What is my sftp server doing?

Well, I'm not familiar with DTrace, but sometimes want to find, what some application is doing. In this case I wanted to monitor my sftp server. Luckily, most illumos distributions provide dtrace patch (coming from Oracle Solaris) to find this out. Unluckily, I haven't found any documentation on it, just source code. After reading Translators chapter of DTrace Guide and looking at /usr/lib/dtrace/sftp.d I've come to this:

dtrace -n 'sftp*:::transfer-done { printf ("%d: %s %s %s %d", pid, xlate <sftpinfo_t *>((sftpproto_t*)arg0)->sfi_pathname, xlate <sftpinfo_t *>((sftpproto_t*)arg0)->sfi_user, xlate <sftpinfo_t *>((sftpproto_t*)arg0)->sfi_operation, xlate <sftpinfo_t *>((sftpproto_t*)arg0)->sfi_nbytes  ); }'

dtrace: description 'sftp*:::transfer-done ' matched 8 probes
CPU     ID                    FUNCTION:NAME
  1  80412      process_read:transfer-done 7409: /export/home/user/1.pp user read 1808
  1  80412      process_read:transfer-done 7409: /export/home/user/1.pp user read 0
  1  80411     process_write:transfer-done 7409: /export/home/user/1.pp user write 1808
  1  80412      process_read:transfer-done 7409: /export/home/user/dtrace/poll.d user read 53
  1  80412      process_read:transfer-done 7409: /export/home/user/dtrace/poll.d user read 53

Seems rather interesting to me.

Quest: creating one hundred zones

Well, I need to create about one hundred zones once again. You could probably use ansible for this, but an old-fashioned man will do everything in shell. So: we have one "golden image" and have to create 100 zones like it. We could clone it, but with clones you receive wonderful issue - beadm activate fails in zone. So we create zones and do send/receive manually. This looks like this:

#!/bin/bash
set -e

for i in $(seq 1 100); do 

    #Creating interface for the zone
    dladm create-vnic -l e1000g1 hnet$i

    #Creating initial config   

    TEMPFILE=$(mktemp /tmp/XXXXXXXXXXXXXXXXXX)
    cat > $TEMPFILE <<EOF
create -b
set zonepath=/zones/h$i
set autoboot=true
set ip-type=exclusive
add net
set physical=hnet$i
end
add capped-memory
set physical=2G
end
add rctl
set name=zone.max-swap
add value (priv=privileged,limit=2147483648,action=deny)
end
add rctl
set name=zone.max-locked-memory
add value (priv=privileged,limit=536870912,action=deny)
end
EOF

    zonecfg -z h$i -f $TEMPFILE
    zfs send -R data/zones/h0@initial | zfs recv -F data/zones/h$i
 
    # Zone tools should know that zone is in installed state, not configured
    # Also during installation zoneadm assigns uuid to zone (last field). We do this manually.
    uuid=$(uuidgen)
    gsed -i  -e "/^h${i}:/ s/\$/${uuid}/" -e "/^h${i}:/ s/configured/installed/" /etc/zones/index
    zoneadm -z h$i mount

    # We known that golden image ip address  ends in 254 and change it
    addr=$((1+$i))
    sed -i -e "s:hnet0:hnet$i:g" -e "s:\.254:.$addr:g" /zones/h$i/root/etc/ipadm/ipadm.conf
    zoneadm -z h$i unmount
    zfs destroy data/zones/h$i@initial
    rm $TEMPFILE
    zoneadm -z h$i boot
done

Thank you, Oracle engineers

After 2010, when Oracle acquired Sun, most of us, who followed OpenSolaris, were depressed. In one year one of the most advantageous operating systems was closed under steel curtain. Luckily, due to enormous efforts of community, of companies, dependent on OpenSolaris, the system survived. Currently we have several more or less successful illumos distributions, targeting different users. But nowadays there's a (of course, deserved) common negative feeling towards Oracle in illumos community. But let's speak from another point of view. Let's look at things, which illumos community (and in particular, OpenIndiana) got directly or indirectly from Oracle in recent years.

• Our userland build system, which constantly evolves, however, in different directions, under Oracle control and in our distribution. But still a lot of components can be easily migrated between build systems.
• A lot of software build receipts and patches, as result, were borrowed with small modifications, from Oracle userland-gate. The process is still going on.
• We still borrow patches from Solaris pkg-gate. Also differences in underlying kernels are currently rather significant, a lot of changesets from pkg-gate can be ported to OpenIndiana pkg5 repository.
• Of course, I can not avoid thanking Alan for his constant help in supporting Xorg subsystem and GUI parts of our distribution. He was always helpful to me and Aurélien.
• Evidently, recent KMS work, integrated into OpenIndiana, wouldn't be possible without Oracle's open drm port, which was ported from Solaris to illumos by Martin Bochnig, and later independently ported and enhanced by Gordon Ross.

- And of course, I cannot count patches, which were suggested to upstream projects by Oracle engineers. Just today when I tried to solve two issues related with IPS and apache 2.4 interaction, I've found two patches by Petr Sumbera, fixing Apache issues on Solaris. So, I want to use the chance and thank all Oracle Solaris engineers for their work on open source projects. I doubt that without them illumos could survive in large scale. Perhaps, we could be an excellent playground for ZFS development, but not an universal operating system...

