would be nice to start sooner rather than later on all the retries that would follow that fix.
[00:34] <slangasek> doko__: not accepting it during RC validation; I realize that's going to set us back on retries, but I need the board clear for now
[00:38] <slangasek> doko__: oh, but do please upload it if you have the fix - I thought the glib2.0 in the queue was the one you meant, but that's pitti's dbgsym fix
[00:52] <slangasek> edubuntu rebuild started
[00:52] <slangasek> is there anyone around who can do wubi testing?
[00:54] <slangasek> charlie-tca and davmor2 both reported that wubi was "not present" on the Xubuntu desktop ISOs; but I can definitely see it on the ISO, and don't have Windows around to test with
[01:01] <slangasek> ^^ there we go
[01:02] <doko__> lamont, slangasek: glib2.0 uploaded
[01:03] <slangasek> doko__: thanks
[01:18] <sbeattie> slangasek: what did they mean by doesn't appear? I have an old win2k8 server prerelease instance that sees the wubi autorun instance with the iso inserted.
[01:19] <slangasek> 15:52 < charlie-tca> When you try to install using wubi, it does not appear in any menu
[01:19] <slangasek> 15:53 < charlie-tca> I put the desktop cd in the drive, there is no wubi to select
[01:19]  * cody-somerville wonders if xscreensaver's 'New Login' feature being broken is a good enough bug to do an upload.
[01:24] <slangasek> sbeattie: so if you're seeing the wubi menu, your guess is as good as mine
[01:24] <slangasek> cody-somerville: are you asking, or just wondering? :)
[01:24] <sbeattie> slangasek: has xubuntu been respun since then?
[01:25] <slangasek> sbeattie: 20100419 is the latest
[01:25] <cody-somerville> slangasek, Wondering with the hope someone might suggest if it is or not. I've tried asking mr_pouit a few times but he hasn't gotten back to me.
[01:25] <slangasek> no respins because I haven't seen anything I could fix by respinning
[01:25] <sbeattie> slangasek: oh, okay, I was going to try with 20100418
[01:26] <cody-somerville> slangasek, http://bazaar.launchpad.net/~ubuntu-desktop/xscreensaver/ubuntu/revision/16 is the change to fix it
[01:26] <slangasek> cody-somerville: oh, well, it's a bugfix so the release team wouldn't block it, but I think it's for you guys to decide if it's worth the upload
[01:57] <ScottK> slangasek: virtualenv accepted.
[02:00] <slangasek> thanks :)
[02:06] <sbeattie> slangasek: I get wubi with 20100418 xubuntu daily-live i386 cd as well.
[02:06] <slangasek> sbeattie: ok; we'll have to wait for them to resurface and give more detail, thanks for double-checking
[02:45] <slangasek> ogra: omap netbook respun, finally; spent too long waiting for acorn to get its act together
[03:23] <ScottK> slangasek: Some additional Unverse syncs for you if you have a moment: http://paste.debian.net/69990/
[03:30] <ScottK> slangasek: Additional binary removals due to the lack of Python2.5: autodocktools mgltools-opengltk
[03:44] <ScottK> slangasek: revised list: http://paste.debian.net/69994/
[05:30] <slangasek> ScottK: syncs running
[05:30] <slangasek> ScottK: autodocktools, mgltools-opengltk removed
[05:38] <ScottK> Excellent.
[05:38] <ScottK> The two recent Universe uploads in queue are mine if you could have a look ....
[05:38] <ScottK> No rush.
[05:39]  * slangasek gets a FTBFS mail for OOo/armel and screams
[05:39] <slangasek> Session terminated, killing shell...make: *** [debian/stampdir/binary-arch] Terminated
[05:39] <slangasek>  ...killed.
[05:39] <slangasek> Build killed with signal 15 after 150 minutes of inactivity
[05:40] <slangasek> lamont: ^^ why did satinash screw us over?
[07:17] <ttx> Good morning
[07:28] <ara> morning ttx
[08:09] <ttx> slangasek: you don't have any plans to respin the server ISO, we can safely work on test coverage ?
[08:36] <slangasek> ttx: no plans to respin
[08:36] <ttx> slangasek: ok
[09:59] <ev> slangasek: I've replied to your comment in bug 558488, but I'd like to get feedback on my suggestion before I go ahead and make that change.
[10:02] <slangasek> ev: hmm, sounds risky to me, precisely because other things may parse it
[10:02] <ev> unfortunately I think all we have are risky options, but I'm open to further suggestions
[10:02] <ev> I guess we could hardcode it for just this release
[10:03] <slangasek> I think that would be least risky, yes
[10:04] <ev> right, I'll work on patches to ubiquity and casper that do just that
[10:04] <slangasek> also, I don't think anything sets DISTRIB_ID for flavors, does it?
[10:04] <slangasek> (if it does, that's buggy, because this is a conffile)
[10:04] <slangasek> before we entirely rule out editing of DEBVERSION, I guess I'd like to have cjwatson's take on it
[10:05] <ev> okay
[10:05] <ev> DISTRIB_ID> ah, my mistake for assuming that it was set for flavors.
[10:06] <slangasek> really, the only place you can distinguish is in the install media; once you've installed, it becomes muddled
[10:06] <slangasek> but .disk/info also includes the lavor name, doesn't it?
[10:06] <ev> ah, wow
[10:06] <ev> -ENOTENOUGHTEA
[10:06] <ev> or something like that
[10:07] <ev> way too many characters
[10:07] <ev> anyway, yeah, we can just check the first field of .disk/info
[10:08]  * slangasek puts mountall to the rack.  TELL ME YOUR SECRETS
[10:09] <ev> lol
[10:09] <cjwatson> my worry about doing it in ubiquity etc. is that it's hard to tell between LTS and non-LTS flavours there
[10:10] <cjwatson> checking DISTRIB_ID seems ... likely to be messy
[10:10] <cjwatson> and yeah, what slangasek said above
[10:10] <cjwatson> in that case what I mean is "checking .disk/info for the flavour name seems ... likely to be messy"
[10:11] <cjwatson> I think I'd be more comfortable with a flavour-specific change to DEBVERSION, THB
[10:11] <cjwatson> TBH
[10:12] <cjwatson> so, um - do CD-based upgrades from hardy actually work right now?
[10:12] <cjwatson>   hardy)
[10:12] <cjwatson>     export PREV_CODENAME=dapper # need to support upgrades from previous LTS
[10:12] <cjwatson>   lucid)
[10:12] <cjwatson>     export PREV_CODENAME=karmic
[10:12] <cjwatson>     export CODENAME=hardy
[10:12] <cjwatson>     export CODENAME=lucid
[10:13] <cjwatson> hmm, maybe that doesn't matter since there's no release-upgrader-* in either hardy-backports or karmic-backports
[10:15] <sbeattie> cjwatson: erm? I haven't done a hardy->lucid cd only upgrade yet for rc, but at least for the ubuntu-server amd64 iso, I know it's worked for the last two betas.
[10:16]  * sbeattie has an amd64 machine that has a NIC that hardy's kernel doesn't recognize.
[10:18] <ev> cjwatson: ubiquity> So to be clear, you think that we're okay to risk breaking tools that parse .disk/info over just hardcoding a check for ubiquity and kubuntu like so for a single release? http://paste.ubuntu.com/419733/ http://paste.ubuntu.com/419736/
[10:19] <ev> err ubuntu and kubuntu
[10:19] <cjwatson> sbeattie: 10:13 <cjwatson> hmm, maybe that doesn't matter since there's no release-upgrader-* in either hardy-backports or karmic-backports
[10:19] <cjwatson> sbeattie: accounts for this working
[10:22] <cjwatson> ev: the only thing I know of that actually *parses* .disk/info is wubi; otherwise, I believe parsing it to be very rare.  Can you think of anything else?
[10:22] <cjwatson> that said wubi would actually break if we inserted LTS there right now, but the regex is easy to fix
[10:23] <cjwatson> most things just display its contents or similar
[10:23] <cjwatson> or log them
[10:23] <cjwatson> so yeah, I think my personal preference would be to change .disk/info and fix wubi's regex
[10:24] <ev> well, and ubiquity and casper, but yeah, I can't think of anything else that would
[10:24] <ev> okay
[10:24] <cjwatson> do they parse it?
[10:24] <ev> ubiquity does
[10:24] <cjwatson> mm, casper does some minimal parsing
[10:24] <cjwatson> ./scripts/casper-bottom/10adduser:55:RELEASE="$(cut -d' ' -f1-2 /root/cdrom/.disk/info 2>/dev/null)" || RELEASE=""
[10:25] <ev> indeed
[10:25] <cjwatson> that wouldn't break, but it probably ought to be changed, since we want that to show LTS as well
[10:26] <cjwatson> and same in ubiquity/ubiquity/misc.py
[10:26] <cjwatson> on the flip side, changing .disk/info would mean that we wouldn't have to change things like cdrom-detect
[10:30] <cjwatson> in wubi, http://paste.ubuntu.com/419742/ looks sufficient; I've checked all the callers and it doesn't display the version anywhere, it's just checking it against isolist.ini, so as long as we leave version in isolist.ini alone, we can just ignore "LTS ", I think
[10:30] <cjwatson> (actually, http://paste.ubuntu.com/419743/ is clearer isn't it)
[10:31] <ev> How does this look for ubiquity: http://paste.ubuntu.com/419744/
[10:31] <ev> wubi> looks good
[10:32] <cjwatson> don't you want the assignments outside the parens?
