Earlier  
Later
New Search
Posted Nick Remark
#openstack-sdks - 2020-12-16
16:06:45 mordred ade_lee: nod. well - yeah - I thnik what you've got in swift would be fine - the uses in openstacksdk are also not for security
16:07:23 ade_lee mordred, cool - I'll get up a patch soon.
16:08:44 fungi ade_lee: so, putting on my paranoid security wonk afdb for a moment, it's entirely possible that the image checksums in glance are relied on for security, and could even be susceptible to exploiting collision attacks, however the exploit scenarios i can think of are a bit specious (if someone has the ability to substitute an image with a malicious alternative, then they've almost certainly also got
16:08:46 fungi more direct ways to compromiose the entire system)
16:09:32 mordred fungi: yeah - the only think we use image checksums for is just to avoid duplicate uploads. as in "have I already uploaded this image"
16:09:57 fungi i think as long as we document that checksums are being used to spot file corruption/truncation and that users should not rely on them to catch malicious activity, then it's fine
16:10:00 mordred and the REAL reason we use them is that we've been putting them there long enough that they're part of the contract. we also do sha256 sums
16:10:05 mordred ++
16:10:14 fungi or, yeah, for process optimization in your example
16:10:14 mordred like, we cannot remove them
16:10:22 mordred but we can document their appropriate uses
16:10:57 fungi but if we're going to be tacking on the notforsecurity flag in our uses of md5() we do need to be very clear to users that these checksums are internal implementation details and not security mechanisms
16:15:52 fungi it's also worth noting that the currently feasible exploits known for md5 would essentially require the malicious actor to create the original image as well so that (using a chosen prefix attack) they could create a second compromised image and then pull a bait-and-switch after users had inspected the original
16:16:54 fungi and even that's a bit theoretical, since it would depend on them being able to choose prefixes which still produce usable image files
16:59:33 openstackgerrit Merged openstack/ansible-collections-openstack master: Migrating network from AnsibleModule to OpenStackModule https://review.opendev.org/c/openstack/ansible-collections-openstack/+/764411
17:11:47 openstackgerrit Merged openstack/ansible-collections-openstack master: Add network tests for versioned args https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766013
17:21:03 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
17:39:51 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
18:12:29 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: Modify cloud.get_aggregate to use proxy.find https://review.opendev.org/c/openstack/openstacksdk/+/767176
20:03:24 openstackgerrit Ade Lee proposed openstack/openstacksdk master: encapsulate md5 calls for fips https://review.opendev.org/c/openstack/openstacksdk/+/767411
20:27:10 openstackgerrit Ade Lee proposed openstack/openstacksdk master: encapsulate md5 calls for fips https://review.opendev.org/c/openstack/openstacksdk/+/767411
21:50:01 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
22:39:01 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: networking/port: add support for tags https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
#openstack-sdks - 2020-12-17
02:39:46 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: WIP add designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
03:24:43 openstackgerrit Merged openstack/openstacksdk master: Drop swift check for volume backup https://review.opendev.org/c/openstack/openstacksdk/+/765587
04:55:44 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
06:23:14 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Аdd designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
06:23:33 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
11:24:23 openstackgerrit Artem Goncharov proposed openstack/openstacksdk master: Modify cloud.get_aggregate to use proxy.find https://review.opendev.org/c/openstack/openstacksdk/+/767176
11:59:19 openstackgerrit Shnaidman Sagi (Sergey) proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
12:28:48 openstackgerrit Lee Yarwood proposed openstack/openstacksdk stable/train: Fix aggregate functional test for id restriction https://review.opendev.org/c/openstack/openstacksdk/+/767526
14:00:00 gtema Anyone planning to participate in SDK/CLI team meeting in a minute?
