| *** hyakuhei has joined #openstack-security | 00:00 | |
| *** hyakuhei1 has quit IRC | 00:02 | |
| *** TimB28 has joined #openstack-security | 00:20 | |
| *** TimB28 has left #openstack-security | 00:21 | |
| *** elmiko has quit IRC | 00:29 | |
| *** curious_george has joined #openstack-security | 00:35 | |
| *** pdesai has quit IRC | 00:35 | |
| *** curious_george has quit IRC | 00:37 | |
| *** pdesai has joined #openstack-security | 00:58 | |
| *** pdesai has quit IRC | 01:02 | |
| *** browne has quit IRC | 01:03 | |
| *** pdesai has joined #openstack-security | 01:04 | |
| openstackgerrit | Merged openstack/bandit: Add info: License, Source, Bugs and Docs to README https://review.openstack.org/209666 | 01:05 |
|---|---|---|
| *** pdesai has quit IRC | 01:08 | |
| *** sdake has joined #openstack-security | 01:27 | |
| *** yuanying has joined #openstack-security | 01:30 | |
| *** sdake_ has joined #openstack-security | 01:30 | |
| *** sdake has quit IRC | 01:34 | |
| *** pdesai has joined #openstack-security | 01:59 | |
| *** sdake_ has quit IRC | 02:09 | |
| *** markvoelker has quit IRC | 02:11 | |
| *** markvoelker has joined #openstack-security | 02:12 | |
| *** viraptor has joined #openstack-security | 02:40 | |
| *** dave-mccowan has joined #openstack-security | 02:40 | |
| *** browne has joined #openstack-security | 03:01 | |
| *** markvoelker has quit IRC | 03:04 | |
| *** pdesai has quit IRC | 03:26 | |
| *** pdesai has joined #openstack-security | 03:26 | |
| *** pdesai has quit IRC | 03:27 | |
| *** bpokorny has quit IRC | 03:34 | |
| *** dave-mccowan has quit IRC | 03:42 | |
| *** tmcpeak has quit IRC | 03:47 | |
| *** markvoelker has joined #openstack-security | 04:04 | |
| *** markvoelker has quit IRC | 04:09 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Implement new API format https://review.openstack.org/190473 | 04:19 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Move all plugins to stevedore https://review.openstack.org/208311 | 04:19 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Allow configurable signing backends https://review.openstack.org/201394 | 04:19 |
| *** scorpion_17 has joined #openstack-security | 05:15 | |
| *** viraptor has quit IRC | 05:16 | |
| *** scorpion_17 has quit IRC | 05:19 | |
| *** scorpion_17 has joined #openstack-security | 05:19 | |
| *** scorpion_17 has quit IRC | 05:38 | |
| *** markvoelker has joined #openstack-security | 05:51 | |
| *** markvoelker has quit IRC | 05:56 | |
| *** hyakuhei_ has joined #openstack-security | 06:49 | |
| *** shohel has joined #openstack-security | 06:51 | |
| *** hyakuhei_ has quit IRC | 06:54 | |
| *** hyakuhei_ has joined #openstack-security | 06:59 | |
| *** hyakuhei_ has quit IRC | 07:05 | |
| *** hyakuhei_ has joined #openstack-security | 07:06 | |
| *** browne has quit IRC | 07:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/209796 | 07:35 |
| *** b10n1k has quit IRC | 07:37 | |
| *** hyakuhei_ has quit IRC | 07:42 | |
| *** alex_klimov has joined #openstack-security | 07:45 | |
| *** elo1 has joined #openstack-security | 07:48 | |
| *** elo has quit IRC | 07:50 | |
| *** markvoelker has joined #openstack-security | 07:52 | |
| *** elo1 has quit IRC | 07:53 | |
| *** sdake has joined #openstack-security | 07:54 | |
| *** elo has joined #openstack-security | 07:55 | |
| *** markvoelker has quit IRC | 07:56 | |
| *** alex_klimov has quit IRC | 07:57 | |
| *** elo has quit IRC | 08:06 | |
| *** elo has joined #openstack-security | 08:09 | |
| *** tkelsey has joined #openstack-security | 08:13 | |
| *** hyakuhei_ has joined #openstack-security | 08:15 | |
| *** alex_klimov has joined #openstack-security | 08:18 | |
| openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/209796 | 08:19 |
| *** hyakuhei_ has quit IRC | 08:28 | |
| *** hyakuhei_ has joined #openstack-security | 09:15 | |
| *** hyakuhei_ has quit IRC | 09:18 | |
| *** hyakuhei_ has joined #openstack-security | 09:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/209843 | 09:40 |
| *** markvoelker has joined #openstack-security | 09:53 | |
| openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/209843 | 09:54 |
| *** markvoelker has quit IRC | 09:57 | |
| *** hyakuhei_ has quit IRC | 10:08 | |
| *** yuanying has quit IRC | 10:09 | |
| *** hyakuhei_ has joined #openstack-security | 10:09 | |
| *** hyakuhei_ has quit IRC | 10:10 | |
| *** hyakuhei_ has joined #openstack-security | 10:24 | |
| *** hyakuhei_ has quit IRC | 10:25 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Stop mixing IPs and domains https://review.openstack.org/209867 | 10:50 |
| *** markvoelker has joined #openstack-security | 10:54 | |
| *** markvoelker has quit IRC | 10:58 | |
| *** shohel has quit IRC | 11:03 | |
| *** shohel1 has joined #openstack-security | 11:03 | |
| *** sdake has quit IRC | 11:07 | |
| *** tjt263 has joined #openstack-security | 11:08 | |
| *** tjt263 has quit IRC | 11:16 | |
| *** shohel1 has quit IRC | 11:19 | |
| *** shohel has joined #openstack-security | 11:19 | |
| *** yuanying has joined #openstack-security | 11:24 | |
| *** tjt263 has joined #openstack-security | 11:24 | |
| *** yuanying has quit IRC | 11:29 | |
| openstackgerrit | Merged openstack/anchor: Simplify the tests https://review.openstack.org/201875 | 11:41 |
| *** timkennedy has quit IRC | 11:59 | |
| *** timkennedy has joined #openstack-security | 11:59 | |
| *** markvoelker has joined #openstack-security | 12:16 | |
| *** edmondsw has joined #openstack-security | 12:36 | |
| *** zul has joined #openstack-security | 12:46 | |
| *** tmcpeak has joined #openstack-security | 12:49 | |
| *** elmiko has joined #openstack-security | 12:53 | |
| *** elmiko has quit IRC | 13:00 | |
| *** elmiko has joined #openstack-security | 13:00 | |
| *** dave-mccowan has joined #openstack-security | 13:01 | |
| *** dave-mcc_ has joined #openstack-security | 13:04 | |
| *** dave-mccowan has quit IRC | 13:07 | |
| *** yuanying has joined #openstack-security | 13:12 | |
| *** browne has joined #openstack-security | 13:15 | |
| *** yuanying has quit IRC | 13:17 | |
| *** singlethink has joined #openstack-security | 13:32 | |
| *** jmckind has joined #openstack-security | 13:34 | |
| *** bknudson has joined #openstack-security | 13:44 | |
| *** edmondsw has quit IRC | 13:46 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:55 | |
| *** sdake has joined #openstack-security | 13:55 | |
| tmcpeak | sigmavirus24: can you repro this: https://bugs.launchpad.net/bandit/+bug/1481922 | 13:58 |
| openstack | Launchpad bug 1481922 in Bandit "'NoneType' object has no attribute '__getitem__'" [High,In progress] - Assigned to Sean McGinnis (sean-mcginnis) | 13:59 |
| sigmavirus24 | Haven't tried yet | 13:59 |
| tmcpeak | browne: you? | 13:59 |
| sigmavirus24 | I have suspicions though and I'm very very doubtful that changing how we use the decorator will actually fix that | 13:59 |
| tmcpeak | smcginnis: interesting bug :) | 13:59 |
