| *** lexholden has quit IRC | 00:26 | |
| *** salv-orlando has joined #openstack-security | 00:45 | |
| *** salv-orl_ has joined #openstack-security | 00:49 | |
| *** salv-orlando has quit IRC | 00:50 | |
| *** salv-orl_ has quit IRC | 00:54 | |
| *** salv-orlando has joined #openstack-security | 01:53 | |
| *** sdake has joined #openstack-security | 01:55 | |
| *** salv-orl_ has joined #openstack-security | 02:01 | |
| *** salv-orlando has quit IRC | 02:03 | |
| *** salv-orl_ has quit IRC | 02:06 | |
| *** tjt263 has joined #openstack-security | 02:28 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Implement new API format https://review.openstack.org/190473 | 02:46 |
|---|---|---|
| *** markvoelker has joined #openstack-security | 02:58 | |
| *** markvoelker has quit IRC | 03:02 | |
| *** kcaj has quit IRC | 03:07 | |
| *** y_sawai has joined #openstack-security | 03:08 | |
| *** salv-orlando has joined #openstack-security | 03:08 | |
| *** salv-orlando has quit IRC | 03:12 | |
| *** salv-orlando has joined #openstack-security | 03:13 | |
| *** kcaj has joined #openstack-security | 03:14 | |
| openstackgerrit | Merged openstack/security-doc: Fix TODOs in identity https://review.openstack.org/205808 | 03:15 |
| *** salv-orlando has quit IRC | 03:17 | |
| *** y_sawai has quit IRC | 03:26 | |
| openstackgerrit | Merged openstack/security-doc: Setup translation for security-guide-rst https://review.openstack.org/205811 | 03:41 |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Return CA for a given instance https://review.openstack.org/198222 | 03:52 |
| *** zul has quit IRC | 03:52 | |
| *** zul has joined #openstack-security | 03:53 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/security-specs: Add Anchor spec for parsing backend change https://review.openstack.org/205328 | 04:04 |
| openstackgerrit | Merged openstack/security-doc: Security-guide-rst: Convert Block Storage chapter https://review.openstack.org/205807 | 04:08 |
| *** dave-mcc_ has quit IRC | 04:27 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/security-specs: Add Anchor spec for parsing backend change https://review.openstack.org/205328 | 04:29 |
| *** tmcpeak has quit IRC | 04:47 | |
| *** markvoelker has joined #openstack-security | 04:58 | |
| *** salv-orlando has joined #openstack-security | 05:01 | |
| *** browne has joined #openstack-security | 05:02 | |
| *** markvoelker has quit IRC | 05:03 | |
| *** salv-orl_ has joined #openstack-security | 05:03 | |
| *** salv-orlando has quit IRC | 05:05 | |
| *** salv-orl_ has quit IRC | 05:11 | |
| *** salv-orlando has joined #openstack-security | 05:12 | |
| *** salv-orlando has quit IRC | 05:16 | |
| *** salv-orlando has joined #openstack-security | 05:19 | |
| *** browne has quit IRC | 05:41 | |
| *** browne has joined #openstack-security | 05:41 | |
| *** tjt263 has quit IRC | 05:59 | |
| *** tjt263 has joined #openstack-security | 06:00 | |
| *** markvoelker has joined #openstack-security | 06:59 | |
| *** markvoelker has quit IRC | 07:04 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: First attempt at pyasn1/pycrypto integration https://review.openstack.org/204368 | 07:13 |
| *** salv-orlando has quit IRC | 07:39 | |
| *** salv-orlando has joined #openstack-security | 07:45 | |
| *** elo has joined #openstack-security | 08:12 | |
| *** elo1 has joined #openstack-security | 08:14 | |
| *** elo has quit IRC | 08:14 | |
| *** shohel has joined #openstack-security | 08:21 | |
| *** b10n1k has joined #openstack-security | 08:24 | |
| *** shohel has quit IRC | 08:32 | |
| *** browne has quit IRC | 08:36 | |
| Daviey | viraptor: hey, have you tried keystone auth for anchor recently? | 08:45 |
| *** lexholden has joined #openstack-security | 08:53 | |
| *** markvoelker has joined #openstack-security | 09:00 | |
| *** tkelsey has joined #openstack-security | 09:03 | |
| *** markvoelker has quit IRC | 09:05 | |
| *** rmarathu has joined #openstack-security | 09:21 | |
| rmarathu | hi , need some info on bandit . when running bandit -r <path> - lists all levels of severity issues | 09:22 |
| rmarathu | bandit -r <path> -ll ------> lists only medium severity issues | 09:24 |
| rmarathu | how can i list only medium and high severity issues excluding low severity issues | 09:24 |
| *** rmarathu has quit IRC | 09:48 | |
| *** shohel has joined #openstack-security | 09:50 | |
| tkelsey | rmarathu Hi, using -ll will list both medium and high issues | 10:07 |
| tkelsey | it lists issues that are medium or higher | 10:08 |
| Daviey | tkelsey: I think you missed him | 10:08 |
| tkelsey | Daviey: heh, well i tried :) | 10:12 |
| Daviey | tkelsey: Whilst i've got you.. Have you ever tried to use Anchor with Keystone Auth? | 10:13 |
| tkelsey | Daviey: nope :( only with shared secret | 10:14 |
| tkelsey | a few people have asked about that this week | 10:14 |
