| *** teh_slack has quit IRC | 00:04 | |
| *** teh_slack has joined #openstack-security | 00:04 | |
| *** edmondsw has quit IRC | 00:08 | |
| *** Kennan has joined #openstack-security | 00:14 | |
| Kennan | hi :tmcpeak? | 00:14 |
|---|---|---|
| Kennan | there? | 00:14 |
| Kennan | or :nkinder there? | 00:15 |
| nkinder | Kennan: I'm here. What's up? | 00:15 |
| Kennan | I followed your https://wiki.openstack.org/wiki/Security/Projects/Bandit | 00:15 |
| Kennan | and download keystone code | 00:15 |
| Kennan | and issue command like this | 00:15 |
| Kennan | tox -e bandit | 00:16 |
| Kennan | but it exception as such mesg | 00:16 |
| Kennan | ValueError: ('Expected version spec in', 'bandit~=0.10.0', 'at', '~=0.10.0') | 00:16 |
| Kennan | :nkinder do you know what's wrong with keystone set with bandit ? | 00:16 |
| nkinder | Kennan: let me see if that occurs for me too | 00:16 |
| Kennan | keystone https://github.com/openstack/keystone/blob/master/tox.ini | 00:16 |
| Kennan | deps = bandit~=0.10.0 | 00:17 |
| Kennan | commands = bandit -c bandit.yaml -r keystone -n5 -p keystone_conservative | 00:17 |
| nkinder | Kennan: yeah, I get that too. It doesn't like that version dependency | 00:22 |
| nkinder | Kennan: I removed the "~=0.10.0" portion and pip installed bandit in a virtualenv, and it runs | 00:23 |
| Kennan | so you mean keystone set wrong with 0.10.0 that ? | 00:23 |
| nkinder | Kennan: I'm not sure yet | 00:24 |
| Kennan | OK. then you know, :nkinder I am working for magnum, and we thought keystone works with bandit, | 00:25 |
| Kennan | but seems keystone not work well with bandit | 00:26 |
| nkinder | It does, but I think the version specifier is messed up | 00:26 |
| dave-mccowan | Kennan, tmcpeak put new instructions up https://wiki.openstack.org/wiki/Security/Projects/Bandit#Gate_Testing_with_Bandit | 00:27 |
| nkinder | Kennan: what version of pip are you using? | 00:27 |
| dave-mccowan | Kennan, he now recommends a different method for specifying version | 00:27 |
| *** jamielennox|away is now known as jamielennox | 00:28 | |
| Kennan | :nkinder I tried that command tox -e bandit in ubuntu 14.04 system | 00:28 |
| Kennan | :dave-mccowan Let me check your link | 00:28 |
| nkinder | Kennan: Ok, but it seems like something isn't liking the ~= version specifier from PEP 440 (https://www.python.org/dev/peps/pep-0440/) | 00:29 |
| Kennan | OK. :nkinder I am not sure if keystone folks make wrong change or not | 00:29 |
| Kennan | :dave-mccowan use tox.ini to specify that bandit version | 00:30 |
| nkinder | Kennan: for example, try "pip install bandit~=0.10.0" | 00:30 |
| Kennan | keystone folks :dave-mccowan | 00:30 |
| *** salv-orlando has quit IRC | 00:31 | |
| Kennan | :nkinder so you mean pip version not match ? or pip not support such ~= as version | 00:31 |
| nkinder | Kennan: I think it doesn't find a "compatible version", which is what ~= means | 00:33 |
| nkinder | pip shows that 0.10.1 is in PyPi | 00:33 |
| nkinder | I'm guessing that whatever needs to be defined to list it as "compatible" was missed, which broke what Keystone is doing in tox.ini | 00:33 |
| nkinder | so this is a problem in bandit, not Keystone I think | 00:34 |
| tmcpeak | ok what's up? | 00:34 |
| tmcpeak | just getting caught up here | 00:34 |
| nkinder | tmcpeak: keystone uses bandit~=0.10.0 | 00:34 |
| nkinder | tmcpeak: that fails now | 00:34 |