| tmcpeak | sigmavirus24: yeah, I'm not seeing how that helps either TBH | 13:59 |
| tmcpeak | that decorator style is uniformly used elsewhere, right? | 14:00 |
| sigmavirus24 | Yes | 14:00 |
| tmcpeak | hmm, actually it is not | 14:00 |
| tmcpeak | @takes_config | 14:00 |
| tmcpeak | @checks('Call') | 14:00 |
| sigmavirus24 | Every other project in openstack uses `import module; ... @module.decorator\ndef foo():\n pass' | 14:00 |
| tmcpeak | that's the way it''s normally done ^ | 14:01 |
| sigmavirus24 | tmcpeak: right because we're not using the hacking check to ensure we only ever import modules | 14:01 |
| tmcpeak | for the rest of Bandit at least | 14:01 |
| sigmavirus24 | Using a module in an import shouldn't be a problem | 14:01 |
| tmcpeak | yeah, I agree it shouldn't be | 14:01 |
| tmcpeak | if I could repro this I'd go in with a debugger but I can't | 14:01 |
| tmcpeak | so yeah, that's the question of the day, why can't I | 14:02 |
| browne | i'll try to reproduce today. but don't think i've seen that bug before | 14:03 |
| tmcpeak | even pip install bandit in a fresh venv I can't repro | 14:04 |
| *** jmckind has quit IRC | 14:05 | |
| sigmavirus24 | I'm cloning cinder to try it | 14:07 |
| sigmavirus24 | So our "takes_config" decorator needs some good comments | 14:08 |
| sigmavirus24 | I spent an hour last night on mental gymnastics udnerstanding it | 14:08 |
| *** jmckind has joined #openstack-security | 14:08 | |
| sigmavirus24 | (I was on my phone at a friend's house ignoring a boring conversation) | 14:08 |
| tmcpeak | ahh yeah, it's probably never been touched since I wrote it in September | 14:09 |
| tmcpeak | sigmavirus24: yeah, you're right, that's pretty sketch | 14:11 |
| sigmavirus24 | I mean | 14:11 |
| sigmavirus24 | I figured out what the branching was doing | 14:11 |
| sigmavirus24 | but I took a lot of looking at other (less obvious) uses of takes_config | 14:11 |
| sigmavirus24 | and to be fair, while we can use @takes_config or @takes_config('config_section') I think they should be separate decorators for simplicity's sake | 14:12 |
| tmcpeak | yeah | 14:12 |
| tmcpeak | that would be easier to understand | 14:12 |
| *** sdake has quit IRC | 14:14 | |
| *** voodookid has joined #openstack-security | 14:19 | |
| tmcpeak | smcginnis: you around? | 14:22 |
| tmcpeak | I'd like to figure out how our envs are different :) | 14:23 |
| *** voodookid has quit IRC | 14:24 | |
| *** edmondsw has joined #openstack-security | 14:28 | |
| sigmavirus24 | tmcpeak: it shouldn't ever be possible for _config to be None, right? | 14:32 |
| tmcpeak | sigamvirus24: no, it comes from bandit config file | 14:34 |
| tmcpeak | unless you can't find the config file, but Bandit goes nuts if that happens | 14:34 |
| *** voodookid has joined #openstack-security | 14:39 | |
| *** yaya has joined #openstack-security | 14:50 | |
| *** yaya has quit IRC | 14:59 | |
| *** shohel has quit IRC | 15:00 | |
| *** yuanying has joined #openstack-security | 15:00 | |
| sigmavirus24 | right | 15:05 |
| *** yuanying has quit IRC | 15:05 | |
| smcginnis | tmcpeak: Here now. | 15:05 |
| smcginnis | tmcpeak: Yeah, weird one. | 15:05 |
| smcginnis | tmcpeak: No idea why what I proposed in the patch makes any difference, but it does. | 15:06 |
| sigmavirus24 | smcginnis: what version of bandit on what os? | 15:06 |
| smcginnis | sigmavirus24: Looks like it's bandit 0.13.0 running on Ubuntu 14.01. | 15:07 |
| sigmavirus24 | 14.01 or 14.04? | 15:07 |
| smcginnis | sigmavirus24: Sorry, you are right. Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-45-generic x86_64) | 15:07 |
| sigmavirus24 | hmm I can repro this on OSX too | 15:07 |
| smcginnis | sigmavirus24: Good, it's not just me. ;) | 15:08 |
| smcginnis | sigmavirus24: Can you see if my change fixes it on OSX? Would be good to see if that's different. | 15:08 |
| sigmavirus24 | So self.config.get_option(test._takes_config) is returning None | 15:10 |
| sigmavirus24 | and test._takes_config is corrrect it seems | 15:10 |
| *** bpokorny has joined #openstack-security | 15:10 | |
| *** zul has quit IRC | 15:10 | |
| *** yaya has joined #openstack-security | 15:23 | |
| sigmavirus24 | so smcginnis, tox -e bandit in cinder uses tools/bandit.yaml | 15:26 |
| sigmavirus24 | Which has no try_except_pass section | 15:26 |
| sigmavirus24 | Because it has no such section we return None from self.config.get_option('try_except_pass') | 15:26 |
| sigmavirus24 | when we return None, we pass that into the try_except_pass function | 15:26 |
| sigmavirus24 | I haven't tested your patch yet, but I see no reason why it would change this behaviour | 15:27 |
| smcginnis | sigmavirus24: I don't know why it makes a difference, but it does. | 15:27 |
| smcginnis | sigmavirus24: So any time a plugin is added to bandit, we will need to update cinder's bandit.yaml for each one? | 15:27 |
| *** sdake has joined #openstack-security | 15:31 | |
| tmcpeak | smcginnis: yeah, that's a downside to our current setup. One of our planned changes involves moving module config into separate configs which will be more static | 15:31 |
| smcginnis | tmcpeak: That will be good. | 15:32 |
| tmcpeak | although when did we merge try pass | 15:32 |
| sigmavirus24 | so | 15:32 |
| tmcpeak | Cinder config must be very old | 15:32 |
| smcginnis | tmcpeak: The patch to add it was out there for a while. | 15:32 |
| sigmavirus24 | I would argue that we can handle this appropriately | 15:32 |
| sigmavirus24 | And I have an idea | 15:33 |
| sigmavirus24 | If something takes config and there is no config | 15:33 |
| sigmavirus24 | We shouldn't run it | 15:33 |
| sigmavirus24 | Or we should take some kind of default config | 15:33 |
| tmcpeak | sigmavirus24: yeah, that sounds pretty damn sensible :) | 15:33 |
| smcginnis | I know there were other cores that had some reservations with adding bandit at this point. | 15:33 |
| smcginnis | If there is going to be an ongoing need to track updates I think there will be even more pushback. | 15:33 |
| tmcpeak | smcginnis: it should be fine, you'll still detect lots of issues | 15:34 |
| tmcpeak | this particular plugin won't run | 15:34 |
| smcginnis | So anything we can do to make that not necessary will be goodness. | 15:34 |
| smcginnis | tmcpeak: True | 15:34 |
| smcginnis | Just doesn't look good if it starts off with a long list of exceptions. ;) | 15:34 |
| tmcpeak | yeah, I think sigmavirus24's solution is good here | 15:34 |
| sigmavirus24 | so | 15:34 |
| sigmavirus24 | that said | 15:34 |
| tmcpeak | sigmavirus24: if you get that patch up I'll push a new Bandit with it today | 15:34 |
| sigmavirus24 | Do we report the fact that we're skipping a test somehow? | 15:35 |
| tmcpeak | sigmavirus24: yeah, I'm sure I saw that elsewhere. I think one simple warning up front is sufficient | 15:35 |
| sigmavirus24 | Also this code is getting super complex around this stuff =/ | 15:36 |
| tmcpeak | which code? | 15:36 |