| Daviey | tkelsey: Yeah, it's terribly broken.. | 10:14 |
| Daviey | tkelsey: You were given a bad bug 1398474 , 200 isn't ever the return code. | 10:15 |
| openstack | bug 1398474 in Anchor "Authorization code should always be 200" [Medium,Fix released] https://launchpad.net/bugs/1398474 - Assigned to Tim Kelsey (tim-kelsey) | 10:15 |
| tkelsey | im not entirely surprised if no one is using it, I'll poke the guy who wrote it originally, though he is in Australia so wont be around for a while | 10:15 |
| Daviey | And the JSON (before that bug) is also wrong. Not sure anybody has tried it. | 10:15 |
| Daviey | tkelsey: Yeah, i poked him earlier | 10:16 |
| tkelsey | ah ok :) | 10:16 |
| Daviey | (no response) | 10:16 |
| *** salv-orlando has quit IRC | 10:24 | |
| *** alex_klimov has joined #openstack-security | 10:42 | |
| *** sdake has quit IRC | 10:42 | |
| *** sdake has joined #openstack-security | 10:46 | |
| *** rmarathu has joined #openstack-security | 10:51 | |
| Daviey | tkelsey: Is dg_ around today, do you know? | 10:54 |
| Daviey | rmarathu: You left just before tkelsey responded to you. | 10:54 |
| Daviey | < tkelsey> rmarathu Hi, using -ll will list both medium and high issues | 10:54 |
| Daviey | < tkelsey> it lists issues that are medium or higher | 10:54 |
| rmarathu | Daviey, sorry about that, i had to restart my machine... | 10:56 |
| tkelsey | thanks Daviey, hope that helps rmarathu | 10:56 |
| rmarathu | what is -l option for? when i run bandit iwth -l option i do not see any issues found...should it always run with any other options like -r | 10:58 |
| rmarathu | ? | 10:59 |
| *** elo1 has quit IRC | 11:00 | |
| *** markvoelker has joined #openstack-security | 11:01 | |
| rmarathu | i meant this option daviey, -l, --level results level filter? | 11:04 |
| rmarathu | no results when i just use this option | 11:04 |
| *** markvoelker has quit IRC | 11:05 | |
| tkelsey | rmarathu: -l is a level threshold. -l means level 1, that is show LOW, MEDIUM, HIGH stuff. It is also the default | 11:12 |
| tkelsey | -ll means MEDIUM and HIGH only, -lll means HIGH only | 11:13 |
| tkelsey | if you are scanning a folder you need to use -r, but that is not related to -l usage | 11:14 |
| rmarathu | would not that be good to specify how to denote level for each kind of issue in the help? | 11:14 |
| rmarathu | otherwise users would not be knowing how to specify the level unless we go thru the documentation | 11:14 |
| rmarathu | or examples | 11:15 |
| rmarathu | ? | 11:15 |
| tkelsey | rmarathu: seems like a good idea "results level filter" isnt telling you much. Please open a bug in Launchpad | 11:16 |
| rmarathu | tkelsey: sure, thank you. i will do that | 11:17 |
| rmarathu | one more question, to use bandit.yaml , we should have different configuration files for different components? | 11:18 |
| rmarathu | say for keystone we will have one and for nova we have different one kind of stuff? | 11:18 |
| rmarathu | and any documentation on how to integrate bandit into continous integration would help | 11:18 |
| rmarathu | please point me to correct link... | 11:19 |
| tkelsey | rmarathu: yes, it is best to have alternate configs for each project. For integration info see https://wiki.openstack.org/wiki/Security/Projects/Bandit#Gate_Testing_with_Bandit | 11:21 |
| tkelsey | #link https://wiki.openstack.org/wiki/Security/Projects/Bandit#Gate_Testing_with_Bandit | 11:21 |
| rmarathu | tkelsey: thank you :) and I will get back with more questions once i read thru it . thank you | 11:22 |
| tkelsey | rmarathu: sure, no problem :) | 11:22 |
| *** salv-orlando has joined #openstack-security | 11:26 | |
| *** salv-orlando has quit IRC | 11:30 | |
| *** marzif has joined #openstack-security | 11:31 | |
| *** salv-orlando has joined #openstack-security | 11:32 | |
| *** tjt263_ has joined #openstack-security | 11:41 | |
| *** tjt263 has quit IRC | 11:43 | |
| *** tjt263_ is now known as tjt263 | 11:44 | |
| *** salv-orlando has quit IRC | 11:58 | |
| *** tmcpeak has joined #openstack-security | 12:11 | |
| *** edmondsw has joined #openstack-security | 12:30 | |
| viraptor | Daviey: no, unfortunately not - thanks for the bug, I'll have a look at it soon | 12:46 |
| Daviey | viraptor: I think i have a fix | 12:46 |
| viraptor | well, tomorrow, it's bedtime now :) | 12:46 |
| *** bknudson has quit IRC | 12:46 | |
| viraptor | great! | 12:46 |
| Daviey | viraptor: I need to sort out the tests tho | 12:46 |
| Daviey | viraptor: nn! | 12:47 |
| viraptor | yeah, something mocking keystone auth at the requests level would be useful :) | 12:47 |
| *** singlethink has joined #openstack-security | 12:57 | |
| *** dave-mccowan has joined #openstack-security | 13:03 | |
| *** edmondsw has quit IRC | 13:08 | |
| *** bknudson has joined #openstack-security | 13:14 | |
