| zigo | Hi. I'm very much surprised that there was no security announce for this one: https://bugs.launchpad.net/keystone/+bug/2159643 | 09:56 |
|---|---|---|
| zigo | I missed it, therefore. | 09:56 |
| opendevreview | Merged openstack/ossa master: Update security liaison link to governance https://review.opendev.org/c/openstack/ossa/+/1000056 | 12:46 |
| fungi | zigo: i think there was some question about whether the team would accept backporting a behavior change that was tested, at the moment none of the backports have feedback from core reviewers | 13:51 |
| fungi | that bug isn't "done" it's just being worked on in public | 13:52 |
| zigo | fungi: It was reported to our bug bounty program, so I'm doing the work of backporting it. It's very though, as that part of Keystone has changed. Though since last week, I'm using opencode, and GLM-5 is great ! I have good hope it will be able to fix it for me (it's well over my skills, the patches are huge). | 14:15 |
| zigo | I'm also backporting fixes for lp- #2157347 and lp- #2158970 too. | 14:17 |
| zigo | What a year... :/ | 14:17 |
| fungi | zigo: please follow up on that bug report if you have suggestions for an alternative fix rather than the ones in the unmerged backports at https://review.opendev.org/q/I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33 | 14:17 |
| fungi | that needs changes to tempest and keystone-tempest-plugin since it's breaking a previously tested behavior | 14:18 |
| zigo | Yeah, I also backported these to tempest and its keystone plugin. | 14:19 |
| zigo | I'm not really sure I understand what behavior change though. | 14:19 |
| zigo | Do you know? | 14:20 |
| fungi | zigo: the credentials endpoint previously allowed `project_id` and `type` to be mutated by the caller in a patch request, in order to be able to delegate tokens to another project's scope | 14:27 |
| fungi | tempest tested that | 14:27 |
| fungi | the test was changed to now expect those fields to be immutable | 14:28 |
| zigo | Ok. | 14:28 |
| fungi | and the credential update test in keystone-tempest-plugin was similarly adjusted | 14:29 |
| zigo | Considering all of the issues with app credentials, I would have like it if we never enabled them early this year ... :/ | 14:29 |
| fungi | yeah, my understanding of the concern with the current fix for bug 2159643 is that it (intentionally) breaks credential delegation, which some users/environments may have been relying on | 14:30 |
| zigo | We had a case where a user was using app credentials for Heat. His stack was from early this year. This september, he complained that his stack wouldn't work anymore, and that he "never touched it". So we explained to him what happened, that we had to fix the security issue in production. And then he went to say that we should have tell him about the update. I honestly have no clue how to check if someone was using app credential for a heat | 14:32 |
| zigo | stack. | 14:32 |
| zigo | The same way, if some things change behavior, it'd be awesome if we (OpenStack users) could be told how to check if someone was using the old (now not working) behavior. | 14:32 |
| zigo | Not sure if that's even possible ... | 14:33 |
| JayF | zigo: a change which broke behavior in that way should've (I think it was?) been billboarded in an OSSN. | 14:35 |
| JayF | We don't always provide backports for fixes because they are breaking in this way. | 14:35 |
| JayF | that's basically the primary difference between an OSSA and an OSSN (do you need to expect a behavior change?) | 14:35 |
| zigo | Well, in some ways. What I just described was with the fixes for OSSA-2026-015. | 14:36 |
| zigo | It's my point of view that it's ok, and it's up to the customer to adapt, the ony issue is how to tell them. | 14:38 |
| zigo | If we were to send a big mail to everyone saying "app credentials in heat wont work anymore", I'm sure so many will get in touch and ask "am I using app credentials in heat? What's that?". And one doesn't want to have our support team flooded... :P | 14:39 |
| JayF | you've basically identified the core reason why VMT has a hard job lol | 14:57 |
| JayF | and why we take our time writing OSSNs about changes on the edges | 14:57 |
| fungi | https://bugs.launchpad.net/barbican/+bug/2168853 is now public | 15:22 |
| fungi | a change was pushed to gerrit referencing that ^ with full details, so i defaulted it to our public workflow | 15:22 |
| JayF | https://bugs.launchpad.net/ironic/+bug/2168428 is now public | 15:23 |
| JayF | fungi: gouthamr: ^ I used direct language with the reporter about the low quality of this bug report | 15:23 |
| *** mrunge_ is now known as mrunge | 23:51 | |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!