[10:32] <ev> err wow, I'm way off the mark today
[10:32] <ev> yeah
[10:33] <cjwatson> >>> test('Ubuntu 10.04 "Lucid Lynx" - Release Candidate i386 (20100419.1)')
[10:33] <cjwatson> 'Ubuntu 10.04'
[10:33] <cjwatson> >>> test('Ubuntu 10.04 LTS "Lucid Lynx" - Release Candidate i386 (20100419.1)')
[10:33] <cjwatson> 'Ubuntu 10.04 LTS'
[10:33] <cjwatson> looks fine to me with that syntactic correction
[10:34] <ev> okay
[10:36] <cjwatson> wubi change committed - can you publish an updated wubi.exe at some point?
[10:36] <ev> I'll do it now
[10:38] <ev> done
[10:39] <cjwatson> BTW, one reason I prefer it this way is that it's really quick to revert things just in cdimage if it goes wrong
[10:40] <slangasek> true
[10:44] <cjwatson> which admittedly would put us out of compliance with branding, but that's probably true with just about any failure mode here ...
[10:44]  * slangasek nods
[10:47] <cjwatson> grr, I didn't realise the translation import queue was quite so far behind
[10:48] <slangasek> dpm mentioned it was slow; how bad is it now?
[10:48] <doko_> slangasek: is there a buildlog left from the OOo build?
[10:48] <cjwatson> "1-50 of 19038 results"
[10:48] <cjwatson> it's backed up to the 16th
[10:48] <slangasek> doko_: no, I restarted the build because the log was useless - it just hung after outputting openoffice.org-core
[10:49] <slangasek> doko_: so the only relevant output is what I quoted in scrollback
[10:49] <cjwatson> though it is catching up; it's up to late on the 16th, and it was only up to sometime on the 15th last night, so that's rather more than one hour per hour
[10:50] <ogra> slangasek, hrm, seems acorn didnt have the new livecd-rootfs or my fix didnt work, there is no vmlinuz file in /boot
[10:50] <slangasek> cjwatson: I don't follow all the implications - is that going to impact the ability to export langpacks in a timely manner this week?
[10:51] <slangasek> ogra: the actual build was on clementine, acorn stiffed me
[10:51] <ogra> lamont, can you check the livecd-rootfs version on clementine ?
[10:51] <ogra> slangasek, ok
[10:51] <slangasek> ogra: as for not having the new one - perhaps I wrongly assumed that the 'buildlive base; build-livecd-base' cronjob helped with this
[10:51] <slangasek> I can retry it, clementine isn't doing anything else
[10:52] <slangasek> (and lamont won't be around for a few hours, I'm sure)
[10:52] <ogra> slangasek, i thought so too, but it might actually be a cronjob
[10:52] <slangasek> ogra: hah - build-livecd-base doesn't know about armel
[10:53] <slangasek> blast, and I just restarted the build on clementine
[10:53] <ogra> heh, ok
[10:56] <slangasek> well, that doesn't really seem to do anything useful on the buildds anyway... maybe this second build on clementine will work
[10:57] <ogra> i'll check once there is an image
[11:07] <cjwatson> slangasek: I *think* imports and exports are largely independent
[11:07] <slangasek> but it may impact the up-to-dateness of the langpacks we export?
[11:07] <cjwatson> the reason I care was that I was hoping to get a last-minute installer translation fix in, which is dependent on an import of d-i translations - but not the end of the world if it doesn't
[11:07]  * slangasek nods
[11:07] <cjwatson> maybe for the odd few upstream translations cycling through, although I noticed a huge pile of kde-i18n being imported
[11:08] <cjwatson> I'd expect it to catch up fairly quickly when it hits the freeze
[11:09] <cjwatson> but just a guess
[11:59] <lamont> slangasek: acorn had multiple remaining issues, which I believe are all fixed, one of your livecd runs is now going, the other I killed since it was a dup
[11:59] <slangasek> lamont: ok - how about logfile visibility?
[12:00] <lamont> which machine and what url are you trying and not succeeding with?
[12:00] <lamont> from which ...
[12:00] <slangasek> lamont: antimony; was getting 404s before?
[12:01] <lamont> and sample URL?
[12:01] <slangasek> http://acorn.buildd/~buildd/LiveCD/
[12:03] <lamont> try now?
[12:06] <slangasek> lamont: there we go - thanks
[12:06] <ogra> lamont, is livecd-rootfs 1.114 currently installed on either of  the amrel livefs builders
[12:06] <ogra> *armel
[12:07] <ogra> else we dont need to bother to rebuild omap yet
[12:07] <lamont> ogra: both - acorn had 1.112 until moments ago
[12:07] <lamont> omap is building with 1.114
[12:07] <ogra> sweet, thanks :)
[12:20] <slangasek> lamont: on which buildd is it building with 1.114?
[12:28] <lamont> acorn
[12:30] <slangasek> right, thanks
[12:50] <lamont> wtf is up with oo.o/armel?
[12:50] <lamont> I refuse to believe that it took > 2.5 hrs to do:  dpkg-deb: building package `openoffice.org-core' in `../openoffice.org-core_3.2.0-7ubuntu3_armel.deb'.
[12:51] <hyperair> it might have =p
[12:51] <hyperair> wait, 28M is kinda small..
[12:52] <lamont> hyperair: if so, pushing it back to the top of the hill for another 2-day run at the problem probably isn't the answer
[12:52] <hyperair> 2 days huh
[12:52] <hyperair> that sounds painful
[12:53] <lamont> yeah - it's a good thing they modularized the build so that it's not one big monolithic takes-forever pile, eh?
[12:53] <lamont> oh wait.  that was just from my dreams
[12:58] <slangasek> man, dreams about OOo, that's really taking your work home with you
[13:16] <ogra> oh, come on, its not two days ... only 40h or so :P
[13:16] <stgraber> ;)
[13:25] <mvo> lamont: and the funny thing is that we may need another OOo upload before final
[13:26] <mvo> (maybe not so funny)
[13:27] <ogra> mvo, what ?!?
[13:28] <mvo> bug #566584 and bug #516727
[13:29] <mvo> the alternative is to remove ooo-evolution and ooo-filter-binfilter during the upgrade (well, before it starts)
[13:30] <ogra> bah, sigh
[13:32] <lamont> WTF does oo.o pre-depends something?
[13:32] <lamont> well, other than the obvious, I suppose. but still SHEESH
[13:32] <mvo> lamont: it pre-depends on TEH WORLD
[13:32] <lamont> mvo: it IS the world.
[13:32] <mvo> lamont: like -core, that needs the full gstreamer, all of gnome etc
[13:32]  * ogra is happy we dont use it in any armel images anymore
[13:33] <lamont> I'd really like to see the size of that beast treated as an RC bug for lucid+1
[13:33] <mvo> lamont: don't ask why, I still have bad dreams from looking at it
[13:33] <mvo> lamont: I *hope* that I found a solution, _rene_ helped a lot to explain me why certain stuff is needed (or done in the way its done)
[13:33] <mvo> buy him a beer if you see him
[13:34] <lamont> oh, goodl
[13:38] <slangasek> lamont: is acorn still going?
[13:39] <slangasek> Unable to fetch squashfs sort list; using a blank list.
[13:39] <slangasek> but no output from mksquashfs after that
[13:39] <lamont> mksquashfs
[13:39] <ogra> didnt we quietenm that down ?
[13:39] <stgraber> slangasek: do you have the URL to what will be the release announcement and release notes for RC ?
[13:39] <lamont> the Unable... is normal
[13:39] <slangasek> lamont: yes, the lack of output afterwards is not
[13:40] <slangasek> stgraber: announcement: https://wiki.ubuntu.com/LucidLynx/RCAnnouncement; release notes: https://wiki.ubuntu.com/LucidLynx/ReleaseNotes; tech overview (which may have been what you meant by release notes): https://wiki.ubuntu.com/LucidLynx/TechnicalOverview
[13:41] <ogra> slangasek, yeah, there should at least be two additional lines
[13:41] <stgraber> slangasek: thanks
[13:41] <ogra> i think the progressbar will only be shown after it finished though
[13:42] <lamont> http://paste.ubuntu.com/419834/ <-- slangasek: thoughts?
[13:42] <slangasek> lamont: 22min without further output - so is that build still doing something, or did it die a mangled death?
[13:42] <slangasek> lamont: is that the mksquashfs?
[13:42] <lamont> root      6663 92.4 50.3<PHONE_NUMBER>44 ?       Sl   13:20  20:28          \_ mksquashfs /build/chroot-livecd/ livecd.ubuntu-netbook-omap.squashfs -sort livecd.ubuntu-netb
[13:42] <lamont> yes
[13:43] <lamont> and the right side of my terminal window for the *snip*
[13:43] <slangasek> doesn't look very healthy to me :/
[13:43] <slangasek> well, let's let it run for another .5h or so
[13:43] <ogra> probably use a bucket with water if the alarm clock doesnt suffice :/
[13:43] <lamont> slangasek: about to run kids to school, will be afk for closer to 1.25h
[13:43] <ogra> i really wonder what kind fo boards they sent you ...
[13:44] <lamont> figure ~7am pacifc
[13:44] <slangasek> ok
[13:44] <ogra> why dont we see all these issues on our dev boards
[13:44] <lamont> ogra: run livecd-rootfs in a lucid chroot on lucid on your boards?
[13:44] <lamont> do you, that is
[13:44] <ogra> lamont, i did that once, yes
[13:45] <lamont> ogra: slangasek does it all the time.
