Merge ~sergiodj/ubuntu/+source/ubuntu-fan:fix-https-proxy-focal into ubuntu/+source/ubuntu-fan:ubuntu/focal-devel

[Sergio Durigan Junior]

This MP fixes ubuntu-fan's "docker" dep8 test and makes it properly set the $https_proxy environment variable when running on autopkgtest.u.c.

This is the MP for Focal.

This problem came to our attention when the docker.io upload got blocked on Focal due to ubuntu-fan's failure to "docker pull" the Ubuntu image while running the aforementioned test. The problem is only reproducible when we run the test in the infrastructure, so it took a long time to debug. The interesting part is that this code has been like this forever, and although we can see some random failures in the past, for the most part it worked fine. I believe there was a recent change on docker.io that uncover this issue once and for all, and now we should fix it.

You can find a PPA with the proposed changes here:

https://launchpad.net/~sergiodj/+archive/ubuntu/ubuntu-fan-proxy-fix

You can take a look at the autopkgtest results attached to the PPA (ran against -proposed in order to use the docker.io that's blocked):

https://autopkgtest.ubuntu.com/results/autopkgtest-focal-sergiodj-ubuntu-fan-proxy-fix/?format=plain

[Lucas Kanashiro (lucaskanashiro)]

Thanks for working on this Sergio! Since all tests are passing the behavior seems OK in the autopkgtest infrastructure.

The only thing I think we might want to change here is the version string. Instead of using 0.12.14~20.04.1 I'd propose version 0.12.13ubuntu0.1. I understand you tried to avoid 'ubuntu' in the version string because this is a Ubuntu only package, but according to this security team wiki page [1], a native package should be appended by 'ubuntu0.1' in case we do not have the same version in more than one release (which is the case here). Usually, when I see "~xx.yy.z", where xx.yy is the Ubuntu release, this is a backport of a package in a newer series. WDYT?

[1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation

review: Needs Information

[Sergio Durigan Junior (sergiodj)]

On Monday, April 11 2022, Lucas Kanashiro wrote:

> Thanks for working on this Sergio! Since all tests are passing the behavior seems OK in the autopkgtest infrastructure.

Thanks for the review, Lucas.

> The only thing I think we might want to change here is the version
> string. Instead of using 0.12.14~20.04.1 I'd propose version
> 0.12.13ubuntu0.1. I understand you tried to avoid 'ubuntu' in the
> version string because this is a Ubuntu only package, but according to
> this security team wiki page [1], a native package should be appended
> by 'ubuntu0.1' in case we do not have the same version in more than
> one release (which is the case here). Usually, when I see "~xx.yy.z",
> where xx.yy is the Ubuntu release, this is a backport of a package in
> a newer series. WDYT?
>
> [1] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation

I was also unsure about the version to be used here. I looked at
ubuntu-fan's publishing history on LP and thought it made sense to use
"~xx.yy.z" as the suffix, but I also understand where you're coming from
when you suggest "ubuntu0.1".

I don't have a strong opinion regarding this, so I've gladly changed the
version to be 0.12.13ubuntu0.1 instead.

Thanks,

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Lucas Kanashiro (lucaskanashiro)]

Thanks Sergio, LGTM.

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Monday, April 11 2022, Lucas Kanashiro wrote:

> Thanks Sergio, LGTM.

Thanks, Lucas.

Uploaded:

$ dput ubuntu-fan_0.12.13ubuntu0.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/ubuntu-fan/ubuntu-fan_0.12.13ubuntu0.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/ubuntu-fan/ubuntu-fan_0.12.13ubuntu0.1.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ubuntu-fan_0.12.13ubuntu0.1.dsc: done.
  Uploading ubuntu-fan_0.12.13ubuntu0.1.tar.xz: done.
  Uploading ubuntu-fan_0.12.13ubuntu0.1_source.buildinfo: done.
  Uploading ubuntu-fan_0.12.13ubuntu0.1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Andy Whitcroft (apw)]

Yeah, crashed into that elsewhere.

+1

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 8d2628c..fa5a9f8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ubuntu-fan (0.12.13ubuntu0.1) focal; urgency=medium
+
+  * d/t/docker: Don't use "https://" for $https_proxy.  Set
+    HTTPS_PROXY for docker.service as well. (LP: #1968387)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 08 Apr 2022 21:11:32 -0400
+
 ubuntu-fan (0.12.13) eoan; urgency=medium
 
   * d/t/control: Fix missing dependencies for autopkgtests (LP: #1832238)
diff --git a/debian/tests/docker b/debian/tests/docker
index 9fa160b..94c7227 100644
--- a/debian/tests/docker
+++ b/debian/tests/docker
@@ -11,15 +11,15 @@ https_proxy=""
 if echo "" | nc -w 2 squid.internal 3128 >/dev/null 2>&1; then
 	INFO="Running in the Canonical CI environment"
 	http_proxy="http://squid.internal:3128"
-	https_proxy="https://squid.internal:3128"
+	https_proxy="http://squid.internal:3128"
 elif echo "" | nc -w 2 10.245.64.1 3128 >/dev/null 2>&1; then
 	INFO="Running in the Canonical enablement environment"
 	http_proxy="http://10.245.64.1:3128"
-	https_proxy="https://10.245.64.1:3128"
+	https_proxy="http://10.245.64.1:3128"
 elif echo "" | nc -w 2 91.189.89.216 3128 >/dev/null 2>&1; then
 	INFO="Running in the Canonical enablement environment"
 	http_proxy="http://91.189.89.216:3128"
-	https_proxy="https://91.189.89.216:3128"
+	https_proxy="http://91.189.89.216:3128"
 fi
 export http_proxy
 export https_proxy
@@ -36,8 +36,12 @@ if [ -n "$http_proxy" ]; then
 	if [ ! -d /etc/systemd/system/docker.service.d ]; then
 		mkdir /etc/systemd/system/docker.service.d
 	fi
-	echo -ne "[Service]\nEnvironment=\"HTTP_PROXY=$http_proxy\"\n" \
-		>/etc/systemd/system/docker.service.d/http-proxy.conf
+	cat > /etc/systemd/system/docker.service.d/http-proxy.conf << _EOF_
+[Service]
+Environment="HTTP_PROXY=$http_proxy"
+Environment="HTTPS_PROXY=$https_proxy"
+_EOF_
+
 	systemctl daemon-reload
 	systemctl restart docker.service
 fi