[gentoo-dev] cvs.gentoo.org, git.gentoo.org, *.overlays.gentoo.org migration timeline & ssh keys

[gentoo-dev] cvs.gentoo.org, git.gentoo.org, *.overlays.gentoo.org migration timeline & ssh keys

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 972 bytes --]

As previously mentioned, we're having to move the CVS & Git (and
discontinuing SVN) very soon (possibly as soon as 2014/07/01 00:00 UTC, but
before the end of the week). There will be a followup mail with the exact time,
but it may be on short notice.

Here are the new SSH fingerprints for the service:

1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba (ED25519)
2048 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)

This covers the following:
- cvs.gentoo.org
- git.gentoo.org
- git.overlays.gentoo.org

As well as the v4-only/v6-only DNS aliases for those services:
- cvs{-v4,-v6}.gentoo.org
- git{-v4,-v6}.gentoo.org
- git{-v4,-v6}.overlays.gentoo.org

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Infrastructure Lead
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 460 bytes --]

Re: [gentoo-dev] cvs.gentoo.org, git.gentoo.org, *.overlays.gentoo.org migration timeline & ssh keys

[James Cloos]

[-- Attachment #1: Type: text/plain, Size: 453 bytes --]

A quick test shows that the sshfp for the ed25519 key for the current
host is not published; those who configure ssh to prefer ssh-ed25519 and
VerifyHostKeyDNS will get an error about that, even after accepting the
key, just because the other keys' sshfps are published.

Please be sure to publish sshfp for all four keys when the new host
takes over.

Thanks!

-JimC
-- 
James Cloos <cloos@jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

[gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

[Robin H. Johnson]

Hi all,

Last evening, the old sponsor where cvs/git/git.overlays was hosted
turned off the old servers, earlier than I expected.

With two notable exceptions listed below, almost everything should be
how it should be, so you can continue as before.

The new SSH keys, in case you still didn't have them:
On Mon, Jun 30, 2014 at 10:26:52PM +0000, Robin H. Johnson wrote:
> 1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
> 256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
> 256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba (ED25519)
> 2048 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)

1.
Overlays missing commits since 2014/07/22 02:49 UTC
---------------------------------------------------
So last time overlays had an outage, infra promised to look into a git
mirroring setup, so when this forced migration was announced, I started
to implement a very rough version of mirroring for both the main cvs/git
repos, as well as the overlays repos.

It worked on the primary repos, but after some initial runs it failed on
all of the git.overlays repos at Jul 22 02:49 UTC. I've been busy with
real life, and I unfortunately didn't notice it until too late.

As a direct result, any commits pushed to git.overlays repos after
2014/07/22 22 02:49 UTC, are missing. If you have them locally, all you
need to do is 'git push' for all of your branches, and they'll be
restored.

2.
gitweb/cgit offline, anongit rate-limited
-----------------------------------------
One of the plans was to merge the hosting of git.gentoo.org and
git.overlays.gentoo.org into a single large Gitolite deployment, in
preparation for the Git migration of gentoo-x86.

The gotcha is that while we want all of the write traffic to be
consolidated, we want to be able to scale the readonly capacity easily
(without the budget or sharding that GitHub has).

It isn't a 100% solved problem yet (one of the reasons that I hadn't
flipped stuff over yet). There is also a lot more read-only Git traffic
than I expected (enough to kill some systems); so I'm NOT enabling a web
server on the box that runs the readwrite traffic yet.

The leading solution I have, that allows the most flexibility, is simply
splitting at the hostname:
http://gitweb.gentoo.org/$REPO
git://readonly.git.gentoo.org/$REPO
git://ro.git.gentoo.org/$REPO
git+ssh://git@readwrite.git.gentoo.org/$REPO
git+ssh://git@rw.git.gentoo.org/$REPO

This also lets us trivially distribute readonly mirrors distributed
around the world, which would hugely improve performance when the Git
migration is done.

As a migration plan, git.gentoo.org would continue to host R+RW git for
a month.

Any concerns or alternative ideas should be proposed on the gentoo-dev
lists.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Infrastructure Lead
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85

Re: [gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

["Paweł Hajdan, Jr."]

[-- Attachment #1: Type: text/plain, Size: 1985 bytes --]

On 8/19/14 1:00 AM, Robin H. Johnson wrote:
> The new SSH keys, in case you still didn't have them:
> On Mon, Jun 30, 2014 at 10:26:52PM +0000, Robin H. Johnson wrote:
>> 1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
>> 256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
>> 256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba (ED25519)
>> 2048 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)

I noticed the ssh host key for cvs.gentoo.org changed just now.

IMHO such announcement would greatly benefit from a digital signature.

