Test Machine Resources For Package Maintainers

Overview
In some cases Fedora Package maintainers may not have access to all supported architectures or releases of Fedora that they maintain packages for. In order to assist with this, some community members are providing access to test machines/instances that they maintain to allow Fedora package maintainers to test, build, compile or debug their packages.

FAQ
Q: What precautions should I take on these machines.

A: Since all Fedora packagers have root access on these machines, do not enter any sensitive information, including FAS credentials on these machines. These systems should never ask you for your FAS password (sudo is NOPASSWD). Authentication is only done via the SSH key you have set in FAS. In particular, it is recommended to disable SSH agent forwarding on these machines on the client side (agent forwarding is disabled on the server, but any user on the system could potentially reenable it). To do this, add the following to your ~/.ssh/config: Host *.scrye.com ForwardAgent no

Q: Who has access to these instances?

A: Anyone who is in the Fedora "packager" group. Use your ssh key from the fedora account system to login. Package maintainers have 'sudo' access.

Q: What kinds of things can I do on these machines?

A: Any of the following:


 * mock build packages
 * install and test packages
 * build packages locally to try and fix problems or compile errors
 * Check locations of files, layout or versions to help solve a Fedora bug.
 * Basically anything that is directly related to Fedora Maintainer tasks.

Q: What should I not do?

A: Any of the following:


 * Things that are not related to your job as maintainer of Fedora packages.
 * Probing or accessing any other system.
 * publishing data or content to the internet.

Q: Can I upgrade/downgrade $basepackage, or reboot the instances?

A: If you need to do this, please contact the maintainer of the instance and arrange it.

Q: Can I leave any data on these instances?

A: No. They could be re-installed at most any time, or rebooted, or suffer a data loss. Please scp or rsync your work off often, and when done, please revert any package installs/downgrades/upgrades.

Q: Aren't you worried that someone will misuse these instances?

A: No. We trust the packagers to maintain and build our packages in Fedora, why would we not trust them to use test instances correctly? Additionally, the instances are all isolated from any local machines, ssh agent forwarding is disabled, and they only allow incoming ssh and a handfull of outgoing traffic.

Q: Can I use one of these instances to maintain my packages from?

A: No. ssh agent forwarding is disabled for security reasons, so you will not be able to do cvs checkins from these instances. Additionally, they could be re-installed or files could be wiped at any time. You should not use these as a place to maintain your packages from.

Q: I would like to contibute a host/instance/machine to allow people to test things, how can I do that?

A: I would be happy to help you in setting up a machine as the above test instances are. Contact me (kevin@scrye.com) for more info on how to set up the hosts.

Q: I would like to donate some secondary arch hardware/machine resources to this effort. How can I do that?

A: See the previous question if you just want to bring up your own test machines at your site. If you would like me to host/manage your machines, please contact me (kevin@scrye.com) and we can see if we can work something out. In particular I would love a ppc64 host to allow maintainers to use.

Q: What should the ssh host keys be for these instances?

A1: The ssh host keys are in DNS (dnssec enabled). Just set the openssh VerifyHostKeyDNS=yes. A2: Here's a list of ssh host keys for the machines:

