Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Start using CentOS 7 to build Wazuh manager packages and deprecate older versions #2154

Closed
1 task
TomasTurina opened this issue Apr 12, 2023 · 11 comments · Fixed by #2164
Closed
1 task

Start using CentOS 7 to build Wazuh manager packages and deprecate older versions #2154

TomasTurina opened this issue Apr 12, 2023 · 11 comments · Fixed by #2164
Assignees
@jnasselle @jotacarma90 @c-bordon @ncvicchi
Labels
level/subtask Task issue type/enhancement Enhancement issue

Comments

@TomasTurina
Copy link
Member

TomasTurina commented Apr 12, 2023 •
edited by jnasselle
Loading

Description

As part of wazuh/wazuh#16279, some dependencies need to be updated in order to fix some vulnerabilities from OpenSSL and CURL.

Updating these dependencies require also to update Python cryptography dependency as explained in wazuh/wazuh#16363. However, this version of cryptography does not support older versions than CentOS 7 anymore (wazuh/wazuh#16128 (comment)).

Since all the pipelines used to build RPM manager packages use an image of CentOS 6, it is necessary to update them and start using CentOS 7.

This is probably something that needs to be done also for DEB manager packages.

Validation

  • Launch Jenkins pipelines to validate that they work as expected.
@TomasTurina TomasTurina mentioned this issue Apr 12, 2023
Closed
@vikman90 vikman90 added the level/subtask Task issue label Apr 12, 2023
@teddytpc1 teddytpc1 assigned teddytpc1 and c-bordon and unassigned teddytpc1 Apr 13, 2023
@jnasselle
Copy link
Member

jnasselle commented Apr 13, 2023 •
edited
Loading

Scope

glibc versions

List based on current supported OS https://documentation.wazuh.com/current/installation-guide/packages-list.html for manager installation

OS and glibc version

CentOS

  • 6: 2.12
docker run  centos:6 ldd --version
ldd (GNU libc) 2.12
Copyright (C) 2010 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 7: 2.17
docker run  centos:7 ldd --version
ldd (GNU libc) 2.17
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 8: 2.28
docker run  centos:8 ldd --version
ldd (GNU libc) 2.28
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Debian

  • 7: 2.13
docker run debian:7 ldd --version
ldd (Debian EGLIBC 2.13-38+deb7u12) 2.13
Copyright (C) 2011 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 8: 2.19
docker run debian:8 ldd --version
ldd (Debian GLIBC 2.19-18+deb8u10) 2.19
Copyright (C) 2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 9: 2.24
docker run debian:9 ldd --version
ldd (Debian GLIBC 2.24-11+deb9u4) 2.24
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 10: 2.28
docker run debian:10 ldd --version
ldd (Debian GLIBC 2.28-10+deb10u2) 2.28
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 11: 2.31
docker run debian:11 ldd --version
ldd (Debian GLIBC 2.31-13+deb11u5) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Ubuntu

  • 12.04 LTS: 2.15
ldd (Ubuntu EGLIBC 2.15-0ubuntu10.18) 2.15
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 14.04 LTS: 2.19
docker run --rm ubuntu:trusty ldd --version
ldd (Ubuntu EGLIBC 2.19-0ubuntu6.15) 2.19
Copyright (C) 2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 16.04 LTS: 2.23
docker run --rm ubuntu:xenial ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu11.3) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 18.04 LTS: 2.27
docker run --rm ubuntu:bionic ldd --version
ldd (Ubuntu GLIBC 2.27-3ubuntu1.6) 2.27
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 20.04 LTS: 2.31
docker run --rm ubuntu:focal ldd --version
ldd (Ubuntu GLIBC 2.31-0ubuntu9.9) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper
  • 22.04 LTS: 2.35
docker run --rm ubuntu:jammy ldd --version
ldd (Ubuntu GLIBC 2.35-0ubuntu3.1) 2.35
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Oracle Linux

  • 6: 2.12
ldd (GNU libc) 2.12
Copyright (C) 2010 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 7: 2.17
ldd (GNU libc) 2.17
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 8 : 2.28
ldd (GNU libc) 2.28
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 9 : 2.34
ldd (GNU libc) 2.34
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Fedora

  • 22: 2.21
ldd (GNU libc) 2.21
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 23: 2.22
ldd (GNU libc) 2.22
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 24: 2.23
ldd (GNU libc) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 25: 2.25
ldd (GNU libc) 2.24
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 26: 2.25
ldd (GNU libc) 2.25
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 27: 2.26
ldd (GNU libc) 2.26
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 28: 2.27
ldd (GNU libc) 2.27
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 29: 2.28
ldd (GNU libc) 2.28
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 30: 2.29
ldd (GNU libc) 2.29
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 31: 2.30
ldd (GNU libc) 2.30
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 32: 2.31
ldd (GNU libc) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 33: 2.32
ldd (GNU libc) 2.32
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 34: 2.33
ldd (GNU libc) 2.33
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS F
  • 35: 2.34
ldd (GNU libc) 2.34
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 36: 2.35
ldd (GNU libc) 2.35
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 37: 2.36
ldd (GNU libc) 2.36
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Amazon Linux

  • 1: 2.17
ldd (GNU libc) 2.17
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 2: 2.26
ldd (GNU libc) 2.26
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
  • 2023: 2.34
ldd (GNU libc) 2.34
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

RHEL

OpenSUSE

  • 42.1: 2.19
docker run --rm opensuse/archive:42.1 ldd --version
ldd (GNU libc) 2.19
Copyright (C) 2014 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Wazuh core dependencies and compilation/runtime glibc dependency

Until nowadays, the compilation of the core third-party libraries was manually triggered by using the exact same containers/environments used for compiling the Wazuh packages, meaning that CentOS 6 and Debian 7 glibc version was used.