Sending SMS notifications from OpenIndiana zone with Huawei E1550

I want to receive SMS notifications when something is terribly wrong in our data center. One part of the problem is OpenNMS, and we know how to configure it. But another part is actually sending SMS.

As only physical server with normal USB ports which we have is self-assembled SuperMicro storage, running OpenIndiana, we want to create OI zone, which can send SMS. First of all, we'll need some USB modem. I use Huawei e1550, which was already switched to modem-only mode (AT^U2DIAG=0) on Windows PC. Let's look at prtconf -v (looking for HUAWEI):

     device, instance #0
                    Driver properties:
                        name='pm-components' type=string items=3 dev=none
                            value='NAME= usbsacm0 Power' + '0=USB D3 State' + '3=USB D0 State'
                    Hardware properties:
                        name='driver-minor' type=int items=1
                            value=00000000
                        name='driver-major' type=int items=1
                            value=00000002
                        name='high-speed' type=boolean
                        name='configuration#' type=int items=1
                            value=00000001
                        name='usb-product-name' type=string items=1
                            value='HUAWEI Mobile'
                        name='usb-vendor-name' type=string items=1
                            value='HUAWEI Technology'
                        name='usb-raw-cfg-descriptors' type=byte items=85
                            value=09.02.55.00.03.01.03.e0.fa.09.04.00.00.03.ff.ff.ff.00.07.05.81.03.40.00.05.07.05.82.02.00.02.20.07.05.01.02.00.02.20.09.04.01.00.02.ff.ff.ff.00.07.05.83.02.00.02.20.07.05.02.02.00.02.20.09.04.02.00.02.ff.ff.ff.00.07.05.84.02.00.02.20.07.05.03.02.00.02.20
                        name='usb-dev-descriptor' type=byte items=18
                            value=12.01.00.02.00.00.00.40.d1.12.01.10.00.00.02.01.00.01
                        name='usb-release' type=int items=1
                            value=00000200
                        name='usb-num-configs' type=int items=1
                            value=00000001
                        name='usb-revision-id' type=int items=1
                            value=00000000
                        name='usb-product-id' type=int items=1
                            value=00001001
                        name='usb-vendor-id' type=int items=1
                            value=000012d1
                        name='compatible' type=string items=3
                            value='usb12d1,1001.0' + 'usb12d1,1001' + 'usb,device'
                        name='reg' type=int items=1
                            value=00000006
                        name='assigned-address' type=int items=1
                            value=00000003

If modem was switched to modem-only mode, you'll see

value='usb12d1,1001.0' + 'usb12d1,1001' + 'usb,device'

in 'compatible' field.So, let's say OI that it should use usbsacm to talk to it:

# update_drv -a -i 'usb12d1,1001' usbsacm

Now you should have /dev/term/0 - 3 devices and can use tip to talk to /dev/term/0:

# tip /dev/term/0
connected
AT
OK
~^D

Let's create zone and pass /dev/term/0 to the zone:

# zonecfg -z  sms1
sms1: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:sms1> create
zonecfg:sms1> set zonepath=/zones/sms1
zonecfg:sms1> set brand=ipkg
zonecfg:sms1> set autoboot=true
zonecfg:sms1> set ip-type=exclusive
zonecfg:sms1> add net
zonecfg:sms1:net> set physical=sms10
zonecfg:sms1:net> end
zonecfg:sms1> add device
zonecfg:sms1:device> set match=/dev/term/0
zonecfg:sms1:device> end
zonecfg:sms1> exit
# zfs create data0/zones/sms1
# zoneadm -z sms1 install
# zoneadm -z sms1 boot

Now we can configure network in our zone:

# zlogin sms1
# ipadm create-if sms10
# ipadm create-addr -T static -alocal=192.168.1.2/24 sms10/v4
# route add -p -net 0 192.168.1.1
# cp /etc/nsswitch.dns /etc/nsswitch.conf
# echo 'nameserver 8.8.8.8' >  /etc/resolv.conf
# svcadm enable dns/client

We'll use gammu utilities to send sms:

# pkg install utility/gammu

Your /etc/gammurc (or ~/.gammurc) should look like:

[gammu]
device = /dev/term/0
connection = at

If everything is fine, now you can send SMS:

# gammu sendsms TEXT +7myphone -text "test" 

Converting "linked images" zones to non-linked

A while ago we introduced "nlipkg" zone brand in OI to create "non-linked" images. OmniOS uses ipkg as non-linked brand by default and has additional "lipkg" brand for linked images. Briefly speaking, when you deal with linked images, global zone's IPS knows a lot about zones, can work with them (for example, you can update all zones in one step with "pkg update -r") and imposes some restrictions on child images. Zone's brand is recorded in /etc/zones/zonename.xml and can be changed manually or using zonecfg. As ipkg and nlipkg zones are rather similar (in fact, they are distinguished only in name and IPS checks in some places on which brand it's operating, but for these two brands zone brand scripts are the same). So, when you are bugged with IPS checks for linked images, you can try to change zone's brand from ipkg to nlipkg. This even can work. The only issue is that it doesn't always work. Sometimes you still receive irritating messages like

pkg install: Invalid child image publisher configuration.  Child image publisher
configuration must be a superset of the parent image publisher configuration.
Please update the child publisher configuration to match the parent.  If the
child image is a zone this can be done automatically by detaching and
attaching the zone.

