| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2023-01-25 | |||
| 09:39:25 | bauzas | gibi: that's what I told to johnthetubaguy | |
| 09:39:42 | johnthetubaguy | yeah, I think we should just merge them all ASAP: "or security patches that should not take much time to merge once the patches are published" | |
| 09:39:44 | gibi | bauzas: so even though the policy allow secu patches to land our tooling did not | |
| 09:39:55 | bauzas | gibi: I was about to write this | |
| 09:39:59 | johnthetubaguy | ah, got you | |
| 09:40:05 | bauzas | somehow we are strictier than the policy | |
| 09:40:45 | johnthetubaguy | so what is the quickest path to merge? in parallel drop that CI job? | |
| 09:40:49 | bauzas | johnthetubaguy: either way, you know we'll need to publish releases | |
| 09:41:07 | bauzas | upstream isn't generally a quick path for remediation | |
| 09:41:14 | bauzas | but we can try to rush | |
| 09:41:21 | johnthetubaguy | its meant to be though, in this particular case. | |
| 09:41:40 | bauzas | johnthetubaguy: that's why distros got notified one week before the disclosure | |
| 09:41:46 | johnthetubaguy | granted the patches are published, which is the important and crucial bit. | |
| 09:42:18 | bauzas | I don't disagree and the security hole is quite dirty | |
| 09:42:41 | bauzas | I would recommend our operators to exceptionnally patch directly | |
| 09:43:00 | bauzas | the patch itself is just about enforcing | |
| 09:46:23 | gibi | one way to rush this is to add [stable-only] to the commit message to silence the backport job | |
| 09:47:41 | bauzas | that's debatable | |
| 09:47:49 | johnthetubaguy | gibi: I like your thinking! | |
| 09:48:11 | bauzas | gibi: your help may be needed on https://review.opendev.org/c/openstack/nova/+/871624 | |
| 09:48:46 | bauzas | johnthetubaguy: which release do you target to ship the security fix ? | |
| 09:49:23 | elodilles | o/ | |
| 09:49:37 | gibi | bauzas: I can approve that but the job will kick it out from the gate | |
| 09:49:44 | elodilles | let me know if any patch needs review | |
| 09:49:50 | gibi | elodilles: it is more like a process thing | |
| 09:49:53 | bauzas | elodilles: we're on the CVE backports | |
| 09:50:03 | elodilles | (i'm not aware of any special handling of security bug fixes) | |
| 09:50:03 | gibi | elodilles: the stable policy allows parallel merge of secu stable fixes | |
| 09:50:06 | bauzas | elodilles: the zed one got kicked out due to some gate failure | |
| 09:50:09 | gibi | elodilles: but the backport job does not | |
| 09:50:43 | elodilles | ok, then [stable-only] is right | |
| 09:50:43 | gibi | elodilles: do you have a magic want to turn off the job or merge the patches against that job? | |
| 09:50:46 | bauzas | gibi: I'd say that if the stable policy agrees on that, we could refer to it if we respin the patch to add the [stable-only] tag | |
| 09:50:56 | gibi | OK then we have a consensus | |
| 09:51:04 | elodilles | if you want them to merge not in the known order | |
| 09:51:08 | gibi | bauzas: will you add the [stable-only] tags? | |
| 09:51:10 | bauzas | ideally, I'd rather prefer to have a specific tag but we're a bit on a rush | |
| 09:51:12 | johnthetubaguy | bauzas: we have a zoo of people on different things, I am not worried about them, thats all happening, I am more worried in general about it not landing in the stable branches. | |
| 09:51:32 | gibi | bauzas: then elodilles and me can approve qucikly | |
| 09:51:42 | johnthetubaguy | what about [stable-only][actually-a-cve] ? | |
| 09:52:05 | gibi | johnthetubaguy: adding a sentence why we add stable-only make sense, yes | |
| 09:52:11 | elodilles | :] | |
| 09:52:35 | gibi | and as a follow up we should extend the job to accept [cve] as a tag to silence the landing order check | |
| 09:52:45 | johnthetubaguy | gibi: +1 | |
| 09:53:00 | bauzas | johnthetubaguy: as a reminder, train requires some oslo.utils bump due to https://review.opendev.org/c/openstack/oslo.utils/+/706880 missing | |
| 09:53:34 | johnthetubaguy | bauzas: appreciated, thanks, I saw zigo is working through that. | |
| 09:56:04 | zigo | Either oslo bump, or backport of https://review.opendev.org/c/openstack/oslo.utils/+/706880 | |
| 09:56:07 | zigo | I did the later ... | |
| 09:56:32 | zigo | YEAH !!! | |
| 09:56:38 | zigo | Got something that worked ! \o/ | |
| 09:56:45 | bauzas | gibi: if we start parallelizing the backports, then we'll break the sha1 information on the commit msgs | |
