Bug 28922 - Replace ntp with ntpsec
Summary: Replace ntp with ntpsec
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Installer (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: release_blocker enhancement
Target Milestone: Mageia 10
Assignee: Mageia tools maintainers
QA Contact:
URL:
Whiteboard:
Keywords: FOR_RELEASENOTES10, IN_RELEASENOTES9
Depends on:
Blocks:
 
Reported: 2021-05-14 23:25 CEST by David Walser
Modified: 2024-01-21 14:22 CET (History)
7 users (show)

See Also:
Source RPM: drakxtools
CVE:
Status comment:


Attachments

Description David Walser 2021-05-14 23:25:28 CEST
Fedora 34 replaced classic NTP with a more secure replacement:
https://fedoraproject.org/wiki/Changes/NtpReplacement

Note that, if importing this package from Fedora, it will need quite a bit of work to adapt it to Mageia.

Ideally it would be nice to allow people to get out of the business of editing the packaged ntp.conf, and support using /etc/ntp.d like upstream does.  Our installer and drak tools would have to be adapted if we make this change.
David Walser 2021-05-14 23:25:39 CEST

Target Milestone: --- => Mageia 9
Version: 8 => Cauldron

Comment 1 David Walser 2021-05-15 01:47:35 CEST
(In reply to David Walser from comment #0)
> Ideally it would be nice to allow people to get out of the business of
> editing the packaged ntp.conf, and support using /etc/ntp.d like upstream
> does.  Our installer and drak tools would have to be adapted if we make this
> change.

According to Ubuntu, chrony can do this now too:
"Chronyd’s configuration can now be fragmented. Please see
/etc/chrony/conf.d/README for more information.
NTP sources can be specified in /etc/chrony/sources.d. Please see
/etc/chrony/sources.d/README for more information."

https://discourse.ubuntu.com/t/hirsute-hippo-release-notes/19221
Comment 2 Lewis Smith 2021-05-15 20:02:37 CEST
'ntp' has no fixed maintainer, and given the wider nature of this request, assigning this globally.

Assignee: bugsquad => pkg-bugs

Comment 3 Jean-Pierre Aubin 2022-08-09 17:39:29 CEST
UP
Neoclust and I are working on replacing ntp with ntpsec.

CC: (none) => jean-pierre

Comment 4 David Walser 2023-04-13 16:53:47 CEST
Indeed this was handled last August it looks like.  Updated to 1.2.2 in January by me, and spec file fixes made by David Geiger in March.

TODO: document in Mageia 9 release notes
TODO: adapt Mageia installer to wrote to ntp.d and chrony/sources.d instead of ntp.conf or chrony.conf

Priority: Normal => release_blocker

Comment 5 Morgan Leijström 2023-06-11 01:31:44 CEST
(In reply to David Walser from comment #4)
> TODO: document in Mageia 9 release notes

-> Added keyword to this bug now.

> TODO: adapt Mageia installer to wrote to ntp.d and chrony/sources.d instead
> of ntp.conf or chrony.conf

-> now setting to installer, assigning tools

Assignee: pkg-bugs => mageiatools
Component: RPM Packages => Installer
Keywords: (none) => FOR_RELEASENOTES9
CC: (none) => fri
Source RPM: ntp-4.2.8p15-1.mga8.src.rpm => drakxtools

Comment 6 Marc Krämer 2023-06-16 10:57:52 CEST
so this bug is fixed???

CC: (none) => mageia

Comment 7 Morgan Leijström 2023-06-16 12:01:27 CEST
I guess the TODO for installer in Comment 4 need to be done.
And then release notes.
Nicolas Lécureuil 2023-06-17 17:10:40 CEST

CC: (none) => mageia
Priority: release_blocker => High

David Walser 2023-06-17 18:53:55 CEST

Priority: High => release_blocker

Comment 8 Martin Whitaker 2023-06-24 09:16:29 CEST
(In reply to David Walser from comment #0)

This seems the only thing left to do:

> Ideally it would be nice to allow people to get out of the business of
> editing the packaged ntp.conf, and support using /etc/ntp.d like upstream
> does.  Our installer and drak tools would have to be adapted if we make this
> change.

Why is this a release blocker?

IMO it is too late to make nice-to-have changes to the installer.

