| *** jamielennox is now known as jamielennox|away | 00:05 | |
| *** jamielennox|away is now known as jamielennox | 00:07 | |
| *** jamielennox is now known as jamielennox|away | 00:10 | |
| *** salv-orlando has quit IRC | 00:13 | |
| *** markvoelker has joined #openstack-security | 00:51 | |
| *** markvoelker has quit IRC | 00:56 | |
| *** bpokorny has quit IRC | 01:06 | |
| *** tjt263 has quit IRC | 01:33 | |
| *** tmcpeak has quit IRC | 01:41 | |
| openstackgerrit | Eric Brown proposed openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 01:41 |
|---|---|---|
| *** markvoelker has joined #openstack-security | 01:43 | |
| openstackgerrit | Eric Brown proposed openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 01:45 |
| openstackgerrit | Eric Brown proposed openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 01:46 |
| *** browne has quit IRC | 01:48 | |
| *** markvoelker has quit IRC | 01:48 | |
| *** jamielennox|away is now known as jamielennox | 02:08 | |
| *** salv-orlando has joined #openstack-security | 02:24 | |
| *** tjt263 has joined #openstack-security | 02:25 | |
| *** salv-orlando has quit IRC | 02:32 | |
| *** bpokorny has joined #openstack-security | 02:52 | |
| *** markvoelker has joined #openstack-security | 02:55 | |
| *** browne has joined #openstack-security | 03:09 | |
| *** jian5397 has joined #openstack-security | 03:10 | |
| *** tkelsey has joined #openstack-security | 03:29 | |
| *** jian5397 has quit IRC | 03:30 | |
| *** tkelsey has quit IRC | 03:33 | |
| *** tjt263 has quit IRC | 03:40 | |
| *** tjt263 has joined #openstack-security | 03:48 | |
| *** jian5397 has joined #openstack-security | 03:51 | |
| *** jamielennox is now known as jamielennox|away | 04:02 | |
| *** salv-orlando has joined #openstack-security | 04:16 | |
| *** salv-orlando has quit IRC | 04:19 | |
| *** jian5397 has quit IRC | 04:23 | |
| *** markvoelker has quit IRC | 04:26 | |
| openstackgerrit | Merged openstack/security-doc: fix spelling in security-services-for-instances https://review.openstack.org/212776 | 04:37 |
| openstackgerrit | Merged openstack/security-doc: made small change to case-studies rst file https://review.openstack.org/212787 | 04:38 |
| *** jamielennox|away is now known as jamielennox | 04:46 | |
| *** dave-mccowan has quit IRC | 05:14 | |
| *** sdake_ has quit IRC | 05:17 | |
| *** bpokorny has quit IRC | 05:17 | |
| *** bpokorny has joined #openstack-security | 05:18 | |
| *** bpokorny has quit IRC | 05:18 | |
| *** bpokorny has joined #openstack-security | 05:19 | |
| *** bpokorny has quit IRC | 05:24 | |
| *** salv-orlando has joined #openstack-security | 05:43 | |
| *** salv-orlando has quit IRC | 05:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/212992 | 06:01 |
| openstackgerrit | Merged openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/212992 | 06:21 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/213003 | 06:28 |
| *** tjt263 has quit IRC | 06:30 | |
| *** tjt263 has joined #openstack-security | 06:33 | |
| openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/213003 | 06:49 |
| *** jamielennox is now known as jamielennox|away | 07:17 | |
| *** tkelsey has joined #openstack-security | 07:31 | |
| *** tkelsey has quit IRC | 07:35 | |
| *** tkelsey has joined #openstack-security | 07:51 | |
| *** salv-orlando has joined #openstack-security | 07:54 | |
| *** salv-orlando has quit IRC | 08:05 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Integrate PyASN1 for certificate operations https://review.openstack.org/204368 | 08:07 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Abstract the signing / verification https://review.openstack.org/211437 | 08:10 |
| *** alex_klimov has joined #openstack-security | 08:24 | |
| *** browne has quit IRC | 08:34 | |
| *** tjt263 has quit IRC | 09:05 | |
| *** salv-orlando has joined #openstack-security | 09:07 | |
| *** salv-orlando has quit IRC | 09:11 | |
| *** tkelsey has quit IRC | 09:22 | |
| *** tjt263 has joined #openstack-security | 09:26 | |
| *** tjt263 has quit IRC | 09:29 | |
| *** tjt263 has joined #openstack-security | 09:30 | |
| *** salv-orlando has joined #openstack-security | 09:36 | |
| *** rmarathu has joined #openstack-security | 09:41 | |
| *** alex_klimov has quit IRC | 09:47 | |
| *** rmarathu has quit IRC | 10:19 | |
| *** alex_klimov has joined #openstack-security | 10:23 | |
| *** tjt263 has quit IRC | 11:43 | |
| *** tjt263 has joined #openstack-security | 11:44 | |
| jelle | /go 17 | 11:44 |
| *** sdake_ has joined #openstack-security | 12:11 | |
| *** markvoelker has joined #openstack-security | 12:21 | |
| *** edmondsw has joined #openstack-security | 12:29 | |
| *** sdake_ has quit IRC | 12:37 | |
| *** dave-mccowan has joined #openstack-security | 12:52 | |
| *** sdake has joined #openstack-security | 12:55 | |
| *** sdake_ has joined #openstack-security | 12:59 | |
| *** sdake has quit IRC | 13:02 | |
| *** tmcpeak has joined #openstack-security | 13:14 | |
| *** sdake has joined #openstack-security | 13:17 | |
