| *** bauzas_ is now known as bauzas | 00:24 | |
| *** mhen_ is now known as mhen | 01:46 | |
| *** bauzas_ is now known as bauzas | 03:02 | |
| *** bauzas_ is now known as bauzas | 11:33 | |
| pdeore | #startmeeting glance | 14:00 |
|---|---|---|
| opendevmeet | Meeting started Thu Aug 29 14:00:13 2024 UTC and is due to finish in 60 minutes. The chair is pdeore. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:00 |
| opendevmeet | The meeting name has been set to 'glance' | 14:00 |
| pdeore | #topic roll call | 14:00 |
| pdeore | #link https://etherpad.openstack.org/p/glance-team-meeting-agenda | 14:00 |
| pdeore | o/ | 14:00 |
| dansmith | o/ | 14:00 |
| mrjoshi | o/ | 14:00 |
| pdeore | lets wait few minutes for others to join | 14:01 |
| pdeore | abhishekk, will not be able to join today | 14:01 |
| croelandt | o/ | 14:03 |
| pdeore | I think we should get started | 14:03 |
| pdeore | #topic release/periodic jobs updates | 14:03 |
| pdeore | As everyone knows this is m3 week and I think we are good to tag m3 today since we have few important things already landed | 14:04 |
| pdeore | rest of the patches which we going to discuss in last topic, I think we can merge them before rc1 as well | 14:04 |
| dansmith | what's the story on the move to oslo patch? | 14:04 |
| dansmith | not really a feature, can that go after m3? | 14:04 |
| dansmith | not critical of course, but it'd be nice | 14:04 |
| dansmith | we need the tempest change to land first | 14:05 |
| pdeore | yeah we can have it before rc1 as well | 14:05 |
| dansmith | okay | 14:05 |
| pdeore | moving ahead | 14:06 |
| pdeore | glanceclient 4.7.0 and glance_store 4.8.1 are released | 14:07 |
| pdeore | periodic jobs are all green... | 14:07 |
| pdeore | moving to next | 14:07 |
| pdeore | #topic Image Encryption with LUKS (please discuss without Luzi & mhen - we have a conflicting meeting) | 14:07 |
| pdeore | #link https://review.opendev.org/q/topic:%22LUKS-image-encryption%22 | 14:07 |
| pdeore | we still need reviews on glance patches | 14:08 |
| dansmith | so, | 14:08 |
| pdeore | I have added few suggestions on parameter change patch but I request other cores to have a look at those patches | 14:08 |
| dansmith | I feel like we need to revisit a couple things about how we store these images | 14:08 |
| dansmith | in light of the giant CVE recently | 14:08 |
| dansmith | in that I think we need to have a specific disk_format for luks-encrypted images, | 14:09 |
| dansmith | so that we can inspect them with a known target format and reject things that are supposed to be encrypted but aren't (and v-v) | 14:09 |
| dansmith | that goes with my proposal to also basically stop using "raw" to mean "image of a PC-like disk or partition" | 14:10 |
| dansmith | (in my defender spec) | 14:10 |
| dansmith | so I feel like we probably need to discuss that with glance, cinder, and nova people together | 14:10 |
| dansmith | much of the complexity in the recent CVE came around the fact that we can never trust the disk_format in glance, and many of the side attack vectors came by putting one format in glance but calling it something else | 14:11 |
| pdeore | ohh ok, could you please add your comments on the patch ? | 14:12 |
| dansmith | well, I'm not sure which patch that really goes on | 14:12 |
| dansmith | maybe "standardization of encrypted images".. I guess I'll have a look at that | 14:12 |
| pdeore | #link https://review.opendev.org/c/openstack/glance/+/926295 | 14:13 |
| dansmith | ack, I will | 14:13 |
| pdeore | Thanks | 14:13 |
| dansmith | glad to see your "does this have test coverage" comments in there :D | 14:13 |
| pdeore | so there is no point in raising FFE for this | 14:14 |
| pdeore | :D I don't see that unit test coverage for few things there | 14:14 |
| pdeore | BTW, any idea till when a FFE can be raised? in m3 week only or anytime before rc1 week? | 14:15 |
| dansmith | I think that's technically your call, but it should get increasingly difficult the closer we get, | 14:16 |
| dansmith | and I always say "aim for zero" and only grant an FFE for truly exceptional cases | 14:16 |
| dansmith | i.e. things that are "all merged except one patch" etc | 14:17 |
| dansmith | the oslo thing should be low-risk, and could be the final step in the recent process if you look at it that way, | 14:17 |
| dansmith | but could also be seen as the first in a not-yet-started process, so it's your call :) | 14:17 |
| pdeore | yeah that's why i wanted to confirm the exact time to raise FFE, if it's ok to be raised anytime before rc1 then we can surely go ahead with that | 14:19 |
| pdeore | I will confirm with the release team after the meeting | 14:21 |
| pdeore | moving to next | 14:22 |
| pdeore | #Importatnt Reviews | 14:22 |
| pdeore | #link https://review.opendev.org/c/openstack/glance/+/927383 | 14:22 |
| pdeore | #link https://review.opendev.org/c/openstack/glance/+/927291 | 14:22 |
| pdeore | so kindly please have a look at these so that we can have them before rc1 :) | 14:23 |
| pdeore | that's it from me for today | 14:23 |
| dansmith | okay I commented on that LUKS patch | 14:23 |
| pdeore | ack, Thank you ! | 14:24 |
| pdeore | let's move to open discussions | 14:24 |
| pdeore | #topic Open Discussions | 14:24 |
| pdeore | anyone has anything else to highlight ? | 14:25 |
| pdeore | seems nothing, so let's wrap up then | 14:27 |
| pdeore | Thanks everyone for joining ! | 14:27 |
| pdeore | #endmeeting | 14:27 |
| opendevmeet | Meeting ended Thu Aug 29 14:27:38 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 14:27 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/glance/2024/glance.2024-08-29-14.00.html | 14:27 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/glance/2024/glance.2024-08-29-14.00.txt | 14:27 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/glance/2024/glance.2024-08-29-14.00.log.html | 14:27 |
| *** pdeore is now known as pdeore|afk | 14:39 | |
| *** bauzas_ is now known as bauzas | 14:56 | |
| *** bauzas_ is now known as bauzas | 20:34 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!