Bug 41760 - ensure UCS@school version is now lower on the DC Master
ensure UCS@school version is now lower on the DC Master
Status: CLOSED FIXED
Product: UCS@school
Classification: Unclassified
Component: General
UCS@school 4.1 R2
Other Linux
: P5 normal (vote)
: UCS@school 4.1 R2 vXXX
Assigned To: Daniel Tröder
Florian Best
: interim-3
Depends on: 42959
Blocks: 43009
  Show dependency treegraph
 
Reported: 2016-07-08 13:48 CEST by Jens Thorp-Hansen
Modified: 2016-12-12 13:10 CET (History)
3 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 6: Setup Problem: Issue for the setup process
Who will be affected by this bug?: 2: Will only affect a few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.206
Enterprise Customer affected?:
School Customer affected?: Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments
Screenshot (118.36 KB, image/png)
2016-12-08 17:40 CET, Florian Best
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jens Thorp-Hansen univentionstaff 2016-07-08 13:48:59 CEST
62USC-School-Slave.inst does not check @school version of the master - joinscript stops if the version of the master is not the same as on the slave. error message may be misleading:

 ERROR: cannot update LDAP indices (ldap server not running?) - stopping here
Comment 1 Sönke Schwardt-Krummrich univentionstaff 2016-10-14 16:31:02 CEST
I think the only problem here is the error message that should indicate that the UCS@school version of the DC master might be a problem.
Comment 2 Daniel Tröder univentionstaff 2016-11-15 16:17:35 CET
Script "app_version.py" was added that can be used to compare the version of an app on the local system and on the DC master.

Backup, edu-slave and non-edu-slave join scripts (not singleserver) use it at the start to check if the versions differ. The ending ' v.*$' in "4.1 R2 v8" is ignored, so a comparision may be between "4.1" and "4.1 R2".

r74445: code and advisory

Waiting for Bug #42959 to fill in the correct URL in the join.log hint.
Comment 3 Sönke Schwardt-Krummrich univentionstaff 2016-11-15 17:23:44 CET
(In reply to Daniel Tröder from comment #2)
> Script "app_version.py" was added that can be used to compare the version of
> an app on the local system and on the DC master.

Calling the script from within the join script is extremely too late. This way the join process has been finished more than 50%.
 
I think the script has to be part of 00ucs-school-slave-check-ou.inst at least. But it would be best if the UCS@school installer checks this *before* starting installation of UCS@school slave.
Comment 4 Sönke Schwardt-Krummrich univentionstaff 2016-11-18 18:14:38 CET
I would prefer an UCR variable instead of an environment variable. It is not assured, that the env variable is passed to the join scripts.

Idea: the UCR variable to override the check should be very specific regarding the version. E.g. ucsschool/join/ignore-version-mismatch/$MASTERVER/$SLAVEVER=yes
→ ucsschool/join/ignore-version-mismatch/4.1R2v5/4.1v8=yes

RFC
Comment 5 Daniel Tröder univentionstaff 2016-11-21 08:49:29 CET
UCS@school installer check is split off into separate Bug #43009.
Comment 6 Daniel Tröder univentionstaff 2016-11-21 13:56:25 CET
(In reply to Sönke Schwardt-Krummrich from comment #3)
> Calling the script from within the join script is extremely too late. This
> way the join process has been finished more than 50%.
>  
> I think the script has to be part of 00ucs-school-slave-check-ou.inst at
> least. But it would be best if the UCS@school installer checks this *before*
> starting installation of UCS@school slave.
I also think it'd be better to run this earlier. But 00ucs-school-slave-check-ou.inst is only installed on edu-slaves and not on non-edu-slaves or backups. Should a new join script be created, that is installed on all roles?

(In reply to Sönke Schwardt-Krummrich from comment #4)
> I would prefer an UCR variable instead of an environment variable. It is not
> assured, that the env variable is passed to the join scripts.
> 
> Idea: the UCR variable to override the check should be very specific
> regarding the version. E.g.
> ucsschool/join/ignore-version-mismatch/$MASTERVER/$SLAVEVER=yes
> → ucsschool/join/ignore-version-mismatch/4.1R2v5/4.1v8=yes
> 
> RFC
I concur.
Comment 7 Sönke Schwardt-Krummrich univentionstaff 2016-11-22 09:50:21 CET
(In reply to Daniel Tröder from comment #6)
> (In reply to Sönke Schwardt-Krummrich from comment #3)
> > Calling the script from within the join script is extremely too late. This
> > way the join process has been finished more than 50%.
> >  
> > I think the script has to be part of 00ucs-school-slave-check-ou.inst at
> > least. But it would be best if the UCS@school installer checks this *before*
> > starting installation of UCS@school slave.
> I also think it'd be better to run this earlier. But
> 00ucs-school-slave-check-ou.inst is only installed on edu-slaves and not on
> non-edu-slaves or backups. Should a new join script be created, that is
> installed on all roles?