The parent image has the following enabled publishers:
    PUBLISHER 0: openindiana.org (non-sticky)
    PUBLISHER 1: userland (non-sticky)
    PUBLISHER 2: hipster-encumbered

The child image has the following enabled publishers:
    PUBLISHER 0: openindiana.org (non-sticky)
    PUBLISHER 1: hipster-encumbered

Even for nlipkg-branded zones. The issue is that inside zone IPS knows nothing about zone's brand. Its logic is always the same. The only thing which it checks for are files in /var/pkg/linked directory. These files are usually created on pkg operations initiated from GZ (the same pkg update -r) and contain information about parent image (read - GZ). When you change zone's brand, they will not disappear, and IPS inside zone will still think that it works with linked image. Luckily, to convince it that it's not true, it's enough to do "rm -fr /var/pkg/linked". Then this condition will make IPS happy. So, long story short - don't forget to remove /var/pkg/linked if you convert zone from ipkg to nlipkg brand.

Bye-bye, sysidtool, hello sysding

Often you want to have some simple tool to configure basic system settings after installation, such as ip settings, time zone settings, locales and so on. More important, installer also sometimes needs similar utility, which would run on first boot and initialize basic system parameters. For example, OmniOS runs /.initialboot script on the first boot. Solaris historically had sysidtool service, which read /etc/sysidcfg file and used it to configure zones or base system. Sysidtool also had ncurses-based interface to perform basic zone configuration.
The disadvantage of sysidtool is that it is a closed source tool, and you cannot fix it if you want it to do a bit more. So, we switched to sysding in OpenIndiana Hipster.
Sysding was originally written by Olaf Bohlen (Agnar at #oi-dev) to configure multiple illumos/Solaris zones. It doesn't have interactive interface, but has a set of utility functions to write configuration scripts. File /etc/sysding.conf is a simple ksh script, sourced by /lib/svc/method/sysding on . /lib/svc/method/sysding predefines some useful functions which can be necessary for initial configuration. Sample configuration file can look like

setup_timezone Europe/Moscow
setup_locale en_US.UTF-8
setup_user_password root '$5$+Fu+utqXFqU=$RD2LbFipqwKc2srNFYnVkda9U6K2pmMajvuR3iyHzR'
setup_interface PRIMARY v4 192.168.1.4/24
setup_route default 192.168.1.1
setup_ns_dns "stud.lan" "stud.lan notebook.lan" "8.8.8.8"

Using it, sysding will set timezone, locale, root password, network settings on first boot and reboot zone (or NGZ), because /etc/default/init was changed. It also cares about setting root password to 'NP' at first boot in zone if it's empty and you haven't specified one. Without this you wouldn't be able to "zlogin" to the zone. It can do a bit more. If you are interested, look at /lib/svc/method/sysding . If you want to have some customizations for your environment, create pull requests against https://github.com/OpenIndiana/sysding/, but don't forget two things: test your changes thoroughly and keep in mind that sysding was created to be a simple configuration tool.

Userland incorporation in OpenIndiana Hipster and what does it mean for developer

Last Sunday we've published userland incorporation to /hipster-2015 repository. This was a feature long asked for by several users. It is generated by Jenkins on the build host and forces all packages generated by oi-userland build (excluding illumos-gate-provided packages and kvm) to be the latest. As we publish this incorporation on each oi-userland rebuild, you can force your system to go to specific point in the future. For example:

$ pkg list -avf pkg://openindiana.org/consolidation/userland/userland-incorporation
FMRI                                                                         IFO
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151006T203007Z ---
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151005T203207Z ---
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151004T163056Z i--
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151004T150924Z ---
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151004T132353Z ---
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151004T122350Z ---
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151004T095518Z ---
....

We can see that this system has incorporation with  20151004T163056Z  timestamp installed and two more recent versions are available. So I can do something like:

$ sudo pkg update -v \
pkg://openindiana.org/consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0:20151005T203207Z

to move to the 5th October  package versions.

Why developers doesn't like incorporations (and IPS generally)? Because it doesn't allow you to do what you want with your system. For example, you can't install another package version.
In case of userland incorporation, you have some freedom. You can just uninstall it (and entire, as entire depends on userland-incorporation). But you can get issues during new zone setup if your NGZ misses entire. So, you have three options:

• stay with old entire, which doesn't depend on userland-incorporation (pkg freeze it);
• uninstall entire and userland-incorporation;
• use facets to relax incorporate dependencies.