[13:45] <ogra> not atm, since i'm focused on omap, but for getting a squashfs to play with i do such stuff
[13:45] <ogra> lamont, but on your silicon
[13:45] <ogra> i dont get why you see these many issues on these new bbg3's
[13:45] <lamont> maybe we're just lucky?
[13:45] <lamont> dunno
[13:46] <lamont> anyway, afk kids->school
[13:50] <slangasek> hah; so I fix plymouth so that it will actually send mountall a 'c' when the user wants to cancel a fsck
[13:50] <slangasek> which uncovers a crasher bug in mountall
[13:51] <slangasek> apparently I'm the first person to ever hit this code path
[14:07] <cjwatson> slangasek: FYI the beta-2-relnoted bug regarding RAID arrays larger than 2TB still exists
[14:08] <slangasek> cjwatson: argh?  I thought I saw that the bug was closed - not so much?
[14:08] <cjwatson> looks like I need to rebuild a generated file; in the meantime, I'm restoring the technicaloverview note
[14:08] <slangasek> ah, you've just reopened, ok
[14:09] <cjwatson> discovered as part of attempting to disentangle the hopelessly unintelligible dogpiled bug 527401
[14:14] <slangasek> lamont: ah, must've been buffering or something; omap build finished successfully now
[14:22] <stgraber> slangasek: updated the release announcement for edubuntu. We still have some annoying bugs, I'll release note them and an updated edubuntu-artwork package should be uploaded soonish (so we can test that extensively post-RC).
[14:23] <ogra> slangasek, \o/
[14:24] <slangasek> stgraber: could you please consolidate that into 4 paragraphs or fewer?
[14:33] <ev> I imagine it's too late for Lucid, but can we get upgrade tests for wubi in 10.10?
[14:33] <ev> in the iso testing tracker, that is
[14:34] <ev> ara: ^
[14:34] <ara> ev, noted
[14:34] <ev> thanks!
[14:35] <ara> are ubuntu studio cds always that big???
[14:35] <ara> that does not fit in a CD, that's for sure
[14:37] <slangasek> yes, it's meant to be a DVD image
[14:37] <ara> slangasek, ok :)
[14:37] <ara> slangasek, thanks
[14:49] <lamont> slangasek: yeah - I think it does some serious processing, and doesn't bother to flush stdout
[15:00] <ogra> slangasek, i'm happy to report that 21.2 has vmlinuz in /boot :)
[15:00] <slangasek> yay
[15:01]  * ogra now hopes there are not other bugs he didnt find yet
[15:01] <ogra> running an install now ... i'll know more in ~2h
[15:01] <ogra> yay for speedy HW
[15:07] <cr3> hi folks, I would appreciate if someone could have a look at bug #567568 in case it might be considered release critical
[16:20] <ogra> in-target: Read error on /dev/mtd2: Cannot allocate memory
[16:20]  * ogra cries
[16:21] <ara> network-manager is not being included in ubuntustudio's cd
[16:23] <ara> no worries, it is there
[16:30] <jdstrand> are server ISOs scheduled for a respin or can I go ahead with my testing on http://cdimage.ubuntu.com/ubuntu-server/daily/20100419.1/lucid-server-amd64.iso
[16:30] <jdstrand> ?
[16:35]  * ara wonders how not installing network-manager is seen as an improvement (http://ubuntustudio.org/KarmicKoala)
[16:35] <jdstrand> slangasek: ^ (regarding server isos)
[16:38] <pitti> ara: urgh, we had n-m on server ISOs before? that sounds kinda wrong..
[16:38] <ara> pitti, I am talking about ubuntu studio
[16:38] <pitti> ah
[16:38] <ara> pitti, :)
[16:39] <pitti> ara: ah, I misread jdstrand's comment :)
[16:39] <jdstrand> heh, sorry
[16:42] <jdstrand> ttx: do you know if the server isos need a respin? I want to test 20100419.1 but don't want to waste testing on it if it is going away
[16:43] <slangasek> jdstrand: there are no respins planned
[16:43] <jdstrand> ok cool
[16:44] <slangasek> in general, respins will be marked on http://iso.qa.ubuntu.com/qatracker/build/all as such
[16:44] <jdstrand> slangasek: excellent, that was my next question :)
[16:49] <ogra> slangasek, so i guess omap has to skip netbook for RC ... i seem to hit that http://paste.ubuntu.com/419902/ and have no idea why
[16:50] <ogra> funnily it works flawless in d-i
[19:54] <highvoltage> slangasek: sorry to do it again, I uploaded another edubuntu-artwork package. this one should be the last one.
[21:34] <mvo> slangasek: if you could have a look at https://code.edge.launchpad.net/~mvo/openoffice/3.2.0-lucid/+merge/23875 that would be much appreciated, this should solve two OOo upgrade issues. I did some testing already and will continue tomorrow with more
[21:35] <sbeattie> slangasek: crap, live images are missing xfs and jfs utilities: bug 568024
[21:36] <cjwatson> er, wot
[21:36] <cjwatson> how'd we screw that one up?
[21:37] <sbeattie> Dunno, I thought we hit that in the alphas, but got it fixed.
[21:38] <cjwatson> looks like it may have been broken by the live-common seed split
[21:38] <cjwatson> 'cept I don't entirely see why
[21:38] <cjwatson> Package: xfsprogs
[21:38] <cjwatson> Task: kubuntu-live, kubuntu-netbook-live, xubuntu-live, mythbuntu-live, netbook-live
[21:38] <cjwatson> same for jfsutils
[21:38] <sbeattie> cjwatson: what's the difference between casper/filesystem.manifest and casper/filesystem.manifest-desktop?
[21:39] <cjwatson> ubiquity removes anything in the former but not in the latter after copying the filesystem to the live system
[21:39] <cjwatson> er, to the installed system
[21:39] <cjwatson> the difference between those two sets includes such things as the installer itself
[21:40] <cjwatson> ah, I see the seed bug - slangasek, unfortunately the archive has to be told explicitly when a task spans multiple seeds like this
[21:41] <cjwatson> there's a Task-Seeds field
[21:41] <mvo> sbeattie: I uploaded https://edge.launchpad.net/~mvo/+archive/openoffice/+packages with the fixes we talked about. you can help by installing it once the ppa2 version is build (probably in +7h or so :/)
[21:41] <sbeattie> ah, okay. xubuntu may be somewhat okay, as on it's livecd the former includes xfs-progs|jfsutils, but not the latter.
[21:41] <cjwatson> yes, kubuntu kubuntu-netbook xubuntu mythbuntu (ubuntu-)netbook are all unaffected, per the Task line above
[21:43] <cjwatson> affects ubuntu and edubuntu
[21:43]  * mvo just noticed that ooo actually only took 3,5h to build, not bad
[21:46] <cjwatson> I imagine this will increase livefs size a bit
[21:47] <cjwatson> seeds fixed
[23:53] <slangasek> highvoltage: do you mean that you want a respin of edubuntu for the new artwork upload for RC?
[23:53] <slangasek> stgraber: ^^
[23:55] <slangasek> cjwatson: Task-Seeds> sigh :/


[10:03] <xnox> cjwatson, cyphermox - when fetch-url is trying to fetch from https, and there are no certificates should it try to opportunistically anna-install ca-certificates-udeb first?
[10:03] <xnox> (and that means creating ca-certificates-udeb...)
[10:04] <xnox> d-i network-console/authorized_keys_url string https://launchpad.net/~xnox/+sshkeys -> currently fails and would be nice =)
[13:46] <cyphermox> xnox: sure
[13:46] <cyphermox> or perhaps better actually depend on ca-certificates-udeb from net-retriever or something?
[13:47] <cyphermox> wait, no
[13:47] <cyphermox> well, something like that rather than trying to anna-install every time you grab any url.
[13:59] <cjwatson> compare SSL_CERTS in the d-i build system


[00:17] <nacc> stokachu: in the conjure-up snap, why don't you stage the conjure-up part's usr/lib/python3.5? Isn't that where site-packages get installed to? And also since it's after python3.6, wouldn't it be 3.6?
[00:17] <nacc> stokachu: nm on the first, i see it's usr/lib not lib/python
[01:27] <brianw> nice work on lxd integration!
[06:12] <lordievader> Good morning
[08:15] <funabash1> hi huys how can i kill tcp        0      0 <IP_ADDRESS>:6379          <IP_ADDRESS>:*               LISTEN      5140/redis-server 1 ?
[08:16] <funabash1> kill -9 pid doesnt work it restarts again with a new pid. /etc/init.d/redis-serer doesnt exists
[08:19] <azidhaka> systemctl stop redis(-server) ?
[08:31] <rh10> guys, which approach better and more secure: i setup access via ssh using keys, but anyway i need pass to execute some root command
[08:33] <andol> rh10: Not sure I understand your question fully, but sounds like you might want to configure sudo to allow you to run that specific command without having to enter a password.
[08:35] <rh10> andol, yep. is most properly way to do it in ubuntu using NOPASSWD option in sudoers?
[08:38] <andol> rh10: Yepp, NOPASSWD would be it, and (again) preferably having that sudouers entry be restricted to running a particular command.
[08:39] <rh10> andol, got it, thanks
[08:41] <rh10> another question. is ubuntu docs (official, community, wiki available as packages for install in disconnected networks?
[09:01] <funabash1> guys anyone know a tool for check if your ubuntu server are secured ?
[09:06] <andol> funabash1: How you define secured? Out of the box an Ubuntu server is reasonably secure. Then there are plenty of ways you can create users, install services, etc and make it less secure.