thulsadoom.scrye.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwcyeuOv+hwYjMLobYmysZJl0XBwPsx3OuExgoSZqof4zKm+Gws/IxWDnwfov/bQ9PKlcsaGTlCeXS7ZfaUA4tYH5GksJP8tczGg35iFjn115ep0/1FF4rsUsc0mNMHVlgF2yibn//5P48in2VgJh7+kjKo6/yBxwFZVEI0Vwncy621dL0VZI52fdbiTacik7BoUWFupDUc7mEXYXL+KLD4WkiQd880VmimgbKzw+M+L19vPKwebMuD8Qat5DAaH+Wji+XR7nRZqvGOa1IOzbb7CPveJk7WEd/07KfU/p3X0Ek1d3Omqex5/Cew2NVFHETF3HEu6LomaNkKjdaqF+Nw== epel5-test.scrye.com,[75.148.32.189]:3005,draco.scrye.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApaGSaZ52+S5ARafXKtYqoNzDklQ2tVaX+73SAyVZNIkV+Eij7oaqiQeBzQjrzmPQBUS1RR4To3puFNjVB0ZKzFwR//hExO+9rP3bqoOHEf/AS6uh/S6sxnClzut6MYDf0QfqlY402puZeQJN/zueCPWKmws08WcfxjLTNDEqiZIMwpRv6V5p20iI7coXiz/R2gN8yD8htNvbFAaqehcYJI6vpUCZR/4LRWVLn/c+rqLVJc3lXuAKuRgkeLbSTyLmX9UZWUX1bIiiqPo0GD7YX4QRAm4l4CSshk2QJc1V9o0j0NpYX+7Yt45lfhlDblTNyT1CSpKI4lXnmF+0knJ2DQ== epel6-test.scrye.com,[75.148.32.189]:3006,gandohar.scrye.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyJV+yuO1cvo7y56lMSY0LKaww0le7/5/jaOfqj9R52ovNTikdqVx/ZmS5GUQvwnn8/8xrZJF1wB+DydYXX8u+Lhz1k68nclHA0oVzf87Q5Vh9VgUyvsp2YPuyY1KGEgc4Bf37FL6eORfVs4K4U5pk5Qj7xs4Ea7RbcpRmWWUG5G/QYbZi/oO2e6vdFh0eiFS+mXidck5GJqxMO+AZ1oQa+H9Pb56+fHmvcc3WgDfIKqTBOPdpFcp8F0IUAJbfvLfKM78UdP2lcv1+QMkPtJtaV5h4Jh4Kb0zu2lokeqLKLqCZ32I9u21BkPCeTlq4RXoWRULSJBO5K6hbl6za2UTcQ== Oxf13.scrye.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5nGwA7uWy49vlHPJrdUWGdtltHJNleURi0RueN3GNzxBuF7yjSHYO/4SfmAwXkq8seeE+0i3h3tfABkA8aidNjFMLqWXFPkxMLGqXUmSVMJ4YPFiwt7SzDJ6qMsL4Dqnnm8TFGeBZONol7TS7NQPYr0/Zfvkmgo6J/bySKAUvAcDvoX/vVTzTwfBfGk1NtqZStadfjH3vxRok3EUgcZG+J1yzplDNz7l8TsLGdg+DdEaFhiExpytggdaQLfAPjlL2Q0Op8xAg/d6DS26Cf9j/wiZGnBvmeYk/Xh33V/1c7Ubbpf9QB5t3GKagtTce9AyYXJKOthYgWUuAAWROmo6x danarius ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFDZFJfHkgAY1l4TGhGwuMejGud1+UyukTMxaJdlnakwIcm8/nsc4JwyiEm0p2bSzs1C9arrqMjKkTVJY/gP+FmspiumECAfy82i6bva0WOwJ9UGHhyb0usaR3tLKozMKHCsLYAv6eK9qysh7YWV/e94eNL79v4JvrPNJGw2R52mJciCTCyIZdhhjapcRrg42d2xxk8/kDAX/yjZI4O1aZGfgFwXtxdxwF0lanOXJgOA3L2Sl7m5yEzDXRtmfCqa89FRbAkmnbjSqUs1QWdlidhmRKaCqQr8uMXkC3kkYYvIhRgRSsLNvd3TJ2K5ZKi1HkdhKzDJF8wPMBeDUCUuRH gadflow ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCYNIJli7xuUptl/MmV5Cj5qF05vTJ2o/OkogzRA6tgCosZyu3H5ihXpq5sRCspipgARy9bhyEaWs75XuGaIK3mFR8DiFEcLQ02mcV5hxt8Ubo0S32nP3qzbm7ET3Hpk5FB7/thOJHNh944MJVvBTeLVlP9iZop1qlnJXElU2JRREsPJ+VxEqpBgIrtxU4yA22bK+8BOulmFk6mF91dJTj6E/KIkpW8L3h4SarcQP7poh0SSwq/75pntwTjEX+63WwkAFAuUedVia7Dr2bKwVg7T/3iTNtCyrOSZ2UZRpRCVHNTa1aPsBBNvxR8xkchRh5FjuBsuCkXgx3/kBtq8eo9 gil-hamilton ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPSO/tK07TkNLeCdu2D5d5ScQubWUbETcDpAgTGDChloEDuHoL7ojYvlIlTNgzEP1u6v+3q+O9WBFMuvfKBvzO67pAzOp9gsDCtJaTMi+acBWmgMsJewaOgGGpX5fRj4UXfLlLPY7JDiLT59CCAqdL0UJg6oE3Xd81G2bw0pJfxx33m6b/l2xYiIxAy7mViemAtvyu36D6/DVgz3t6AZ+qoJH+HevipO4xsKH+pbzObr8e3XADzsz32Qp0LSh6uPEf9H/DSOPCfywB8wzdscu9BI7mKfwwBffRQTLh39ISdHk+atLd4jTKkg8+gA4GmtHWfX5KFeKbbEKCT3uK8bOV

IPV6 info
All the instances are using a tunnelbroker.net ipv6 gateway, and should be reachable via ipv6. There should be AAAA records for all the hosts and they should be available for ping6 or ssh.