7 ms·

Doesn't Fedora X's RPMs basically become RHEL's RPMs? What's the big deal here?

deleted 5y ago
[deleted]
skered 5y ago
Until Red Hat starts to add backports or fixes for customers that don't get push back upstream. Then when X+1 gets to RHEL it's missing all the previous RHEL only updates (some not backport related).
- denimnerd42 5y ago
  How often does this happen? do they not keep track of what they need to upstream? how do they merge that all back in when X+1 begins? yikes..
  - deleted 5y ago
    [deleted]
- CoolGuySteve 5y ago
  I always wondered who does all this backporting and patching work for these ancient enterprise Linuxes. It seems like brutally monotonous work. Maybe they're reading this comment right now, hi!
  - NAK21 5y ago
    Maybe I'm missing what's ancient about Fedora or RHEL, care to share?
    - CoolGuySteve 5y ago
      RHEL 7 came out 6 years ago with Linux 3.10 and is still getting patched. Somebody has to manage and integrate all those security fixes in all those packages without breaking the old codebases.
      - chasil 5y ago
        ...it's not just getting patched. Kernelcare has given me 48 hotfixes on a 3.10 kernel that I booted last year. kcarectl --patch-info | awk '/^kpatch-name/{print ++n};{print}' .... 48 kpatch-name: 3.10.0/proc-restrict-pagemap-access-1062.patch kpatch-description: Restrict access to pagemap/kpageflags/kpagecount kpatch-kernel: kpatch-cve: kpatch-cvss: kpatch-cve-url: http://googleprojectzero.blogspot.ru/2015/03/exploiting-dram-rowhammer-bug-to-gain.html kpatch-patch-url: uname: 3.10.0-1160.25.1.el7
        jaboutboul 5y ago
        +1 for KernelCare.
        gnufx 5y ago
        Is "kpatch" there actually the same thing as RHEL's kpatch? I thought Kernelcare used something proprietary.
        chasil 5y ago
        The Kernelcare front end tool is kcarectl. Ksplice (Oracle) was first, followed by kgraft (Suse), and kpatch (RedHat). According to the article below, kpatch is x86/64 only, uses ftrace, provides runtime patches only until the next minor kernel release on a standard license, does not address all CVEs, and cannot be used with "SystemTop or kprobe." "KernelCare has no such limitations." https://blog.kernelcare.com/competitors/kpatch-overview-of-enterprise-live-patching-services https://blog.kernelcare.com/competitors/kpatch-overview-of-e...
        gnufx 5y ago
        I asked because the listing said "kpatch" in the output of the command. I've never used Kernelcare, only suggested investigating it, despite it being proprietary. Ksplice was done by MIT students, not Oracle. I used it long before Oracle bought it, initially with my own patches (and actually after that as a "legacy" customer). kpatch isn't just x86_64; it's in at least ppc64le RHEL 7, although not for the "alt kernel" on the POWER9 systems I use. I don't know whether it's the case, but their comparison rather suggests Kernelcare is based on Ksplice.
  - delaynomore 5y ago
    For a lot of developers, "brutally monotonous work" is just ... work.
  - handrous 5y ago
    Is there a world in which the vast majority of dev work isn't brutally monotonous? Most work's writing unremarkable code for unremarkable products containing unremarkable features that have already been implemented 1,000 times before, and likely even more than once before for the person doing the work. A ton of dev time, at least for people who aren't the much-derided solo-language-experts (e.g. The C# + Windows programmer, the Java programmer, who only do those kinds of jobs and don't even dabble in much else) is just wrangling the unfamiliar-brokenness of a tool & library ecosystem (it would be familiar-brokenness 5 years in and take up little of your time, for most non-trendy platforms, but you're either using a trendy one that changes way too much, or will be on a different language + ecosystem entirely before you hit 5 years on this one). Very little dev effort is working on anything cool, and very little of the code for cool projects isn't kinda boring and normal.
- richardwhiuk 5y ago
  Presumably everything relevant in RHEL gets backported before the next RHEL cut, and everything is in a branch?
dralley 5y ago
The author seems to be complaining that instead of every distro having their own copy of specfiles, the specfiles are semi-shared and use conditional logic to include or exclude components depending on which distribution the package is being built for. In this particular case a feature should have been disabled on Fedora, but was enabled unconditionally, which caused problems on Fedora. They seem to be further complaining that when this bug was fixed [0], a condition was added for "fedora" rather than "rhel", meaning that any Fedora derivatives might trip over this issue (because they wouldn't trigger the condition). But they never made this complaint in the actual Bugzilla [0] where someone could consider their feedback, they skipped straight to the "complain via blog post" phase. Just like they did in their first blog post [1] where they said >I would file a bug report but I cannot imagine that Fedora would accept it. They already know that this feature doesn't work; it's right there in the DKMS manpage. It's there anyway because, well, I don't know. This is the most user-hostile decision I think I've ever seen Fedora make. Nevertheless it seems they did file the bug report, and it was accepted, and fixed in less than a week. My advice to the author is that perhaps they should extend a little more charity and "just ask" first, before they jump at the opportunity to complain in public - without having mentioned the issue to anyone with the ability to fix it. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1962841 https://bugzilla.redhat.com/show_bug.cgi?id=1962841 [1] https://utcc.utoronto.ca/~cks/space/blog/linux/FedoraWeakUpdatesFailure https://utcc.utoronto.ca/~cks/space/blog/linux/FedoraWeakUpd...
- kjs3 5y ago
  Welcome to the social media era. You don't get clicks/likes/upvotes by going through the process to engage with people, you get them by running to social media and making mountains out of molehills, for the lulz. Remember, it's not about community, or helping out, or just doing the right thing, it's about your "influencer" clout.
- 3v1n0 5y ago
  Also debian uses conditional rules on some packages whether something is for debian, ubuntu or a derivative
  - 5y ago
fulafel 5y ago
Fedora is supposedly a community project and there are lots of desktop/laptop Fedora users and contributors who hold it to similar standards as eg Debian. Your comment seems to assume Fedora's aim is basically to be a RHEL incubator but that's not how it's supposed to work.

