| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2023-01-25 | |||
| 10:08:32 | bauzas | and was on the gate before | |
| 10:08:34 | gibi | bauzas: zed will be kicked out of gate by the backport job as it has no commit hash | |
| 10:08:42 | bauzas | gibi: oh shit, you're right | |
| 10:08:46 | bauzas | doing then the hack | |
| 10:09:19 | opendevreview | Sylvain Bauza proposed openstack/nova stable/zed: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871616 | |
| 10:09:23 | bauzas | there ^ | |
| 10:09:28 | zigo | I really don't feel confident pushing the 3 patches I linked above to Gerrit. I'm sure I'll do some mistakes like commit ID and such ... | |
| 10:09:37 | zigo | Can someone else pick them up ? | |
| 10:10:17 | johnthetubaguy | gibi: does that job not run in the check queue? | |
| 10:10:28 | gibi | johnthetubaguy: it is non-voting in check | |
| 10:10:33 | gibi | afaik | |
| 10:10:56 | johnthetubaguy | oh, I see it now: nova-tox-validate-backport https://zuul.opendev.org/t/openstack/build/016594434b19461781e2dbb3688a61cd : FAILURE in 4m 51s (non-voting) | |
| 10:11:03 | gibi | yepp it failed ther nova-tox-validate-backport https://zuul.opendev.org/t/openstack/build/04bf544d0dc44ca48f45ba4d71bb8892 : FAILURE in 5m 45s (non-voting) | |
| 10:12:51 | bauzas | yup, missed that when I rechecked | |
| 10:12:56 | bauzas | I focused on the other failures :D | |
| 10:13:18 | gibi | the important ones :D | |
| 10:13:46 | bauzas | that's two weeks I devoted to upstream | |
| 10:14:03 | bauzas | and despite this, I nearly progressed on my feature by 5%. | |
| 10:14:05 | bauzas | lovely. | |
| 10:14:17 | bauzas | Zuul, I look at you | |
| 10:14:49 | gibi | bauzas: keeping Zuul happy is part of the deal unfortunately :) | |
| 10:15:05 | gibi | maybe you should ask ChatGPT to maintain it for us :D | |
| 10:15:33 | bauzas | that's... dangerous | |
| 10:16:30 | gibi | OK all the patches I know of has +2 +A https://review.opendev.org/q/topic:bug%252F1996188 | |
| 10:16:34 | kashyap | gibi: Even ChatGPT will throw up in the hands and say "it's a Sisphean task" | |
| 10:16:51 | gibi | kashyap: we need better aligned AIs then | |
| 10:16:57 | kashyap | Heh | |
| 10:17:13 | kashyap | And this time-out seems unfortunate :-( https://review.opendev.org/c/openstack/nova/+/870794 | |
| 10:18:11 | zigo | Looks like doing train -> stein is just a refresh of patches... | |
| 10:22:38 | bauzas | zigo: I've quickly read your patches on your server | |
| 10:22:47 | bauzas | why aren't you proposing them upstream ? | |
| 10:23:19 | bauzas | the problem is that I don't know which objects or methods you've touched | |
| 10:24:05 | bauzas | I mean, if you need help on how to propose a series on a stable branch, I can surely offer my help | |
| 10:30:24 | opendevreview | John Garbutt proposed openstack/nova stable/victoria: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871699 | |
| 10:31:26 | opendevreview | John Garbutt proposed openstack/nova stable/ussuri: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871702 | |
| 10:33:25 | johnthetubaguy | ah, thanks gibi, your cut and paste of the topic was faster | |
| 10:35:12 | gibi | johnthetubaguy: I think there is a merge conflict resolution issue in https://review.opendev.org/c/openstack/nova/+/871699 | |
| 10:35:27 | johnthetubaguy | oops, yes | |
| 10:35:46 | johnthetubaguy | I only got as far as pep8 locally | |
| 10:36:02 | johnthetubaguy | fixing that now | |
| 10:36:23 | gibi | affects the stable/ussuri one too | |
| 10:36:32 | johnthetubaguy | yeah, I cherry-picked that down | |
| 10:39:09 | sean-k-mooney | i have not read back but why do we have stable only variants | |
| 10:39:32 | sean-k-mooney | dan had proposed cherry picks already | |
| 10:40:22 | gibi | sean-k-mooney: we want to land them in parallel | |
| 10:40:31 | gibi | sean-k-mooney: and the only way to allow it is to add [stable-only] | |
| 10:40:41 | sean-k-mooney | hum ok | |
| 10:40:44 | gibi | otherwise the backport job will prevent the merge | |
| 10:40:55 | sean-k-mooney | i was going to try and land them in sequence | |
| 10:40:55 | gibi | elodilles: was OK with this from stable :D | |
| 10:41:06 | sean-k-mooney | and just hold other patches until they were merged | |
| 10:41:26 | gibi | sean-k-mooney: johnthetubaguy expressed time sensitiveness and the stable/policy actually allows it for secu patches | |
| 10:41:51 | sean-k-mooney | it does but i didnt tink it warrented it | |
| 10:41:58 | sean-k-mooney | but if other are happy then ok | |
| 10:42:09 | sean-k-mooney | i just wont try and babysit the patches today | |
| 10:42:15 | gibi | at least bauzas, johnthetubaguy, elodilles and myself was OK with it | |
