Re: [atomic-devel] [atomic-announce] Fedora Atomic Host Two Week Release Announcement

[Dusty Mabe <dusty dustymabe com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256



On 01/04/2018 02:14 PM, noreply fedoraproject org wrote:
> 
> A new Fedora Atomic Host update is available via an OSTree update:
> 
> Version: 27.47
> Commit(x86_64): 397e907961adafaeff11b807ceade8da5783134072406fcdba627f1195e0db76
> Commit(aarch64): 25965b64256417d7dfed37511ffe0cf842ebe64bd6adc8c57a3c603dcfd79885
> Commit(ppc64le): c0d0a28a01fd363dfc317e3418935efae6d728a718320dfb3709c4282160f20f
> 
> 
> We are releasing images from multiple architectures but please note
> that x86_64 architecture is the only one that undergoes automated
> testing at this time.
> 
> Existing systems can be upgraded in place via e.g. `atomic host upgrade` or
> `atomic host deploy`.
> 
> Corresponding image media for new installations can be downloaded from:
> 
>     https://getfedora.org/en/atomic/download/
> 
> Alternatively, image artifacts can be found at the following links:
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/Atomic/aarch64/iso/Fedora-Atomic-ostree-aarch64-27-20180104.5.iso
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/Atomic/ppc64le/iso/Fedora-Atomic-ostree-ppc64le-27-20180104.5.iso
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/Atomic/x86_64/iso/Fedora-Atomic-ostree-x86_64-27-20180104.5.iso
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/aarch64/images/Fedora-Atomic-27-20180104.5.aarch64.qcow2
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/aarch64/images/Fedora-Atomic-27-20180104.5.aarch64.raw.xz
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/ppc64le/images/Fedora-Atomic-27-20180104.5.ppc64le.qcow2
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/ppc64le/images/Fedora-Atomic-27-20180104.5.ppc64le.raw.xz
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/x86_64/images/Fedora-Atomic-27-20180104.5.x86_64.qcow2
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/x86_64/images/Fedora-Atomic-27-20180104.5.x86_64.raw.xz
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/x86_64/images/Fedora-Atomic-Vagrant-27-20180104.5.x86_64.vagrant-libvirt.box
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/x86_64/images/Fedora-Atomic-Vagrant-27-20180104.5.x86_64.vagrant-virtualbox.box
> 
> Respective signed CHECKSUM files can be found here:
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/Atomic/aarch64/iso/Fedora-Atomic-27-20180104.5-aarch64-CHECKSUM
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/Atomic/ppc64le/iso/Fedora-Atomic-27-20180104.5-ppc64le-CHECKSUM
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/Atomic/x86_64/iso/Fedora-Atomic-27-20180104.5-x86_64-CHECKSUM
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/aarch64/images/Fedora-CloudImages-27-20180104.5-aarch64-CHECKSUM
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/ppc64le/images/Fedora-CloudImages-27-20180104.5-ppc64le-CHECKSUM
> https://alt.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-27-20180104.5/CloudImages/x86_64/images/Fedora-CloudImages-27-20180104.5-x86_64-CHECKSUM
> 
> For direct download, the "latest" targets are always available here:
>     https://getfedora.org/atomic_iso_latest
>     https://getfedora.org/atomic_qcow2_latest
>     https://getfedora.org/atomic_raw_latest
>     https://getfedora.org/atomic_vagrant_libvirt_latest
>     https://getfedora.org/atomic_vagrant_virtualbox_latest
> 
> Filename fetching URLs are available here:
>     https://getfedora.org/atomic_iso_latest_filename
>     https://getfedora.org/atomic_qcow2_latest_filename
>     https://getfedora.org/atomic_raw_latest_filename
>     https://getfedora.org/atomic_vagrant_libvirt_latest_filename
>     https://getfedora.org/atomic_vagrant_virtualbox_latest_filename
> 
> For more information about the latest targets, please reference the Fedora
> Atomic Wiki space.
> 
>     https://fedoraproject.org/wiki/Atomic_WG#Fedora_Atomic_Image_Download_Links
> 
> Do note that it can take some of the mirrors up to 12 hours to "check-in" at
> their own discretion.
> 
> Thank you,
> Fedora Release Engineering


This is a security related release of Fedora Atomic Host to
address CVE-2017-5754 [1] (Meltdown). This release does not
yet handle the "Spectre" vulnerabilities [2][3]. Those will
come in a future update. For more information see the Red Hat
KB article [4].

kernel-4.14.11-300.fc27.x86_64 fixes BZ1530826 [5] related to
CVE-2017-5754. It also fixes some other CVEs as well. See the 
attached bugs to the bodhi update [6] for more information.

