| *** ianw is now known as Guest52 | 01:07 | |
| Guest52 | test | 01:15 |
|---|---|---|
| fungi | /usr/bin/test | 01:19 |
| Guest52 | i identified as ianw in matrix but now i can't figure out how to unidentify | 01:26 |
| *** Guest52 is now known as ianw | 01:29 | |
| ianw | test | 01:29 |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 06:18 |
| *** ysandeep|away is now known as ysandeep | 06:26 | |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 06:33 |
| opendevreview | Merged zuul/zuul-jobs master: Fix buildset-registry test on focal https://review.opendev.org/c/zuul/zuul-jobs/+/792349 | 06:44 |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 07:03 |
| *** jpena|off is now known as jpena | 07:34 | |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 07:36 |
| *** zbr is now known as Guest76 | 07:40 | |
| *** rpittau|afk is now known as rpittau | 07:41 | |
| *** ykarel is now known as ykarel|lunch | 08:44 | |
| *** ykarel|lunch is now known as ykarel | 09:48 | |
| *** jpena is now known as jpena|lunch | 11:30 | |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 11:33 |
| *** guillaumec_ is now known as guilllaumec | 12:18 | |
| *** jpena|lunch is now known as jpena | 12:30 | |
| yoctozepto | morning | 13:52 |
| yoctozepto | any idea why reconfigure file in https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_f40/797267/1/check/kolla-ansible-ubuntu-source-cephadm/f403d80/primary/logs/ansible/index.html cannot be downloaded | 13:52 |
| fungi | yoctozepto: i'm able to download it with wget, can you be more specific? | 13:56 |
| fungi | ahh, if i try to download it with a web browser it seems to get confused on what the content encoding should be | 13:57 |
| yoctozepto | ah, I tried two browsers and 'save as' but yeah, it is something about encoding | 13:58 |
| fungi | looks like we upload everything to swift as text/plain so files which aren't actual text are probably going to make browsers unhappy | 13:58 |
| yoctozepto | although it should not care, should it? | 13:58 |
| yoctozepto | meh, modern browsers | 13:58 |
| yoctozepto | it should be a text file btw | 13:58 |
| yoctozepto | ascii only | 13:58 |
| yoctozepto | ah, I downloaded it with curl and it's gibberish | 13:59 |
| fungi | yes, `file reconfigure` reports "reconfigure: data" | 14:00 |
| fungi | what generates that file? | 14:00 |
| yoctozepto | it's ansible output redirected to a file | 14:01 |
| yoctozepto | it normally works | 14:01 |
| fungi | interesting | 14:01 |
| yoctozepto | an unrelated job failed and I decided to peek | 14:02 |
| yoctozepto | and this is what I found | 14:02 |
| fungi | is reconfigure-prechecks created the same way, i guess? because yes it has text content | 14:02 |
| yoctozepto | so it probably broke in some weird way | 14:02 |
| yoctozepto | yeah | 14:02 |
| rosmaita | not sure who to direct this to, but the summary urls at the end of a meeting (for example, https://eavesdrop.opendev.org/meetings/image_encryption/2021/image_encryption.2021-06-21-13.00.html ) aren't redirecting to https://meetings.opendev.org/meetings/image_encryption/2021/image_encryption.2021-06-21-13.00.html | 14:02 |
| rosmaita | just a FYI | 14:02 |
| fungi | rosmaita: thanks for spotting that, i'll try to get a fix up later today if nobody beats me to it | 14:03 |
| rosmaita | fungi: thanks ... and actually i don't know if it's for all meetings or just that particular one | 14:03 |
| *** gthiemon1e is now known as gthiemonge | 14:04 | |
| fungi | i expect the problem is that we redirected from eavesdrop.openstack.org but the new servername where the bot is running now is causing it to put eavesdrop.opendev.org im urls | 14:04 |
| fungi | we should 1. correct that to echo the new canonical urls, but also 2. probably add a redirect from eavesdrop.opendev.org so it's solved for any meetings which mentioned urls in this in-between state | 14:05 |
| fungi | anyway i have to leave momentarily to run some errands, but will try to tackle both those tasks when i get back in a couple hours | 14:08 |
