Earlier  
Later
New Search
Posted Nick Remark
#openstack-sdks - 2020-12-15
13:33:37 sshnaidm gtema_, can you take a look please in your time on sdk job failure here? https://review.opendev.org/c/openstack/devstack/+/766622
13:34:33 gtema_ there's another blocker - https://review.opendev.org/c/openstack/openstacksdk/+/767126
13:34:45 gtema_ CentOS-8 stuff
13:37:24 gtema_ anyway - I'm on the thing you pointed
13:47:25 sshnaidm gtema_, great, thanks
13:48:20 gtema_ interestingly I was recenly (pretty much one of the latest merged changes) touching nova aggregates, but that stuff was not touched. Something else changed down the road as well
14:22:04 stephenfin gtema_: Comments on https://review.opendev.org/c/openstack/openstacksdk/+/767126
14:22:49 gtema_ ok, am on the phone right now
14:23:33 stephenfin no rush
14:39:39 openstackgerrit Ananya proposed openstack/ansible-collections-openstack master: Migrating network from AnsibleModule to OpenStackModule https://review.opendev.org/c/openstack/ansible-collections-openstack/+/764411
15:06:11 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: Change nodepool job to build CentOS-8-stream (unblock gate) https://review.opendev.org/c/openstack/openstacksdk/+/767126
15:25:21 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: Modify cloud.get_aggregate to use proxy.find https://review.opendev.org/c/openstack/openstacksdk/+/767176
16:39:06 openstackgerrit Merged openstack/ansible-collections-openstack master: Migrating security_group from AnsibleModule to OpenStackModule https://review.opendev.org/c/openstack/ansible-collections-openstack/+/764381
17:34:25 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Add network tests for versioned args https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766013
18:08:22 openstackgerrit Merged openstack/openstacksdk master: Fix invalid argument formatting in log messages https://review.opendev.org/c/openstack/openstacksdk/+/765732
20:47:00 openstackgerrit Emilien Macchi proposed openstack/openstacksdk master: network/v2/port: add support for tags https://review.opendev.org/c/openstack/openstacksdk/+/767216
21:03:24 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: networking/port: add support for tags https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
#openstack-sdks - 2020-12-16
01:20:24 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Add network tests for versioned args https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766013
03:22:37 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Run images tests https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767265
03:22:51 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Run images tests https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767265
03:28:16 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Separate volume tests from servers tests https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767268
07:34:47 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
08:16:31 openstackgerrit Merged openstack/openstacksdk master: Change nodepool job to build CentOS-8-stream (unblock gate) https://review.opendev.org/c/openstack/openstacksdk/+/767126
08:52:20 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Add network tests for versioned args https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766013
09:57:26 openstackgerrit Merged openstack/ansible-collections-openstack master: Run images tests https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767265
13:36:56 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
16:00:50 ade_lee fungi, hey - I need to add some changes to allow openstacksdk to work under fips -- in particular to handle md5()
16:01:10 ade_lee fungi, for example this is what we did for glance --- https://review.opendev.org/c/openstack/glance/+/756158
16:01:28 fungi looking
16:01:40 ade_lee in that we referenced an encapsulation of md5() which we had put into oslo
16:01:50 ade_lee oslo.utils
16:02:13 ade_lee but I see there are no references to oslo in openstacksdk - and I'm gusessing thats deliberate?
16:03:18 mordred very
16:03:55 ade_lee I figured that -- I can put in an implementation of that then -- just like I did for swift
16:04:59 mordred ade_lee: you said python hashlib.md5 has been updaed with the notforsecurity param?
16:05:16 ade_lee as in https://review.opendev.org/c/openstack/swift/+/751966/16/swift/common/utils.py (line 4864 -> 4888)
16:05:37 ade_lee mordred, not everywhere yet
16:06:45 mordred ade_lee: nod. well - yeah - I thnik what you've got in swift would be fine - the uses in openstacksdk are also not for security
16:07:23 ade_lee mordred, cool - I'll get up a patch soon.
