| *** rlandy|ruck is now known as rlandy|out | 01:07 | |
| *** ysandeep is now known as ysandeep|lunch | 07:26 | |
| opendevreview | chzhang8 proposed openstack/openstack-zuul-jobs master: fix trio2o dsvm funcional exception https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/823482 | 08:03 |
|---|---|---|
| *** bhagyashris_ is now known as bhagyashris | 08:26 | |
| *** ysandeep|lunch is now known as ysandeep | 08:53 | |
| *** dviroel|out is now known as dviroel|rover | 11:12 | |
| *** rlandy|out is now known as rlandy|ruck | 11:13 | |
| *** dansmith is now known as Guest10351 | 11:26 | |
| *** jcapitao is now known as jcapitao_lunch | 11:59 | |
| *** ysandeep is now known as ysandeep|mtg | 12:22 | |
| *** ysandeep|mtg is now known as ysandeep | 12:50 | |
| *** bhagyashris_ is now known as bhagyashris | 13:19 | |
| *** jcapitao_lunch is now known as jcapitao | 13:20 | |
| rpittau | coreycb: hi! I talked to fungi yesterday and he pointed me to you to get some info on the current status of the python3.10 package for ubuntu focal that is needed for https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/821863 :) | 13:57 |
| coreycb | rpittau: ah great to see that review. I'm not seeing doko online in #ubuntu-devel (libera.chat) but I have a daily reminder to check with him about it. | 13:59 |
| rpittau | coreycb: thanks! I will join that channel too :) | 14:00 |
| coreycb | he was planning to do it after 3.10.1 was available, and it is available in ubuntu jammy now so I'd expect it to be available soon in focal. | 14:00 |
| rpittau | great! that would be helpful to catch some changes in advance in py3.10 | 14:01 |
| coreycb | absolutely, thanks for the help | 14:01 |
| rpittau | my pleasure :) | 14:02 |
| fungi | thanks for the update, coreycb! | 14:10 |
| *** ysandeep is now known as ysandeep|out | 15:42 | |
| *** dviroel|rover is now known as dviroel|rover|lunch | 16:03 | |
| *** Guest10351 is now known as dansmith | 16:46 | |
| *** dviroel|rover|lunch is now known as dviroel|rover\ | 16:47 | |
| *** dviroel|rover\ is now known as dviroel|rover | 16:49 | |
| *** rlandy|ruck is now known as rlandy|ruck|lunch | 17:09 | |
| *** rlandy|ruck|lunch is now known as rlandy|ruck | 17:35 | |
| *** akahat|ruck is now known as akahat|out | 17:35 | |
| *** jcapitao is now known as jcapitao_off | 17:44 | |
| *** dviroel|rover is now known as dviroel|rover|afk | 19:00 | |
| sean-k-mooney | o/ | 19:50 |
| sean-k-mooney | is gerrit broken or under mantaince | 19:50 |
| sean-k-mooney | if i do ssh sean-k-mooney@review.opendev.org -p 29418 | 19:50 |
| sean-k-mooney | i get "sean-k-mooney@review.opendev.org: Permission denied (publickey)" | 19:51 |
| sean-k-mooney | but i have not change my key and the public key matches the one in the ui | 19:51 |
| sean-k-mooney | i can also use that key to ssh into server at home | 19:51 |
| sean-k-mooney | have the key requirements changed recently or something? | 19:52 |
| fungi | sean-k-mooney: have you maybe upgraded your machine? | 19:53 |
| fungi | recent fedora stopped working for rsa keys when connecting to gerrit | 19:53 |
| sean-k-mooney | yes... | 19:54 |
| sean-k-mooney | i installed nixos | 19:54 |
| fungi | if you switch to elliptic curve keys that's probably the easiest solution, but there are a few other options | 19:54 |
| sean-k-mooney | hum | 19:54 |
| sean-k-mooney | ya i could change the key i proably shoudl roate them form time to time | 19:54 |
| fungi | openssh 8.8 also no longer works with rsa keys for connecting to gerrit, so it could be that | 19:54 |
| sean-k-mooney | perhaps it was breaking git review so i tried sshign and got the same issue | 19:55 |
| sean-k-mooney | it is an rsa key | 19:55 |
| sean-k-mooney | so that is likely the issue | 19:55 |
| fungi | the long answer is that the sshd gerrit embeds doesn't do hash negotiation for exchanging host keys, and the default is ssh-rsa which uses sha-1 and is no longer accepted by default in openssh 8.8 | 19:56 |
| sean-k-mooney | yep | 19:56 |
| sean-k-mooney | i rememebr the issue | 19:56 |
| sean-k-mooney | i help other fix it when fedora made the change | 19:56 |
| fungi | gerrit's sshd does support sha-2/256 and sha-2/512 instead, but openssh doesn't bother trying them if there's no host key negotiation support in the sshd | 19:56 |
| sean-k-mooney | i just didnt upgrade fedora and forgot about it | 19:56 |
| sean-k-mooney | ya i can reinable it in my ssh config if i want | 19:57 |
| sean-k-mooney | the main issue is have my home server set to only allow ssh with keys so beofre i replace my key i shoudl make sure to add the new one first | 19:57 |
| fungi | yep, that'll work too and is quicker, but it's a regression in security posture so we're not in the business of suggesting it to people ;) | 19:58 |
| sean-k-mooney | well it depends on the key chper you use | 19:58 |
| sean-k-mooney | but ya | 19:58 |
| fungi | right, i think you may be able to force it on a host-by-host basis in ~/.ssh/config to use rsa-sha2-512 | 19:59 |
| sean-k-mooney | if you dont use the nist curve eliptic curves are not too bad | 19:59 |
| sean-k-mooney | oh you ment enabling it in the config | 20:00 |
| sean-k-mooney | ya i think you can do it for just one host | 20:00 |
| fungi | rsa-sha2-512 is plenty strong with a 3072 or 4096 bit rsa key, in my professional opinion | 20:00 |
| fungi | even rsa-sha2-256 should be fine | 20:01 |
| fungi | see the HostbasedAcceptedAlgorithms section in the ssh_config manpage if you want to override it like that | 20:02 |
| fungi | or actually it may be HostKeyAlgorithms | 20:03 |
| fungi | though i don't even recall if that works when the sshd lacks negotiation for it | 20:04 |
| fungi | i know ssh-rsa is a hard-coded fallback in the openssh client anyway | 20:04 |
| fungi | unfortunately | 20:04 |
| fungi | keeping it as the fallback even after deprecation seems wrong to me, but whatever | 20:04 |
| sean-k-mooney | fungi: actully im not sure if you are on #openstack-qa | 20:08 |
| sean-k-mooney | setuptools need to be bumped to 60.3.0 | 20:09 |
| sean-k-mooney | they broke get-pip | 20:09 |
| sean-k-mooney | so i would expect the devstack jobs to start exploding soon | 20:09 |
| fungi | yeah, i'm in #openstack-qa but don't usually follow it unless someone mentions me | 20:09 |
| sean-k-mooney | i was working on a patch to upper constaitns to resolve it | 20:10 |
| sean-k-mooney | once i fi my key issue | 20:11 |
| fungi | yep, i caught up in there, thanks | 20:11 |
| *** timburke__ is now known as timburke | 20:58 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!