| prometheanfire | tonyb: queens https://review.opendev.org/658699 | 00:19 |
|---|---|---|
| tonyb | prometheanfire: okay, that's a bit of a mess and will require some untangling | 00:25 |
| prometheanfire | ya | 00:26 |
| tonyb | Yeah that review looks just plain wrong. | 00:29 |
| tonyb | I wont aabandon it but I will start a new backport that look smore correct | 00:29 |
| prometheanfire | ok | 00:31 |
| prometheanfire | it's based on what was done for rocky | 00:31 |
| tonyb | yeah I'll try to untangle that too | 00:32 |
| tonyb | the problem with it ATM is it doesn't seem to include the networkx chnage and for unknown reasons switches the cap in sckkit-learn | 00:33 |
| tonyb | and that's why it's failing the integration gate | 00:33 |
| prometheanfire | right, but it did seem to work for rocky | 00:34 |
| tonyb | prometheanfire: no: rocky says "scikit-learn<=0.20.0;python_version<='3.4' # BSD" queens says "scikit-learn>=0.17.1<0.21;python_version<='3.4' # BSD" | 00:38 |
| tonyb | prometheanfire: so we get 0.21.0rc2 on queens which need py3 | 00:39 |
| * tonyb feels like that cap is wrong but it is what it is now | 00:40 | |
| tonyb | Ahh the networkx thing is differnt on queens which is why it's mising, so we need to explain that it's un-squashed | 00:41 |
| tonyb | #sheesh | 00:41 |
| openstackgerrit | Tony Breeds proposed openstack/requirements stable/queens: Cap keyring, scikit-learn, and sphinx on python2 https://review.opendev.org/658699 | 00:43 |
| prometheanfire | tonyb: ya, I noticed the cap and changed in in queens to be more acurate | 00:44 |
| prometheanfire | tonyb: it failed with the same error with your proposed patch, check pactchset 1 | 00:45 |
| tonyb | prometheanfire: Oh well I've applied stable rules and updated https://review.opendev.org/658699 | 00:45 |
| prometheanfire | tonyb: https://review.opendev.org/#/c/658699/1..3 only shows a commit message as the change | 00:46 |
| tonyb | prometheanfire: well that sucks | 00:47 |
| tonyb | So there's another bug in there somewhere | 00:47 |
| tonyb | I'll debug that later | 00:49 |
| *** altlogbot_2 has quit IRC | 00:50 | |
| prometheanfire | 2019-05-12 22:34:14.126155 | primary | + /opt/stack/new/requirements/tools/integration.sh:install_all_of_gr:L19: /tmp/tmp.md5caeTpsP/all_requirements/bin/pip install -r /opt/stack/new/requirements/global-requirements.txt | 00:51 |
| prometheanfire | combine with https://review.opendev.org/658692 maybe? | 00:52 |
| *** altlogbot_2 has joined #openstack-requirements | 00:56 | |
| tonyb | nope that's a bandaid to hide the bug | 00:59 |
| tonyb | prometheanfire: I don't understand how <=0.20.0 matches 0.21.0rc2 | 01:00 |
| prometheanfire | true | 01:01 |
| openstackgerrit | Merged openstack/requirements master: update constraint for os-service-types to new release 1.7.0 https://review.opendev.org/658661 | 01:08 |
| *** udesale has joined #openstack-requirements | 03:56 | |
| *** hongbin has quit IRC | 05:02 | |
| *** e0ne has joined #openstack-requirements | 05:16 | |
| *** udesale has quit IRC | 05:45 | |
| *** udesale has joined #openstack-requirements | 05:45 | |
| *** udesale has quit IRC | 05:49 | |
| *** udesale has joined #openstack-requirements | 05:49 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/requirements master: Updated from generate-constraints https://review.opendev.org/658636 | 06:15 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/queens: Cap keyring, scikit-learn, and sphinx on python2 https://review.opendev.org/658699 | 06:26 |
| *** e0ne has quit IRC | 06:29 | |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/pike: Cap keyring, scikit-learn, and sphinx on python2 https://review.opendev.org/658728 | 06:37 |
| *** udesale has quit IRC | 06:47 | |
| *** udesale has joined #openstack-requirements | 06:47 | |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/ocata: Avoid networkx 2.0 https://review.opendev.org/658735 | 06:49 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/queens: Add upper-constraints enforcement for local reqs https://review.opendev.org/658739 | 07:18 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/queens: Add upper-constraints enforcement for local reqs https://review.opendev.org/658739 | 07:19 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/stein: update constraint for python-ironicclient to new release 2.7.1 https://review.opendev.org/658100 | 07:20 |
| *** ccamacho has joined #openstack-requirements | 07:20 | |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/stein: update constraint for python-monascaclient to new release 1.15.0 https://review.opendev.org/658097 | 07:21 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/stein: update constraint for heat-translator to new release 1.3.1 https://review.opendev.org/658416 | 07:21 |
| *** hberaud has joined #openstack-requirements | 07:44 | |
| *** jpich has joined #openstack-requirements | 07:51 | |
| dirk | tonyb: there was a typo in the requirements line, see my new upload | 08:19 |
| dirk | tonyb: prometheanfire : tonyb: please review https://review.opendev.org/#/q/I2598503c2d4397d7efbb03a76df9a4e91dd0c1cf | 08:20 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/pike: Add upper-constraints enforcement for local reqs https://review.opendev.org/658747 | 08:21 |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/ocata: Add upper-constraints enforcement for local reqs https://review.opendev.org/658748 | 08:22 |
| *** e0ne has joined #openstack-requirements | 08:32 | |
| openstackgerrit | Merged openstack/requirements stable/stein: Add upper-constraints enforcement for local reqs https://review.opendev.org/658691 | 08:58 |
| openstackgerrit | Natal Ngétal proposed openstack/requirements master: Update constraint for bandit. https://review.opendev.org/658767 | 09:20 |
| *** hberaud is now known as hberaud|school-r | 09:51 | |
| *** hberaud|school-r is now known as hberaud|lunch | 10:06 | |
| *** hberaud|lunch is now known as hberaud | 10:52 | |
| *** udesale has quit IRC | 11:17 | |
| *** snapiri has quit IRC | 11:59 | |
| *** dirk has quit IRC | 12:58 | |
| *** dmellado_ has joined #openstack-requirements | 12:59 | |
| *** dmellado has quit IRC | 13:00 | |
| *** dmellado_ is now known as dmellado | 13:00 | |
| *** dirk has joined #openstack-requirements | 13:01 | |
| *** udesale has joined #openstack-requirements | 13:10 | |
| *** udesale has quit IRC | 13:18 | |
| *** udesale has joined #openstack-requirements | 13:18 | |
| *** efried has quit IRC | 13:19 | |
| *** efried has joined #openstack-requirements | 13:20 | |
| prometheanfire | dirk: /win 23 | 13:28 |
| prometheanfire | dirk: reviewed those that are passing | 13:29 |
| *** snapiri has joined #openstack-requirements | 13:47 | |
| openstackgerrit | Merged openstack/requirements stable/queens: Cap keyring, scikit-learn, and sphinx on python2 https://review.opendev.org/658699 | 14:16 |
| dirk | prometheanfire: thanks. I was somehow hoping that we could just get away with the constraints fixes | 14:17 |
| dirk | And you have too many windows ;-) | 14:17 |
| prometheanfire | dirk: 33 :P | 14:21 |
| *** hberaud is now known as hberaud|school-r | 14:26 | |
| *** hberaud|school-r is now known as hberaud | 14:40 | |
| *** snapiri has quit IRC | 14:44 | |
| dhellmann | so, what's the deal with the bandit situation? capping apparently doesn't work because it fails the requirements check. should bandit be in the blacklist with the other linters? | 14:46 |
| prometheanfire | that's a good point, I thought it was | 14:47 |
| dhellmann | oh, nevermind, that job actually failed because of some sphinx dependency issue | 14:47 |
