| *** salv-orlando has joined #openstack-security | 00:01 | |
| *** openstack has joined #openstack-security | 00:04 | |
| openstackgerrit | Nathaniel Dillon proposed openstack/security-doc: Adding section to compute chapter https://review.openstack.org/202825 | 00:05 |
|---|---|---|
| *** salv-orlando has quit IRC | 00:06 | |
| *** y_sawai has joined #openstack-security | 00:18 | |
| *** y_sawai has quit IRC | 00:19 | |
| *** hyakuhei1 has quit IRC | 00:28 | |
| *** hyakuhei has joined #openstack-security | 00:28 | |
| *** sdake has joined #openstack-security | 00:30 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:37 | |
| *** barra204 has quit IRC | 00:39 | |
| *** tmcpeak has quit IRC | 01:10 | |
| *** bpokorny has quit IRC | 01:32 | |
| *** hyakuhei has quit IRC | 01:37 | |
| *** hyakuhei has joined #openstack-security | 01:39 | |
| *** elo1 has joined #openstack-security | 01:50 | |
| *** elo has quit IRC | 01:54 | |
| *** dave-mccowan has quit IRC | 02:18 | |
| *** y_sawai has joined #openstack-security | 02:48 | |
| *** y_sawai has quit IRC | 02:49 | |
| *** hyakuhei has quit IRC | 02:49 | |
| *** hyakuhei has joined #openstack-security | 02:50 | |
| *** y_sawai has joined #openstack-security | 02:52 | |
| *** elo1 has quit IRC | 03:01 | |
| *** y_sawai_ has joined #openstack-security | 03:01 | |
| *** y_sawai has quit IRC | 03:04 | |
| *** tmcpeak has joined #openstack-security | 03:13 | |
| *** tmcpeak has quit IRC | 03:13 | |
| *** tmcpeak has joined #openstack-security | 03:15 | |
| *** hyakuhei has quit IRC | 03:17 | |
| *** hyakuhei has joined #openstack-security | 03:19 | |
| *** sdake has quit IRC | 03:23 | |
| *** sdake has joined #openstack-security | 03:33 | |
| *** y_sawai_ has quit IRC | 03:48 | |
| *** y_sawai has joined #openstack-security | 03:48 | |
| *** y_sawai has quit IRC | 03:49 | |
| *** y_sawai has joined #openstack-security | 03:49 | |
| *** y_sawai has quit IRC | 03:54 | |
| *** hyakuhei has quit IRC | 03:55 | |
| *** hyakuhei has joined #openstack-security | 03:55 | |
| *** misc has quit IRC | 04:17 | |
| *** misc has joined #openstack-security | 04:25 | |
| *** y_sawai has joined #openstack-security | 04:30 | |
| *** y_sawai has quit IRC | 04:36 | |
| *** sicarie is now known as sicarie_away | 04:46 | |
| *** sdake has quit IRC | 04:56 | |
| *** hyakuhei has quit IRC | 05:05 | |
| *** hyakuhei has joined #openstack-security | 05:09 | |
| *** browne has quit IRC | 05:16 | |
| *** tmcpeak has quit IRC | 05:19 | |
| *** browne has joined #openstack-security | 05:21 | |
| *** Daviey_ has joined #openstack-security | 05:22 | |
| *** Daviey has quit IRC | 05:23 | |
| *** browne has quit IRC | 05:27 | |
| *** markvoelker has joined #openstack-security | 05:41 | |
| *** markvoelker_ has joined #openstack-security | 05:44 | |
| *** markvoelker has quit IRC | 05:45 | |
| *** y_sawai has joined #openstack-security | 05:52 | |
| *** hyakuhei has quit IRC | 06:06 | |
| *** ig0r_ has joined #openstack-security | 06:08 | |
| *** hyakuhei has joined #openstack-security | 06:11 | |
| *** ig0r_ has quit IRC | 06:45 | |
| *** ig0r_ has joined #openstack-security | 06:49 | |
| *** y_sawai has quit IRC | 07:07 | |
| openstackgerrit | Andreas Jaeger proposed openstack/security-specs: Housekeeping https://review.openstack.org/202904 | 07:09 |
| openstackgerrit | Andreas Jaeger proposed openstack/security-specs: Sync with global requirements https://review.openstack.org/202906 | 07:12 |
| *** kutija_ has quit IRC | 07:25 | |
| *** kutija has joined #openstack-security | 07:26 | |
| *** alex_klimov has joined #openstack-security | 07:28 | |
| *** salv-orlando has joined #openstack-security | 07:39 | |
| openstackgerrit | Andreas Jaeger proposed openstack/security-doc: Setup RST Security Guide https://review.openstack.org/202917 | 08:03 |
| *** salv-orlando has quit IRC | 08:17 | |
| *** hyakuhei1 has joined #openstack-security | 08:18 | |
| *** hyakuhei has quit IRC | 08:18 | |
| *** markvoelker_ has quit IRC | 08:42 | |
| *** markvoelker has joined #openstack-security | 08:57 | |
| *** markvoelker has quit IRC | 09:02 | |
| *** markvoelker has joined #openstack-security | 09:12 | |
| *** Daviey_ is now known as Daviey | 09:14 | |
| *** markvoelker has quit IRC | 09:17 | |
| *** hyakuhei1 has quit IRC | 09:24 | |
| *** hyakuhei has joined #openstack-security | 09:25 | |
| *** markvoelker has joined #openstack-security | 09:26 | |
| *** tkelsey has joined #openstack-security | 09:30 | |
| *** markvoelker has quit IRC | 09:31 | |
| *** hyakuhei has quit IRC | 09:35 | |
| *** hyakuhei has joined #openstack-security | 09:37 | |
| *** markvoelker has joined #openstack-security | 09:41 | |
| *** markvoelker has quit IRC | 09:45 | |
| *** rmarathu has joined #openstack-security | 09:50 | |
| *** Nospheratos has joined #openstack-security | 09:52 | |
| *** markvoelker has joined #openstack-security | 09:55 | |
| *** markvoelker has quit IRC | 10:00 | |
| openstackgerrit | Andreas Jaeger proposed openstack/security-doc: Setup RST Security Guide https://review.openstack.org/202917 | 10:01 |
| *** markvoelker has joined #openstack-security | 10:07 | |
| *** markvoelker has quit IRC | 10:12 | |
| *** markvoelker has joined #openstack-security | 10:22 | |
| *** Nospheratos has quit IRC | 10:29 | |
| *** openstackgerrit has quit IRC | 10:31 | |
| *** openstackgerrit has joined #openstack-security | 10:31 | |
| *** markvoelker has quit IRC | 10:32 | |
| *** markvoelker has joined #openstack-security | 10:37 | |
| *** sdake has joined #openstack-security | 10:39 | |
| *** markvoelker has quit IRC | 10:42 | |
| *** hyakuhei has quit IRC | 10:50 | |
| *** hyakuhei has joined #openstack-security | 10:51 | |
| *** markvoelker has joined #openstack-security | 10:51 | |
| *** markvoelker has quit IRC | 10:56 | |
| *** markvoelker has joined #openstack-security | 11:06 | |
| *** markvoelker has quit IRC | 11:11 | |
| *** rmarathu has quit IRC | 11:17 | |