[1] https://access.redhat.com/security/cve/cve-2017-5754
[2] https://access.redhat.com/security/cve/cve-2017-5753
[3] https://access.redhat.com/security/cve/cve-2017-5715
[4] https://access.redhat.com/security/vulnerabilities/speculativeexecution
[5] https://bugzilla.redhat.com/show_bug.cgi?id=1530826
[6] https://bodhi.fedoraproject.org/updates/kernel-4.14.11-300.fc27

An example of the diff between this and the previous released version (for x86_64) is:

ostree diff commit old: b5845ebd002b2ec829c937d68645400aa163e7265936b3e91734c6f33a510473
ostree diff commit new: 397e907961adafaeff11b807ceade8da5783134072406fcdba627f1195e0db76
Upgraded:
  container-selinux 2:2.36-1.fc27.noarch -> 2:2.37-1.fc27.noarch
  glibc 2.26-20.fc27.x86_64 -> 2.26-21.fc27.x86_64
  glibc-all-langpacks 2.26-20.fc27.x86_64 -> 2.26-21.fc27.x86_64
  glibc-common 2.26-20.fc27.x86_64 -> 2.26-21.fc27.x86_64
  kernel 4.14.8-300.fc27.x86_64 -> 4.14.11-300.fc27.x86_64
  kernel-core 4.14.8-300.fc27.x86_64 -> 4.14.11-300.fc27.x86_64
  kernel-modules 4.14.8-300.fc27.x86_64 -> 4.14.11-300.fc27.x86_64
  libcrypt-nss 2.26-20.fc27.x86_64 -> 2.26-21.fc27.x86_64
  oci-register-machine 0-5.11.gitcd1e331.fc27.x86_64 -> 0-5.12.git3c01f0b.fc27.x86_64
  oci-systemd-hook 1:0.1.13-1.gitafe4b4a.fc27.x86_64 -> 1:0.1.15-1.git2d0b8a3.fc27.x86_64
  oci-umount 2:2.3.0-1.git51e7c50.fc27.x86_64 -> 2:2.3.2-1.git3025b19.fc27.x86_64
  os-prober 1.74-3.fc27.x86_64 -> 1.74-4.fc27.x86_64
  selinux-policy 3.13.1-283.17.fc27.noarch -> 3.13.1-283.19.fc27.noarch
  selinux-policy-targeted 3.13.1-283.17.fc27.noarch -> 3.13.1-283.19.fc27.noarch
  vim-minimal 2:8.0.1386-1.fc27.x86_64 -> 2:8.0.1427-1.fc27.x86_64

The Vagrant Cloud page with the new atomic host:

https://app.vagrantup.com/fedora/boxes/27-atomic-host
https://app.vagrantup.com/fedora/boxes/27-atomic-host/versions/27.20180104.5

For posterity the AMIs for this release are:

Fedora-Atomic-27-20180104.5.x86_64            EC2 (ap-northeast-1) ami-bb1588dd    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (ap-southeast-1) ami-e8186e94    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (ap-southeast-2) ami-3ce4165e    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (eu-central-1)   ami-7b108014    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (eu-west-1)      ami-1e9e0967    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (sa-east-1)      ami-08a3e064    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (us-east-1)      ami-851b4aff    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (us-west-1)      ami-03bfbe63    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (us-west-2)      ami-b1cf65c9    hvm           standard
Fedora-Atomic-27-20180104.5.x86_64            EC2 (ap-northeast-1) ami-41188527    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (ap-southeast-1) ami-f21b6d8e    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (ap-southeast-2) ami-73e41611    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (eu-central-1)   ami-6e138301    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (eu-west-1)      ami-38910641    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (sa-east-1)      ami-ab9ddec7    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (us-east-1)      ami-911948eb    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (us-west-1)      ami-c04040a0    hvm           gp2
Fedora-Atomic-27-20180104.5.x86_64            EC2 (us-west-2)      ami-e3c9639b    hvm           gp2

Dusty


-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEPb6zG5c6sV89tRYPMwLb1zlS5nEFAlpOhZMACgkQMwLb1zlS
5nGecxAAkUxRWDfwxRVRo7evkWzo4hZH0ZrXLlPehsSZijtEZBMpCWtonmarxiEW
tsNhPrvKLykAdVS2R7LTy8Zcb1aPMp7kV1laUvUOfbg7YnDnQvkgnuZc2+9IcC/X
AWAx1xYqym1LyKQPyog2V2KfwGSfrZ/dHV1GhOzZCsc/XUod9QkSZD41kvkDapsa
NQV+jf3yvbHyoNQ85A99pEs34ruMCZ9AwMsFVu67eyqAChekL9S2pyyIwop9QCBj
nMG58cEottg5PnJ97dxCjDLUqft7D9h0lyOvV+qkHEvYBGTacXuZO9AIcVqi2tIN
Ogw7uNcibp1zbMFfEbAJa2uI4gM/HFR1ZrZbbj04rjXu3SjqFC6DicD8AtwVFfFT
ZSb59iodLO0zPeHDVSmRGYw7sav+FDtHnAvxFBnmbuqfuebFyxJ12cxBfMShZ9iX
+o8g4cV09hGbnTu7ySiVWR34eecR0TV+QCyr2XnvorIYQvt56nI+vYGK8/CUQ8tk
nPr/UcPdF7D6BlSFOIke4XG+I+Gq3cdndWn+DAepULhZt+3XrBvtlzjX9gHgjl+H
cRlyKFQj4EXJ/m5pmTtFhdFO6g2OMzIFtRM8CfAX4mUJ3iQPo4ARf1jjUE8P5bsa
n4rR8LRI3OnpZPhbKTJVsvzqNOvnRXWLyAbKimBx63hqLMJUEvs=
=0z0b
-----END PGP SIGNATURE-----