16:08:44 fungi ade_lee: so, putting on my paranoid security wonk afdb for a moment, it's entirely possible that the image checksums in glance are relied on for security, and could even be susceptible to exploiting collision attacks, however the exploit scenarios i can think of are a bit specious (if someone has the ability to substitute an image with a malicious alternative, then they've almost certainly also got
16:08:46 fungi more direct ways to compromiose the entire system)
16:09:32 mordred fungi: yeah - the only think we use image checksums for is just to avoid duplicate uploads. as in "have I already uploaded this image"
16:09:57 fungi i think as long as we document that checksums are being used to spot file corruption/truncation and that users should not rely on them to catch malicious activity, then it's fine
16:10:00 mordred and the REAL reason we use them is that we've been putting them there long enough that they're part of the contract. we also do sha256 sums
16:10:05 mordred ++
16:10:14 fungi or, yeah, for process optimization in your example
16:10:14 mordred like, we cannot remove them
16:10:22 mordred but we can document their appropriate uses
16:10:57 fungi but if we're going to be tacking on the notforsecurity flag in our uses of md5() we do need to be very clear to users that these checksums are internal implementation details and not security mechanisms
16:15:52 fungi it's also worth noting that the currently feasible exploits known for md5 would essentially require the malicious actor to create the original image as well so that (using a chosen prefix attack) they could create a second compromised image and then pull a bait-and-switch after users had inspected the original
16:16:54 fungi and even that's a bit theoretical, since it would depend on them being able to choose prefixes which still produce usable image files
16:59:33 openstackgerrit Merged openstack/ansible-collections-openstack master: Migrating network from AnsibleModule to OpenStackModule https://review.opendev.org/c/openstack/ansible-collections-openstack/+/764411
17:11:47 openstackgerrit Merged openstack/ansible-collections-openstack master: Add network tests for versioned args https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766013
17:21:03 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
17:39:51 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
18:12:29 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: Modify cloud.get_aggregate to use proxy.find https://review.opendev.org/c/openstack/openstacksdk/+/767176
20:03:24 openstackgerrit Ade Lee proposed openstack/openstacksdk master: encapsulate md5 calls for fips https://review.opendev.org/c/openstack/openstacksdk/+/767411
20:27:10 openstackgerrit Ade Lee proposed openstack/openstacksdk master: encapsulate md5 calls for fips https://review.opendev.org/c/openstack/openstacksdk/+/767411
21:50:01 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
22:39:01 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: networking/port: add support for tags https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
#openstack-sdks - 2020-12-17
02:39:46 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
03:24:43 openstackgerrit Merged openstack/openstacksdk master: Drop swift check for volume backup https://review.opendev.org/c/openstack/openstacksdk/+/765587
04:55:44 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
06:23:14 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Аdd designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
06:23:33 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
11:24:23 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: Modify cloud.get_aggregate to use proxy.find https://review.opendev.org/c/openstack/openstacksdk/+/767176
11:59:19 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
12:28:48 openstackgerrit Lee Yarwood proposed openstack/openstacksdk stable/train: Fix aggregate functional test for id restriction https://review.opendev.org/c/openstack/openstacksdk/+/767526
14:00:00 gtema Anyone planning to participate in SDK/CLI team meeting in a minute?
14:00:16 gtema diablo_rojo, diablo_rojo_phon, gouthamr, gtema, stephenfin, amotoki
14:00:34 gtema anybody willing a meeting? We have till now no agenda
14:00:59 amotoki gtema: I can join it but I have no agenda either
14:02:03 gtema well, if nobody else is willing and no agenda - perhaps we will skip this meeting
14:03:31 amotoki yeah, I think so
14:04:23 gtema anyway, I am still here, so if anybody having need to discuss something - please.
14:19:28 stephenfin Yup, nothing from me either. I think we've everything sorted for this NDSU thing
15:06:12 openstackgerrit Merged openstack/ansible-collections-openstack master: Separate volume tests from servers tests https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767268
17:01:10 openstackgerrit Rodolfo Alonso proposed openstack/openstacksdk master: Add ``device_profile`` attribute to ``port`` https://review.opendev.org/c/openstack/openstacksdk/+/767588
17:20:55 openstackgerrit Rodolfo Alonso proposed openstack/python-openstackclient master: Add device profile to ``port`` https://review.opendev.org/c/openstack/python-openstackclient/+/767594
19:23:02 openstackgerrit Merged openstack/ansible-collections-openstack master: Аdd designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
20:33:40 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
20:35:35 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
#openstack-sdks - 2020-12-18
09:40:54 openstackgerrit Rodolfo Alonso proposed openstack/python-openstackclient master: Add device profile to ``port`` https://review.opendev.org/c/openstack/python-openstackclient/+/767594
12:50:04 openstackgerrit Ananya proposed openstack/ansible-collections-openstack master: Migrating subnet module from AnsibleModule to OpenStackModule https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767710
13:38:35 openstackgerrit Cyril Grosjean proposed openstack/ansible-collections-openstack master: Remove flavor update and add param for it https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767719
13:45:58 openstackgerrit Irina Pereiaslavskaia proposed openstack/openstacksdk master: New volume availability zone resource, new functional and unit tests https://review.opendev.org/c/openstack/openstacksdk/+/767720
14:17:33 openstackgerrit Cyril Grosjean proposed openstack/ansible-collections-openstack master: Remove flavor update and add param for it https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767719
16:07:43 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: networks/ports: add tags support https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
22:13:13 openstackgerrit Kendall Nelson proposed openstack/service-types-authority master: Remove Retired Karbor Support https://review.opendev.org/c/openstack/service-types-authority/+/767962
22:18:03 openstackgerrit Kendall Nelson proposed openstack/os-service-types master: Remove Retired Karbor Support https://review.opendev.org/c/openstack/os-service-types/+/767964
22:28:42 mordred diablo_rojo_phon: just left a comment on those two - let me know if there is a way we can improve the docs of those to make their strange place in the universe clearer
22:29:49 diablo_rojo_phon mordred: looking now!
22:30:57 diablo_rojo_phon Ohhh so basically I just overzealous with my ripping out of things. I can abandon them both mordred.
22:31:06 diablo_rojo_phon Retired too effectively lol.
22:31:24 mordred diablo_rojo_phon: extra effectiveness strikes again ;)
22:31:59 diablo_rojo_phon Silly me for trying to be an overachiever lol
22:32:04 diablo_rojo_phon Abandoned now.
22:32:13 diablo_rojo_phon Thanks for the education mordred :)
#openstack-sdks - 2020-12-21
15:05:42 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: ports: add tags support https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
16:58:49 openstackgerrit Lee Yarwood proposed openstack/openstacksdk stable/train: Fix aggregate functional test for id restriction https://review.opendev.org/c/openstack/openstacksdk/+/767526

Earlier   Later