| *** kcaj has joined #openstack-security | 11:19 | |
| *** markvoelker has joined #openstack-security | 11:19 | |
| *** markvoelker has quit IRC | 11:24 | |
| *** sdake has quit IRC | 11:32 | |
| *** markvoelker has joined #openstack-security | 11:32 | |
| *** markvoelker has quit IRC | 11:44 | |
| *** rmarathu has joined #openstack-security | 11:49 | |
| *** markvoelker has joined #openstack-security | 11:55 | |
| *** markvoelker has quit IRC | 12:00 | |
| *** markvoelker has joined #openstack-security | 12:09 | |
| *** hyakuhei has quit IRC | 12:10 | |
| *** hyakuhei has joined #openstack-security | 12:11 | |
| *** markvoelker has quit IRC | 12:13 | |
| *** markvoelker has joined #openstack-security | 12:16 | |
| *** markvoelker has quit IRC | 12:21 | |
| *** edmondsw has joined #openstack-security | 12:23 | |
| *** markvoelker has joined #openstack-security | 12:24 | |
| *** markvoelker has quit IRC | 12:32 | |
| *** sdake has joined #openstack-security | 12:34 | |
| *** rmarathu has quit IRC | 12:39 | |
| *** markvoelker has joined #openstack-security | 12:39 | |
| *** markvoelker has quit IRC | 12:43 | |
| *** markvoelker has joined #openstack-security | 12:53 | |
| *** markvoelker has quit IRC | 12:58 | |
| *** rmarathu has joined #openstack-security | 12:59 | |
| *** browne has joined #openstack-security | 13:00 | |
| *** rmarathu has quit IRC | 13:05 | |
| *** markvoelker has joined #openstack-security | 13:05 | |
| *** markvoelker_ has joined #openstack-security | 13:07 | |
| *** markvoelker has quit IRC | 13:09 | |
| *** markvoelker_ has quit IRC | 13:34 | |
| *** tmcpeak has joined #openstack-security | 13:41 | |
| tkelsey | o/ tmcpeak | 13:42 |
| tmcpeak | yo | 13:42 |
| *** markvoelker has joined #openstack-security | 13:49 | |
| *** dave-mccowan has joined #openstack-security | 13:54 | |
| *** markvoelker has quit IRC | 13:54 | |
| *** markvoelker has joined #openstack-security | 13:59 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:06 | |
| *** markvoelker has quit IRC | 14:07 | |
| *** fubi has quit IRC | 14:12 | |
| *** markvoelker has joined #openstack-security | 14:14 | |
| *** markvoelker has quit IRC | 14:18 | |
| *** hyakuhei1 has joined #openstack-security | 14:23 | |
| *** hyakuhei has quit IRC | 14:23 | |
| *** timkennedy has quit IRC | 14:24 | |
| *** markvoelker has joined #openstack-security | 14:28 | |
| *** sicarie_away is now known as sicarie | 14:31 | |
| *** markvoelker has quit IRC | 14:33 | |
| openstackgerrit | Merged openstack/anchor: Add tests for CA read failures https://review.openstack.org/201877 | 14:35 |
| *** voodookid has joined #openstack-security | 14:36 | |
| *** markvoelker has joined #openstack-security | 14:50 | |
| tmcpeak | sigmavirus24, browne, chair6, Daviey, tkelsey: https://bugs.launchpad.net/bandit/+bug/1475681 | 14:52 |
| openstack | Launchpad bug 1475681 in Bandit "System wide pip install fails on some platforms" [Undecided,New] | 14:52 |
| Daviey | uho | 14:52 |
| tmcpeak | I saw something similar when working with one of our devs yesterday | 14:52 |
| tmcpeak | only way I can think this could happen is if it can't find plugins | 14:53 |
| Daviey | tmcpeak: have you done a bisect? | 14:53 |
| tmcpeak | so I think at a minimum we need to scream very loudly if it can't find any plugins | 14:53 |
| tmcpeak | if it can't find plugins we can probably just print a big loud error message and exit | 14:53 |
| tmcpeak | no point in running without plugins | 14:53 |
| tmcpeak | now the real question is why it can't find plugins in this case | 14:53 |
| Daviey | tmcpeak: "report any findings for some projects." .. since last week, bandit exits if it can't find any plugins | 14:53 |
| tmcpeak | ahh ok, that hasn't been pushed into PyPI yet | 14:54 |
| Daviey | Yeah.. only landed last week | 14:54 |
| tmcpeak | Daviey: ok awesome | 14:54 |
| tmcpeak | now new question is why can't it find the plugins ;) | 14:54 |
| browne | yep, i've seen this before. when it can't find the plugins | 14:54 |
| tmcpeak | seems to happen more frequently on Ubuntu... | 14:55 |
| tmcpeak | gmurphy as well as the dev I was talking to see it on Ubuntu systems | 14:55 |
| Daviey | $ bandit . | 14:55 |
| Daviey | [bandit]INFOusing config: /home/dave/openstack/old/bandit/bandit/config/bandit.yaml | 14:55 |
| Daviey | [bandit]INFOrunning on Python 2.7.6 | 14:55 |
| Daviey | [bandit]ERRORCould not find any tests to apply, please check the configuration. | 14:55 |
| Daviey | $ echo $? | 14:55 |
| Daviey | 2 | 14:55 |
| browne | you don't need vagrant to reproduce | 14:55 |
| tmcpeak | Daviey: ok awesome, so that part's handled | 14:56 |
| tmcpeak | browne: well I probably need vagrant to reproduce since I don't run Ubuntu | 14:56 |
| browne | oh ok. i always use Ubuntu | 14:56 |
| Daviey | tmcpeak: The finding of plugins may well change if we change to a stevedore based plugin infrastructure | 14:56 |
| *** markvoelker has quit IRC | 14:57 | |
| *** markvoelker_ has joined #openstack-security | 14:57 | |
| *** markvoelker_ has quit IRC | 14:57 | |
| browne | Daviey: is there a stevedore patch in flight? | 14:57 |
| tmcpeak | Daviey: true | 14:57 |
| *** markvoelker has joined #openstack-security | 14:57 | |
| Daviey | browne: I started toying around with it.. but I am now writing a spec for it | 14:57 |
| Daviey | tmcpeak: So i have seen something similar in my local env. When i am using bandit bin from my tox -e py27 environment, i need to symlink the plugin directory into the site-packages under tox env. | 14:59 |
| *** dwyde has joined #openstack-security | 15:00 | |
| tmcpeak | interesting | 15:00 |
| tmcpeak | so where is your Bandit bin and where are the plugins? | 15:00 |
| tmcpeak | rather where is your bandit.py | 15:00 |
| Daviey | bandit/.tox/py27/bin/bandit | 15:01 |
| Daviey | Doing an strace it ONLY looks for plugins in bandit/.tox/py27/lib/python2.7/site-packages/bandit/plugins | 15:01 |