Yes, I think a new join script for each role (exclusive DC master) is currently the only solution (until the pre-checks feature is implemented in univention-join and UCS@school install wizard).
Comment 8 Daniel Tröder univentionstaff 2016-11-22 16:05:50 CET
* App versions are now compared in a separate join script 00ucs-school-app-version-check.inst on DC backups and DC slaves (edu & non-edu).
* Comparisation uses exact versions now (incl. trailing "v_").
* It is only checked, that the version on the DC master is higher or equal to the one on the installing host.
* Support for overriding the result of app_version.py (version checking script) was added using the UCRV ucsschool/join/ignore-version-mismatch/$MASTERVERSION/$SLAVEVERSION.

r74668: code change
r74669: advisory
Comment 9 Daniel Tröder univentionstaff 2016-11-23 12:00:43 CET
r74685: added executable flag to script
Comment 10 Stefan Gohmann univentionstaff 2016-12-04 16:51:26 CET
At least in our Large Jenkins environment the join fails:

http://jenkins.knut.univention.de:8080/job/UCSschool%204.1/job/UCSschool%204.1%20(R2)%20Large%20Environment/ws/autotest-300-ucsschool-large.log
-------------------------------------------------------------------------------
. . . . . . . . . Domänenbeitritt - beendet...
ERROR: installation failed!
output: {u'info': u'beendet...', u'steps': 36.93109090909091, u'finished': True, u'errors': [u'Die Softwarepakete wurden erfolgreich installiert, jedoch konnte der Dom\xe4nenbeitritt nicht abgeschlossen werden: Warning: UCS version on master300.autotest300.local is lower () than local version (). This constellation is not supported.. Mehr Hinweise k\xf6nnen in der Log-Datei /var/log/univention/join.log gefunden werden. Nach Beheben der entsprechenden Konflikte kann der Dom\xe4nenbeitritt \xfcber das UMC-Modul "Dom\xe4nenbeitritt" abgeschlossen werden.', u'Die Softwarepakete wurden erfolgreich installiert, jedoch konnte der Dom\xe4nenbeitritt nicht ausgef\xfchrt werden. Mehr Hinweise k\xf6nnen in der Log-Datei /var/log/univention/join.log gefunden werden. Nach Beheben der entsprechenden Konflikte kann der Dom\xe4nenbeitritt \xfcber das UMC-Modul "Dom\xe4nenbeitritt" noch einmal ausgef\xfchrt werden.'], u'component': u'Dom\xe4nenbeitritt'}
-------------------------------------------------------------------------------
Comment 11 Stefan Gohmann univentionstaff 2016-12-05 09:13:10 CET
If we used the released scope, we didn't register the App.

r74957:
 Register the UCS@school App explicit even if the App is installed manually (Bug #41760)

I've restarted the large and the multiserver tests.
Comment 12 Florian Best univentionstaff 2016-12-08 13:59:05 CET
Why is the joinscript installed on the DC Master, too?
Comment 13 Daniel Tröder univentionstaff 2016-12-08 14:15:16 CET
r75116: don't install 00ucs-school-app-version-check on master

Package: ucs-school-metapackage
Version: 9.0.2-14.190.201612081412
Branch: ucs_4.1-0
Scope: ucs-school-4.1r2
Comment 14 Florian Best univentionstaff 2016-12-08 14:18:38 CET
(In reply to Daniel Tröder from comment #13)
> r75116: don't install 00ucs-school-app-version-check on master
> 
> Package: ucs-school-metapackage
> Version: 9.0.2-14.190.201612081412
> Branch: ucs_4.1-0
> Scope: ucs-school-4.1r2
No, please revert this. ucs-school-master is installed on a DC Backup. That was the reason for comment #12.
Comment 15 Daniel Tröder univentionstaff 2016-12-08 15:07:23 CET
r75125: revert 75116
Comment 16 Florian Best univentionstaff 2016-12-08 17:40:13 CET
Created attachment 8297 [details]
Screenshot
Comment 17 Florian Best univentionstaff 2016-12-08 17:40:49 CET
OK: older versions are detected correctly on a DC Slave

~This does only detect if the app is installed but not if UCS@school is installed and configured at all.
~ Doesn't work on a DC Backup with the school installer because no join scripts are installed there.
~The link is wrong. → Bug #42959
~Running univention-join on a DC Backup now only displays:
**************************************************************************
* Join failed!                                                           *
* Contact your system administrator                                      *
**************************************************************************
* Message:  FAILED: 00ucs-school-app-version-check.inst

But the relevant information what to do is only available in the join.log.

~Running the UCS@school installer on a DC Slave also doesn't show any relevant information. This may be a bad user experience.
→ See Screenshot in attachment 8297 [details]
Comment 18 Sönke Schwardt-Krummrich univentionstaff 2016-12-12 13:10:17 CET
UCS@school 4.1 R2 v9 has been released.

http://docs.software-univention.de/changelog-ucsschool-4.1R2v9-de.html