| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-11-18 | |||
| 12:45:50 | gibi | sean-k-mooney: thanks! | |
| 12:53:40 | zigo | I'm now hit by the crypt.crypt removal in Python 3.13: | |
| 12:53:40 | zigo | https://buildd.debian.org/status/fetch.php?pkg=nova&arch=all&ver=2%3A30.0.0-2&stamp=1731930425&file=log | |
| 12:54:08 | zigo | tkajinam: Do you think your patch here https://review.opendev.org/c/openstack/oslo.utils/+/931899 could be used for it? | |
| 12:56:35 | zigo | BTW, I don't think we should keep using md5 as algo, like the comment above https://github.com/openstack/nova/blob/master/nova/virt/disk/api.py#L634 says. Any distro still using md5 shouldn't be consider at this time and age. | |
| 13:01:57 | zigo | gibi: bauzas: sean-k-mooney: Would it be accepted by the team if I was to propose a patch that does SHA-512 instead, and drop support for MD5 ? | |
| 13:02:39 | sean-k-mooney | zigo: i dont have context but there are some places where we cant do that for upgrade reaons | |
| 13:03:08 | zigo | sean-k-mooney: I believe nova/virt/disk/api.py is the bit that is doing password injections in VMs. | |
| 13:03:18 | zigo | (I didn't check much, but should be...) | |
| 13:03:32 | zigo | The comment says md5, because some distro may be outdated. | |
| 13:04:07 | gibi | zigo: yeah that codepath generates the content of the shadow file so we need to make sure whathever we change there still works with old but not super old linux distros | |
| 13:04:13 | zigo | This was in 2012 ... | |
| 13:04:41 | zigo | gibi: Fast forward 12 years later, md5 is a security hole... | |
| 13:04:48 | gibi | I'm aware | |
| 13:04:59 | zigo | I'm sure you are. | |
| 13:05:14 | zigo | So question still is: is it ok if we drop support for distros with such security hole? :) | |
| 13:05:52 | gibi | OK, if you ask this way then it sounds right to say no, we should not support distros that uses md5 for the root password's hash | |
| 13:06:06 | gibi | I'm sold | |
| 13:06:19 | zigo | Thanks for confirming, I'll try to write a patch. | |
| 13:16:55 | opendevreview | Thomas Goirand proposed openstack/nova master: Python 3.13: crypt.crypt support is dropped https://review.opendev.org/c/openstack/nova/+/935512 | |
| 13:17:09 | sean-k-mooney | zigo: the password injection we may be removing | |
| 13:18:44 | zigo | sean-k-mooney: I'm ok with it to be removed, but I'd prefer to have this patch merged, so I can safely backport it to Dalamatian, which will be the OpenStack release in the next Debian. | |
| 13:19:35 | zigo | Also, that'd be annoying for rescuing ... what would be the method? | |
| 13:19:57 | zigo | (especially for windows ...) | |
| 14:30:33 | opendevreview | Thomas Goirand proposed openstack/nova master: Python 3.13: crypt.crypt support is dropped https://review.opendev.org/c/openstack/nova/+/935512 | |
| 15:53:12 | tkajinam | zigo, I'm adding that utility for nova and ironic so let's use the oslo.utils implementation instead of pulling the same code to nova | |
| 20:00:52 | frickler | not sure if I've mentioned this here before, the reqs bump to latest jsonschema is failing due to nova and placement jobs breaking, maybe someone can take a look https://review.opendev.org/c/openstack/requirements/+/925059 | |
| 20:17:14 | sean-k-mooney | zigo: so file injefction on which password injection is based has been deprecated for removal for a long time | |
| 20:17:34 | sean-k-mooney | zigo: we discussed this in the context of the crypt depency and the fact that is removed in py 3.13 | |
| 20:17:56 | sean-k-mooney | so while we may or may note bable to change form md5 to sha512 in this case | |
| 20:18:17 | sean-k-mooney | there is other technial debth with supproting passwod/file injection in general | |
| 20:19:43 | sean-k-mooney | for rescuue you really should use cloud-init to set the password or use x509 or ssh keys | |
| 20:20:08 | sean-k-mooney | the only non deprecated way to set teh root password today | |
| 20:20:23 | sean-k-mooney | is to dues the qemu guest agent to do that with an image that has that installed | |
| 20:21:02 | sean-k-mooney | which does nto need that code path if i recall correctly but i have not looked at that in some times | |