| tmcpeak | smcginnis: AFAIK Cinder isn't even running any Bandit gate yet, let alone a voting one | 15:37 |
| sigmavirus24 | tmcpeak: the code in bandit.core.tester | 15:37 |
| sigmavirus24 | I'll be picking this apart for a refactor later | 15:37 |
| smcginnis | tmcpeak: Correct. | 15:37 |
| sigmavirus24 | Now is not the time | 15:37 |
| tmcpeak | sigmavirus24: sounds good | 15:38 |
| smcginnis | tmcpeak: We just merged support for running it with tox. | 15:38 |
| *** singlethink has quit IRC | 15:38 | |
| smcginnis | Not in gate, just on demand for whoever is interested. | 15:38 |
| tmcpeak | I think there are several issues here: 1) new Bandit and Cinder Bandit merged at roughly the same time, so new Bandit wasn't tested with Cinder 2) as sigmavirus24 mentions, our current procedure for dealing with missing config is stupid 3) we need better automation in Bandit to make sure that the projects that are consuming it aren't broken in some way with new Bandit versions | 15:39 |
| smcginnis | +1 | 15:40 |
| sigmavirus24 | Agreed with tmcpeak | 15:40 |
| sigmavirus24 | I really want to set-up reverse gates for projects that are consuming bandit | 15:40 |
| tmcpeak | 1) is a fluke, 2) sigmavirus24 is going to work on right now, 3) is something I'm going to move up to the top of the stack | 15:40 |
| sigmavirus24 | Just confirmed that my fix works | 15:40 |
| tmcpeak | sigmavirus24: great, yeah, that makes sense | 15:41 |
| sigmavirus24 | smcginnis: what was that bug number? | 15:41 |
| sigmavirus24 | nevermind found | 15:41 |
| openstackgerrit | Ian Cordasco proposed openstack/bandit: Skip a test if it requires config but none is found https://review.openstack.org/209994 | 15:42 |
| sigmavirus24 | oh I forgot to add a warning to it | 15:42 |
| *** dwyde has joined #openstack-security | 15:45 | |
| openstackgerrit | Ian Cordasco proposed openstack/bandit: Skip a test if it requires config but none is found https://review.openstack.org/209994 | 15:54 |
| sigmavirus24 | tmcpeak: bknudson Daviey ^ | 15:55 |
| sigmavirus24 | Also we should make a bug to send all warnings.warn's to the logs | 15:55 |
| bknudson | sigmavirus24: do all tests have config? | 15:56 |
| sigmavirus24 | bknudson: not really | 15:56 |
| sigmavirus24 | some tests takea config but the config may not config them | 15:56 |
| tmcpeak | sigmavirus24: awesome, thank you | 15:57 |
| tmcpeak | looking now | 15:57 |
| *** yaya has quit IRC | 16:00 | |
| tmcpeak | sigmavirus24: looks good, is there a simple way of doing a unit test? | 16:02 |
| sigmavirus24 | not at the moment really | 16:03 |
| sigmavirus24 | I can imagine a way to test it | 16:03 |
| sigmavirus24 | But it won't be pretty and I really don't have bandwidth for it right now | 16:03 |
| sigmavirus24 | We could register a check that takes a bogus config name | 16:03 |
| sigmavirus24 | And assert it isnt' called | 16:03 |
| sigmavirus24 | And/or that warnings.warn is called | 16:04 |
| sigmavirus24 | That said, if we refactor that entire method, testing it would be easier | 16:04 |
| tmcpeak | yeah ok cool | 16:04 |
| *** alex_klimov has quit IRC | 16:04 | |
| tmcpeak | I'm happy to skip for now | 16:04 |
| tmcpeak | this could be part of more comprehensive unit testing later | 16:04 |
| tmcpeak | sigmavirus24: so you've confirmed this fixes the issue? | 16:04 |
| tmcpeak | browne, tkelsey: reviewsies? | 16:06 |
| tkelsey | tmcpeak: I'm still devstacking like mad, but i'll take a look | 16:08 |
| tmcpeak | ok thanks | 16:08 |
| sigmavirus24 | tmcpeak: it fixes in tox for me | 16:10 |
| sigmavirus24 | tmcpeak: also someone can write a test as a follow on like I described | 16:10 |
| tmcpeak | sigmavirus24: unit test? | 16:13 |
| tmcpeak | I'm incline to punt for now, it seems like a strange place to draw the line on starting to do comprehensive testing | 16:13 |
| sigmavirus24 | tmcpeak: I agree wholeheartedly with bknudson's comment | 16:14 |
| sigmavirus24 | Don't get me wrong | 16:14 |
| sigmavirus24 | I'm just head's down on a product fire | 16:14 |
| *** yaya has joined #openstack-security | 16:14 | |
| tmcpeak | I agree with his comment also | 16:14 |
| *** sdake has quit IRC | 16:14 | |
| tmcpeak | if we had testing we can discover stuff like this before bug reports | 16:14 |
| tmcpeak | something else to tackle at the midcycle | 16:15 |
| *** pdesai has joined #openstack-security | 16:19 | |
| *** pdesai has quit IRC | 16:22 | |
| openstackgerrit | Merged openstack/bandit: Skip a test if it requires config but none is found https://review.openstack.org/209994 | 16:22 |
| Daviey | tmcpeak: stop making those of us that aren't going jelly that we are missing the midcycle. | 16:25 |
| *** hyakuhei1 has joined #openstack-security | 16:26 | |
| *** singlethink has joined #openstack-security | 16:28 | |
| *** hyakuhei has quit IRC | 16:29 | |
| tmcpeak | Daviey: oh yeah, :( | 16:33 |
| sigmavirus24 | == Daviey | 16:33 |
| tmcpeak | we'll do something less fun like implementing unit tests ;) | 16:33 |
| sigmavirus24 | I'll be in SATX that week with my team | 16:33 |
| *** jmckind has quit IRC | 16:39 | |
| *** malacostraca has joined #openstack-security | 16:39 | |
| *** malacostraca has left #openstack-security | 16:40 | |
| tmcpeak | ok cool, looks like we're live on that change | 16:48 |
| tmcpeak | (sigh) Bandit 0.13.1 time :( | 16:48 |
| *** yuanying has joined #openstack-security | 16:48 | |
| *** singleth_ has joined #openstack-security | 16:49 | |
| *** hyakuhei has joined #openstack-security | 16:51 | |
| tmcpeak | sigmavirus24: is this right? 291 [0.. /usr/local/lib/python2.7/site-packages/bandit/core/tester.py:67: UserWarning: "hardcoded_tmp_directory" has been skipped due to missing config "hardcoded_tmp_directory". | 16:51 |
| tmcpeak | '"{1}".'.format(test.__name__, test._takes_config) | 16:51 |
| sigmavirus24 | yeah that's how all warnings print | 16:51 |
| sigmavirus24 | like I said | 16:52 |
| tmcpeak | oh you did? okies | 16:52 |
| sigmavirus24 | we need code to redirect warnings.warn to logging.info | 16:52 |
| sigmavirus24 | sorry I'm talking inf ragments right now | 16:52 |
| sigmavirus24 | warnings.warn isn't ideal but it provides us with a guarantee that we will only see the warning once | 16:52 |
| sigmavirus24 | rather than spamming logs | 16:52 |
| sigmavirus24 | we just need an extra bit of code to take things from warnings.warn and put them in logs instead of stderr | 16:53 |
| *** singlethink has quit IRC | 16:53 | |
| sigmavirus24 | there's example code on a urllib3 issues iirc | 16:53 |
| *** yuanying has quit IRC | 16:53 | |
| tmcpeak | ok | 16:54 |
| tmcpeak | I'm happy with this for now | 16:54 |
| tmcpeak | it's better than what we had | 16:54 |
| tmcpeak | btw, now with move of tmp files to config, now older projects don't have the tmp file test anymore it seems | 16:55 |
| tmcpeak | :( | 16:55 |
| tmcpeak | bknuson ^ | 16:55 |
| tmcpeak | bknudson even ^ | 16:55 |
| sigmavirus24 | tmcpeak: | 16:56 |
| sigmavirus24 | import logging | 16:56 |
| sigmavirus24 | logging.captureWarnings(True) | 16:56 |
