| *** jamesmcarthur has joined #openstack-infra | 00:03 | |
| *** jamesmcarthur has quit IRC | 00:35 | |
| *** dims has joined #openstack-infra | 00:39 | |
| *** markvoelker has joined #openstack-infra | 00:46 | |
| *** markvoelker has quit IRC | 00:50 | |
| *** jamesmcarthur has joined #openstack-infra | 01:51 | |
| *** jamesmcarthur has quit IRC | 02:16 | |
| *** rmcallis has joined #openstack-infra | 02:44 | |
| *** rmcallis has quit IRC | 02:45 | |
| *** rmcall has quit IRC | 02:46 | |
| *** jamesmcarthur has joined #openstack-infra | 03:04 | |
| *** jamesmcarthur has quit IRC | 03:09 | |
| *** jamesmcarthur has joined #openstack-infra | 03:10 | |
| *** jamesmcarthur has quit IRC | 03:14 | |
| *** markvoelker has joined #openstack-infra | 03:15 | |
| *** jamesmcarthur has joined #openstack-infra | 03:15 | |
| *** markvoelker has quit IRC | 03:20 | |
| *** harlowja has quit IRC | 03:44 | |
| *** jamesmcarthur has quit IRC | 03:49 | |
| *** jamesmcarthur has joined #openstack-infra | 03:59 | |
| *** jamesmcarthur has quit IRC | 04:19 | |
| *** jamesmcarthur has joined #openstack-infra | 04:20 | |
| *** jamesmcarthur has quit IRC | 04:41 | |
| *** jamesmcarthur has joined #openstack-infra | 04:44 | |
| *** jamesmcarthur has quit IRC | 04:48 | |
| *** jamesmcarthur has joined #openstack-infra | 04:49 | |
| *** jamesmcarthur has quit IRC | 04:52 | |
| *** markvoelker has joined #openstack-infra | 05:30 | |
| *** markvoelker has quit IRC | 05:35 | |
| *** dosaboy has quit IRC | 07:01 | |
| *** dosaboy has joined #openstack-infra | 07:14 | |
| *** markvoelker has joined #openstack-infra | 07:30 | |
| *** markvoelker has quit IRC | 07:35 | |
| *** jtomasek has joined #openstack-infra | 07:40 | |
| *** yamamoto has joined #openstack-infra | 07:44 | |
| *** yamamoto has quit IRC | 07:48 | |
| *** jtomasek has quit IRC | 08:12 | |
| *** yamamoto has joined #openstack-infra | 08:17 | |
| *** zbr has joined #openstack-infra | 08:28 | |
| *** zbr_ has quit IRC | 08:30 | |
| *** e0ne has joined #openstack-infra | 08:36 | |
| *** yamamoto has quit IRC | 08:42 | |
| *** yamamoto has joined #openstack-infra | 08:56 | |
| *** xenos76 has joined #openstack-infra | 09:01 | |
| *** yamamoto has quit IRC | 09:07 | |
| *** yamamoto has joined #openstack-infra | 09:15 | |
| *** markvoelker has joined #openstack-infra | 09:30 | |
| *** xeno_os76_xyz has joined #openstack-infra | 09:34 | |
| *** markvoelker has quit IRC | 09:35 | |
| *** xenos76 has quit IRC | 09:37 | |
| *** trident has quit IRC | 10:09 | |
| *** trident has joined #openstack-infra | 10:28 | |
| *** dchen has joined #openstack-infra | 10:28 | |
| zbr | does anyone have a working example of quering opendev gerrit using python with credentials inside netrc? somehow i failed trying pygerrit2 and even requests directly. | 10:33 |
|---|---|---|
| zbr | i mention that I do want to make use of netrc, as I do not like to deal with credentials in my code. | 10:33 |
| zbr | in fact is much easier: basic auth is broken, even testing it with curl does not work. | 10:41 |
| zbr | curl -vn "https://review.opendev.org/changes/?q=owner:self%20status:open" --- should work and not return "Must be signed-in to use owner:self" when you have credentials saved in .netrc | 10:42 |
| *** yolanda has joined #openstack-infra | 10:50 | |
| fungi | zbr: i believe you have to use digest auth, not basic auth | 11:14 |
| zbr | fungi: but probably you know that netrc does work only with basic-auth | 11:15 |
| *** yamamoto has quit IRC | 11:16 | |
| zbr | afaik, digest was a way to make non-https bit more secure, but since https became wild-spread, basic-auth became... secure. | 11:16 |
| fungi | well, i've always had to use digest auth with the gerrit rest api | 11:17 |
| *** yamamoto has joined #openstack-infra | 11:18 | |
| fungi | https://review.opendev.org/Documentation/rest-api.html#authentication | 11:18 |
