fatal error while updating XOA (installed from source)

laurentm

I'm running XCP-NG 8.3 Beta (with last updates availables) and when I try to update XOA (installed from source), I have this error:

fatal: unable to access 'https://github.com/vatesfr/xen-orchestra/': server certificate verification failed. CAfile: none CRLfile: none

EDIT: same update with XCP-NG 8.2 LTS works perfectly

Danp

Hi,

What are the exact steps that you are running to upgrade your XO from sources VM?

Dan

laurentm

@Danp

cd /root/XenOrchestraInstallerUpdater/

 ./xo-install.sh

Welcome to automated Xen Orchestra install

Following options will be used for installation:

OS: Ubuntu 22
Basedir: /opt/xo
User: root
Port: 80
HTTPS: false
Git Branch for source: master
Following plugins will be installed: all
Number of previous installations to preserve: 3
Node.js and yarn auto update: true

Errorlog is stored to /root/XenOrchestraInstallerUpdater/logs/xo-install.log-202403021931 for debug purposes

Depending on which installation is chosen:

Xen Orchestra configuration will be stored to /root/.config/xo-server/config.toml, if 2a74b636-cb2b-e63d-f4da-76aa3789d6d5you don't want it to be replaced with every update, set CONFIGUPDATE to false in xo-install.cfg
Xen Orchestra Proxy configuration will be stored to /root/.config/xo-proxy/config.toml. Config won't be overwritten during update, ever
-----------------------------------------

1. Install
2. Update
3. Rollback
4. Install proxy
5. Update proxy
6. Exit




**choice 2 is selected**


: 2
[info] Installing nodesource repository

[info] Checking current node.js version

[ok] node.js version already on 18, checking updates

[info] Fetching Xen Orchestra source code


[fail] Something went wrong, exiting. Check /root/XenOrchestraInstallerUpdater/logs/xo-install.log-202403021931 for more details and use rollback feature if needed

Danp

Is the issue repeatable on 8.3? Maybe @stormi would have some ideas.

laurentm

@Danp I have only one XOA running on XCP-NG 8.3, the other one is on 8.2 and had no issues. I do not know if others 8.3 users have success or not.
The previous updates on 8.3 had no problems.

Both XOA VMs are build from source on Ubuntu server 22.04 LTS with 16 GB ram
and 4 vCPU.

Hardware:

DELL Poweredge R820 quad cpu Xeon E4610 for XCP-NG 8.3
DELL Poweredge R650 two cpu Xeon 4309Y for XCP-NG 8.2.

HeMaN

@laurentm

The update of Xen Orchestra from sources (not the same as XOA) is running completely inside the VM and independent of xcp-ng.
If the proces is complaining about missing certificates I would rather suspect the OS of the VM rather than the hypervisor.

If you migrate the vm from 8.2 to 8.3 does it also show that error when updating (or use a snapshot)?

laurentm

@HeMaN

The XOA running on 8.3 was a clone of the XOA running on 8.2 and has been fine for more than four months. It still works, just the last update cannot be performed.
The VM OS is the same Ubuntu 22.04 LTS with the latest updates.

I cannot right now update the 8.2 because it is used by 100+ VMs.

stormi

As @HeMaN, I don't think this should be affected by the hypervisor. Are you sure there's nothing different network-wise or firewall-wise for this VM? Sometimes firewalls break HTTPS connections.

laurentm

@stormi

Thanks for your answer.

I'll give a try later, bypassing the PFBlocker module of the router.

Github is not currently on any blacklist, but I block Digital Ocean and some others who host many attackers.