CERN Linux 7.3.x updates

Updates are normally triggered by announcements from Progeny or Fedora Legacy. Subscribe to two lists:

• https://www.redhat.com/mailman/listinfo/fedora-legacy-announce
• ask security@progenyNOSPAMPLEASE.com to be put on the announcement list

So, the actual update goes like this:

• run /afs/cern.ch/project/linux/adm/rsync_progeny_7.3
• (and/or) download the 'legacy' RPMs
• edit /afs/cern.ch/project/sue/src/linux-support/feature/security/update.pl(i386_redhat73) (need AFS permissions)
• init.pl(i386_redhat73) must be a hard link (!) to update.pl(i386_redhat73).
• copy the updated RPMs into /afs/cern.ch/project/linux/cern/7.3.X/updates/RPMS
• run /afs/cern.ch/project/sue/src/adm/src2test -m security i386_redhat73
• on a machine where you have /usr/sue/dist pointing to /afs/cern.ch/project/sue/test/i386_redhat73/dist, run /usr/sue/etc/sue.update -v and /usr/sue/etc/sue.init -v. Observe output.
• run ..../test2new i386_redhat73 and let people test the new release (this will announce a new 'new' release on certain mailing lists)
• run ..../new2pro i386_redhat73 and then edit the changes file. Run new2pro i386_redhat73 AGAIN.
• ls -l /afs/cern.ch/project/sue/{new,test,pro}/i386_redhat73/dist/feature/security/update.pl, compare dates. Massage until consistent.
• run cd /afs/cern.ch/project/sue/adm ; ./make-rpm , copy the resulting rpm to /afs/cern.ch/project/sue/rpms/i386_redhat73/, update the symlink there.
• copy the same RPM into /afs/cern.ch/project/linux/cern/7.3.X/updates/RPMS
• update APT/yum repos by running (on refslc3-* systems for example):
  /afs/cern.ch/project/linux/dev/build/rpmbuild/7.3.X/bin/genrepos updates
  /afs/cern.ch/project/linux/dev/build/rpmbuild/7.3.X/bin/syncrepos
  
• check that emails get send properly to linux.announce@cernNOSPAMPLEASE.ch. You MUST have your PEM (physical email address) pointing to a username@mailNOSPAMPLEASE.cern.ch for this! (Please note that mail service is not on linux, not even 7.3:)
• Update the WIKI (or, as for now, update /afs/cern.ch/project/linux/{index.shtml,updates/updates-73X.shtml}.

The sue.update thing is run from cron on running machines, while sue.init is run only at boot time. The latter updates glibc and friends while the former does not.

Kernel/AFS updates are handled manually.

1. Get the latest Progeny/Fedora kernel, forward port CERN patches, rebuild all RPMS. rpmbuild -ba kernel-2.4.spec and rpmbuild -bb --target i686 kernel-2.4.spec (so as to build SMP kernels as well!) and finally rpmbuild -bb --target athlon kernel-2.4.spec
2. Rebuild OpenAFS against the new kernel. Have the one-but-latest sources also installed - this permits the RPM to build against BOTH, so that people can reboot with their old kernel and still have AFS modules in case of problems. (This is done automatically by the .spec file in the openafs package.)
3. UPDATE: always have the 2.4.20-30.7 sources installed as well in order to include AFS modules against that kernel. It is needed for the reinstallation of tape servers (no, don't ask...)
4. Rebuild the alsa-driver source package to produce ALSA kernel modules - there shouldn't be too many 7.3 desktops around anymore, but there might be operator consoles which need the sound card to work. Don't forget to specify rpmbuild -bb --define 'kernel yourversion' alsa-driver.spec, since multiple kernel sources should be installed at this point.
5. It's safe to put the results in the 'updates' directory since kernels are not upgraded automatically.
6. Send to Linux Expertise and FIO for testing (it-dep-adc-le@cernNOSPAMPLEASE.ch, project-elfms@cernNOSPAMPLEASE.ch) XXX. Then announce the production release a few days later by:
7. an email to linux-announce@cernNOSPAMPLEASE.ch and by sending the same post to the cern.linux newsgroup. ExampleRH73Announcement is what the name suggests.
8. Update the WIKI. Update the 'version-check' SUE feature to nag about the one-but-latest kernel.
9. Keep fingers crossed...

-- AndrasHorvath - 15 Jun 2005