| tmcpeak | oh, I failed to correctly read your original message | 15:01 |
| tmcpeak | hmmmmm... | 15:02 |
| sigmavirus24 | hm | 15:02 |
| * sigmavirus24 is doing vagrant up still | 15:02 | |
| tmcpeak | isn't bandit/.tox/py27/bin/bandit itself a symlink to something? | 15:02 |
| *** timkennedy has joined #openstack-security | 15:02 | |
| *** bknudson has joined #openstack-security | 15:03 | |
| sigmavirus24 | in retrospect, I could have just spun up a cloud server faster | 15:03 |
| * sigmavirus24 shrugs | 15:03 | |
| Daviey | There is a ./lib/python2.7/site-packages/bandit.egg-link which points to the git root, and SHOULD be respected.. but the plugin finding doesn't respect it | 15:03 |
| browne | i'm trying to reproduce now on my ubuntu | 15:03 |
| sigmavirus24 | tmcpeak: should be | 15:03 |
| tmcpeak | sigmavirus24: how does flake8 handle this? | 15:04 |
| tmcpeak | no sense coming up with a solution when we can just steal one | 15:04 |
| sigmavirus24 | so ... all of our plugins are 3rd party packages anyway | 15:04 |
| sigmavirus24 | so basically we use pkg_resources (stevedore without all the convenience) and import from our entry-point | 15:04 |
| Daviey | tmcpeak: The bandit executable is a pbr generated script, which DOES respect the egg.link file | 15:04 |
| Daviey | http://paste.openstack.org/show/383932/ | 15:05 |
| sigmavirus24 | But I suspect that we're not packaging things correctly | 15:05 |
| sigmavirus24 | which I have a different way of verifying | 15:05 |
| sigmavirus24 | I suspect that setuptools isn't grabbing bandit/plugins | 15:05 |
| sigmavirus24 | because it doesn't know that it should | 15:05 |
| tmcpeak | sigmavirus24: I think you're right | 15:05 |
| Daviey | sigmavirus24: I'm not sure it is that... | 15:05 |
| sigmavirus24 | Daviey: that's my first suspicion | 15:05 |
| sigmavirus24 | I haven't confirmed it yet | 15:05 |
| tmcpeak | Daviey: what's this output from? | 15:06 |
| sigmavirus24 | also, keep in mind, tox installed != pip installed | 15:06 |
| Daviey | tmcpeak: that pastebin is the bandit executable | 15:06 |
| Daviey | sigmavirus24: I'm almost certain this issue is caused because we have a cack handed plugin discovery | 15:06 |
| Daviey | which doesn't respect egg link files | 15:07 |
| sigmavirus24 | egg-link is when you do "python setup.py install" which is not what pip does | 15:07 |
| sigmavirus24 | that's what tox does | 15:07 |
| tmcpeak | Daviey: that sounds right too, extra points for "cack handed" | 15:07 |
| sigmavirus24 | pip does not make eggs anymore | 15:07 |
| sigmavirus24 | (hasn't in a long long time) | 15:07 |
| browne | ericwb@ericwb-virtual-machine:~/bandit$ time .tox/py27/bin/bandit -r ../nova/ | 15:08 |
| browne | [bandit]INFOusing config: /home/ericwb/bandit/bandit/config/bandit.yaml | 15:08 |
| browne | [bandit]INFOrunning on Python 2.7.6 | 15:08 |
| browne | [bandit]ERRORCould not find any tests to apply, please check the configuration. | 15:08 |
| browne | real0m0.383s | 15:08 |
| browne | user0m0.340s | 15:08 |
| browne | sys0m0.040s | 15:08 |
| Daviey | tmcpeak: Sorry, British-ishm.. | 15:08 |
| tmcpeak | I like British-ism | 15:08 |
| tmcpeak | s | 15:08 |
| *** bpokorny has joined #openstack-security | 15:08 | |
| tmcpeak | ok, browne: so you can reproduce | 15:08 |
| tmcpeak | would you mind putting in a "import pdb; pdb.set_trace()" | 15:08 |
| Daviey | browne: strace -f .tox/py27/bin/bandit -r ../nova/ 2>&1 | grep plugins | 15:09 |
| tmcpeak | and then doing "os.path.abspath(os.curdir) | 15:09 |
| tmcpeak | would be good to know where Bandit is actually executing from and where the Bandit plugins are in relation to that | 15:09 |
| *** timkennedy has quit IRC | 15:09 | |
| Daviey | I think browne is seeing the same thing i described | 15:10 |
| tmcpeak | or Daviey, anybody that has the issue in front of them, | 15:10 |
| sigmavirus24 | I can confirm that bandit/plugins is included | 15:10 |
| Daviey | tmcpeak: Anywhere particular, or just in the bandit executable ? | 15:11 |
| tmcpeak | as close to main as you can get | 15:11 |
| Daviey | ok | 15:12 |
| browne | ericwb@ericwb-virtual-machine:~/bandit$ strace -f .tox/py27/bin/bandit -r ../nova/ 2>&1 | grep plugins | 15:12 |
| browne | openat(AT_FDCWD, "/home/ericwb/bandit/.tox/py27/lib/python2.7/site-packages/bandit/plugins", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 ENOENT (No such file or directory) | 15:12 |
| tmcpeak | ok cool, so that's as expected, it's looking for the plugins basically in the same place it would if it was a source install | 15:12 |
| tmcpeak | now the question is where are the plugins actually installed | 15:12 |
| tmcpeak | or are they | 15:13 |
| *** sdake has quit IRC | 15:13 | |
| sigmavirus24 | oh | 15:13 |
| sigmavirus24 | I know what the problem is | 15:13 |
| tmcpeak | sick - what you got? | 15:13 |
| browne | bandit is not installed here: ~/bandit/.tox/py27/lib/python2.7/site-packages | 15:13 |
| sigmavirus24 | so on Ubuntu apt installs to /usr/lib/python2.7/dist-packages | 15:13 |
| sigmavirus24 | pip installs to /usr/local/lib/python2.7/dist-packages | 15:13 |
| Daviey | browne: can you do, ls -al /home/ericwb/bandit/.tox/py27/lib/python2.7/site-packages/bandit* | 15:13 |
| sigmavirus24 | for some reason, we're looking in teh wrong place | 15:13 |
| Daviey | ^^ i bet there is an egg link file | 15:13 |
| tmcpeak | who is doing apt though? | 15:14 |
| sigmavirus24 | http://paste.openstack.org/show/383960/ | 15:14 |
| browne | Daviey: right, no bandit there | 15:14 |
| browne | ubuntu typically goes to dist-packages | 15:14 |
| Daviey | browne: but there is an egg link file called bandit? | 15:14 |
| sigmavirus24 | browne: they both go to dist-packages but one is /usr/lib and the other is /usr/local/lib | 15:14 |
| browne | Daviey: nope, no bandit dir of any kind | 15:15 |
| sigmavirus24 | ther is no .egg-info | 15:15 |
