Fixes #15538 - make sure the rpms from ssl-build are used #91
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @@ -81,9 +83,8 @@ def deploy! | |||
|
|
|||
| def new_version_available? | |||
There was a problem hiding this comment.
I don't think this function covers what it needs to do anymore. Something like needs_deploy? feels more appropriate now.
Before this patch, we were relying on the fact that the latest rpms are always better. However, people often try to rollback to the previous state of ssl-build and this behavior of the certs script was causing more troubles than benefits. After this change, we always use the latest version we have available in ssl-build by checking if that's what's already installed on the system or not. While trying to rollback to some older version of certs, I was hitting the nssdb errors, as we were not cleaning the certs in there properly. Therefore I've reused the resource we already had there for certutil, to clean up certs first.
iNecas
force-pushed
the
install-latest-in-dir
branch
from
a9d6038 to
5c48882
Compare
|
Untested, but 👍 for the code. |
|
Running through the test scenario |
|
ACK - thanks @iNecas ! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this patch, we were relying on the fact that the latest rpms
are always better. However, people often try to rollback to the
previous state of ssl-build and this behavior of the certs script was
causing more troubles than benefits.
After this change, we always use the latest version we have available
in ssl-build by checking if that's what's already installed on the
system or not.
While trying to rollback to some older version of certs, I was hitting
the nssdb errors, as we were not cleaning the certs in there properly.
Therefore I've reused the resource we already had there for certutil,
to clean up certs first.
Steps to test:
1 install katello
2 check the certificiate of web UI
3
cp ~/ssl-build{,.1}4
foreman-installer --certs-update-all5 check the certificiate of web UI
6
cp ~/ssl-build{,.2}7
rm -rf ~/ssl-build8
cp ~/ssl-build{.1,}9
foreman-installer10 the certificate of the web UI should change back to the one from step 2
11
foreman-installer --certs-update-all12 the certificate of the web UI should be different than the one from step 2 or 5