| tmcpeak | it should use bandit==0.10.0 | 00:34 |
| tmcpeak | I don't know what ~= means | 00:34 |
| nkinder | compatible version (see PEP 440) | 00:34 |
| Kennan | but https://pypi.python.org/pypi?%3Aaction=search&term=bandit&submit=search is 0.10.1 | 00:34 |
| tmcpeak | bandit==0.10.0 is what will be in upstream (because of version pin) | 00:34 |
| tmcpeak | let's set that | 00:34 |
| Kennan | I think ~= means find 0.10.* like that ? or | 00:35 |
| Kennan | not sure | 00:35 |
| tmcpeak | yeah, so we want to keep updating Bandit, but don't want to break anybody's stuff | 00:35 |
| tmcpeak | so let's pin versoin | 00:35 |
| tmcpeak | bandit==0.10.0 should work as expected | 00:35 |
| Kennan | if we specify 0.10.0 could it find in https://pypi.python.org/pypi?%3Aaction=search&term=bandit&submit=search | 00:35 |
| Kennan | ? | 00:35 |
| Kennan | it seems bandit is 0.10.1 in pip | 00:35 |
| tmcpeak | both are in pip | 00:35 |
| tmcpeak | pip install bandit==0.10.0 should work fine | 00:36 |
| nkinder | Kennan: it's compatible version - https://www.python.org/dev/peps/pep-0440/#compatible-release | 00:36 |
| tmcpeak | nkinder: I'm surprised it would work before and not now | 00:37 |
| Kennan | :nkinder yes, just not sure why can not work with compatible version | 00:37 |
| tmcpeak | we have not pushed any new tagged bandit version | 00:37 |
| nkinder | and that's why I wonder if this is newer and the pip version matters | 00:37 |
| dstufft | ~= is new | 00:37 |
| dstufft | in pip 6 | 00:37 |
| dstufft | and setuptools 8 | 00:37 |
| nkinder | yeah, that's what I'm getting at | 00:37 |
| tmcpeak | well we're not implementing any method of defining compatible releases yet, so pip would have no way of knowing what that means | 00:38 |
| nkinder | I'm on F20 right now, which is a bit older | 00:38 |
| tmcpeak | dstufft: ah, is it? | 00:38 |
| Kennan | test@magnum-VirtualBox:~/keystone$ pip --version | 00:38 |
| Kennan | pip 6.0.6 from /usr/local/lib/python2.7/dist-packages (python 2.7) | 00:38 |
| nkinder | tmcpeak: no, it would | 00:38 |
| Kennan | my pip is 6.0.6 | 00:38 |
| Kennan | still not work | 00:38 |
| tmcpeak | if we release 0.10.2, how does it know whether that is "compatible" | 00:38 |
| dstufft | tmcpeak: if you do ~=0.10.2 it'l match anything in 0.10.* that is >= 0.10.2 | 00:39 |
| Kennan | I just not know why they not set it like >= or something else , but ~= | 00:39 |
| tmcpeak | Kennan: at any rate, please set bandit==0.10.0 in your project.. you'll get the expected behavior | 00:39 |
| tmcpeak | ahh ok | 00:39 |
| dstufft | if you do ~=0.10 it'll do anything in the 0.* series that is >= 0.10 | 00:39 |
| tmcpeak | so it will automatically take any new versions | 00:39 |
| tmcpeak | that's not the behavior we want for gates | 00:39 |
| tmcpeak | we want to stay at a known stable version, so bandit updates don't introduce unforseen consequences in everybody's gate | 00:40 |
| dstufft | the idea behind it is, for projects that use something semver-esque, you can define a range of acceptable versions based on that projects stable version policies | 00:40 |
| tmcpeak | dstufft: ah ok, makes sense | 00:40 |
| dstufft | yea, if you want pinning you want == | 00:40 |
| Kennan | OK. So guys, what's the proper way to do that ? why ~= not work now, I am confused | 00:41 |
| dstufft | Kennan: define not work | 00:41 |
| dstufft | what does it do | 00:41 |