| 20:46:49 | frickler | this also looks broken, might be due to latest sphinx, but I'm not sure why it would only affect nova and not most other projects https://zuul.opendev.org/t/openstack/builds?job_name=build-openstack-api-ref&project=openstack/nova | |
| 21:24:42 | opendevreview | melanie witt proposed openstack/nova master: tests: Functional reproducer for bug 2088831 https://review.opendev.org/c/openstack/nova/+/935565 | |
| #openstack-nova - 2024-11-19 | |||
| 00:02:59 | opendevreview | melanie witt proposed openstack/nova master: nova-manage: Add flavor scanning to migrate_to_unified_limits https://review.opendev.org/c/openstack/nova/+/924110 | |
| 00:54:32 | opendevreview | Koya Watanabe proposed openstack/placement master: Add memcached packages https://review.opendev.org/c/openstack/placement/+/935576 | |
| 01:12:55 | opendevreview | Ghanshyam proposed openstack/nova master: Update gate jobs as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/nova/+/932648 | |
| 01:15:27 | opendevreview | Ghanshyam proposed openstack/nova master: Testing doc job on Ubuntu Noble https://review.opendev.org/c/openstack/nova/+/935577 | |
| 01:33:57 | opendevreview | Ghanshyam proposed openstack/os-resource-classes master: Update python classifier as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/os-resource-classes/+/935578 | |
| 01:33:59 | opendevreview | Ghanshyam proposed openstack/osc-placement master: Update python classifier as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/osc-placement/+/935579 | |
| 01:33:59 | opendevreview | Ghanshyam proposed openstack/os-vif master: Update gate jobs as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/os-vif/+/935580 | |
| 01:34:00 | opendevreview | Ghanshyam proposed openstack/placement master: Update gate jobs as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/placement/+/935581 | |
| 01:35:30 | opendevreview | Ghanshyam proposed openstack/os-traits master: Update python classifier as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/os-traits/+/935582 | |
| 01:50:22 | opendevreview | Ghanshyam proposed openstack/python-novaclient master: DNM: Testing ubuntu noble https://review.opendev.org/c/openstack/python-novaclient/+/935583 | |
| 02:24:27 | opendevreview | Ghanshyam proposed openstack/osc-placement master: Update python classifier as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/osc-placement/+/935579 | |
| 02:42:35 | opendevreview | Takashi Kajinami proposed openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685 | |
| 02:42:49 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706 | |
| 02:43:47 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106 | |
| 04:29:58 | opendevreview | melanie witt proposed openstack/nova-specs master: Re-propose config option for behavior of unset unified limits https://review.opendev.org/c/openstack/nova-specs/+/934391 | |
| 04:31:54 | opendevreview | Ghanshyam proposed openstack/os-vif master: Update gate jobs as per the 2025.1 cycle testing runtime https://review.opendev.org/c/openstack/os-vif/+/935580 | |
| 05:14:59 | opendevreview | melanie witt proposed openstack/nova-specs master: Re-propose config option for behavior of unset unified limits https://review.opendev.org/c/openstack/nova-specs/+/934391 | |
| 07:32:24 | zigo | tkajinam: sean-k-mooney: Please reconsider your review after reading my comments at https://review.opendev.org/c/openstack/nova/+/935512 | |
| 09:14:36 | opendevreview | zhou zhong proposed openstack/nova master: ESFIX: Add auto_converge parameters for invoking the migration https://review.opendev.org/c/openstack/nova/+/935614 | |
| 09:15:04 | opendevreview | zhou zhong proposed openstack/nova master: ESFIX: Add auto_converge parameters for invoking the migration https://review.opendev.org/c/openstack/nova/+/935614 | |
| 09:17:43 | opendevreview | zhou zhong proposed openstack/nova master: Add auto_converge parameters for invoking the migration https://review.opendev.org/c/openstack/nova/+/935614 | |
| 09:23:35 | opendevreview | zhou zhong proposed openstack/nova master: Add auto_converge parameters for invoking the migration https://review.opendev.org/c/openstack/nova/+/935614 | |
