Re: [pve-devel] [RFC PATCH access-control] loosen locking restriction for users without tfa configured

2022-09-15 Thread Fabian Grünbichler
I think this is https://bugzilla.proxmox.com/show_bug.cgi?id=3739 ;) @wolfgang could you take a look at this? On September 14, 2022 3:42 pm, Dominik Csapak wrote: > With change to our new tfa mechanism, we now lock the tfa config > when verifying the second factor and when creating the challenge

Re: [pve-devel] [RFC kernel] revert problematic TSC multiplier commit

2022-09-15 Thread Fiona Ebner
Am 14.09.22 um 11:38 schrieb Eneko Lacunza: > Hi, > > El 14/9/22 a las 10:40, Eneko Lacunza escribió: >> >> El 14/9/22 a las 9:50, Fiona Ebner escribió: >>> Am 05.09.22 um 10:25 schrieb Eneko Lacunza: I just confirmed that in addition to issue reported in https://bugzilla.proxmox.com/sho

[pve-devel] [PATCH manager] ui: eslint: fix undefined check

2022-09-15 Thread Dominik Csapak
'typeof' cannot return 'undefined' only the string '"undefined"', newer eslint versions detect that as error to fix it, directly check it for undefined instead of using typeof Signed-off-by: Dominik Csapak --- www/manager6/storage/PBSEdit.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

Re: [pve-devel] [RFC PATCH access-control] loosen locking restriction for users without tfa configured

2022-09-15 Thread Thomas Lamprecht
Am 14/09/2022 um 15:42 schrieb Dominik Csapak: > The downside is that we cannot authenticate users anymore without quorum > (since locking requires write access to pmxcfs), even for users without > tfa configured (and also for clusters without any tfa configured at all) question is more if we shou

Re: [pve-devel] [RFC kernel] revert problematic TSC multiplier commit

2022-09-15 Thread Thomas Lamprecht
Am 14/09/2022 um 11:38 schrieb Eneko Lacunza via pve-devel: > I just made a kick test and 5.19.7-1 kernel continues to have issues for us > (tried live migration of 5 VMs from 5.13 to 5.19, 4 VMs froze using 100% CPU). Well, that is somewhat expected.. How 5.19 to 5.19 is working out would be mor

Re: [pve-devel] [PATCH qemu-server v7 1/1] api: update: check 'admin' tags privileges

2022-09-15 Thread Dominik Csapak
On 9/14/22 16:15, Aaron Lauterer wrote: Something that crossed my mind: Have you thought about not allowing tags if they match an admin tag, except for the '+'? Depending on what they will be used for in the future, there could be some potential to trick an admin by creating a similar regular

[pve-devel] [PATCH v3 container] fix #4192: revamp check for systemd version

2022-09-15 Thread Leo Nunner
Instead of iterating through several folders, it might just be easier to check the objdump output of /sbin/init and getting the version from there. Resolving the /sbin/init symlink happens inside the chroot, but the objdump from the host system is used, as to not run any untrusted executables. Sig

Re: [pve-devel] [PATCH manager v7 10/14] ui: tree/ResourceTree: show Tags in tree

2022-09-15 Thread Dominik Csapak
On 9/14/22 16:15, Aaron Lauterer wrote: Why the change from vm.text to vm_text in {lxc,qemu}/Config.js? AFAICT we have exactly the same string in the now not used "vm.text". If these changes are needed and should be part of this commmit, a short explanation would be good as it does not seem to

Re: [pve-devel] [PATCH manager v7 14/14] ui: form/Tag(Edit): add drag & drop when editing tags

2022-09-15 Thread Dominik Csapak
On 9/14/22 16:15, Aaron Lauterer wrote: On 6/21/22 11:20, Dominik Csapak wrote: Signed-off-by: Dominik Csapak ---   www/manager6/form/Tag.js | 22 +++--   www/manager6/form/TagEdit.js | 96 +++-   2 files changed, 114 insertions(+), 4 deletions(-) diff -

Re: [pve-devel] [RFC PATCH access-control] loosen locking restriction for users without tfa configured

2022-09-15 Thread Dominik Csapak
On 9/15/22 12:43, Thomas Lamprecht wrote: Am 14/09/2022 um 15:42 schrieb Dominik Csapak: The downside is that we cannot authenticate users anymore without quorum (since locking requires write access to pmxcfs), even for users without tfa configured (and also for clusters without any tfa configur

Re: [pve-devel] [RFC PATCH access-control] loosen locking restriction for users without tfa configured

2022-09-15 Thread Thomas Lamprecht
Am 15/09/2022 um 14:40 schrieb Dominik Csapak: > On 9/15/22 12:43, Thomas Lamprecht wrote: >> Am 14/09/2022 um 15:42 schrieb Dominik Csapak: >>> The downside is that we cannot authenticate users anymore without quorum >>> (since locking requires write access to pmxcfs), even for users without >>> t

[pve-devel] Proxmox Offline Mirror released!