| *** gmurphy has left #openstack-security | 16:56 | |
| tmcpeak | ahh ok great | 16:57 |
| tmcpeak | I'll add that | 16:57 |
| tmcpeak | thanks sigmavirus24 | 16:57 |
| Daviey | tmcpeak: No other complaints or comments from users on 0.13.0 ? | 16:59 |
| tmcpeak | Daviey: not that I've heard | 17:00 |
| *** gmurphy has joined #openstack-security | 17:00 | |
| bknudson | hi | 17:10 |
| openstackgerrit | Merged openstack/security-doc: Adding file permissions section https://review.openstack.org/207707 | 17:14 |
| openstackgerrit | Merged openstack/security-doc: Updating missing link in object storage section https://review.openstack.org/207706 | 17:16 |
| openstackgerrit | Merged openstack/security-doc: Trying to add numbers and orders to commands https://review.openstack.org/207721 | 17:20 |
| Daviey | tmcpeak / bknudson: bandit is listed here..- https://review.openstack.org/#/c/208820/ | 17:24 |
| tmcpeak | Daviey: oh cool | 17:25 |
| *** sdake has joined #openstack-security | 17:33 | |
| *** salv-orlando has quit IRC | 17:35 | |
| *** markvoelker has quit IRC | 17:44 | |
| *** yaya has quit IRC | 17:44 | |
| *** dwyde has quit IRC | 17:44 | |
| *** zul has joined #openstack-security | 17:56 | |
| hyakuhei | Righto, meeting done, time for 2.5 hour drive home :) | 17:58 |
| tmcpeak | cool thanks hyakuhei | 17:58 |
| *** hyakuhei has quit IRC | 17:58 | |
| browne | Daviey: wait, so how to upper contraints work? Who maintains that? | 17:58 |
| browne | does it just scan PyPi? | 17:58 |
| elmiko | where is hyakuhei1 at, scotland.... ;) | 17:59 |
| Daviey | browne: bot | 18:00 |
| Daviey | browne: I think it daily looks for changes on pypi, then proposes them | 18:01 |
| browne | Daviey: ah, ok thx | 18:01 |
| Daviey | elmiko: I'd hate to think the speed that hyakuhei1 would have to drive at to go from Scotland to Wales in 2.5 hours! | 18:01 |
| *** yaya has joined #openstack-security | 18:02 | |
| elmiko | Daviey, it's my ignorance, the isles just never seem that big. or maybe i drive too fast lol | 18:03 |
| Daviey | elmiko: At least you can find us on a map... You are the 1% :) | 18:04 |
| elmiko | haha | 18:04 |
| elmiko | i have had awesome times visiting england and scotland. we're planning to come back next feburary | 18:04 |
| elmiko | we nearly planned to move there last time we visited | 18:04 |
| Daviey | i'm still looking for those parts. | 18:04 |
| Daviey | right. time to go o/ | 18:05 |
| *** markvoelker has joined #openstack-security | 18:05 | |
| elmiko | later Daviey | 18:05 |
| tmcpeak | later | 18:08 |
| *** tkelsey has quit IRC | 18:22 | |
| *** yuanying has joined #openstack-security | 18:37 | |
| *** salv-orlando has joined #openstack-security | 18:37 | |
| tmcpeak | sigmavirus24: you around? | 18:40 |
| sigmavirus24 | sort of | 18:40 |
| sigmavirus24 | what's up? | 18:40 |
| tmcpeak | even with that change we get this: | 18:41 |
| tmcpeak | [tester]WARNING/usr/local/lib/python2.7/site-packages/bandit/core/tester.py:67: UserWarning: "try_except_pass" has been skipped due to missing config "try_except_pass". | 18:41 |
| tmcpeak | '"{1}".'.format(test.__name__, test._takes_config) | 18:41 |
| tmcpeak | specifically the .format is in there | 18:41 |
| tmcpeak | not sure why | 18:41 |
| tmcpeak | any ideas? | 18:41 |
| tmcpeak | or should I googles | 18:41 |
| *** yuanying has quit IRC | 18:41 | |
| sigmavirus24 | that's very weird | 18:41 |
| tmcpeak | yeah, my thoughts also | 18:42 |
| sigmavirus24 | might not be able to use .format | 18:42 |
| sigmavirus24 | *str.format | 18:42 |
| tmcpeak | also this: [general_hardcoded_password]WARNING/usr/local/lib/python2.7/site-packages/bandit/plugins/general_hardcoded_password.py:58: UserWarning: Could not substitute '%(site_data_dir)s' to a path with a valid word_list file | 18:42 |
| tmcpeak | warnings.warn(e.message) | 18:42 |
| sigmavirus24 | tmcpeak: https://stackoverflow.com/questions/2187269/python-print-only-the-message-on-warnings | 18:44 |
| *** dwyde has joined #openstack-security | 18:44 | |
| tmcpeak | ick | 18:44 |
| *** salv-orlando has quit IRC | 18:44 | |
| tmcpeak | I'll play with it | 18:44 |
| *** b10n1k has joined #openstack-security | 18:51 | |
| *** jmckind has joined #openstack-security | 18:53 | |
| *** yaya has quit IRC | 19:05 | |
| *** dwyde has quit IRC | 19:05 | |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 19:21 |
| tmcpeak | sigmavirus24, browne: ^ | 19:21 |
| tmcpeak | sigmavirus24: good point, I'll move it | 19:28 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 19:30 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 19:31 |
| *** yaya has joined #openstack-security | 19:31 | |
| *** singleth_ has quit IRC | 19:32 | |
| tmcpeak | sigmavirus24: back at you | 19:33 |
| tmcpeak | also browne: looksies? | 19:33 |
| tmcpeak | I'd like to get 0.13.1 out the door before I bounce for the weekend at 4:30 mountain time | 19:34 |
| tmcpeak | looks like I introduced a crapload of pep8 problems anyways | 19:38 |
| *** yaya has quit IRC | 19:38 | |
| tmcpeak | smcginnis: what's the py3 happy way of doing it? | 19:39 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 19:41 |
| *** singlethink has joined #openstack-security | 19:43 | |
| smcginnis | tmcpeak: Oh, sorry, meant to include that in the comment. val = six.text_type(message) | 19:46 |
| *** salv-orlando has joined #openstack-security | 19:47 | |
| tmcpeak | smcginnis ok, how about the formatting approach I took? | 19:48 |
| smcginnis | tmcpeak: I'll take a look at the latest. | 19:48 |
| tmcpeak | smcginnis: great, thank you | 19:48 |
| smcginnis | tmcpeak: Looks good! | 19:49 |
| tmcpeak | cool | 19:49 |
| tmcpeak | browne, sigmavirus24: around? | 19:50 |
| *** salv-orlando has quit IRC | 19:51 | |
| browne | yep, back from lunch | 19:54 |
| tmcpeak | great | 19:56 |
| tmcpeak | would love to have mergies soon | 19:56 |
| browne | this is needed for 0.13.1? | 19:57 |
| tmcpeak | browne: yep | 19:57 |
| tmcpeak | Daviey: yeah, I was thinking about utils, but honestly it gets monkey patched once at log initialization and then it's good for the rest of time | 19:57 |
| tmcpeak | main seemed appropriate | 19:57 |
| tmcpeak | utils is more for things that will get used in multiple places | 19:57 |
| tmcpeak | at least in my mind | 19:58 |
| browne | tmcpeak: could you tag it with a bug, since this is important for a respin | 19:58 |
| Daviey | tmcpeak: Well, either way.. It crossed my mind yo try and move all the functions out of bandit.py to try and make that file simpler... | 19:58 |
| tmcpeak | Daviey: yeah, probably time for a clean | 19:58 |
| tmcpeak | browne: no, but I can file one :) | 19:58 |
| tmcpeak | sigmavirus24's earlier change closed abug | 19:58 |
| Daviey | tmcpeak: Leave it there.. and for the future we'll refactor a bunch of it i guess | 19:58 |
| tmcpeak | this just makes the output nicer | 19:58 |
| Daviey | refactoring WITH better unit testing :) | 19:59 |
| tmcpeak | yep yep | 19:59 |
