unable to access 'https://git.launchpad.net/ubuntu-cve-tracker/': 503 error

Bug #1925337 reported by Olivian Doroftei on 2021-04-21
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Ubuntu CVE Tracker
Undecided
Unassigned

Bug Description

Hi,

As of today the CVE tracker repository is no longer accessible via the https url.

git clone https://git.launchpad.net/ubuntu-cve-tracker/
Cloning into 'ubuntu-cve-tracker'...
fatal: unable to access 'https://git.launchpad.net/ubuntu-cve-tracker/': The requested URL returned error: 503

Cloning the repository using the other url (git://git.launchpad.net/ubuntu-cve-tracker) works, however the CLAIR scanner has the "https" url hardcoded and this blocks all the scans.

Can you have a look please?

Regards,
Olivian

Revision history for this message
Steve Beattie (sbeattie) wrote :

Hi Olivian,

Sorry you're hitting this issue. Unfortunately, services like clair that have thousands of hosts continually hitting the hosting git server saturate the server, and so there are scaling measures in place that cause it to retur a 503 error when too many clients are concurrently hitting it. We have staff working on scaling up the git service, bu also have attempted to get clair to pull data from other sources instead.

Thanks.

Revision history for this message
Olivian Doroftei (olivian) wrote :

Hi,

Thank you very much for your response.
I totally understand what you're going through.

For the time being we have stopped cloning your repository for every scan.
For now we will stick to consume CLAIR's (almost) daily updated containerized database.

This should prevent at least ~2000 calls/day from our side.

The incident can be closed.

Best regards,
Olivian

Revision history for this message
Olivian Doroftei (olivian) wrote :

p.s.:
  The phrasing "for the time being" should be read as "from now on".
  We were not aware that CLAIR was doing those "git clone" commands on every run.
  No more "git clone" from us from now on.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Related questions