| Daviey | sigmavirus24: I think this is the wrong road you are going down... python (outside of tox) should search all PYTHONPATH's | 15:15 |
| browne | sigmavirus24: pip installed goes to /usr/local/lib, whereas deb packages go to /usr/lib | 15:15 |
| sigmavirus24 | Daviey: look at my paste and the original bug | 15:16 |
| sigmavirus24 | bandit installed with pip, when you strace that, you get one attempt to open "bandit/plugins" in /usr/lib/python2.7/dist-packages | 15:16 |
| sigmavirus24 | but bandit, installed by pip, goes in /usr/local/lib/python2.7/dist-packages | 15:16 |
| Daviey | Yes, and i am saying it shouldn't matter | 15:16 |
| Daviey | This is because of our clumsy plugin discovery | 15:17 |
| browne | ericwb@ericwb-virtual-machine:~/bandit/.tox$ find |grep bandit | 15:17 |
| browne | ./py27/lib/python2.7/site-packages/bandit.egg-link | 15:17 |
| browne | ./py27/bin/bandit | 15:17 |
| openstackgerrit | Merged openstack/anchor: Add tests for higher coverage https://review.openstack.org/201464 | 15:17 |
| Daviey | if i put foobar.py in /usr/local/lib or /usr/lib/.. python should search the entire path and find the first one that matches that name, right? | 15:18 |
| tmcpeak | does anybody know of a way to reproduce this on the mac without Vagrant, or am I barking up the wrong tree? | 15:18 |
| browne | Daviey: correct | 15:18 |
| sigmavirus24 | tmcpeak: Mac's don't do this silly separation of logic | 15:18 |
| tmcpeak | ;) | 15:18 |
| tmcpeak | hence why I've never seen the problem | 15:18 |
| browne | tmcpeak: just use vmware fusion to spin up a ubuntu. :) | 15:19 |
| Daviey | right, so browne confirmed the same behaviour as me... the executable 'bandit' CORRECTLY finds the bandit lib.. but later fails to find the plugin as it isn't respecting ./py27/lib/python2.7/site-packages/bandit.egg-link | 15:19 |
| sigmavirus24 | It's because of https://github.com/openstack/bandit/blob/8c7c1e53c56a299ca893ef9fde8f6d120341495f/bandit/core/constants.py#L37 | 15:19 |
| tmcpeak | yeah, I've got a VM, so once I do that 'pip install bandit'? | 15:19 |
| sigmavirus24 | We just need to convert the rest of the stuff to use the entry-points that we have available | 15:19 |
| sigmavirus24 | That will fix all of this | 15:19 |
| sigmavirus24 | tmcpeak: if you have pip installed, yes | 15:19 |
| gmurphy | tmcpeak: yeah vagrant isn't necessary just ubuntu vm | 15:20 |
| tmcpeak | ok cool | 15:20 |
| browne | tmcpeak: just follow instructions by Ian in https://review.openstack.org/#/c/199548/. see comment PS4 | 15:20 |
| Daviey | sigmavirus24: right, that is the clumsy bit i was talking about | 15:20 |
| Daviey | not respecting egg-link files | 15:20 |
| sigmavirus24 | So we already have logic to load plugins from entry-points | 15:21 |
| sigmavirus24 | We just need to add the entry-points for our own plugins and stop that silly looking for plugins in a specific directory :D | 15:22 |
| browne | ++ | 15:22 |
| Daviey | Well we could do that... or just switch to stevedore :) | 15:22 |
| tmcpeak | sigmavirus24, Daviey, browne: yeah, that sounds sensible | 15:22 |
| tmcpeak | Daviey: stevedore is already being used for extensions | 15:22 |
| Daviey | The workaround i've been doing is: mkdir -p $(pwd)/.tox/py27/lib/python2.7/site-packages/bandit | 15:22 |
| Daviey | ln -s $(pwd)/bandit/plugins /home/dave/openstack/old/bandit/.tox/py27/lib/python2.7/site-packages/bandit/plugins | 15:23 |
| Daviey | tmcpeak: I mean using it for plugins | 15:23 |
| sigmavirus24 | Daviey: we already use stevedore | 15:23 |
| Daviey | For plugins? | 15:23 |
| sigmavirus24 | We allow third party plugins through stevedore | 15:23 |
| sigmavirus24 | yes | 15:23 |
| sigmavirus24 | We just never registered our own through the entrypoints for stevedore to find | 15:23 |
| Daviey | Ah, so we need to use entry-points for OUR plugins then? | 15:23 |
| Daviey | right | 15:23 |
| sigmavirus24 | yes | 15:23 |
| tmcpeak | yep | 15:24 |
| sigmavirus24 | Add them to setup.cfg, remove that other hackery, confirm you still have your plugins, send review, merge it, cut 0.12.1 | 15:24 |
| Daviey | sigmavirus24: Do you want to JFDI, or should i? | 15:24 |
| tmcpeak | JFDI, forget the spec | 15:24 |
| Daviey | yeah | 15:24 |
| tmcpeak | we all know this is what we need | 15:24 |
| Daviey | Who is doing it? | 15:25 |
| tmcpeak | I don't want specs to trip us up, just used for coordination for when ideas might be contentious | 15:25 |
| Daviey | Yeah, this isn't contentious. :) | 15:25 |
| tmcpeak | Daviey: are you willing to? | 15:25 |
| sigmavirus24 | Daviey: if you have the time, go ahead | 15:25 |
| sigmavirus24 | Otherwise, I'll get to it sometime tonight | 15:25 |
| tmcpeak | I'm under-the-gun ATM, but I could get to it next week | 15:26 |
| Daviey | Well, it is Friday afternoon and I've peaked from doing primary work.. So.. i could give it a gander | 15:26 |
| tmcpeak | if somebody can do it faster than that, that would be awesome | 15:26 |
| tmcpeak | Daviey: great! | 15:26 |
| tmcpeak | thanks man | 15:26 |
| tmcpeak | the effort you save in writing the spec might be enough to get it merged :P | 15:26 |
| Daviey | yeahhah | 15:27 |
| tmcpeak | browne, Daviey, sigmavirus24: thanks for the swarming | 15:27 |
| browne | tmcpeak: np | 15:28 |
| Daviey | np | 15:28 |
| sigmavirus24 | Daviey: feel free to ping me here for a +2 | 15:28 |
| sigmavirus24 | I know what it /should/ look like | 15:28 |
| sigmavirus24 | And I'm happy to test it on my vm when it's done to make sure it works as expected | 15:28 |
| tmcpeak | yeah, I'll watch for your change as well and move reviews to the top of the queue | 15:28 |
| openstackgerrit | Merged openstack/anchor: Make sure X509_NAME lives long enough https://review.openstack.org/202078 | 15:28 |
| *** sdake has joined #openstack-security | 15:28 | |
| browne | I can help with the other +2 today. i have a local env to test also | 15:29 |
| tmcpeak | sweet! | 15:29 |
| tmcpeak | good stuff guys | 15:29 |
