See parent T283165, Let's Encrypt has changed their chain which affects:
It only affects Debian Stretch.
We need to find CI images in use that might be affected and trigger a rebuild. Should happen before October 1st 2021.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | TheDJ | T283164 Let's Encrypt issuance chains update | |||
| Resolved | SLyngshede-WMF | T283165 OpenSSL < 1.1.0 compatibility issues with new LE issuance chain | |||
| Resolved | hashar | T291425 Rebuild CI images affected by OpenSSL compat issue with new Let's Encrypt issuance chain |
The expected version numbers are
openssl1.0: 1.0.2u-1~deb9u5
gnutls28: 3.5.8-5+deb9u6
Change 723993 had a related patch set uploaded (by Hashar; author: Hashar):
[integration/config@master] dockerfiles: update Stretch images for Let'sEncrypt
Change 723993 merged by jenkins-bot:
[integration/config@master] dockerfiles: update Stretch images for Let'sEncrypt
The java package refuses to install. It fails when updating the debian alternatives for man page:
Setting up openjdk-8-jre-headless:amd64 (8u302-b08-1~deb9u1) ... (image.py:210) update-alternatives: using /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/rmid to provide /usr/bin/rmid (rmid) in auto mode (image.py:210) update-alternatives: error: error creating symbolic link '/usr/share/man/man1/rmid.1.gz.dpkg-tmp': No such file or directory (image.py:210) dpkg: error processing package openjdk-8-jre-headless:amd64 (--configure): urned error exit status 2 (image.py:210) dpkg: dependency problems prevent configuration of default-jre-headless: default-jre-headless depends on openjdk-8-jre-headless; however: Package openjdk-8-jre-headless:amd64 is not configured yet.
But we have dpkg configured to not install any man page in the images.
Reproducible with:
FROM docker-registry.wikimedia.org/stretch:latest RUN apt update RUN apt install -y openjdk-8-jre-headless
Package has version 8u302-b08-1~deb9u1
Change 724065 had a related patch set uploaded (by Hashar; author: Hashar):
[integration/config@master] dockerfiles: fix update-alternatives for java8
Change 724065 merged by jenkins-bot:
[integration/config@master] dockerfiles: fix update-alternatives for java8
Change 724076 had a related patch set uploaded (by Hashar; author: Hashar):
[integration/config@master] dockerfiles: fix more java based images
Change 724076 merged by Hashar:
[integration/config@master] dockerfiles: fix more java based images
Change 724132 had a related patch set uploaded (by Hashar; author: Hashar):
[integration/config@master] dockerfiles: update apt repo for java8-scala-spark
Change 724132 merged by jenkins-bot:
[integration/config@master] dockerfiles: update apt repo for java8-scala-spark
That was a not so fun trip but all images should have been updated. Gotta switch the Jenkins jobs to the new versions now which is yet another endeavor.
Change 724156 had a related patch set uploaded (by Hashar; author: Hashar):
[integration/config@master] jjb: update jobs having a Stretch related image
Mentioned in SAL (#wikimedia-releng) [2021-09-27T19:24:45Z] <hashar> Updating Jenkins jobs using a Stretch related image to latest version of the image. https://gerrit.wikimedia.org/r/c/integration/config/+/724156/ # T291425
Should be good. We shall see whether something ends up being broken on October 1st UTC.
Change 724156 merged by jenkins-bot:
[integration/config@master] jjb: update jobs having a Stretch related image