T283165 updated the production servers, but if we still run production images on Stretch we need to rebuild/redeploy them with latest Stretch:
The expected version numbers are
openssl1.0: 1.0.2u-1~deb9u5
gnutls28: 3.5.8-5+deb9u6
Description
Description
Details
Details
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | TheDJ | T283164 Let's Encrypt issuance chains update | |||
| Resolved | SLyngshede-WMF | T283165 OpenSSL < 1.1.0 compatibility issues with new LE issuance chain | |||
| Resolved | Joe | T291458 Rebuild production Stretch images with GNUTLS/OpenSSL updates for LE issue chain update |
Event Timeline
Comment Actions
The debmonitor query for libssl 1.0.2 tells us it's mostly images under the /releng prefix.
In addition, we have the following images:
- graphoid Decommissioned
- fluentd Decommissioned
- nodejs-slim old stretch-based nodejs image, needs updating
- ruby which is still stretch-based, should probably be bumped at least to use buster, and is apparently unused by releng or anything else.
- wikimedia-portals just needs to have its blubberfile to be updated not to pin specific versions of the images.
Comment Actions
The debmonitor query for | libgnutls30 tells us again it's mostly releng images, plus:
- research-mwaddlink:stable which needs updating. I am a bit perplexed by the label as "stable" is not a label we use in the pipeline.
- python-build-stretch which needs updating
- openjdk8 and openjre8 which need updating
- A couple of old wikidata-query-flink-rdf-streaming-updater -candidate images we can probably ignore given it seems the current -production ones are built on buster, but I see the blubberfile still points to a specific version of the base image, which should be corrected.
Comment Actions
Change 722565 had a related patch set uploaded (by Giuseppe Lavagetto; author: Giuseppe Lavagetto):
[operations/docker-images/production-images@master] Update a few stretch-based images for openssl / gnutls updates
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2021-09-21T09:44:58Z] <_joe_> deleting images for graphoid, T291458
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2021-09-21T09:46:08Z] <_joe_> deneb:~# docker-registryctl delete-tags docker-registry.wikimedia.org/fluentd T291458
Comment Actions
Change 722565 merged by Giuseppe Lavagetto:
[operations/docker-images/production-images@master] Update a few stretch-based images for openssl / gnutls updates
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2021-09-21T09:59:27Z] <_joe_> rebuilding openjdk8* image, ruby, nodejs-slim for T291458
Comment Actions
Change 722572 had a related patch set uploaded (by Giuseppe Lavagetto; author: Giuseppe Lavagetto):
[operations/docker-images/production-images@master] Fix openjdk8 images build
Comment Actions
Change 722572 merged by Giuseppe Lavagetto:
[operations/docker-images/production-images@master] Fix openjdk8 images build
Comment Actions
Change 722606 had a related patch set uploaded (by Giuseppe Lavagetto; author: Giuseppe Lavagetto):
[wikimedia/portals@master] Update blubberfile to avoid specific versions of parent images
Comment Actions
Change 722606 merged by jenkins-bot:
[wikimedia/portals@master] Update blubberfile to avoid specific versions of parent images
Comment Actions
Change 725765 had a related patch set uploaded (by Giuseppe Lavagetto; author: Giuseppe Lavagetto):
[wikimedia/portals@master] pipeline: switch to newer, buster-based image
Comment Actions
Change 725765 merged by jenkins-bot:
[wikimedia/portals@master] pipeline: switch to newer, buster-based image