| fungi | By default Gerrit uses HTTP digest authentication with the HTTP password from the user’s account settings page. HTTP basic authentication is used if auth.gitBasicAuth is set to true in the Gerrit configuration. | 11:18 |
| fungi | so i'm guessing we haven't enabled that nonstandard option | 11:18 |
| zbr | fungi: i find it bit weird because apparently that is what pygerrit2 is trying to use too, same with requests. | 11:19 |
| zbr | i am not saying that we had it wrongly configured, maybe that is the default. | 11:20 |
| zbr | at least the experience seems consistent with review.gerrithub.io | 11:20 |
| fungi | i don't find that weird. i find that it's documented default behavior | 11:21 |
| fungi | not sure why you say "maybe" since the documentation definitely says it's the default | 11:21 |
| zbr | this explains current behavior. now the question is, can we enable basic-auth? | 11:22 |
| fungi | it seems like it might be a reasonable thing to change though | 11:22 |
| fungi | but will require a gerrit restart | 11:22 |
| fungi | and some rough consensus | 11:22 |
| zbr | i guess basic-auth is not enable for security, as it would be a pretty bad idea with non-HTTPS. | 11:23 |
| fungi | right, or with https where the client is trusting untrustworthy certificate authorities (which is... almost all the certificate authorities in the typical browser trust set) | 11:24 |
| openstackgerrit | Sorin Sbarnea proposed zuul/zuul-jobs master: add-build-sshkey: add centos/rhel-8 support https://review.opendev.org/674092 | 11:35 |
| fungi | zbr: out of curiosity, is "self" the only thing you need auth for? if so, it may be simpler just to expect the user to configure their username and use that in anonymous queries instead | 11:37 |
| zbr | fungi: nope, my final query is going to be more complex than that, using other features that require a current user. | 11:37 |
| zbr | but i can wait, there is no pressure on that one. | 11:39 |
| zbr | fungi: btw, the auto-complete in gerrit query is aread PITA. I am trying to type owner:ssbarnea and it seems impossible... either way it will replace it with an email address. | 11:40 |
| zbr | he clearly knows better than me what I want to type ;) | 11:40 |
| *** jonher has quit IRC | 11:49 | |
| *** jonher has joined #openstack-infra | 11:49 | |
| *** eyalb has joined #openstack-infra | 11:57 | |
| *** eyalb has left #openstack-infra | 11:58 | |
| fungi | yeah, the typeahead matching in gerrit wants to prefer a name or e-mail address because usernames are usually not known by other users (not that they're considered particularly secret, just that they're typically not displayed) | 12:09 |
| clarkb | https://2.python-requests.org/en/master/user/authentication/#digest-authentication use that for pygerri2 digest auth | 12:22 |
| clarkb | no gerrit restart required | 12:22 |
| fungi | clarkb: zbr indicated the underlying challenge is that he wants to also be able to use ~/.netrc and https://2.python-requests.org/en/master/user/authentication/#netrc-authentication implies that only works for basic auth | 12:35 |
| zbr | and I think that this is not a limitation of requests library, is. moreof "netrc", everyone using netrc seems to assume basic-auth. | 12:36 |
| clarkb | fungi: you can always read the file yourself I guess | 12:36 |
| zbr | clarkb: please...not. The file systax is more complex that what you would think. it supports multiline! | 12:37 |
| clarkb | zbr I think if you tell curl to digest auth it will do so with the netrc contents | 12:37 |
| zbr | i do not want to write a parser. | 12:37 |
| clarkb | --digest +.netrc I mean | 12:37 |
| fungi | https://python-forum.io/Thread-requests-digest-auth-with-netrc | 12:38 |
| fungi | that's an example of using the netrc module to parse it | 12:39 |
| fungi | zbr: ^ is that a reasonable compromise? | 12:40 |
