'staging' is FROZEN

'staging' is FROZEN

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 3153 bytes --]

Hello Guixers,

The 'staging' branch is now considered "frozen" and only takes
bug-fixes for new regressions.  You can follow progress here:

https://ci.guix.gnu.org/jobset/staging-staging

Two months have passed since the previous 'staging' merge due to the
recent 'core-updates' effort.  Thus, this cycle somewhat larger than
usual.  Shortlog below.

Thanks to everyone who contributed!


Marius Bakke (33):
      gnu: libwebp: Remove obsolete phase.
      gnu: tzdata: Update to 2019c.
      gnu: libfaketime: Update to 0.9.8.
      gnu: imagemagick: Update to 6.9.10-68.
      gnu: nspr: Update to 4.22.
      gnu: nss, nss-certs: Update to 3.46.1.
      gnu: bluez: Update to 5.51.
      gnu: lz4: Update to 1.9.2.
      gnu: libogg: Update to 1.3.4.
      gnu: gdk-pixbuf: Update to 2.40.0.
      gnu: gtk+: Update to 3.24.12.
      gnu: libinput: Update to 1.14.1.
      gnu: libgit2: Update to 0.28.3.
      gnu: libical: Update to 3.0.6.
      gnu: OpenBLAS: Incorporate grafted changes.
      gnu: OpenBLAS: Update to 0.3.7.
      gnu: python-packaging: Update to 19.2.
      gnu: qpdf: Update to 9.0.1.
      gnu: cups-filters: Update to 1.25.7.
      gnu: CUPS: Update to 2.3.0.
      gnu: pulseaudio: Update to 13.0.
      gnu: orc: Update to 0.4.30.
      gnu: gstreamer: Update to 1.16.1.
      gnu: Remove GDB@8.2.
      gnu: mesa: Update to 19.2.1.
      gnu: libXfont: Update to 2.0.4.
      gnu: libXvMC: Update to 1.0.12.
      gnu: python-sphinx: Update to 2.2.0.
      gnu: OpenSSL@1.0: Incorporate grafted changes.
      gnu: cups-filters: Update to 1.25.11.
      gnu: mesa: Fix test failure on 32-bit systems.
      gnu: sdl2: Fix build on 32-bit architectures.
      gnu: orc: Fix broken header file.

Björn Höfling (8):
      gnu: ant-build-system: Don't override symlinks.
      gnu: java-javaee-servletapi: Don't use unstable tarball.
      gnu: java-javaee-servletapi: Add properties-files to jar.
      gnu: Remove dependencies on java-tomcat, use servlet API instead.
      gnu: java-commons-daemon: Update to 1.1.0.
      gnu: Add java-ecj in version 4.6.3.
      gnu: java-tomcat: Build the full Tomcat package.
      gnu: java-tomcat: Update to 8.5.46.

Rutger Helling (7):
      gnu: vulkan-headers: Update to 1.1.119.
      gnu: mesa: Remove unnecessary inputs.
      gnu: libinput: Update to 1.14.0.
      gnu: libvdpau: Update to 1.3.
      gnu: wayland-protocols: Update to 1.18.
      gnu: mesa: Update to 19.1.5.
      gnu: vulkan-headers: Update to 1.1.121.

Efraim Flashner (6):
      build/cargo-build-system: Move generate-all-checksums to cargo-utils.
      gnu: gnuzilla: Use 'generate-all-checksums'.
      gnu: rust: Use 'generate-all-checksums'.
      gnu: rust: Fix building.
      gnu: qt: Update to 5.12.4.
      gnu: qt: Update to 5.12.5.

Diego Nicola Barbato (1):
      gnu: pulseaudio: Add optional X11 inputs.

Ingo Ruhnke (1):
      gnu: gtk+: Add libxrandr input.

Julien Lepiller (1):
      gnu: mariadb: Split into out, lib and dev.

Vagrant Cascadian (1):
      gnu: electron-cash: Update to 4.0.10.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: 'staging' is FROZEN

[Bengt Richter]

On +2019-10-15 19:03:41 +0200, Marius Bakke wrote:
> Hello Guixers,
> 
> The 'staging' branch is now considered "frozen" and only takes
> bug-fixes for new regressions.  You can follow progress here:
> 
> https://ci.guix.gnu.org/jobset/staging-staging
>

No I can't, unfortunately -- not without setting DNSSEC=off :-(

(I did that as a temporary measure, just to see, and I do get through
that way, but I don't want to turn DNSSEC off).

(Thank you Marius, BTW, who pointed me to
https://github.com/systemd/systemd/issues/9867
where I got the DNSSEC=off clue).

https://gnu.org works fine with DNSSEC=on (with the exception of page
links from there to guix.gnu.org or savannah.gnu.org (that I know of)).

Why does gnu.org work and guix.gnu.org not??

That gnu.org works makes me think the problem is at guix.gnu.org,
not in a configuration problem on my machine.

I wonder if key infrastructure potholes like this are not putting off
more potential contributors than other recently discussed put-offs :)

> Two months have passed since the previous 'staging' merge due to the
> recent 'core-updates' effort.  Thus, this cycle somewhat larger than
> usual.  Shortlog below.
> 
> Thanks to everyone who contributed!
> 
[...]
--
Regards,
Bengt Richter

*.gnu.org fails to resolve with systemd-resolvd (was: Re: 'staging' is FROZEN)

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1965 bytes --]

Hello Bengt,

Bengt Richter <bokr@bokr.com> writes:

> On +2019-10-15 19:03:41 +0200, Marius Bakke wrote:
>> Hello Guixers,
>> 
>> The 'staging' branch is now considered "frozen" and only takes
>> bug-fixes for new regressions.  You can follow progress here:
>> 
>> https://ci.guix.gnu.org/jobset/staging-staging
>>
>
> No I can't, unfortunately -- not without setting DNSSEC=off :-(
>
> (I did that as a temporary measure, just to see, and I do get through
> that way, but I don't want to turn DNSSEC off).
>
> (Thank you Marius, BTW, who pointed me to
> https://github.com/systemd/systemd/issues/9867
> where I got the DNSSEC=off clue).
>
> https://gnu.org works fine with DNSSEC=on (with the exception of page
> links from there to guix.gnu.org or savannah.gnu.org (that I know of)).
>
> Why does gnu.org work and guix.gnu.org not??
>
> That gnu.org works makes me think the problem is at guix.gnu.org,
> not in a configuration problem on my machine.
>
> I wonder if key infrastructure potholes like this are not putting off
> more potential contributors than other recently discussed put-offs :)

You do not have to disable DNSSEC.  You just have to use a resolver that
properly handles signed-but-not-authenticated DNS records such as those
on *.gnu.org.  I.e. by replacing systemd-resolvd with a "proper"
recursor like dnsmasq or Unbound, or by using an external DNS server
such as the one provided by your ISP.

The GNU/FSF sysadmins are aware of the issue and will fix the gnu.org
domains eventually, but the problem really is with systemd-resolvd.  It
is not supposed to return SERVFAIL at all, but rather omit the
"authenticated" flag in the response.

The last comment on the GitHub issue says archlinux.org itself was
affected.  I wonder if they had just enabled DNSSEC, or if they rotated
signing keys.  Both scenarious could trigger this problem.

Unfortunately there is nothing we can do about it :-/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]