| fungi | yoctozepto: maybe it's compressed? but doesn't seem to be gzip at least since zcat doesn't like it either | 14:08 |
| fungi | also running strings on it returns nothing recognizable, which is why i suspect some sort of encapsulation/compression | 14:09 |
| yoctozepto | fungi: I think it looks more like something tried to uncompress uncompressed | 14:09 |
| yoctozepto | yeah | 14:09 |
| fungi | maybe it was compressed with deflate | 14:09 |
| yoctozepto | not on our side | 14:09 |
| fungi | could perhaps happen on the fly when uploading to swift, or be done by the serving end | 14:10 |
| fungi | anyway, i'll be around later | 14:10 |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 14:12 |
| yoctozepto | take care | 14:15 |
| opendevreview | Florian Haas proposed opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 14:24 |
| *** ykarel is now known as ykarel|away | 14:30 | |
| *** odyssey4me is now known as Guest109 | 14:46 | |
| gthiemonge | Hi Folks, a security fix was proposed for Octavia (https://review.opendev.org/c/openstack/octavia/+/797322), there's storyboard id in the commit message, but we cannot access it, how can we fix that? | 15:19 |
| JayF | Typically that indicates a embargoed security bug. There should be someone working with your project who knows the details... do you have a VMT liason? | 15:22 |
| gthiemonge | JayF: we don't have a VMT liaison | 15:25 |
| JayF | Then IDK what to tell you :) I don't have special knowledge/access, just have helped with those kinda bugs in Ironic before | 15:26 |
| johnsom | There is supposed to be a "group" in storyboard that allows the PTL (maybe core) view the security tagged story, but it appears that is not working. | 15:26 |
| *** ysandeep is now known as ysandeep|out | 15:36 | |
| fungi | gthiemonge: anyone who has access to that story can switch it to public, but the fix should never have been pushed to public code review without first making the story public | 15:49 |
| fungi | octavia isn't overseen by the openstack vmt though, so are free to do things however they wish | 15:49 |
| *** gthiemon1e is now known as gthiemonge | 15:51 | |
| fungi | johnsom: gthiemonge: by default private stories are only accessible to the people who submit them, unless there is a group configured in storyboard and associated as a security team for that project. deliverables overseen by the openstack vmt are associated with the openstack-security team, but for deliverables with no vmt oversight they'd need a group of their own created and added to the | 15:53 |
| fungi | project | 15:53 |
| fungi | otherwise the person who creates the story needs to manually add someone to it | 15:53 |
| johnsom | fungi Yeah, we worked on the group for the Octavia team, many months ago (I think we were working with you actually). But that seems to no longer be working. | 15:54 |
| johnsom | Is that group missing now? Is there a way we can check or does it require a storyboard admin? | 15:56 |
| fungi | creating the group can be done by an admin, i'll look and see what's set. i also don't have access to story 2008994, fwiw | 15:57 |
| fungi | possible there's some other reason, like the only task on it is for a different project entirely, or something | 15:58 |
| *** rpittau is now known as rpittau|afk | 16:00 | |
| johnsom | Ah, interesting | 16:02 |
| fungi | johnsom: i've used sysadmin access to the backend db to insert permission for myself to view that story, and can confirm it's for openstack/octavia but the only people who were added access for it before now were Paul Axe | 16:04 |
| fungi | Anton Zhabolenko and Mikhail Ushanov | 16:04 |
| fungi | the first of the three being automatically added since they created the story | 16:04 |
| johnsom | Must be the reporting team/company. Is the "Octavia security" group still there? | 16:05 |
| fungi | the openstack-octavia-security group exists, includes you and list showing related to the octavia team deliverables including openstack/octavia | 16:06 |
