We released another 2.1 version. More important then the actual changes is
actually the new place. We moved the 2.1 stream now to the
"openSUSE:Tools:2.1" project to free "openSUSE:Tools" for the upcomming 2.3
release.

Please find the packages and appliances here:

http://download.opensuse.org/repositories/openSUSE:/Tools:/2.1/

If you want to stay on 2.1 branch for some time, please modify your update
repository entry now.

The openSUSE:Tools project is now on hold until 2.3 gets released.

The changes are quite minimal:

Feature backports:

• none

Changes:

• backend: support projects with defined devel projects (from OBS 2.3)

Bugfixes:

• webui: Fix revert to revision button by using the revision to revert to.
• webui: fix link to new forum location of OBS forums.
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

Yet another really small OBS maintenance release. This release is basically
fixing one thing: linking to remote source links/branches of packages.

This was broken since a long time (but api.opensuse.org was not affected for
some reason).

Packages are as usual in openSUSE:Tools project, the appliances have been
updated.

Release Notes:

Feature backports:

• none

Changes:

• Removed openSUSE 11.2 from default list since it runs out-of-maintenance

Bugfixes:

• api: fix handling of source linking/branching packages on a remote server,
  which are a link/branch there as well.
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

We just released OBS 2.1.8. Maybe the last maintenance release before 2.3.

This release brings in first place fixes for the experimental apache/passenger
support. People who try to use this should update in any case.

As usual you can find packages below:

http://download.opensuse.org/repositories/openSUSE:/Tools/

and updated appliances here:

http://en.opensuse.org/openSUSE:Build_Service_Appliance

Full changelog from release notes:

Feature backports:

• Support for request notifications when a request has multiple actions

Changes:

• Remove Ubuntu 9.04 from default targets and added 11.04
  • api: strip passwords in log files (when running in debug mode)

Bugfixes:

• webui: support mod_xforward
  • api: fix handling of not permitted PUT/POST commands when use apache with mod_rails
  • api: fix crash when accessing attributes on remote projects
    --
    Adrian Schroeter
    SUSE Linux Products GmbH
    email: [email protected]

We have just published another maintenance release for OBS 2.1.

Beside the usual bugfixes, it supports some new features:

• Building against OBS 2.3 remote instances (like api.opensuse.org)
  is working now even when new features are used in the projects.

• It comes with a default configuration for apache2. While lighttpd
  remains to be the standard for 2.1, we will most likely switch to
  apache for OBS 2.3.
  People who reported random incorrect answers from OBS (like empty
  answers with OK/code 200) should be able to solve these problems
  with this setup.
  There will be also a follow up post about how to use the load
  optimizations via mod_xforward.

As usual you can find packages below:

http://download.opensuse.org/repositories/openSUSE:/Tools/

and updated appliances here:

http://en.opensuse.org/openSUSE:Build_Service_Appliance

openSUSE Build Service 2.1.7

Updaters from any OBS 2.1 release can just ugrade the packages and restart
all services. Updaters from former releases should read the
README.UPDATERS file.

Feature backports:

• bs_admin supports the dump of .solv files now
• EXPERIMENTAL: support apache2-mod_xforward optionally in api
• apache2 vhost config has been added

Changes:

• Support building against OBS 2.3 using new project features (lock, type and releasetarget)

Bugfixes:

• api: fix diffing of package meta files
• api: fix history access of deleted packages
• api: fix logging of comment and user on package delete
• backend: Fix argument handling in experimental LXC wrapper for source services
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

We just released another bugfix release for OBS 2.1. Update for all 2.1.x
users will work just by updating the packages and restart the services.
No further steps are needed.

Please note also that we updated the future OBS roadmap. We will skip 2.2
release to give it some more time to stabelize and release the features
together with 2.3 end of next month hopefully.

Feature backport:

• Support xz compression on srcdiff

Changes:

• backend: Throw valid error message when running a source service on a
  linked, but not branched package.
• backend: cleaned up BSConfig template.
• worker: Support new --vm-memory parameter of new build script.
• Outdated OBS book has been removed

Bugfixes:

• webui: Don't crash if package has no debuginfo
• webui: Don't crash without session data
• api: fix database of _product: packages, when a request accept of product
  rename or a new product addition happens.
• backend: fixed storage of incorrect linked data, which could happen when
  accessing to a package link via a project link under some
  circumstances.
• backend: useforbuild parameter was not checked when using Exportfilters in
  prjconf.
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

openSUSE Build Service 2.1.3 released

Updaters from any OBS 2.1 release can just upgrade the packages and restart
all services. Updaters from former releases should read the
README.UPDATERS file.