| dhellmann | http://logs.openstack.org/74/658674/1/check/requirements-check/4555b07/ara-report/result/3cf3b05c-9723-439e-aade-2bcdbf0216ca/ | 14:47 |
| prometheanfire | I just emailed the list with the list of projects using -x | 14:47 |
| *** beekneemech is now known as bnemec | 15:00 | |
| openstackgerrit | Merged openstack/requirements stable/pike: Cap keyring, scikit-learn, and sphinx on python2 https://review.opendev.org/658728 | 15:26 |
| openstackgerrit | Merged openstack/requirements stable/rocky: Add upper-constraints enforcement for local reqs https://review.opendev.org/658692 | 15:26 |
| openstackgerrit | Sean McGinnis proposed openstack/requirements master: Set upper-constraint for scikit-learn https://review.opendev.org/658851 | 15:44 |
| openstackgerrit | Walter A. Boring IV (hemna) proposed openstack/requirements master: Add cinder extras python-3parclient library https://review.opendev.org/658098 | 16:11 |
| dirk | tonyb: prometheanfire : https://review.opendev.org/#/c/658739/ pretty please | 16:12 |
| dirk | prometheanfire: we're holding off the requests merge for tomorrow given the mailing list discussion, right? | 16:13 |
| prometheanfire | done | 16:13 |
| prometheanfire | and for the requests, ya, holding off for now | 16:14 |
| prometheanfire | til tomorrow morning, I think we need to update docs to state best effort and by request only for security updates | 16:19 |
| *** dtantsur is now known as dtantsur|afk | 16:23 | |
| dirk | I'm still struggling to build a relevant set of projects locally from queens branch to validate requests update | 16:28 |
| dirk | prometheanfire: I think the conclusion was.a bit more complex. One was to not ever do it, and one was to give deployers a way to override (which basically has no value id it isn't actually used to test patches as well imho) | 16:34 |
| prometheanfire | I think there's a middle ground but it just needs to be loudly called out imo | 16:34 |
| prometheanfire | fungi: we are talkinb about our favorite recent topic | 16:35 |
| *** e0ne has quit IRC | 16:42 | |
| *** jpich has quit IRC | 16:46 | |
| *** mriedem has joined #openstack-requirements | 16:53 | |
| mriedem | prometheanfire: on this requirements job failure https://review.opendev.org/#/c/658571/1/doc/requirements.txt do i actually need to add the python 2.7 entry in the doc/requirements.txt even though we don't run that job with py27? | 16:53 |
| mriedem | i see in novaclient's doc/requirements we don't have a python_version specified for sphinx https://github.com/openstack/python-novaclient/blob/master/doc/requirements.txt#L4 | 16:54 |
| *** hberaud is now known as hberaud|gone | 16:55 | |
| prometheanfire | mriedem: I'd say so, if only to make gate active, there's also downstreams who use doc builds (and could be py27) | 16:56 |
| *** udesale has quit IRC | 16:59 | |
| dirk | mriedem: it was just recently (a few hours ago merged), it will fail everywhere now | 17:05 |
| dirk | mriedem: we don't have a propose-updates bot anymore that would inform projects about the changed requirements though, so its all up to themselves for figuring out what to do | 17:05 |
| prometheanfire | the next couple of cyclkes are going to be fun | 17:08 |
| *** jroll has quit IRC | 17:34 | |
| *** jroll has joined #openstack-requirements | 17:35 | |
| openstackgerrit | Merged openstack/requirements stable/queens: Use the new opendev path for requirements-check https://review.opendev.org/658120 | 17:37 |
| openstackgerrit | Merged openstack/requirements stable/queens: Add upper-constraints enforcement for local reqs https://review.opendev.org/658739 | 17:45 |
| mriedem | ok thanks. might want to give people a heads up in the ML | 17:47 |
| fungi | prometheanfire: i see... on vacation and in and out of airports today but happy to follow up later | 17:57 |
| prometheanfire | fungi: ya | 17:57 |