Let's look on the last option more attentively. For example, I'm going to experiment with new mesa. But userland-incorporation has the following dependency:

$ pkg contents -m userland-incorporation |grep mesa
depend facet.version-lock.x11/library/mesa=true fmri=x11/library/mesa@10.5.9,5.11-2015.0.1.0:20150927T212600Z type=incorporate

As you see, it is marked by facet. So you can do

$ sudo pkg facet facet.version-lock.x11/library/mesa
FACET                                                            VALUE SRC
version-lock.x11/library/mesa                                    True  system
$ sudo pkg change-facet facet.version-lock.x11/library/mesa=false
$ sudo pkg install pkg://userland/x11/library/mesa
$ sudo pkg info mesa
             Name: x11/library/mesa
          Summary: The Mesa 3-D Graphics Library
         Category: System/X11
            State: Installed
        Publisher: userland
          Version: 11.0.2
           Branch: 2015.0.1.0
   Packaging Date: October  7, 2015 03:00:58 PM
Last Install Time: October  7, 2015 06:49:24 PM
             Size: 34.82 MB
             FMRI: pkg://userland/x11/library/mesa@11.0.2-2015.0.1.0:20151007T150058Z
      Project URL: http://www.mesa3d.org/
       Source URL: ftp://ftp.freedesktop.org/pub/mesa/11.0.2/mesa-11.0.2.tar.xz
 

But beware, if you would like to change facet back, you can't do it:

$ sudo pkg change-facet version-lock.x11/library/mesa=true
Creating Plan (Solver setup): /
pkg change-facet: Package entire must be uninstalled before the requested operation can be performed.
  Reject:  pkg://openindiana.org/entire@0.5.11-2015.0.2.1:20151003T221212Z
  Reason:  No version matching 'require' dependency consolidation/userland/userland-incorporation can be installed
Package x11/server/xorg/driver/xorg-video-ati must be uninstalled before the requested operation can be performed.
  Reject:  pkg://openindiana.org/x11/server/xorg/driver/xorg-video-ati@6.14.6-2015.0.1.0:20150927T212825Z
  Reason:  No version matching 'require' dependency x11/server/xorg@1.14.7-2015.0.1.0 can be installed
    ----------------------------------------
    Reject:  pkg://openindiana.org/x11/server/xorg@1.14.7-2015.0.1.0:20150927T184317Z
    Reason:  No version matching 'optional' dependency x11/library/mesa@7.4.4-2014.1.3.0 can be installed
      ----------------------------------------
      Reject:  pkg://userland/x11/library/mesa@11.0.2-2015.0.1.0:20151007T150058Z
      Reason:  This version is excluded by installed incorporation consolidation/userland/userland-incorporation@0.5.11-2015.0.2.0
      ----------------------------------------
    ----------------------------------------

.....

Firstly, you have to install mesa version offered by openindiana.org publisher.
Update (2016-01-26). If you use your host as test station, it's easier just to uninstall userland-incorporation. Now you can do this without touching entire. Just do

$ sudo pkg change-facet facet.require.consolidation/userland/userland-incorporation=false
$ sudo pkg uninstall userland-incorporation

On attaching zones and linked images

Recently updated IPS was added to OI and it caused some inconvenience to developers. The most annoying "feature" is caused by publisher check: NGZ first several publishers should be the same as GZ's publishers and their stickiness should match.
OK, I've set the publishers according to this rule, but today was surprised by fact that I can't longer set openindiana.org publisher to be non-sticky in NGZ. I've set openindiana.org publisher to non-sticky in GZ, NGZ, but still IPS complains on "pkg install":

pkg install: Invalid child image publisher configuration.  Child image publisher
configuration must be a superset of the parent image publisher configuration.
Please update the child publisher configuration to match the parent.  If the
child image is a zone this can be done automatically by detaching and
attaching the zone.

The parent image has the following enabled publishers:
    PUBLISHER 0: openindiana.org
    PUBLISHER 1: userland (non-sticky)

The child image has the following enabled publishers:
    PUBLISHER 0: openindiana.org (non-sticky)
    PUBLISHER 1: userland (non-sticky)
    PUBLISHER 2: hipster-encumbered

I've rechecked. Both GZ and NGZ had  openindiana.org publisher set to non-sticky.  I've followed IPS advice - detached and attached zone. And zone attach -u failed with the same error.

OK. Time for black magic. I've unset userland publisher. Set GZ and NGZ publisher list only  to openindiana.org (non-sticky). The same issue - IPS doesn't see that GZ publisher is non-sticky now. So, I concluded that  information about parent image is recorded or cached in some local zone configuration file. Looked at zone's /var/pkg and found /var/pkg/linked/linked_ppubs, which listed [["openindiana.org", true], [userland, false]]. I changed this file to [["openindiana.org", false]] and after that could attach zone.

I think I still doesn't understand as linked images work (or should work), but they are starting annoying me...

There and back again

Once upon a time in a galaxy far far away there has been OpenSolaris distribution. This was the first Unix-like desktop which allowed me to completely replace Windows on my desktop. It wasn't perfect, but a magic of ZFS and IPS made it very attractive. As we now, the sun sets... So, with the end of OpenSolaris era I've moved to FreeBSD and has never regretted about it.

But I always liked illumos and was interested in OpenIndiana distribution. So, now, when I seem to be one of the last interested in it, I tried to go back. Really, migration was smooth. I've bought Nvidia GeForce 740-based video adapter, 4 more GB of RAM and after this I was sure that my hardware is supported by OI.

OI could recognize FreeBSD ZFS pool, so I've detached one disk from zpool, installed OI Hipster from October ISO, imported data and looked at software. As always, software choice for OI if you don't want to compile it yourself is not wast. Yes, there are pkgsrc builds, but they seems foreign in IPS world. So, I used sfe and sfe-encumbered repositories for OI /dev. I hope to use vlc, but vlc 1.1 from sfe-encumbered was a complete garbage. It didn't want to play anything or when it played something it was awful (like no sound or no video or no navigation in DVD menu...) So I stopped on totem/rhythmbox combination and used additional gstreamer codecs from sfe-encumbered. This works, however you should set sfe-encumbered before sfe in your publisher's list.