| *** browne has joined #openstack-security | 13:19 | |
| *** browne has quit IRC | 13:28 | |
| *** singleth_ has joined #openstack-security | 13:30 | |
| *** singlethink has quit IRC | 13:33 | |
| *** markvoelker has joined #openstack-security | 13:34 | |
| *** jmckind has joined #openstack-security | 13:41 | |
| openstackgerrit | Tom Cocozzello proposed openstack/anchor: Activate pep8 check that _ is imported https://review.openstack.org/206076 | 13:55 |
| *** edmondsw has joined #openstack-security | 13:57 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| *** salv-orlando has joined #openstack-security | 14:21 | |
| *** voodookid has joined #openstack-security | 14:25 | |
| *** salv-orlando has quit IRC | 14:35 | |
| *** salv-orlando has joined #openstack-security | 14:44 | |
| *** sicarie__ has joined #openstack-security | 14:45 | |
| *** singlethink has joined #openstack-security | 14:56 | |
| *** singlet__ has joined #openstack-security | 14:58 | |
| *** jmckind has quit IRC | 15:00 | |
| *** singleth_ has quit IRC | 15:00 | |
| *** singlethink has quit IRC | 15:02 | |
| *** dwyde has joined #openstack-security | 15:05 | |
| *** salv-orlando has quit IRC | 15:16 | |
| *** browne has joined #openstack-security | 15:16 | |
| *** bpokorny has joined #openstack-security | 15:20 | |
| *** sdake has quit IRC | 15:23 | |
| *** alexandra1 has joined #openstack-security | 15:37 | |
| *** alexandra1 has left #openstack-security | 15:41 | |
| *** shohel has quit IRC | 16:02 | |
| *** lexholden has quit IRC | 16:12 | |
| *** alex_klimov has quit IRC | 16:13 | |
| Daviey | Anyone know if Doug is around today? | 16:13 |
| *** singlethink has joined #openstack-security | 16:14 | |
| *** jmckind has joined #openstack-security | 16:15 | |
| *** singlet__ has quit IRC | 16:17 | |
| *** bpb has joined #openstack-security | 16:18 | |
| tmcpeak | Daviey: yeah, he's here | 16:23 |
| Daviey | tmcpeak: He's not <here> though, is he? | 16:24 |
| *** salv-orlando has joined #openstack-security | 16:24 | |
| *** singleth_ has joined #openstack-security | 16:25 | |
| tmcpeak | here? no | 16:26 |
| tmcpeak | he's dg_ when he's around | 16:26 |
| *** salv-orl_ has joined #openstack-security | 16:26 | |
| * Daviey sends him a mail | 16:26 | |
| tmcpeak | that works | 16:27 |
| *** singlethink has quit IRC | 16:27 | |
| *** dg_ has joined #openstack-security | 16:27 | |
| dg_ | hey Daviey | 16:27 |
| Daviey | Oh hey dg_, was just about to send you a mail. | 16:28 |
| Daviey | dg_: On Friday, we said we'd talk about Keystone, Anchor and Devstack today? | 16:28 |
| dg_ | yeah | 16:28 |
| Daviey | dg_: Have a few mins? | 16:28 |
| dg_ | yeah sure | 16:28 |
| *** salv-orlando has quit IRC | 16:29 | |
| Daviey | dg_: Well Keystone Auth is pretty badly broken.. but I have a branch for that. | 16:29 |
| dg_ | on anchor? | 16:29 |
| Daviey | dg_: Can you try this? clone devstack ; cd devstack ; add this https://gist.github.com/Daviey/3fcfbf3b1aa75f221254 | 16:29 |
| Daviey | dg_: yeah | 16:29 |
| openstackgerrit | Dave Walker proposed openstack/anchor: Fix Keystone Auth and Tests https://review.openstack.org/206141 | 16:30 |
| Daviey | ^ That fixes Keystone Auth. | 16:30 |
| Daviey | dg_: I had a go at making a devstack plugin, and it seems to WFM - but perhaps not terribly graceful. | 16:30 |
| dg_ | yeh i was thinking the same thing myself, I've not got to the point of actually trying it yet, but I've gone through the code and spun up devstack - suprised anchor isnt using the python-openstack client | 16:31 |
| dg_ | oh awesome, I'll take a look :D | 16:31 |
| Daviey | dg_: The plugin is here - https://gist.github.com/Daviey/anchor/tree/devstack-plugin/devstack , but if you see the gist from above, you should just be able to declare it as is in ~/devstack/local.conf | 16:32 |
| Daviey | Does that make sense? | 16:32 |
| dg_ | yeh that makes sense | 16:33 |
| dg_ | I'll give that a try | 16:33 |
| dg_ | I see your anchor patch you suggest using the keystone middleware - is that the python library that the keystone docs recommends? | 16:34 |
| Daviey | yeah | 16:34 |
| Daviey | dg_: I think that'll be more intrusive tho.. so i wanted to fix the current implementation with least change | 16:35 |
| dg_ | yeh that makes sense | 16:35 |
| dg_ | although the current impplementation is horrible | 16:35 |
| Daviey | yeah | 16:36 |
| *** dave-mccowan has quit IRC | 16:42 | |
| *** lexholden has joined #openstack-security | 16:49 | |
| *** pdesai has joined #openstack-security | 16:56 | |
| dg_ | sec doc meeting? | 16:59 |
| elmiko | presumably | 16:59 |
| pdesai | Hi guys | 17:00 |
| elmiko | hi =) | 17:00 |
| elmiko | amazing effort last week! | 17:00 |
| sicarie__ | +1 | 17:01 |
| pdesai | yup, thanks all of you for all the hard work | 17:01 |
| pdesai | can i ask you something, when do you guys sleep? lol | 17:01 |
