Atomic yum Repo for RHEL 6 x86_64 is broken

[SaschaNowak]

Hi

I can not update my OpenVAS box anymore, because graphviz tagged "graphviz-python" as obsolete and created a new one called "graphviz-lang-python" in its new stable versions.
Poorly your package w3af (and other?) requires the old "graphviz-python" package.
(http://www2.atomicorp.com/channels/atom ... x86_64.rpm)


Could you please rebuild w3af with an up to date dependency list?


Here is the yum update output:
...
---> Package graphviz.x86_64 0:2.36.0-1.el6 will be an update
---> Package graphviz-lang-python.x86_64 0:2.36.0-1.el6 will be obsoleting
---> Package graphviz-python.x86_64 0:2.34.0-1.el6 will be obsoleted
--> Processing Dependency: graphviz-python for package: w3af-1.1-2.el6.art.x86_64
---> Package kernel.x86_64 0:2.6.32-431.3.1.el6 will be installed
---> Package kernel-firmware.noarch 0:2.6.32-431.1.2.el6 will be updated
---> Package kernel-firmware.noarch 0:2.6.32-431.3.1.el6 will be an update
---> Package kernel-headers.x86_64 0:2.6.32-431.1.2.el6 will be updated
---> Package kernel-headers.x86_64 0:2.6.32-431.3.1.el6 will be an update
--> Running transaction check
---> Package graphviz-libs.x86_64 0:2.36.0-1.el6 will be installed
---> Package graphviz-plugins-core.x86_64 0:2.36.0-1.el6 will be installed
---> Package graphviz-python.x86_64 0:2.34.0-1.el6 will be obsoleted
--> Processing Dependency: graphviz-python for package: w3af-1.1-2.el6.art.x86_64
--> Finished Dependency Resolution
--> Running transaction check
---> Package graphviz-python.x86_64 0:2.34.0-1.el6 will be obsoleted
--> Processing Dependency: graphviz-python for package: w3af-1.1-2.el6.art.x86_64
---> Package kernel.x86_64 0:2.6.32-358.6.1.el6 will be erased
--> Finished Dependency Resolution
Error: Package: w3af-1.1-2.el6.art.x86_64 (@atomic)
Requires: graphviz-python
Removing: graphviz-python-2.34.0-1.el6.x86_64 (@OpenVAS)
graphviz-python = 2.34.0-1.el6
Obsoleted By: graphviz-lang-python-2.36.0-1.el6.x86_64 (OpenVAS)
Not found
Available: graphviz-python-2.26.0-4.el6.x86_64 (rhel-x86_64-server-optional-6)
graphviz-python = 2.26.0-4.el6
Available: graphviz-python-2.26.0-7.el6.x86_64 (rhel-x86_64-server-optional-6)
graphviz-python = 2.26.0-7.el6
Available: graphviz-python-2.26.0-10.el6.x86_64 (rhel-x86_64-server-optional-6)
graphviz-python = 2.26.0-10.el6
Available: graphviz-python-2.26.3-1.el6.x86_64 (OpenVAS)
graphviz-python = 2.26.3-1.el6
Available: graphviz-python-2.28.0-1.el6.x86_64 (OpenVAS)
graphviz-python = 2.28.0-1.el6
Available: graphviz-python-2.30.0-1.el6.x86_64 (OpenVAS)
graphviz-python = 2.30.0-1.el6
Available: graphviz-python-2.30.1-1.el6.x86_64 (OpenVAS)
graphviz-python = 2.30.1-1.el6
Available: graphviz-python-2.32.0-1.el6.x86_64 (OpenVAS)
graphviz-python = 2.32.0-1.el6



Thany you and best regards
S.

[scott]

Im afraid I cant find this package "graphviz-lang-python", it doesnt appear to be in the base / updates repo from upstream. Im unable to reproduce this on any of our QA instances here.

[SaschaNowak]

Hi Scott

Thank you for your response.

Because you do not provide graphviz packages in your (Red Hat 6) yum repository, I took the official repo for graphviz rpms:

http://www.graphviz.org/pub/graphviz/st ... x86_64/os/

There you can see, graphiz do not support graphviz-python in version 2.36 (the stopped at 2.34) until 11-Jan-2014. This package is replaced by graphviz-lang-python.
So, no one can install OpenVAS (from your yum rhel6 repo) with the current graphviz packages because your w3af packages needs graphviz-python which is incompatible with the current version of graphviz.