| 09:57:11 | bauzas | since there is no guarantee that the commit in the gerrit branch will have the same sha1 once merged | |
| 09:57:11 | gibi | bauzas: ignore the sha (it does not have it now either) as we disable the check anyhow | |
| 09:57:29 | bauzas | gibi: I'll then mention the gerrit links | |
| 09:57:50 | gibi | bauzas: the bug ref is there to make a connection, but yes if you want you can add gerrit change id | |
| 09:57:53 | gibi | or link | |
| 09:58:09 | bauzas | unfortunately, we can't also track all commits easily as they're on different branches | |
| 09:58:55 | zigo | So, I did: | |
| 09:58:55 | zigo | https://salsa.debian.org/openstack-team/services/nova/-/blob/debian/train/debian/patches/cve-2022-47951-nova-stable-train.patch | |
| 09:58:55 | zigo | https://salsa.debian.org/openstack-team/services/nova/-/blob/debian/train/debian/patches/images_Move_qemu-img_info_calls_into_privsep.patch | |
| 09:58:55 | zigo | https://salsa.debian.org/openstack-team/services/nova/-/blob/debian/train/debian/patches/images_Make_JSON_the_default_output_format_of_calls_to_qemu-img_info.patch | |
| 09:58:56 | zigo | With these 3 patches, all unit tests are passing. | |
| 09:59:58 | zigo | Is this acceptable (from your Nova upstream point of view) to backport these 3 patches on the train branch? | |
| 10:01:39 | bauzas | zigo: propose the backports | |
| 10:01:54 | bauzas | Train is EM | |
| 10:02:08 | zigo | bauzas: The only issue is that I apply them in the wrong order, so patch 1 and 2 may have failures ... | |
| 10:02:22 | zigo | Can I just merge the 3 patches then? | |
| 10:02:37 | johnthetubaguy | zigo: +1 that looks like a nice solution to me. You can submit them as a patch chain in gerrit, that should work OK I think? | |
| 10:02:39 | bauzas | then I need to review those patches | |
| 10:02:50 | bauzas | and yeah, this would have to be a gerrit series | |
| 10:02:56 | zigo | Ok, doing this. | |
| 10:03:02 | gibi | zigo: https://salsa.debian.org/openstack-team/services/nova/-/blob/debian/train/debian/patches/images_Make_JSON_the_default_output_format_of_calls_to_qemu-img_info.patch#L416 format=output_format ? | |
| 10:04:04 | zigo | gibi: That's what is in there: https://review.opendev.org/c/openstack/nova/+/711679/6/nova/virt/images.py#57 | |
| 10:04:13 | opendevreview | Sylvain Bauza proposed openstack/nova stable/yoga: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871624 | |
| 10:04:32 | zigo | Ask Lee Yarwood I guess? :) | |
| 10:04:32 | gibi | zigo: then that is a latent bug, so keep it as is | |
| 10:04:55 | opendevreview | Sylvain Bauza proposed openstack/nova stable/xena: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871622 | |
| 10:05:34 | opendevreview | Sylvain Bauza proposed openstack/nova stable/wallaby: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871557 | |
| 10:05:40 | gibi | zigo: lyarwood is gone from openstack unfortunately | |
| 10:06:19 | bauzas | I'd be honest, I spotted a few bugs on this | |
| 10:06:27 | bauzas | (and ChatGPT as well) | |
| 10:06:37 | bauzas | but nothing prevents the cve to be fixed | |
| 10:07:01 | bauzas | gibi: did the [stable-only] hack | |
| 10:07:04 | bauzas | enjoy | |
| 10:07:11 | bauzas | johnthetubaguy: ditto | |
| 10:07:14 | gibi | bauzas: I agree, lets fix the cve, the latent bugs can be fixed later / separately | |
| 10:07:17 | gibi | bauzas: on it | |
| 10:07:34 | zigo | bauzas: Last time, I asked ChatGPT to write an alembic migration env.py for me, using oslo.db, and it did kind of well ... :) | |
| 10:07:34 | gibi | bauzas: you missed https://review.opendev.org/c/openstack/nova/+/871616 | |
| 10:07:51 | gibi | zigo: you live dangerously :) | |
| 10:08:11 | zigo | gibi: I didn't use what ChatGPT produced ! :) | |
| 10:08:18 | gibi | ahh :) | |
| 10:08:18 | bauzas | gibi: no, this was on purpose, zed is on the check pipeline | |
| 10:08:32 | bauzas | and was on the gate before | |
| 10:08:34 | gibi | bauzas: zed will be kicked out of gate by the backport job as it has no commit hash | |
| 10:08:42 | bauzas | gibi: oh shit, you're right | |
| 10:08:46 | bauzas | doing then the hack | |
| 10:09:19 | opendevreview | Sylvain Bauza proposed openstack/nova stable/zed: [stable-only][cve] Check VMDK create-type against an allowed list https://review.opendev.org/c/openstack/nova/+/871616 | |
| 10:09:23 | bauzas | there ^ | |
| 10:09:28 | zigo | I really don't feel confident pushing the 3 patches I linked above to Gerrit. I'm sure I'll do some mistakes like commit ID and such ... | |