Building Fuel 8.0 Fails with the latest cpio package

[Jonas Bjurel]

Detailed bug descripotion:
Fuel 8.0 build fails due to new cpio version.
A new security patch for cpio causes the fuel build to fail. Before this patch, cpio used to follow symlinks, this was deemed as a security risk and a patch (now part of Ubuntu 14.04) prevents cpio to follow symlinks unless the --extract-over-symlinks option
is given. See: https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=774669;filename=cpio-2.11%2Bdfsg-4.1-nmu.diff;msg=48

The fault is manifested in the following log output:

   rubygem-rdoc.noarch 0:4.0.0-26.el7~mos1
   rubygem-stomp.noarch 0:1.3.4-3.el7~mos1
   rubygem-systemu.noarch 0:2.6.4-1.el7~mos1
   rubygems.noarch 0:2.0.14-26.el7~mos1
   sed.x86_64 0:4.2.2-5.el7
   setup.noarch 0:2.8.71-5.el7
   shadow-utils.x86_64 2:4.1.5.1-18.el7
   shared-mime-info.x86_64 0:1.1-7.el7
   sqlite.x86_64 0:3.7.17-6.el7_1.1
   systemd.x86_64 0:208-20.el7_1.6
   systemd-libs.x86_64 0:208-20.el7_1.6
   sysvinit-tools.x86_64 0:2.88-14.dsf.el7
   tcp_wrappers-libs.x86_64 0:7.6-77.el7
   tzdata.noarch 0:2015g-1.el7
   ustr.x86_64 0:1.0.4-16.el7
   util-linux.x86_64 0:2.23.2-22.el7_1.1
   xz.x86_64 0:5.1.2-9alpha.el7
   xz-libs.x86_64 0:5.1.2-9alpha.el7
   zlib.x86_64 0:1.2.7-13.el7

Complete!
# Disabling mail server (it have been installed as a dependency) sudo chroot /tmp/fuel-main/build/bootstrap/initram-root chkconfig exim off error reading information on service exim: No such file or directory
make[1]: [/tmp/fuel-main/build/bootstrap/prepare-initram-root.done]
Error 1 (ignored)
sudo chroot /tmp/fuel-main/build/bootstrap/initram-root chkconfig postfix off error reading information on service postfix: No such file or directory
make[1]: [/tmp/fuel-main/build/bootstrap/prepare-initram-root.done]
Error 1 (ignored)
sudo chroot /tmp/fuel-main/build/bootstrap/initram-root chown smmsp:smmsp /var/spool/clientmqueue
chown: invalid user: 'smmsp:smmsp'
make[1]: [/tmp/fuel-main/build/bootstrap/prepare-initram-root.done]
Error 1 (ignored)
# Installing kernel modules
find /tmp/fuel-main/local_mirror/centos/os/x86_64 -name 'kernel-3.10.0*'
| xargs rpm2cpio | \
         ( cd /tmp/fuel-main/build/bootstrap/initram-root; sudo cpio -idm './lib/modules/*' './boot/vmlinuz*' )
cpio: Can't write over symlinks: ./lib/modules/3.10.0-229.20.1.el7.x86_64

make[1]: *** [/tmp/fuel-main/build/bootstrap/prepare-initram-root.done]
Error 1
make[1]: Leaving directory `/tmp/fuel-main'
### Build failed with rc 2 ###

Steps to reproduce:
 Build Fuel from stable/8.0

Expected results:
 Build should pass

Actual result:
 Build fails

Reproducability:
 100% If using latest Ubuntu 14.04 cpio version.
 uabjonb@cbf3ca988a26:~/projects/opnfv/fuel/build$ dpkg -l cpio Desired=Unknown/Install/Remove/Purge/Hold
 |
 Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
 |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
 ||/ Name Version Architecture Description
 +++-=========================-=================-=================-======
 +++==================================================
 ii cpio 2.11+dfsg-1ubuntu amd64 GNU cpio -- a
 program to manage archives of files

Workarond:
 Not known

Impact:
 Not possible to build Fuel 8

[Dmitry Klenov (dklenov)]

Hi Jonas,

Thank you for bug report. Can you please also specify where did you try to build Fuel? Which environment / server did you use?

[Jonas Bjurel (jonas-bjurel)]

It is built in the context of Fuel@OPNFV.
It basically builds in a Ubuntu 14.04 (Vivid) docker container.
See https://git.opnfv.org/cgit/fuel/tree/build

I assume the result would be the same on any Ubuntu 14.04 environment.

[Michal Skalski (mskalski)]

This problem was resolved by pining cpio to specific version: https://github.com/fuel-infra/puppet-manifests/blob/master/modules/fuel_project/manifests/jenkins/slave.pp#L622-L636

It looks like using --extract-over-symlinks is a better solution: https://gerrit.opnfv.org/gerrit/#/c/12569/

[Jonas Bjurel (jonas-bjurel)]

A temporary emergency fix has been proposed in OPNFV:
https://gerrit.opnfv.org/gerrit/12569

BR/Jonas

[Sergey Kulanov (skulanov)]

for our build env we use pinning [1] and here is related bug [2]

[1]. https://github.com/fuel-infra/puppet-manifests/blob/master/modules/fuel_project/manifests/jenkins/slave.pp#L622-L636
[2]. https://bugs.launchpad.net/fuel/+bug/1551092

[Sergey Kulanov (skulanov)]

so making as duplicate for https://bugs.launchpad.net/fuel/+bug/1551092

workaround is to use pinning

[Michal Skalski (mskalski)]

What we have in fuel-infra project is a temporary workaround, using --extract-over-symlinks at least will eliminate this error for all customers who wants to build Fuel 8.0. We have a chance to resolve this bug in better way.

[Sergey Kulanov (skulanov)]

@Michal,

yep, I think this is the best way, so we can create patch

[Sergey Kulanov (skulanov)]

preparing patch, setting to high, since there exists workaround with pinning

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/8.0
Review: https://review.openstack.org/309432

[Fuel Devops McRobotson (fuel-devops-robot)]

Related fix proposed to branch: master
Change author: Sergey Kulanov <email address hidden>
Review: https://review.fuel-infra.org/20014

[Jonas Bjurel (jonas-bjurel)]

Thanks for the quick response/action, for reference - here is the corresponding OPNFV Jira ticket including the emergency patches related to it:
https://jira.opnfv.org/browse/FUEL-125

BR/Jonas

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/309432
Committed: https://git.openstack.org/cgit/openstack/fuel-main/commit/?id=456ce166cb0048675f3c54a173683e3bf891d51f
Submitter: Jenkins
Branch: stable/8.0

commit 456ce166cb0048675f3c54a173683e3bf891d51f
Author: Sergey Kulanov <email address hidden>
Date: Fri Apr 22 17:17:00 2016 +0300

    Allow cpio to follow symlinks

    Follow symlinks in cpio was deemed as a security risk so we
    unable to build iso with the latest cpio package.

    This patch introduce changes which allows to build iso both with
    "old" cpio and the latest one by using --extract-over-symlinks
    option

    Co-author: Stefan K. Berg <email address hidden>

    Change-Id: I2ac5a2e6255fae799ddff14bb3f97c270e3dba43
    Closes-bug: #1573213
    Related-bug: #1551092