2022-09-15 Thread Thomas Lamprecht
Hi all, We are proud to announce the first release of our new Proxmox Offline Mirror tool. With the Proxmox Offline Mirror tool, you can manage a local apt mirror for all package updates for Proxmox and Debian projects. From this local apt mirror you can create an external medium, for example

[pve-devel] [PATCH proxmox-apt/proxmox-offline-mirror 0/7] misc improvements

2022-09-15 Thread Fabian Grünbichler
this series adds some features and fixes some issues that pop up when attempting to mirror Ubuntu repositories, and should also improve resilience with other third-party repositories. tested with Ubuntu Jammy (main, security and updates repositories).

[pve-devel] [PATCH proxmox-offline-mirror 2/4] mirror: skip failed, non Packages references

2022-09-15 Thread Fabian Grünbichler
these contain extra data that is not that important for the main repository use case - providing deb packages. if they are not retrievable (e.g., Ubuntu *only* provides some of they via by-hash, which proxmox-offline-mirror doesn't yet support) a warning should be enough, instead of failing the wh

[pve-devel] [PATCH proxmox-apt 2/3] release: add 'architecture' helper

2022-09-15 Thread Fabian Grünbichler
which returns if a file reference is architecture specific, and for which architecture it is relevant. Signed-off-by: Fabian Grünbichler --- src/deb822/release_file.rs | 16 1 file changed, 16 insertions(+) diff --git a/src/deb822/release_file.rs b/src/deb822/release_file.rs in

[pve-devel] [PATCH proxmox-apt 3/3] release: fix typo in 'Acquire-By-Hash'

2022-09-15 Thread Fabian Grünbichler
to allow detection of repositories that support downloading indices via their hash instead of their filename. Signed-off-by: Fabian Grünbichler --- src/deb822/release_file.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/deb822/release_file.rs b/src/deb822/release_file.

[pve-devel] [PATCH proxmox-offline-mirror 1/4] mirror: use xz multi decoder

2022-09-15 Thread Fabian Grünbichler
Ubuntu's Packages.xz files require it, because they contain multiple streams. Signed-off-by: Fabian Grünbichler --- src/mirror.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mirror.rs b/src/mirror.rs index 78a493b..14b0c6a 100644 --- a/src/mirror.rs +++ b/src/mirror.r

[pve-devel] [PATCH proxmox-apt 1/3] release: add Commands file reference type

2022-09-15 Thread Fabian Grünbichler
used by command-not-found to lookup which package ships which command. Signed-off-by: Fabian Grünbichler --- Notes: this is technically a breaking change, but the only user of this already has a fallback match arm. I wonder whether we should mark this as non-exhaustive? src/deb822/

[pve-devel] [PATCH proxmox-offline-mirror 3/4] mirror: support acquiring indices by hash

2022-09-15 Thread Fabian Grünbichler
requires proxmox-apt > 0.9.1, since earlier versions misdetect by-hash support in the release file. Signed-off-by: Fabian Grünbichler --- src/mirror.rs | 47 ++- 1 file changed, 38 insertions(+), 9 deletions(-) diff --git a/src/mirror.rs b/src/mirror.

[pve-devel] [PATCH proxmox-offline-mirror 4/4] mirror: use new architecture helper

2022-09-15 Thread Fabian Grünbichler
in order to avoid having a list of arch-specific references on two places. Signed-off-by: Fabian Grünbichler --- requires proxmox-apt > 0.9.1 with the new helper src/mirror.rs | 14 +++--- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/mirror.rs b/src/mirror.rs index

Re: [pve-devel] [RFC PATCH access-control] loosen locking restriction for users without tfa configured

2022-09-15 Thread Dominik Csapak
On 9/15/22 14:53, Thomas Lamprecht wrote: Am 15/09/2022 um 14:40 schrieb Dominik Csapak: On 9/15/22 12:43, Thomas Lamprecht wrote: Am 14/09/2022 um 15:42 schrieb Dominik Csapak: The downside is that we cannot authenticate users anymore without quorum (since locking requires write access to pmx

[pve-devel] [PATCH FIXUP proxmox-offline-mirror] clippy fix

2022-09-15 Thread Fabian Grünbichler
Signed-off-by: Fabian Grünbichler --- not really important, but can be folded into the patch since it's not yet applied ;) src/mirror.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mirror.rs b/src/mirror.rs index f5ee48e..a1fc1a0 100644 --- a/src/mirror.rs +++ b/src/m

[pve-devel] [PATCH follow-up proxmox-offline-mirror 8/7] mirror: handle indices which are only available compressed

2022-09-15 Thread Fabian Grünbichler
there are repositories out there that not only skip serving the uncompressed version, but not even reference it in their Release file(s). Signed-off-by: Fabian Grünbichler --- best viewed with -w, the signal-desktop repository is one such example. src/mirror.rs | 56