| 10:21:44 | zigo | 25 test failures for Nova under Python 3.13: https://bugs.launchpad.net/nova/+bug/2088999 | |
| 10:31:42 | zigo | 24 are flavor related, one must be my own patch failing. | |
| 11:15:11 | frickler | zigo: trying to run this locally I'm seeing "TypeError: 'PipeMutex' object does not support the context manager protocol" during discovery, does that ring a bell for you? do you have more fixes than just 935512? | |
| 11:17:29 | zigo | frickler: The patch from tkajinam https://review.opendev.org/c/openstack/oslo.log/+/935620 fixed it for me. | |
| 11:18:05 | zigo | Also, I may have the fix for the issue I just reported ! :) | |
| 11:18:26 | zigo | (my patch repaired at least one unit tests, running them all now...) | |
| 11:25:05 | opendevreview | Thomas Goirand proposed openstack/nova master: Python 3.13: Repair fake_flavor_get_by_id https://review.opendev.org/c/openstack/nova/+/935631 | |
| 11:26:29 | frickler | zigo: ah, tkajinam ftw, thx | |
| 11:39:34 | zigo | This looks like failing under Py 3.13 as well: | |
| 11:39:34 | zigo | msg = _('User %(username)s not found in password file.') | |
| 11:39:34 | zigo | raise exception.NovaException(msg % username) | |
| 11:39:34 | zigo | with: | |
| 11:39:34 | zigo | TypeError: format requires a mapping | |
| 11:39:38 | zigo | Anyone got a clue? | |
| 11:41:11 | sean-k-mooney | i think its saying that the right hand side need to be a dict | |
| 11:41:41 | sean-k-mooney | i guess in the past named parmatere i.e. %(username)s could take postional replacements and they got stricter about that in 3.13 | |
| 11:42:12 | sean-k-mooney | so its expexting (msg % {'username': username}) | |
| 11:42:30 | sean-k-mooney | but i would just replace %(username)s with %s | |
| 11:43:07 | zigo | Ok, so I should just replace username by {'username': username} ? | |
| 11:43:20 | zigo | I can try ... :P | |
| 11:43:32 | sean-k-mooney | that or update msg = _('User %(username)s not found in password file.') to msg = _('User %s not found in password file.') | |
| 11:43:49 | sean-k-mooney | either both should be useing named paramaters or both should be postional | |
| 11:43:56 | sean-k-mooney | its unhappy that we are mixing them | |
| 11:45:22 | zigo | I'm trying the first solution, so it doesn't break translations. | |
| 11:45:53 | zigo | Do we still care about these btw? I thought we were to just stop translating error messages ... | |
| 11:49:49 | zigo | sean-k-mooney: Fixed ! :) | |
| 11:50:10 | zigo | Now I'm worried we have this type of raise all over the place ... | |
| 11:51:20 | zigo | Hum... doesn't look like it. | |
| 11:52:13 | sean-k-mooney | im kind of surprised that this was never flagged by a linter | |
| 11:52:45 | sean-k-mooney | some projects have been more agressive with replacing percent strings with fstring so that woudl also remove that issue | |
| 11:54:54 | opendevreview | Thomas Goirand proposed openstack/nova master: Fix exception raising in inject_data https://review.opendev.org/c/openstack/nova/+/935640 | |
| 11:55:58 | opendevreview | Thomas Goirand proposed openstack/nova master: Fix exception raising in _set_passwd() https://review.opendev.org/c/openstack/nova/+/935640 | |
| 11:56:43 | sean-k-mooney | zigo: did you hit yappi/_yappi.c:1288:5: error: implicit declaration of function ‘_PyEval_SetProfile’; did you mean ‘PyEval_SetProfile’? [-Wimplicit-function-declaration] | |
| 11:57:22 | sean-k-mooney | i was trying to run the unit test with 3.13 locally | |
| 11:58:13 | zigo | sean-k-mooney: Yeah, I fixed that one, you need a local rebuild of yappi probably (since it's a .so based module). | |
| 11:58:21 | zigo | Debian Unstable is already fixed for that. | |
| 11:58:50 | sean-k-mooney | ack im using testing so i guess i need to wait or clone and buidl that myslef | |
| 11:58:58 | sean-k-mooney | i can test this in a vm instead | |
| 11:59:20 | zigo | I used version 1.6.10 instead of 1.6.<something>. | |
| 11:59:25 | zigo | Maybe just bump it? | |
| 12:00:03 | sean-k-mooney | you mean bump the distro packages or the python dep in a requirements file | |