https://www.mediawiki.org/wiki/User:Hashar
I am based in France CET/CEST (UTC+1, UTC+2). I have been a volunteer since ~ 2002 and employed at the Wikimedia Foundation since 2011.
My team is Release-Engineering-Team in which I notably maintain Jenkins Zuul Gerrit Continuous-Integration-Infrastructure Continuous-Integration-Config and various other things such as running the weekly MediaWiki deployment.
The preferred ways to reach me are:
IRC Libera.Chat
File a task in Phabricator and subscribe me to it ( @hashar ).
Email, Slack etc are read on an inconsistent best effort basis
It took me a while to test locally with Gerrit 3.8 / 3.9 and my test case above + figuring out how the Google font API works, but eventually I have sent a patch Upstream https://gerrit-review.googlesource.com/c/gerrit/+/429477 Update Material Icons .
So, IIUC, upstream should update the font file so it works on installs that don’t useGoogleFonts? (Whereas Google’s own install uses Google fonts and therefore they didn’t notice that the bundled font is outdated.)
The lib/fonts/material-icons.woff2 has NOT changed with the upgrade and is still the same in master.
The element is a <gr-icon> which has for style:
: host { font-family : var ( -- icon - font - family , 'Material Symbols Outlined' ); } : host :: before { content : attr ( icon ); }
The beta cluster fails to update as a result of https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1039564 being merged. I haven't investigated further but I have filed T367144: Beta cluster fails to update database due to MigrateActorsAF maintenance script .
More info! While I was typing this complaint I eventually (like 3-5 minutes later) got a new notice for the same change (this is after previously clicking RELOAD and having nothing happen): "There are new messages on this change from jenkins-bot RELOAD/DISMISS". When I clicked RELOAD this time, the page DID reload.
I have proposed a patch Upstream : https://gerrit-review.googlesource.com/c/gerrit/+/429157 Fix code comment position with Firefox
I think that is fixed now that we have upgraded to Gerrit 3.9.5:
We have upgraded to Gerrit 3.9.5 and this is still happening.
I think that one is fixed now that we have upgraded to Gerrit 3.9.5 and RELOAD does reload the change view!
The upgrade:
We have upgraded to Gerrit 3.9.x series and the new conflict style should show up now.
We have upgraded to Gerrit 3.9 and that has fixed it.
At a quick glance at polygerrit-ui/app/embed/diff/ they have changed the diff view and moved from a table layout toward a grid one. Firefox must have some slightly different behavior.
Yes the CSS positioning is off somehow. The element has position: absolute but under Chrome that is relative to the top of the diff while on Firefox that is relative to the bottom of the diff element. I don't have any good candidate nor could I find a way to fix the CSS through the inspector. I am afraid I will have to bisect it.
With Firefox 115:
That is caused by f8ace7db909382e106a52bf4473d303f946670fa by @dancy it changes the way the directory is detected:
To reproduce from the deployment server:
cd /srv/deployment/integration/docroot scap deploy --no-log-message --verbose --limit doc1003.eqiad.wmnet
A copy paste of the warning lines excluding the ssh verbose lines:
15:01:28 ['/usr/bin/scap', 'deploy-local', '-v', '--repo', 'integration/docroot', '-g', 'default', 'fetch', '--refresh-config'] (ran as deploy-ci-docroot@doc1003.eqiad.wmnet) returned [70]: OpenSSH_7.9p1 Debian-10+deb10u4, OpenSSL 1.1.1n 15 Mar 2022 debug1: Sending command: /usr/bin/scap deploy-local -v --repo integration/docroot -g default fetch --refresh-config Registering scripts in directory '/srv/deployment/integration/docroot-cache/revs/eee90e66f005e683a407f22a30f3b624d3ca8aa2/scap/scripts' Fetch from: http://deploy1002.eqiad.wmnet/integration/docroot/.git Running ['git', 'rev-parse', '--is-inside-work-tree'] with {'cwd': '/srv/deployment/integration/docroot-cache/cache', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Running ['git', 'rev-parse', '--is-inside-work-tree'] with {'cwd': '/srv/deployment/integration/docroot-cache/cache', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Running ['git', 'rev-parse', '--is-inside-work-tree'] with {'cwd': '/srv/deployment/integration/docroot-cache/cache', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Running ['git', 'remote', 'set-url', 'origin', 'http://deploy1002.eqiad.wmnet/integration/docroot/.git'] with {'cwd': '/srv/deployment/integration/docroot-cache/cache', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Running ['git', 'fetch', '--tags', '--jobs', '1', '--no-recurse-submodules'] with {'cwd': '/srv/deployment/integration/docroot-cache/cache', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Running ['git', 'config', 'lfs.url', 'https://gerrit.wikimedia.org/r/integration/docroot.git/info/lfs'] with {'cwd': '/srv/deployment/integration/docroot-cache/cache', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Running ['git', 'rev-parse', '--is-inside-work-tree'] with {'cwd': '/srv/deployment/integration/docroot-cache/revs/eee90e66f005e683a407f22a30f3b624d3ca8aa2', 'stdout': -1, 'stderr': -1, 'text': True, 'stdin': -3} Unhandled error: deploy-local failed: <FileNotFoundError> {}
The Gerrit host got restarted this morning. I have scanned the list of ssh algorithms and md5 ones are not showing up as expected:
| mac_algorithms: (6) | hmac-sha2-256-etm@openssh.com | hmac-sha2-512-etm@openssh.com | hmac-sha1-etm@openssh.com | hmac-sha2-256 | hmac-sha2-512 | hmac-sha1
I have REscheduled the upgrade for Monday June 10th at 8:00am UTC and I have announced it on wikitech-l .
