- OpenStack-announce - lists.openstack.org

[release] [ironic] python-ironic-inspector-client release 1.0.1
by Dmitry Tantsur 18 Jun '15

18 Jun '15

Hi all! I'm glad to announce the first release of the Python library and CLI too for (yet-to-be released) Ironic Inspector. Code for this library was extracted from ironic-discoverd tree, with removing deprecated code and adding basic support for API versioning. Big warning: while client itself is compatible with ironic-discoverd API, they are not co-installable due to using the same setuptools entry point. Grab the source: http://git.openstack.org/cgit/openstack/python-ironic-inspector-client/ Report issues: https://bugs.launchpad.net/python-ironic-inspector-client Cheers, Dmitry

1 0

[release][keystone] keystonemiddleware release 2.0.0 (liberty)
by doug＠doughellmann.com 18 Jun '15

18 Jun '15

We are overjoyed to announce the release of: keystonemiddleware 2.0.0: Middleware for OpenStack Identity This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/keystonemiddleware For more details, please see the git log history below and: http://launchpad.net/keystonemiddleware/+milestone/2.0.0 Please report issues through launchpad: http://bugs.launchpad.net/keystonemiddleware Changes in keystonemiddleware 1.6.1..2.0.0 ------------------------------------------ 2d4e194 Ensure cache keys are a known/fixed length 5690dc1 Updated from global requirements 9fd3986 Refactor request methods onto request object 468addb validate_token returns AccessInfo bdf03b0 Updated from global requirements 8723d88 Fixes a spelling error in a test name 6f9b7a4 Remove custom header handling c94f403 Stop using function deprecated in py34 570f26b Fetch user token from request rather than env 7074ee2 Remove the _msg_format function 675729b Base use webob aca9909 Don't rely on token_info for header building 2c00f8c Move project included validation c67420b Depend on keystoneclient for expiration checking c965851 Don't store expire into memcache 0aeea58 Removes discover from test-reqs 8aa9e80 Drop py2.6 support for keystone middleware 2a841f1 Create new user plugin tests bd74215 Add an explicit test failure condition when auth_token is missing c482f5b Fixup test-requirements-py3.txt 03d6f0c Fix list_opts test to not check all deps 0e2c5b5 tox env for Bandit 530b5cb Cleanup token hashes generated by cache 7940e10 Updated from global requirements 47fed2f Improved handling of endpoints missing urls 7148072 Refactor: extract echo_app from enclosing class 194e00a Add keystone v3 API to fetch revocation list 68bc769 Simplify request making in auth_token tests f45d766 Change auth_token to use keystoneclient 74d978c Deprecate auth_token authentication ea9ac13 Updated from global requirements dc44d62 Ignore cover directory Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 + bandit.yaml | 134 ++++ keystonemiddleware/audit.py | 26 +- keystonemiddleware/auth_token/__init__.py | 428 +++------- keystonemiddleware/auth_token/_auth.py | 19 +- keystonemiddleware/auth_token/_cache.py | 87 +-- keystonemiddleware/auth_token/_identity.py | 105 +-- keystonemiddleware/auth_token/_request.py | 180 +++++ keystonemiddleware/auth_token/_user_plugin.py | 19 + keystonemiddleware/auth_token/_utils.py | 32 - keystonemiddleware/echo/service.py | 16 +- .../unit/auth_token/test_auth_token_middleware.py | 870 +++++++-------------- requirements.txt | 8 +- setup.cfg | 1 - test-requirements-bandit.txt | 1 + test-requirements-py3.txt | 4 +- test-requirements.txt | 2 +- tox.ini | 4 + 24 files changed, 1389 insertions(+), 1142 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b611a31..b13a89e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ Babel>=1.3 -oslo.config>=1.9.3 # Apache-2.0 +oslo.config>=1.11.0 # Apache-2.0 @@ -11 +11 @@ oslo.utils>=1.4.0 # Apache-2.0 -pbr>=0.6,!=0.7,<1.0 +pbr>=0.11,<2.0 @@ -13,2 +13,2 @@ pycadf>=0.8.0 -python-keystoneclient>=1.1.0 -requests>=2.2.0,!=2.4.0 +python-keystoneclient>=1.6.0 +requests>=2.5.2 diff --git a/test-requirements-bandit.txt b/test-requirements-bandit.txt new file mode 100644 index 0000000..b21da7f --- /dev/null +++ b/test-requirements-bandit.txt @@ -0,0 +1 @@ +bandit>=0.10.1 diff --git a/test-requirements-py3.txt b/test-requirements-py3.txt index 9a33730..abada85 100644 --- a/test-requirements-py3.txt +++ b/test-requirements-py3.txt @@ -4,0 +5,2 @@ +hacking>=0.10.0,<0.11 + @@ -8 +9,0 @@ fixtures>=0.3.14 -hacking>=0.8.0,<0.9 @@ -15,0 +17 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 +stevedore>=1.5.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index e36b86e..a305e6c 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +7,0 @@ coverage>=3.6 -discover @@ -16,0 +16 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 +stevedore>=1.5.0 # Apache-2.0