deleted 5y ago

[deleted]

Until Red Hat starts to add backports or fixes for customers that don't get push back upstream. Then when X+1 gets to RHEL it's missing all the previous RHEL only updates (some not backport related).

denimnerd42 5y ago
How often does this happen? do they not keep track of what they need to upstream? how do they merge that all back in when X+1 begins? yikes..
- deleted 5y ago
  [deleted]
CoolGuySteve 5y ago
I always wondered who does all this backporting and patching work for these ancient enterprise Linuxes. It seems like brutally monotonous work. Maybe they're reading this comment right now, hi!
- NAK21 5y ago
  Maybe I'm missing what's ancient about Fedora or RHEL, care to share?
  - CoolGuySteve 5y ago
    RHEL 7 came out 6 years ago with Linux 3.10 and is still getting patched. Somebody has to manage and integrate all those security fixes in all those packages without breaking the old codebases.
    - chasil 5y ago
      ...it's not just getting patched. Kernelcare has given me 48 hotfixes on a 3.10 kernel that I booted last year. kcarectl --patch-info | awk '/^kpatch-name/{print ++n};{print}' .... 48 kpatch-name: 3.10.0/proc-restrict-pagemap-access-1062.patch kpatch-description: Restrict access to pagemap/kpageflags/kpagecount kpatch-kernel: kpatch-cve: kpatch-cvss: kpatch-cve-url: http://googleprojectzero.blogspot.ru/2015/03/exploiting-dram-rowhammer-bug-to-gain.html kpatch-patch-url: uname: 3.10.0-1160.25.1.el7
      - jaboutboul 5y ago
        +1 for KernelCare.
      - gnufx 5y ago
        Is "kpatch" there actually the same thing as RHEL's kpatch? I thought Kernelcare used something proprietary.
        chasil 5y ago
        The Kernelcare front end tool is kcarectl. Ksplice (Oracle) was first, followed by kgraft (Suse), and kpatch (RedHat). According to the article below, kpatch is x86/64 only, uses ftrace, provides runtime patches only until the next minor kernel release on a standard license, does not address all CVEs, and cannot be used with "SystemTop or kprobe." "KernelCare has no such limitations." https://blog.kernelcare.com/competitors/kpatch-overview-of-enterprise-live-patching-services https://blog.kernelcare.com/competitors/kpatch-overview-of-e...
        gnufx 5y ago
        I asked because the listing said "kpatch" in the output of the command. I've never used Kernelcare, only suggested investigating it, despite it being proprietary. Ksplice was done by MIT students, not Oracle. I used it long before Oracle bought it, initially with my own patches (and actually after that as a "legacy" customer). kpatch isn't just x86_64; it's in at least ppc64le RHEL 7, although not for the "alt kernel" on the POWER9 systems I use. I don't know whether it's the case, but their comparison rather suggests Kernelcare is based on Ksplice.
- delaynomore 5y ago
  For a lot of developers, "brutally monotonous work" is just ... work.
- handrous 5y ago
  Is there a world in which the vast majority of dev work isn't brutally monotonous? Most work's writing unremarkable code for unremarkable products containing unremarkable features that have already been implemented 1,000 times before, and likely even more than once before for the person doing the work. A ton of dev time, at least for people who aren't the much-derided solo-language-experts (e.g. The C# + Windows programmer, the Java programmer, who only do those kinds of jobs and don't even dabble in much else) is just wrangling the unfamiliar-brokenness of a tool & library ecosystem (it would be familiar-brokenness 5 years in and take up little of your time, for most non-trendy platforms, but you're either using a trendy one that changes way too much, or will be on a different language + ecosystem entirely before you hit 5 years on this one). Very little dev effort is working on anything cool, and very little of the code for cool projects isn't kinda boring and normal.
richardwhiuk 5y ago
Presumably everything relevant in RHEL gets backported before the next RHEL cut, and everything is in a branch?

dralley 5y ago

The author seems to be complaining that instead of every distro having their own copy of specfiles, the specfiles are semi-shared and use conditional logic to include or exclude components depending on which distribution the package is being built for. In this particular case a feature should have been disabled on Fedora, but was enabled unconditionally, which caused problems on Fedora. They seem to be further complaining that when this bug was fixed [0], a condition was added for "fedora" rather than "rhel", meaning that any Fedora derivatives might trip over this issue (because they wouldn't trigger the condition). But they never made this complaint in the actual Bugzilla [0] where someone could consider their feedback, they skipped straight to the "complain via blog post" phase. Just like they did in their first blog post [1] where they said >I would file a bug report but I cannot imagine that Fedora would accept it. They already know that this feature doesn't work; it's right there in the DKMS manpage. It's there anyway because, well, I don't know. This is the most user-hostile decision I think I've ever seen Fedora make. Nevertheless it seems they did file the bug report, and it was accepted, and fixed in less than a week. My advice to the author is that perhaps they should extend a little more charity and "just ask" first, before they jump at the opportunity to complain in public - without having mentioned the issue to anyone with the ability to fix it. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1962841 https://bugzilla.redhat.com/show_bug.cgi?id=1962841 [1] https://utcc.utoronto.ca/~cks/space/blog/linux/FedoraWeakUpdatesFailure https://utcc.utoronto.ca/~cks/space/blog/linux/FedoraWeakUpd...

kjs3 5y ago
Welcome to the social media era. You don't get clicks/likes/upvotes by going through the process to engage with people, you get them by running to social media and making mountains out of molehills, for the lulz. Remember, it's not about community, or helping out, or just doing the right thing, it's about your "influencer" clout.
3v1n0 5y ago
Also debian uses conditional rules on some packages whether something is for debian, ubuntu or a derivative
- 5y ago

fulafel 5y ago

Fedora is supposedly a community project and there are lots of desktop/laptop Fedora users and contributors who hold it to similar standards as eg Debian. Your comment seems to assume Fedora's aim is basically to be a RHEL incubator but that's not how it's supposed to work.