| browne | tmcpeak: but cutting 0.12.1 is all you. :) | 15:30 |
| tmcpeak | for sure | 15:30 |
| sigmavirus24 | tmcpeak: gets to test drive openstack/releases for ossg | 15:30 |
| sigmavirus24 | =P | 15:30 |
| tmcpeak | lol | 15:30 |
| sigmavirus24 | assuming the release managers manage bandit releases too | 15:30 |
| tmcpeak | they haven't until now, but it might change now that we're in the big umbrella or whatever it's called | 15:31 |
| sigmavirus24 | I guess not | 15:31 |
| sigmavirus24 | tumbrella (tent + umbrella) | 15:31 |
| sigmavirus24 | tentrella? | 15:31 |
| sigmavirus24 | umbtenta? | 15:31 |
| tmcpeak | we're in the big tentrella now | 15:31 |
| openstackgerrit | Merged openstack/anchor: Add test for robots file https://review.openstack.org/201879 | 15:33 |
| *** timkennedy has joined #openstack-security | 15:35 | |
| Daviey | Being in the big tetrapack means that centralized release management isn't a thing.. right? | 15:41 |
| *** rol01340 has joined #openstack-security | 15:42 | |
| tmcpeak | Daviey: yeah, nobody has cornered me yet though ;) | 15:43 |
| *** rol01340 has left #openstack-security | 15:44 | |
| openstackgerrit | Tim Kelsey proposed openstack/bandit: Improving SQL Injection detection https://review.openstack.org/202646 | 15:54 |
| tmcpeak | I just had a not so fun thought - this release actually might break gates | 15:55 |
| tmcpeak | let's say a project has been thinking they had no issues because Bandit was running with no plugins. Now all of a sudden it finds the plugins and boom, fails | 15:55 |
| tmcpeak | I think we actually need to validate that we aren't generating new findings in the existing project gates before we push :\ | 15:55 |
| tkelsey | tmcpeak: we need to use that cool script the get the projects using it and the config in use, then we need to run it locally | 15:55 |
| tmcpeak | it's a longshot that projects have been running incorrectly this whole time, but if they are it would really suck | 15:56 |
| tkelsey | if we find unexpected stuff, we need to let the project know before pushing | 15:56 |
| tmcpeak | tkelsey: yeah, for sure | 15:56 |
| tkelsey | im sure it will be fine so long as we give a heads up | 15:56 |
| tkelsey | and maybe even a patch or two if we find stuff | 15:57 |
| tmcpeak | yeah | 15:57 |
| tkelsey | priority testing goes to Keystone, since bknudson has been a hero and adopted it early | 15:58 |
| tmcpeak | yeah, I think they're the only voting gate still too | 15:59 |
| tkelsey | cool | 15:59 |
| tmcpeak | so technically nothing would break | 15:59 |
| tmcpeak | would still be good to check them all though | 15:59 |
| tkelsey | yeah | 16:00 |
| openstackgerrit | Tim Kelsey proposed openstack/bandit: Improving SQL Injection detection https://review.openstack.org/202646 | 16:04 |
| *** Windir has joined #openstack-security | 16:11 | |
| *** Windir has quit IRC | 16:11 | |
| *** Windir has joined #openstack-security | 16:13 | |
| *** alex_klimov has quit IRC | 16:25 | |
| *** hyakuhei1 has quit IRC | 16:49 | |
| *** hyakuhei has joined #openstack-security | 16:52 | |
| *** sigmavirus24 has quit IRC | 16:52 | |
| *** sigmavirus24 has joined #openstack-security | 16:53 | |
| *** elo has joined #openstack-security | 16:53 | |
| sigmavirus24 | tmcpeak: so | 16:54 |
| *** browne has quit IRC | 16:54 | |
| tmcpeak | sigmavirus24: wassup | 16:54 |
| sigmavirus24 | If I understand correctly, installing and using from within tox shouldn't be an issue for us | 16:54 |
| *** dwyde has quit IRC | 16:54 | |
| sigmavirus24 | That should also be how most of the projects consume bandit, no? | 16:54 |
| tmcpeak | sigmavirus24: yeah, most are using a tox bandit setup | 16:56 |
| *** sigmavirus24 has quit IRC | 16:57 | |
| *** sigmavirus24 has joined #openstack-security | 17:00 | |
| tmcpeak | sigmavirus24: oh, I see what you're saying.. yeah, you're right. If they're using tox nothing should change | 17:10 |
| sigmavirus24 | tmcpeak: I'll verify it | 17:10 |
| sigmavirus24 | * against trove | 17:10 |
| tmcpeak | sigmavirus24: awesome, thank you | 17:10 |
| tmcpeak | my favorite | 17:11 |
| sigmavirus24 | tmcpeak: I shouldn't need to since gmurphy said it worked fine inside a virtualenv in the bug | 17:11 |
| sigmavirus24 | But just to be extra paranoid | 17:11 |
| sigmavirus24 | =P | 17:11 |
| tmcpeak | yeah, we ended up solving the problem for the internal dev I was talking to yesterday with a venv | 17:12 |
| sigmavirus24 | oh | 17:13 |
| sigmavirus24 | I forgot tox always installs the project | 17:13 |
| sigmavirus24 | =( | 17:13 |
| sigmavirus24 | installing trove is taking a while | 17:13 |
| sigmavirus24 | =P | 17:13 |
| sigmavirus24 | -_- | 17:13 |
| tmcpeak | installs? | 17:13 |
| tmcpeak | it does? | 17:14 |
| sigmavirus24 | by default tox will do `python setup.py install` (roughly) | 17:14 |
| tmcpeak | huh | 17:14 |
| tmcpeak | I learn something new | 17:14 |
| tmcpeak | 'eryday | 17:14 |
| openstackgerrit | Tim Kelsey proposed openstack/bandit: Improving SQL Injection detection https://review.openstack.org/202646 | 17:14 |
| sigmavirus24 | lol | 17:16 |
| sigmavirus24 | install_command = python -c 'print("foo")' {packages} | 17:16 |
| sigmavirus24 | that gets around installing trove lol | 17:16 |
| sigmavirus24 | And using it in tox works just fine | 17:17 |
| sigmavirus24 | Apply http://paste.openstack.org/show/384218/ to trove's tox.ini and compare to bandit installed globally and you'll see that it works | 17:18 |
| sigmavirus24 | So | 17:18 |
| sigmavirus24 | we need not work about breaking anyone | 17:18 |
| sigmavirus24 | (You only need the install_command line if you want this to go quickly and you don't want to install mysql or any of the other -dev packages) | 17:19 |
| openstackgerrit | Tim Kelsey proposed openstack/bandit: Improving SQL Injection detection https://review.openstack.org/202646 | 17:19 |
| sigmavirus24 | Daviey: how goes? | 17:20 |
| tmcpeak | sigmavirus24: awesome | 17:20 |