| elmiko | sleep? what's that... ;) | 17:01 |
| dg_ | totally overrated | 17:01 |
| elmiko | lol | 17:01 |
| pdesai | :) | 17:02 |
| pdesai | i was really amazed to see all the chapters and sections moving to MERGED | 17:02 |
| Daviey | \o | 17:02 |
| sicarie__ | So I apologize, I kept losing the etherpad link | 17:03 |
| elmiko | no worries | 17:03 |
| sicarie__ | However, there are no pending sections | 17:03 |
| sicarie__ | whcih is awesome | 17:03 |
| elmiko | \o/ | 17:03 |
| sicarie__ | Has anyone done a read-through? | 17:03 |
| Daviey | If it compiles, ship it. | 17:03 |
| sicarie__ | :D | 17:03 |
| elmiko | haha, i've only skimmed a few sections | 17:03 |
| dg_ | Daviey +1 | 17:04 |
| sicarie__ | So I’ll do a cover-to-cover today | 17:04 |
| elmiko | i figured that would be our next effort, the great read-through | 17:04 |
| dg_ | I skimmed the sections I was working on | 17:04 |
| sicarie__ | +1 elmiko | 17:04 |
| pdesai | i checked the list of figures which hasnt made it to sec-guide-rst | 17:04 |
| Daviey | Yeah, i think i can only say i skimmed it.. but I can't imagine it to differ to much from the docbook | 17:04 |
| sicarie__ | Does anyone have the etherpad? | 17:04 |
| pdesai | https://etherpad.openstack.org/p/sec-guide-rst | 17:04 |
| Daviey | I had reasonable coverage of the reviews and I looked at the rendered copies of each. | 17:04 |
| sicarie__ | Daviey: awesome, how did it look? | 17:05 |
| Daviey | sicarie__: mediocre. | 17:05 |
| elmiko | ooph.. | 17:05 |
| Daviey | :).. No, it was pretty good. | 17:05 |
| sicarie__ | :( | 17:05 |
| sicarie__ | haha | 17:05 |
| elmiko | lol | 17:05 |
| dg_ | lol | 17:05 |
| pdesai | :) | 17:05 |
| Daviey | dg_ rightly pointed out that navigation is worse than the docbook version | 17:05 |
| sicarie__ | yep | 17:05 |
| sicarie__ | I’m going to be pinging the docs team about that shortly | 17:06 |
| sicarie__ | We were tracking issues at the bottom, please make sure anything you found either has a change or entry in the etherpad | 17:06 |
| dg_ | ok | 17:06 |
| Daviey | I also noticed some of the images were a little overwhelming.. but on my resolution they are on docbook. Is that just me? | 17:06 |
| sicarie__ | Daviey: thats the type of stuff I’d like to cleanup - that and table formatting :) | 17:07 |
| pdesai | nope, most of them appear same on docbook | 17:07 |
| Daviey | yeah | 17:07 |
| elmiko | agreed, the images need some formatting | 17:07 |
| pdesai | yup +1 | 17:07 |
| sicarie__ | pdesai: many of the images would render in … interesting proportions when using alternate media | 17:07 |
| sicarie__ | (between pdf, html, etc…) | 17:07 |
| pdesai | yeah, PDF has better rendering | 17:08 |
| sicarie__ | yep | 17:08 |
| Daviey | I also noticed that we have differing use of :term: across the chapters.. but that is a general thing, rather than something related to the conversion process | 17:08 |
| sicarie__ | As long as we’re doing it, I think it makes sense to do it now | 17:08 |
| sicarie__ | Daviey: we also don’t have all the sections marked for linking, which I’d like to go back over too | 17:08 |
| sicarie__ | So yes, please make sure this stuff is tracked on the etherpad | 17:08 |
| sicarie__ | We’ll either fix it, or open a bug for it | 17:09 |
| Daviey | sicarie__: what do you mean? the anchors? | 17:09 |
| *** dave-mccowan has joined #openstack-security | 17:09 | |
| sicarie__ | Daviey: yep | 17:09 |
| elmiko | sicarie__: do we need to mark all the sections, i'd rather do this lazy style i.e. just label the sections that need it | 17:09 |
| Daviey | sicarie__: Surely we just want to add anchors if they are used somehwere? | 17:09 |
| Daviey | Ie, KISS. | 17:09 |
| elmiko | +1 | 17:09 |
| pdesai | agree +1, elmiko fixed lot of sections for linking to chapters which were assigned to other folks | 17:09 |
| sicarie__ | yeah, that makes sense, but I know, for example, I may have not been as careful with those as I should have | 17:10 |
| sicarie__ | and a few may be missing from my sections :( | 17:10 |
| Daviey | I think the lesson i learned, and related to the fixing of links.. is that landing stubs early makes so much sense. | 17:10 |
| dg_ | disappointed sicarie__ | 17:10 |
| sicarie__ | but agreed, that is something that would have a lower pirority | 17:10 |
| elmiko | Daviey: +1 | 17:11 |
| sicarie__ | I’d like to end the freeze as soon as possible, so I’ll ping Andreas on how to add navigation and give an initial rating to the issues, so we can declare what does need to be handled right away, and what can just have a bug opened | 17:11 |
| Daviey | When I reviewed, i did check there were *equal* amount of links.. but i didn't dig into the correct location | 17:11 |
| sicarie__ | Daviey: +1 | 17:11 |
| sicarie__ | I tried to do similar, but I may have not been as careful as I should have been | 17:12 |
| Daviey | yeah | 17:12 |
| pdesai | yup, i will grep for "?" on entire sec-guide-rst and check if we have any obvious missing links | 17:12 |
| sicarie__ | on a brief look, this looks awesome | 17:13 |
| sicarie__ | haha, thanks! | 17:13 |
| elmiko | so, should we make a chapter list in the pad and then make an effort to each take a chap or two this week? | 17:13 |
| elmiko | (for reading that is) | 17:13 |
| pdesai | +1 elmiko | 17:13 |
| Daviey | Did i see that translations are now re-enabled for it | 17:13 |
| Daviey | ? | 17:13 |
| sicarie__ | yes | 17:13 |
| sicarie__ | Andreas took care of that last night | 17:13 |
| elmiko | awesome | 17:13 |
| dg_ | translations? | 17:14 |
| Daviey | Hopefully we should see them come in soon.. | 17:14 |
| Daviey | https://review.openstack.org/#/c/205811/ | 17:14 |
| sicarie__ | dg_ mostly to Japanese, I think that had the most coverage | 17:15 |
| dg_ | sweet | 17:15 |
| sicarie__ | Looks like we don’t have any new bugs | 17:15 |
| Daviey | https://www.transifex.com/projects/p/openstack-manuals-i18n/ | 17:16 |
| sicarie__ | Does anyone have anything else they’d like to discuss? | 17:16 |
| sicarie__ | If not, I think the read-through and etherpad tracking will help this get wrapped up this week | 17:17 |
| Daviey | sicarie__: So freeze lifted as of this meeting? | 17:17 |
| elmiko | sicarie__: i'll add something about read through to the pad | 17:17 |
| Daviey | namespace switcheroo this week, or next? | 17:17 |
| sicarie__ | Daviey: I’d like to hold until we get the RST moved to main | 17:17 |
| sicarie__ | master | 17:17 |
| Daviey | Yeah, are we doing the switcheroo this week or next? | 17:17 |
| sicarie__ | I suppose people can just make changes to the RST (and not the doc) if they want | 17:18 |
| sicarie__ | Daviey: I was hoping to do it this week, but want to get the navigation set up | 17:18 |
| dg_ | +1 | 17:18 |
| sicarie__ | IMO that’s a rather large piece of it | 17:18 |
| sicarie__ | though if anyone disagrees and thinks we should just move over the RST I’d be interested in alternate reasoning | 17:18 |
| Daviey | I don't think it is significantly worse than it was | 17:19 |
| sicarie__ | Daviey: those are the comforting words I want to hear :) | 17:19 |
| Daviey | I'm not sure i see value in keeping freeze longer TBH | 17:19 |
| sicarie__ | Daviey: the purpose of the freeze would be to not require duplicate changes (in both RST and DocBook) | 17:19 |
| Daviey | If we wait for it to be perfect, it'll never ship | 17:20 |
| Daviey | Right | 17:20 |
| sicarie__ | otherwise, we need both at the same time so nothing gets out of sync | 17:20 |
| Daviey | I mean, in this context - freeze == RST to primary namespace | 17:20 |
| dg_ | I think navigation is quite a lot worse | 17:20 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/206157 | 17:20 |
| elmiko | i think it might be nice to get a quick scan through to make sure we haven't lost any content, then remove the freeze | 17:20 |
| sicarie__ | So if we get what we have determined is “high priority” in, then we move and open changes on the rest | 17:20 |
| dg_ | I see no issues with making patches to the RST, but i think we need to get navigation fixed before RST becomes the book | 17:20 |
| Daviey | dg_: Is it worse enough to frustrate users? | 17:20 |
| elmiko | dg_: +1 | 17:21 |
| dg_ | frustrated me, but I am super-grumpy | 17:21 |
| Daviey | Fair enough | 17:21 |
| sicarie__ | +1: someone in a rush and looking for a quick reference would click elsewhere | 17:21 |
| sicarie__ | IMO | 17:21 |
| *** dwyde has quit IRC | 17:21 | |
| Daviey | So deep freeze on deprecated docbook, but thaw on RST - but don't expect it to be published just yet. | 17:21 |
| dg_ | 'this isnt the section I wanted, wheres the index...back...back...back...' | 17:21 |
| dg_ | Daviey +1 | 17:22 |
| elmiko | i think that makes sense Daviey | 17:22 |
| sicarie__ | +1 Daviey: deep freeze lifted, but patches need DocBook & RST to keep them sync’d; we’ll switch as soon as we get priorities on our issues list and navigation set up | 17:22 |
| sicarie__ | all: ^ sound good? | 17:22 |
| Daviey | So for clarity, is it just better nav blocking namespace switcheroo? | 17:23 |
| Daviey | sicarie__: I'm not sure they need to be kept in sync do they? | 17:23 |
| elmiko | sicarie__: i guess, not thrilled about docbook needing more patches but hopefully it won't last long | 17:23 |
| sicarie__ | Daviey: I’d like to get the issues list prioritiezed - any “high” priorities should be discussed if it’s a blocker | 17:23 |
| Daviey | sicarie__: keeping degraded publication helps put the pressure on switching IMO. | 17:23 |
| sicarie__ | elmiko: +1 | 17:23 |
| sicarie__ | that’s why I’m going to be pinging the docs team today and trying to correlate the issues | 17:24 |
