| tkajinam | release proposed https://review.opendev.org/c/openstack/releases/+/1009391 | 02:47 |
|---|---|---|
| tkajinam | JayF, honestly I've not been using it really by myself (and even the whole OpenStack these days) but I used to help maintaining projects shipped in RDO and supported by our puppet modules and they invited me to their core reviewers after they find having me there and letting me fixing their CI problem is useful :-P | 02:48 |
| tkajinam | in old days it was used in TripleO but I didn't used it in my whole experience with TripleO (it was eventually removed soon after I started using TripleO ) | 02:50 |
| opendevreview | Jeremy Stanley proposed openstack/ossa master: Add OSSA-2026-044 https://review.opendev.org/c/openstack/ossa/+/1009511 | 14:28 |
| fungi | amorin: rosmaita: ^ please check that for accuracy | 14:29 |
| fungi | i'd like to get it merged in the next few minutes if possible | 14:29 |
| amorin | checking | 14:29 |
| rosmaita | looking | 14:29 |
| amorin | looks good to me | 14:30 |
| rosmaita | fungi: +2 from me, want me to +W? | 14:34 |
| fungi | yes please | 14:34 |
| rosmaita | done | 14:34 |
| fungi | thanks to you both! i'm prepping the e-mail versions now | 14:34 |
| gouthamr | ++ | 14:38 |
| fungi | okay, i have e-mails staged to go out at the top of the hour. worried the check pipeline isn't going to get a node assignment any time soon so i enqueued it directly into the gate (`tox -e docs` runs clean locally at least so should succeed) | 14:46 |
| fungi | we've had some node request backlog according to https://grafana.opendev.org/d/21a6e53ea4/zuul-status?orgId=1&from=now-6h&to=now&timezone=utc but it looks like it's basically caught up now | 14:48 |
| gouthamr | okay with sending the email now fungi, we’ve done this in the past.. | 14:58 |
| fungi | yep, planning to here in about 90 seconds | 14:58 |
| fungi | the change should merge in a minute or two, then promote job, then afs vos release so we're looking at it probably being on the site at 15:10 utc | 15:00 |
| fungi | sending now | 15:00 |
| fungi | both copies have been sent | 15:01 |
| opendevreview | Merged openstack/ossa master: Add OSSA-2026-044 https://review.opendev.org/c/openstack/ossa/+/1009511 | 15:01 |
| fungi | i went ahead and accepted my own post through openstack-announce moderation | 15:04 |
| gouthamr | gah was slow, thanks | 15:04 |
| fungi | np | 15:05 |
| fungi | okay, zuul is overloaded from lots of reconfiguration events today so enqueuing took a while, but looks like it should show up on the site after the 15:25 pulse now | 15:23 |
| fungi | https://security.openstack.org/ossa/OSSA-2026-044.html is live now | 15:28 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: OSSN-0110: Ironic image server + basic auth https://review.opendev.org/c/openstack/security-doc/+/1009383 | 15:34 |
| JayF | found a minor thing to correct in wording, if someone could review and +A this as well at this point I'd appreciate it | 15:34 |
| fungi | looking | 15:38 |
| fungi | lgtm! | 15:46 |
| fungi | https://bugs.launchpad.net/nova/+bug/2169692 is now public | 16:07 |
| fungi | okay, based on discussion in opendev matrix, the zuul delays earlier were a combination of higher than usual workload along with some debug profiling that got left enabled in the scheduler, but that's been cleaned up in the last few minutes so things should start speeding back up a bit | 16:09 |
| fungi | has anybody been able to figure out how, in the new mitre form, to notify them of publication of a cve id that your account didn't request? | 16:32 |
| fungi | aha, it's a different form | 16:34 |
| fungi | the "rbp" (reserved but public) reporting form | 16:34 |
| fungi | okay, actually simpler than the old form was for that particular case, as long as you find the right form | 16:37 |
| JayF | fungi: I think https://zuul.opendev.org/t/openstack/status?change=1009383 may be stuck? The build for the publish log jobs keeps returning not-found | 17:05 |
| fungi | looking | 17:14 |
| gouthamr | would rebase/re-enqueue.. but fungi would know more from the zuul side. | 17:16 |
| fungi | JayF: it's in the gate now | 17:19 |
| JayF | was it broken or just slow? | 17:19 |
| fungi | is that what you were seeing? | 17:20 |
| JayF | I was seeing the first job as [success] and the second job as [spinner] | 17:20 |
| gouthamr | i was seeing a stuck job, "End of Stream" | 17:20 |
| gouthamr | (on the check queue) | 17:20 |
| JayF | which I cliked thru to the second job, I saw `build ID XXXX not found\n End of stream` -- more recently just `end of stream` with nothing else | 17:20 |
| JayF | I can probably resolve XXX if you need me to, from browser history | 17:20 |
| fungi | i think that's what you normally see if the job completes but the job completion event is still in zuul's results queue and hasn't been processed yet | 17:20 |
| JayF | makes sense. part of why I didn't wanna kick it is you all said there was a slowdown | 17:21 |
| JayF | thanks for looking at it so it started moving ;0 | 17:21 |
| fungi | looks like there's a pretty large event backlog in the check pipeline still: https://zuul.opendev.org/t/openstack/status/pipeline/check | 17:21 |
| fungi | (up at the top right of the screen) | 17:21 |
| fungi | 133 result events not yet processed | 17:22 |
| fungi | it's falling though | 17:22 |
| JayF | yeah, I mean that OSSN was posted more than 2 hours ago | 17:22 |
| fungi | the pipeline-specific event queue counts aren't displayed on the overview status screen, but if you drill down into a particular pipeline's status screen it shows them | 17:23 |
| opendevreview | Merged openstack/security-doc master: OSSN-0110: Ironic image server + basic auth https://review.opendev.org/c/openstack/security-doc/+/1009383 | 17:35 |
| gouthamr | rosmaita: zigo asked if the cinder team would like to use an OSSN for https://bugs.launchpad.net/cinder/+bug/2138566 | 21:51 |
| zigo | Yeah. It's a suggestion, as I almost missed it. | 21:52 |
| gouthamr | the fix wasn't backported upstream; my non-cinder review is that it can be safely backported | 21:52 |
| gouthamr | thanks for raising the concern, zigo! | 21:53 |
| zigo | I did backport it up to Zed ! :) | 21:53 |
| zigo | (like everything else...) | 21:53 |
| zigo | I also would like to bring attention to this patch of mine: https://review.opendev.org/c/openstack/cinder/+/1009608 | 21:54 |
| zigo | It's hardenning for CVE-2023-2088. | 21:54 |
| zigo | We missfortunately configured our multi-region (first region) without a [nova]/region_name in our cinder.conf, and we had it triggered, just as if the patch wasn't there. | 21:55 |
| zigo | Indeed, in such configuration, Nova returns a 404 instead of 409, and then Cinder hapilly deletes the attachment. | 21:56 |
| zigo | IMO, it's safer with my patch, so that, no mater what (ie: resource exists or not...), as long as it's a user doing the request, cinder just refuses the delete. | 21:57 |
| zigo | I don't think it deserves a CVE / OSSN or OSSA, since it was due to miss-configuration and that should never happen, but still... | 21:58 |
| gouthamr | ack, good hardening - rosmaita can probably look/help | 22:09 |
| rosmaita | zigo: maybe we should discuss at the ptg, it doesn't seem to make sense to have a create-attachment without delete-attachment, so that seems to be over-hardening | 22:18 |
| *** mrunge_ is now known as mrunge | 23:11 | |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!