Just in case, this is what ssh printed out for me (the new key matches
the announcement):

$ cvs up
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for cvs.gentoo.org has changed,
and the key for the corresponding IP address 148.251.78.52
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88.
Please contact your system administrator.
Add correct host key in /home/ph/.ssh/known_hosts to get rid of this
message.
Offending RSA key in /home/ph/.ssh/known_hosts:15
RSA host key for cvs.gentoo.org has changed and you have requested
strict checking.
Host key verification failed.
cvs [update aborted]: end of file from server (consult above messages if
any)

Paweł


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 841 bytes --]

Re: [gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

[Dirkjan Ochtman]

On Tue, Aug 19, 2014 at 6:10 PM, "Paweł Hajdan, Jr."
<phajdan.jr@gentoo.org> wrote:
> I noticed the ssh host key for cvs.gentoo.org changed just now.
>
> IMHO such announcement would greatly benefit from a digital signature.

Robin's July 1 announcement, which I easily found when I ran into the
same warning yesterday night, did have a signature.

Cheers,

Dirkjan

Re: [gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

[hasufell]

"Paweł Hajdan, Jr.":
> On 8/19/14 1:00 AM, Robin H. Johnson wrote:
>> The new SSH keys, in case you still didn't have them:
>> On Mon, Jun 30, 2014 at 10:26:52PM +0000, Robin H. Johnson wrote:
>>> 1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
>>> 256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
>>> 256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba (ED25519)
>>> 2048 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)
> 
> I noticed the ssh host key for cvs.gentoo.org changed just now.
> 
> IMHO such announcement would greatly benefit from a digital signature.
> 

I'm not going to commit anything until this issue is resolved. Can we
get _confirmed_ fingerprints?

Re: [gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 08/19/2014 10:46 PM, hasufell wrote:
> "Paweł Hajdan, Jr.":
>> On 8/19/14 1:00 AM, Robin H. Johnson wrote:
>>> The new SSH keys, in case you still didn't have them: On Mon,
>>> Jun 30, 2014 at 10:26:52PM +0000, Robin H. Johnson wrote:
>>>> 1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA) 
>>>> 256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA) 
>>>> 256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba
>>>> (ED25519) 2048
>>>> 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)
>> 
>> I noticed the ssh host key for cvs.gentoo.org changed just now.
>> 
>> IMHO such announcement would greatly benefit from a digital
>> signature.
>> 
> 
> I'm not going to commit anything until this issue is resolved. Can
> we get _confirmed_ fingerprints?
> 

The following fingerprint information was presented in Robin's email
of 1 July titled "[gentoo-dev] cvs.gentoo.org, git.gentoo.org,
*.overlays.gentoo.org migration timeline & ssh keys" and properly
OpenPGP Signed:

1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba (ED25519)
2048 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)



- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJT87hMAAoJEPw7F94F4TaghKEQAJDCdvT2K/de+uhbdBkgScYQ
YdBDUqgsCMQFZmCsGyhncmbf83ZAGy37IcN0Dk6x1jLm/VxDPfpkkxF3RivJAtcJ
4hT3UYGzo9c+3yLpevRgU+/RTVWG2yflNdVeXyeKmAB+OVjIKIio8j6pK5YuQjGT
mit5jVsgb03pKPXHMdn2Fy/lgV69llhOVtpAE6mtpxi3qtPafB1o5KYx71ufT04q
Axo2ucbbEKfY0ZQ6dQk9DtAzIJbgei9G5w0rNgayVXFwnQ5xGcqdZDqE3fjC9Vm5
iV/taJIg0Ks+L/mjl/rMg/6lcVGyy/Fv0nk5GK3mEpoUjoeoJkmZIxQScEy7g9k/
gfXyQEclbS3+05PqfE7AUvyC7j10mlc/I0KgNjOUwEqLv/LS/m2+fTKT9JjXi63u
zfYF3jqAUvqeb4bnhTZVuCvYUyUP1ShyQnwPGXlVt1CLujf5nyf6hP++Ect9Fjd4
N8s4K7fT2FUPTczZGmB75XtXETgUWcfvtgT/kP2S5auDYerP0KoId0zf7R0d0Psm
PupvEefpBm2wdRXsUJyH0ulDJhee0TIzfUQEVaOOpoyYj98rPilUC7Z7O+t7Ls46
RsBZVFmT/xJkDYeuE0A4wOX40H8exzHZ/BtumfFWY56g80GuWy/phYn5g7LGqUZm
zVtfQ/23vUhwcxMF0Ha+
=2vHT
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

[hasufell]

Kristian Fiskerstrand:
> On 08/19/2014 10:46 PM, hasufell wrote:
>> "Paweł Hajdan, Jr.":
>>> On 8/19/14 1:00 AM, Robin H. Johnson wrote:
>>>> The new SSH keys, in case you still didn't have them: On Mon,
>>>> Jun 30, 2014 at 10:26:52PM +0000, Robin H. Johnson wrote:
>>>>> 1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
>>>>> 256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
>>>>> 256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba
>>>>> (ED25519) 2048
>>>>> 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)
>>>
>>> I noticed the ssh host key for cvs.gentoo.org changed just now.
>>>
>>> IMHO such announcement would greatly benefit from a digital
>>> signature.
>>>
> 
>> I'm not going to commit anything until this issue is resolved. Can
>> we get _confirmed_ fingerprints?
> 
> 
> The following fingerprint information was presented in Robin's email
> of 1 July titled "[gentoo-dev] cvs.gentoo.org, git.gentoo.org,
> *.overlays.gentoo.org migration timeline & ssh keys" and properly
> OpenPGP Signed:
> 
> 1024 5f:c3:fe:9a:ac:a7:99:f4:d3:c1:93:4c:52:87:74:28 (DSA)
> 256  aa:6a:e4:74:1d:73:d2:5a:9f:45:9f:18:55:81:c9:9a (ECDSA)
> 256  1c:2e:99:7d:c7:f0:bc:3b:a9:fb:d0:3e:2c:2a:79:ba (ED25519)
> 2048 24:3b:2d:3b:47:ca:7e:62:48:97:49:6a:f5:ad:66:88 (RSA)
> 
> 


Thanks, I found it now. Maybe it would still be better to repost this
close before it actually hits us to minimize confusion.

Re: [gentoo-dev] Followup notes: {cvs,git,git.overlays}.gentoo.org migration; awol: some overlays commits, gitweb

[Brian Dolbec]

On Tue, 19 Aug 2014 21:19:11 +0000
hasufell <hasufell@gentoo.org> wrote:

> Thanks, I found it now. Maybe it would still be better to repost this
> close before it actually hits us to minimize confusion.
> 

Quoting from Robin's email From Monday, Aug. 18, 2014:

Last evening, the old sponsor where cvs/git/git.overlays was hosted
turned off the old servers, earlier than I expected.


So, I'm sure there would have been an announcement again before the
final switch.  Had the actual date been known in advance.

-- 
Brian Dolbec <dolsen>

Re: [gentoo-dev] cvs.gentoo.org, git.gentoo.org, *.overlays.gentoo.org migration timeline & ssh keys

[Vadim A. Misbakh-Soloviov]

[-- Attachment #1: Type: text/plain, Size: 983 bytes --]

Btw, I've noticed git.overlays.gentoo.org moved to Hetzner.

When I remember my expirience of work with Hetzner - I'm scary about Gentoo' 
infrastructure destiny.


I had a conversation with CEO of my current DDoS-proof hoster and he expressed 
his desire to "help interesting projects" and asked about the necessary amount 
of sponsorship and it's terms (and conditions).

So, can I ask you to provide some info about infra team hardware requirements 
(which amount needs to be sponsored) and if it is any sponsoring conditions 
that Gentoo Foundation can suggest to the sponsor (maybe some banner, or 
something like that)?

Anyway, mainly I need the amount of hardware gentoo infra team requires to 
[strike]get rid of hetzner[/strike] meet their "comfortable-work" 
requirements? Then I can discuss it with hoster again and then bring together 
somebody from infra-team and hoster's CEO or CTO to discuss the terms 
themselves.



-- 
Best regsrds,
mva

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-dev] cvs.gentoo.org, git.gentoo.org, *.overlays.gentoo.org migration timeline & ssh keys

[Alex Legler]

[-- Attachment #1: Type: text/plain, Size: 1461 bytes --]

On 8/19/14, 8:18 PM, Vadim A. Misbakh-Soloviov wrote:
> Btw, I've noticed git.overlays.gentoo.org moved to Hetzner.
> 
> When I remember my expirience of work with Hetzner - I'm scary about Gentoo' 
> infrastructure destiny.
> 

We are directly sponsored by them with at least another machine and are
happy with their services.

> 
> I had a conversation with CEO of my current DDoS-proof hoster and he expressed 
> his desire to "help interesting projects" and asked about the necessary amount 
> of sponsorship and it's terms (and conditions).
> 
> So, can I ask you to provide some info about infra team hardware requirements 
> (which amount needs to be sponsored) and if it is any sponsoring conditions 
> that Gentoo Foundation can suggest to the sponsor (maybe some banner, or 
> something like that)?

Kindly consult past messages sent to the gentoo-announce list on that topic.

> 
> Anyway, mainly I need the amount of hardware gentoo infra team requires to 
> [strike]get rid of hetzner[/strike] meet their "comfortable-work" 
> requirements? Then I can discuss it with hoster again and then bring together 
> somebody from infra-team and hoster's CEO or CTO to discuss the terms 
> themselves.
> 
> 

Mind you, we are not going to 'ditch' sponsors, or randomly move
services around just to use your preferred hoster, even if you establish
sponsorship contacts with them.

Alex

PS. Your signature has a typo.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 841 bytes --]