| dg_ | why does docbook need patches? | 17:24 |
| dg_ | just freeze it totally | 17:24 |
| Daviey | I think it is perfectly ok to tombstone docbook | 17:24 |
| sicarie__ | dg_: and all new patches go to RST? | 17:24 |
| Daviey | yeah | 17:24 |
| dg_ | sicarie__ yeah | 17:25 |
| elmiko | yea, i'm +1 for that plan (assuming doc folks agree) | 17:25 |
| pdesai | i was going to ask the same, as now we have an exercise of making sure we havent lost any content in docbook | 17:25 |
| sicarie__ | Does anyone have a critical change they’re working on right now (that’s going to land within the next day or two)? | 17:25 |
| dg_ | and lets try to get this issue knocked on the head with nav so we can swap over asap, hopefully there wont be too much divergence | 17:25 |
| sicarie__ | yes, I believe the docbook team does want them sync’d, but I’m not 100% on that | 17:25 |
| sicarie__ | dg_: +1 | 17:26 |
| Daviey | sicarie__: Just to check, when docbook is dead.. it is dead... right? | 17:26 |
| sicarie__ | pdesai: yep, and I’ll be doing a read-through today to make sure | 17:26 |
| sicarie__ | Daviey: yes, but I’m going to hold onto a few silver stakes just inc ase it comes back | 17:26 |
| * sicarie__ is ready to stab it through the heart | 17:26 | |
| dg_ | :) | 17:26 |
| elmiko | haha | 17:27 |
| Daviey | great | 17:27 |
| Daviey | sicarie__: Can i also prod you with https://review.openstack.org/#/c/200755/ ? | 17:27 |
| sicarie__ | Daviey: sure | 17:27 |
| Daviey | *prod* | 17:27 |
| sicarie__ | Ah, yes, so they didn’t respond to my request to keep it here, I’m going to re-ping and then i think they’re in a room here I’ll jump in to double-ping | 17:28 |
| sicarie__ | Thanks for the reminder Daviey | 17:28 |
| Daviey | sicarie__: why not update the pull request to point to here? | 17:28 |
| sicarie__ | Daviey: I will, there was pushback initially, but that’s the plan, re-push the request to point to the security room and ping around for approvals | 17:29 |
| Daviey | (then at least the tests will pass, and more likely to get reviewed) | 17:29 |
| sicarie__ | +1 | 17:29 |
| Daviey | cool. | 17:29 |
| Daviey | Shall we go home? | 17:29 |
| sicarie__ | +1 to that | 17:29 |
| sicarie__ | Thanks to everyone for the awesome work last week! | 17:29 |
| elmiko | thanks fearless leader =) | 17:30 |
| sicarie__ | Please expect the issues email from me sometime tomorrow, and I’ll be adding names to reviews if the navigation is an easy fix | 17:30 |
| pdesai | +10000 for last week's efforts everyone | 17:30 |
| sicarie__ | ^^ | 17:30 |
| sicarie__ | what pdesai said | 17:30 |
| sicarie__ | Thanks all! | 17:30 |
| dg_ | good work everyone, and same to the docteam | 17:30 |
| dg_ | +1 | 17:30 |
| pdesai | thanks guys | 17:31 |
| Daviey | thanks! | 17:31 |
| Daviey | ~~~~~~~~~~~~~~~~~~~~~~~~ | 17:34 |
| elmiko | lol | 17:35 |
| dg_ | Daviey looks like that devstack anchor patch works, pulled it in and got anchor set up | 17:35 |
| dg_ | I havent tested it yet thou | 17:35 |
| *** tkelsey has quit IRC | 17:35 | |
| Daviey | dg_: Sweet. It won't work unless you apply the inflight patch tho | 17:36 |
| dg_ | yeah sure | 17:36 |
| Daviey | but having a reproducible platform does become interesting for better gate testing | 17:36 |
| dg_ | yeah i'll talk to tkelsey about it tomorrow, its an interesting apporach | 17:37 |
| dg_ | also makes it a lot easier to setup for our users | 17:37 |
| Daviey | Something is weird tho... tox ; echo $? ; tox ; echo $? .. will consistently give 0 1 | 17:37 |
| Daviey | tox ; echo $? ; rm -rf .tox ; tox ; echo $? .. will consistently give 1 1 | 17:38 |
| dg_ | hmm that sounds like a bug | 17:38 |
| Daviey | It must be leaving something on the filesystem, but i haven't worked it out. | 17:39 |
| Daviey | The old test was really bad, as it was throwing crappy mock data in and expecting broken behaviour... So the issue might have been there already. | 17:40 |
| dg_ | yeh i dont think we have ever tested that | 17:41 |
| dg_ | with hindsight, that was dumb | 17:42 |
| *** dwyde has joined #openstack-security | 17:44 | |
| Daviey | Anyway, going home. o/ | 17:45 |
| dg_ | oki, catcha later mate | 17:45 |
| dg_ | are you coming to the midcycle? | 17:45 |
| *** dg_ has quit IRC | 17:49 | |
| *** sdake has joined #openstack-security | 17:57 | |
| *** tkelsey has joined #openstack-security | 18:03 | |
| *** tkelsey has quit IRC | 18:08 | |
| *** sdake has quit IRC | 18:09 | |
| *** sdake has joined #openstack-security | 18:10 | |
| *** salv-orl_ has quit IRC | 18:14 | |
| *** elo has joined #openstack-security | 18:20 | |
| *** sdake has quit IRC | 18:23 | |
| openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/206157 | 18:24 |
| *** elo has quit IRC | 18:25 | |
| *** elo has joined #openstack-security | 18:31 | |
| *** jmckind has quit IRC | 19:02 | |