| *** sdake_ has quit IRC | 13:20 | |
| *** browne has joined #openstack-security | 13:24 | |
| *** singlethink has joined #openstack-security | 13:24 | |
| *** sdake_ has joined #openstack-security | 13:34 | |
| *** sdake has quit IRC | 13:38 | |
| *** jmckind has joined #openstack-security | 13:46 | |
| *** timkennedy has quit IRC | 13:48 | |
| *** jmckind has quit IRC | 13:52 | |
| *** timkennedy has joined #openstack-security | 13:54 | |
| *** jmckind has joined #openstack-security | 14:02 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:23 | |
| tmcpeak | sigmavirus24: can you take a look at this please? https://review.openstack.org/212896 | 14:24 |
| tmcpeak | we somehow managed to once again break config in 0.13.0 :( | 14:24 |
| tmcpeak | Daviey: ^ | 14:24 |
| Daviey | :'( | 14:25 |
| tmcpeak | so guess what day it is? 0.13.2 day | 14:25 |
| sigmavirus24 | tmcpeak: yeah I saw the bug report in my email | 14:25 |
| sigmavirus24 | hah | 14:25 |
| sigmavirus24 | that looks right | 14:25 |
| sigmavirus24 | I think dstufft would be the better person to review that | 14:25 |
| tmcpeak | ooh good point | 14:26 |
| sigmavirus24 | Since he knows all things virtualenv, pip, etc. | 14:26 |
| Daviey | tmcpeak: Hmm. Maybe i am missremembering, but i thought we concluded that it was acceptable that a config wouldn't be found in virtualenv? | 14:26 |
| sigmavirus24 | It *looks* right to me | 14:26 |
| sigmavirus24 | But damned if I know | 14:26 |
| sigmavirus24 | Daviey: did we? | 14:26 |
| tmcpeak | dstufft: you got time to take a look at this or are you snowed under? | 14:26 |
| sigmavirus24 | I don't see why we would have thought that | 14:26 |
| tmcpeak | no, I don't think so | 14:26 |
| sigmavirus24 | Most people use bandit in tox (i.e., in a virtualenv) | 14:26 |
| Daviey | sigmavirus24: I'm not sure... we bikeshedded quite a bit :) | 14:26 |
| tmcpeak | 0.12.0 -> 0.13.0 broke some internal automation | 14:26 |
| tmcpeak | that's how I noticed it | 14:26 |
| * sigmavirus24 may not have been around/paying attention | 14:26 | |
| Daviey | Ah yes, quite right. | 14:26 |
| * sigmavirus24 shrugs | 14:26 | |
| sigmavirus24 | I'm not worried about it too much | 14:27 |
| sigmavirus24 | we're still in 0.x | 14:27 |
| tmcpeak | lol | 14:27 |
| *** browne has quit IRC | 14:27 | |
| sigmavirus24 | breaking working things isn't acceptable | 14:27 |
| sigmavirus24 | but we also aren't guaranteeing stability | 14:27 |
| sigmavirus24 | so yolo | 14:27 |
| tmcpeak | we're never coming out of 0.x ;) | 14:27 |
| tmcpeak | like Gmail, it was in beta for like 12 years | 14:27 |
| tmcpeak | #yolo ! | 14:27 |
| tmcpeak | I'm mainly concerned with the gate stability | 14:28 |
| tmcpeak | if we break things for bknudson I'll be very upset but otherwise I'm pretty much on the same page with sigmavirus24 on that | 14:28 |
| tmcpeak | Daviey: oh yeah, we have tests.. | 14:29 |
| Daviey | Move Fast and Break Things. -- Facebook | 14:29 |
| sigmavirus24 | "tests" | 14:29 |
| sigmavirus24 | =P | 14:29 |
| tmcpeak | ;) | 14:29 |
| tmcpeak | we're kind of testing whatever we're doing we're doing right, but we're obviously not testing that we're doing what we're supposed to be | 14:30 |
| Daviey | Yeah, turns out that 1==1 | 14:32 |
| Daviey | I started doing better mocking.. but not ready to push up. | 14:32 |
| tmcpeak | but when that day comes when 1 != 1 we'll be right there waiting | 14:33 |
| Daviey | We'll catch that use case perfectly! | 14:33 |
| *** alejandrito has joined #openstack-security | 14:44 | |
| tmcpeak | http://www.irongeek.com/i.php?page=videos/bsideslasvegas2015/mainlist | 14:47 |
| *** jian5397 has joined #openstack-security | 14:48 | |
| dstufft | tmcpeak: you're not going to detect pyvenv style virtual envs | 14:55 |
| dstufft | tmcpeak: https://github.com/pypa/pip/blob/develop/pip/locations.py#L72-L82 | 14:56 |
| tmcpeak | dstufft: ahh ok, what do you suggest for an approach? | 14:57 |
| tmcpeak | adding the first bit of that code? | 14:57 |
| dstufft | use the code I linked | 14:57 |
| dstufft | to detect virtualenv | 14:57 |
| tmcpeak | if hasattr(sys, 'real_prefix'): | 14:57 |
| tmcpeak | return True | 14:57 |
| dstufft | that whole function | 14:57 |
| tmcpeak | dstufft: ok awesome, thank you sir | 14:58 |
| dstufft | that function is "return true if running under a virtual environment, false otherwise" | 14:58 |
| dstufft | also um | 14:58 |
| tmcpeak | and whenever we are we can use browne's code to find the virtualenv config? | 14:58 |
| dstufft | you probably don't want to use the env var | 14:58 |
| dstufft | that only happens if you activate the virtual env, not call the bins directly | 14:59 |
| tmcpeak | ahh ok | 14:59 |
| tmcpeak | better way? | 14:59 |
| *** singleth_ has joined #openstack-security | 14:59 | |
| dstufft | use sys.prefix | 14:59 |
| tmcpeak | same way as you did in that code? | 15:00 |
| dstufft | No, you should be able to replace os.environ["..."] with "sys.prefix" | 15:00 |
