*** njohnston_ has quit IRC | 00:23 | |
*** goldyfruit has quit IRC | 02:30 | |
*** awalende has joined #openstack-barbican | 02:50 | |
*** awalende has quit IRC | 02:55 | |
*** goldyfruit has joined #openstack-barbican | 04:34 | |
*** awalende has joined #openstack-barbican | 08:07 | |
*** tosky has joined #openstack-barbican | 09:07 | |
*** goldyfruit has quit IRC | 09:11 | |
*** jaosorior has joined #openstack-barbican | 09:19 | |
*** xek has joined #openstack-barbican | 09:24 | |
*** jaosorior has quit IRC | 09:54 | |
*** ivve has joined #openstack-barbican | 10:07 | |
*** openstackgerrit has quit IRC | 10:12 | |
*** goldyfruit has joined #openstack-barbican | 10:47 | |
*** raildo has joined #openstack-barbican | 11:06 | |
*** goldyfruit has quit IRC | 11:10 | |
*** awalende has quit IRC | 11:13 | |
*** raildo_ has joined #openstack-barbican | 11:14 | |
*** awalende has joined #openstack-barbican | 11:14 | |
*** raildo has quit IRC | 11:17 | |
*** Luzi has joined #openstack-barbican | 12:28 | |
*** nearyo has joined #openstack-barbican | 12:34 | |
moguimar | redrobot: meeting? | 13:03 |
---|---|---|
Luzi | o/ | 13:06 |
redrobot | o\ | 13:07 |
redrobot | sorry I'm late, guys! | 13:07 |
redrobot | #startmeeting barbican | 13:07 |
openstack | Meeting started Tue Jan 21 13:07:27 2020 UTC and is due to finish in 60 minutes. The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot. | 13:07 |
openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 13:07 |
*** openstack changes topic to " (Meeting topic: barbican)" | 13:07 | |
openstack | The meeting name has been set to 'barbican' | 13:07 |
nearyo | \o/ | 13:07 |
redrobot | #topic Roll Call | 13:07 |
*** openstack changes topic to "Roll Call (Meeting topic: barbican)" | 13:07 | |
redrobot | Courtesy ping for ade_lee dave-mccowan hrybacki jamespage Luzi lxkong mhen moguimar raildo rm_work xek | 13:08 |
Luzi | o/ again :) | 13:08 |
redrobot | Okay, let's get started! | 13:09 |
redrobot | #topic Secret-Consumers broke the TripleO gate | 13:10 |
*** openstack changes topic to "Secret-Consumers broke the TripleO gate (Meeting topic: barbican)" | 13:10 | |
moguimar | yep, wanted to bring that one up | 13:11 |
redrobot | Looks like the client can't handle changes to the API | 13:11 |
redrobot | so I'm going to make a workaround patch after the meeting | 13:11 |
redrobot | and then work on microversions so we don't break the client again | 13:11 |
redrobot | then work on the client so it doesn't break anymore | 13:11 |
redrobot | I should have the workaround patch up soon (just removing the API response bits) | 13:12 |
redrobot | and then I'll bug y'all for reviews. | 13:12 |
redrobot | any questions/comments? | 13:12 |
moguimar | works for me | 13:14 |
redrobot | ok, moving on | 13:17 |
redrobot | #topic Manipulation of ACL data in DB | 13:17 |
*** openstack changes topic to "Manipulation of ACL data in DB (Meeting topic: barbican)" | 13:17 | |
redrobot | This is an old security audit finding from the Newton cycle | 13:17 |
redrobot | #link https://review.opendev.org/#/c/357978/13/doc/source/artifacts/barbican/newton/review-findings.rst | 13:18 |
redrobot | Finding #1 | 13:18 |
redrobot | basically, if an attacker can modify the database, then they can add arbitrary users to a Secret's ACL, and then retrieve the secret using the API | 13:18 |
redrobot | at the time, we talked about maybe signing acl rows | 13:19 |
redrobot | and then error out if the row fails to validate on retreival | 13:19 |
redrobot | in any case, we should consider fixing it | 13:21 |
redrobot | or at least documenting that DB manipulation is a "Bad Thing"™ | 13:21 |
redrobot | What do y'all think? | 13:21 |
Luzi | redrobot, i need to think about the problem a little bit more - but you are right, something has to be done :D | 13:22 |
redrobot | Luzi, cool, lets revisit this in a week or two | 13:24 |
redrobot | ok, moving on | 13:25 |
redrobot | #topic Barbican UI | 13:25 |
*** openstack changes topic to "Barbican UI (Meeting topic: barbican)" | 13:25 | |
redrobot | nearyo, all yours | 13:26 |
redrobot | #link https://review.opendev.org/#/c/702399/ | 13:26 |
nearyo | Hey, I finally reached a good point for the first contribution to the barbican-ui. With this contribution it is possible to list, show, create, update and delete secrets and their metadata. I left the metadata stuff inside for now, but I would say it's trivial to remove this (as we discussed in shanghai). | 13:26 |
