spacewalk-java not updating on any satellite servers, not available in any downloadable satellite channel (disconnected satellite servers)

Latest response

I'm curious if anyone else has faced this issue. It will likely only affect those who have satellite servers that are disconnected and are not facing the public internet.

We have eight Red Hat satellite servers, all disconnected. We manually download Satellite server iso channel dumps provided by Red Hat (links below).

We have discovered that the rpm "spacewalk-java" is not in any of the channels we download manually. Note, based on our discussions with Red Hat, this is apparently unrelated to the oracle-java updates that are in a different channel.

I added two screen shots, the RHEL6/Satellite 5.6 spacewalk-java 2.0.2-46.el6sat.noarch rpm download page leads to this link for it's channel which claims it is part of the Red Hat Enterprise Linux Server parent channel see screenshot


I did not include the screen shots for RHEL 5/Satellite 5.5 as i did above, but the link for the spacewalk-java-1.7.54-100.el5sat.noarch.rpm
rpm here
leads to this link for it's channel which claims it is part of the channel "Red Hat Enterprise Linux (v. 5 for 64-bit x86_64)"

However, the rpms are not in our satellite servers as part of any channels we download. We have done rpm searches both in the web interface on all eight of our satellite servers, and also did a find command against the rpm repository and could not find the listed rpms below (scroll down), or the current rpm.

Here is what our current Satellite servers have (some are RHEL 5/Satellite 5.5, some are RHEL 6/Satellite 5.6
- RHEL 6/Satellite 5.6
- RHEL6/Satellite 5.6 Current rpm is rpm spacewalk-java-2.0.2-46.el6sat.noarch
- RHEL6/Satellite 5.6 not available in channel dumps - the most current is (as I type this): spacewalk-java-2.0.2-85.el6sat.noarch.rpm

IMPORTANT NOTE: Of course, security is more than mere patches, and that's another discussion. I believe we should keep our satellite servers up to date with security patches (not just this rpm, but I'm focusing on this rpm as an example). We are interested in this because our satellite servers should be updated as much as reasonably possible, since they patch/control hundreds of other servers.

However since the advent of these rpms, updates that are not in the satellite channels have been released for RHEL 5 and 6 satellite running versions 5.5 and 5.6:
RHEL 6/SATELLITE 5.6 spacewalk-java list

spacewalk-java-2.0.2-85.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-81.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-79.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-78.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-71.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-64.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-63.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-62.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-58.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-56.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-50.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-48.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  
spacewalk-java-2.0.2-46.el6sat.noarch  Red Hat Satellite (v5.6 for Server v6 AMD64 / Intel64)  

When we use "yum update spacewalk-java" on our satellite servers, no update is available.
However I found all these versions that exist after our version:
RHEL 5/Satellite 5.5 spacewalk-java list

spacewalk-java-1.7.54-129.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-126.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64) 
spacewalk-java-1.7.54-125.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-124.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-121.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-119.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-115.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-114.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-111.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-108.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64)
spacewalk-java-1.7.54-103.el5sat.noarch     Red Hat Network Satellite (v5.5 for Server v5 AMD64 / Intel64) 

The current base channels for rhel5 and rhel6 are (as I type this today):
* RHEL 6 (x86_64) + EUS + AUS + RHN Proxy/Tools + Supplementary (Base 2013-11-24)
* RHEL 5 Client/Server (x86_64) + EUS + AMC + RHN Proxy/Tools + Supplementary (Base 2014-10-15)

The current Incremental channels (as I type this today) are:
* --RHEL 5.11 just released, no incremental channels -yet- for RHEL 5.11
* RHEL 6 (x86_64) + EUS + AUS + RHN Proxy/Tools + Supplementary (Incremental 2013-11-24:2014-09-07)

That is where we download our iso channels, but have not found the spacewalk-java rpm in that or any other downloadable channel.