| *** salv-orlando has joined #openstack-security | 19:11 | |
| *** pdesai has quit IRC | 19:12 | |
| *** b10n1k has quit IRC | 19:20 | |
| *** elo has quit IRC | 19:52 | |
| *** jmckind has joined #openstack-security | 19:54 | |
| *** elo has joined #openstack-security | 19:56 | |
| *** jhfeng has joined #openstack-security | 19:57 | |
| *** singlethink has joined #openstack-security | 19:59 | |
| *** singleth_ has quit IRC | 20:02 | |
| *** tkelsey has joined #openstack-security | 20:04 | |
| *** tkelsey has quit IRC | 20:09 | |
| *** bpokorny has quit IRC | 20:32 | |
| *** bpokorny has joined #openstack-security | 20:32 | |
| *** bpokorny has quit IRC | 20:33 | |
| *** bpokorny has joined #openstack-security | 20:34 | |
| openstackgerrit | william snow proposed openstack/security-doc: Corrected security group documentation https://review.openstack.org/202801 | 20:40 |
| *** elo1 has joined #openstack-security | 20:57 | |
| *** sdake has joined #openstack-security | 20:58 | |
| *** elo has quit IRC | 21:01 | |
| *** b10n1k has joined #openstack-security | 21:26 | |
| *** Windir has quit IRC | 21:26 | |
| *** bpokorny has quit IRC | 21:27 | |
| *** Windir has joined #openstack-security | 21:33 | |
| *** jmckind has quit IRC | 21:36 | |
| *** bpokorny has joined #openstack-security | 21:39 | |
| *** salv-orlando has quit IRC | 21:39 | |
| *** bpokorny has quit IRC | 21:42 | |
| *** bpokorny has joined #openstack-security | 21:43 | |
| *** bpb has quit IRC | 21:53 | |
| *** singleth_ has joined #openstack-security | 21:54 | |
| *** singlethink has quit IRC | 21:58 | |
| *** bpokorny has quit IRC | 21:59 | |
| *** bpokorny has joined #openstack-security | 21:59 | |
| *** salv-orlando has joined #openstack-security | 22:09 | |
| *** singlethink has joined #openstack-security | 22:12 | |
| *** elo has joined #openstack-security | 22:14 | |
| *** edmondsw has quit IRC | 22:14 | |
| *** singleth_ has quit IRC | 22:16 | |
| *** singlethink has quit IRC | 22:16 | |
| *** elo1 has quit IRC | 22:17 | |
| *** dwyde has quit IRC | 22:24 | |
| *** b10n1k has quit IRC | 22:32 | |
| *** bpokorny_ has joined #openstack-security | 22:34 | |
| openstackgerrit | Merged openstack/anchor: Activate pep8 check that _ is imported https://review.openstack.org/206076 | 22:36 |
| *** bpokorny has quit IRC | 22:38 | |
| Daviey | viraptor: here? | 22:47 |
| viraptor | yup | 22:47 |
| Daviey | viraptor: Thanks for helping work out the test stuff.. I'm also looking at it right now.. but currently really confused | 22:48 |
| *** sdake has quit IRC | 22:48 | |
| Daviey | viraptor: tox -epy27 ; echo $? ; tox -epy27 ; echo $?0 # == 0 1 | 22:49 |
| Daviey | viraptor: tox -epy27 ; echo $? ; rm -rf .tox ; tox -epy27 ; echo $?0 # == 0 0 | 22:49 |
| viraptor | I think it's some webob/pecan version mismatch which gets some weird exception rather than httpclienterror (sys.stderr.write() debugging ahead) | 22:49 |
| Daviey | But i've also noticed it seems racey, such that it sometimes does work.. if i run it through strace for example/ | 22:50 |
| Daviey | True, yeah - i've seen that... but odd that it seems to be semi-determinisitc | 22:51 |
| viraptor | Daviey: while you're here, could you tell me what would we gain with signing backends implemented via stevedore? Just trying to figure out what are the benefits over importlib in case of a single function import | 22:52 |
| sigmavirus24 | Daviey: fwiw, tox -re py27 will recreate the virtualenv in question | 22:52 |
| sigmavirus24 | no need to separately do `rm -rf .tox/` | 22:53 |
| Daviey | sigmavirus24: oh neat.. didn't know that... but i was more trying to show shorthand an observed oddity. | 22:53 |
| sigmavirus24 | I got that | 22:53 |
| sigmavirus24 | Just thought I'd drop that in here in the event it was helpful :D | 22:53 |
| viraptor | Daviey: I understand how it may be useful for a number of hooks, proper registration, etc. but in a simple case it looks like an overkill to me - maybe I'm missing something though | 22:54 |
| Daviey | sigmavirus24: I'll try and remmeber it.. but i am not going to lie, i'm almost certain my fingers will type rm before i remember. | 22:54 |
| *** bknudson has quit IRC | 22:54 | |
| sigmavirus24 | Daviey: muscle memory is the worst =P | 22:54 |
| sigmavirus24 | rm -rf muscle_memory/ | 22:55 |
| Daviey | viraptor: Hmm. Good question.. I think it is useful to allow external plugins.. But mostly, having just unravelled the bandit plugin interface - i have a distaste for self-rolling. | 22:56 |
| Daviey | I'm not sure it is overkill when there is a code reduction. | 22:56 |
| Daviey | sigmavirus24: If only. | 22:56 |
| sigmavirus24 | Daviey: do or do not, there is no "if only" =P | 22:56 |
| Daviey | sigmavirus24: /nick yoda | 22:57 |
| viraptor | Daviey: thanks, it's always good to make the framework part someone else's problem :) (stevedore's in this case) | 22:59 |