| dstufft | sys.prefix in virtual environments is rooted at the top of the virtual env | 15:01 |
| *** singlethink has quit IRC | 15:03 | |
| tmcpeak | ok awesome, thank you | 15:03 |
| *** bpokorny has joined #openstack-security | 15:04 | |
| Daviey | dstufft rocks. | 15:05 |
| tmcpeak | +1 | 15:05 |
| tmcpeak | I've said it before, I'll say it again - dstufft gets beers for life | 15:05 |
| *** voodookid has joined #openstack-security | 15:06 | |
| *** bpokorny has quit IRC | 15:08 | |
| *** singlethink has joined #openstack-security | 15:16 | |
| *** singleth_ has quit IRC | 15:19 | |
| *** singlethink has quit IRC | 15:20 | |
| *** bpokorny has joined #openstack-security | 15:24 | |
| *** dwyde has joined #openstack-security | 15:26 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 15:30 | |
| *** openstackgerrit has quit IRC | 15:31 | |
| *** openstackgerrit has joined #openstack-security | 15:31 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:33 | |
| openstackgerrit | Andrew Mitry proposed openstack/security-doc: Made changes to docs case studies in sec guide https://review.openstack.org/213205 | 15:38 |
| *** alex_klimov has quit IRC | 15:44 | |
| tmcpeak | where's Mr. Brown? :) | 15:52 |
| *** browne has joined #openstack-security | 15:53 | |
| tmcpeak | speak of the devil :P | 15:53 |
| tmcpeak | browne: could you take another crack at that change? I'd like to get it into 0.13.2 before I leave (1 PM PST) | 15:54 |
| browne | will do | 15:54 |
| tmcpeak | browne: awesome, thanks man! | 15:55 |
| openstackgerrit | Shilla Saebi proposed openstack/security-doc: change to data-encryption file https://review.openstack.org/213215 | 15:55 |
| openstackgerrit | Shilla Saebi proposed openstack/security-doc: small change to key-management rst file https://review.openstack.org/213217 | 15:57 |
| *** singlethink has joined #openstack-security | 16:01 | |
| openstackgerrit | Shilla Saebi proposed openstack/security-doc: fixed spelling in secure-reference-architectures https://review.openstack.org/213220 | 16:01 |
| openstackgerrit | Shilla Saebi proposed openstack/security-doc: Made changes to docs case studies in sec guide https://review.openstack.org/213205 | 16:09 |
| browne | tmcpeak: i'll need help on mac. i've never been able to get venv working there. so i don't know what the equivalent of /etc/ is | 16:23 |
| tmcpeak | you mean within the venv? | 16:24 |
| browne | yeah | 16:24 |
| tmcpeak | should be the same venv_name/etc | 16:24 |
| browne | but according to the readme we don't search anywhere in ../etc/.. | 16:25 |
| tmcpeak | browne: I think what we should do is add the venv/etc check to the end of the dirs regardless of platform if we detect we're in a virtualenv (using dstufft's linked code) | 16:26 |
| browne | tmcpeak: yeah i did that, but not sure what to put in the readme. although i can just be general | 16:28 |
| *** singleth_ has joined #openstack-security | 16:28 | |
| tmcpeak | browne: yeah, just be general I htink | 16:28 |
| tmcpeak | *think | 16:28 |
| tmcpeak | virtualenv's work the same in Mac/Linux I believe | 16:28 |
| browne | sure, it works the same, but what path do it get for appdirs.site_config_dir("bandit") | 16:29 |
| *** singlet__ has joined #openstack-security | 16:30 | |
| tmcpeak | browne: let me check | 16:30 |
| browne | /usr/local/etc/bandit/bandit.yaml ? | 16:30 |
| elmiko | i've had issues getting some packages to install correctly on my mac, usually issues with having the compiled dependencies in place. ymmv | 16:31 |
| *** singlethink has quit IRC | 16:31 | |
| tmcpeak | browne: when I ran appdirs.site_config_dir("bandit") it returned: '/Library/Application Support/bandit' | 16:32 |
| tmcpeak | from within the venv | 16:32 |
| browne | elmiko: yeah i tried to use mac os like a year ago for python. lots of issues | 16:33 |
| tmcpeak | it's all I use, it works great as long as I don't have to produce something that somebody else wants to run :P | 16:33 |
| *** singleth_ has quit IRC | 16:33 | |
| browne | tmcpeak: ok cool. that's what i needed. now do you also have a directory of '/Library/Application Support/bandit' in your virtualenv path? | 16:34 |
| tmcpeak | lemme check | 16:34 |
| elmiko | tmcpeak: lol! | 16:34 |
| elmiko | browne: yea, sadly i gave up on my mac for dev work about 1.5 years ago | 16:34 |
| tmcpeak | browne: no I do not, nothing in '/Library' is in my virtualenv path | 16:35 |
| browne | tmcpeak: so what is in your <path to venv>/ ? | 16:35 |
| Daviey | browne: did you see the comment i left about mac's /etc ? | 16:36 |
| Daviey | (in code comment, prior commit near your change) | 16:36 |
| openstackgerrit | Merged openstack/security-doc: Remove DocBook glossary https://review.openstack.org/211904 | 16:36 |
| browne | Daviey: i did not. let me check | 16:36 |
| openstackgerrit | Merged openstack/security-doc: Remove tools/generatepot https://review.openstack.org/212129 | 16:37 |
| openstackgerrit | Merged openstack/security-doc: change to data-encryption file https://review.openstack.org/213215 | 16:37 |