| tmcpeak | Kennan: we want to pin to a specific version. I'm not sure why 0.10.1 is causing problems, but we have tested extensively for 0.10.0, so that's what we are trying to pin to | 00:41 |
| tmcpeak | pinning to a specific version means setting: bandit==0.10.0 | 00:41 |
| tmcpeak | I'd never seen that ~= thing before, but now with an understanding of what it does, I can say that is *not* the setting we want for gates right now | 00:42 |
| tmcpeak | bknudson: you around? | 00:42 |
| nkinder | Kennan: just set it to ==, or use >= if you want | 00:42 |
| nkinder | It's a single character tox.ini change | 00:42 |
| bknudson | tmcpeak: where would I go? | 00:42 |
| Kennan | OK. :tmcpeak, I would do that first ==, if anyone solved ~= issue, pls let me know | 00:42 |
| dstufft | tmcpeak: dec of 2014 is when pip released that had ~=, so it's real new | 00:43 |
| bknudson | everyone loves ~= | 00:43 |
| tmcpeak | bknudson: lols, ok. Kennan is saying bandit~=0.10.0 is causing problems.. from my understanding of the ~= behavior from dstufft, we want to set bandit==0.10.0 | 00:43 |
| tmcpeak | so we don't automatically pull new Bandit versions | 00:43 |
| tmcpeak | we want to be using the extensively tested version in the gates | 00:43 |
| bknudson | that's what the global-requirements change is proposing, == | 00:44 |
| bknudson | so use that. | 00:44 |
| tmcpeak | yep | 00:44 |
| bknudson | pip should support == | 00:44 |
| tmcpeak | bknudson: can you update the keystone example, Bandit is pointing people to that | 00:44 |
| tmcpeak | yeah, == is fine | 00:44 |
| bknudson | tmcpeak: update the example where? | 00:44 |
| Kennan | :bknudson | 00:45 |
| Kennan | https://github.com/openstack/keystone/blob/master/tox.ini | 00:45 |
| Kennan | I just execute tox -e bandit | 00:45 |
| Kennan | it failed with ~= | 00:45 |
| tmcpeak | oh… this is getting updated anyway, isn't it? | 00:45 |
| bknudson | y, the change is https://review.openstack.org/#/c/171772/ | 00:45 |
| tmcpeak | ahhh ok | 00:46 |
| tmcpeak | cool | 00:46 |
| tmcpeak | so this will be cleared up anyway once this patch goes through | 00:46 |
| bknudson | which uses bandit==0.10.0 | 00:46 |
| Kennan | ok. That sounds good | 00:46 |
| Kennan | :bknudson it would work for that | 00:46 |
| bknudson | dec 2014 is like a year ago in dog months. | 00:47 |
| tmcpeak | haha | 00:47 |
| tmcpeak | ok cool | 00:47 |
| tmcpeak | this seems sorted, thanks Kennan, dave-mccowan, nkinder, bknudson, dstufft | 00:47 |
| tmcpeak | Kennan: if you have any issues reach out to one of us, we'll get it figured out | 00:48 |
| Kennan | thanks :tmcpeak | 00:48 |
| Kennan | and all guys | 00:48 |
| bknudson | there's an 0.10.1 release? | 00:48 |
| bknudson | why aren't we proposing that for global-requirements? | 00:48 |
| tmcpeak | yeah, 0.10.0 didn't include a config file, which doesn't affect gates, but makes it a pain for people that want to pip install and run it | 00:49 |
| tmcpeak | bknudson: actually yeah, we probably should | 00:49 |
| browne | i can update https://review.openstack.org/#/c/167126/ to use 0.10.1 | 00:49 |
| tmcpeak | 0.10.1 should be the same | 00:49 |
| tmcpeak | browne: yeah, please do | 00:49 |
| browne | ok, will do | 00:50 |
| tmcpeak | 0.10.1 has all the same bandit goodness 0.10.0 had, plus better config file checking | 00:50 |
| tmcpeak | browne: awesome, thanks! | 00:50 |
| browne | done | 00:51 |
| tmcpeak | sweet! | 00:51 |