| Daviey | sigmavirus24: I'm iterating over the plugins OK.. but trying to getmembers is proving a little bit of a pain | 17:21 |
| sigmavirus24 | Daviey: if you throw a wip up, I'll pull it and see if I can offer help. I'm on lunch at the moment so no one can give me crap for not working on our product =P | 17:21 |
| tmcpeak | ;) | 17:23 |
| openstackgerrit | Dave Walker proposed openstack/bandit: Initial Stevedore work https://review.openstack.org/203174 | 17:24 |
| Daviey | sigmavirus24: https://review.openstack.org/203174 | 17:24 |
| Daviey | uh, damn bot.. making lives easier | 17:24 |
| sigmavirus24 | Daviey: you don't need to reinvent the extension manager | 17:25 |
| sigmavirus24 | We have that loading things already | 17:25 |
| tmcpeak | legit cow ascii | 17:25 |
| Daviey | sigmavirus24: Yeah.. I was trying to make it as unintrusive change as possible to start with | 17:26 |
| sigmavirus24 | Daviey: https://github.com/openstack/bandit/blob/master/bandit/core/extension_loader.py#L27 | 17:26 |
| Daviey | OIC | 17:26 |
| sigmavirus24 | also | 17:27 |
| sigmavirus24 | let's keep the cowsay in that commit message | 17:27 |
| sigmavirus24 | In fact | 17:27 |
| *** tkelsey has quit IRC | 17:27 | |
| sigmavirus24 | Let's add cowsay to every commit message | 17:27 |
| sigmavirus24 | I'll make a hacking check | 17:27 |
| sigmavirus24 | It'll enforce cowsay | 17:27 |
| tmcpeak | haha | 17:27 |
| Daviey | I'm sure a git post commit hook to just add it | 17:27 |
| Daviey | It isn't too dissimilar to the Change-ID hook | 17:28 |
| Daviey | if first_line contains "[WIP]": do_cowify() ; done | 17:28 |
| Daviey | sigmavirus24: If you want to just push onwards with this, i won't be upset | 17:29 |
| sigmavirus24 | let me see | 17:29 |
| Daviey | err, stevedore.. not cowsay | 17:29 |
| sigmavirus24 | oh | 17:29 |
| sigmavirus24 | i want to work on cowsay now though =P | 17:29 |
| tmcpeak | lol - I see I'm in good company "ooh - shiny!" | 17:30 |
| sigmavirus24 | oh I see | 17:30 |
| Daviey | https://drfatani.files.wordpress.com/2014/05/i-love-shiny-things.png | 17:30 |
| sigmavirus24 | so Daviey when using stevedore | 17:30 |
| sigmavirus24 | You'll get the functions back directly | 17:30 |
| sigmavirus24 | getmembers was looking for functions defined int he module | 17:30 |
| sigmavirus24 | which means that's totally unnecessary now | 17:30 |
| Daviey | sigmavirus24: Right.. but they all retured None | 17:30 |
| Daviey | I tried that | 17:30 |
| sigmavirus24 | So you don't need to muck around with gemembers or inspect anymore | 17:31 |
| Daviey | functions_list: {'xml': None, 'crypto_request_no_cert_validation': None, 'general_bind_all_interfaces': None, 'injection_shell': None, 'exec': None, 'blacklist_imports': None, 'try_except_pass': None, 'injection_paramiko': None, 'blacklist_calls': None, 'general_hardcoded_password': None, 'injection_wildcard': None, 'secret_config_option': None, 'general_bad_file_permissions': None, 'asserts': None, 'injection_sql': None, 'exec_as_root': No | 17:31 |
| Daviey | sigmavirus24: see i tried to replace functions_list with, functions_list = dict((x.name, x.obj) for x in available_plugins) ? | 17:32 |
| *** dwyde has joined #openstack-security | 17:32 | |
| Daviey | That _should_ IIUC have given me all the functions from the plugins, no ? | 17:32 |
| sigmavirus24 | so extension_loader.MANAGER does the right things for you because you want invoke_on_load=True iirc | 17:32 |
| Daviey | Yeah, that blew up | 17:32 |
| sigmavirus24 | at least | 17:32 |
| sigmavirus24 | that works well for the formatters we have defined | 17:32 |
| sigmavirus24 | x.plugin isn't it? | 17:33 |
| Daviey | sigmavirus24: with it set to True, i got - W Could not load 'crypto_request_no_cert_validation': 'module' object is not callable | 17:33 |
| sigmavirus24 | yeah | 17:33 |
| sigmavirus24 | L95 in bandit/core/result_store.py | 17:34 |
| Daviey | So.. it started getting complicated.. So i thought for phase 1, it might make sense to reuse the same workflow and do inspect.getmembers | 17:34 |
| sigmavirus24 | Daviey: I don't want to steal this from you, hopefully that's enough to push you in the right direction | 17:34 |
| Daviey | sigmavirus24: I honestly wouldn't be upset if you took this.. | 17:35 |
| sigmavirus24 | hm | 17:36 |
| sigmavirus24 | oh sorry you do want invoke_on_load=False | 17:36 |
| sigmavirus24 | the extension_loader is doing it right =P | 17:36 |
| sigmavirus24 | Daviey: okay | 17:36 |
| Daviey | I mean, i'm sure i'll have something working eventually. but i do need to EoD shortly. | 17:37 |
| sigmavirus24 | sure | 17:38 |
| sigmavirus24 | On my team we hand things off internationally when sprinting on stuff | 17:38 |
| sigmavirus24 | We'll just do a handoff here ;) | 17:38 |
| tmcpeak | awesome | 17:40 |
| Daviey | nice! | 17:43 |
| Daviey | Okay, weekend is starting.. I'll check in later o/ | 17:49 |
| sigmavirus24 | Have a good weekend Daviey! | 17:50 |
| tmcpeak | Daviey: awesome, have a good one | 17:52 |
| *** browne has joined #openstack-security | 17:52 | |
| *** bpokorny_ has joined #openstack-security | 18:02 | |
| *** bpokorny has quit IRC | 18:03 | |
| *** markvoelker has quit IRC | 18:32 | |
| openstackgerrit | Ian Cordasco proposed openstack/bandit: Register plugins included as entry-points https://review.openstack.org/203174 | 18:51 |
| sigmavirus24 | gmurphy: tmcpeak ^ should fix it | 18:51 |
| sigmavirus24 | Daviey was like 99% of the way there | 18:51 |
| chair6 | +70, -104 .. most of the + is config .. that commit is a thing of beauty :) | 18:56 |
| *** bknudson has quit IRC | 19:00 | |
| tmcpeak | sigmavirus24: awesome! | 19:03 |
| tmcpeak | reviewsies coming now | 19:04 |
| tmcpeak | browne: can you please test too (I still can't repro the problem ;) ) | 19:04 |
| *** bpokorny_ has quit IRC | 19:07 | |
| *** bpokorny has joined #openstack-security | 19:07 | |
