| opendevreview | Jay Faulkner proposed openstack/ossa master: Add OSSA-2026-008: Ironic IPMI Console injection https://review.opendev.org/c/openstack/ossa/+/986424 | 16:25 |
|---|---|---|
| JayF | gouthamr: rosmaita: fungi: ^ please review, this is for an unembargoed bug in Ironic where fixes and releases are already in progress | 16:34 |
| gouthamr | on it JayF | 16:34 |
| rosmaita | JayF: how big a hurry are you in? nit: extra whitespace at the end of line 8 | 16:39 |
| rosmaita | otherwise, LGTM ... how confident are you about the "affects" string? (I hate checking those) | 16:40 |
| JayF | I'm never confident about them, but I paired on this one with cid and so had to talk the logic out loud | 16:40 |
| JayF | hopefully that means I've done a good job :D | 16:40 |
| gouthamr | yeah you could just edit it in gerrit if you care, and another couple of typos | 16:41 |
| JayF | rare oppo to help show someone what happens for most security bugs in public since we didn't embargo this (non-default config in something that'd be highly unlikely to run in a multitenant cloud) | 16:41 |
| JayF | plenty of time to push an update :) | 16:41 |
| JayF | Only real reason I'm "rushing" is I fly to Dallas on Wednesday so I wanna have this buttoned up by then | 16:41 |
| rosmaita | checking the affected versions now, almost done | 16:45 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: Add OSSA-2026-008: Ironic IPMI Console injection https://review.opendev.org/c/openstack/ossa/+/986424 | 16:45 |
| JayF | that's for the typos | 16:45 |
| opendevreview | Jay Faulkner proposed openstack/ossa master: Add OSSA-2026-008: Ironic IPMI Console injection https://review.opendev.org/c/openstack/ossa/+/986424 | 16:50 |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-008: Ironic IPMI Console injection https://review.opendev.org/c/openstack/ossa/+/986424 | 16:58 |
| fungi | JayF: i've only got time to skim (we're on a 10-minute break between presentations), but overall it lgtm. i didn't test the urls to confirm they link to the right bits though | 17:16 |
| JayF | It's already announced and out :) | 17:17 |
| JayF | I thought you were not in this week? Or am I misremembering | 17:17 |
| JayF | (how long has it been since an OSSA was issued without you even reviewing it? Maybe worth a celly!) | 17:17 |
| mnasiadka | JayF: I don’t know if that’s only my Mail.app client - but the fonts in OSSA-2026-008 mail are nearly black :) | 17:40 |
| mnasiadka | In gmail web app the fonts are white | 17:41 |
| JayF | It's sent from a reasonably configured thunderbird | 17:43 |
| JayF | I'm unsure why it'd be appearing so strangely | 17:43 |
| JayF | (and that's the first report I've ever gotten of that behavior from my client) | 17:44 |
| JayF | please someone else chime in if it's something you're seeing so I can doulbe check my setup | 17:44 |
| JayF | gouthamr indicated in another channel he had the same issue :( | 17:58 |
| JayF | I'll look at my compose settings but won't re-spam the world | 17:58 |
| gouthamr | i need to pin this channel :| | 17:59 |
| gouthamr | yeah, encoding has html and the text was colored, probably revealing to the world that you're a dark mode guy :D | 18:00 |
| JayF | yeah, apparently thunderbird has some bad defaults surrounding this | 18:02 |
| JayF | according to an old reddit thread I have fixed it now 🤞 | 18:03 |
| gouthamr | ah, share reddit thread, i'm a thunderbird noob | 18:03 |
| JayF | that is lost to the sands of my history. I went settings -> composition -> uncheck "Use reader's default colors" | 18:05 |
| JayF | which on mine were set to black text black bg so clearly screwed up lol | 18:05 |
| gouthamr | black text black background sounds great for security | 18:06 |
| gouthamr | i've set the sending format to "Only Plain Text" too.. also went and tweaked this from the config editor interface: | 18:10 |
| gouthamr | mail.identity.default.compose_html = false | 18:10 |
| JayF | making it not default to html is an okay idea, assuming it's easy to toggle | 18:11 |
| JayF | I like the default of something like plain text for something I compose, match-formats for anythign I reply to | 18:11 |