| Kennan | :tmcpeak do you suggest we use bandit in client check ? like glanceclient keystoneclient ? | 00:51 |
| browne | still has a -2 until liberty is open | 00:51 |
| tmcpeak | ok cool | 00:52 |
| tmcpeak | Kennan: I think that Bandit can be useful in most/all projects, as it will at least point out insecure coding practices, regardless of the impact | 00:52 |
| tmcpeak | allright, I'm off.. catch you all tomorrow :) | 00:53 |
| Kennan | ok. Thanks | 00:53 |
| *** bpokorny has quit IRC | 01:22 | |
| *** salv-orlando has joined #openstack-security | 01:31 | |
| *** salv-orlando has quit IRC | 01:37 | |
| *** browne has quit IRC | 02:12 | |
| *** sdake has joined #openstack-security | 02:26 | |
| *** browne has joined #openstack-security | 02:44 | |
| *** sdake_ has joined #openstack-security | 02:54 | |
| *** sdake has quit IRC | 02:57 | |
| *** markvoelker has quit IRC | 03:35 | |
| *** elmiko has quit IRC | 03:41 | |
| *** elmiko has joined #openstack-security | 03:42 | |
| *** salv-orlando has joined #openstack-security | 03:46 | |
| *** salv-orlando has quit IRC | 03:53 | |
| *** markvoelker has joined #openstack-security | 04:06 | |
| *** markvoelker has quit IRC | 04:12 | |
| *** sdake_ has quit IRC | 04:27 | |
| *** sdake has joined #openstack-security | 05:14 | |
| *** sdake has quit IRC | 05:14 | |
| *** sdake has joined #openstack-security | 05:14 | |
| *** sdake_ has joined #openstack-security | 05:25 | |
| *** sdake has quit IRC | 05:29 | |
| *** sdake_ has quit IRC | 05:55 | |
| *** dave-mccowan has quit IRC | 06:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/171472 | 06:00 |
| *** markvoelker has joined #openstack-security | 06:09 | |
| *** markvoelker has quit IRC | 06:14 | |
| *** markvoelker has joined #openstack-security | 07:10 | |
| openstackgerrit | Merged openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/171472 | 07:11 |
| *** markvoelker has quit IRC | 07:15 | |
| *** salv-orlando has joined #openstack-security | 07:20 | |
| *** jamielennox is now known as jamielennox|away | 07:20 | |
| *** teh_slack has quit IRC | 07:44 | |
| *** browne has quit IRC | 07:50 | |
| *** salv-orlando has quit IRC | 07:58 | |
| *** salv-orlando has joined #openstack-security | 08:03 | |
| *** markvoelker has joined #openstack-security | 08:11 | |
| *** salv-orlando has quit IRC | 08:11 | |
| *** salv-orlando has joined #openstack-security | 08:12 | |
| *** markvoelker has quit IRC | 08:16 | |
| *** salv-orlando has quit IRC | 08:37 | |
| *** slacker has joined #openstack-security | 08:44 | |
| *** slacker has quit IRC | 08:59 | |
| *** tmcpeak1 has joined #openstack-security | 09:03 | |
| *** tmcpeak has quit IRC | 09:05 | |
| *** slacker has joined #openstack-security | 09:11 | |
| *** markvoelker has joined #openstack-security | 09:12 | |
| *** markvoelker has quit IRC | 09:17 | |
| *** salv-orlando has joined #openstack-security | 09:38 | |
| *** salv-orlando has quit IRC | 09:42 | |
| *** salv-orlando has joined #openstack-security | 09:43 | |
| *** aswadr has joined #openstack-security | 09:54 | |
| *** Kennan2 has joined #openstack-security | 10:04 | |
| *** Kennan has quit IRC | 10:04 | |
| *** Kennan has joined #openstack-security | 10:08 | |
| *** Kennan2 has quit IRC | 10:08 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/172365 | 10:09 |
| *** markvoelker has joined #openstack-security | 10:13 | |
| *** markvoelker has quit IRC | 10:17 | |