| openstackgerrit | Merged openstack/security-doc: fixed spelling in secure-reference-architectures https://review.openstack.org/213220 | 16:37 |
| tmcpeak | browne: /Users/travismcpeak/Desktop/temp/test/bin:/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin | 16:37 |
| tmcpeak | that Desktop/temp/test is my virtualenv | 16:37 |
| Daviey | browne: '/Library/Application Support/bandit' IS correct, but pip will never install there.. so appdirs does the wrong thing for us | 16:37 |
| browne | so where in a venv on mac os does bandit.yaml go? | 16:38 |
| browne | /usr/local/etc/bandit/bandit.yaml ? | 16:39 |
| tmcpeak | browne: test/lib/python2.7/site-packages/bandit/config/bandit.yaml | 16:39 |
| Daviey | browne: See the comment here, might be useful https://gist.github.com/Daviey/6edf198a996ba55a0167 | 16:39 |
| Daviey | tmcpeak: IMO we should really try to avoid using the lib one | 16:39 |
| tmcpeak | Daviey: in my virtualenv that's the only one I got | 16:40 |
| Daviey | browne: Also see the paths where it might actually be installed here, https://github.com/openstack/bandit/commit/80c7798e5140203ae8d48d11a3de660db1de8f80 | 16:40 |
| Daviey | tmcpeak: Yeah, so that should be the LAST place we check | 16:40 |
| tmcpeak | Daviey: I'm happy with that, but it needs to be *a* place we check | 16:41 |
| tmcpeak | otherwise broken ensues | 16:41 |
| Daviey | +1 | 16:41 |
| Daviey | browne: Does those two links make sense? | 16:41 |
| browne | Daviey: they make sense, but i still have no idea what to do about venv on mac | 16:41 |
| *** salv-orlando has quit IRC | 16:42 | |
| tmcpeak | can we use the path relative to the actual python being executed? | 16:42 |
| Daviey | browne: Right so... | 16:42 |
| Daviey | tmcpeak: can you run that code segement AGAIN under virtualenv? | 16:42 |
| tmcpeak | Daviey: which code segment? | 16:42 |
| Daviey | Oh wait.. that wont help you | 16:42 |
| tmcpeak | so I think general approach should be this: | 16:43 |
| openstackgerrit | Merged openstack/security-doc: Made changes to docs case studies in sec guide https://review.openstack.org/213205 | 16:43 |
| Daviey | tmcpeak: What is the full path of test/lib/python2.7/site-packages/bandit/config/bandit.yaml ? | 16:43 |
| tmcpeak | 1) we detect if we're in a virtualenv, and if so 2) add virtual_env/etc/bandit.yaml and virtualenv/site_packages/bandit/config/bandit.yaml to the searched paths | 16:43 |
| browne | tmcpeak: hardcoded? or use appdirs? | 16:44 |
| tmcpeak | test/lib/python2.7/site-packages/bandit/config/bandit.yaml | 16:44 |
| tmcpeak | hardcoded, I don't think appdirs works | 16:44 |
| Daviey | tmcpeak: it might be safe to unconditionally try and use the virtualenv path | 16:44 |
| Daviey | tmcpeak: No, the full path... ? | 16:44 |
| tmcpeak | no not the full path | 16:44 |
| Daviey | But for my education, what is the full path? :) | 16:45 |
| tmcpeak | is there a way to get the site-packages dir of a virtualenv? | 16:45 |
| *** firstTimeHero has joined #openstack-security | 16:45 | |
| tmcpeak | Daviey: it's that, it's just got my desktop sitting in front of it. test is the root of my virtualenv | 16:45 |
| *** firstTimeHero has left #openstack-security | 16:45 | |
| Daviey | Oh i see | 16:46 |
| tmcpeak | I think per what dstuffft said we can use sys.prefix | 16:46 |
| Daviey | yeah | 16:46 |
| Daviey | virtualenv changes the sys.prefix, right? | 16:46 |
| tmcpeak | dstufft: is there an equivalent to sys.prefix of site packages? | 16:46 |
| Daviey | so sys.prefix + "/bandit/config/bandit.yaml" ? | 16:46 |
| tmcpeak | well no, because: | 16:47 |
| tmcpeak | >>> sys.prefix | 16:47 |
| tmcpeak | '/Users/travismcpeak/Desktop/temp/test/bin/..' | 16:47 |
| tmcpeak | so that only gets us to the root of the virutalenv | 16:47 |
| tmcpeak | so we can do "sys.prefix + '/etc'" for the virtualenv etc directory but we also need a way of getting to site packages | 16:47 |
| Daviey | is [-1] safe? | 16:49 |
| Daviey | >>> print sys.prefix | 16:49 |
| Daviey | /home/dave/openstack/.venv | 16:49 |
| Daviey | err | 16:49 |
| tmcpeak | import site; site.getsitepackages() | 16:49 |
| Daviey | >>> print sys.path[-1] | 16:49 |
| Daviey | /home/dave/openstack/.venv/lib/python2.7/site-packages | 16:49 |
| tmcpeak | lol, that doesn't work | 16:49 |
| tmcpeak | I mean the one I pasted | 16:49 |
| tmcpeak | Daviey: yours works for me | 16:50 |
| browne | Daviey: can you always rely on that being the last item in the list? | 16:50 |
| Daviey | NFI | 16:50 |
| tmcpeak | I doubt it | 16:50 |
| tmcpeak | from distutils.sysconfig import get_python_lib; print(get_python_lib()) | 16:50 |
| tmcpeak | that also works ^ | 16:50 |
| tmcpeak | dstufft: you around? | 16:51 |
| Daviey | tmcpeak: are you /certain/ it doesn't get installed somewhere else aswell? | 16:51 |
| tmcpeak | not in the virtualenv path | 16:51 |
| tmcpeak | (test)MacBook-Pro:temp travismcpeak$ find . -name 'bandit.yaml' | 16:52 |
| tmcpeak | ./test/lib/python2.7/site-packages/bandit/config/bandit.yaml | 16:52 |