When speaking about OI one should mention IIMF/IIMD and other IIIM shit. Luckily, it can be turned off. I've finished just adding setxkbmap command to the list of startup applications.

Unfortunately, our Apache OpenOffice from /hipster is still buggy, so I had to use one from AdfinisSyGroup. VirtualBox 4.3.18 from Oracle for Solaris/x64 works fine. I was pleased with our Firefox 24.8.1. Adobe flash plugin 10.1 r85 sometimes crashes. Especially annoying is that it crashes on the flash games which I have to support. At least I've expected that it would not work - the application require Flash 11+. But for other use cases it works. Having working evince, xchm and FBreader seems enough to read documentation. zpool resilvering has completed by 50%. So, now I'm eating my own dog's food.

Hipster 2014.10 is finally out

We are finally ready to present you new OpenIndiana Hipster snapshot and ISO images. We had some difficulties with generating installable "entire", so we had to delay snapshot for a week. But now you can just pkg fix entire to be more stable in constantly-changing Hipster world :) Since last snapshot a lot of work was done. I tried to summarize the changes in this informal "release notes". Please, be sure to read at least Perl-related notices before updating from previous snapshot.

General system changes

We performed migration from GCC 4.7.4 to GCC 4.8.3. New packages are compiled with GCC 4.8.4.
Perl 5.10 is not compulsory now. All perl dependencies were updated to use Perl 5.16 or don't care about perl version. This includes changes to illumos-gate. /usr/perl5/bin/perl now is mediated symlink, pointing to perl 5.16 by default. However, if you would like to compile unmodified illumos gate, you should switch it back to perl 5.10:

pkg set-mediator system-perl=5.10

Perl 5.10 modules which are required to compile illumos-gate are preserved. Other perl 5.10 modules are removed. If you have perl-510 installed on your system and don't need it, you can just remove runtime/perl-510, runtime/perl-510/extra and runtime/perl-510/module/sun-solaris.
During perl update version of perl-516/module/sun-solaris was DECREASED from 5.11 to 0.5.11 for consistency with other illumos-gate provided software. So if you have installed it, please, remove it BEFORE updating to new Hipster snapshot.
Perl 5.16 was recompiled without -Dperl_static_inline="static" flag to avoid creating one more patch for illumos-gate (this can affect perl ABI). So, if you had self-compiled perl modules, possibly, you have to recompile them.
Also, for consistency we renamed library/perl-5/xml-parser@5.12.1-0.151.1.8.1 to library/perl-5/xml-parser@2.41. So, if you have it installed (and every desktop system has it), please update it to library/perl-5/xml-parser@2.41,5.11-2014.1.2.0 (pkg update library/perl-5/xml-parser@2.41,5.11-2014.1.2.0). Also you'll have to update desktop/system-monitor/gnome-system-monitor if you have it installed.

Development tools and compilers

• OpenJDK was updated to 1.7.60. GCC 4.7 was updated to 4.7.4. GCC 4.8.3 and Clang 3.4 were added.
• GDB was updated to 7.6.2
• Mercurial was updated to 3.0.2
• MPICH was updated to 3.1.2
• ant was updated to 1.9.3
• python 2.7 was updated to 2.7.8

Common software

• bash was updated to fix latest bash CVEs, GNU coreutils were updated to 8.22, CUPS updated to 1.4.8, doxygen updated to 1.8.7, GNU grep was updated to 2.20, gnupg to 2.0.25
• Several packages to work with numerical data were added (datamash, hdf5)

Server software

• A lot of packages were updated, including apache 2.4, apache 2.2, nginx, php 5.4, php 5.5, squid 3.1, tomcat 6.0, postgresql 8.4/9.3
• Ldap backend was enabled for OpenLDAP server.
• Illumos-gate provided wu-ftpd was replaced with proftpd 1.3.5
• Barman was updated to 1.3.3
• NTP was updated to 4.2.7p453
• Bind was updated to 9.9.6

Desktop software

• Firefox and Thunderbird were updated to 24.8.1
• Packages from sic-team incorporation (notably, Mozilla nss and nspr) were updated.
• glib-networking, webkit were added
• Experimental package for Apache OpenOffice 4.1.1 was added. There is known issue with it - it can't create ODF documents. We are working on it.
• ntfsprogs were updated to 2014.2.15 version
• DJVU support was added to evince
• Gnome-pilot and Gnome-pilot-link packages are obsolete now as upstream is dead.

Also there were lot of other small fixes.

As always we ship the newest illumos-gate version, so you can leverage the great work of illumos developers.

Last time I blogged about Hipster I shared some plans. From things which were planned but not made I have to point to integration of new Perl version and 64-bit Perl version. Also we didn't add vlc and other multimedia software to oi-userland because of legal issues. We still miss fsvs. However, I hope we'll find decision for this problem soon.

Now I'd like to share my current plans, the things I'm interested in and the things I'm working on.

First of all, I'd like to look at OpenOffice issue with ODF files. It seriously bugs me, but I don't know if and when I'll be able to solve it.

