09:59:56 <tonyb> #startmeeting requirements
09:59:57 <openstack> Meeting started Wed Mar  8 09:59:56 2017 UTC and is due to finish in 60 minutes.  The chair is tonyb. Information about MeetBot at http://wiki.debian.org/MeetBot.
09:59:58 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
10:00:00 <openstack> The meeting name has been set to 'requirements'
10:00:15 <tonyb> Oh phooey 4seconds early
10:00:25 <prometheanfire> for shame
10:00:49 <tonyb> sigmavirus,  number80, coolsvap, toabctl
10:00:55 <tonyb> sigmavirus,  number80, coolsvap, toabctl: ping
10:01:05 <tonyb> #topic rollcall
10:01:24 <tonyb> I'm pretty sure dirk is on leave this week so we don't have him
10:01:27 <tonyb> anyone else?
10:04:26 <tonyb> #topic Any controversies in the Queue?
10:04:51 <tonyb> Well the queue is a bit of a mess after PBR, pyparsing and oslo
10:05:02 <tonyb> but I think it's coming good
10:05:06 <prometheanfire> yep
10:05:16 <prometheanfire> not exactly a contraversy
10:05:28 <tonyb> Yeah
10:05:55 <tonyb> The things that are becoming challenging are eventlet and webob
10:06:09 <tonyb> no one is driving them so they're just stagnating
10:06:27 <prometheanfire> true
10:06:46 <prometheanfire> come monday should we just do eventlet?
10:06:56 <prometheanfire> that was the first one we were targeting right?
10:06:56 <tonyb> prometheanfire: we can't
10:07:17 <tonyb> we have known issues in $projects and the fixes aren;t merging
10:07:24 <tonyb> same for webob
10:07:30 <prometheanfire> ah, right, the deps
10:07:36 <tonyb> Yeah
10:07:46 <prometheanfire> ya, that'd need to happen first
10:08:16 <prometheanfire> I'm good at badgering people into submission
10:08:28 <prometheanfire> will see what I can do maybe
10:08:41 <tonyb> I'll post to the mailing list
10:08:53 <prometheanfire> k
10:09:42 <tonyb> I'd like to find an ownr for each of them
10:10:05 <tonyb> if they're not in by M2 then they're not going in IMO
10:10:22 <prometheanfire> ya
10:11:32 <tonyb> next is kombu/amqp
10:11:46 <tonyb> we just laned kombu4 but it breaks windows
10:11:50 <tonyb> there is a review up
10:11:58 <tonyb> https://review.openstack.org/#/c/443032
10:12:06 <tonyb> but it needs work to be mergeable
10:12:18 <prometheanfire> k
10:12:59 <prometheanfire> ya, it hard caps
10:13:08 <tonyb> https://review.openstack.org/#/c/443032/3
10:13:13 <tonyb> fixed
10:13:21 <prometheanfire> https://launchpad.net/openstack/+milestone/pike-2 is june 5 btw
10:14:19 <tonyb> prometheanfire: Yeah sounds about right
10:15:27 <tonyb> Once that has a +1 from claudiub can you shepard it?
10:15:41 <prometheanfire> sure
10:16:50 <tonyb> prometheanfire: Thanks
10:17:02 <tonyb> #topic How to we crypto
10:17:35 <tonyb> prometheanfire: what's the haps with pycrypto vs pycryptome and possibly pyca/cryptography ?
10:17:36 <prometheanfire> I haven't looked yet, but I suspect there are still projects out there using pycrypto
10:18:06 <prometheanfire> since upstream is dead now, they need to move to preferably cryptography, but at least to pycryptome
10:18:32 <prometheanfire> pycrypto already had one hard to backport cve
10:18:41 <prometheanfire> in january
10:19:13 <tonyb> prometheanfire: is the switch from pycrypto -> pycryptome trivial?
10:19:52 <prometheanfire> I think so
10:19:53 <tonyb> they exist in thr same namespace right? are they mostly API compatible?
10:20:52 <prometheanfire> both?
10:20:59 <prometheanfire> pycryptome is kinda odd
10:21:54 <tonyb> and we're capping pysaml2 because it has to stay compatible with pycrypto but pycryptome works with pysaml2>=4 ?
10:22:19 <prometheanfire> pycryptodomex is an alt install method
10:23:10 <prometheanfire> a drop-in replacement for the old PyCrypto library. You install it with:
10:23:13 <prometheanfire> pip install pycryptodome
10:23:17 <prometheanfire> a library independent of the old PyCrypto. You install it with:
10:23:17 <prometheanfire> pip install pycryptodomex
10:23:30 <prometheanfire> https://github.com/Legrandin/pycryptodome
10:23:40 <prometheanfire> just something to read up on for next week
10:24:47 <prometheanfire> next?
10:24:48 <tonyb> Yeah the transition is going to be a massive PITA
10:25:10 <tonyb> because it's all or nothing and I don't know how to ensure that
10:25:27 <prometheanfire> yep
10:25:56 <prometheanfire> pycrypto's dead, long live pycrypto
10:26:06 <prometheanfire> or
10:26:13 <prometheanfire> just move to cryptography
10:26:51 <tonyb> prometheanfire: Sure but how do we *do* the switch from pycrypto to pycryptome
10:27:26 <prometheanfire> that, I'm not sure
10:27:35 <tonyb> prometheanfire: how do we ensure atmonically that 14 repos switch
10:27:38 <prometheanfire> something for the list maybe
10:28:07 <tonyb> prometheanfire: Yeah that's the thing I'm worried about ... if they're API compatible then Meh it's the switch that's hard
10:28:08 <prometheanfire> it doesn't have to be atomic if they are switching to cryptography
10:28:27 <prometheanfire> does if switching to pycryptome
10:28:30 <tonyb> prometheanfire: Sure but that's a *much* bigger change
10:28:34 <prometheanfire> yep
10:28:40 <prometheanfire> I'm aware
10:28:47 <prometheanfire> guess I'll send out that email
10:29:00 <tonyb> I guess I'll poke the PTLs of the affected projects
10:29:10 <tonyb> see if it's on the TODO list
10:29:26 <tonyb> I had great plans of helping with that kinda of work but we don
10:29:42 <tonyb> t have as many people willing to do that as I'd hoped for
10:30:07 <tonyb> unny barbican uses both ;P
10:30:38 <prometheanfire> wat
10:30:46 <tonyb> Yeah
10:30:47 <prometheanfire> maybe they are switching?
10:31:03 <tonyb> prometheanfire: more like they use it for differnt things
10:31:18 <prometheanfire> ya
10:32:02 <prometheanfire> so, have my todo list
10:32:16 <tonyb> ok
10:32:30 <prometheanfire> go to bed now? :D
10:32:38 <tonyb> Yeah
10:32:53 <tonyb> Thanks
10:32:59 <tonyb> #enmeeting
10:32:59 <prometheanfire> heh, np
10:33:06 <tonyb> #endmeeting