| clarkb | does enabling basic auth disable digest auth too? because that will break many existing users I expect | 12:40 |
| fungi | it's hard to tell from the config option description | 12:40 |
| fungi | i assumed we'd test it on review-dev first before changing production anyway | 12:41 |
| clarkb | ++ | 12:41 |
| fungi | i definitely had the same question after reading the vague and brief docs for it | 12:41 |
| zbr | so mainly if I want to use https://pypi.org/project/pygerrit2 with our gerrit, i need to patch the library? or is a better python library for talking with it? | 12:42 |
| clarkb | you dont patch the library | 12:42 |
| clarkb | you pass an auth object to the library | 12:42 |
| clarkb | their first example in the library docs shows how to do this | 12:43 |
| *** tosky_ has joined #openstack-infra | 12:43 | |
| clarkb | er I was looking at pypi description but ya first example there | 12:43 |
| zbr | I guess this sensece clarifies it: Also note that in Gerrit version 2.14, support for HTTP Digest authentication was removed and only HTTP Basic authentication is supported | 12:44 |
| zbr | maybe I only need to wait for us to upgrade from 2.13 to 2.14 :D | 12:44 |
| zbr | why to bother implementing digest, when it will be removed at next upgrade. | 12:44 |
| zbr | now i kinda feel stupid for not reading the entire readme. | 12:45 |
| fungi | but that forum post does show how by calling the netrc module directly you can extract the credentials and pass them to the requests object | 12:47 |
| fungi | if you decided you did want to be able to do digest | 12:47 |
| zbr | i do remember that on jira python library I wrote some code that was identifying which auth to use at runtime, working with kerberos/digest/basic | 12:47 |
| *** udesale has joined #openstack-infra | 13:13 | |
| *** bobh has joined #openstack-infra | 13:25 | |
| *** markvoelker has joined #openstack-infra | 13:30 | |
| *** markvoelker has quit IRC | 13:35 | |
| *** noama has joined #openstack-infra | 13:49 | |
| *** e0ne has quit IRC | 14:22 | |
| *** udesale has quit IRC | 14:30 | |
| *** udesale has joined #openstack-infra | 14:31 | |
| *** e0ne has joined #openstack-infra | 14:39 | |
| *** udesale has quit IRC | 14:52 | |
| *** jtomasek has joined #openstack-infra | 14:59 | |
| *** jtomasek has quit IRC | 15:00 | |
| *** jamesmcarthur has joined #openstack-infra | 15:12 | |
| *** smarcet has joined #openstack-infra | 15:14 | |
| *** psachin has joined #openstack-infra | 15:30 | |
| *** jamesmcarthur has quit IRC | 15:42 | |
| *** jamesmcarthur has joined #openstack-infra | 15:43 | |
| *** psachin has quit IRC | 15:43 | |
| *** jamesmcarthur has quit IRC | 15:45 | |
| *** jamesmcarthur has joined #openstack-infra | 15:45 | |
| *** psachin has joined #openstack-infra | 15:50 | |
| *** jamesmcarthur has quit IRC | 15:51 | |
| *** ricolin has joined #openstack-infra | 15:54 | |
| *** jamesmcarthur has joined #openstack-infra | 15:56 | |
| *** EvilienM is now known as Emilienm | 15:58 | |
| *** Emilienm is now known as EmilienM | 15:59 | |
| *** psachin has quit IRC | 16:00 | |
| *** e0ne has quit IRC | 16:03 | |
| *** jamesmcarthur has quit IRC | 16:19 | |
| fungi | as paladox has pointed out to me, the switch to only supporting basic auth in 2.14 is related to no longer storing http passwords on the server. as of 2.14 it stores password hashes in notedb, which means it no longer has the information it needs to be able to perform digest auth | 16:24 |
| fungi | basically the same change which fixed clarkb's many-years-old bug report ;) | 16:24 |
| *** jamesmcarthur has joined #openstack-infra | 16:34 | |
| *** dave-mccowan has joined #openstack-infra | 16:37 | |
| *** ricolin has quit IRC | 16:39 | |
| *** dave-mccowan has quit IRC | 16:42 | |
| *** jamesmcarthur has quit IRC | 16:52 | |
| *** tosky_ has quit IRC | 17:01 | |
| *** bobh has quit IRC | 17:09 | |