| JayF | but I don't do that for a major reason: I learned a LOT of email clients do not display plain text if there's no html version alongside | 18:11 |
| JayF | it's jsut ... blank | 18:11 |
| JayF | at least that was true in the late 2000s when I worked in email more closely | 18:12 |
| gouthamr | security folks: theoretically if you had a bug where you had to fix a number of things, and the bugfixes were getting backported to all the older stable branches. would you prefer if we squashed all the changes? | 19:25 |
| gouthamr | it's could be seen as against the way we do single-purpose commits in OpenStack | 19:26 |
| gouthamr | single purpose commits help with easier review and possibly with reverting changes, isolating issues with git tooling | 19:27 |
| gouthamr | but, if you did a handful of changes as a patch train, backporting these to older stable branches could be painful to shephed - and, package maintainers/downstream consumers may find it hard.. because they'd be patching things together ideally to close a specific security vulnerability.. | 19:28 |
| gouthamr | what's a good tradeoff here? we've seldom done "massive" code backports.. but in theory, we could be making them | 19:29 |
| gouthamr | now as we discover and close age old security flaws | 19:30 |
| sean-k-mooney | well we have | 19:31 |
| sean-k-mooney | just not in a secuirty context | 19:31 |
| sean-k-mooney | well not initally | 19:32 |
| sean-k-mooney | the full backprot for the image inspection fixes includign all the patches to fix the reguresion with iso support | 19:32 |
| sean-k-mooney | was quite exstinsive | 19:32 |
| gouthamr | oh, do you have a link for that example, sean-k-mooney ? | 19:34 |
| JayF | Part of what made that complex is that it was incredibly cross-project, right? | 19:34 |
| JayF | Do we have any history of releasing a single-project security advisory with "N" patches for a given branch? | 19:34 |
| sean-k-mooney | JayF: no it was that the inital fix broke a buch of fucntioalty requring a addtion set of pacths to fix that sepreate form the inital cve fix | 19:35 |
| sean-k-mooney | https://bugs.launchpad.net/nova/+bug/2059809 had a buch of sqash patches | 19:36 |
| JayF | Honestly I was just thinking like, from a technical perspective, can you cat multiple .patch files from `git format-patch` together to create a multi-commit patch file? So you could deploy 1 file, N commits? | 19:36 |
| sean-k-mooney | but we meged the indivutal commtis https://review.opendev.org/c/openstack/nova/+/923255 | 19:37 |
| JayF | oh, interesting | 19:38 |
| JayF | that might have caused some pain for downstream rebases | 19:38 |
| sean-k-mooney | im double checkign that but i belive that is what we did | 19:38 |
| sean-k-mooney | well i was the one that did the backprot at redhat wht gibi help since dan was goign on pto for july 4th | 19:38 |
| JayF | downstream not meaning red hat in this case, fwiw :) | 19:39 |
| sean-k-mooney | so with my downstrema hat on any secuirty backports i have done internally ahve alwasy been on a per patch basis | 19:39 |
| sean-k-mooney | at least for nova i dont think iahve ever seen us merge a squash commit on master | 19:41 |
| sean-k-mooney | its possibel the entir commit history was discarded and it was presented as a single commit | 19:42 |
| JayF | That's sorta what my point was? | 19:42 |
| JayF | If we put a squash commit in the advisory | 19:42 |
| JayF | and a downstream applies it to their downstream git fork | 19:42 |
| JayF | they will then be somewhat perm. misaligned with a stable branch that got a non-squashed backport into git | 19:42 |
| sean-k-mooney | right so we normally dont squash in the sabel branch eihter | 19:43 |
| JayF | I guess we have those problems anyway from times when patches were revised after advisory before landing, idk | 19:43 |
| JayF | sean-k-mooney: yeah, what I'm saying is I think there's a way to make *fewer files for an advisory* while having those files contain *the correct number and shape of commits* | 19:43 |
| JayF | sean-k-mooney: I at no point would suggest we ever issue patches that are squashed into a single *commit* if we aren't shaping it that way in master/backports. | 19:44 |
| sean-k-mooney | right but not a squash correct jsut a set of commtis in one file | 19:44 |
| sean-k-mooney | ok so they are just concatinated togeter into one file represeting the history | 19:44 |
| JayF | that's my understanding | 19:44 |
| JayF | I'm 99% sure there's a way to shape them that way | 19:44 |
| JayF | and I think it's as simple as cat patch1 patch2 patch3 > multipatch | 19:45 |
| sean-k-mooney | ack | 19:45 |
| JayF | but I'm not 100% sure | 19:45 |
| sean-k-mooney | i belvie the vmt process doc has the comamnd somewhere | 19:45 |
| sean-k-mooney | do you know if its common for teams to follwo the otherwise normal "create a repoducer test" and then "fix it flow" | 19:46 |
| sean-k-mooney | i.e. for normla bug fixes in nova and some other project we like to see a repocuer patch first followed by an actual fix | 19:47 |
| sean-k-mooney | is suspect that is depriotiesed with security work to some degree | 19:47 |
| JayF | I don't think I've ever seen a project in OpenStack other than Nova enforce that rule. | 19:47 |
| JayF | Having a test in the same commit, yes. Having it separate to clearly demonstrate a bug is a part of nova process that is heavier than for most projects. | 19:48 |
| sean-k-mooney | ack it really does make it easier to review but i have not really seen it elsewhere either | 19:48 |
| sean-k-mooney | ya it make the actuall review process simpler but it frontload that by making you repodcue the issue up fornt rather then just the fix | 19:49 |
| sean-k-mooney | i or other cores often end up writing the repoducer for drive by contibotors or operators | 19:49 |
| fungi | JayF: no, i'm not really around this week, just checking in between meetings but you pinged me specifically (at 16:34) asking me to review it, so did my best | 20:02 |
| JayF | fungi: just force of habit :) also ignore the email to discuss-owner, I've cleared the queue | 20:04 |
| fungi | thanks! | 20:04 |
| gouthamr | JayF: we ultimately do email patch files (apart from including gerrit links in the advisory). so even if things merge as several separate gerrit changes, operators/packagers would rely on us having curated the patch files correctly.. this is our recommendation, then? | 20:08 |
| * gouthamr isn't aware of multi-commit patch documentation in the security bug process | 20:08 | |
| sean-k-mooney | if you use git format-patch on a brnach and give it a directiy it will output numbered patch fiels in the order they need to be applie | 20:09 |
| sean-k-mooney | and i belive git am | 20:09 |
| sean-k-mooney | can do the reverse | 20:09 |
| JayF | well also I think again | 20:09 |
| sean-k-mooney | to reconstuct the branch | 20:09 |
| JayF | you can cat 001* 002* 003* > all.patch | 20:09 |
| JayF | and git am will pop them in happily | 20:09 |
| sean-k-mooney | but lookign at the older bug ya i think you can etiehr do ^ or pass an extra flag to create the unifed file | 20:10 |
| JayF | gouthamr: yep, but we only email patch files in cases of embargoed bugs with coordinated disclosure. e.g. the recent Ironic OSSA, not-embargoed, at no point did we ever have to pass around .patch files | 20:10 |
| JayF | gouthamr: this is why the VMT generally encourages teams to strongly evaluate the cost:benefit of embaroing issues | 20:10 |
| gouthamr | true true | 20:10 |
| gouthamr | ack, makes sense | 20:11 |
| sean-k-mooney | oh that was a public security bug | 20:11 |
| sean-k-mooney | ithe ironic one that just shipped | 20:11 |
| sean-k-mooney | i have used both of those ironic ipmi console before in the past but i dont currently have an ironic isntall at home | 20:11 |
| sean-k-mooney | ipmi-shellinabox was cool while that was a mainted project | 20:12 |
| sean-k-mooney | ah https://security.openstack.org/#security-information-for-openstack-developers is what i was lookign for i was expecting it here https://security.openstack.org/vmt-process.html#patch-development | 20:15 |
| gouthamr | ah! yes | 20:16 |
| sean-k-mooney | we coudl improve that with a multi commit exampel | 20:17 |
| sean-k-mooney | ill see if i can find time to do that | 20:17 |
| gouthamr | https://bugs.launchpad.net/horizon/+bug/2150331 is now public | 22:07 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!