[09:06] <andol> funabash1: On the other hand, if you want it to be secure in a boolean sense there is always the option to both pull the network chord as well as the power chord.
[09:09] <andol> funabash1: Anyway, what tools can help you with is that they can warn you about (obvious) insecurities, but the lack of such discoveries doesn't translate into the server being "secure" per se.
[09:10] <funabash1> andol: like a vulnerability scanner
[09:10] <funabash1> patched version of programs etc
[09:11] <funabash1> lynis maybe is a good tool
[10:53] <nixadmin> Hi all
[10:53] <nixadmin> Currently now server using 99% of my memory, In linux how can i find the exact amount of memory you would need?
[11:14] <adac> ok now be honest who of you is Mark Shuttleworth? :-)
[11:15] <adac> thought this is a nice system montitor, maybe ubuntu likes to add to their packages: https://github.com/aksakalli/gtop
[11:28] <wretchedspirit> adac gtop looks pretty
[11:29] <wretchedspirit> htop is always an option too
[11:29] <wretchedspirit> and it's in the repositories
[11:37] <adac> wretchedspirit, yeap using that one :)
[11:37] <adac> mean htop already. very handy
[11:38] <wretchedspirit> hell yeah
[12:08] <Walex> adac: it is based on 'node.js'!!!!!! :-(
[12:15] <adac> yeah :/
[12:17] <stanfordtools> when I push to git, I'd like my remote server to pull automatically, so that my website is updated. What's the best way to make this automatic? Maybe instead of just pushing I can run another command that pushes and pulls remotely. But how can I make such script?
[12:26] <lordievader> stanfordtools: You mean something like: https://www.digitalocean.com/community/tutorials/how-to-set-up-automatic-deployment-with-git-with-a-vps
[12:37] <stanfordtools> no
[12:37] <stanfordtools> well, kinda
[12:37] <stanfordtools> I don't want a bare repo
[12:38] <lordievader> I don't think that that matters. The point of the tutorial is the post-receive scripts.
[12:53] <stanfordtools> lordievader, I don't need those. I found a way to git pull via ssh
[12:53] <stanfordtools> so, i think that's all i need
[12:54] <lordievader> I guess I misunderstand what you want then.
[20:04] <nacc> dpb1: rbasak: i think i've fixed all the segfaults on x on a, still working through the python dependency chain to make sure the integration tests pass
[20:04] <nacc> rbasak: you mentioned writing a test for the changelog case I hit yesterday (that is, dpkg-parsechangelog skipping some entries). How do I do that in pytest?
[20:06] <rbasak> nacc: drop a changelog file that exhibits the problem, and a test function that asserts it?
[20:07] <rbasak> I don't really know how else to answer the question, sorry.
[20:07] <nacc> rbasak: we would just be testing dpkg-parsechangelog?
[20:07] <nacc> rbasak: so i'm not sure what the test shows us other than you can't rely on the behavior on certain distros
[20:08] <rbasak> nacc: I'm suggesting a test that verifies that the behaviour is the one that we expect, that's all.
[20:08] <rbasak> So the test will instantly fail if using a wrong dpkg-parsechangelog.
[20:08] <nacc> rbasak: right, but I'm trying to understand who uses that test?
[20:08] <nacc> and I don't expect someone runnning from git on xenial to run the unit tests before using the tooling
[20:08] <nacc> since that seems like the 'use case' -- to konw that you can't do that :)
[20:13] <nacc> rbasak: i suppose we could have git ubuntu do self-tests on startup and fail to run unless you're on a 'good' OS
[20:13] <nacc> the snap would somehow avoid that, i thinkn
[20:14] <nacc> at the same time, the fix is probalby to fix dpkg-parsechangelog on xenial :)
[20:28] <rbasak> nacc: that's a good point. I had assumed the test would fail if we do it wrong, but as you point out there's a build time vs. runtime distinction.
[20:28] <nacc> rbasak: yeah, it's messy :)
[20:28] <nacc> implies, to me, that dpkg-dev needs the unit test
[20:28] <rbasak> nacc: perhaps we should run our test suites (or a subset that is possible) after building a snap, from the snap?
[20:28] <nacc> rbasak: yeah, i was going to try that next (via our jenkins job)
[20:29] <nacc> i think i'll need to switch to a shell
[20:29] <nacc> but also means i'll need to snap pytest :)
[20:29] <nacc> so not a priority itself yet
[20:29] <nacc> pytest-3, rather
[20:29] <rbasak> This feels like a common problem for all snappers to me.
[20:29] <rbasak> As-installed testing for snaps.
[20:29] <rbasak> A bit like dep8.
[20:29] <nacc> just asked that i #sanppy
[20:29] <nacc> *snappy
[20:30]  * nacc needs to clean under the n key


[00:01] <kees> kirkland: hurrm.  benc and pitti haven't added their updates to the grub bzr tree
[00:03] <kees> kirkland: or rather, slangasek didn't notice when committing your changes to bzr.  I'll go find him
[00:09] <kirkland> kees: okay
[00:09] <kirkland> kees: i am formally baffled/befuddled/bemused by developing on bzr vs. dsc
[00:10] <kirkland> rather, the inconsistencies among the two
[00:11] <kees> kirkland: yeah, it's a serious pain currently.
[00:11] <kirkland> kees: is http://people.ubuntu.com/~kirkland/grub/ what you were asking for, at least?
[00:11] <kirkland> kees: the changes file therein?
[00:12] <kees> kirkland: yeah, that's cool.
[00:13] <nxvl> zul: the evil now is libtool
[00:13] <nxvl> zul: not php
[00:13]  * nxvl checks infinity's debdiff
[00:13] <zul> not its evil
[00:14] <nxvl> heh, well yes, php is evil, but not as libtool
[00:20] <kirkland> kees: okay, I'm in a holding pattern then, until i receive further instruction from you or slangasek on what form they want you/he want(s) these changes in
[00:22] <kees> kirkland: yeah, basically, slangasek and I will clean up bzr and I'll upload the source.changes you put up.  sorry for this goofiness.
[00:22] <kirkland> kees: cool, thanks for the cleanup
[02:59] <HellMind> I need help to jail users , i tried the stupids guides  but isnt work, maybe you know something to doit in ubuntu server, the best, easy, and simple way
[03:16] <HellMind> I want to be a bot
[03:18] <p4_xxx> hi
[03:19] <p4_xxx> i have tried to ask Q here but seems nobody answer :-(
[03:25] <sommer> p4_xxx: what's your question?
[04:40] <ScottK> foolano: Since dovecot is the standard MDA for Ubuntu, I'm a bit suprised ebox went with courier.
[04:40] <ScottK> This will pose a problem for getting ebox-mail into Main.
[04:40] <ScottK> mathiaz: ^^
[04:40] <mathiaz> ScottK: correct - I think he is working on it
[04:41] <mathiaz> ScottK: but courier was supported before they moved to ubuntu as their base platform
[04:42] <ScottK> OK.
[04:42] <ScottK> mathiaz: Taking a quick look at this one package, I don't think I'd be excited to give them upload rights.
[04:43] <ScottK> It looks not so good from an FHS perspective and the maintainer scripts are not at all complete.
[04:53] <emgent> kirkland: ping.
[04:53] <kirkland> emgent: pong
[04:54] <ScottK> mathiaz: It's no where near ready for the archive.
[04:56] <HellMind> help me to jail users
[04:57] <HellMind> I need something like apt-get install jailpatch
[04:57] <HellMind> Y
[04:57] <HellMind> COol :D
[05:09] <mathiaz> ScottK: hm - could you send an email to foolano with your comments on the package ?
[05:10] <mathiaz> ScottK: It seems that it may require to get through the sponsoring queue.
[05:14] <ScottK> mathiaz: I'm not sure I know where to start.
[05:14] <ScottK> Docs still refer to postfix with VDA patch and it's all very scary.
[05:15] <ScottK> It's past midnight and I'm trying to relibtoolize courier.  My brain cells are all pretty used up.
[05:15] <mathiaz> ScottK: right - I see what you mean :)
[05:16] <mathiaz> ScottK: I'll point out your comments to foolano  - it may not be the best option to ask for ebox upload privilege for now
[05:16] <ScottK> That's what I'm thinking.
[05:17] <ScottK> mathiaz: For that one in particular, I'd suggest that the requirement be lamont is happy.
[05:25] <lamont> any sentence that includes the word "relibtoolize" is evidence that brain cells are getting burned up
[05:26] <lamont> or even "libtoolize" for that matter...
[05:26] <nxvl> lamont: try to build courier without relibtoolize it
[05:27] <nxvl> (actually if you have a better solution please let me know)
[05:27] <lamont> nxvl: I assert that it using libtool is evidence that it'd be an uphill battle to have me maintain it
[05:29] <nxvl> :D
[05:29] <nxvl> it seems that i'm not the only one that hates libtool
[05:29] <nxvl> :D
[05:29] <nxvl> awesome
[05:32] <ScottK> nxvl: You may have been led astray, but let me look into it some more.
[05:41] <lukehasnoname> ScottK, your dry, constant, quasi-subtle stabs at LP amuse me.
[05:42] <ScottK> OK.  I didn't think I was being subtle.
[05:44] <lukehasnoname> It's subtle if the person reading doesn't already know you dislike it. I'm reading the response to the server team meeting.
[05:44] <nxvl> bed time
[05:44] <nxvl> read you tomorrow!
[05:47] <ScottK> OK.  Well it turned out to exist, it was just somewhat hidden.
[05:48] <ScottK> As it goes, Launchpad isn't so bad, but the fact that it's closed really makes it pretty much impossible for an outsider to contribute even ideas.