Due to a security issue we use "bsdtar" now to setup a build environment
in a secure way. Please note that builds inside of a chroot environment are
still insecure, you still need to use KVM or XEN.
Please update the "build" package also to get the bsdtar support.

It got released to the ususal places:

Appliance: http://en.opensuse.org/openSUSE:Build_Service_Appliance
Packages: http://download.opensuse.org/repositories/openSUSE:/Tools/
Git: http://www.gitorious.org/opensuse/build-service/commits/2.1

Please find the release notes below for more details:

Feature backport:

• none

Changes:

• webui: is not offering a download link of files > 4MB, if user is not logged
  in.
• api: api is not restoring a project object anymore if source server takes
  too long removing the project (better fix in 2.2 branch)
• backend: services get also executed on "commitfilelist" (used by osc 0.130)
• worker: requires bsdtar now for setting up build environment via build
  script

Bugfixes:

• webui: OOM error fixes diststats calculation script
• webui: tablesorter element fixes
• api: fix anonymous access, when osc is used on api server
• api: fix listing of history of meta data
• backend: dispatcher priorisation fix
• backend: fix source links to remote OBS instance with specified md5 revision
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

openSUSE Build Service 2.1.2 released

Users of OBS 2.1.0 and 2.1.1 should update if they rely on the source
read access protection. We fixed a security leak here.

This release is also fixing a regression of 2.1.1 for iChain users. New
users were not able to register.

Users who want to build for Ubuntu:10.10 need also the new build package
from today. Support for RHEL-6 and Fedora:14 has been added as well.

Updaters from any OBS 2.1 release can just upgrade the packages and restart
all services. Updaters from former releases should read the
README.UPDATERS file.

It got released to the ususal places:

Appliance: http://en.opensuse.org/openSUSE:Build_Service_Appliance
Packages: http://download.opensuse.org/repositories/openSUSE:/Tools/
Git: http://www.gitorious.org/opensuse/build-service/commits/2.1

Please find the release notes below for more details:

Feature backport:

• api: Support deletion of binaries in _repository (FATE #310489)

Changes:

• backend: Make OBS interconnect more reliable by retrying multiple times on
  not reachable remote instances
• api: XML schema of _link files is not enforcing the element order anymore
• api: submit requests do not modify link target definitions anymore.
• api: updated default build target list
• webui: Removed "Add as patch" functionality as it can not work with branched
  links.

Bugfixes:

• backend: Security bugfix which allowed access to "sourceaccess" protected sources
• backend: XPATH query fix
• api: layout fixes
• webui: fixing new user registration when using iChain (regression introduced in 2.1.1)
• webui: layout fixes
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

We just released OBS 2.1.1 maintenance und security fix release.

Users of OBS 2.1.0 should update ASAP due to a critical security issue. OBS 2.0
and before is not affected by this.

Apart from this we have also a number of bugfixes, find details below.

Special thanks go to Vivian Zhang from Intel and David Greaves for their contributions
to this release.

It got released to the ususal places:

Appliance: http://en.opensuse.org/openSUSE:Build_Service_Appliance
Packages: http://download.opensuse.org/repositories/openSUSE:/Tools/
Git: http://www.gitorious.org/opensuse/build-service/commits/2.1

Changes:

• Default build target list got updated
• Support for filtering user base when using LDAP database for authentification
• LDAP support enforces the usage of SSL for authentification now for security reasons

Bugfixes:

• api got fixes which allowed a cross side scripting attack to change a users password,
  if he is logged in and clicked on a crafted URL elsewhere. (Affected only OBS 2.1.0)
• api handles request state "revoked" also as final state now
• webui received multiple layout fixes and improvements esp. when handling sources.
• webui is CC'ng now all bugowners if multiple are defined (#513167)
• source service daemon has been fixed to support long running processes
• worker code download is honoring proxy settings now (#630994)
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

The openSUSE Build Service - OBS - is now officially at release 2.1. We're
delighted with the improvements in this release, including an enhanced web
interface, integration with online code management systems and better
access controls.