| fungi | oh! i see why it didn't get added | 16:07 |
| johnsom | Hmm, ok, so a bug. Should I open a Story for Storyboard? | 16:07 |
| fungi | nope, working as designed. my fault, almost certainly, i didn't set it as a "security team" | 16:08 |
| fungi | i'm double-checking the others i created to see if i made the same mistake elsewhere | 16:08 |
| gthiemonge | perhaps "private" is true | 16:08 |
| johnsom | Ok, and if we can't manage that group, can you add Greg (current PTL)? | 16:08 |
| fungi | confirmed, i forgot to set openstack-trove-security as a security team too | 16:09 |
| fungi | and yeah, i'll add greg, just a sec | 16:09 |
| johnsom | Thank you! | 16:09 |
| gthiemonge | fungi: thanks ;-) | 16:11 |
| fungi | gthiemonge: i've added you to the openstack-octavia-security team in storyboard.openstack.org now | 16:11 |
| johnsom | So if I log out and back in I should be able to see that bug now? | 16:11 |
| fungi | i'll work on adding openstack-octavia-security access to any still private stories next | 16:11 |
| johnsom | Ah, ok, thanks | 16:11 |
| rm_work | Hmm yeah I was surprised since I have definitely viewed Octavia security bugs before | 16:12 |
| gthiemonge | I still have 404 errors on 2008994 | 16:12 |
| rm_work | Need to relog? | 16:12 |
| fungi | well, the group could still be manually added to a story, just wouldn't have been auto-added | 16:13 |
| fungi | gthiemonge: rm_work: i'm working on adding the team to the existing stories it doesn't have access to now, give me a moment | 16:13 |
| gthiemonge | fungi: ok, thanks | 16:13 |
| rm_work | Sorry for impatience 😅 | 16:13 |
| * johnsom guesses the Octavia team takes security stories seriously.... grin | 16:14 | |
| fungi | as well they should! | 16:14 |
| fungi | gthiemonge: rm_work: johnsom: i've manually added the team to that story while working on identifying any others | 16:17 |
| johnsom | Hmm, I still get a 404 after logging out and back in. | 16:18 |
| fungi | you're logged into storyboard, have no api error pop-ups in the top-right corner, and then attempt to load https://storyboard.openstack.org/#!/story/2008994 ? | 16:19 |
| fungi | oh, i didn't actually save, hold on | 16:20 |
| fungi | johnsom: reload now, sorry | 16:21 |
| gthiemonge | I can see it ;-) | 16:21 |
| gthiemonge | fungi: thank you | 16:22 |
| fungi | gthiemonge: you're welcome, i've also added the team to story 2008853 which was already marked invalid but should probably be switched to public | 16:26 |
| *** jpena is now known as jpena|off | 16:46 | |
| fungi | gthiemonge: also 2004606 which looks like it should have been switched to public years ago | 17:24 |
| fungi | gthiemonge: and 2001515 | 17:28 |
| fungi | gthiemonge: and 2001398 | 17:29 |
| fungi | gthiemonge: and 2001380 | 17:30 |
| fungi | gthiemonge: and 2001376 | 17:31 |
| fungi | many of those i had added rm_work to years ago in a prior audit of private stories, before an openstack-octavia-security team had been added for those projects | 17:33 |
| gthiemonge | fungi: wow, thanks, I'll review those stories | 17:39 |
| fungi | gthiemonge: i expect most are invalid or long since fixed | 17:40 |
| fungi | please switch any which aren't sensitive to public | 17:40 |
| fungi | doing my best to keep the private stories in sb limited to those which actually need to be private until they're fixed | 17:41 |
| opendevreview | Merged opendev/git-review master: Support the Git "core.hooksPath" option when dealing with hook scripts https://review.opendev.org/c/opendev/git-review/+/796727 | 19:49 |
| *** dviroel is now known as dviroel|out | 21:39 | |
| opendevreview | Ian Wienand proposed opendev/system-config master: centos-mirror: add dry run mode https://review.opendev.org/c/opendev/system-config/+/797364 | 23:38 |
| opendevreview | Ian Wienand proposed opendev/system-config master: centos-mirror: exclude ppc64le https://review.opendev.org/c/opendev/system-config/+/797365 | 23:38 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!