| viraptor | Daviey: I reproduced the issue locally... so pecan randomly throws either "webob.exc.WSGIHTTPException", or "webob.exc.HTTPServerError" in the same test | 23:00 |
| viraptor | if only I could smack software.... | 23:00 |
| Daviey | wtf | 23:00 |
| Daviey | Actually, this sounds familiar | 23:00 |
| Daviey | viraptor: WSGIHTTPException and HTTPServerError both == 500, right? | 23:02 |
| viraptor | second one definitely, first not sure | 23:03 |
| Daviey | I'm curious why it seems non-deterministic.. | 23:03 |
| *** voodookid has quit IRC | 23:03 | |
| *** tkelsey has joined #openstack-security | 23:04 | |
| Daviey | https://github.com/Pylons/webob/blob/master/webob/exc.py#L223 | 23:04 |
| viraptor | so the exception type comes from WebOb.ex.status_map[exception_number] | 23:04 |
| viraptor | Daviey: I added some debugging to webob's status_map creation | 23:07 |
| viraptor | https://www.irccloud.com/pastebin/wTUIV0dI/ | 23:08 |
| *** tkelsey has quit IRC | 23:08 | |
| Daviey | viraptor: Yeah, so just matching 500 should catch it? | 23:08 |
| viraptor | so we'll get a random one each time due to hashmap randomisation | 23:08 |
| viraptor | yeah, but I think it's a bad pecan issue anyway | 23:09 |
| Daviey | viraptor: I'm amazed nobody else has hit this! | 23:10 |
| viraptor | I'll send a patch in a moment, just going to figure out what's the top level exception that can be caught here... | 23:12 |
| *** sicarie__ has quit IRC | 23:22 | |
| openstackgerrit | Stanislaw Pitucha proposed openstack/anchor: Check for exception code and not type https://review.openstack.org/206257 | 23:24 |
| viraptor | Daviey: ^ | 23:24 |
| *** sicarie__ has joined #openstack-security | 23:25 | |
| viraptor | I still don't understand why did clearing .tox fix this - I expected a better randomness | 23:25 |
| Daviey | viraptor: I'll try it.. but it does feel like the wrong way to fix this.. | 23:26 |
| Daviey | viraptor: I wonder if pyc optimizes this out? | 23:26 |
| Daviey | err, no - scrub that | 23:26 |
| *** salv-orlando has quit IRC | 23:32 | |
| Daviey | viraptor: Why not do this? http://git.io/vYXUU | 23:40 |
| *** markvoelker has quit IRC | 23:40 | |
| Daviey | I'm not a fan of using codes when we have helpers personally | 23:40 |
| viraptor | but that's the original issue - the exception being raised is not guaranteed to be of that type | 23:42 |
| viraptor | we could check if it's one of the exceptions, but for 500 that means checking 5 different types (and can be more after webob updates) | 23:42 |
| *** jhfeng has quit IRC | 23:43 | |
| Daviey | viraptor: Yeah, i thought maybe if we were outside of the context it might be differnet.. but seems not | 23:45 |
| Daviey | I ran it 5 times before posting it.. :/ | 23:45 |
| Daviey | viraptor: Ok, one more thing - that review where you questioned my comment about "+1 on direction rather than current implementation".. it was just because it was a large code change and i've not had time to sit down and review it. | 23:48 |
| Daviey | As the conversation was a "is this the right thing?".. I wanted to chirp in that i thought it was. | 23:48 |
| Daviey | viraptor: I did want to check that we can support arbitrary leading hierarchy, rather than expecting to own document root... Which i suspect that change doesn't do. | 23:50 |
| Daviey | But that might belong in a separate change anyway | 23:50 |
| Daviey | Also, we currently default to using port 5000 - which is pretty anti-social, considering Keystone does aswell (and was in the playground first)... But also a problem, if you want to use anchor + keystone together! | 23:51 |
| viraptor | raised https://bugs.launchpad.net/pecan/+bug/1478732 for the exceptions issue | 23:51 |
| openstack | Launchpad bug 1478732 in pecan "pecan.abort exception changes on each run" [Undecided,New] | 23:51 |
| viraptor | Daviey: I thought I missed some specific comment about implementation - thanks for reviewing it! it's great to have more people looking at Anchor now - I'd hate it if it was an HP-only project | 23:52 |
| viraptor | as for the arbitrary leading hierarchy, I didn't even think about it before; I assumed we do - is there some story behind it? | 23:53 |
| Daviey | viraptor: The other projects are trying to get behind namespacing ^/compute/ ^/identity/ .. but also support other leading noise. | 23:54 |
| viraptor | good point on port 5000... do you want to raise all of those as bugs / blueprints? I'm about to leave for lunch, but they all sound like something we need to do | 23:55 |
| openstackgerrit | Dave Walker proposed openstack/anchor: [WIP] Initial commit of devstack plugin https://review.openstack.org/206264 | 23:59 |
| *** bpokorny_ has quit IRC | 23:59 | |
| *** bpokorny has joined #openstack-security | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!