| Daviey | browne: I'm not sure i agree with opening bugs for bugs sake TBH. | 20:00 |
| browne | sure i get that, but in this case we're doing a 0.13.1 just for this or was mostly for sigmavirus24 fix? | 20:01 |
| sigmavirus24 | more so for the fix I tossed in | 20:01 |
| sigmavirus24 | if "this" is warnings.warn stuff then this is to make sure that we don't have super ugly output | 20:01 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 20:01 |
| tmcpeak | browne: done | 20:02 |
| tmcpeak | browne: mostly the sigmavirus24 fix | 20:02 |
| browne | ok | 20:02 |
| tmcpeak | btw, sigmavirus24 is a lot to type out, from now on it's going to be sv24 I think ;) | 20:02 |
| sigmavirus24 | hah | 20:03 |
| browne | yeah, i wish my IRC client was smarter | 20:03 |
| sigmavirus24 | tab completion is your friend tmcpeak | 20:03 |
| Daviey | tmcpeak: here, have a sug<tab> | 20:03 |
| sigmavirus24 | sig\t | 20:03 |
| tmcpeak | oh, lol | 20:03 |
| tmcpeak | wow, I never knew I had that | 20:03 |
| browne | oh crap, that does work. | 20:03 |
| Daviey | Xmas come early for tmcpeak | 20:03 |
| browne | me too | 20:03 |
| tmcpeak | my life just got 8-9% better | 20:03 |
| Daviey | Although, I am displeased with how many nicks start with t here. | 20:03 |
| Daviey | tmcpeak: Are you using telnet/netcat to IRC? If so, switching to a proper client will make your life ~3% better. | 20:05 |
| tmcpeak | Daviey: no ways, I use Adium | 20:07 |
| tmcpeak | terminals scare me | 20:07 |
| Daviey | irssi++ | 20:07 |
| tmcpeak | the little duck jumps up and down when I get called out | 20:07 |
| tmcpeak | that pleases me | 20:07 |
| Daviey | WOW.. I'd never even seen Adium before | 20:08 |
| tmcpeak | it's legit | 20:08 |
| smcginnis | +1 irssi :) | 20:08 |
| tmcpeak | lol, this thing | 20:09 |
| sigmavirus24 | Daviey: weechat or bust =P | 20:09 |
| Daviey | Adium looks like Microsoft Chat - http://img.photobucket.com/albums/v232/Davie1337fablemaster/lolpost.png | 20:09 |
| smcginnis | We could make it really interesting and start talking about text editors. :D | 20:09 |
| * sigmavirus24 doesn't have time for that | 20:09 | |
| tmcpeak | irssi do you even HTML bro? http://snag.gy/CzUpS.jpg | 20:09 |
| browne | Adium is unfortunately the best free IRC client on mac OS (that i know of) | 20:09 |
| browne | i keep wishing for something more like Slack | 20:10 |
| tmcpeak | ahh I haven't used slack yet, is it good? | 20:10 |
| browne | tmcpeak: its amazing | 20:10 |
| *** daemontool_ has joined #openstack-security | 20:10 | |
| tmcpeak | wow, that's high prize for a chat client | 20:10 |
| sigmavirus24 | browne: textual is often available for free | 20:11 |
| sigmavirus24 | it's nothing (visually) like Slack but it does work well and gives me growl notifications which is all I care about | 20:11 |
| browne | sigmavirus24: yeah, think i tried others, but they didn't support proxies | 20:11 |
| tmcpeak | browne, sigmavirus24, Daviey, etc etc etc new rev here: https://review.openstack.org/#/c/210091/ | 20:11 |
| sigmavirus24 | that said, when I dno't care if people are pinging me, I use irssi or weechat | 20:11 |
| tmcpeak | btw, has Zuul given up on life again? | 20:11 |
| Daviey | Zuul has been super sketchy the last few weeks | 20:12 |
| tmcpeak | yeah man | 20:12 |
| *** marzif has quit IRC | 20:12 | |
| sigmavirus24 | Go figure, a CI system needs disk space to work | 20:12 |
| sigmavirus24 | =P | 20:12 |
| tmcpeak | it's out of disk? | 20:13 |
| tmcpeak | somebody plug in some damn thumb drives, get this thing rolling again | 20:13 |
| Daviey | There is actually a spec' to allow people to contribute nodes to the CI pool. | 20:14 |
| Daviey | And another Spec to drop Jenkins and make Zuul everything. | 20:14 |
| tmcpeak | voluntarily or no? ;) | 20:14 |
| tmcpeak | I could see a future where you click the wrong link and next thing you know you're running Zuul jobs | 20:15 |
| Daviey | tmcpeak: I jokingly offered my old machine, and I was thrown back a serious spec. FML. | 20:15 |
| browne | tmcpeak: should i still be seeing this | 20:15 |
| browne | bandit/plugins/general_hardcoded_password.py:41: UserWarning: Using relative path for word_list: ./wordlist/default-passwords | 20:15 |
| browne | % word_list_path) | 20:15 |
| tmcpeak | hmm, lol no | 20:16 |
| Daviey | That is probably my fault | 20:16 |
| tmcpeak | but I see it too | 20:16 |
| tmcpeak | let me fix that too | 20:16 |
| browne | tmcpeak: all i did was checkout your patch and do tox -r | 20:16 |
| sigmavirus24 | yeah those should all be covered by the monkey patching of warnings module | 20:16 |
| Daviey | i imported warnings in the plugin, that is why | 20:16 |
| Daviey | Does it make sense to convert that to an exception and convert it to a warning in bandit.py? | 20:17 |
| tmcpeak | browne: crap | 20:18 |
| tmcpeak | I think it isn't because of the entry points? | 20:19 |
| tmcpeak | does this make sense? | 20:19 |
| *** alex_klimov has joined #openstack-security | 20:19 | |
| tmcpeak | Daviey: yeah, I think it does | 20:19 |
| Daviey | Yeah, warnings isn't a global monkey patch.. so my local import is using the real one | 20:20 |
| tmcpeak | Daviey, sigmavirus24, browne: ok how about this | 20:20 |
| tmcpeak | I'll implement BanditPluginException | 20:20 |
| tmcpeak | and raise that in the hardcoded password plugin | 20:20 |
| tmcpeak | catch that when I run the plugins | 20:21 |
| sigmavirus24 | I'm confused | 20:21 |
| tmcpeak | and if I see it use the monkey patched warning? | 20:21 |
| tmcpeak | sigmavirus24: I think because of stevedore plugins are not covered under the warnings monkey patch done in main | 20:21 |
| sigmavirus24 | I wonder if we can do the monkey patch immediately in bandit.py, i.e., right after we define the function with which we're monkey patching the warnings module | 20:22 |
| sigmavirus24 | I don't think that'll change anything | 20:22 |
| sigmavirus24 | Oh | 20:22 |
| sigmavirus24 | wait | 20:22 |
| sigmavirus24 | I get it | 20:22 |
| sigmavirus24 | we need to monkey patch warnings before other modules import it? | 20:22 |
| tmcpeak | sigmavirus24: you'd think I'm already doing that | 20:23 |
| tmcpeak | I'm monkey patching immediately in main | 20:23 |
| sigmavirus24 | yeah but we import the plugin manager thing right? | 20:23 |
| *** yaya has joined #openstack-security | 20:23 | |
| sigmavirus24 | that loads all plugins auto-magically I think | 20:23 |
| tmcpeak | sigmavirus24: logger comes first | 20:24 |
| tmcpeak | logger = _init_logger(debug) | 20:25 |
| tmcpeak | # By default path would be /etx/xdg/bandit, we want system paths | 20:25 |
| tmcpeak | os.environ['XDG_CONFIG_DIRS'] = '/etc:/usr/local/etc' | 20:25 |
| tmcpeak | extension_mgr = _init_extensions() | 20:25 |
| *** yuanying has joined #openstack-security | 20:25 | |
| sigmavirus24 | tmcpeak: I'm not sure | 20:26 |
| * sigmavirus24 also doesn't totally have his head here right now | 20:26 | |
| *** jmckind_ has joined #openstack-security | 20:28 | |