[05:48] <ScottK> Getting really outspoken and filing lots of bugs seems to have some effect.
[06:07] <ScottK> OK.  That wasn't it.  I'm going to bed.
[06:22] <p4_xxx> hi, i set up a ubuntu server at home. i have 4 pc that i want them to store and share files. but at the same time i want their own private folder and one folder for shares. i read a data from a link and it worked, but it's just one folder evry one can see all. i ve been reading a lot on samba site but i got confuse, i m new to linux and i would like to know if someone know a site that explain the procces easly tanks
[07:34] <kraut> moin
[07:46] <foolano> ScottK: we dont use the VDA patch anymore, unfortunately the doc you read was outdated
[07:47] <jmazaredo> i have a weird problem i have a router where if i plug my ubuntu server it gives a problem on the network (intermittent connection)
[07:49] <jmazaredo> i formatted and reinstalled a fresh ubuntu 5 times different hardware different ubuntu dist (desktop/server)
[07:49] <jmazaredo> any known issue?
[07:49] <Deeps> dodgy hardware?
[07:50] <Deeps> network card / cable / switch
[07:50] <jmazaredo> i used several hardwares
[07:50] <jmazaredo> all good
[07:50] <jmazaredo> 1 thing fixed it
[07:51] <jmazaredo> i installed a centos dist and also plugged it in
[07:51] <jmazaredo> all becomes stable.
[07:52] <jmazaredo> dunno how that happen
[08:01] <chmac> Can anyone recommend a slightly more powerful alternative to Firestarter? I want to configure iptables a little more carefully.
[08:02] <henkjan> chmac: try ufw
[08:02] <chmac> henkjan: Sweet, thanks, I'll check it out
[08:26] <ghaleb> hello, when I flush my iptables the firewall blocks everything
[08:27] <Deeps> ghaleb: iptables -nL |grep policy
[08:27] <ghaleb> Deeps, there are no rules
[08:28] <Deeps> ghaleb: no default policy either?
[08:28] <ghaleb> Chain INPUT (policy DROP)
[08:28] <Deeps> there you go, that's why
[08:29] <ghaleb> I see .. hmm
[08:29] <ghaleb> so when I flush the iptables .. the firewall drops everything else
[08:30] <Deeps> if you want to change the default policy, use the -P flag
[08:30] <Deeps> eg, iptables -P INPUT ACCEPT
[08:31] <ghaleb> great!
[08:31] <ghaleb> thank you very much
[08:32] <ghaleb> to save the config , iptables-save ?
[08:34] <Deeps> iptables-save will dump it to the screen, you'll want to redirect that to a file
[10:53] <dusty_> Hrm, I have a default drop all unless i allow it through iptables firewall, i've just noticed that I can make connections to the mysql port, even though i don't allow that in my firewall (only allow 22, 53 and 80).  Can anyone see how myslq traffic can get through this: http://rafb.net/p/28mV0w88.html it doesn't make sense ?
[10:53] <Ontolog> ubuntu-8.04.1-server-amd64.iso is the right distro for a Xeon 3065?
[10:56] <soren> Ontolog: I imagine so, yes.
[10:56] <thefish> whois [miles]
[10:56] <Ontolog> why is it called "amd"?
[10:57] <thefish> Ontolog: i reckon you want ia64
[10:57] <soren> dusty_: "iptables -A INPUT -p tcp -m state --state NEW -j ACCEPT" seems like a good guess.
[10:57] <Ontolog> ia means intel arch?
[10:57] <soren> Ontolog: Hysterical raisins.
[10:57] <soren> thefish: ia64 is Itanium.
[10:58] <Ontolog> Xeon != Itanium?
[10:58]  * Ontolog is a hardware noob
[10:58] <thefish> dont reckon you want amd for intel
[10:58] <soren> dusty_: It's the third rule you apply. It probably somewhat more promiscuous than you want :)
[10:58] <Ontolog> but that's what ubuntu.com gives me...
[10:58] <soren> thefish: Yes, he does.
[10:58] <thefish> ok
[10:59] <soren> amd64 is for x86_64, be it Intel or AMD.
[10:59] <dusty_> soren, hrm, what do you mean, that just allows new connections
[10:59] <soren> dusty_: Yes... Such as connections to your mysql database.
[10:59] <soren> dusty_: ...which is what you didn't want. correct?
[11:00] <dusty_> ahh yeah
[11:00] <dusty_> so
[11:00] <dusty_> that needs to be appended to the output chain not input
[11:00] <dusty_> ?
[11:00] <Ontolog> ok if I install the 64-bit version, how does that effect software installs?
[11:00] <soren> dusty_: I can't say "yes", but it's likelyl.
[11:01] <soren> dusty_: I don't know the policy for your network.
[11:01] <Ontolog> for example, can if I want to download Apache source and compile and install will I get any nasty surprises?
[11:01] <dusty_> ok let me try commenting it out and see if it makes a difference
[11:01] <soren> Ontolog: Probably.
[11:01] <soren> Ontolog: Why do you want to do that?
[11:02] <Ontolog> for my project we are using a custom build of apache
[11:02] <soren> What's custom about it?
[11:02] <dusty_> ahh sorry i just re-read it, im trying to figure out a way to log properly so i can run some log analysing software
[11:02] <dusty_> so i wanted to log all new  traffic blocked or unlblocked
[11:02] <Ontolog> i know where you are going with this
[11:02] <Ontolog> no i don't want to use ubuntu's apache
[11:02] <soren> Ah. Then -j LOG rather than -j ACCEPT.
[11:03] <soren> Ontolog: Then I don't think I understand your question.
[11:03] <Ontolog> my question was about compiling and install things from source
[11:03] <soren> And I'm also interested in use cases that our apache packages does not serve.
[11:03] <Ontolog> well
[11:03] <Ontolog> in my case, while i love ubuntu, i don't want my project tied to it
[11:03] <soren> Ontolog: Could you please state it as an actual question?
[11:03] <dusty_> soren, so just these two rules then : http://rafb.net/p/AgBp1388.html
[11:03] <Ontolog> all the things directly related to my project are installed under /usr/local from tarballs
[11:04] <soren> dusty_: You misspelled ACCEPT.
[11:05] <dusty_> yes sorry i didnt need that rule anyways just hte bottom one
[11:05] <soren> Ontolog: Well, as long as you're prepared to handle the problems inherent in compiling stuff yourself, there's nothing in particular that should make it more difficult to do so under Ubuntu. In fact, I'd bet it's easier than on most other distro.
[11:06] <soren> dusty_: Yeah, the last one looks about right (if I understand its purpose correctly, of course).
[11:06] <Ontolog> thanks my question is not so much about compiling and install from source under ubuntu, i am already doing that, just about the 64-bit OS being a factor
[11:07] <soren> Ontolog: I see. That was not very obvious :)
[11:07] <dusty_> soren, log all new connections
[11:07] <soren> Ontolog: 64-bit Linux installations are so commonplace these days, I wouldn't foresee any problems at all.
[11:07] <Ontolog> so i can run 32-bit binaries on them?
[11:07] <soren> Ontolog: In fact, *all* my systems are 64 bit ones, and I'm perfectly happy with that.
[11:07] <soren> Ontolog: Yes.
[11:08] <soren> Ontolog: Let me qualify that a bit, though:
[11:08] <soren> The kernel and CPU will allow you to do so. However, 32 bit applications need 32 bit supporting libraries.
[11:09] <soren> Ubuntu provides quite a few 32-bit libraries on 64 bit installations, so it might not be a huge problem, but our Apache's are 64-bit ones, when on 64 bit installations.
[11:10] <soren> ..so we haven't tested (and are not going to, since it's silly) 32 bit Apache on 64 bit Ubuntu.
[11:13] <soren> Ontolog: Still, I'd very much like to know why our Apache does not serve you.
[12:41] <ScottK> foolano: The doc I read was the one in the package that according to the minutes you're looking to get sponsored.
[12:44] <foolano> ScottK: that doc was outdated. we dropped the support for VDA a few months ago. Actually, when I was told by you that there was no way we would package postfix with that patch. I didn't sync the install doc at the time. I've just changed it to avoid problems.
[12:45] <ScottK> foolano: OK.
[12:45] <foolano> ScottK: I'm also interested in hearing the packages issues in order to fix them asap
[12:45] <foolano> s/packages/packaging
[12:46] <foolano> ScottK: with the FHS issues maybe you were pointing out the /usr/share/ebox/migration stuff?
[12:47] <ScottK> IIRC the thing that initially suprised me as having your config stuff not in /etc, but I only got about 3 hours sleep last night, so I'm sure I'm not entirely coherent today.
[12:48] <ScottK> foolano: One thing I remember is that it didn't appear that removing with purge actually removed your conffiles.
[12:50] <foolano> ScottK: configuration is stored in gconf, so when the packaes is removed debhelper takes care of removing the gconf schemas
[12:50] <ScottK> OK.
[12:52] <foolano> ScottK: i gotta go home now, if you fancy talking about this a bit later or when you get some rest it would nice
[13:00] <foolano> see you later
[13:13]  * ScottK wonders about the suitability of gconf for server apps.
[13:27] <Syntux> Good day, Which control panel would you guys recommend for Ubuntu server ? 8.04
[13:57] <ScottK> Personally I like vim.
[13:57] <jpds> vim FTW.
[13:58] <ScottK> kirkland: While asking the user what they want to do when booting degraded makes sense on the desktop, I think it's not very satisfactory for servers.