| Daviey | tmcpeak: and you used pip inside the virtualenv to install it? | 16:52 |
| tmcpeak | yep | 16:52 |
| tmcpeak | browne: you're on Ubuntu right? | 16:53 |
| tmcpeak | can you verify what happens when you're in a virutalenv and run this: | 16:53 |
| tmcpeak | from distutils.sysconfig import get_python_lib | 16:53 |
| tmcpeak | print get_python_lib() | 16:53 |
| tmcpeak | if it points to our site-packages I think we're good | 16:53 |
| browne | '/home/ericwb/bandit/test_me/lib/python2.7/site-packages' | 16:53 |
| browne | tmcpeak: ^^^ | 16:54 |
| Daviey | weird... | 16:54 |
| Daviey | (.venv)dave@piper:~/openstack/.venv$ find ./ | grep bandit.yaml | 16:54 |
| Daviey | ## Nothing returned, now pip install | 16:54 |
| Daviey | (.venv)dave@piper:~/openstack/.venv$ find ./ | grep bandit.yaml | 16:54 |
| Daviey | ./lib/python2.7/site-packages/bandit/config/bandit.yaml | 16:54 |
| Daviey | ./etc/bandit/bandit.yaml | 16:54 |
| dstufft | tmcpeak: what versions of Python do you support | 16:55 |
| tmcpeak | 2.7 + | 16:55 |
| tmcpeak | browne: ok I think this should work then | 16:55 |
| sigmavirus24 | dstufft: actually 2.7 and 3.4 | 16:55 |
| sigmavirus24 | not 2.7 + | 16:55 |
| tmcpeak | :P | 16:55 |
| tmcpeak | listen to sigma | 16:55 |
| sigmavirus24 | some people may use it on 3.3, but we don't test there | 16:55 |
| tmcpeak | I rarely know what I'm talking about :) | 16:55 |
| sigmavirus24 | (some people == gentoo) | 16:55 |
| Daviey | tmcpeak: SO.. I am not sure 0.13.1 doesn't work as designed on Linix.. i think it is just mac. | 16:56 |
| *** tjt263 has quit IRC | 16:56 | |
| sigmavirus24 | Daviey: virtualenvs != global installs | 16:56 |
| sigmavirus24 | Which is the problem | 16:56 |
| dstufft | tmcpeak: sigmavirus24 there's a sysconfig API outside of distutils | 16:56 |
| dstufft | that you want | 16:56 |
| dstufft | instead of the distutils one | 16:56 |
| tmcpeak | Daviey: nah, it doesn't work in our HP lab on *nix as well | 16:56 |
| Daviey | sigmavirus24: No.. i mean.. the config IS present at an expected path on Linux using virtualenv. | 16:56 |
| tmcpeak | dstufft ahh ok | 16:57 |
| Daviey | tmcpeak: oh.. but it is in $virtualenv/etc/ | 16:57 |
| tmcpeak | Daviey: oh yeah, it must be | 16:57 |
| tmcpeak | dstufft: you know offhand what that call is? | 16:57 |
| dstufft | sysconfig.get_path("purelib") | 16:58 |
| tmcpeak | sysconfig.get_paths['platlib']? | 16:59 |
| dstufft | or platlib | 16:59 |
| tmcpeak | ok cool | 16:59 |
| dstufft | it's typically the same location | 16:59 |
| dstufft | purelib is where pure python files get installed, platlib for platform specific | 16:59 |
| tmcpeak | we'll want purelib, we don't have compiled anything | 16:59 |
| browne | AttributeError: 'module' object has no attribute 'get_paths' | 16:59 |
| dstufft | almost all situations they point to the same | 16:59 |
| tmcpeak | >>> sysconfig.get_paths()['purelib'] | 17:00 |
| tmcpeak | '/Users/travismcpeak/Desktop/temp/test/lib/python2.7/site-packages' | 17:00 |
| Daviey | hmm.. neither of those work for me on Ubuntu | 17:00 |
| Daviey | oh | 17:00 |
| *** tjt263 has joined #openstack-security | 17:01 | |
| Daviey | Yeah ()[] does work | 17:01 |
| tmcpeak | ok cool, so just wrap that in a try and we should be gtg | 17:01 |
| tmcpeak | browne: ^ | 17:02 |
| Daviey | bHmm | 17:03 |
| Daviey | But... that is dist-packages rather than site-packages | 17:03 |
| tmcpeak | Daviey: it is? | 17:04 |
| tmcpeak | site-pacakges on my end :\ | 17:04 |
| dstufft | Daviey: lol Debuntu | 17:04 |
| tmcpeak | haha | 17:04 |
| Daviey | >>> sysconfig.get_paths()['purelib'] | 17:04 |
| Daviey | '/home/dave/openstack/.venv/local/lib/python2.7/dist-packages' | 17:04 |
| Daviey | >>> sysconfig.get_paths()['platlib'] | 17:04 |
| Daviey | '/home/dave/openstack/.venv/local/lib/python2.7/dist-packages' | 17:04 |
| browne | on ubuntu in venv it should be path to site-packages | 17:04 |
| Daviey | Can i suggest using ['include']? | 17:04 |
| tmcpeak | include? | 17:05 |
| Daviey | >>> sysconfig.get_paths()['include'] + "/site-packages/bandit/config/bandit.yaml" | 17:05 |
| Daviey | '/home/dave/openstack/.venv/local/include/python2.7/site-packages/bandit/config/bandit.yaml' | 17:05 |
| tmcpeak | nah, wrong path - I need to get to test/lib/python2.7/site-packages | 17:05 |
| browne | >>> sysconfig.get_paths()['include'] | 17:05 |
| browne | '/home/ericwb/bandit/test_me/local/include/python2.7' | 17:05 |
| tmcpeak | that's the wrong path - we need to be in /lib/.. | 17:06 |
| Daviey | tmcpeak: where does sysconfig.get_paths()['include'] get you? | 17:06 |
| browne | its ok if its not right on ubuntu, its mac os we're after | 17:06 |
| Daviey | True! | 17:06 |
| tmcpeak | that's true.. Ubuntu is already doing the right thing with virtualenvs | 17:06 |
| tmcpeak | >>> sysconfig.get_paths()['include'] | 17:06 |
| tmcpeak | '/Users/travismcpeak/Desktop/temp/test/include/python2.7' | 17:06 |
| tmcpeak | ok cool, let's go with that | 17:07 |