| *** Goneri has joined #openstack-infra | 17:13 | |
| *** Goneri has quit IRC | 17:17 | |
| *** Goneri has joined #openstack-infra | 17:25 | |
| *** ralonsoh has joined #openstack-infra | 17:29 | |
| *** smarcet has quit IRC | 17:31 | |
| *** Goneri has quit IRC | 17:41 | |
| ralonsoh | hello folks | 17:59 |
| ralonsoh | is happening something with http://mirror.regionone.fortnebula.opendev.org:8080/rdo/centos7-master/current/delorean.repo | 17:59 |
| ralonsoh | ? | 17:59 |
| ralonsoh | in the networking-ovn repo we are trying to retrieve this repo | 18:00 |
| ralonsoh | but is failing for the last 3 days | 18:00 |
| ralonsoh | wll, only 2 days | 18:00 |
| fungi | ralonsoh: have a job log we can look at? | 18:09 |
| ralonsoh | sure, one sec | 18:10 |
| ralonsoh | fungi, | 18:10 |
| ralonsoh | https://c3308e17743765936b80-6c7fec3fffbf24afb7394804bcdecfae.ssl.cf2.rackcdn.com/678599/1/check/networking-ovn-tripleo-ci-centos-7-containers-multinode/2e13989/job-output.txt | 18:10 |
| clarkb | trunk.rdoproject.org is not responding | 18:12 |
| clarkb | https://trunk.rdoproject.org/centos7-master/current/delorean.repo backs that file and you can't get it either | 18:12 |
| clarkb | (remember these are just proxies, if the backend is not responding then the proxy will eventually expire its cached data and do the same) | 18:12 |
| ralonsoh | ahhhh ok | 18:12 |
| ralonsoh | I'll ping the guys in RDO to check what is happening | 18:12 |
| ralonsoh | thanks! | 18:13 |
| clarkb | ralonsoh: https://opendev.org/opendev/system-config/src/branch/master/modules/openstack_project/templates/mirror.vhost.erb is the proxy config if you want ot look up what a backend is for a url | 18:18 |
| clarkb | I usually find the vhost based on port number then look at the first path entry prefix to find the backend | 18:18 |
| ralonsoh | clarkb, ahhh I got it now, good info! | 18:20 |
| *** coreycb has quit IRC | 18:24 | |
| *** coreycb has joined #openstack-infra | 18:27 | |
| *** csatari has quit IRC | 18:27 | |
| *** jamesmcarthur has joined #openstack-infra | 18:28 | |
| *** portdirect has quit IRC | 18:28 | |
| *** sdoran has quit IRC | 18:28 | |
| *** csatari has joined #openstack-infra | 18:29 | |
| *** portdirect has joined #openstack-infra | 18:30 | |
| *** sdoran has joined #openstack-infra | 18:30 | |
| *** bobh has joined #openstack-infra | 18:39 | |
| *** jamesmcarthur has quit IRC | 19:08 | |
| *** e0ne has joined #openstack-infra | 19:35 | |
| *** ralonsoh has quit IRC | 20:18 | |
| *** kjackal has joined #openstack-infra | 20:18 | |
| *** xek has joined #openstack-infra | 20:26 | |
| *** rkukura has quit IRC | 20:26 | |
| *** e0ne has quit IRC | 20:27 | |
| *** markvoelker has joined #openstack-infra | 20:49 | |
| *** markvoelker has quit IRC | 20:54 | |
| *** kjackal has quit IRC | 21:08 | |
| *** dchen has quit IRC | 21:31 | |
| *** rcernin has joined #openstack-infra | 21:45 | |
| *** tobberydberg has quit IRC | 22:05 | |
| *** tobberydberg has joined #openstack-infra | 22:05 | |
| *** sshnaidm|off is now known as sshnaidm|pto | 22:06 | |
| *** kukacz has quit IRC | 22:16 | |
| *** smarcet has joined #openstack-infra | 22:20 | |
| *** kukacz has joined #openstack-infra | 22:25 | |
| *** kukacz has quit IRC | 22:26 | |
| *** smarcet has left #openstack-infra | 22:34 | |
| *** xeno_os76_xyz has quit IRC | 22:57 | |
| *** tkajinam has joined #openstack-infra | 22:57 | |
| *** xek has quit IRC | 23:23 | |
| *** bobh has quit IRC | 23:31 | |
| *** rcernin has quit IRC | 23:35 | |
| *** dchen has joined #openstack-infra | 23:37 | |
| *** dchen has quit IRC | 23:53 | |
| *** dchen has joined #openstack-infra | 23:53 | |
| *** smarcet has joined #openstack-infra | 23:57 | |
| *** xenos76 has joined #openstack-infra | 23:59 | |
| *** rcernin has joined #openstack-infra | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!