| tmcpeak | sigmavirus24: my only complaint is the actual section where we're loading plugins is tough to read | 19:08 |
| tmcpeak | can we get comments in there? | 19:08 |
| tmcpeak | link breaks | 19:08 |
| tmcpeak | logical separation, etc | 19:08 |
| tmcpeak | I'm not sure what setup.cfg supports | 19:08 |
| *** bpokorny_ has joined #openstack-security | 19:19 | |
| *** bpokorny has quit IRC | 19:19 | |
| *** edmondsw has quit IRC | 19:24 | |
| *** sdake has quit IRC | 19:32 | |
| sigmavirus24 | tmcpeak: It should support comments | 19:33 |
| sigmavirus24 | tmcpeak: do you mean line-breaks like having things across multpile lines? | 19:33 |
| sigmavirus24 | *multiple | 19:33 |
| tmcpeak | sigmavirus24: no, just blank lines in between things | 19:33 |
| tmcpeak | like | 19:33 |
| sigmavirus24 | Sure | 19:33 |
| sigmavirus24 | I might add comments too adding references to the file | 19:34 |
| sigmavirus24 | I mean | 19:34 |
| sigmavirus24 | That's inherent in the entry-point, but it won't hurt | 19:34 |
| tmcpeak | yeah, we can start with breaking them down by actual file, | 19:34 |
| sigmavirus24 | Also if people go grepping for where that file is used, they'll see that ideally | 19:34 |
| sigmavirus24 | In case people don't know where to add their new checks | 19:34 |
| sigmavirus24 | SInce they won't be auto-loaded by module anymore | 19:34 |
| sigmavirus24 | (That's more of a developer consideration than anything else) | 19:35 |
| tmcpeak | sorry, where which file is used/ | 19:35 |
| tmcpeak | ? | 19:35 |
| sigmavirus24 | e.g., people looking where 'bandit/plugin/asserts.py' | 19:35 |
| tmcpeak | oh right | 19:35 |
| sigmavirus24 | someone's like "I added a check! Why doesn't it magicappear" | 19:35 |
| tmcpeak | yeah, I expect some such confusion initially | 19:35 |
| openstackgerrit | Ian Cordasco proposed openstack/bandit: Register plugins included as entry-points https://review.openstack.org/203174 | 19:42 |
| sigmavirus24 | tmcpeak: ^ | 19:42 |
| sigmavirus24 | Also fixed two typos in function names that I noticed | 19:42 |
| tmcpeak | sigmavirus24: awesome | 19:44 |
| * tmcpeak looks | 19:44 | |
| *** ig0r_ has quit IRC | 19:47 | |
| tmcpeak | same dev from yesterday is having a hard time even in a virtualenv | 19:50 |
| tmcpeak | :| | 19:50 |
| tmcpeak | confusion abounds | 19:50 |
| sigmavirus24 | weird | 19:53 |
| sigmavirus24 | did they try blowing away the virtualenv and rebuilding it? | 19:53 |
| sigmavirus24 | the great thign about this vagrant box is that /vagrant/ is bandit's repo on my laptop | 19:54 |
| sigmavirus24 | so I just pip uninstall -y bandit; pip install /vagrant | 19:54 |
| * sigmavirus24 doesn't trust pip install -e /vagrant | 19:54 | |
| *** dave-mccowan has quit IRC | 20:07 | |
| * sigmavirus24 is trying it out in a venv anyway | 20:09 | |
| browne | tmcpeak: will test now | 20:10 |
| browne | love the cowsay | 20:10 |
| *** timkennedy has quit IRC | 20:10 | |
| sigmavirus24 | browne: the cowsay is all Davey | 20:11 |
| browne | works! | 20:14 |
| *** dave-mccowan has joined #openstack-security | 20:16 | |
| tmcpeak | browne: awesome | 20:16 |
| browne | anyone else want to look before i merge? | 20:18 |
| tmcpeak | browne: if it looks good to you, mergeys ;) | 20:19 |
| browne | ok will do | 20:19 |
| tmcpeak | awesome, thank you | 20:20 |
| tmcpeak | false alarm on the dev having trouble in a virtualenv | 20:32 |
| chair6 | excellent | 20:35 |
| sigmavirus24 | tmcpeak: good to hear | 20:39 |
| sigmavirus24 | It worked fine in a virtualenv for me | 20:39 |
| sigmavirus24 | but I didn't want to be /That Guy/ | 20:39 |
| tmcpeak | I've been that guy all day :P | 20:39 |
| sigmavirus24 | Funny thing is that I realized I never sent this patch | 20:43 |
| sigmavirus24 | And was thinking about it yesterday | 20:43 |
| sigmavirus24 | "Hm, I should get to that. It should have been a follow-on of the original stevedore stuff" | 20:44 |
| *** elo has quit IRC | 20:44 | |
| sigmavirus24 | So, sorry. I guess I should have done this sooner =P | 20:44 |
| chair6 | it's okay, we know you're busy being a virus and all | 20:45 |
| sigmavirus24 | lol | 20:45 |
| chair6 | quite liking where bandit is heading towards.. input from all you folks is really appreciated, whether you "should have done this sooner" or not :) | 20:46 |
| chair6 | i missed the discussion the other day about bandit specs | 20:46 |
| chair6 | i personally am inclined to avoid using the specs repo for now, and instead just use launchpad blueprints | 20:47 |
| sigmavirus24 | To be honest, I had thought about making something like bandit as a plugin for flake8 for a year now | 20:47 |
| tmcpeak | yeah, but then we can end up with confusion like we had with the statement buffer stuff | 20:47 |
| sigmavirus24 | never comfortable enough to mark things as insecure | 20:47 |
| * sigmavirus24 thinks he missed that confusion | 20:48 | |
| chair6 | heh, yeah, it's kinda nice having that come from a separate tool sigma | 20:48 |
| chair6 | tmcpeak howso? don't we just write what we plan to do in the blueprint form instead of the spec form? | 20:48 |
| tmcpeak | oh, I'm lumping blueprint and spec together | 20:49 |
| tmcpeak | I don't know the difference | 20:49 |
| chair6 | (i have very little exposure to the spec side of things, so am arguing against something i know little about.. lazily trying to adding another workflow to my workflows) | 20:49 |
| chair6 | heh, seems we might both be ill-informed then :) | 20:49 |
| tmcpeak | I'm generally lumping "written plans before we write code" together | 20:50 |
| tmcpeak | er "written plans before we write big code" | 20:50 |
| chair6 | http://specs.openstack.org/ .. this is specs | 20:50 |
| chair6 | we have a security-specs repo, that we could theoreticaly add bandit specs to | 20:50 |
| tmcpeak | ok, so maybe something huge like on the Bandit 1.0 level would deserve a spec | 20:50 |
| tmcpeak | this look pretty broad | 20:51 |
