Yes, we can and need to. The host(s) running this are currently Fedora 28 hosts.

However, they are behind proxies that do all the tls part of things, so I am not sure there would be any change in that part of it.

I'll note that I proposed the bug as a blocker for beta (not sure if it will get accepted).

I'll note that I proposed the bug as a blocker for beta (not sure if it will get accepted).

Afaik container images are not release blocking deliverables, at least last time I checked they were not.

Also as a work around you can get the base image from the DockerHub or Quay.io :smile:

@cverna do you think this would be good task to onboard me in to the infra work?(I'm bit afraid what I'm signing up for here :smile:)

@jcajka haha up to you, first thing we should do is to look at updating https://src.fedoraproject.org/rpms/docker-distribution to latest upstream and build it in f30.

Then we can try to rebuild the box as @kevin mentioned the TLS part is done on the proxy and tbh this kind of out of my league but if you want to have a look at how this is done you should be able to find breadcrumbs in our ansible repo.

https://infrastructure.fedoraproject.org/cgit/ansible.git

So it looks like the TLS issue is coming from upstream Go (https://github.com/golang/go/issues/34040).

We still need to rebuild the server on F30 so keeping the ticket open.

since we have #8173 do we want to keep this issue open?

since we have #8173 do we want to keep this issue open?

Yes they are 2 different issues, this one about updating our registry boxes ( running on F28) which I think is lower priority than #8173 which is about updating our proxies with the new version of openssl.

ok. I reinstalled the oci-cadidate-registry01.stg box.

I am not 100% sure it's working as we need, if you all could check it that would be great.

I have tested registry.stg.fp.o and all seems to work well. I was able to pull a container image, access the web interface and call the v2 rest api.

I did not try to push an image but if all the rest works I don't see a reason for the push to fail.

I think we are good to update production.

To test it

podman run -it --rm registry.stg.fedoraproject.org/fedora
curl https://registry.stg.fedoraproject.org/v2/_catalog

I didn't change registery.stg... I changed candidate-registery.stg. :)

Can you test that, or would you prefer I update registry.stg?

Just tried to pull and push an image on candidate-registry.stg.fp.o and it did not work. So I ll investigate that further tomorrow.

@kevin I have tried again and all seems to work fine. I have tested the following

push an image

podman push candidate-registry.stg.fedoraproject.org/fedora:31

pull and run the same image

podman podman run -it --rm candidate-registry.stg.fedoraproject.org/fedora:31

I think we are good to deploy the registry.stg.fp.o and then prod.

ok. I just went ahead and did all the rest, since I wanted this to be done before freeze.

Can you please test and confirm all is looking ok? I tried to test as I went and it seemed fine, but I might have missed some case...

If all looks good, we can close this. \o/

ok. I just went ahead and did all the rest, since I wanted this to be done before freeze.
Can you please test and confirm all is looking ok? I tried to test as I went and it seemed fine, but I might have missed some case...
If all looks good, we can close this. \o/

I just did a successful container build and it was correctly pushed to the registry. Closing Thanks Kevin.