One thing which annoys me in OpenIndiana desktop is lack of text search in gnome terminal. I have prepared update to gnome-terminal 2.32. It's coming soon.

Also I'd like to look at migration of some XNV components to oi-userland. This should allow us to enhance their packaging (so that it better correlates with oi-userland build system) and later I hope to update it.

I'm seriously annoyed by our out-of-date sendmail, coming from illumos-gate. I'd like to see postfix as a first-class OI MTA. Of course, we'll also need dovecot and perhaps some other mail server software.

Finding security patches for our squid 3.1 is becoming harder. Perhaps we have to update it to recent 3.4 version and also receive SMP support as a pleasant triffle.

PostgreSQL 9.4 release is coming. I want to have it in the gate. On other hand, I think we should remove PostgreSQL 8.4 once 9.4 is landed. PostgreSQL 8.4 has already reached its EOL.

PHP 5.6 is already out. I think, we'll get it soon. As always I hope to use EveryCity's work :)

Our Ruby is amazingly old. We have to migrate to at least ruby 1.9. Ruby 1.9 package is ready and just waiting for official snapshot announcement

I'd like to see some binary blobs disappearing from OI Hipster - like cpp (we can use Joyent version), also I hope once we'll have open source gcc-compiled dmake alternative.

Adding dpkg/apt tools and support for DilOS zones in OI seems attractive and perhaps even necessary thing if we want to better collaborate with DilOS on userland packages.

rude hack to proceed on zoneadm attach error

I have two zones on my build host. One is build zone, serving IPS repository for the whole host,  so I have to be very careful with its updates and another - test one. I wished to update test zone, so issued

# zoneadm -z zonename detach
# zoneadm -z zonename attach -u

and noticed that I detached build zone with repository. zoneadm launched pkg, pkg worked for a while, and then it said:

Evaluation: Packages in zone zonename are out of sync with the global zone. To proceed, retry with the -u flag. 
Result: Attach Failed.

What a hell! NGZ and GZ were in sync... At least both of them were latest /hipster. So I removed all publishers served by this zone from host and zone config.  The same reaction.
After grepping for this message in  /usr/lib/brand/ipkg/attach I found that this message is produced in  the following part of the script ($m_need_update message).

#
# Bring the ngz entire incorporation into sync with the gz as follows:
# - First compare the existence of entire in both global and non-global
#   zone and update the non-global zone accordingly.
# - Then, if updates aren't allowed check if we can attach because no
#   updates are required. If we can, then we are finished.
# - Finally, we know we can do updates and they are required, so update
#   all the non-global zone incorporations using the list we gathered
#   from the global zone earlier.
#

if [[ -z $gz_entire_fmri && -n $ngz_entire_fmri ]]; then
        if [[ $allow_update == 1 ]]; then
                LC_ALL=C $PKG uninstall entire || pkg_err_check "$f_update"
        else
                log "\n$m_need_update" "$ZONENAME"
                EXIT_CODE=$ZONE_SUBPROC_NOTCOMPLETE
                exit $EXIT_CODE
    fi
fi


if [[ $allow_update == 0 ]]; then
        LC_ALL=C $PKG install --accept --no-refresh -n $incorp_list
        if [[ $? == 0 ]]; then
                log "\n$m_complete"
                EXIT_CODE=$ZONE_SUBPROC_OK
                exit $EXIT_CODE
        else
                log "\n$m_need_update" "$ZONENAME"
                EXIT_CODE=$ZONE_SUBPROC_NOTCOMPLETE
                exit $EXIT_CODE
        fi
fi

I've just commented all these checks out and after this zone attach succeed. Zone is working now and I'm glad I don't have to reinstall my build zone....

OpenIndiana /hipster progress and my long TODO list...

There is always a lot of things to do. Of course I'd like to see OpenIndiana a modern universal OS, but it's still a long way to go. We've made a lot of work in the last two monthes.
1) Thanks to Adam Stevko and  Andrzej Szeszo we have a modern IPS version. Unfortunately, IPS GUI has gone, but as it was dropped even by upstream , it's not a big loss. We got ability to generate dependencies on mediated links, improved speed of operations and I hope fixed a number of bugs.
2) Andrzej Szeszo has updated NVidia drivers to version 331.20
3) Andrzej Szeszo has finally proposed a reasonable package versioning scheme, which allows to do /hipster more stable and predictable. I hope we'll adopt it soon.
4) I continued my work on JDS conversion and updates: we received Python 2.7, a lot of Python modules and several GUI applications (totem, rhythmbox, fbreader) were moved from JDS or added to oi-userland. The most noticable additions are OpenJDK 1.7.45, Firefox 17esr and Bacula 5.2.13.
I know, there should be some bugs there, but I hope we'll deal with them soon.