[13:58] <kirkland> ScottK: why is that?
[13:59] <ScottK> Because usually when you reboot a server there's no one looking at any u/i.
[14:00] <kirkland> ScottK: understood...  but if we don't have this prompt, it simply drops you to a busybox prompt
[14:00] <kirkland> which is no better, or worse, IMHO
[14:01] <ScottK> Right.  I just don't want to preclude the ability to automatically boot degraded is that's how the sysadmin has configured it.
[14:01] <ScottK> is/if
[14:01] <kirkland> this patch does not preclude that
[14:02] <kirkland> ScottK: first, BOOT_DEGRADE is read from an /etc configuration file
[14:02] <ScottK> kirkland: OK.  That's fine then.
[14:02] <kirkland> ScottK: that can then be overridden or specified on the kernel boot parameters
[14:02] <ScottK> It just sounded to me like he was proposing that instead of boot degraded.
[14:02] <kirkland> ScottK: i didn't read it that way
[14:03] <ScottK> Fair enough.
[14:26] <cokegen> hi, I'm running a command with cron but it launches an exim process each time is run. What I need to configure to prevent that ? (debian box)
[14:35] <ScottK> cokegen: Probably a question that should be asked on a Debian channel then.
[14:38] <thefish> cokegen: i think you can change the MAILTO directive
[14:38] <thefish> maybe to like /dev/null, not 100% sure
[14:38] <thefish> but it will try and email each time a cron job is run
[14:43] <thefish> i need a remote server to open an openvpn tun and reopen if its dropped, any suggestions? want it to start on boot. its so i can always reach it even behind firewalls etc
[14:45] <_ruben> openvpn has autoreconnect functionality
[14:51] <thefish> _ruben: cool ill look that up
[14:51] <thefish> and start it with a rc.x?
[14:52] <cokegen> ScottK: I will ...
[14:52] <_ruben> the openvpn debian/ubuntu package has a proper /etc/init.d/ script
[14:52] <cokegen> thefish: MAILTO directive where ?
[14:53] <gegema> I am currently mounting a network share using "mount -t cifs -o username=foo,password=bar /mnt" >> I am wanting to add this entry to my fstab, which tab would the username and password belog to?
[14:54] <gegema> currently I have gotten as far as "//network/share    /mountpt       cifs      "
[15:07] <thefish> cokegen: in your crontab
[15:08] <thefish> gegema: my guess is col4 with the options
[15:18] <sylfire> lo all. anyone here using a xen server? having some issues setting it up, bridged networking
[15:18] <trakinas> hello all! need some help with cronjob. I created one with root, but it is not being executed.
[15:19] <sylfire> trakinas: is your cron service running?
[15:19] <trakinas> sylfire: almost sure it is, but anyways, how can I check?
[15:20] <sylfire>  /etc/init.d/anacron restart, if you're using anacron
[15:21] <sylfire> no wait, just checked, mine here on a box says cron, so just /etc/init.d/cron restart
[15:22] <trakinas> sylfire: * Restarting periodic command scheduler crond                           [ OK ]
[15:22] <trakinas> so, it was running
[15:22] <sylfire> do you have the format of your cronjob correct?
[15:23] <trakinas> i think so. I will pastebin.
[15:24] <trakinas> sylfire: http://pastebin.us/?show=d3d16bc5d
[15:25] <sylfire> checking
[15:26] <sylfire> try converging the output before you say which logfile to write to
[15:29] <trakinas> I dont have a sendmail running and I dont pretend to configure one (Im leaving this place). so I thought about send them to /dev/null. but I guess I you talking about the log only.
[15:31] <sylfire> yes, I'm referring to the devnull. Just noted it as "logpath" in my mind, didn't consider the value
[15:31] <trakinas> hmmm... so, leave it there or should I proper configure one?
[15:32] <sylfire> make it 2>&1 > /dev/null
[15:34] <trakinas> like this? http://pastebin.us/?show=m625f672d
[15:35] <sylfire>  /root/mondo-backup.sh 2>&1 > /dev/null
[15:42] <trakinas> thank you
[16:27] <Quest_> any replacement for "knemo" . it shows live network trafic chart/graph ... ?
[16:30] <Quest_> any replacement for "knemo" . it shows "live" network trafic "gui" chart/graph ... ?
[16:46] <uvirtbot`> New bug: #257625 in dovecot (main) "Upgrade to Intrepid : Unknown setting: user_global_uid" [Undecided,New] https://launchpad.net/bugs/257625
[16:52] <jimcooncat> hi. I'd like a guide or dead-tree book on managing user preferences: establishing sane defaults in /etc/skel, applying a preference to an existing user, migrating between machines, etc.
[16:56] <jmedina> jimcooncat: what you mean with «applying a preference»?
[16:58] <jimcooncat> jmedina: let's say I want to remove ipv6 stuff from all my users firefox profiles. Maybe this is a bad example.
[16:58] <jimcooncat> jmedina: or set default font in gedit for an existing user
[16:59] <jimcooncat> I'm really looking for an administrators guide that goes deeper than "how to add or delete a user"
[17:00] <jmedina> well, that depends on the desktok enviroment
[17:01] <jmedina> not really in the user account
[17:01] <jmedina> there is a kiosk thing for KDE, you can do stuff like that
[17:01] <jmedina> but dont know for gnome, I have not used for about 4 years
[17:03] <jimcooncat> thanks jmedina. I think there's a gnome equivalent in Hardy, and I'll check it out once I get it installed in a couple of machines.
[17:04] <kraut> wie starte ich das nm-applet?
[17:04] <jmedina> jimcooncat: maybe that can help you, and yap, I remember a few months ago about that feature in gutsy or somthing
[17:16] <jmedina> jimcooncat: check this out, http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/desktop-guide/s1-ddg-lockdown-other-kiosk-configs.html
[17:16] <jmedina> there is a lot information about kiosks in gnome
[17:18] <jimcooncat> that's really good jmedina. thanks
[17:19] <jmedina> you are welcome,
[17:22] <jimcooncat> I found sabayon stuff on gnome website, and policykit. I think I can run with it now.
[17:42] <dusty_> Hey guys I am trying to make a firewall like so: Default deny all unless i specifically allow it.  I allow ssh and DNS (as its a nameserver). Everything else gets dropped, how can i log the 'everything else' that gets dropped.. ? my ruleset so far is: http://rafb.net/p/AhSDIF36.html i know i use -j LOG but do i do it on the policy lines or how would i achieve this ?
[17:43] <ScottK> Did you try ufw?  It might be easier to configure that way.
[17:43] <dusty_> ufw ?
[17:43] <dusty_> No I have not tried that.
[17:43] <ScottK> uncomplicate fire wall.
[17:44] <dusty_> I rather just use plain ole iptables
[17:44] <ScottK> uncomplicated.
[17:44] <dusty_> as I only need one rule to log everything that gets dropped
[17:44] <dusty_> im just not sure how to do it
[17:44] <jmedina> ScottK: so is there a option for ufw to do that?
[17:44] <jmedina> never used ufw, but with shorewall it is an easy task
[17:45] <ScottK> I'm not sure exactly.  If one is uncertain with iptables scripts directly, then it's worth looking into.
[17:45] <jmedina> with shorewall I specify my policy for example traffic from the internet to the firewall
[17:46] <jmedina> net    fw     REJECT    LOG
[17:47] <jmedina> what I see with ufw is that there is no way to filter based on the source and destination
[17:47] <jmedina> they assume all the traffic is comming from the internet
[17:47] <jmedina> there is where is complicated :P
[17:47] <jmedina> maybe it is worth for single interface firewalls, of user firewall
[17:48] <foolano> dusty_: as your rules are pretty simple add  a "-j LOG "rule at the end of the each chain
[17:49] <dusty_> foolano, like iptables -A INPUT -j LOG
[17:49] <dusty_> iptables -A OUTPUT -j LOG
[17:49] <dusty_> and same for forward ?
[17:50] <foolano> dusty_: yep, like that. Just make sure you add them at the end of the chain
[17:50] <dusty_> what do you mean at the end of the chain ?
[17:50] <foolano> if a packet reaches the LOG rule it will be logged, and after that it will be rejected for your chain policy
[17:50] <dusty_> what ?
[17:51] <foolano> dusty_: run iptables -L
[17:51] <foolano> and you see how your rules are added to the chains
[17:52] <dusty_> ah
[17:52] <dusty_> sweet, thank you for your help.
[17:52] <foolano> np
[17:55] <dusty_> one curious question thought, I can nmap my server using the -PN option and it replies the open correct ports, how can i stop this ?
[17:55] <jmedina> dusty_: could you show us the output of nmap?
[17:55] <dusty_> ofcourse
[17:55] <dusty_> http://rafb.net/p/Huc0qU17.html
[17:56] <foolano> well, that's correct
[17:56] <foolano> you are allowing access to those ports
[17:56] <dusty_> hrm
[17:56] <dusty_> is there a way to filter this ?
[17:56] <dusty_> or is there a way to foil scanners ?
[17:56] <foolano> ehh no
[17:56] <_ruben> opened ports are, well, open ...
[17:56] <dusty_> heh ok
[17:59] <dusty_> one last question, is there anything i can do to improve on the script (my firewall one) for added security bearing in mind that server is just a nameserver with 53/22 open
[17:59] <dusty_> ?