| tmcpeak | if virtualenv? configs.append('virtualenv/etc', sysconfig.get_paths()['purelib'] | 17:07 |
| tmcpeak | with a try around that sysconfig.get_paths call | 17:07 |
| tmcpeak | I don't trust it o-O | 17:07 |
| tmcpeak | 0.13.3 is definitely going to have something to do with sysconfig.get_paths :P | 17:08 |
| Daviey | lol | 17:08 |
| Daviey | Actually, i am not sure Linux is DTRT with configs.. it is installed in the venv/etc/, but not sure it is read there | 17:08 |
| tmcpeak | Daviey: no it isn't this change will fix that | 17:11 |
| openstackgerrit | Eric Brown proposed openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 17:11 |
| tmcpeak | that's why my internal automation was busted - it's *nix and installing bandit config to virtualenv/etc/bandit.yaml but not actually reading from there | 17:11 |
| Daviey | tmcpeak: Well.. not sure it will? | 17:11 |
| tmcpeak | browne: I think you're missing a :"return False" at the end of that function | 17:12 |
| browne | unnecessary | 17:12 |
| Daviey | Ah, you added sys.prefix.. that'll do it | 17:12 |
| tmcpeak | implicit return? | 17:13 |
| browne | yeah, implicit | 17:13 |
| browne | explicit default returns remind me of java | 17:13 |
| tmcpeak | lol ok | 17:14 |
| browne | ok well review away. i need to shower and get my butt to work | 17:14 |
| tmcpeak | is the implicit return None or False? | 17:14 |
| tmcpeak | (not that it matters) | 17:14 |
| tmcpeak | browne: could you wrap the sysconfig.get_paths in a try and except a KeyError? | 17:15 |
| Daviey | the default return is None | 17:16 |
| tmcpeak | I don't trust sysconfig.get_paths enough on all platforms not to do something janky | 17:16 |
| Daviey | i kinda hoped appdirs would have handled all this for us.. :/ | 17:16 |
| *** 17SADBVNB has joined #openstack-security | 17:17 | |
| tmcpeak | Daviey yeah, it was a good concept | 17:17 |
| tmcpeak | Python and Linux kind of has a fragmentation problem it seems | 17:17 |
| Daviey | That is a quote i'd like to print on a t-shirt. | 17:19 |
| tmcpeak | lol | 17:19 |
| Daviey | tmcpeak: rather than a KeyError, why not use sysconfig.get_paths().get('purelib', None) ? | 17:21 |
| *** 17SADBVNB has quit IRC | 17:21 | |
| tmcpeak | Daviey: sure, either way | 17:22 |
| *** salv-orlando has joined #openstack-security | 17:22 | |
| tmcpeak | get is more robust | 17:22 |
| openstackgerrit | Eric Brown proposed openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 17:30 |
| tmcpeak | +2 | 17:31 |
| tmcpeak | sigmavirus24, Daviey - let's make it happen | 17:31 |
| browne | tmcpeak: i probably should at a test too | 17:32 |
| browne | s/at/add | 17:32 |
| Daviey | testing is overrated | 17:32 |
| browne | ha | 17:32 |
| tmcpeak | our testing sucks right now anyway | 17:32 |
| tmcpeak | you can hold off | 17:32 |
| Daviey | browne: Is it worth adding those paths to the unit tests or not? | 17:32 |
| tmcpeak | we'll sweep through soon | 17:32 |
| tmcpeak | yeah probably | 17:33 |
| tmcpeak | let's not break what bknduson has so nicely put together for us | 17:33 |
| browne | i feel gross when i don't do a unit test. but i could wait | 17:34 |
| tmcpeak | browne: if you wouldn't mind adding those paths to what bknudson already did | 17:35 |
| browne | ok | 17:35 |
| tmcpeak | thank you | 17:35 |
| Daviey | Oooo, i didn't realize bknudson cleaned up my crap | 17:36 |
| tmcpeak | :) | 17:36 |
| *** sdake has joined #openstack-security | 17:48 | |
| *** sdake_ has quit IRC | 17:49 | |
| *** sdake_ has joined #openstack-security | 17:50 | |
| *** singlethink has joined #openstack-security | 17:51 | |
| *** singlethink has quit IRC | 17:53 | |
| *** sdake has quit IRC | 17:53 | |
| *** singlet__ has quit IRC | 17:54 | |
| tmcpeak | browne: if you don't have time for the tests I'm happy to merge as is | 17:54 |
| browne | yeah, it'll take me more time. but i can make it right by tomorrow | 17:55 |
| tmcpeak | browne: ok, let's get what you have through | 17:55 |
| tmcpeak | browne: eek bug | 17:57 |
| tmcpeak | - /Users/travismcpeak/Desktop/temp/test/lib/python2.7/site-packages/bandit/config/bandit.yaml/bandit.yaml, | 17:57 |
| browne | ha, oops | 17:57 |
| *** singlethink has joined #openstack-security | 17:58 | |
| openstackgerrit | Eric Brown proposed openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 18:02 |
| tmcpeak | sigmavirus24: can you +A please? | 18:03 |
| sigmavirus24 | trusting that you tested that tmcpeak | 18:05 |
| tmcpeak | sigmavirus24: I did | 18:05 |
| *** browne has quit IRC | 18:05 | |
| tmcpeak | awesome | 18:06 |
| *** dwyde has quit IRC | 18:09 | |
| *** salv-orlando has quit IRC | 18:11 | |
| openstackgerrit | Merged openstack/bandit: Find bandit.yaml when in virtualenv https://review.openstack.org/212896 | 18:21 |
| tmcpeak | cool, 0.13.2 up - thanks guys | 18:23 |
| tmcpeak | hmm is Bandit badly broken for anybody | 18:31 |
| tmcpeak | nevermind, there was some strange lag but it seems ok | 18:32 |
| elmiko | tmcpeak: ticket/hotel booked =) | 18:33 |
| tmcpeak | elmiko: sweet! | 18:33 |