nearyo | https://review.opendev.org/#/c/702399/ | 13:26 |
redrobot | nearyo, that is awesome news! | 13:26 |
nearyo | What do I have to do, to assign this to someone? (It's my first contribution ^^) | 13:26 |
redrobot | I've added myself and ade_lee as reviewers, and I may go poke folks at the horizon channel to see if anyone could also review real quick | 13:27 |
redrobot | It may take me a while though, as I have not written/read any JS in years. 😅 | 13:28 |
nearyo | Nice, thanks :) | 13:28 |
nearyo | Yeah the angular stuff was also "new" for me ^^ | 13:29 |
*** enriquetaso has joined #openstack-barbican | 13:29 | |
redrobot | cool beans | 13:31 |
redrobot | man, it'll be awesome if we can ship this for the next release :D | 13:31 |
*** ade_lee has quit IRC | 13:31 | |
nearyo | I would say if we agree on this we can think about further panel for acls and orders. | 13:31 |
*** ade_lee has joined #openstack-barbican | 13:31 | |
redrobot | nearyo, sounds good | 13:31 |
nearyo | Cool, thats all from my side. ;-) | 13:32 |
redrobot | coolness | 13:32 |
redrobot | #topic Liaison Updates | 13:32 |
*** openstack changes topic to "Liaison Updates (Meeting topic: barbican)" | 13:32 | |
redrobot | moguimar, forgot to ask if you had any updates from Oslo? | 13:32 |
redrobot | ... | 13:37 |
redrobot | I'll take that as a no | 13:37 |
redrobot | #topic Open Discussion | 13:37 |
*** openstack changes topic to "Open Discussion (Meeting topic: barbican)" | 13:37 | |
redrobot | Any other topics we should talk about? | 13:37 |
redrobot | Alrighty then | 13:39 |
redrobot | thanks for coming, everyone! | 13:40 |
redrobot | See y'all next week | 13:40 |
redrobot | #endmeeting | 13:40 |
*** openstack changes topic to "OpenStack Barbican Train Cycle Development - Weekly Meeting Agenda: https://etherpad.openstack.org/p/barbican-weekly-meeting" | 13:40 | |
openstack | Meeting ended Tue Jan 21 13:40:11 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 13:40 |
openstack | Minutes: http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-01-21-13.07.html | 13:40 |
openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-01-21-13.07.txt | 13:40 |
openstack | Log: http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-01-21-13.07.log.html | 13:40 |
*** openstackgerrit has joined #openstack-barbican | 13:45 | |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Revert Secret Consumers API change https://review.opendev.org/703616 | 13:45 |
*** ade_lee has quit IRC | 13:46 | |
*** nearyo has quit IRC | 13:59 | |
*** abishop_ has joined #openstack-barbican | 14:14 | |
*** awalende has quit IRC | 14:16 | |
*** ade_lee has joined #openstack-barbican | 14:16 | |
*** abishop has quit IRC | 14:16 | |
*** ade_lee_ has joined #openstack-barbican | 14:22 | |
*** ade_lee has quit IRC | 14:25 | |
*** abishop_ is now known as abishop | 14:33 | |
*** Luzi has quit IRC | 14:46 | |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Revert Secret Consumers API change https://review.opendev.org/703616 | 15:16 |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Revert Secret Consumers API change https://review.opendev.org/703616 | 16:00 |
*** openstackgerrit has quit IRC | 16:13 | |
*** tosky has quit IRC | 16:33 | |
*** raildo_ has quit IRC | 17:12 | |
*** enriquetaso has quit IRC | 18:36 | |
*** openstackgerrit has joined #openstack-barbican | 19:24 | |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Revert Secret Consumers API change https://review.opendev.org/703616 | 19:24 |
*** tosky has joined #openstack-barbican | 19:25 | |
*** abishop_ has joined #openstack-barbican | 20:15 | |
*** abishop has quit IRC | 20:17 | |
*** ade_lee__ has joined #openstack-barbican | 20:44 | |
*** ade_lee_ has quit IRC | 20:46 | |
*** ade_lee__ has quit IRC | 20:47 | |
*** jmlowe has joined #openstack-barbican | 21:00 | |
*** jmlowe has quit IRC | 22:09 | |
*** jmlowe has joined #openstack-barbican | 22:13 | |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Update README https://review.opendev.org/703702 | 22:13 |
*** jmlowe has quit IRC | 22:17 | |
*** enriquetaso has joined #openstack-barbican | 22:30 | |
*** tosky has quit IRC | 23:47 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!