[18:00] <jmedina> dusty, you better improve security on your name and ssh server
[18:00] <jmedina> this kind of firewall only filters traffic, based on ips and ports, and posibly another tcp/ip flags, but doesnt filter maliciuis packets or attacks specific for your applications
[18:01] <jmedina> you can use failtoban to protect dictionary attacs for ssh
[18:01] <jmedina> uses public key autentication
[18:01] <ScottK> As an example, you can rate limit ssh to a few connections per minute (or use fail2ban)
[18:02] <dusty_> Yeah i'm looking into fail2ban, so this iptables script is pretty pointless then ?
[18:03] <jmedina> sad but true
[18:03] <jimcooncat> port knocking I hear is fun in these situations
[18:03] <jmedina> that firewall wont protec you agains spoof attacs, for example
[18:04] <jmedina> I prefere to change the port for ssh
[18:04] <jmedina> :P and use only public key auth
[18:04] <dusty_> yeah
[18:04] <dusty_> thats what i am doing public key auth
[18:04] <dusty_> i may change the port too
[18:04] <jmedina> all these robots scanning only use tcp/22 as target
[18:04] <dusty_> what kinda attacks kind iptables stop then that i can research
[18:04] <jmedina> dusty_: but then disable password auth
[18:05] <dusty_> passwd auth is dissabled
[18:05] <jmedina> that is good
[18:05] <jmedina> dusty_: check your dns for open relay
[18:06] <foolano> are you guys having problems to file bugs in launchpad? i'm getting time out error all the time
[18:06] <jmedina> you can test your dns with http://intodns.com a free and opensource bases dnsreport replacement
[18:06] <jimcooncat> jmedina: that's what I'm doing. dusty_, changing the port may help a lot for kiddies that are just looking for any open machine. Not if they're targeting YOU, though
[18:07] <jmedina> jimcooncat: yeap, that when fail2ban enters
[18:11] <foolano> hey mathiaz, i'm testing the latest slapd and I think I've found an issue with the permissions of /var/run/slapd
[18:12] <dusty_> jmedina, how can i check if its an open relay /
[18:12] <dusty_> ?
[18:12] <jmedina> dusty_: intodns can tellyou
[18:13] <jmedina> scrolll up
[18:14] <dusty_> what?
[18:14] <jmedina> that page
[18:14] <jmedina> http://intodns.com
[18:14] <dusty_> ah sorry
[18:14] <jmedina> you can test your domain, and one of the tests is check if your dns server is open relay
[18:17] <dusty_> wtf
[18:17] <dusty_> jmedina, check this out: http://www.intodns.com/stoned-hacker.co.uk
[18:17] <dusty_> it says the glue records are wrong it says my registar reports one ip and the nameserver another, thats in correct. i just checked at the registrar and the glue records are fine ?
[18:17] <mathiaz> foolano: what's the issue ?
[18:17] <trakinas> foolano: i liked your nick. haha!
[18:18] <dusty_> For ns1.stoned-hacker.co.uk the parent reported: ['<IP_ADDRESS>'] and your nameservers reported: ['<IP_ADDRESS>']
[18:18] <dusty_> thats intodns
[18:18] <dusty_> my registrar:
[18:18] <dusty_> is .25 for the ip
[18:19] <dusty_> jmedina, im confused and a little worried over this  ?
[18:19] <dusty_> ns1.stoned-hacker.co.uk has <IP_ADDRESS> on my registrar
[18:19] <dusty_> where does that site get that info?
[18:20] <jmedina> directly form the the root servers and your own server
[18:20] <foolano> mathiaz: the ldapi socket, that's the unix socket where slapd can listen on. It's usually within /var/run/slapd. There's even a link from /var/run/ldapi to /var/run/slapd/ldapi. /var/run/slapd hasn't the right permissions to allow anyone to connect to the socket.
[18:22] <mathiaz> foolano: https://bugs.launchpad.net/ubuntu/+source/openldap2.2/+bug/114438 ?
[18:22] <uvirtbot`> Launchpad bug 114438 in openldap2.2 "Permissions for ldapi:// socket are too restrictive" [Undecided,Fix released]
[18:23] <mathiaz> foolano: that's supposed to be fixed now
[18:23] <foolano> mathiaz: nope, that's not the same. that's bug is related to the file itself. This problem is with the directory permissions
[18:24] <foolano> mathiaz: i experienced this issue a couple of days ago. the automatic tests of eBox in intrepid failed. I thought it was just for the new backend but this was a problem too. Unless i'm missing something
[18:25] <mathiaz> foolano: ok - could you file a bug ?
[18:25] <mathiaz> foolano: I'll get it fixed later, but the archive is frozen for now as we're preparing for alpha4
[18:25] <foolano> mathiaz: i'm trying :) but it seems lp is a bit busy :)
[18:25]  * jmedina rembers foolano is having troubles filing bugs..
[18:26] <sommer> mathiaz: hello, I also noticed a small issue with "sudo dpkg-reconfigure slapd", if the /etc/ldap/slapd.d directory is already there the reconfigure doesn't work
[18:27] <foolano> yeo
[18:27] <foolano> that's the nexxt thing i was going to tell you :)
[18:27] <sommer> foolano: :-)
[18:29] <edmoore> hi - I'm running server currently without any flavour of gui. Is it as simple as sudo apt-get install ubuntu-desktop?
[18:29] <dusty_> jmedina, hrm how do i fix this then ?
[18:30] <dusty_> jmedina, its reporting the incorrect ip ?
[18:30] <sommer> !servergui
[18:30] <sommer> edmoore: ^^^ that link has instructions
[18:30] <jmedina> dusty_: why do you have two A recorsd for ns2?
[18:31] <dusty_> round robin
[18:31] <edmoore> sommer, many thanks
[18:31] <dusty_> and that machine has two ips so i thought i would make use of them (it doesn't harm things does it )
[18:31] <sommer> edmoore: np
[18:33] <edmoore> sounds like they don't like it
[18:34] <dusty_> jmedina, what about the wrong ips for the nameservers i cant see how that can be ?
[18:34] <edmoore> most of the guides I've found on sharing my ethernet over wifi seem to assume I have a desktop environment, and I'm sufficiently green at this that i don't know how to do it just with cli
[18:34] <jmedina> dusty_: i check it, but probably is getting confues because your round robin
[18:34] <dusty_> ah
[18:34] <jmedina> I dont see why the need, maybe for another host but for a NS record,
[18:35] <dusty_> ok ill kill it for now
[18:35] <jmedina> you better configure ns3 :)
[18:35] <jmedina> dusty_: you should change your SOA time record
[18:35] <dusty_> what ya mean ?
[18:36] <jmedina> the SOA retry,, refresh,  expire values
[18:36] <jmedina> http://verde.e-compugraf.com/jm-confs/bind9/db.ejemplo.com.zone-SIMPLE.txt
[18:36] <dusty_> dusty@delerious:~$ host ns2.stoned-hacker.co.uk
[18:36] <dusty_> ns2.stoned-hacker.co.uk has address <IP_ADDRESS>
[18:36] <dusty_> dusty@delerious:~$
[18:36] <jmedina> that template pass all the checks and works good
[18:36] <dusty_> i removed it, looks like its just reading a cached entry
[18:36] <Mez> dusty_, 2 IPs for an NS?
[18:36] <jmedina> Mez: that is what intodns says...
[18:36] <jmedina> :P
[18:36] <jmedina> so do I
[18:37] <Mez> that's not supported in the root servers is it ?
[18:37] <dusty_> jmedina, what is wrong with the times i have ?
[18:37] <jmedina> they are to small
[18:37] <dusty_> jmazaredo, ok i fixed a couple things: http://www.intodns.com/stoned-hacker.co.uk
[18:37] <dusty_> see :)
[18:38] <dusty_> just got the other issues to fix now
[18:38] <jmedina> dusty_: there is no need to use a RETRY value to small, why send retry each minute?
[18:39] <jmedina> when the server is up is up, and more retrys wont put it up
[18:39] <Mez> last time I ran a check like that jmedina, it moaned at me cause it couldn't handle the fact I had/have 6 nameservers
[18:40] <jmedina> mez, well you are not normal
[18:40] <Mez> http://www.intodns.com/sourceguru.net
[18:41] <jmedina> for a simple setup it works good, afaik intodns is free, so you can contribute and make it work with 6 nameservers
[18:41] <Mez> jmedina, it wasnt intodns that moaned
[18:41] <Mez> it was something else
[18:42] <Mez> though it did just flag up something I should check
[18:42] <jmedina> good
[18:43] <jmedina> ìntodns is good not too descriptive as dns reports but works fine, I remember dnsreorts tells you why the retry value is considerd bad, and gives you the reference to RFCs
[18:43] <Mez> it flagged up bullshit about it not having glue :(
[18:43] <Fenix|work> Greetings... quick question... any particular reason as to why these four packages are being kept back when doing an upgrade?         bind9-host dnsutils libbind9-30 libisccfg30
[18:44] <Mez> !ohmy | Mez
[18:44] <Mez> Fenix|work, packages are kept back when the introduce new packages, or remove packages
[18:44] <Mez> do a
[18:44] <Mez> sudo apt-get dist-upgrade
[18:45] <jmedina> or you can install them by hand
[18:45] <jmedina> yum install
[18:45] <jmedina> :O
[18:45] <jmedina> damn
[18:45] <jmedina> aptitude install bind9-host
[18:45] <Fenix|work> packages are kept back when they introduce new packages?
[18:45] <Fenix|work> (or remove packages)
[18:45] <Mez> Fenix|work, yeah...
[18:46] <Fenix|work> any idea on how to discover which packages they introduce or remove?