| *** dave-mccowan has joined #openstack-security | 10:53 | |
| *** salv-orlando has quit IRC | 10:56 | |
| *** salv-orlando has joined #openstack-security | 11:10 | |
| *** markvoelker has joined #openstack-security | 11:13 | |
| *** markvoelker has quit IRC | 11:18 | |
| *** browne has joined #openstack-security | 11:52 | |
| *** markvoelker has joined #openstack-security | 12:11 | |
| *** sdake has joined #openstack-security | 12:31 | |
| *** sdake_ has joined #openstack-security | 12:32 | |
| *** bknudson has quit IRC | 12:33 | |
| *** sdake has quit IRC | 12:36 | |
| *** markvoelker has quit IRC | 12:43 | |
| *** markvoelker has joined #openstack-security | 12:44 | |
| *** sdake_ has quit IRC | 12:47 | |
| *** bknudson has joined #openstack-security | 12:56 | |
| *** browne has quit IRC | 13:07 | |
| *** browne has joined #openstack-security | 13:09 | |
| *** edmondsw has joined #openstack-security | 13:18 | |
| *** singlethink has joined #openstack-security | 13:26 | |
| *** Kennan2 has joined #openstack-security | 14:11 | |
| *** Kennan has quit IRC | 14:13 | |
| *** sicarie has joined #openstack-security | 14:13 | |
| *** Kennan has joined #openstack-security | 14:15 | |
| *** Kennan2 has quit IRC | 14:16 | |
| *** sdake_ has joined #openstack-security | 14:49 | |
| *** sdake has joined #openstack-security | 14:58 | |
| *** sdake_ has quit IRC | 15:02 | |
| *** voodookid has joined #openstack-security | 15:08 | |
| *** bpokorny has joined #openstack-security | 15:13 | |
| *** tmcpeak1 has quit IRC | 15:17 | |
| *** tmcpeak has joined #openstack-security | 15:17 | |
| *** tmcpeak has quit IRC | 15:18 | |
| *** tmcpeak has joined #openstack-security | 15:18 | |
| *** browne has quit IRC | 15:55 | |
| *** singlethink has quit IRC | 16:11 | |
| *** sdake_ has joined #openstack-security | 16:16 | |
| *** sdake has quit IRC | 16:20 | |
| *** bpokorny_ has joined #openstack-security | 16:35 | |
| *** bpokorny has quit IRC | 16:38 | |
| *** browne has joined #openstack-security | 16:42 | |
| *** singlethink has joined #openstack-security | 16:43 | |
| *** dave-mccowan has quit IRC | 18:18 | |
| *** dave-mccowan has joined #openstack-security | 18:42 | |
| *** elmiko has quit IRC | 20:25 | |
| *** elmiko has joined #openstack-security | 20:26 | |
| *** aswadr has quit IRC | 20:39 | |
| *** bpokorny has joined #openstack-security | 20:57 | |
| *** bpokorny_ has quit IRC | 20:59 | |
| openstackgerrit | Merged openstack/security-doc: Security Guide links invalid https://review.openstack.org/171922 | 21:03 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/172365 | 21:10 |
| *** bpokorny_ has joined #openstack-security | 21:29 | |
| *** bpokorny has quit IRC | 21:32 | |
| *** Guest95667 has joined #openstack-security | 22:02 | |
| *** bknudson has quit IRC | 22:09 | |
| *** Guest95667 has quit IRC | 22:13 | |
| *** markvoelker has quit IRC | 22:40 | |
| *** singlethink has quit IRC | 22:40 | |
| *** tmcpeak has quit IRC | 22:41 | |
| *** voodookid has quit IRC | 23:21 | |
| *** NightShades has joined #openstack-security | 23:23 | |
| NightShades | Hello everyone | 23:28 |
| *** edmondsw has quit IRC | 23:28 | |
| *** sicarie has left #openstack-security | 23:29 | |
| *** markvoelker has joined #openstack-security | 23:39 | |
| *** NightShades has left #openstack-security | 23:45 | |
| *** bpokorny_ has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!