| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2023-01-24 | |||
| 16:30:14 | bauzas | elodilles: happy to pass the mic to you | |
| 16:30:22 | elodilles | #info stable branches seem to be unblocked / OK back till wallaby | |
| 16:30:30 | elodilles | #info ussuri and train might be broken ('Could not build wheels for bcrypt, cryptography' errors) | |
| 16:30:43 | elodilles | at least i saw some failures like that ^^^ | |
| 16:30:51 | zigo | Can we talk a little bit about CVE-2022-47951 / OSSA-2023-002 ? That's related: I'm trying to backport the patches up to Rocky... | |
| 16:31:37 | elodilles | rocky is End of Life already from nova perspective | |
| 16:31:44 | bauzas | zigo: if you don't mind, let's discuss this properly in the open discussion | |
| 16:31:48 | zigo | Ok. | |
| 16:32:03 | bauzas | elodilles: thanks for thze summaru | |
| 16:32:06 | gibi | isn't that a private bug we should not talk about publicly yet? | |
| 16:32:09 | bauzas | summary* even | |
| 16:32:14 | bauzas | gibi: this is public now | |
| 16:32:15 | dansmith | gibi: public as of an hour ago | |
| 16:32:18 | bauzas | since 1600UTC | |
| 16:32:23 | gibi | dansmith: ahh, OK then | |
| 16:32:27 | zigo | Since 15:00 UTC | |
| 16:32:44 | bauzas | stupid French TZ which confuses me | |
| 16:33:21 | bauzas | elodilles: damn about ussuri and train, ping me tomorrow if you wish, I could try to look at the problems | |
| 16:33:33 | bauzas | sounds vaguely familiar | |
| 16:33:41 | elodilles | bauzas: ack, thanks, I'll try to look into it, too | |
| 16:33:54 | elodilles | though it's not familiar to me O.o | |
| 16:34:01 | bauzas | I'm pretty sure we had the same issues in the past | |
| 16:34:03 | elodilles | anyway, last but not least: | |
| 16:34:07 | elodilles | #info stable branch status / gate failures tracking etherpad: https://etherpad.opendev.org/p/nova-stable-branch-ci | |
| 16:34:18 | elodilles | i've added it to the pad ^^^ | |
| 16:35:05 | elodilles | bauzas: if you remember something regarding this error then it would be awesome :) | |
| 16:35:06 | bauzas | cool | |
| 16:35:46 | elodilles | i think that's all from me | |
| 16:35:50 | bauzas | ack | |
| 16:36:00 | bauzas | #topic Open discussion | |
| 16:36:06 | zigo | Now? :) | |
| 16:36:18 | bauzas | no items in the agenda | |
| 16:36:22 | bauzas | zigo: so, your turn | |
| 16:36:27 | zigo | I've tried backporting to Train the official patch, though for Train, it would need these to be backported (in this order if I'm not mistaking): | |
| 16:36:27 | zigo | I5ac03f923d9d181d22d44d8ec8fbc31eb0c3999e If878a023c69f25a9ea45b7de2ff9eb1976aaeb8c I56676713571e79f05ee3f0bffc5da8386e02c5d4 | |
| 16:36:28 | zigo | Can someone help? Or is it out of scope of the team? | |
| 16:36:36 | bauzas | (the volume detach issue, we can discuss it later) | |
| 16:36:53 | bauzas | zigo: ideally, gerrit links may help :) | |
| 16:37:15 | zigo | https://review.opendev.org/c/openstack/nova/+/706897 | |
| 16:37:28 | zigo | https://review.opendev.org/c/openstack/nova/+/710239 | |
| 16:37:39 | zigo | https://review.opendev.org/c/openstack/nova/+/711679 | |
| 16:38:05 | zigo | I tracked them using "git blame" and didn't try doing a backport of them to Train though ... | |
| 16:38:06 | elodilles | so this is fixed in Ussuri and newer | |
| 16:38:16 | zigo | Yeah, Ussuri and up are fine. | |
| 16:38:34 | bauzas | sec | |
| 16:38:34 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: api: extend evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858384 | |
| 16:38:35 | elodilles | so from upstream perspective Train is the only target | |
| 16:38:38 | bauzas | we have a series up | |
| 16:38:40 | zigo | But Train and before would need either such a backport, or something else to get the VMDK extended infos. | |
| 16:38:45 | bauzas | that's proposed to fix the CVE | |
| 16:39:01 | bauzas | oh, this is down to yoga | |
| 16:39:32 | elodilles | zigo: Nova's stable/stein and stable/rocky is End of Life already | |