Those precompiled dependencies are shared between the agent and manager, so they are published without segmentation, only by OS (or OS family) and ARCH.

Wazuh embedded Python and compilation/installation/runtime glibc dependency

Until nowadays, Wazuh embedded Python was built in a Centos 6 environment and linked against some of the mentioned core third-party deps via libwazuhext.so (bundle)

Change impact

OS support deprecation

Due to Wazuh embedded Python compilation on CentOS 7, rising the required glib version from 2.12 to 2.17, the next OS may be affected, being deprecated (at least for Manager installation)

Packages generation misc

Despite the Wazuh embedded Python being already compiled on Centos 7, package generation consists (simplified) of installing Wazuh from sources and then packaging it.

During installation from the source, some Python scripts are executed, meaning that glibc 2.17 will be needed to package and install Wazuh

Affected packages are

  • RPM amd64 (CentOS 6 container as building/install/package env)
  • Debian amd64 (Debian 7 container as building/install/package env)
  • Linux WPK (CentOS 6 container as building/install/package env)

Alternatives

  • Deprecate Wazuh Agent and Wazuh Manager on affected OS
    • Pros: unify deprecation criteria and avoid misunderstandings. Left behind OS at EOL. Better understanding of environments used for compilation/packaging/installation.
    • Cons: Users that still have agents on those legacy/EOL could not use Wazuh anymore
  • Deprecate only Wazuh Manager on affected OS

@jnasselle jnasselle self-assigned this Apr 13, 2023
@c-bordon
Copy link
Member

Change impact

Pipelines that we have to update:

  • Test_install and Test_install_tier: Remove Centos 6 from MANAGER_SYSTEM_VERSION
  • Test_registration and Test_registration_tier: Remove Centos 6 from MANAGER_SYSTEM_VERSION
  • Test_service: Remove Centos 6 from the options or edit the code to use a Centos 7 manager
  • Test_upgrade: Remove Centos 6 from MANAGER_SYSTEM_VERSION
  • Check.groovy: remove this option:
    • amd64_service_centos_6: [ 'amd64_build_centos_manager', 'amd64_build_centos_agent' ],

@jnasselle
Copy link
Member

@c-bordon will also need to consider the other OS to be deprecated that currently are present on Jenkins

  • RHEL 6
  • Debian 7 "wheezy"
  • Ubuntu 12.04 "precise"
  • Oracle Linux 6

@jnasselle jnasselle mentioned this issue Apr 17, 2023
Merged
30 tasks
@jnasselle jnasselle linked a pull request Apr 17, 2023 that will close this issue
Deprecate CentOS 6 and Debian 7 on Wazuh Manager compilation #2164
Merged
30 tasks
@teddytpc1 teddytpc1 added type/refactor Enhancement type/enhancement Enhancement issue and removed type/refactor Enhancement labels Apr 20, 2023
@vikman90 vikman90 mentioned this issue May 29, 2023
Closed
4 tasks
This was referenced Jun 13, 2023
Closed
Closed
@vikman90
Copy link
Member

I don't think we can commit this issue in this sprint. It will have to enter the next one but surely we will only need a week.

@jotacarma90 jotacarma90 self-assigned this Aug 14, 2023
@jotacarma90
Copy link
Member

Issue related in jenkins:
https://github.com/wazuh/wazuh-jenkins/issues/5022

@jotacarma90 jotacarma90 reopened this Aug 17, 2023
@ncvicchi
Copy link
Member

ncvicchi commented Sep 4, 2023

ETA was changed to 8/9 for pending testing on newly created packages with other teams dependencies

@ncvicchi
Copy link
Member

ncvicchi commented Sep 7, 2023

Packages are being successfully generated now from master, but we are facing an issue when updating dependencies to a deps where the CPython package was updated.
After a successful compilation, package generation fails with:

Processing files: wazuh-manager-4.8.0-1.x86_64
error: File not found: /build_wazuh/rpmbuild/BUILDROOT/wazuh-manager-4.8.0-1.x86_64/var/ossec/var/db/mitre.db

I am still exploring the source of this error.

@ncvicchi
Copy link
Member

ncvicchi commented Sep 11, 2023 •
edited
Loading

ETA has been modified because of a cpython dependency issue that is being requested to be solved by framework team.

@ncvicchi ncvicchi mentioned this issue Sep 11, 2023
Closed
@ncvicchi
Copy link
Member

We keep running on issues. We are fixing the suffix for nonrelated packages and need to rebuild ARM packages. We expect to finish it before the end of the week

@jotacarma90
Copy link
Member

Blocked waiting for this PR to merge:
wazuh/wazuh#19421

ETA delayed.

@fdalmaup fdalmaup mentioned this issue Nov 1, 2023
Merged
@ncvicchi
Copy link
Member

ncvicchi commented Nov 3, 2023

Blocking condition was resolved but passed to on hold for an urgent issue we are working on. Will resume this issue as soon as possible

@vikman90 vikman90 closed this as completed Nov 9, 2023
@jotacarma90 jotacarma90 mentioned this issue Nov 9, 2023
Closed
@fdalmaup fdalmaup mentioned this issue Nov 21, 2023
Closed
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jnasselle jnasselle

@jotacarma90 jotacarma90

@c-bordon c-bordon

@ncvicchi ncvicchi

Labels
level/subtask Task issue type/enhancement Enhancement issue
Projects
No open projects
Release 4.8.0
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Deprecate CentOS 6 and Debian 7 on Wazuh Manager compilation wazuh/wazuh-packages
7 participants
@jnasselle @vikman90 @TomasTurina @teddytpc1 @jotacarma90 @c-bordon @ncvicchi