1 0

[release][oslo] oslo.service release 0.1.0 (liberty)
by doug＠doughellmann.com 18 Jun '15

18 Jun '15

We are pleased to announce the release of: oslo.service 0.1.0: oslo.service library This release is part of the liberty release series, and is the first experimental release of this library. With source available at: http://git.openstack.org/cgit/openstack/oslo.service For more details, please see the git log history below and: http://launchpad.net/oslo.service/+milestone/HEAD Please report issues through launchpad: http://bugs.launchpad.net/oslo.service

1 0

[OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-2015-1851) ERRATA 1
by Tristan Cacqueray 17 Jun '15

17 Jun '15

======================================================================= OSSA-2015-011.1: Cinder host file disclosure through qcow2 backing file ======================================================================= :Date: June 16, 2015 :CVE: CVE-2015-1851 Affects ~~~~~~~ - Cinder: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0 Description ~~~~~~~~~~~ Bastian Blank from credativ reported a vulnerability in Cinder. By overwriting an image with a malicious qcow2 header, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. All Cinder setups are affected. Errata ~~~~~~ CVE-2015-1850 has been assigned to a similar issue in Nova, the correct CVE number for Cinder is CVE-2015-1851. Patches ~~~~~~~ - https://review.openstack.org/191871 (Icehouse) - https://review.openstack.org/191865 (Juno) - https://review.openstack.org/191786 (Kilo) - https://review.openstack.org/191785 (Liberty) Credits ~~~~~~~ - Bastian Blank from Credativ (CVE-2015-1851) References ~~~~~~~~~~ - https://launchpad.net/bugs/1415087 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1851 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse), 2014.2.4 (juno) and 2015.1.1 (kilo) releases. OSSA History ~~~~~~~~~~~~ - 2015-06-17 - Errata 1 - 2015-06-16 - Original Version -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release][openstackclient] python-openstackclient release 1.5.0 (liberty)
by doug＠doughellmann.com 16 Jun '15

16 Jun '15

We are delighted to announce the release of: python-openstackclient 1.5.0: OpenStack Command-line Client This release is part of the liberty release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient For more details, please see the git log history below and: https://launchpad.net/python-openstackclient/+milestone/1.5.0 Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient Changes in python-openstackclient 1.4.0..1.5.0 ---------------------------------------------- 291ba62 Add release notes for 1.5.0 258f4ca reference corect ec2 helper function dca47a7 Updated from global requirements c88b433 Add support for volume snapshot v2 command Diffstat (except docs and test files) ------------------------------------- openstackclient/identity/v3/ec2creds.py | 8 +- openstackclient/volume/v2/snapshot.py | 205 ++++++++++++++++++++++- requirements.txt | 2 +- setup.cfg | 4 + 7 files changed, 412 insertions(+), 11 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index d420b1a..11d2a39 100644 --- a/requirements.txt +++ b/requirements.txt @@ -17 +17 @@ python-novaclient>=2.22.0 -python-cinderclient>=1.2.1 +python-cinderclient>=1.2.2

1 0

[release][oslo] taskflow release 0.11.0 (liberty)
by doug＠doughellmann.com 16 Jun '15