[18:46] <Mez> Fenix|work, sudo apt-get -s dist-upgrade
[18:46] <Fenix|work> libdns35 is new
[18:47] <Fenix|work> okie dokie, thanks for the info
[18:47] <Mez> Fenix|work, yeah, that'll be the new libversion for the fix
[18:47] <Mez> np, glad to help Fenix|work
[18:48] <Fenix|work> ok... back to overhauling some PHP code...
[18:48] <Fenix|work> hey Mez, you over in ##php?
[18:48] <Mez> yep
[18:49] <Fenix|work> Mez, ok, I'll bug ya there
[19:07] <dusty_> jmedina, what do you think now of the new soa times, that ok ?
[19:07] <dusty_> http://www.intodns.com/stoned-hacker.co.uk
[19:08] <jmedina> dusty_: I always use http://verde.e-compugraf.com/jm-confs/bind9/db.ejemplo.com.zone-EXTENDIDA.txt
[19:08] <dusty_> thats what i used
[19:08] <dusty_> by the way, what does this mean : Different autonomous systems  	WARNING: Single point of failure
[19:08] <jmedina> because probably your nameservers are in the same location
[19:09] <jmedina> same link, same power
[19:09] <dusty_> jmedina, also the last blue icon on the output of intodns.com what does that mean, about the www record, why is that bad?
[19:09] <jmedina> there is a single point of failure
[19:10] <dusty_> what about the www record ?
[19:10] <jmedina> dusty_: it is not bad
[19:10] <jmedina> it justs informative
[19:11] <dusty_> thanks
[19:11] <dusty_> thanks very very much for the help
[19:13] <jmedina> dusty_: good
[19:23] <Mez> SPoF==bad
[19:24] <dusty_> Oh yeah, before I go any last suggestions/advice ? (i'm lookin into the rate limiting of connections to ssh, change default port, fail2ban/denyhosts), checked dns config ?
[19:26] <Mez> dusty_, "rate limiting"?
[19:26] <uvirtbot`> New bug: #257667 in openldap (main) "wrong permissions to access ldapi" [Undecided,New] https://launchpad.net/bugs/257667
[19:26] <Mez> dusty_, f2b works well for what you're on about... and changing the default port
[19:26] <Mez> if you REALLY wanna be uber though - look into port knocking
[19:28] <dusty_> Yeah i've seen that, its not practical, as I access the server from many places and I sometime access it from window environment, with no permission to install software (Work) so i wouldn't be able to install the software required to send the special packet to open to port.
[19:30] <jmedina> what about a PHPSHELL? jeje just kidding
[19:35] <kirkland> kees: ping
[19:43] <Fenix|work> Where do I find the mysql error logs?  /var/log/messages?
[19:44] <jmedina> mysql.err
[19:44] <jmedina>  /varlog/mysql.err
[19:44] <Fenix|work> /var/log/mysql.err is empty
[19:44] <jmedina> then mysqld is not configured to log
[19:44] <Fenix|work> yet mysql won't start
[19:45] <jmedina> where you got more info
[19:45] <jmedina> http://dev.mysql.com/doc/refman/5.0/en/log-files.html
[19:45] <jmedina> mmm
[19:45] <jmedina> why dont you start it by hand?
[19:45] <Fenix|work> ok, I rebooted and it started
[19:45] <poningru> ...
[19:45] <poningru> Fenix|work, /etc/init.d/mysqld restart
[19:46] <poningru> in linux you dont reboot
[19:46] <jmedina> only when compiz crash your system
[19:46] <jmedina> ;P
[19:46] <Fenix|work> poningru, I'd love to say something derogatory and somewhat funny but I'll refrain :)
[19:46] <poningru> in soviet russia linux reboots you?
[19:46] <Fenix|work> /etc/init.d /mysql restart didn't work at all, kept dying... hence the reboot trick which incidentally worked.
[19:47] <poningru> wtf weird
[19:47] <poningru> what did it say?
[19:47] <poningru> it should have said why it was dying
[19:47] <Fenix|work> besides fail, nothing
[19:48] <Fenix|work> I was getting a kernel message about mysqld.sock ... but nothing from mysql
[19:49] <poningru> what did that say?
[19:49] <poningru> was there a socket creation error?
[19:50] <Fenix|work> poningru,  kernel: [1053396.176660] audit(1218651725.013:10): type=1503 operation="inode_mknod" requested_mask="w::" denied_mask="w::" name="/var/chroot/var/run/mysqld/mysqld.sock" pid=8013 profile="/usr/sbin/mysqld" namespace="default"
[19:50] <poningru> huh that is odd
[19:51] <jmedina> Fenix|work: apparmor running?
[19:51] <jmedina> or selinux?
[19:52] <jmedina> Fenix|work: did you chrooted mysqld by hand?
[19:52] <Fenix|work> I'm chrooting my entire apache environment and I did it by hand
[19:53] <jmedina> what about selinux/apparmor
[19:53] <Fenix|work> neither
[19:53] <jmedina> mmm
[19:55] <Fenix|work> Hmmm... if I connect using the loopback address I can eliminate the need to have the socket available through the jail root
[19:56] <Fenix|work> that saves a headache
[19:58] <jmedina> yeap that is much better
[19:58] <jmedina> and my.cnf by default binds to <IP_ADDRESS>
[20:07] <uvirtbot`> New bug: #257682 in bind9 (main) "dig compiled without -DDIG_SIGCHASE!" [Undecided,New] https://launchpad.net/bugs/257682
[20:48] <dusty_> hey jmedina http://rafb.net/p/FucSMY32.html what do you think about those ?
[20:55]  * sommer wants a stock ticker displayed when logging into servers... heeeh
[21:00] <dusty_> anyone good with iptables ?
[21:01] <dusty_> Could you check out: http://rafb.net/p/FucSMY32.html and give me opinions/comments/advice ?
[21:01] <jmedina> I always put my OUTPUT to REJECT and INPUT
[21:02] <jmedina> and open only the ports I want to reach
[21:02] <jmedina> my policy is REJECTo DROP, and then the exceptions (rules) open ports I the server needs
[21:04] <dusty_> yeah i know that, what do you think to my ruleset though, specifically /
[21:04] <dusty_> ?
[21:04] <dusty_> i only interested in 22 53
[21:05] <jmedina> I would open udp/53 only to your slave servers, or user allow-transfers { ip.slave.server}; in you zone definition
[21:05] <jmedina> I meant TCP/53
[21:06] <jmedina> udp open for any
[21:08] <_ruben> tcp/53 is also used for 'normal' dns stuff
[21:08] <_ruben> large answers will use tcp instead of udp
[21:09] <jmedina> _ruben: any reference for that?
[21:11] <dusty_> jmedina, i do have allow-transfers, but if i restrict port 53 udp to my slaves then queries wouldnt get through ?
[21:12] <_ruben> jmedina: nothing concrete from top of my head .. do have a book on dns/bind at work .. afaik any dns packet above a specific given type will be tcp instead of udp
[22:08] <kirkland> kees: would you review/sponsor the patch attached to https://bugs.launchpad.net/ubuntu/+source/mdadm/+bug/257568 when you get a chance?
[22:08] <uvirtbot`> Launchpad bug 257568 in mdadm "degraded raid boot process should interactively prompt user before dropping to recovery shell" [Wishlist,In progress]
[22:13] <ScottK> kirkland: Don't forget Main is frozen until after the Alpha release (plus kees is at Debconf).
[22:15] <kirkland> ScottK: understood on both counts; however, kees has been helping/sponsoring these grub issues.
[22:15] <ScottK> Right, just wanted to make sure you had reasonable expectations.
[23:20] <dusty_> http://rafb.net/p/61SvtD29.html Is that the correct way to log using iotables ?
[23:22] <jmedina> dusty_: yeap


[02:11] <hub> I upgraded yesterday to latest dapper (from earlier dapper), and the machine now fails during the boot on udev
[02:11] <hub> then eveyrthing is messed up
[02:11] <hub> X does not start and the console is trashed
[02:11] <hub> (ie show lot of garbage)
[02:13] <hub> any idea?
[02:13] <hub> (it is on i386)
[02:13] <hub> on how to debug that
[02:13] <hub> looks like udevplug hang and then timeout
[03:02] <hub> bbl


[01:05] <ubotu> New bug: #183026 in xorg (main) "desktop cd fails to start gdm with hp nc6400 (widescreen, ati-based laptop)" [Undecided,New] https://launchpad.net/bugs/183026
[01:35] <ubotu> New bug: #183032 in xorg (main) "Seems to be confusion about what is the resolution of my external screen" [Undecided,New] https://launchpad.net/bugs/183032
[08:45] <ubotu> New bug: #183119 in xserver-xorg-input-evdev (main) "[Hardy] Cannot open input pEvdev for keyboard" [Undecided,New] https://launchpad.net/bugs/183119
[13:55] <ubotu> New bug: #182622 in xserver-xorg-video-nv (main) "Xserver Crashes After Double click on icon in awn" [Undecided,Incomplete] https://launchpad.net/bugs/182622
[15:54] <ubotu> New bug: #183192 in xserver-xorg-video-nv (main) "closing youtube flash video make Xorg CRASH" [Undecided,Incomplete] https://launchpad.net/bugs/183192
[19:10] <ubotu> New bug: #183298 in xorg-server (main) "can not disable track pad" [Undecided,New] https://launchpad.net/bugs/183298
[19:31] <tjaalton> mm, testing RAOF's nouveau packages, but the kernel module refuses to load
[19:33] <tjaalton> ah, wrong drm.ko loaded
[19:37] <tjaalton> blimey, it works