| elmiko | \o/ | 18:33 |
| tmcpeak | where you staying? | 18:33 |
| elmiko | the hilton around the corner, i get in monday afternoon | 18:33 |
| tmcpeak | nice! | 18:34 |
| *** browne has joined #openstack-security | 18:48 | |
| tmcpeak | thanks browne - new version pushed | 18:48 |
| browne | thx | 18:49 |
| *** dwyde has joined #openstack-security | 18:50 | |
| *** jian5397 has quit IRC | 18:52 | |
| *** jian5397 has joined #openstack-security | 18:52 | |
| *** jian5397 has quit IRC | 18:53 | |
| *** jian5397 has joined #openstack-security | 18:55 | |
| tmcpeak | elmiko, browne, Daviey: I'm getting a huge delay from when I start Bandit until it starts actually scanning | 18:55 |
| tmcpeak | anybody else see that? | 18:55 |
| tmcpeak | I'm at a loss to what it is | 18:55 |
| tmcpeak | it's not our new config thing | 18:55 |
| browne | maybe its sysconfig | 18:55 |
| browne | oh ok | 18:56 |
| tmcpeak | no because it's already stating the config it found | 18:56 |
| tmcpeak | it happens after it lists the total number of files but before it starts printing out the stats | 18:56 |
| tmcpeak | *status | 18:56 |
| elmiko | tmcpeak: i'll have to get a new copy and try it out | 18:57 |
| tmcpeak | elmiko: yeah, I'll be curious | 18:57 |
| tmcpeak | it's prob a 40 second delay for me :\ | 18:57 |
| tmcpeak | it's not *breaking* anything, but it sucks | 18:57 |
| *** browne has quit IRC | 18:57 | |
| *** browne has joined #openstack-security | 18:58 | |
| tmcpeak | also I meant sigmavirus24 not elmiko :) | 19:01 |
| tmcpeak | but I'd love to have you look too | 19:01 |
| tmcpeak | usual Bandit victimsw | 19:01 |
| elmiko | tmcpeak: no slowdown for me with a fresh bandit from pypi | 19:02 |
| tmcpeak | oh ok cool | 19:03 |
| tmcpeak | if it's just me I'm happy with that | 19:03 |
| elmiko | probably a mac thing ;P | 19:11 |
| tmcpeak | haha yeah | 19:14 |
| tmcpeak | I'll figure it out sometime that is not Friday afternoon | 19:14 |
| elmiko | +1 | 19:15 |
| elmiko | also, how do i control the color options in bandit? | 19:15 |
| elmiko | is that a log format thing | 19:15 |
| tmcpeak | elmiko: it's in the config | 19:15 |
| tmcpeak | towards the top | 19:15 |
| tmcpeak | but if you don't want it you can just "-f txt" | 19:16 |
| elmiko | ah, cool. thanks | 19:16 |
| elmiko | i recently switched to light background terminals and some things are just awful (ie yellow) | 19:17 |
| tmcpeak | haha I bet | 19:18 |
| * sigmavirus24 sighs | 19:20 | |
| tmcpeak | sigh which part sigma? | 19:21 |
| tmcpeak | sigh for light terminals? sigh for my localized performance issues? | 19:21 |
| tmcpeak | sigmavirus24: | 19:22 |
| sigmavirus24 | tmcpeak: sigh because it's now passé to blame things on OSX | 19:24 |
| tmcpeak | haha yeah | 19:24 |
| sigmavirus24 | "hur hur must be osx" | 19:25 |
| tmcpeak | +1 I agree with sigmavirus24 OSX - burn it! | 19:25 |
| elmiko | hey, i added a ;P to that comment... | 19:28 |
| sigmavirus24 | I know | 19:28 |
| sigmavirus24 | That just seems to be the replacement for "works on my machine" as of late | 19:28 |
| elmiko | and python support on OSX is not as good as on linux, but it is way worse than windows | 19:28 |
| elmiko | fair | 19:29 |
| sigmavirus24 | i disagree | 19:30 |
| sigmavirus24 | latest version of OSX has a more up-to-date version of Python 2 than most "stable" distros | 19:30 |
| sigmavirus24 | of linux that is | 19:30 |
| sigmavirus24 | because "stable" as far as I can tell always means "insecure" | 19:30 |
| elmiko | what version is on the latest? | 19:30 |
| elmiko | (but actually, i was referring more to installing packages which require compiled bits, that always seem to get out of sync on OSX) | 19:31 |
| *** salv-orlando has joined #openstack-security | 19:35 | |
| sigmavirus24 | 2.7.10 | 19:41 |
| sigmavirus24 | elmiko: I've never had problems with installing things like cryptography and such | 19:41 |
| elmiko | that's remarkably fresh | 19:41 |
| sigmavirus24 | elmiko: yes | 19:41 |
| sigmavirus24 | also has all the SSL module backports from 3.x branch to 2.7 | 19:42 |
| sigmavirus24 | and other excellent fixes for 2.7 | 19:42 |
| tmcpeak | oh that's cool | 19:42 |
| sigmavirus24 | 2.7.10 is the best 2.7 version | 19:42 |
| sigmavirus24 | tmcpeak: 10.10.5 has 2.7.10 | 19:42 |
| tmcpeak | yeah I use the brew version | 19:42 |
| tmcpeak | I should probably update | 19:42 |
| sigmavirus24 | which means requests can do fancy SNI on system python without needing extra crap | 19:42 |
| sigmavirus24 | tmcpeak: only if the CVE in 10.10.4 was fixed | 19:42 |
| sigmavirus24 | which would be in the release notes | 19:42 |
| tmcpeak | sigmavirus24: oh no, I mean update brew versions | 19:43 |
| tmcpeak | yep, 2.7.10_2 now | 19:43 |
| elmiko | the only OSX machine i have is still running 2.7.5 from apple | 19:43 |
| elmiko | and otoh, my f21 box is running 2.7.8, not sure what f22 ships with | 19:44 |
| sigmavirus24 | elmiko: what version of OSX? | 19:44 |
| elmiko | looks like 2.7.10 is default on f22, and i find fedora's security to be decent for a stable distro | 19:44 |