OBS 2.1 Introduces New Features

Enhanced web user interface

This iteration has enhanced the web user interface of openSUSE Build
Service with features that were previously only in the osc command line
client. It now allows submitting of packages to other projects, showing a
history of changes and who did them, with associated comments. This means
that the full work flow needed to build packages, contribute them to
projects and collaborate on them is available from the web interface.

Integration with online source code management tools

Users of the Build Service may now access a new concept called 'source
services'. Source services allow, for example, the automatic checkout of
source code for a package from a remote server via Git or Subversion,
building a tar ball from these checked out sources, and using them for
building a package. It also enables direct download of tar balls from
remote sites. This allows packagers to work with external sources without
downloading them to their own workstations, and makes it easy to rebuild
packages after upstream changes with a single click.

Better access controls

The access controls have been enhanced so that read/write access to a
project can be granted on an individual basis. This allows for tighter
control of work flows where needed. You can for example ensure people don't
have access to security updates while they are being tested.

Using OBS

To use the Open Source Build Service, you can access the public instance on
build.opensuse.org or install it on your own hardware to have a private
Build Service. For local installations you can install from source, or use
the ready-to-run appliance image, either directly or in a virtual machine.
You can also obtain an installation image to install an openSUSE 11.3
system with the Build Service pre-installed. For details check
http://en.opensuse.org/openSUSE:Build_Service_installations

For more information about the Build Service, check
http://en.opensuse.org/Portal:Build_Service.

Thanks

This release of the OBS has received many contributions from other
companies, community members and foundations, making this release a truly
collaborative product. We would like to thank everyone who helped make the
openSUSE Build Service 2.1 possible! Special thanks go to Martin Mohring
and the OBS team at The Linux Foundation, who contributed the extended
access handling.

About the Build Service

The Build Service is an open package and distribution development platform
providing a transparent infrastructure for developers to build packages for
a variety of Linux distributions and hardware architectures.
build.opensuse.org is a freely available service and can build packages for
the most popular distributions besides openSUSE including SUSE Linux
Enterprise, Debian, Fedora, Mandriva, Red Hat Enterprise Linux and Ubuntu.
The Build Service aims to significantly reduce the costs and risks related
to the distribution of applications, from building, providing and
maintaining them. It does so by providing a convenient web and command-line
interface, which developers can use to upload their code and build
instructions. The Build Service will then create a clean, virtualized
operating system, install any required build dependencies and create the
package. This process will be repeated for each supported operating system.
Once the build is finished, all packages will be made available in a set of
repositories for easy distribution.
The Build Service at build.opensuse.org currently builds about 100,000
packages from 25,000 users working on 15,000 different projects.
Communities and companies using their own Build Service installation
include the MeeGo Project, VLC team, Dell, Cray and many others.

For more information about the Build Service, check
http://en.opensuse.org/Portal:Build_Service.

Andreas Jaeger, Program Manager openSUSE, aj@{novell.com,opensuse.org}
Twitter: jaegerandi | Identica: jaegerandi
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nürnberg)
Maxfeldstr. 5, 90409 Nürnberg, Germany
GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126

The openSUSE Build Service team has released verison 2.0.8 and 2.1.6.

Both versions are fixing a critical security leak which can be missused to modify
projects or packages without having write permission there. We highly recommend to
update your instance therefore.
Thanks to Marcus Hüwe for reporting this issue.

Version 1.7 is not affected by this issue.

OBS 2.1.6 is fixing also security issues in LDAP mode and a possible crossite scripting
attack vector on the login screen (full XSS protection in all webui interfaces will be part
of OBS 2.3).
Thanks to Dean Pierce from Intel for discussing these issues and possible solutions with us.

Version 2.1.6 can be downloaded as usual from gitorious, openSUSE:Tools (or openSUSE:Tool:2.0
for version 2.0.8) project repositories or as appliance for testing and production systems:

http://en.opensuse.org/openSUSE:Build_Service_Appliance

OBS 2.1.6 contains also further changes, please read the release notes below:

openSUSE Build Service 2.1.6

Updaters from any OBS 2.1 release can just ugrade the packages and restart
all services. Updaters from former releases should read the
README.UPDATERS file.

