Pulp 2.8 Release Notes¶

Upgrade instructions¶

The CVEs require user interaction to remedy if you have been using qpid, and if you used pulp-qpid-ssl-cfg to generate the TLS keys. Rabbit users and users who generated their own keys for qpidd are not affected by these CVEs. Begin by upgrading to Pulp 2.8.5 and running migrations:

$ sudo systemctl stop qpidd httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd
$ sudo yum upgrade
$ sudo -u apache pulp-manage-db

Any qpidd CA, server and client certificate and key pairs that were generated with pulp-qpid-ssl-cfg are unsafe and should be replaced. After upgrading to 2.8.5 (as we did above), you can use the script to replace the certificates and keys:

$ sudo pulp-qpid-ssl-cfg

Now we are ready to start the services again:

$ sudo systemctl start qpidd httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd

Upgrade instructions¶

If you haven’t already upgraded (or attempted to upgrade) to 2.8.3, you should follow the upgrade instructions below for 2.8.3. If you have already dealt with the security issues in the 2.8.3 upgrade instructions, then the normal upgrade process, with migrations, should be followed:

$ sudo systemctl stop httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd
$ sudo yum upgrade
$ sudo -u apache pulp-manage-db
$ sudo systemctl start httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd

Bug Fixes¶

See the list of bugs fixed in 2.8.4

Upgrade instructions¶

Some of the CVEs require user interaction to remedy. Begin by upgrading to Pulp 2.8.3, and running migrations:

$ sudo systemctl stop httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd
$ sudo yum upgrade
$ sudo -u apache pulp-manage-db
$ sudo systemctl start httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd

$ sudo pulp-consumer unregister

# First remove the old files so that the new files get the correct SELinux context.
$ sudo rm /etc/pki/pulp/ca.*
$ sudo pulp-gen-ca-certificate

# You only need to do this if you didn't regenerate the CA above.
$ sudo restorecon -R /etc/pki/pulp

# It is important to remove the file so that the new file has the correct permissions.
$ sudo rm /etc/pki/pulp/nodes/node.crt
$ sudo pulp-gen-nodes-certificate

$ cd /etc/pki/pulp/
$ rm rsa.key rsa_pub.key
$ umask 077
$ openssl genrsa -out rsa.key <bits>  # <bits> should be at least 2048
$ openssl rsa -in rsa.key -pubout > rsa_pub.key
$ chgrp apache rsa.key rsa_pub.key
$ chmod 640 rsa.key  # Apache must be able to read the private key
$ chmod 644 rsa_pub.key  # The public key is world-readable as it is served via Apache

$ cd /etc/pki/pulp/consumer/
$ rm rsa.key rsa_pub.key
$ umask 077
$ openssl genrsa -out rsa.key <bits>  # <bits> should be at least 2048
$ openssl rsa -in rsa.key -pubout > rsa_pub.key

$ sudo pulp-consumer -u <admin-username> register --consumer-id=<consumer-id>

$ sudo systemctl restart httpd pulp_workers pulp_resource_manager pulp_celerybeat goferd

Troubleshooting¶

Regenerating the CA certificate will invalidate all client certificates that were issued by the old CA. All users will need to login to Pulp again to obtain a new client certificate. If you forget a step, you may see one of the following error messages:

• “pulp.server.managers.auth.authentication:ERROR: Auth certificate with CN [admin:admin:57155b83e779896cb3d634a4] is signed by a foreign CA” (or similar) in the server log can indicate that httpd has not been restarted since the CA was replaced.
• “The specified user does not have permission to execute the given command” from pulp-admin can mean that the user has not logged in since the new CA was present, or that httpd has not been restarted since the certificate was replaced. More generally, this error message can also mean that the user is not authorized to perform the given action.
• “An error occurred attempting to contact the server. More information may be found using the -v flag.” may be output by pulp-admin if you have restarted httpd but have not logged in again to get a new CA certificate. If you provide that -v flag and see “ConnectionException: (None, ‘tlsv1 alert decrypt error’, None)”, this is likely the issue.

Security Fixes¶

This release addresses a low impact security vulnerability related to the regeneration of pulp CA certificates:

https://access.redhat.com/security/cve/cve-2016-3095

Upgrade instructions¶

Users are advised to skip this release and move on to at least 2.8.3. See above.

Bug Fixes¶

See the list of bugs fixed in 2.8.1

New Features¶

• Multiple instances of pulp_celerybeat can now run simultaneously. If one of them goes down, another instance will dispatch scheduled tasks as usual.
• Pulp now supports configuring repositories to download content on-demand when it is requested by a client, or in the background after a sync and publish has occurred. This feature requires several additional packages and services, and is not supported on all content types. As part of this feature we now provide a new package, python-pulp-streamer. More information on these alternate download policies can be found in the alternate download policies documentation.
• Several changes have been made to the provided Apache httpd configuration files. In addition to these changes, a new Apache httpd configuration file is provided by Pulp. This configuration file, pulp_content.conf, is used to configure the new WSGI application used to serve content.
• When downloading content, Pulp now uses the system certificate authority trust store rather than the certificate authority trust store bundled with python-requests.
• Content applicability for an updated repository is calculated in parallel.

Deprecation¶

Dependency/Platform Changes¶

• If run on CentOS or Red Hat Enterprise Linux, the Pulp server now requires either version 7.1+ or 6.7+.
• pymongo >= 3.0.0 is now required.
• mod_xsendfile >= 0.12 is now required.

Client Changes¶

• Tasks with complete states (except canceled state) can now be deleted. This can be done using pulp-admin tasks purge command.

Other Changes¶

• Pulp used to store WSGI files under /srv, which was a violation of FHS. These files have been moved to /usr/share/pulp/wsgi.
• Pulp platform now automatically calculates the added_count, removed_count, and updated_count fields of repository sync task output.

Agent Changes¶

Bugs¶

Known Issues¶

• RHEL 7 and CentOS 7 users may experience a problem when upgrading. Please refer to note in upgrade instructions for workaround.

• Users that have the /var/lib/pulp directory or one of it’s subdirectories symlinked will experience a problem. Replacing the symlink with a bind mount will resolve the issue.

• RHEL 6 and CentOS 6 users who use Qpid as their broker need to be aware that the Qpid repository has changed locations. The most recent Qpid repository definition file can be obtained from Qpid packaging docs. Using an older version of python-qpid package will produce the following error in the logs:

  AttributeError: Session instance has no attribute 'set_message_received_notify_handler'
  

Before Upgrade¶

The Pulp team added stronger data validation in 2.8. To ensure that your data gets smoothly upgraded, please test your data with the provided testing tool before attempting an upgrade. You can read about how to perform the test here:

https://raw.githubusercontent.com/pulp/pulp/pulp-2.8.0-1/playpen/mongoengine/README

Upgrade Instructions for 2.7.x –> 2.8.x¶

sudo rpm -e --nodeps python-semantic-version

Upgrade the packages using:

sudo yum update

After yum completes you should migrate the database using:

sudo -u apache pulp-manage-db

sudo systemctl daemon-reload

After migrating the database, restart httpd, pulp_workers, pulp_celerybeat, and pulp_resource_manager.

Upgrade From Older Release¶

If you are upgrading from pulp older than 2.4.0, you must first upgrade to some release between 2.4.0 and 2.7.x, and then upgrade to 2.8.0 or greater.

Rest API Changes¶

• Tasks with complete states (except canceled state) can now be deleted.
• The API for regenerating content applicability for updated repositories no longer returns a Call Report. Instead a Group Call Report is returned.
• Task Groups with tasks having incomplete states can now be canceled.

Binding API Changes¶

Plugin API Changes¶