So what we need is a new w3af package with the new package name graphviz-lang-python (first and current version 2.36.0-1.el6.x86_64.rpm) for dependency (and not the old one graphviz-lang-python).

[root@host ~]# rpm -qi w3af
Name : w3af Relocations: (not relocatable)
Version : 1.1 Vendor: (none)
Release : 2.el6.art Build Date: Fri 08 Jun 2012 08:31:36 PM CEST
Install Date: Mon 18 Jun 2012 09:55:26 AM CEST Build Host: ministry.whq.atomicorp.com
Group : Applications/Internet Source RPM: w3af-1.1-2.el6.art.src.rpm
Size : 40446936 License: GPLv2 and ( LGPLv3 and LGPLv2 and GPLv2+ and GPLv3 and CC-BY-SA )
Signature : DSA/SHA1, Fri 08 Jun 2012 08:46:08 PM CEST, Key ID 32a951145ebd2744
URL : http://w3af.sourceforge.net
Summary : Web Application Attack and Audit Framework
Description :
The W3AF, is a Web Application Attack and Audit Framework.
The W3AF core and it's plug-ins are fully written in python.
The project has more than 130 plug-ins, which check for SQL injection,
cross site scripting (XSS), local and remote file inclusion and much more.
[root@host ~]# rpm -q --requires w3af
python
SOAPpy
python-fpconst
graphviz-python
pyPdf
pygtk2
python-BeautifulSoup
python-SocksiPy
wordnet
pysvn
python-pybloomfiltermmap
PackageKit-gtk-module
libcanberra-gtk2
pygtksourceview
python-nltk
pyOpenSSL
libxml2-python
python-lxml
scapy
tcpdump
rpmlib(PartialHardlinkSets) <= 4.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(PayloadIsXz) <= 5.2-1



thanks and regards
Sascha

[scott]

Ah I see, its because its from a different repo. Its always a good idea to start with that information to save time

I'll look into what we can do here, since there are other packages that depend on graphiz and an upgrade/package name change could break something in a different package

[SaschaNowak]

Hi scott

I don't want to be annoy you, but do you have an update for me?

[scott]

Yeah it doesnt look like I can make this update without interfering with other packages

[SaschaNowak]

So, the yum repo for RHEL 6 stays broken?

Sorry, but I only locate w3af-1.1-2.el6.art.x86_64.rpm as the "problem rpm". Only this one requires graphviz-python.
Which other packages are affected?

Best Regards
Sascha

[scott]

Sure, I'm building this list across each distro. Fedora at the moment is where I have the most mapped out:

antlrworks-0:1.4.3-10.fc20.noarch
apiviz-0:1.3.2-5.fc20.noarch
asciidoc-0:8.6.8-2.fc20.noarch
bcfg2-server-0:1.3.2-2.fc20.noarch
dot2tex-0:2.8.7-9.fc20.noarch
erlang-dialyzer-0:R16B-02.7.fc20.x86_64
fawkes-devenv-0:0.5.0-13.fc20.noarch
fawkes-guis-0:0.5.0-13.fc20.x86_64
flowcanvas-0:0.7.1-12.fc20.x86_64
frama-c-0:1.9-6.fc20.x86_64
gramps-0:4.0.2-1.fc20.noarch
graphviz-R-0:2.34.0-4.fc20.x86_64
kscope-0:1.9.4-11.fc20.x86_64
libgda-tools-1:5.1.2-4.fc20.x86_64
mm-common-0:0.9.6-4.fc20.noarch
monotone-viz-0:1.0.2-10.fc20.x86_64
mtn-browse-0:1.10-4.fc20.noarch
netdisco-0:1.1-6.fc20.noarch
ntop-0:5.0-7.fc20.x86_64
perl-GraphViz-0:2.14-4.fc20.noarch
php-pear-Image-GraphViz-0:1.3.0-8.fc20.noarch
pprof-0:2.1-2.fc20.noarch
pydot-0:1.0.28-4.fc20.noarch
python-pebl-0:1.0.2-11.fc20.x86_64
python-pycallgraph-0:0.5.1-5.fc20.noarch
python-xdot-0:0.5-3.fc20.noarch
root-graf-gviz-0:5.34.10-1.fc20.x86_64
root-html-0:5.34.10-1.fc20.x86_64
synopsis-0:0.12-10.fc20.x86_64
trac-mastertickets-plugin-0:3.0.3-2.20130209.git4c461fe.fc20.noarch
trac-workflowadmin-plugin-0:0.12-20120633svn11062.fc20.noarch
umlgraph-0:5.6-5.fc20.noarch
viewmtn-0:0.10-11.20100308mtn0030ad67.fc20.noarch
xhprof-0:0.9.4-1.fc20.noarch