This request should be completed now.
I have deployed Bryan plugin and a currently open change of operations/mediawiki-config such as Gerrit 1035473 :
We would need Gerrit to be restarted in order for the sshd.mac setting change to be taken in account. Next time Gerrit is restarted, I will run nmap --script ssh2-enum-algos -sV -p 29418 gerrit.wikimedia.org to confirm the obsolete algorithms are not present.
That archival request has been completed as far as I can tell.
From nmap --script ssh2-enum-algos -sV -p 29418 gerrit.wikimedia.org I get:
And after deploying the config change we should have the same list of supported MAC algorithms.
I have verified the update of the releases Jenkins using scap3-dev and then went ahead and did a deployment using the deploy.sh script from the deployment repository.
We have done the switch with @MoritzMuehlenhoff this morning. Both Gerrit instances are now running with Java 17 and the Gerrit plugins have been recompiled to use Java 17 as well.
The MAC algorithms to use come from Mina SSHD. Gerrit 3.8.6 ships with Mina 2.12.0. The source code has both algorithms marked as deprecated and refers to https://issues.apache.org/jira/browse/SSHD-1004
That can be added as a simple link below the commit message and the checks summary. That is how we displayed CI results before moving them to the Checks tab / API.
Archival requests are handled via Projects-Cleanup :)
I am reopening this task which was filed assuming the crawler is not indexing all the Gitlab repositories which is what ticket 1274 tracks now :)
I have added -nolisten unix to the instruction at https://www.mediawiki.org/w/index.php?title=Selenium/How-to/Record_videos_of_test_runs&diff=prev&oldid=6556836
It turns out that starting with Gerrit 3.9, upstream is providing a war file that requires Java 17. I found that out the hardware when attempting to upgrade from 3.8 to 3.9 earlier today ( T354887#9853725 ). According to https://groups.google.com/g/repo-discuss/c/pSGsHbi2TEw/m/JHj_QZcJAQAJ , support for Java 17 started with Gerrit 3.6, and 3.8.1 should fully support Java 17.
Oups that is because I have used a filter url.path=/r/ :)
The ability to browse Gerrit project from Phabricator ( at https://phabricator.wikimedia.org/r/ ) has been removed via T228507 . I don't think we should maintain a redirect for that given the feature was barely advertised and looking at Apache logs there were only 58 hits for the last 90 days.
I have merged the change to upgrade to 3.9 , stopped Gerrit on the replica gerrit2002 and upon running the initialization ( java -jar gerrit.war init ):
Error: LinkageError occurred while loading main class Main java.lang.UnsupportedClassVersionError: Main has been compiled by a more recent version of the Java Runtime (class file version 61.0), this version of the Java Runtime only recognizes class file versions up to 55.0
The thread https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/RCKRQ2GKRVLGVLFJMOCURY3BYM4GOWYA/ had two replies sent to both mailing lists and directly to me. Despite having the Receive list copies setting enabled in mailman, I only received the emails that were sent directly to me (the mail headers do not show any traces of Mailman in the routing.
The original task description had the console log from the trigger-* Jenkins job which triggers another job https://integration.wikimedia.org/ci/job/typescript-service-pipeline-test/
The RUN PUPPET COMPILER has been praised by several people since Friday which is a great win.
I have scheduled the upgrade for Monday June 3rd at 8:00am UTC and I have announced it on wikitech-l .
zuul-merger is now running on contint2002.wikimedia.org
In T334517#9840346 , @Dzahn wrote: @hashar I see jobs at https://integration.wikimedia.org/ci/computer/contint2002/ Doesn't this mean the " attached as a Jenkins agent to the Jenkins controller" is done?
@hashar I see jobs at https://integration.wikimedia.org/ci/computer/contint2002/
Doesn't this mean the " attached as a Jenkins agent to the Jenkins controller" is done?
I have upgraded both hosts.
I have took the opportunity to slightly update the Gerrit upgrade documentation https://wikitech.wikimedia.org/wiki/Gerrit/Upgrade
Turns out Upstream had a very old issue mentioning this: https://issues.jenkins.io/browse/JENKINS-18884 . That is addressed by 2.452.1 which removes the view (we will upgrade as per T366008 ).
Should have been solved by granting LDAP ops group the permission to create annotated or signed tags: https://gerrit.wikimedia.org/r/c/operations/software/+/1036212
There is nothing specific to Gerrit itself, I am untagging it.
I have disabled GitHub notifications for Actions , Dependabot alerts and Email weekly digest .
See 6c3c6fc864ab1b2fed3bafe7aa983009e6544367 which I did when upgrading from Jessie ( T203178 ). It introduces a firefox shell script wrapper in /usr/local/bin/firefox and set HOME there. That has the advantage of not setting HOME which does have side effects.
I went to do the same thing for the Puppet compiler. It is not run by default so I went to create a Runnable check which can be triggered from the checks tab:
I think that is essentially the same as T78319 which asks for a way to filter out some hosts from the dsh groups.
I filed this subtask to express an idea filed in the parent T78319 . That was ten years ago and lot of things have changed nowadays, notably we have a Puppetdb to collect hosts states, Etcd etc.
When looking at deploy1002 /etc/ssh/ssh_known_hosts was last modified at 5:56
I have deployed the fix this morning and confirmed the fix while doing the deployment. Thank you @matmarex !
Congratulations on having reimaged contint2002! It is missing steps though: