| *** zigo_ is now known as zigo | 14:07 | |
| gouthamr | https://bugs.launchpad.net/glance/+bug/2158998 is now public | 14:27 |
|---|---|---|
| gouthamr | https://bugs.launchpad.net/glance/+bug/2161330 is now public | 14:27 |
| gouthamr | https://bugs.launchpad.net/glance/+bug/2158999 is now public | 14:27 |
| gouthamr | https://bugs.launchpad.net/glance/+bug/2160020 is now public | 14:27 |
| frickler | thx gouthamr. is there already a draft for an advisory? or will it be multiple ones? | 14:33 |
| gouthamr | frickler: one advisory, working on it.. | 14:33 |
| gouthamr | (https://bugs.launchpad.net/glance/+bug/2160020 will get a ride on that advisory) | 14:34 |
| fungi | frickler: we typically switch the bugs to public immediately before fixes get pushed to gerrit, then incorporate the urls for those changes into the advisory data, so there's a 30-60 minute lag between those steps | 14:41 |
| frickler | usually (or at least sometimes?) there is a draft prepared in the bugs, which I couldn't find this time, so I was just wondering whether I missed it | 14:44 |
| fungi | some developers have in the past added a draft advisory in a private bug comment, the vmt process doesn't expect that, our standard is to include a draft impact description which covers the relevant details | 14:46 |
| JayF | The draft OSSA in the bug is a classic Jay move for prepping for go-live :) | 14:47 |
| JayF | I don't trust myself to keep it locally | 14:47 |
| fungi | i haven't looked at those bugs to see if there was an impact description reviewed in them | 14:47 |
| JayF | not a VMT process, just Jay making sure the internet has all the pieces when I run the day-of | 14:47 |
| fungi | yeah, particularly in cases where one vmt member writes the ossa patch in advance for another vmt member to push to gerrit, including an export of the commit with relevant placeholders as a bug attachment similar to other patches can help coordination. but really the important parts should be covered by the impact description anyway and the rest is fairly mechanical | 15:03 |
| JayF | it's as simple as "if I'm doing something important at 6/7am local time... I need to have done all the thinking beforehand" :D | 15:05 |
| fungi | makes sense. i usually just leave it as a local commit and then amend it the next morning once i have the remaining details, but i can understand not wanting to have to redo it in a pinch of something goes sideways with the machine you left it on | 15:07 |
| JayF | I think you manage the idea of roving workstations by using ssh to get around; I manage it by keeping as much of my state as possible in bugs/gerrit/etc (I swap pretty indiscriminately between using my desktop and my laptop) | 15:09 |
| fungi | that's true. i keep a tmux session going on my main workstation and then multi-attach portables to it with mosh+wireguard | 15:10 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-038 https://review.opendev.org/c/openstack/ossa/+/1003831 | 15:24 |
| gouthamr | https://review.opendev.org/q/hashtag:%22ossa-2026-038%22+(status:open%20OR%20status:merged) | 15:28 |
| gouthamr | woah, rosmaita | 15:28 |
| gouthamr | messed up the reporter->CVE attribution, fixing that | 15:35 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-038 https://review.opendev.org/c/openstack/ossa/+/1003831 | 15:35 |
| opendevreview | Goutham Pacha Ravi proposed openstack/ossa master: Add OSSA-2026-038 https://review.opendev.org/c/openstack/ossa/+/1003831 | 15:54 |
| gouthamr | JayF: rosmaita ^ clarified the patch ordering bit | 15:55 |
| rosmaita | OK, +W | 16:00 |
| gouthamr | ty! working on the emails | 16:02 |
| * gouthamr emails sent, self-approved on openstack-announce.. | 16:10 | |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-038 https://review.opendev.org/c/openstack/ossa/+/1003831 | 16:16 |
| gouthamr | gmaan: o/ looks like a stack of glance security bug fixes rely on this one: https://review.opendev.org/c/openstack/tempest/+/1003560 | 16:30 |
| gouthamr | sorry to seek urgent reviews, but, any chance you have some time, or maybe someone else we can bug? | 16:30 |
| gmaan | yeah, I am on it. ws tetsing the tests in glance gate as it run there only | 16:31 |
| gmaan | I think I got the result from one of the job and glance-s3-multistore which also run this test seems to be broken | 16:31 |
| gmaan | but I am good on that and will +w on tempest change | 16:31 |
| gouthamr | yeah, i was scratching my head which specific job etc, but abhishek seems to have identified the job run | 16:32 |
| gouthamr | tyty gmaan! | 16:32 |
| gmaan | two jobs run this test and one pasing and other failing but for other issue (means did not run test itself) | 16:32 |
| gouthamr | ack | 16:32 |
| gmaan | +w it, let's see how fast it merge. I will keep eyes on it | 16:33 |
| gouthamr | \o/ | 16:34 |
| fungi | thanks for the hard work on these! | 16:53 |
| gouthamr | ++ MITRE has been informed to publish these three CVEs.. will likely happen in the next ~24 hours | 17:01 |
| gouthamr | (version numbers were updated, and Sami Yessou was added as a co-finder for CVE-2026-71196) | 17:01 |
| gouthamr | fungi: wanted to pick your brain on: https://review.opendev.org/c/openstack/releases/+/1003379 | 17:05 |
| gouthamr | so far, i've been making patch bumps whenever I requested a security release.. it is a judgement thing, and i agree with elod that this deserved a minor version bump. | 17:05 |
| gouthamr | Tangentially, i was glad for his -1 because i overlooked the fact that a fix that was in 2025.1/2025.2 wasn't in 2026.1 | 17:05 |
| gouthamr | and gtema rectified that now | 17:05 |
| gouthamr | but, what's the right thing to do here? | 17:05 |
| gouthamr | the fix in question isn't backwards compatible by the letter. It introduces a config opt that has a secure default, but could break someone theoretically | 17:06 |
| gouthamr | on upgrade | 17:06 |
| gouthamr | (https://review.opendev.org/c/openstack/keystone/+/997369) | 17:06 |
| gouthamr | (this question belongs in #openstack-release perhaps, or #openstack-dev, or #openstack-keystone because of how cross-impacting it is.. but, this is a security release proposal, so seeding the discussion here. i'll take whatever takeaways bck to the patch) | 17:09 |
| fungi | gouthamr: i'm more of a linux-style "these are still just bugs" person, but i don't object to the interpretation that recognized security fixes deserve a minor instead of only patch-level bump (sort of a blend between classic semver and pridever approaches i guess) | 17:09 |
| JayF | It's worth noting that practicality has to play here too | 17:11 |
| gouthamr | i wasn't thinking of the CVE/OSSA/OSSN impact, but more about functionality itself. will i see a new feature on upgrade? will i break? | 17:11 |
| JayF | often we don't have room, reliably, to bump at the "right level" for stable branches | 17:11 |
| JayF | This is why Ironic, as policy, cuts a major version for bugfix branches, so we always have room for stable branch releases if something serious comes up | 17:12 |
| gouthamr | there's room with the minor version bump here.. | 17:12 |
| fungi | there are grey areas, as i pointed out in https://review.opendev.org/c/openstack/releases/+/1003611 | 17:12 |
| gouthamr | i see, so the OSSAs in question used a minor bump afaict | 17:14 |
| gouthamr | this one for instance: | 17:15 |
| gouthamr | https://security.openstack.org/ossa/OSSA-2026-008.html | 17:15 |
| gouthamr | says: Ironic: >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1 | 17:15 |
| gouthamr | and Ironic 32.0.1 doesn't exist, 32.1.0 does | 17:15 |
| JayF | that doesn't render that statement inaccurate. | 17:15 |
| JayF | 32.1.0 is greater than 32.0.1 and less then 33, so it's got the fix | 17:16 |
| JayF | There's no = on that clause implying that specific version exists | 17:16 |
| fungi | right, that's the approach we've operated on since the begining. the expression is correct, the expressed minimum/maximum versions aren't necessarily assumed to exist | 17:17 |
| gouthamr | i can live with that honestly, because that's how software is versioned/built/used :P but, will it satisfy the "security advisory mentioning missing versions" thingy that cardoe brought up? | 17:17 |
| JayF | I am not compelled to adjust our documented, decade+ long process, to adjust for a vibe coded github feature that didn't consider edge cases | 17:18 |
| gouthamr | oh crap | 17:18 |
| gouthamr | "By convention, the < version is the next possible patchlevel release following three-component SemVer rules, so if the current highest affected version on a given branch is 8.1.0 then the affected versions includes <8.1.1 even though the next actual version tagged might well be 8.2.0 or 9.0.0 (but since we don’t know what the next version will necessarily be at the time of publication, we choose the lowest possible version | 17:18 |
| gouthamr | it could be). This convention also makes it clear that prerelease versions may not be sufficient to address the vulnerability." | 17:18 |
| gouthamr | i should RTFM | 17:18 |
| fungi | i think that's based on invalid assumptions, we can try to better communicate the reality of our predictive versioning approach | 17:18 |
| * JayF puts that note under his "VMT videos" idea board | 17:19 | |
| fungi | basically we found a way to announce affected versions even when there is not yet a fixed version | 17:20 |
| gouthamr | ++ | 17:20 |
| JayF | if we tried to force just-in-time releases | 17:20 |
| JayF | I think I'd die from stress on day of fix | 17:20 |
| JayF | lol | 17:20 |
| gouthamr | i'm a cat i think, i've had 38 heart attacks this year :) | 17:21 |
| gouthamr | perfect, so i can stick to this and be consistent, and imo the minor version bump is better for the keystone releases.. | 17:21 |
| gouthamr | gtema: FYI , if you're around | 17:21 |
| cardoe | gouthamr: yes the version numbers work. | 17:22 |
| cardoe | I just reached out to the GitHub dad and confirmed. | 17:22 |
| gtema | gouthamr - small recap for me would be helpful | 17:23 |
| cardoe | renovate scanner, as happy as well | 17:23 |
| gtema | renovate is something that would make me happy as well | 17:23 |
| gouthamr | great! | 17:26 |
| gouthamr | ty cardoe | 17:26 |
| gouthamr | gtema: so elodilles asked why we weren't bumping the minor version for the keystone releases on https://review.opendev.org/c/openstack/releases/+/1003379; his interpretation is correct. There's a very subjective interpretation for this; and my earlier assumptions of wanting to stick with whatever we mentioned in the OSSA were fixed up by the above brainstorm | 17:27 |
| gtema | ack, however I can't hold this in my brain anymore ;-) | 17:28 |
| gouthamr | haha, +1 on the patch if you agree please; so i can find someone to merge today rather than wait the weekend | 17:29 |
| gtema | done | 17:30 |
| gouthamr | ty gtema | 17:32 |
| fungi | lgtm still | 17:38 |
| fungi | i might go ahead and single-rm-approve since it's getting late in europe and i may be the only one around at this point | 17:39 |
| gouthamr | wow | 17:40 |
| gouthamr | jinx :P | 17:40 |
| fungi | and, as you say, better to release today than wait for next week, since we avoid friday/weekend releases | 17:40 |
| gouthamr | ++ | 17:40 |
| *** mrunge_ is now known as mrunge | 23:16 | |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!