| *** yuanying has quit IRC | 20:29 | |
| Daviey | tmcpeak: Try implementing our own exception and see if you can make that a warning in bandit.py | 20:30 |
| Daviey | That is probably a more graceful way of handling it anyway IMO | 20:30 |
| bknudson | a warning specific to bandit would be better | 20:30 |
| sigmavirus24 | warnings do not actually catch exceptions though | 20:31 |
| Daviey | no, that isn't what i mean | 20:31 |
| sigmavirus24 | Okay | 20:31 |
| sigmavirus24 | Just making sure we're all on the same page | 20:31 |
| *** jmckind has quit IRC | 20:32 | |
| Daviey | sigmavirus24: So we throw an exception in the plugin.. which bubbles up to bandit.py where we do the filtering as a warning | 20:33 |
| Daviey | So reinterpret the exception as a warning | 20:33 |
| *** yaya has quit IRC | 20:33 | |
| Daviey | That would work? | 20:33 |
| *** jmckind_ has quit IRC | 20:33 | |
| Daviey | Just thinking about it... I find it amazing that warnings module doesn't JFDI for us. | 20:34 |
| tmcpeak | yeah.. just struggling over that myself | 20:38 |
| tmcpeak | Exception -> warning doesn't feel nice | 20:38 |
| bknudson | you can make warnings raise the exception | 20:38 |
| bknudson | https://docs.python.org/2.6/library/warnings.html#the-warnings-filter | 20:38 |
| *** jmckind has joined #openstack-security | 20:38 | |
| Daviey | bknudson: that is the wrong way around, isn't it? | 20:42 |
| Daviey | the only thing we want warnings for is to filter to stop repeating | 20:43 |
| bknudson | are you wondering how to log an exception? it's log.exception('whatever') | 20:43 |
| Daviey | no, no | 20:43 |
| tmcpeak | I believe I'm an idiot | 20:45 |
| Daviey | bknudson: for i in range(1,10): log.exception('I only want to see this error once and not 10 times FFS!') | 20:45 |
| sigmavirus24 | bknudson: we're using warnings so we'll only see a message once | 20:46 |
| sigmavirus24 | I don't get this exception/warning stuff though | 20:46 |
| bknudson | oh, sure... and you can control that per exception, I think. | 20:46 |
| Daviey | Seems our very own Doug Hellman has written a book about this. | 20:50 |
| tmcpeak | ok | 20:50 |
| tmcpeak | well I went nuts here | 20:50 |
| tmcpeak | turns out all of that stuff I said about the monkey patch not working was complete bs | 20:50 |
| Daviey | https://books.google.co.uk/books?id=cOSAzek6resC&pg=PA1176&lpg=PA1176&dq=def+send_warnings_to_log&source=bl&ots=dAbWQhfJ_k&sig=4UrTzuMJMvfjI2QKjinvRWjCIM4&hl=en&sa=X&ved=0CCgQ6AEwAWoVChMItq-m26qVxwIVsgfbCh1T1wQA#v=onepage&q=def%20send_warnings_to_log&f=false | 20:51 |
| Daviey | ^^ doing something like that is what i was suggesting ^^ | 20:51 |
| tmcpeak | Daviey: real quick, what is it we actually want to output here? | 20:52 |
| tmcpeak | raise RuntimeError("Could not substitute '%(site_data_dir)s' " | 20:52 |
| tmcpeak | "to a path with a valid word_list file") | 20:52 |
| *** salv-orlando has joined #openstack-security | 20:52 | |
| Daviey | tmcpeak: Just inform the user that we couldn't find a dictionary file | 20:53 |
| Daviey | before we were silently ignoring this, and therefore doing no check but appearing to pass | 20:53 |
| tmcpeak | ok I'm just going to say that | 20:54 |
| * Daviey needs more Gin | 20:55 | |
| tmcpeak | I just chased my tail for 30 mins for literally zero reason | 20:55 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 20:56 |
| tmcpeak | ship it | 20:56 |
| tmcpeak | browne, sigmavirus24: approvies please | 20:56 |
| tmcpeak | I need to go far far away from a computer apparently | 20:56 |
| tmcpeak | site_data_dir is apparently a function | 20:57 |
| tmcpeak | printing it isn't working | 20:57 |
| tmcpeak | monkey patch for warnings works fine with plugins | 20:58 |
| Daviey | tmcpeak: wait, what was the fix for this discussion ? | 20:58 |
| Daviey | what caused the fugly issue? | 20:58 |
| tmcpeak | we were trying to %s print a function | 20:58 |
| tmcpeak | the solution is the original warning monkey patch | 20:59 |
| tmcpeak | it works fine | 20:59 |
| Daviey | Oh | 20:59 |
| Daviey | we are dumb. | 21:00 |
| *** salv-orlando has quit IRC | 21:00 | |
| Daviey | nice catch tho. | 21:00 |
| tmcpeak | yeah, dumb :( | 21:00 |
| tmcpeak | sigmavirus24, browne: ok mergies for real | 21:01 |
| Daviey | tmcpeak: I did put in the detail incase someone was scratching their head as to what was wrong in the config.. but i don't think it matters | 21:02 |
| browne | ok, checking | 21:02 |
| tmcpeak | yeah, we can add it back later | 21:03 |
| browne | i still see the same thing | 21:03 |
| browne | bandit/plugins/general_hardcoded_password.py:41: UserWarning: Using relative path for word_list: ./wordlist/default-passwords | 21:03 |
| browne | % word_list_path) | 21:03 |
| tmcpeak | oh crap | 21:03 |
| tmcpeak | oh man | 21:04 |
| tmcpeak | that's it | 21:04 |
| tmcpeak | I think I need to retire | 21:04 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 21:05 |
| tmcpeak | browne: try that ^ | 21:05 |
| browne | tmcpeak: will do | 21:06 |
| browne | tmcpeak: no dice. and now its worse. I get assertion failure in the tests | 21:08 |
| tmcpeak | oh man | 21:08 |
| tmcpeak | ok, well, this is going to require more time | 21:09 |
| tmcpeak | I don't really want to push this last minute and go away for the weekend, lest something breaks really bad | 21:09 |
| tmcpeak | so I guess 0.13.1 is going to have to wait | 21:09 |
| Daviey | tmcpeak: I was busy when the earlier discussion happened about needing this .1.. but just to check, it isn't OMG emergency.. just annoying? | 21:10 |
| tmcpeak | wish I could repro your issue | 21:10 |
| tmcpeak | Daviey: yeah, Cinder (which isn't using it in a gate) gets a lot of exceptions when running because they don't have a profile which includes try,pass,except and others | 21:11 |
| tmcpeak | sigmavirus24 fixed the issue, but now we're having nasty formatting printing | 21:11 |
| Daviey | how come Cinder is using the latest release? | 21:12 |
| openstackgerrit | Travis McPeak proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 21:12 |
| tmcpeak | browne: sorry, one last time? | 21:12 |
| browne | sure | 21:13 |
| tmcpeak | Daviey: they don't have an upper pinned, so it just pulls the latest | 21:13 |
| tmcpeak | that's the way the majority of projects are set up | 21:13 |
| Daviey | tmcpeak: Hmm, o | 21:13 |
| Daviey | ok | 21:13 |
| tmcpeak | browne: it probably doesn't work | 21:14 |
| browne | tmcpeak: ha, should i stop? | 21:14 |
| tmcpeak | browne: go ahead | 21:14 |
| tmcpeak | if it works I'll do a little happy dance | 21:14 |
| Daviey | tmcpeak: Unit tests fail at least :) | 21:14 |
| Daviey | no happy dance :( | 21:14 |
| tmcpeak | still failing | 21:15 |
| tmcpeak | ? | 21:15 |
| tmcpeak | dammit | 21:15 |
| Daviey | oh, lemme try the recent one | 21:15 |
| browne | tmcpeak: is it failing for you? | 21:15 |
| tmcpeak | browne: what's failing? | 21:15 |
| tmcpeak | the output looks correct but unit tests are failing | 21:15 |