| chair6 | heres an example of a swift spec .. http://specs.openstack.org/openstack/swift-specs/specs/in_progress/at_rest_encryption.html | 20:51 |
| sigmavirus24 | So it depends as far as other projects are concerned | 20:51 |
| sigmavirus24 | Big features tend to have specs that have associated blueprints | 20:51 |
| sigmavirus24 | The blueprint is more to allow us to track the work in launchpad | 20:51 |
| sigmavirus24 | The spec has all the technical details and discussion of the feature and renders nice things for others on specs.o.o | 20:51 |
| tmcpeak | the main use-case I'm concerned with is soliciting feedback prior to making a change people might disagree with | 20:52 |
| sigmavirus24 | Using both is actually what upstream projects do as far as I know | 20:52 |
| chair6 | ahhh, cool .. so maybe we ahve a single 'spec' that describes what bandit hopes to become, then use whitepad to track individual features/changes against that spec? | 20:52 |
| sigmavirus24 | tmcpeak: right, that's where specs make sense | 20:52 |
| tmcpeak | ahh ok | 20:52 |
| chair6 | lol, s/whitepad/blueprint/ | 20:52 |
| tmcpeak | so multi-threaded for example | 20:52 |
| sigmavirus24 | blueprints can track dependencies too which specs don't | 20:52 |
| tmcpeak | I think some are in favor and some aren't, right? | 20:52 |
| tmcpeak | that could be a spec | 20:52 |
| *** dwyde has quit IRC | 20:52 | |
| tmcpeak | and then we can comment-war back and forth and come to consensus | 20:52 |
| tmcpeak | before we write code | 20:52 |
| sigmavirus24 | I was going to write a spec. There's already a bp for that | 20:52 |
| tmcpeak | is that the general idea? | 20:53 |
| sigmavirus24 | Or have that + code so that you can see the implementation along side the description | 20:53 |
| sigmavirus24 | Yeah that's kind of how other projects do it | 20:53 |
| tmcpeak | ok cool, that makes sense | 20:53 |
| tmcpeak | I think the other issue we're running into is synchronizing - not everybody is hanging out in IRC at the same time or at all | 20:53 |
| sigmavirus24 | Right | 20:53 |
| sigmavirus24 | Glance team has that issue | 20:53 |
| sigmavirus24 | We have glance cores who are only ever on IRC for our weekly meeting or when they need to get a hold of someone | 20:54 |
| *** dwyde has joined #openstack-security | 20:54 | |
| sigmavirus24 | Apropos of nothing, do we want a separate bug team for bandit to manage bugs? | 20:54 |
| sigmavirus24 | So chair6 isn't the only bug supervisor? | 20:55 |
| chair6 | heh, that's probably just from when i set launchpad up | 20:57 |
| chair6 | yeah, good plan .. i can create a team that has current cores in it for a start | 20:57 |
| sigmavirus24 | apparently as an ossg member I can change that | 20:58 |
| sigmavirus24 | =P | 20:58 |
| sigmavirus24 | I just looked and saw an edit button | 20:58 |
| chair6 | .. oh, or you can :) | 20:58 |
| sigmavirus24 | I was thoroughly confused | 20:58 |
| sigmavirus24 | You can do it | 20:58 |
| sigmavirus24 | I should be ansible-ing | 20:58 |
| tmcpeak | oh ansible land | 20:58 |
| tmcpeak | it's been a while since I've come across anything I feel more polarized about then Ansible - it's so magical when it works and fills me with hate when it doesn't | 20:59 |
| *** edmondsw has joined #openstack-security | 20:59 | |
| sigmavirus24 | tmcpeak: this is why you run everything with -vvvvvvvv | 21:00 |
| tmcpeak | haha yeah | 21:03 |
| *** y_sawai has joined #openstack-security | 21:12 | |
| chair6 | okay, "Bandit Core" has been created on launchpad and populated | 21:14 |
| tmcpeak | sweet | 21:14 |
| chair6 | i've set the 'driver' for the bandit project to it, as well as the bug supervisor | 21:14 |
| sigmavirus24 | awesome! | 21:22 |
| *** dave-mccowan has quit IRC | 21:27 | |
| *** dave-mccowan has joined #openstack-security | 21:28 | |
| *** dave-mccowan has quit IRC | 21:33 | |
| openstackgerrit | Nathaniel Dillon proposed openstack/security-doc: Adding section to compute chapter https://review.openstack.org/202825 | 21:45 |
| openstackgerrit | Merged openstack/bandit: Register plugins included as entry-points https://review.openstack.org/203174 | 22:03 |
| *** y_sawai has quit IRC | 22:19 | |
| *** edmondsw has quit IRC | 22:28 | |
| *** dwyde has quit IRC | 22:39 | |
| *** sicarie has quit IRC | 22:48 | |
| * Daviey checks in | 22:59 | |
| Daviey | sigmavirus24: Thanks for taking that, nicely done. | 22:59 |
| *** voodookid has quit IRC | 23:00 | |
| *** hyakuhei1 has joined #openstack-security | 23:03 | |
| *** hyakuhei has quit IRC | 23:03 | |
| chair6 | the best bit about it was the cowsay, just for the record | 23:11 |
| Daviey | chair6: Well, that was my contribution.. So i'll take all the credit. | 23:13 |
| chair6 | rightly so | 23:13 |
| Daviey | sigmavirus24: I see why it wasn't working for me now.. I was lacking the function name in setup.cfg | 23:14 |
| Daviey | We do claim to be able to support multiple functions per plugin.. which this doesn't do.. We might need to add Class support. | 23:16 |
| *** dave-mccowan has joined #openstack-security | 23:16 | |
| *** y_sawai has joined #openstack-security | 23:19 | |
| *** tmcpeak has quit IRC | 23:21 | |
| chair6 | isn't that what's happening with (say) the xml stuff? multiple functions per plugin? | 23:21 |
| chair6 | for example: | 23:21 |
| chair6 | lxml_function_calls = bandit.plugins.xml:lxml_function_calls | 23:21 |
| chair6 | etree_celement_import = bandit.plugins.xml:etree_celement_import | 23:21 |
| chair6 | etree_element_import = bandit.plugins.xml:etree_element_import | 23:21 |
| chair6 | i guess it depends on what you mean when you say 'plugin' | 23:22 |
| *** y_sawai has quit IRC | 23:24 | |
| *** freerunner has joined #openstack-security | 23:25 | |
| Daviey | So it is.. | 23:26 |
| *** bpokorny_ has quit IRC | 23:30 | |
| chair6 | groovy :) | 23:47 |
| chair6 | happy weekend, y'all | 23:47 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