Security fixes:

• api: fix security leak which allowed to modify packages or projects without write access (CVE-2011-0466)
• api: change password in LDAP mode was possible for foreign user (bnc #648982)
• webui: Fix possible XSS attack vectors in login page (bnc #669909, CVE-2011-0462)

Feature backports:

None

Changes:

• openSUSE 11.4 and Debian 6.0 got added as default target.
• adding reviewers or changing the review state is only allowed for requests which are in review state now.

Bugfixes:

• webui: Fix link to moved OBS web forums
• webui: Fix adding of repositories from remote projects in advanced repository interface
• api and webui: Do not use (and fail with) rails 3 environment
• api: allow admins to raise "sourceaccess" permissions on existing projects or packages
• api: do not allow to create packages with invalid chars via branch command
• api: do not fail on "mbranch" when a package gets found directly and indirectly via project link
• backend: Allow browsing of repositories of remote projects (fixes advanced webui view for adding repos)

--
Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]

The openSUSE Build Service team is proud to present a weekend gift,
the OBS 1.7.1 release.

You find it as usual in openSUSE:Tools project as rpms for openSUSE
and SLE. The OBS Appliances have been updated as well.

Just a package update and restart of services is needed, nothing else
for upgrade.

From the changelog:

• various usebility fixes in error cases
• Support "add kiwi image build" repo button in webui
• webui xml escaping fixes
• improvements and fixes in product handling area
• fixed handling of "change devel" requests
• support for requestid in commitfilelist
• fixes kvm check in worker init script
• fixed DoS error when having binary data in build description files
• fixes for possible scheduler crash
• Allow direct creation of home sub project, without home project
• Fix for detection # of CPUs on Arm kernels.

Resources:

http://download.opensuse.org/repositories/openSUSE:/Tools/

http://gitorious.org/opensuse/build-service

Thanks a lot to all who contributed!

Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]

We release another 2.0 bugfix release, triggered by bugfix requests
for the meego.com OBS instance.

Appliance users can just call

zypper ref

zypper up

and reboot their server or download a new appliance from

http://en.opensuse.org/Build_Service/OBS-Appliance

People who installed the packages manually can find updated packages
below as usual:

http://download.opensuse.org/repositories/openSUSE:/Tools/

These manual installations need a migration update afterwards to get
another bugfix:

cd /srv/www/obs/api/

RAILS_ENV="production" rake db:migrate

chown -R lighttpd.lighttpd log

The release notes are listing the following fixes since 2.0.5 version:

• api: branch by specified revision is working now
• api: submit request to a project without the package, but linked project works now
• api: fix runtime error when using group permissions in attribute permissions
• api: fix a crash in webui when using the status view due to missing attribute
• backend: fixed prefer-pkgs support for local build
• backend: dispatcher takes care of badhosts now and is not assigning the job again to the host

--
Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]

OBS 2.0.5 is on the way to

http://download.opensuse.org/repositories/openSUSE:Tools/

As usual also available as appliance:

http://en.opensuse.org/Build_Service/OBS-Appliance

This is a pure bug fix release this time. Please find details below.

Special thanks go to

• David Greaves for init script fixes and
• Iain Arnell for fixing redhat repo pattern generation

From the release notes file:

Updaters from 2.0.X can just update the packages and restart all services.
Updaters from former releases need to check the 2.0.0 Release Notes file.

Changes since 2.0.4:

Changes:

• api: do not allow operations on packages included via project link

Fixes:

• api: handle usage of default reviewers correctly
• backend: handle package add or removal via project link to remote OBS correctly
• backend: fixes in init scripts for workers using automatic storage setup
• backend: fix for RedHat pattern generation (comp.xml) generation
• backend: in existing, but configured keyfile is not fatal for publisher anymore
  --
  Adrian Schroeter
  SUSE Linux Products GmbH
  email: [email protected]

OBS 2.0.4 is on the way to

http://download.opensuse.org/repositories/openSUSE:Tools/

As usual also available as appliance:

http://en.opensuse.org/Build_Service/OBS-Appliance

Beside the usual bug fixes this release comes with some features (backported from master branch)
which were urgently needed and are luckily safe to backport. These features are

• Compatibility with Rails 2.3.8 (2.3.5 is still supported)

• Extend of gpg pub keys used for signing

Special thanks to David Greaves who fixed a problem with hanging LDAP connections.