| tmcpeak | and I don't see your warning so I can't tell if it's fixed | 21:16 |
| tmcpeak | my unit test is failing in a way that doesn't seem to have anything to do with this | 21:16 |
| Daviey | tmcpeak: sorry, last commit fixed unit tests | 21:16 |
| Daviey | but, still the same crappy output | 21:16 |
| Daviey | bandit/plugins/general_hardcoded_password.py:41: UserWarning: Using relative path for word_list: ./wordlist/default-passwords "".format(word_list_path)) | 21:16 |
| browne | tmcpeak: is this a Ubuntu only problem? i still see the UserWarning in the output, but the test passed now | 21:16 |
| tmcpeak | hmmmrm | 21:17 |
| tmcpeak | ok, so the monkey patch is not working | 21:17 |
| tmcpeak | as I initially suspected | 21:17 |
| tmcpeak | I also have broken unit tests on my system somehow | 21:18 |
| tmcpeak | FAIL: tests.test_config.ConfigTests.test_find_configs | 21:18 |
| tmcpeak | AssertionError: 3 not less than 3 | 21:18 |
| tmcpeak | I'm sure we fixed this | 21:19 |
| *** jmckind has quit IRC | 21:19 | |
| tmcpeak | smcginnis: you still around? | 21:19 |
| *** dwyde has joined #openstack-security | 21:19 | |
| tmcpeak | I'm tempted to just fix this properly when I'm not feeling rush | 21:20 |
| tmcpeak | ed | 21:20 |
| tmcpeak | don't want to bang out some half-assed fix | 21:20 |
| sigmavirus24 | We already have ugly warning printing | 21:20 |
| sigmavirus24 | so what's more of it? =P | 21:20 |
| tmcpeak | sigmavirus24: yeah, well that's an alternative | 21:20 |
| tmcpeak | I guess your fix is better than not having it | 21:21 |
| tmcpeak | should I push 0.13.1 with that? | 21:21 |
| tmcpeak | at least a warning is better than spammed exceptions | 21:21 |
| tmcpeak | releases are cheap | 21:21 |
| tmcpeak | sigmavirus24, browne, Daviey, bknduson votes | 21:21 |
| tmcpeak | release with sigmavirus24's fix now, smooth it out Monday or wait until Monday, release once and have it nice? | 21:22 |
| *** markvoelker has quit IRC | 21:22 | |
| tmcpeak | I'll go with release now and re-release Monday | 21:22 |
| Daviey | tmcpeak: Gate is almost idle over the weekend | 21:23 |
| Daviey | I'd wait until Monday | 21:23 |
| tmcpeak | yeah, this isn't even a gate issue | 21:23 |
| tmcpeak | this is just a cinder devs playing around with Bandit user experience issue | 21:23 |
| tmcpeak | hmm actually | 21:23 |
| tmcpeak | Keystone would probably see this in their gate as well, but it shouldn't cause it to fail | 21:23 |
| Daviey | tmcpeak: I'm having a quick play with an idea.. but don't block on me | 21:23 |
| tmcpeak | bknudson: are you around? | 21:24 |
| bknudson | tmcpeak: y, where would I go? | 21:24 |
| tmcpeak | bknudson: hmm nevermind | 21:25 |
| tmcpeak | wanted to make sure this 13 didn't break Keystone but it looks like it did not | 21:25 |
| tmcpeak | https://jenkins07.openstack.org/job/gate-python-keystoneclient-tox-bandit/52/console | 21:25 |
| tmcpeak | so yeah, in that case I'm happy to wait until Monday to do anything | 21:25 |
| tmcpeak | bknudson - basically the issue is that the tmp file test now requires config, which your profile does not have | 21:25 |
| bknudson | bandit==0.13.0 | 21:25 |
| tmcpeak | which apparently causes copious errors to be blasted in output | 21:26 |
| bknudson | why aren't we running the tmp test? | 21:26 |
| *** dave-mcc_ has quit IRC | 21:26 | |
| bknudson | what's the test name? | 21:26 |
| tmcpeak | bknudson: no, you are | 21:27 |
| browne | hardcoded_password | 21:27 |
| tmcpeak | lol wait what | 21:27 |
| tmcpeak | you aren't | 21:28 |
| tmcpeak | hmm | 21:28 |
| tmcpeak | why not | 21:28 |
| bknudson | when was it added? | 21:28 |
| browne | because earlier bandit versions had a bug where the password list couldn't be found | 21:28 |
| tmcpeak | oh interesting | 21:28 |
| tmcpeak | bknudson: the gate isn't running it | 21:29 |
| browne | so goes back to my question, what version of bandit should the projects assume | 21:29 |
| tmcpeak | it's only in the verbose profile | 21:29 |
| tmcpeak | that's very intersting | 21:29 |
| bknudson | at this point projects have to assume 0.10.1 | 21:29 |
| bknudson | since that's what's in g-r | 21:29 |
| tmcpeak | no but, >=0.10.1, right? | 21:29 |
| tmcpeak | not actual 10.1 | 21:30 |
| bknudson | right, they have to work with 0.10.1 | 21:30 |
| tmcpeak | bknudson: your gate is running 0.13 | 21:30 |
| tmcpeak | https://jenkins07.openstack.org/job/gate-python-keystoneclient-tox-bandit/52/console | 21:30 |
| tmcpeak | oh right | 21:30 |
| bknudson | and assume that later versions are compatible | 21:30 |
| tmcpeak | they have to be compatible with 0.10.1 | 21:30 |
| tmcpeak | yeah | 21:30 |
| browne | what scenario would they not get 0.13, if they tested internally with their own PyPi mirror that's old? | 21:30 |
| bknudson | bandit might be installed via rpm or deb or whatever | 21:31 |
| bknudson | not everyone uses pypi | 21:31 |
| bknudson | because it's not secure | 21:31 |
| tmcpeak | lol | 21:31 |
| browne | true, although i don't think there are packages yet. ok, so should we bump the g-r here soon? we've made a lot of fixes | 21:32 |
| bknudson | (that's the rumor anyways) | 21:32 |
| tmcpeak | browne: yeah, definitely | 21:32 |
| browne | so when 0.13.1 is up, push g-r to 0.13.1 and then update projects? | 21:33 |
| tmcpeak | yeah | 21:33 |
| *** E7D4A1B8 has joined #openstack-security | 21:33 | |
| tmcpeak | I really want to build this automation too to make sure we don't break projects | 21:33 |
| browne | ok sounds good to me unless there are concerns | 21:33 |
| tmcpeak | that's going to be my #1 priority at midcycle | 21:34 |
| browne | tmcpeak: yeah, that would be really nice. but we can do manually for now | 21:34 |
| browne | #2 priority is probably unit tests | 21:34 |
| tmcpeak | manual is prone to errors and it sucks | 21:34 |
| browne | the maintenance of maintaining a separate bandit.yaml in each project also sucks hard | 21:35 |
| tmcpeak | yeah, definitely | 21:35 |
| *** E7D4A1B8 has quit IRC | 21:36 | |
| *** yaya has joined #openstack-security | 21:36 | |
| *** E7D4A1B8 has joined #openstack-security | 21:36 | |
| Daviey | tmcpeak: did we notice the Cinder noise issue, or did Cinder dev's? | 21:38 |
| smcginnis | Daviey: You mean the exception messages? That was me. | 21:39 |
| * smcginnis is a cinder dev | 21:39 | |
| Daviey | smcginnis: Ah, ok - thanks | 21:40 |
| smcginnis | Causing trouble wherever I go. :) | 21:40 |
| Daviey | heh | 21:41 |
| tmcpeak | :D | 21:44 |
| *** b10n1k has quit IRC | 21:44 | |
| *** zul has quit IRC | 21:45 | |
| sigmavirus24 | bknudson: I trust that's trolling (about PyPI not being secure0 | 21:52 |
| bknudson | sigmavirus24: tmcpeak was complaining about it during the ossg meeting | 21:52 |
| * sigmavirus24 wasn't around for the meeting | 21:53 | |
| *** zul has joined #openstack-security | 21:55 | |
| *** dwyde has quit IRC | 21:57 | |
| *** salv-orlando has joined #openstack-security | 21:59 | |
