Hello,

From the Scientific Linux side, we'd like to add EPEL to the list of disabled additional software repos.

It shouldn't be enabled by default, but it is something a lot of our users utilize.

This code adds a place within the InstallClass were distribution owners can add 3rd party repos they believe their community may desire.

This may also be helpful for pre-seeding the CentOS folks. They could use this to add some of their most popular SIGs to the list.

This resolves ambiguity of what options are available when root is locked.

~~This is a draft because there are at least these TODOs:~~

• [x] make bold labels "clickable"
• [x] verify the logic
• [x] find bugs etc. to link
• [x] consider renaming spoke to "Root account security"
• [x] ~~add an "empty password" banner~~ automatically switches to no password + locked instead.

See also: https://github.com/rhinstaller/anaconda/pull/3262#issuecomment-839202230 Suggested-by: Mairin Duffy [email protected] @mairin

The yescrypt hashing method is considered to be much stronger than sha512crypt and fully supported by libxcrypt. It is based on NIST-approved primitives and on par with argon2 in strength.

Fresh installed systems, as well as newly computed hashes for the UNIX shadow file should prefer this method.

The logic of the password entry box conflicts with that of the root lock button when enter the root_password spoke Root is locked but the password_entry box can still be entered when enter the root password spoke It's a confusing situation

the program triggers a timeout and executes sigalrm_handler When the Xorg service starts too slowly and exceeds the timeout time, which executes the raise exiterror causing the finally block to be executed. The finally block will cancel processing of the SIGUSER1 signal, which will cause the signuser1 sent to Anaconda after the Xorg service is started to fail to process and the program will die

link:https://bugzilla.redhat.com/show_bug.cgi?id=1918702

This fixes a large part of the ELN container builds.

Unfortunately, there are still missing BuildRequires so it can't be tested completely: Error: Unable to find a match: libtimezonemap-devel >= 0.4.1-2.

Add support to Anaconda to register no only to Red Hat run subscription infrastructure (usually called Hosted Candlepin) but also to custom Red Hat Satellite instances run by customers.

This is implemented by a couple new tasks and and a new library module called satellite.

To register to a Satellite instance instead of to Hosted Candlepin the use sets the Satellite URL in the GUI or the --server-hostname option of the rhsm kickstart command. Then at registration time Anaconda will try to fetch and execute a Satellite provisioning script from this URL.

If this is successful, the registration process will continue but the machine will end up talking to the Satellite instance instead of to Hosted Candlepin.

Also at installation time, execute the provisioning script on the target system after installation, so that the installed system is also properly provisioned for the given Satellite instance as well.

NOTE: Most Satellite instances use self signed certificates and only after the provisioning script has been run the chain of trust containing these self signed certificates is established.

Due to this it is recommended only ever register to Satellite via a trusted network where an attacker can't replace the provisioning script in transit as it by necessity has to be transferred a secure SSL connection being established (as before the script is run no chain of trust to the Satellite instance exists).

TODO

• [x] check registration to Satellite from kickstart works as well
• [x] check the system can still work with Satellite and its repositories after installation
• [x] check Satellite provided repos can be used as installation source (needs content added to Satellite test instance)
• [x] check why install time token transfer fails (likely caused by missing entitlements on Satellite test instance)
• [x] rename "Red Hat CDN" to "Satellite" when system is registered to Satellite, roll back to "Red Hat CDN" if unregistered at installation time
• [x] ~find why source spoke status is not updated after un-registration from Satellite~ actually a race condition in payload thread, see details in a comment below
• [x] adjust and fixup unit tests to cover Satellite functionality
• [x] resolve and remove all #FIXME items in the code

https://listman.redhat.com/archives/anaconda-devel-list/2021-February/msg00020.html

This is very much untested. I've written it and never actually attempted to run it. Not yet anyway.

I found a problem thou. Python's zoneinfo does not have any concept of common timezones. I can implement my own method to determine whether a timezone is common (pytz uses zone.tab and a short list of hardcoded values).

With pytz 2021.1, the extra zones effectively added by this PR are:

>>> import pytz, zoneinfo
>>> pytz_zones = {tz for tz in pytz.common_timezones if '/' in tz and not tz.startswith('Etc/')}
>>> zoneinfo_zones = {tz for tz in zoneinfo.available_timezones() if '/' in tz and not tz.startswith('Etc/')}
>>> len(zoneinfo_zones) / len(pytz_zones)
1.1762013729977117
>>> zoneinfo_zones - pytz_zones
{'Africa/Asmera',
 'Africa/Timbuktu',
 'America/Argentina/ComodRivadavia',
 'America/Atka',
 'America/Buenos_Aires',
 'America/Catamarca',
 'America/Coral_Harbour',
 'America/Cordoba',
 'America/Ensenada',
 'America/Fort_Wayne',
 'America/Godthab',
 'America/Indianapolis',
 'America/Jujuy',
 'America/Knox_IN',
 'America/Louisville',
 'America/Mendoza',
 'America/Montreal',
 'America/Porto_Acre',
 'America/Rosario',
 'America/Santa_Isabel',
 'America/Shiprock',
 'America/Virgin',
 'Antarctica/South_Pole',
 'Asia/Ashkhabad',
 'Asia/Calcutta',
 'Asia/Chongqing',
 'Asia/Chungking',
 'Asia/Dacca',
 'Asia/Harbin',
 'Asia/Istanbul',
 'Asia/Kashgar',
 'Asia/Katmandu',
 'Asia/Macao',
 'Asia/Rangoon',
 'Asia/Saigon',
 'Asia/Tel_Aviv',
 'Asia/Thimbu',
 'Asia/Ujung_Pandang',
 'Asia/Ulan_Bator',
 'Atlantic/Faeroe',
 'Atlantic/Jan_Mayen',
 'Australia/ACT',
 'Australia/Canberra',
 'Australia/Currie',
 'Australia/LHI',
 'Australia/NSW',
 'Australia/North',
 'Australia/Queensland',
 'Australia/South',
 'Australia/Tasmania',
 'Australia/Victoria',
 'Australia/West',
 'Australia/Yancowinna',
 'Brazil/Acre',
 'Brazil/DeNoronha',
 'Brazil/East',
 'Brazil/West',
 'Canada/Saskatchewan',
 'Canada/Yukon',
 'Chile/Continental',
 'Chile/EasterIsland',
 'Europe/Belfast',
 'Europe/Nicosia',
 'Europe/Tiraspol',
 'Mexico/BajaNorte',
 'Mexico/BajaSur',
 'Mexico/General',
 'Pacific/Johnston',
 'Pacific/Ponape',
 'Pacific/Samoa',
 'Pacific/Truk',
 'Pacific/Yap',
 'US/Aleutian',
 'US/East-Indiana',
 'US/Indiana-Starke',
 'US/Michigan',
 'US/Samoa'}

That's 17.6% of extra zones.

Please let me know if this actually matters or not.

Listing the most important major languages make them super-easy to find for international users. (lesser scroll) Identification of those languages is a challenge, however we may refer gnome-control-center.

Implementation

• One option is to join (prepend) those identified languages to locales in pyanaconda/ui/gui/spokes/welcome.py. Here, we may have separators to avoid confusion: separate local/national languages to common/major ones. So, major languages | national languages | other languages. However, in a many cases the count of national languages remain less than 4 which may leave the separators very close! And may not look nice.

• Another option could be major languages + national languages | other languages. I feel this may create confusion.

• As we are identifying local/national languages already to help ease user's search (for their languages), it makes sense to populate the first list with identified common languages in the event when territory lookup fails instead of just en_US.

Should we try moving get_common_languages to langtable instead?

Please feel free, to suggest better implementation way.

• Enable read only sysroot in the ostree repo config.
• Add rw to the kernel arguments to keep statefull parts of the system (/var & /etc) writable.

See: https://fedoraproject.org/wiki/Changes/Silverblue_Kinoite_readonly_sysroot Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2086489

Debugging of the driver_updates script could be a pain. To improve that we need much more logs in the whole file in a way that it won't bother users during boot. To solve that we are adding debug logs and showing them on the console only in case that inst.debug or rd.debug is used.

I propose a set of features allowing to reduce modifications we need for Qubes OS:

• Allow to specify default thin pool name and size,
• Allow to provide default partitioning based on scheme,
• Support for adding bootloader options in configuration file
• Support for setting encryption from configuration file
• Support for setting hostname from configuration file

We think that would benefit other parties, that's the reason of this PR.

The output of the zipl tool has been changed in version 2.25.0 [1], thus adapt the line prefix in the anaconda check as well.

[1] https://github.com/ibm-s390-linux/s390-tools/commit/f7d2339c6ad6c0adf1902a1a97a30b3168bc2c46

Resolves: rhbz#2157916

The output of the zipl tool has been changed in version 2.25.0 [1], thus adapt the line prefix in the anaconda check as well.

[1] https://github.com/ibm-s390-linux/s390-tools/commit/f7d2339c6ad6c0adf1902a1a97a30b3168bc2c46

Resolves: rhbz#2157917

The output of the zipl tool has been changed in version 2.25.0 [1], thus adapt the line prefix in the anaconda check as well.

[1] https://github.com/ibm-s390-linux/s390-tools/commit/f7d2339c6ad6c0adf1902a1a97a30b3168bc2c46

Resolves: rhbz#2153361

In case of late network activation based on kickstart (fetched from storage) we need to start the nm-initrd service manually by anaconda.

Follow-up of https://github.com/redhat-plumbers/dracut-rhel9/commit/c17c5b7604c8d61dd1c00ee22d