While we can certainly download the rpm manually, it would be better if it could be included in the Satellite Server product's channels for download. This way that rpm and it's subsequent updates could be available for patching satellite servers into an existing channel so that we do not have a one-off rpm we have to consider when doing updates.

Our goal is to find the iso channel dump so we can update it with our normal patches.

My question, does anyone else have an outdated version of this rpm on their satellite server? the most current versions are (as I type this today)
- RHEL 6, satellite 5.6 - spacewalk-java-2.0.2-85.el6sat.noarch.rpm
- RHEL 5, satellite 5.5 - spacewalk-java-1.7.54-129.el5sat.noarch.rpm

we are hoping to be able to have these available in subsequent channel dumps we download. We acquire our updates for all servers through the satellite channel dumps.

I'd appreciate feedback from anyone reading this to perform these commands and see if they too have an outdated rpm spacewalk-java as well.

rpm -q spacewalk-java
rhn-schema-version  

This can also include other rpms that are related to the satellite server product itself, that may not be in current channel dumps, to include those I have not listed above that (again) would not be in a current channel dump

Thanks much

Responses

Hello Remmele,
Red Hat Satellite 5.x Channels are child Channels of the respective Red Hat Enterprise Linux base Channels. Spacewalk-java packages reside within the Satellite 5.x Channel, not the RHEL Channels. The Channel Dumps contain content for Satellite to serve its client systems, which does not include Satellite itself.

You can download the spacewalk-java packages from the Satellite Channels such as https://rhn.redhat.com/rhn/channels/PackageList.do?filter_string=spacewalk-java&cid=18952 (latest being spacewalk-java-2.0.2-85.el6sat.noarch as you mentioned).

If you'd like to file a feature request for having Satellite Channel content itself be in downloadable ISO format, please feel feel free to contact support.
Thanks,

Hi Xixi,

Thanks for your input. We did contact support. They asked us for more detail, and I suspect your input will be very useful. We wanted to see if this impacted anyone else in the community who a) also downloads channel dumps b) has disconnected satellite servers and c) may also have an out-of-date spacewalk-java rpm d) and who might actually read this...

While security is of course more than mere patches, we believe since the satellite server does control hundreds of systems, it should have the most current patches for rpms.

We have put in a feature request on this, but the engineer who contacted us said they wanted more data, we appreciate your input.

Kind Regards,

I did some research and found https://access.redhat.com/solutions/43122 initially resolved the issue.

I have submitted a feature request along with another customer I know in a case with Red Hat.

What makes me pound my head over this is I discovered the spacewalk-java rpm that comes with the satellite installation never gets updated (at least for disconnected satellite owners who download iso channel dumps).

This week I checked within the satellite installation iso named "satellite-5.6.0-20130927-rhel-6-x86_64.iso" and it contains the original "spacewalk-java" rpm that never gets updated with any downloadable channel dump from Red Hat.

All four of my satellite servers are disconnected, so I routinely download and ingest the ISO channel dumps from the location at this link (scroll down at that page, click on "base" or "incremental").

This caused serious repository creation issues cited in the Red Hat Solution 43122, along with not having the security patches that were needed for that rpm because we never knew to download it separately.

I find it hard to believe that such an important rpm as spacewalk-java is never part of any downloadable ISO channel dump to update disconnected satellite servers.

Now that we know about this, we manually download and apply at least that rpm, but I haven't had a chance to check the other collection of rpms that are part of the original satellite iso named satellite-5.6.0-20130927-rhel-6-x86_64.iso" (MD5: 9684d5f91b91997a5c913ddab653de30). This matter also applies for satellite 5.5 for it's version of spacewalk-java.

I have discovered this issue still is relevant for Satellite 5.7. We have a case open with Red Hat on the matter. This affects all of our disconnected satellite servers. (orphaned spacewalk-java-* rpms not in any downloadable channel at the Red Hat Customer Portal).