| 10:43:00 | johnthetubaguy | sean-k-mooney: I am curious, why do you think its not urgent enough? | |
| 10:44:03 | sean-k-mooney | form my perspective there is nothign preventing a downstream form merging them once its proposed. and for anyone that ues a release i.e. form pypi its not going to get it to them faster. those that use source builds can use the gerrit version | |
| 10:44:25 | opendevreview | John Garbutt proposed openstack/nova stable/victoria: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871699 | |
| 10:44:35 | sean-k-mooney | i was still expecting them to all merge today or tommorrow without needing to do it in parallel | |
| 10:44:39 | gibi | sean-k-mooney: I assume we will propose a stable release as soon as a stable patch lands | |
| 10:45:29 | sean-k-mooney | i think anyone who is going to deploy that by the end of the week would jsut take the patch and do it them selevs | |
| 10:45:32 | gibi | sean-k-mooney: given the gate speed parallel is lot faster than sequential when we need to do 7 backports | |
| 10:46:05 | sean-k-mooney | the gate is fast if this is the only thing we are merging | |
| 10:46:40 | gibi | gate is unstable regardles of the number of patches on it, also we have no power over how other projects using the gate resources | |
| 10:46:50 | sean-k-mooney | if we are merging things in parallel less so but as i said im fine with it i just dont think we needed it. i was still expecting all these to be merged by tomrrow either ay | |
| 10:47:18 | sean-k-mooney | gibi: i didnt mean other project i ment lets not merge anything that would put these in merge conflict | |
| 10:47:49 | sean-k-mooney | anyway ill leave this to ye since ye have a plan | |
| 10:48:04 | bauzas | sean-k-mooney: I don't disagree with you, and I expressed the fact that we need anyway need to release so those fixes could be eventually helpful | |
| 10:48:11 | gibi | I think the merge conflict is just a small percent of why serial merge would be slower here. It is more like rechecks and waiting for the patch on the newer branch that slow sequential down | |
| 10:48:25 | opendevreview | John Garbutt proposed openstack/nova stable/ussuri: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871702 | |
| 10:48:28 | bauzas | but it occurred from johnthetubaguy that we could rush the things a little bit up | |
| 10:48:52 | bauzas | and eventually I joined the 'rush' team when I saw our stable policy was accepting it | |
| 10:49:05 | sean-k-mooney | we have a second CVE fix with backprots that need review upstream | |
| 10:49:07 | bauzas | sean-k-mooney: just explaining my thoughts journey | |
| 10:49:23 | sean-k-mooney | if we are going to do a release we proably shoudl also merge that with the same speed | |
| 10:49:42 | bauzas | sean-k-mooney: that's understandable, despite that one was pretty nasty | |
| 10:49:53 | bauzas | sean-k-mooney: patches ? | |
| 10:50:07 | sean-k-mooney | looking for them now | |
| 10:50:11 | bauzas | I only remember the former-embargoed one which is now public | |
| 10:50:17 | gibi | https://review.opendev.org/q/topic:bug%252F1981813 | |
| 10:50:22 | gibi | I think sean-k-mooney refers to ^^ | |
| 10:50:28 | gibi | it is a lot less sever though | |
| 10:50:32 | sean-k-mooney | yes | |
| 10:50:50 | sean-k-mooney | we have a downstream deadlien ot have that merged internally by next week | |
| 10:51:04 | gibi | and we have downstream proactive backport too ;) | |
| 10:51:05 | sean-k-mooney | but i would prefer to also have it merged upstream | |
| 10:51:51 | johnthetubaguy | I didn't see that one, yes, that should get some love too. | |
| 10:51:55 | sean-k-mooney | if we are doing a release we should ideally include both or do a second release once both are there | |
| 10:51:57 | bauzas | mmm, OK, I only tho see 'in progress' on ossa | |
| 10:52:09 | bauzas | so I guess that one isn't on mitre | |
| 10:52:37 | bauzas | nevermind me, it is https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37394 | |
| 10:52:52 | bauzas | but yeah, it's a dos | |
| 10:53:00 | bauzas | not a compute exposure | |
| 10:53:11 | sean-k-mooney | preventign the compute agent form stating | |
| 10:53:26 | bauzas | yup, hence the security level | |
| 10:53:39 | sean-k-mooney | from a public cloud perspecivive both are costly in different ways | |
| 10:53:55 | bauzas | we can try to land them at the same pace, but I don't want to wait more than one day if we can't due to them | |
| 10:54:29 | bauzas | sean-k-mooney: I tend to set a different priority on it | |
| 10:54:52 | gibi | I agree to not wait more than a day with a release if the latest cve fix lands | |