14:00:16 gtema diablo_rojo, diablo_rojo_phon, gouthamr, gtema, stephenfin, amotoki
14:00:34 gtema anybody willing a meeting? We have till now no agenda
14:00:59 amotoki gtema: I can join it but I have no agenda either
14:02:03 gtema well, if nobody else is willing and no agenda - perhaps we will skip this meeting
14:03:31 amotoki yeah, I think so
14:04:23 gtema anyway, I am still here, so if anybody having need to discuss something - please.
14:19:28 stephenfin Yup, nothing from me either. I think we've everything sorted for this NDSU thing
15:06:12 openstackgerrit Merged openstack/ansible-collections-openstack master: Separate volume tests from servers tests https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767268
17:01:10 openstackgerrit Rodolfo Alonso proposed openstack/openstacksdk master: Add ``device_profile`` attribute to ``port`` https://review.opendev.org/c/openstack/openstacksdk/+/767588
17:20:55 openstackgerrit Rodolfo Alonso proposed openstack/python-openstackclient master: Add device profile to ``port`` https://review.opendev.org/c/openstack/python-openstackclient/+/767594
19:23:02 openstackgerrit Merged openstack/ansible-collections-openstack master: Аdd designate to install with devstack https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767352
20:33:40 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
20:35:35 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
#openstack-sdks - 2020-12-18
09:40:54 openstackgerrit Rodolfo Alonso proposed openstack/python-openstackclient master: Add device profile to ``port`` https://review.opendev.org/c/openstack/python-openstackclient/+/767594
12:50:04 openstackgerrit Ananya proposed openstack/ansible-collections-openstack master: Migrating subnet module from AnsibleModule to OpenStackModule https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767710
13:38:35 openstackgerrit Cyril Grosjean proposed openstack/ansible-collections-openstack master: Remove flavor update and add param for it https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767719
13:45:58 openstackgerrit Irina Pereiaslavskaia proposed openstack/openstacksdk master: New volume availability zone resource, new functional and unit tests https://review.opendev.org/c/openstack/openstacksdk/+/767720
14:17:33 openstackgerrit Cyril Grosjean proposed openstack/ansible-collections-openstack master: Remove flavor update and add param for it https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767719
16:07:43 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: networks/ports: add tags support https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
22:13:13 openstackgerrit Kendall Nelson proposed openstack/service-types-authority master: Remove Retired Karbor Support https://review.opendev.org/c/openstack/service-types-authority/+/767962
22:18:03 openstackgerrit Kendall Nelson proposed openstack/os-service-types master: Remove Retired Karbor Support https://review.opendev.org/c/openstack/os-service-types/+/767964
22:28:42 mordred diablo_rojo_phon: just left a comment on those two - let me know if there is a way we can improve the docs of those to make their strange place in the universe clearer
22:29:49 diablo_rojo_phon mordred: looking now!
22:30:57 diablo_rojo_phon Ohhh so basically I just overzealous with my ripping out of things. I can abandon them both mordred.
22:31:06 diablo_rojo_phon Retired too effectively lol.
22:31:24 mordred diablo_rojo_phon: extra effectiveness strikes again ;)
22:31:59 diablo_rojo_phon Silly me for trying to be an overachiever lol
22:32:04 diablo_rojo_phon Abandoned now.