| *** e0ne has joined #openstack-requirements | 18:17 | |
| fungi | part of why we agreed maintenance of stable branches could be extended is that we were now freezing the dependency tree for them | 18:21 |
| fungi | if we want to have a non-frozen external constraints list for stable branches, that seems like something which needs to be maintained independent of the frozen testable set | 18:22 |
| prometheanfire | I think that's a better suggestion, but it'd need it's own testing, publishing a unified list for those that want it would be good as well | 18:23 |
| prometheanfire | master_least-best-effort-security-constraints.txt | 18:24 |
| *** mriedem has left #openstack-requirements | 18:28 | |
| fungi | and yeah, i'm imagining the next major vulnerability for one of our external deps could require a much newer release of other transitive deps which require extensive code changes to one or more of our projects... what then? | 18:30 |
| fungi | just shrug? | 18:30 |
| fungi | distros solve this by forking projects they distribute and backporting security fixes. as a project we don't have that luxury | 18:31 |
| prometheanfire | well, if we have two lists and the CI around it (at least to do our cross testing) then it'd be 'good' | 18:31 |
| prometheanfire | I agree, we don't the 'best' solution we could do other than saying no is to have a diff'd list, that is combined then cross tested | 18:31 |
| fungi | i'm thinking more of what happens when we can't actually solve this for some significant vulnerability in an external dep and deployment projects need to punt anyway | 18:32 |
| fungi | better if they're prepared for that in advance as a matter of routine | 18:33 |
| prometheanfire | there's a reason I named it as I did | 18:33 |
| prometheanfire | and that's true | 18:33 |
| prometheanfire | master_least-best-effort-security-constraints.txt | 18:33 |
| fungi | we could just have a job which runs devstack on stable branches with master branch upper-constraints.txt and drop the job as soon as we hit an obvious incompatibility | 18:34 |
| prometheanfire | drop the job as in from all testing on that branch? | 18:34 |
| fungi | though maybe it would be a mash-up of stable constraints for deps we actually produce (oslo libs et al) | 18:34 |
| fungi | and external constraints from master | 18:35 |
| prometheanfire | problem set keeps getting bigger | 18:35 |
| prometheanfire | dirk: around? | 18:35 |
| prometheanfire | I feel like he's more the one lading this | 18:35 |
| fungi | yeah, basically assert that our "best effort" dependency security support ends when we can no longer run devstack with external constraints grafted in from master | 18:35 |
| prometheanfire | dirk: we should pause (not merge) the patch til we decide our policy of out of openstack security updates on stable branches | 18:37 |
| fungi | this is merely my opinion on the matter, just trying to bring vmt experience to bear | 18:38 |
| prometheanfire | ofc | 18:38 |
| prometheanfire | making an etherpad | 18:38 |
| fungi | anyway, about to board a longish flight and then will be in a car for hours, so probably the last i'll be able to weigh in for some time | 18:39 |
| prometheanfire | fungi: I'm populating https://etherpad.openstack.org/p/non-openstack-stable-security-constraints-updates | 18:39 |
| prometheanfire | fungi: so when you land... | 18:39 |
| prometheanfire | or whenever :D | 18:39 |
| fungi | land-and-then-drive-to-the-island-and-maybe-find-some-food-and-then-get-home | 18:40 |
| prometheanfire | :D | 18:40 |
| fungi | up, up and /away! | 18:40 |
| smcginnis | prometheanfire: mriedman's error from earlier looks odd. | 18:44 |
| smcginnis | prometheanfire: The original job failure was running with py3.6, but it failed to match: | 18:44 |