CC: (none) => mageia

Comment 9 David Walser 2023-06-24 15:20:26 CEST
At the very least, the release notes still need to be updated.  As for the configuration change, no it's not absolutely necessary to be done now, but we have a good track record of kicking cans like this down the road and never actually handling them.  It should be a relatively easy change.
Comment 10 Martin Whitaker 2023-06-24 16:44:31 CEST
It may be a relatively easy change, but any change to the installer requires some hours of work to rebuild everything and test it thoroughly. But if you can find a willing volunteer before I start building the RC ISOs, fine. Given that nobody has cared enough to do the work in the 2 years since you created this bug report, I won't hold my breath.
Comment 11 David Walser 2023-06-24 17:49:13 CEST
I understand where you're coming from, but I think that's why these things tend to not get done.  During the vast majority of the development cycle, most of us just worry about updating packages and don't even look at these bugs, then at the last minute when we're trying to finalize a release, the bugs do get looked at and punted because we don't think we have time to fix them.
Comment 12 Morgan Leijström 2023-06-24 21:38:15 CEST
We need to get mga9 out, we can not keep some bug hostages.

If this from user perspective works like ntp did before (but is more secure) i think it is good enough.
Comment 13 David Walser 2023-06-25 18:23:48 CEST
Real nice Morgan.
Comment 14 Morgan Leijström 2023-07-17 16:44:39 CEST
Looks like we kick this can further to Mageia 10.

- If not, revert my flag change and get it done :)

When that is decided, what should we write in release notes for mga9?

Target Milestone: Mageia 9 => Mageia 10
Priority: release_blocker => High

Comment 15 David Walser 2023-07-17 19:15:40 CEST
At this point all that needs to be written is that ntpsec has replaced ntp.

Priority: High => release_blocker

Comment 16 Morgan Leijström 2023-07-20 09:40:15 CEST
(In reply to David Walser from comment #15)
> At this point all that needs to be written is that ntpsec has replaced ntp.

How is this handled during upgrade?

Will an installed mga8 ntp be kept or replaced?
Comment 17 David Walser 2023-07-20 14:47:56 CEST
Replaced.
Comment 18 Morgan Leijström 2023-07-20 20:13:03 CEST
Thanks

Now in
https://wiki.mageia.org/en/Mageia_9_Release_Notes#Replaced_on_upgrade

Keywords: FOR_RELEASENOTES9 => IN_RELEASENOTES9

Comment 19 Chris Denice 2023-08-25 15:45:07 CEST
I am landing late here, but since a long while, I have been using "chrony" on Mageia. So a drop of ntp would have been fine too.
We could also suggest its usage in the Mga9 release notes?

CC: (none) => eatdirt

Comment 20 Morgan Leijström 2023-08-25 16:47:42 CEST
Do you mean extending this note:

 ntp is replaced with ntpsec, mga#28922, for security.

to become:

 ntp is replaced with ntpsec, mga#28922, for security.  An alternative is to use chrony.

?
Comment 21 Chris Denice 2023-08-28 15:05:56 CEST
Yes, that would be good!
Comment 22 Morgan Leijström 2023-09-02 13:07:32 CEST
Updated rel notes
Comment 23 w unruh 2024-01-21 01:27:21 CET
(In reply to Morgan Leijström from comment #22)
> Updated rel notes

Except that never happened apparently. The release notes just say
"Replaced on upgrade ntp is replaced with ntpsec, mga#28922, for security."

CC: (none) => unruh

Comment 24 katnatek 2024-01-21 03:57:37 CET
(In reply to w unruh from comment #23)
> (In reply to Morgan Leijström from comment #22)
> > Updated rel notes
> 
> Except that never happened apparently. The release notes just say
> "Replaced on upgrade ntp is replaced with ntpsec, mga#28922, for security."

Why did you say that?

urpmq -pi ntpsec
Name        : ntpsec
Version     : 1.2.2
Release     : 5.mga9
Group       : System/Servers
Size        : 1595298                      Architecture: x86_64
Source RPM  : ntpsec-1.2.2-5.mga9.src.rpm
URL         : https://www.ntpsec.org/
Summary     : NTP daemon and utilities
Description :
NTPsec is a more secure and improved implementation of the Network Time
Protocol derived from the original NTP project.

urpmq --conflicts ntpsec
ntp
ntp-perl
ntpdate
Comment 25 w unruh 2024-01-21 06:00:15 CET
Because I looked at what was apparently an old version of the release notes, where the suggestion to perhaps use chrony was not there. Looking again at the official release notes, that clause is there. Sorry I did not notice I was looking at an old version of the notes.
Morgan Leijström 2024-01-21 14:22:33 CET

Keywords: (none) => FOR_RELEASENOTES10


Note You need to log in before you can comment on or make changes to this bug.