| elmiko | sigmavirus24: it's old, not sure the exact version number. i stopped using it regularly last year sometime | 19:44 |
| elmiko | but i ran into issues just yesterday trying to get a solid pecan app running in a venv on my mac | 19:45 |
| elmiko | and it all came down to weird version stuff with pbr, and mising components needing for compiling something | 19:45 |
| sigmavirus24 | elmiko: mostly when I think of "stable" distros I think debian and RHEL | 19:45 |
| elmiko | (which i've run into before) | 19:45 |
| elmiko | sigmavirus24: well, yeah, rhel is gonna be behind on the python front, but security-wise i think it does better than debian | 19:46 |
| sigmavirus24 | agreed | 19:47 |
| *** browne has quit IRC | 19:47 | |
| elmiko | i give apple props for shipping good standard versions of python, but it seems like i need to use brew, or even macports, if i want to get a fresh python on older mac stuff. | 19:47 |
| sigmavirus24 | debian mispatched requests-kerberos right prior to kilo and didn't want to hear a peep about it | 19:47 |
| sigmavirus24 | it was a CVE fix across two patches reported in the open | 19:47 |
| elmiko | ooph | 19:47 |
| sigmavirus24 | They only backported 1 | 19:47 |
| tmcpeak | allright guys, have a great weekend! | 19:48 |
| elmiko | you too tmcpeak ! | 19:48 |
| *** dwyde has quit IRC | 19:56 | |
| *** singleth_ has joined #openstack-security | 20:00 | |
| *** dwyde has joined #openstack-security | 20:01 | |
| *** singlethink has quit IRC | 20:03 | |
| *** alejandrito has quit IRC | 20:04 | |
| *** singleth_ has quit IRC | 20:04 | |
| *** yaya has joined #openstack-security | 20:05 | |
| *** yaya has quit IRC | 20:09 | |
| *** bknudson has quit IRC | 20:27 | |
| *** sdake has joined #openstack-security | 20:27 | |
| *** sdake_ has quit IRC | 20:31 | |
| *** browne has joined #openstack-security | 20:34 | |
| *** bpokorny has quit IRC | 20:49 | |
| *** bpokorny has joined #openstack-security | 20:50 | |
| elmiko | sigmavirus24: still around? | 21:11 |
| sigmavirus24 | sort of | 21:11 |
| sigmavirus24 | what's up? | 21:11 |
| elmiko | have you ever seen this come out of devstack/glance http://pastebin.test.redhat.com/305456 ? | 21:11 |
| sigmavirus24 | server not found | 21:12 |
| sigmavirus24 | guess I need to become a red hat employee to view that =P | 21:13 |
| elmiko | oops, sorry | 21:13 |
| elmiko | unless you're looking for a reference ;) lol | 21:13 |
| elmiko | http://paste.openstack.org/show/414855/ | 21:13 |
| sigmavirus24 | sounds familiar elmiko | 21:14 |
| sigmavirus24 | that said I've never seen it come out of osc | 21:14 |
| sigmavirus24 | it's usually a problem on larger images | 21:14 |
| elmiko | that's kinda what i thought too, but this is like the default image | 21:15 |
| sigmavirus24 | I know | 21:15 |
| sigmavirus24 | that truly is strange | 21:17 |
| sigmavirus24 | does glance have any logs about the error? | 21:17 |
| elmiko | ah well, thanks for taking a look | 21:17 |
| sigmavirus24 | it's typically to do with token expiration | 21:17 |
| elmiko | hmm | 21:17 |
| sigmavirus24 | that said, what's your backing store? RBD? | 21:17 |
| sigmavirus24 | elmiko: but something that tiny shouldn't take so long | 21:18 |
| elmiko | this is devstack, so it's just the loopback disk | 21:18 |
| sigmavirus24 | yeah | 21:18 |
| sigmavirus24 | that's really bizarre | 21:18 |
| sigmavirus24 | what version of devstack/glance? | 21:18 |
| elmiko | checking | 21:19 |
| elmiko | devstack and glance updated within the last hour, so master... | 21:20 |
| sigmavirus24 | anything in g-api? | 21:20 |
| elmiko | trying to get into the machine now | 21:20 |
| *** jerrygb has joined #openstack-security | 21:24 | |
| elmiko | sigmavirus24: still working around some issues here, please don't let me hold you up. i just thought you might have seen that before. | 21:24 |
| sigmavirus24 | not in a while | 21:26 |
| *** jerrygb has quit IRC | 21:30 | |
| *** jmckind has quit IRC | 21:32 | |
| *** sdake_ has joined #openstack-security | 21:35 | |
| *** bknudson has joined #openstack-security | 21:37 | |
| *** bpokorny_ has joined #openstack-security | 21:39 | |
| *** sdake has quit IRC | 21:39 | |
| *** dwyde has quit IRC | 21:40 | |
| *** bpokorny has quit IRC | 21:42 | |
| *** tmcpeak has quit IRC | 21:49 | |
| elmiko | have a good weekend sigmavirus24 | 21:50 |
| *** elo has joined #openstack-security | 21:57 | |
| sigmavirus24 | you too | 22:03 |
| *** jian5397 has quit IRC | 22:05 | |
| *** markvoelker has quit IRC | 22:15 | |
| *** salv-orlando has quit IRC | 22:25 | |
| *** salv-orlando has joined #openstack-security | 22:27 | |
| *** edmondsw has quit IRC | 22:51 | |
| *** voodookid has quit IRC | 22:58 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:20 | |
| *** markvoelker has joined #openstack-security | 23:31 | |
| *** kutija has quit IRC | 23:32 | |
| *** markvoelker has quit IRC | 23:35 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!