| 16:39:57 | bauzas | I guess zigo wants at least Train | |
| 16:39:58 | elodilles | so that needs to be handled downstream as branches are deleted already | |
| 16:40:04 | bauzas | correct | |
| 16:40:05 | zigo | elodilles: Yeah, but Debian is doing LTS for Rocky, so I will need to do the patch backport. And so probably is Red Hat for its customers, etc. | |
| 16:40:08 | bauzas | those are tagged eol | |
| 16:40:26 | zigo | Ok, so out of scope for the team, and I'm on my own ... :P | |
| 16:40:40 | dansmith | zigo: you might need something more bespoke if backporting all the dependencies isn't possible | |
| 16:40:51 | zigo | Oh, also, when I'm at it ... | |
| 16:40:57 | zigo | This also need another patch in oslo.utils | |
| 16:41:10 | dansmith | but it is clearly out of scope for us, which doesn't necessarily mean we won't help you, but... | |
| 16:41:36 | zigo | Ok, thanks. :P | |
| 16:42:20 | zigo | FYI, that's the oslo.utils patch that I backported already: https://review.opendev.org/c/openstack/oslo.utils/+/706880 | |
| 16:42:33 | zigo | That fixed one of the unit tests... | |
| 16:42:33 | dansmith | so with that, | |
| 16:42:42 | zigo | (for train and below) | |
| 16:42:50 | bauzas | dansmith: I guess there is no plan to backport https://review.opendev.org/c/openstack/nova/+/871624 downer than Yoga ? | |
| 16:42:51 | dansmith | even if you don't backport the privsep stuff, you should have the data you need I think | |
| 16:43:03 | dansmith | bauzas: I backported to xena, | |
| 16:43:13 | dansmith | I think because xena was still in scope at the time and I was asked | |
| 16:43:43 | dansmith | it was the only one with a conflict, trivial because of the config | |
| 16:43:46 | bauzas | I'm actually surprised than backporting requires pulling more deps | |
| 16:44:07 | dansmith | because of privsep conversions | |
| 16:44:18 | dansmith | this was run within nova before IIRC | |
| 16:44:18 | bauzas | dansmith: mmm, OK, can't see it proposed in the list of cherry-picks of https://review.opendev.org/c/openstack/nova/+/871624 | |
| 16:44:27 | dansmith | and probably not with json output or something | |
| 16:44:35 | dansmith | bauzas: https://review.opendev.org/c/openstack/nova/+/871622 | |
| 16:45:03 | bauzas | I'm fucking blind | |
| 16:45:08 | bauzas | it's on the list | |
| 16:45:17 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: api: extend evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858384 | |
| 16:45:20 | sean-k-mooney | that does not need any dep changes does it | |
| 16:45:45 | bauzas | after being deaf when dansmith speaks, I'm now blind | |
| 16:45:53 | dansmith | sean-k-mooney: not package deps, dependent patches | |
| 16:45:56 | bauzas | correct | |
| 16:46:06 | bauzas | but should be honestly minimal | |
| 16:46:13 | bauzas | the patch itself is well self-contained | |
| 16:46:25 | dansmith | but listen to what zigo is saying | |
| 16:46:30 | sean-k-mooney | but it does not have depend on so you mena we need to backprot each branch or changes in other repos | |
| 16:46:40 | dansmith | the information we need was not being exposed out of oslo utils before the patch he referenced | |
| 16:46:59 | sean-k-mooney | ok then thats kind of a problem | |
| 16:47:11 | sean-k-mooney | the olso backports would have to happen first | |
| 16:47:29 | dansmith | I don't think he's suggesting it upstream | |
| 16:47:31 | sean-k-mooney | and we would need to be able to work with older oslo | |
| 16:47:40 | opendevreview | Merged openstack/nova master: Make tenant network policy default to PROJECT_READER_OR_ADMIN https://review.opendev.org/c/openstack/nova/+/865071 | |
| 16:47:43 | dansmith | he's talking about old and crusty packages debian is keeping on life support | |
| 16:48:00 | bauzas | oh | |
| 16:48:08 | sean-k-mooney | ok we can propably talk about this out of the meeting | |
| 16:48:15 | bauzas | that's gonna be fun then | |
| 16:48:24 | dansmith | yes, especially since it's out of our support scope, very clearly | |