Now I'm interested in several issues:
1) I'm currently working on Thunderbird update to 24.2.0. I hope to finish in about 10 days if there are no any surprises.
2) The second thing I'd like to do is to work a bit on Python 2.7 modules so we'll be able to turn on compilation of Python 2.7 components (I mean setuptools, cherrypy,  mysql, psycopg and so on) by default. As I'm on Python I would deprecate Python 2.4, 2.5. It also worth investigating if IPS could use Python 2.7.
3) I'd like to look on PHP 5.5. Jon Tibble has recently added PHP 5.5 to ec-userland. We could base oi-userland component on this version.
4) I think I should finally build, test and integrate brasero to userland (Ken Mays has prepared patches and Makefile long ago)
4) I would really like to move to userland some more things from oi-build, first of all, kvm and qemu, but I don't think I have a hardware necessary to test it.
5) Also I'd like to look at perl - what do we need to allow Perl 5.10 go away? We definately need 64-bit Perl version. It worth to look at Perl update. One interesting part is current work of Andrew Stormont on https://www.illumos.org/issues/3900 which can allow us to use Perl 5.16 for building illumos-gate.
6) I also want to see apache 2.4 in the gate ( https://www.illumos.org/issues/4405 ). However, I currently don't have a clear view if it can coexist with apache 2.2. The main issue I see now is php module - php 5.4 component currently doesn't allow to build apache php module for several apache versions.
7) And every operating system would like to be a decent desktop. I'd like to see fusefs and vlc out of the box....

It's a long list, I don't know how long it will take to implement everything, but I'm going to do at least something :)

beadm destroy error

Today when I was trying to destroy old boot environment, I got strange error:

# beadm destroy oi-hipster-2013-08-06
Are you sure you want to destroy oi-hipster-2013-08-06?
This action cannot be undone (y/[n]): y
be_destroy_callback: failed to destroy data/zones/build/ROOT/zbe: dataset is busy
be_destroy: failed to destroy BE data/zones/build/ROOT/zbe
be_destroy_zone_root_callback: failed to destroy zone root data/zones/build/ROOT/zbe
be_destroy_zone_roots: failed to destroy zone roots under zonepath dataset data/zones/build: dataset is busy
be_destroy_zones: failed to find and destroy zone roots for zone build
be_destroy: failed to destroy one or more zones for BE oi-hipster-2013-08-06

I didn't want to destroy zone root FS accidentally, so was a bit scared. However, after looking at it a bit longer, I found out, that zone root FS has several manual ZFS snapshots. After destroying snapshots I was able to destroy BE.

elfdump -a in Solaris

Solaris userland is rather specific... A lot of utilities misses convenient options from GNU/BSD analogs. E.g., we don't have "elfdump -a" here... As always, a bit of scripting solves this problem:

elfdump -c /bin/ls |grep Header |awk ' { print $4; }'  |xargs -n 1 -I '{}' elfdump -N '{}' /bin/ls 

Illumian is here...

Today I've tried the first Illumian version. This is illumos-based Nexenta OS. Just a few remarks.
What I liked:
1) VTs finally work in illumos installer, it's good to have a possibility of going to text console and checking installer's log.
2) It seems, the installer can install system on mirror pool. C'est beau.
3) APT... I finally shouldn't learn one more package system and apt is IMHO faster then IPS.
4) It's still Solaris: you have DTrace, ZFS, projects, fair share scheduler...
5) git change number in place of OS version looks cool :)

# uname -a 
SunOS oi-test 5.11 4cece89cac3e i86pc i386 i86pc Solaris

What I disliked:
1) Zones don't work:

root@oi-test:~# zoneadm -z  myzone install
sh[1]: exec: /usr/lib/brand/ipkg/pkgcreatezone: not found

And Solaris without zones is a very strange thing...
2) /usr/gnu/bin in front of path... How can you use GNU chmod with ZFS ACL?
3) Soft, soft, soft... Where are you?

root@oi-test:~# apt-cache pkgnames |grep postgres

4) apt-clone doesn't work

This is just a first glance on this OS. It is very raw and is still in development. I doubt that calling this release 1.0 was a good idea. It seems, we will have a production-ready OS not sooner then in half of year, but still... I wonder, what Illumos-based OS will be first to reach production quality: OI or Illumian? It seems OI is in better form nowadays, but the fact is that OI team has failed to create a stable release in about 1.5 years.

Adding vdev to raidz pool

There is one fundamental flaw in raidz ZFS pools: you can't add devices to raidz (as opposed to usual raid5). So, could we do anything to expand our pool without full rebuilding? Yes, if we are ready to sacrifice one more disk.
From zpool man page:

A pool can have any number of virtual devices at the top of the config‐
uration (known as "root vdevs"). Data is dynamically distributed across
all top-level devices to balance data among  devices.  As  new  virtual
devices are added, ZFS automatically places data on the newly available
devices.

So, to add some capacity to our pool, we can add one more raidz to it. Let's look at this process. Firstly, let's create test pool from three "disks":

freebsd# foreach i ( 1 2 3 4 5 6)
foreach? dd if=/dev/zero of=/tmp/disk$i bs=100M count=1
foreach? end
freebsd# zpool create testpool raidz /tmp/disk1 /tmp/disk2 /tmp/disk3

Now, let's see what we have:

freebsd# zpool status testpool
  pool: testpool
 state: ONLINE
 scrub: none requested
config:

        NAME            STATE     READ WRITE CKSUM
        testpool        ONLINE       0     0     0
          raidz1        ONLINE       0     0     0
            /tmp/disk1  ONLINE       0     0     0
            /tmp/disk2  ONLINE       0     0     0
            /tmp/disk3  ONLINE       0     0     0

errors: No known data errors
freebsd# zpool list testpool
NAME       SIZE   USED  AVAIL    CAP  HEALTH  ALTROOT
testpool   286M   156K   286M     0%  ONLINE  -
freebsd# zfs list testpool
NAME       USED  AVAIL  REFER  MOUNTPOINT
testpool  95.9K   158M  28.0K  /testpool

Now let's expand this pool:

freebsd# zpool add testpool raidz /tmp/disk4 /tmp/disk5 /tmp/disk6

So, we recieved the following configuration:

freebsd# zpool status testpool
  pool: testpool
 state: ONLINE
 scrub: none requested
config:

        NAME            STATE     READ WRITE CKSUM
        testpool        ONLINE       0     0     0
          raidz1        ONLINE       0     0     0
            /tmp/disk1  ONLINE       0     0     0
            /tmp/disk2  ONLINE       0     0     0
            /tmp/disk3  ONLINE       0     0     0
          raidz1        ONLINE       0     0     0
            /tmp/disk4  ONLINE       0     0     0
            /tmp/disk5  ONLINE       0     0     0
            /tmp/disk6  ONLINE       0     0     0

errors: No known data errors
freebsd# zpool list testpool
NAME       SIZE   USED  AVAIL    CAP  HEALTH  ALTROOT
testpool   572M   210K   572M     0%  ONLINE  -
freebsd# zfs list testpool
NAME       USED  AVAIL  REFER  MOUNTPOINT
testpool   114K   349M  28.0K  /testpool

Let's compare this to raidz from 6 disks:

freebsd# zpool create testpool raidz /tmp/disk1 /tmp/disk2 /tmp/disk3 /tmp/disk4 /tmp/disk5 /tmp/disk6
freebsd# zpool status testpool
  pool: testpool
 state: ONLINE
 scrub: none requested
config:

        NAME            STATE     READ WRITE CKSUM
        testpool        ONLINE       0     0     0
          raidz1        ONLINE       0     0     0
            /tmp/disk1  ONLINE       0     0     0
            /tmp/disk2  ONLINE       0     0     0
            /tmp/disk3  ONLINE       0     0     0
            /tmp/disk4  ONLINE       0     0     0
            /tmp/disk5  ONLINE       0     0     0
            /tmp/disk6  ONLINE       0     0     0

errors: No known data errors
freebsd# zpool list testpool
NAME       SIZE   USED  AVAIL    CAP  HEALTH  ALTROOT
testpool   572M   147K   572M     0%  ONLINE  -
freebsd# zfs list testpool
NAME       USED  AVAIL  REFER  MOUNTPOINT
testpool   112K   443M  34.9K  /testpool

So, we lost more then 21% of space, but expanded our pool without downtime. Firstly, the lost of more then 20% space suprised me, but 20% was expectable (in second case only 5 disks, in first - 4, so 20% is the difference).
Let's see, where did 1 percent go. 443 MB is useful in second case, it means about 11.4 MB (100 /*disk size*/ - 443/*useful space*/ / 5 /*useful disks*/) metadata per disk. In first case we have 349 MB. It is provided by two pools with 2 useful disks in each. So, wasted space per disk is 12.75 MB (100 - 349/2/2). It seems, in this configuration we have a bit more metadata.

KVM is ported to Illumos

Great news. KVM is ported to Illumos by Joyent. Currently only Intel CPUs are supported. I crave for KVM on OpenIndiana with support for AMD CPUs...

Two useful illumos-related links

I've just found two interesting resources:

• planet.illumos.org site - it's always interesting to know what is happening in opensource Solaris. I'm still looking at this project. We'll hardly make something like OpenIndiana our main platform, but for me it's a preferrable alternative to Linux where FreeBSD is not the best sollution (e.g. I'd prefer to use something Solaris-based for hardly loaded file server because of some stability issues with ZFS in FreeBSD and we still should decide what to do with our existing SXCE-based terminal servers). And planet.opensolaris.org became very quiet now..


• src.illumos.org - sometimes you just have to look at some subsystem to understand what has gone wrong. Web access to code is useful thing to have for such cases.
  

And I would like to play with stable OpenIndiana release. In particular it's interesting to see how do it deal with multipath on our EMC Clarion storage.

Looking for virtualization solution

Now I'm looking something to replace VMware ESXi... So far I looked at XCP (xen cloud platform). It has issues running OpenIndiana, so it was not a best choice for me. Then I looked at OpenNode. But satisfactory WebUI was available only for latest beta version, and I didn't manage to make it working. Maybe I should look at Aeolus Project? When I return to this task, I'll give it a try. Just for now I'm going to deploy new PostgreSQL server in old proved FreeBSD jailed environment. At least its overhead and complexity is minimal...

Should we wait for a first stable OpenIndiana release?

I'm excited: it seems OpenIndiana developers consider 148 build stable enough to provide release based on b148-b149 (as I understood, it will be based on latest freely available code from ONNV repository with several fixes and 148-149 builds of other consolidations). Security updates may be available for several core network services (Apache, PostgreSQL and other) for a period of about 6 months.
Long life to OpenIndiana!

Next great step planned for several next builds is moving to Illumos base, which can shake stability, so, it seems, there will be no possibility to make a "stable" release for several months after this serious shift.