Additional Clarification:

For disconnected Satellite servers, Red Hat had to create a channel dump for the specific version (5.6 or 5.7) Satellite server. We had to download it through the case we created with them on this. This translates to these rpm packages not being commonly available to (at least) those who rely on ISO channel dumps (base and incremental channels). Our vulnerability detection servers were the first and only method we first determined our spacewalk-java-* rpm collection on the satellite servers was out of date.

If anyone else has 5.6 or 5.7 Satellite servers, they should contact Red Hat for the spacewalk-java-* rpm collection because it is not commonly available through base or incremental ISO channel dumps in the Red Hat Customer Portal.

We also had to ingest the channel, and make a CLONE of the channel, else it would NOT be accessible to our Satellite servers.

Hello again Remmele,
The RFE (BZ #1149697) for providing Satellite Channel content itself via ISO is work-in-progress, and we hope to have an update for you soon.

In the meantime, the packages can be downloaded via Customer Portal or exported from a connected Satellite (which I see support has been helped to provide). There is a use case for disconnected Satellite customers to register and update the Satellite server via itself such as:
1) Download and sync, provided by Red Hat, Satellite channels on the channel dump ISOs for import
2) Customer imports channels
- NOTE: Customer cannot subscribe to those Satellite channels, and concept of activation to get to those channels does not work.
3) Customer clones Satellite channel to the same location as where the Satellite is subscribed to, typically a cloned child channel of an already cloned rhel base channel
4) subscribe to the cloned satellite child channel and keep system up to date.

This is currently outlined in KnowledgeBase Solution https://access.redhat.com/solutions/10952 and official documentation is being QE'd as we speak (Satellite 5.7 doc BZ #1153335).

Regarding incremental Channel ISOs, we currently have an infrastructure issue which has delayed availability of updated ISOs, we hope to have it resolved within the next 48 hours, if not, will let you know. If fixed, it will still take 24+ hours before new incrementals would be published.
Best regards and appreciate your understanding and patience,

Thanks Xixi, we look forward to this being resolved.

We can not set up a self-subscribed public-facing satellite server per the URL you cite at https://access.redhat.com/solutions/10952 - due to compelling reasons we can not place here. Additionally, all eight of our satellite servers are disconnected, and we can not buy another satellite just to resolve the spacewalk-java rpm issue (or even if it was without cost).

The bugzilla you cite I suspect is a separate matter. (Does RFE # 1149697 address the current incremental channel issue - not what we are addressing here - or placing spacewalk-java rpms into an available ISO channel dump?) To separate the issues, we have two cases where we have requested the spacewalk-java collection of RPMs to be part of an existing channel dump commonly available via the Red Hat Customer Portal. So we were requested to put in a Feature Request (which we did last year), and we've documented this in the two separate cases for this for our two separate accounts.

We are already aware of downloading the individual rpms manually through the customer portal, however when we created a case regarding this matter, we were provided a channel of these rpms to ingest into our satellite servers.

I brought up base/incremental channels in this discussion not to address the current dilemma being addressed in the Bug, but to say that it would be great to have the spacewalk-java rpms available in an existing Base/Incremental channel instead of having to either 1) manually download them or 2) Red Hat (who has been) packaging them into an ISO with recurring support cases and then we import them as a channel (we've done this twice).

Since spacewalk-java is an intregal part of the Satellite product, it really should be part of an existing ISO dump instead of having to manually seek and download the rpms manually. The purpose of the channel ISO dumps and the Red Hat Satellite server, and the support given to those with disconnected Red Hat Satellite servers (we are not the only ones with disconnected satellites), is to be able to have the rpms in an iso channel dump and not to have to manually acquire them...

I appreciate the info feedback Xixi, and we recognize the separate issue of incremental channels. However, we only meant to address spacewalk-java rpms in this discussion (and it would be great if spacewalk-java were part of future base/incremental channels, see our feature request cases). I'm available for discussion by phone if needed, I spoke with Paul Lyons today and he has my contact information (and you guys probably have it on file for the cases we have submitted). We will be happy to discuss any details.