More details from the Release Notes file:

Updaters from 2.0.X can just update the packages and restart all services.
Updaters from former releases need to check the 2.0.0 Release Notes file.

Changes since 2.0.3:

Changes:

• api/backend: support to extend experation date for pgp keys. Requires obs-signd 2.1.1.
• OBS is now compatible with Rails 2.3.5 and 2.3.8
• correct session key in api and webui, it can be stored in a config/secret.key file now
  (this is no security leak, because session data is stored in MySQL and therefore not reachable)
• Adding Mandriva 2010.1 to default targets

Fixes:

• api: correct handling of source files which contain special characters like hashes
• api: LDAP connections were not being closed properly (#623397)
• backend: filter broken SLP announcements to "localhost"

--
Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]

New packages and appliance of OBS 2.0.3 and OBS 1.7.5 are available.

As usual, you can find packages below

http://download.opensuse.org/repositories/openSUSE:Tools/
http://download.opensuse.org/repositories/openSUSE:Tools:1.7/

Both releases contains a fix for a lacking permission check. It was possible
to write request data, even in some conditions where you should not be allowed
to do so. This had no effect to sources or projects though.

OBS 2.0 gets also a number of further fixes and changes, please read below for
details.

OBS Appliance has been also updated, please check

http://wiki.opensuse.org/openSUSE:Build_Service_Appliance

From the 2.0.3 release notes:

Updaters from 2.0.X can just update the packages and restart all services.
Updaters from former releases need to check the 2.0.0 Release Notes file.

Changes since 2.0.2:

Changes:

• webui: Updated list of default distributions, matching api.opensuse.org updates
• api: OBS Appliance runs with enabled anonymous mode now by default
• backend: sparc64 and sparv9 are sharing one build number pool by default now.

Fixes:

• api: correct permission handling when storing a request
• api: fixed review handling of requests via groups
• api: fixed aggregate schema validation, support unlimited repositories
• api: fixed mbranch execution when having an Update project defined
• backend: fix server side build of driver disks via kiwi
• backend: handle request states correctly during review
  --

Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]

We released again a set of bug fixes for OBS, released as OBS 2.0.2

As usual, you can find the appliance via the wiki page:

http://wiki.opensuse.org/openSUSE:Build_Service_Appliance

Packages are available via the openSUSE:Tools project:

http://download.opensuse.org/repositories/openSUSE:/Tools/

Details from the release notes:

Updaters from 2.0.X can just update the packages and restart all services.
Updaters from former releases need to check the 2.0.0 Release Notes file.

Changes since 2.0.1:

Changes:

• Fix for kiwi 4.43 schema validation
• OBS appliance is using signing only when hardware number generator is available
  => solves time out errors during startup and product creation
• packages conflict with too new rails packages
• re-spawn failed download requests from remote OBS instance in inter connect

Bugfixes:

• various text message typo fixes
• backend: fixes for building against remote instance
• backend: source services get called with parameters in safe order
• api: reports version 2.0 now
• api: fix branching of packages in case of update project defintion exists
• webui: fix for javascript popups on request page (they hide again now)
• webui: missing icons fixed

--

Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]

Hello,

this is the OBS 2.0.1 release. Contains some of the usual
"why-don't-we-noticed-THAT-during-Beta ?" fixes. But also a nice admin/debug feature,
try

rcobssrcserver status

to see current running tasks.

As usual the packages are available via

http://download.opensuse.org/repositories/openSUSE:/Tools/

OBS-Appliances can be updated just by running the package update or you can download
new ones. Please check the wiki page for this:

http://wiki.opensuse.org/openSUSE:Build_Service_Appliance

From the release notes file:

Updaters from 2.0.0 can just update the packages and restart all
services. Updaters from former releases need to check the README.UPDATERS file.

Changes since 2.0.0:

Changes:

• workers which don't produce any log at all see themselfs as bad build hosts
• rcobssrcserver, rcobsrepserver and rcobsservice status command show running tasks

Bug fixes:

• A significant number of runtime error and layout fixes for the webui
• source server streams binary packages again
• service files get correct cleaned up now
• documentation fixes
• automatic worker pre-configuration in OBS Appliance got fixed

update now so you don't miss the game in 4 hours !

Adrian Schroeter
SUSE Linux Products GmbH
email: [email protected]