| smcginnis | http://logs.openstack.org/71/658571/1/check/requirements-check/6ecd8e4/job-output.txt.gz#_2019-05-11_23_13_07_270985 | 18:44 |
| smcginnis | Do we need to specify each individual python_version or something? u-c should have worked with the way that was set up. | 18:45 |
| dirk | This is not an error from pip, smcginnis | 18:46 |
| dirk | It's a special check for ensuring that requirements of projects don't diverge from the global requirements | 18:47 |
| dirk | I was also thinking that the check could be more intelligent | 18:47 |
| smcginnis | dirk: Oh, odd. | 18:47 |
| smcginnis | We should be hitting that pretty much everywhere now then. | 18:47 |
| dirk | Yes, all branches, all projects | 18:47 |
| smcginnis | Can we bring back the bot updates now? :) | 18:48 |
| dirk | And we'll get that on every stupid dependency that decides to drop py2.x support | 18:48 |
| smcginnis | This is going to hurt. | 18:48 |
| dirk | Well, dropping the bot updates was a feature | 18:48 |
| dirk | Because infra didn't like the fanout of global requirements changes | 18:49 |
| dirk | And projects wanted to manage their requirements on their own | 18:49 |
| dirk | I guess we could special treat py2 dependencies | 18:50 |
| dirk | Or we stop with py2 | 18:50 |
| dirk | But that's against the tc plan | 18:50 |
| smcginnis | One more release to go, then things should get a little better. | 18:51 |
| dirk | You mean the next swift release? ;-) | 18:54 |
| *** e0ne has quit IRC | 18:54 | |
| smcginnis | Heh, that too. :) | 18:54 |
| dirk | Py2.7 is pretty much broken already now | 18:55 |
| dirk | Anything using rootwrap with eventlet is broken with 2.7 | 18:55 |
| smcginnis | Oh, I hadn't seen issues there. | 18:56 |
| openstackgerrit | Merged openstack/requirements stable/rocky: update constraint for python-ironicclient to new release 2.5.2 https://review.opendev.org/658101 | 19:09 |
| openstackgerrit | Merged openstack/requirements stable/rocky: update constraint for python-cinderclient to new release 4.0.2 https://review.opendev.org/658413 | 19:48 |
| openstackgerrit | Merged openstack/requirements stable/rocky: update constraint for os-brick to new release 2.5.7 https://review.opendev.org/658099 | 19:48 |
| dirk | prometheanfire: now yes | 20:13 |
| dirk | prometheanfire: link to etherpad? | 20:13 |
| *** e0ne has joined #openstack-requirements | 20:14 | |
| openstackgerrit | Dirk Mueller proposed openstack/requirements stable/rocky: Add safety check output to the linters output https://review.opendev.org/657106 | 20:15 |
| prometheanfire | dirk: nothing in it yet | 20:17 |
| prometheanfire | dirk: https://etherpad.openstack.org/p/non-openstack-stable-security-constraints-updates | 20:17 |
| *** e0ne has quit IRC | 20:26 | |
| openstackgerrit | Merged openstack/requirements stable/pike: Add upper-constraints enforcement for local reqs https://review.opendev.org/658747 | 20:29 |
| *** openstackgerrit has quit IRC | 21:09 | |
| *** openstackgerrit has joined #openstack-requirements | 21:11 | |
| openstackgerrit | Merged openstack/requirements stable/stein: update constraint for python-ironicclient to new release 2.7.1 https://review.opendev.org/658100 | 21:11 |
| openstackgerrit | Merged openstack/requirements stable/rocky: update constraint for oslo.db to new release 4.40.2 https://review.opendev.org/657674 | 21:52 |
| openstackgerrit | Merged openstack/requirements stable/queens: update constraint for os-brick to new release 2.3.7 https://review.opendev.org/658113 | 22:09 |
| openstackgerrit | Merged openstack/requirements stable/queens: update constraint for python-manilaclient to new release 1.21.2 https://review.opendev.org/658109 | 22:09 |
| openstackgerrit | Merged openstack/requirements master: Add cinder extras python-3parclient library https://review.opendev.org/658098 | 22:16 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!