[hostingg]

openvas installs and upgrades just fine for me on 6 from the atomic repo:

# rpm -qa openvas*
openvas-1.0-9.el6.art.noarch
openvas-administrator-1.3.2-5.el6.art.x86_64
openvas-scanner-3.4.0-7.el6.art.x86_64
openvas-cli-1.2.0-4.el6.art.x86_64
openvas-manager-4.0.4-13.el6.art.x86_64
openvas-libraries-6.0.1-7.el6.art.x86_64

# rpm -qa w3af*
w3af-1.1-2.2.el6.art.x86_64

# cat /etc/redhat-release
CentOS release 6.5 (Final)

[SaschaNowak]

@hostingg: than, you do not use the latest version of graphviz, do you?

OK, thats a lot. So I will freeze the graphviz packages so I can update my GSA machines. It is more important for me to have up to date openvas and gsa packages.

On which plattform do you have your focus? SLES/RHEL/CENTOS/Fedora/Debian/...?
Did I back the wrong horse with RHEL?

[scott]

So the core demographic for the repo over all are RHEL and its derivatives (Centos, Cloudlinux, etc). At the moment its about 500k (and falling) on el5 and 500k on el6 (and rising). For the vast majority of projects, those are the focus. For anything we're putting together here, they are always the first 2 distros we try to support.

Openvas is kind of a unique case though, it turns out it is the #1 project in Atomic for the Fedora users, right now around 20k. So if people are using Atomic on fedora, its most likely for this specific project. That said, if you're running a scanning server, use EL6. Fedora is great if you need something to also be a desktop.

The other reason for making sure Fedora is squared away is that RHEL 7 is coming out soon, and it is very close to Fedora 19/20. Having all the loose ends tied up there means we'll have the EL7 packages out much faster.

[hostingg]

@hostingg: than, you do not use the latest version of graphviz, do you?

Yes i use the latest stable version for el6

# rpm -qa graphviz*
graphviz-2.26.0-10.el6.x86_64
graphviz-python-2.26.0-10.el6.x86_64

And i have no problems upgrading either graphiz, openvas or w3af from the atomic rpms

# rpm -qa w3af*
w3af-1.1-2.2.el6.art.x86_64

# rpm -qa openvas*
openvas-1.0-9.el6.art.noarch
openvas-administrator-1.3.2-5.el6.art.x86_64
openvas-scanner-3.4.0-7.el6.art.x86_64
openvas-cli-1.2.0-4.el6.art.x86_64
openvas-manager-4.0.4-13.el6.art.x86_64
openvas-libraries-6.0.1-7.el6.art.x86_64

# yum upgrade w3af* openvas* graphviz*
Loaded plugins: fastestmirror, refresh-packagekit
Loading mirror speeds from cached hostfile
* asl-3.0: www6.atomicorp.com
* atomic: www6.atomicorp.com
* base: mirror.metrocast.net
* extras: mirrors.advancedhosters.com
* updates: centos.mirror.nac.net
Setting up Upgrade Process
No Packages marked for Update

your problem appears to be because you are using a non standard version of graphiz and not the version supplied with el6. if u use the standard version everything works fine.

[SaschaNowak]

Hi

first, thank you for your responses.

I can confirm that if you use the graphviz of RHEL6 repositories everything is fine.
But it does not work with the current version 2.27 of graphiz project homepage.

I do not know, why I used the graphiz project yum repo for my openvas machines.
I now use the older RHEL6 version, and I am happy now!

Thanks to all!