22:32:13 diablo_rojo_phon Thanks for the education mordred :)
#openstack-sdks - 2020-12-21
15:05:42 openstackgerrit Emilien Macchi proposed openstack/ansible-collections-openstack master: ports: add tags support https://review.opendev.org/c/openstack/ansible-collections-openstack/+/767219
16:58:49 openstackgerrit Lee Yarwood proposed openstack/openstacksdk stable/train: Fix aggregate functional test for id restriction https://review.opendev.org/c/openstack/openstacksdk/+/767526
19:26:45 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
21:05:01 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
#openstack-sdks - 2020-12-22
07:02:03 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
09:33:43 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
11:33:15 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
11:50:23 openstackgerrit Stephen Finucane proposed openstack/shade master: Update the constraints url https://review.opendev.org/c/openstack/shade/+/684929
12:36:33 openstackgerrit Stephen Finucane proposed openstack/python-openstackclient master: Add plugin doc page for cyborg https://review.opendev.org/c/openstack/python-openstackclient/+/751986
12:50:02 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
12:54:26 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
12:57:55 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
13:30:58 openstackgerrit Merged openstack/python-openstackclient master: Add option to filter instances by AZ https://review.opendev.org/c/openstack/python-openstackclient/+/764926
13:31:04 openstackgerrit Merged openstack/python-openstackclient master: Add name and enabled param in ListDomain parser https://review.opendev.org/c/openstack/python-openstackclient/+/742178
13:49:35 openstackgerrit Merged openstack/python-openstackclient master: Add project field in image list subcommand https://review.opendev.org/c/openstack/python-openstackclient/+/766523
14:31:22 openstackgerrit Slawek Kaplonski proposed openstack/openstacksdk master: Allow unknown attributes to be included in request body https://review.opendev.org/c/openstack/openstacksdk/+/768208
14:36:11 openstackgerrit Slawek Kaplonski proposed openstack/python-openstackclient master: Allow to send extra attributes in Neutron related commands https://review.opendev.org/c/openstack/python-openstackclient/+/768210
15:24:57 openstackgerrit Thomas Bechtold proposed openstack/openstacksdk master: Support SNAP_REAL_HOME when using openstacksdk inside a snap package https://review.opendev.org/c/openstack/openstacksdk/+/768223
17:11:52 openstackgerrit Stephen Finucane proposed openstack/python-openstackclient master: image: Unset properties rather than setting to None https://review.opendev.org/c/openstack/python-openstackclient/+/768239
17:47:49 openstackgerrit Stephen Finucane proposed openstack/python-openstackclient master: Introduce 'quota unset' command https://review.opendev.org/c/openstack/python-openstackclient/+/376311
19:05:53 openstackgerrit Thomas Bechtold proposed openstack/openstacksdk master: Support SNAP_REAL_HOME when using openstacksdk inside a snap package https://review.opendev.org/c/openstack/openstacksdk/+/768223
19:20:58 openstackgerrit Merged openstack/python-openstackclient master: Change 'Volume' to 'Block Storage' https://review.opendev.org/c/openstack/python-openstackclient/+/532439
19:23:24 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
20:57:50 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
21:10:23 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
#openstack-sdks - 2020-12-23
11:13:54 stephenfin gtema: Around? Thoughts on https://review.opendev.org/c/openstack/python-openstackclient/+/747279/7/setup.cfg#386 ?
11:14:15 gtema yupp
11:14:52 stephenfin Cool. Just left an additional reply.
11:15:02 gtema oki
11:22:19 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
11:50:35 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
12:12:30 stephenfin gtema++ thanks
12:12:38 gtema wlcm
13:27:33 openstackgerrit Merged openstack/openstacksdk master: Add ``device_profile`` attribute to ``port`` https://review.opendev.org/c/openstack/openstacksdk/+/767588
13:27:50 openstackgerrit Merged openstack/openstacksdk stable/ussuri: Don't set list_type to dict for server groups. https://review.opendev.org/c/openstack/openstacksdk/+/763120
14:03:49 openstackgerrit Polina Gubina proposed openstack/ansible-collections-openstack master: Enable update for recordset and add tests for dns and recordset module https://review.opendev.org/c/openstack/ansible-collections-openstack/+/766528
15:16:15 openstackgerrit Merged openstack/openstacksdk master: Add new Open Telekom Cloud region into the profile https://review.opendev.org/c/openstack/openstacksdk/+/765667
19:27:04 openstackgerrit Hang Yang proposed openstack/python-openstackclient master: Support Neutron Address Group CRUD https://review.opendev.org/c/openstack/python-openstackclient/+/747279
#openstack-sdks - 2020-12-24
06:57:02 openstackgerrit zhangboye proposed openstack/shade master: Use TOX_CONSTRAINTS_FILE https://review.opendev.org/c/openstack/shade/+/768429

Earlier   Later