| *** yaya has quit IRC | 21:59 | |
| Daviey | tmcpeak: So, raising an exception in the plugin and then wrapping it in try/except in tester.py and raising it as a warning seems to do it? | 21:59 |
| tmcpeak | sigmavirus24: yeah, PyPI wasn't really built for enterprise uses | 22:00 |
| tmcpeak | dstufft has his hands full trying to make it better but legacy PyPI is super legacy | 22:00 |
| tmcpeak | we got brute force prevention added to it yesterday | 22:00 |
| tmcpeak | Daviey: yeah, well in one of those cases we want to warn and keep going, and in the other we don't | 22:01 |
| Daviey | tmcpeak: Right, if UserWarning is raised, catch it and convert it to a warning.warn | 22:01 |
| tmcpeak | Daviey: yeah, that should work | 22:02 |
| Daviey | UserWarning isn't a show stopper but something that should carry on | 22:02 |
| tmcpeak | if we're taking our time though, I'd like to actually implement two of our own exceptions - BanditPluginError and BanditPluginWarning | 22:02 |
| Daviey | Hah | 22:02 |
| tmcpeak | to be more explicit | 22:02 |
| tmcpeak | but yeah, UserWarning is fine | 22:02 |
| Daviey | $ git diff | grep BanditWarning | 22:03 |
| Daviey | +class BanditWarning(Exception): | 22:03 |
| Daviey | + raise utils.BanditWarning("Using relative path for word_list: {0}" | 22:03 |
| tmcpeak | perfect :) | 22:03 |
| tmcpeak | Daviey: if you (or anybody else) want to take over that set I had going, that would be awesome | 22:03 |
| sigmavirus24 | uhm | 22:05 |
| sigmavirus24 | Daviey: banditwarning should inherit from Warning | 22:05 |
| sigmavirus24 | Not exception | 22:05 |
| Daviey | tmcpeak: You are 99% there, i don't want to steal your glory.. Just the last stretch now | 22:05 |
| tmcpeak | steal away | 22:06 |
| tmcpeak | I shun glory | 22:06 |
| Daviey | sigmavirus24: Ah, good thinking | 22:06 |
| sigmavirus24 | I shun sleep | 22:06 |
| Daviey | sigmavirus24: can you 'raise' a Warning? | 22:06 |
| sigmavirus24 | Daviey: you're not supposed to | 22:06 |
| tmcpeak | yeah, can you? | 22:07 |
| sigmavirus24 | warnings.warn('message', BanditWarning) | 22:07 |
| Daviey | ah right | 22:07 |
| Daviey | TIL | 22:07 |
| Daviey | wait.. but we can't try/except a warning | 22:08 |
| *** salv-orlando has quit IRC | 22:08 | |
| sigmavirus24 | I don't understand why you want to | 22:08 |
| Daviey | But i suppose the redfintion of warnings cn be imported per plugin | 22:09 |
| Daviey | rather than using core warnigns module | 22:09 |
| tmcpeak | Daviey: yeah, but that sucks | 22:09 |
| tmcpeak | I'd prefer the raise approach | 22:09 |
| Daviey | indeed | 22:09 |
| Daviey | sigmavirus24: Do you have a better direction? | 22:09 |
| bknudson | if you set warnings filter to "error" it'll raise the exception | 22:09 |
| sigmavirus24 | ^ | 22:10 |
| edmondsw | so the issue smcginnis found, https://bugs.launchpad.net/bandit/+bug/1481922 , is because bandit.yaml is missing something? | 22:10 |
| openstack | Launchpad bug 1481922 in Bandit "'NoneType' object has no attribute '__getitem__'" [High,Fix committed] - Assigned to Sean McGinnis (sean-mcginnis) | 22:10 |
| Daviey | hmm | 22:10 |
| sigmavirus24 | I don't understand what you're all doing so | 22:10 |
| sigmavirus24 | edmondsw: correct | 22:10 |
| Daviey | well then we are warning-treated-as-exception, catching-and-convert-back-to-monkey-warning | 22:10 |
| Daviey | which is even nastier IMO | 22:10 |
| edmondsw | sigmavirus24 what exactly is missing? | 22:10 |
| tmcpeak | edmondsw: yeah, so basically browne proposed the config for Bandit a while ago, since then we added new plugins which require config and the new profile didn't get them | 22:10 |
| tmcpeak | edmondsw: I'll dig up a link | 22:10 |
| edmondsw | tmcpeak, tx | 22:11 |
| tmcpeak | this block: https://github.com/openstack/bandit/blob/master/bandit/config/bandit.yaml#L236 and this block: https://github.com/openstack/bandit/blob/master/bandit/config/bandit.yaml#L205 | 22:11 |
| sigmavirus24 | edmondsw: try_except_pass was what smcginnis was seeing | 22:11 |
| edmondsw | same here | 22:11 |
| smcginnis | edmondsw: Yeah, outdated config that caused problems for missing new plugins. | 22:12 |
| *** yuanying has joined #openstack-security | 22:13 | |
| edmondsw | ok, I think I understand... need to add try_except_pass:\n check_typed_exception: True to the yaml | 22:16 |
| *** yuanying has quit IRC | 22:17 | |
| *** edmondsw has quit IRC | 22:20 | |
| *** bknudson has quit IRC | 22:23 | |
| Daviey | tmcpeak: sweet, that worked... | 22:24 |
| Daviey | $ bandit -r bandit/ | 22:24 |
| Daviey | [bandit]INFOusing config: /usr/local/etc/bandit/bandit.yaml | 22:24 |
| Daviey | [bandit]INFOrunning on Python 2.7.6 | 22:24 |
| Daviey | [general_hardcoded_password]WARNINGUsing relative path for word_list: ./wordlist/default-passwords | 22:24 |
| *** singlethink has quit IRC | 22:32 | |
| *** zul has quit IRC | 22:35 | |
| Daviey | tmcpeak: So actually, just monkey patching in tester.py is enough.. This works, http://git.io/vOd2d | 22:41 |
| Daviey | tmcpeak: should i push that up? | 22:42 |
| Daviey | actually, it seems it can be removed from bandit.py aswell | 22:44 |
| *** markvoelker has joined #openstack-security | 22:50 | |
| * Daviey pushes up.. feel free to revert. | 22:51 | |
| openstackgerrit | Dave Walker proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 22:51 |
| *** voodookid has quit IRC | 23:03 | |
| *** yuanying has joined #openstack-security | 23:14 | |
| browne | Daviey: looks much better! | 23:14 |
| browne | the only thing that's odd is how these warning messages are printed in the middle of the file count | 23:15 |
| browne | 790 [0.. [tester]WARNING"hardcoded_tmp_directory" has been skipped due to missing config "hardcoded_tmp_d | 23:15 |
| browne | but that's a nit | 23:15 |
| *** yuanying has quit IRC | 23:18 | |
| *** alex_klimov has quit IRC | 23:19 | |
| *** yuanying has joined #openstack-security | 23:23 | |
| *** Daviey has quit IRC | 23:25 | |
| *** Daviey has joined #openstack-security | 23:26 | |
| *** salv-orlando has joined #openstack-security | 23:27 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Implement new API format https://review.openstack.org/190473 | 23:29 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Move all plugins to stevedore https://review.openstack.org/208311 | 23:29 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Move sample config for tests to one place https://review.openstack.org/207752 | 23:30 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Allow configurable signing backends https://review.openstack.org/201394 | 23:30 |
| *** bknudson has joined #openstack-security | 23:35 | |
| *** sdake has quit IRC | 23:38 | |
| openstackgerrit | Dave Walker proposed openstack/bandit: Capture warnings for missing plugins or config in normal logging https://review.openstack.org/210091 | 23:46 |
| Daviey | sigmavirus24: Can you take a quick look.. /me wants to go to bed. :) | 23:46 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