16 Jun '15

We are satisfied to announce the release of: taskflow 0.11.0: Taskflow structured state management library. This release is part of the liberty release series. With source available at: http://git.openstack.org/cgit/openstack/taskflow For more details, please see the git log history below and: http://launchpad.net/taskflow/+milestone/0.11.0 Please report issues through launchpad: http://bugs.launchpad.net/taskflow/ Changes in taskflow 0.10.1..0.11.0 ---------------------------------- 6e62842 Updated from global requirements 28eafa6 Switch badges from 'pypip.in' to 'shields.io' 3d4bbb9 Adding a revert_all option to retry controllers 4b28b32 Updated from global requirements 61a4f97 Remove example not tested deaf61c Make the default file encoding a class constant with a docstring 33e9ccc Use a lru cache to limit the size of the internal file cache 14f5d0a Updated from global requirements 24752c2 Use hash path lookup vs path finding f1bd24f Remove all 'lock_utils' now that fasteners provides equivalents 4ee5ffd Add a new `ls_r` method 9091a9c Updated from global requirements c3afeb5 Replace lock_utils lock(s) with fasteners package 1e6b991 Updated from global requirements ae6e48f Use shared '_check' function to check engine stages b8da7f7 Remove a couple more useless 'pass' keywords found 16a2c79 Add a test that checks for task result visibility 6b5b9dc Remove testing using persistence sqlalchemy backend with 'mysqldb' 2e0eac0 Remove customized pyX.Y tox requirements 553b6b3 Updated from global requirements c7e8c86 Allow same deps for requires and provides in task b9da5e1 Remove 'pass' usage not needed 712eed5 Only show state transitions to logging when in BLATHER mode e183fc9 Fix updated_at column of sqlalchemy tables 9c4520e Remove script already nuked from oslo-incubator 58f43d2 Ensure path_based abstract base class is included in docs ad5b556 Beef up docs on the logbook/flow detail/atom details models fb2b813 Remove custom py26/py27 tox venvs no longer used 6990fb1 Use newer versions of futures that adds exception tracebacks 5d4dfe0 Ensure empty paths raise a value error 4fc6b61 Remove listener stack and replace with exit stack 24a11aa Expose action engine no reraising states constants 5cfeeb6 Chain a few more exception raises that were previously missed d76bd26 Expose in memory backend split staticmethod 4e550ba Updated from global requirements 98cb841 Remove tox py33 environment no longer used 84c1ad6 Avoid creating temporary removal lists 115bf98 Avoid re-normalizing paths when following links e247e07 Add a profiling context manager that can be easily enabled 562884d Updated from global requirements 73b98de Avoid duplicating exception message 7c3fdcc Small refactoring of 'merge_uri' utility function 530328a Refactor/reduce shared 'ensure(task/retry)' code 22fd32f Just let the future executors handle the max workers Diffstat (except docs and test files) ------------------------------------- README.rst | 4 +- openstack-common.conf | 3 - requirements.txt | 17 +- taskflow/atom.py | 11 - taskflow/conductors/backends/impl_blocking.py | 11 +- taskflow/conductors/base.py | 6 +- taskflow/engines/action_engine/compiler.py | 5 +- taskflow/engines/action_engine/engine.py | 42 +- taskflow/engines/action_engine/executor.py | 9 +- taskflow/engines/action_engine/runner.py | 4 +- taskflow/engines/worker_based/protocol.py | 4 +- taskflow/engines/worker_based/worker.py | 13 +- taskflow/examples/dump_memory_backend.py | 2 +- taskflow/examples/job_board_no_test.py | 171 ------ .../examples/jobboard_produce_consume_colors.py | 9 + taskflow/jobs/backends/impl_zookeeper.py | 6 +- taskflow/jobs/base.py | 2 - taskflow/persistence/backends/impl_dir.py | 29 +- taskflow/persistence/backends/impl_memory.py | 106 +++- taskflow/persistence/backends/impl_zookeeper.py | 8 +- taskflow/persistence/backends/sqlalchemy/tables.py | 6 +- taskflow/persistence/base.py | 17 - taskflow/persistence/logbook.py | 473 +++++++++++---- taskflow/retry.py | 31 +- taskflow/storage.py | 177 +++--- .../unit/persistence/test_memory_persistence.py | 66 ++- taskflow/types/futures.py | 23 +- taskflow/utils/async_utils.py | 9 +- taskflow/utils/lock_utils.py | 517 ----------------- taskflow/utils/misc.py | 80 +-- test-requirements.txt | 16 +- tools/speed_test.py | 87 ++- tox.ini | 37 -- 46 files changed, 1380 insertions(+), 1878 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8e0c5f3..f85b92d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ -pbr>=0.6,!=0.7,<1.0 +pbr>=0.11,<2.0 @@ -18,0 +19,3 @@ enum34 +# For reader/writer + interprocess locks. +fasteners>=0.7 # Apache-2.0 + @@ -21,0 +25,3 @@ networkx>=1.8 +# For contextlib new additions/compatibility for <= python 3.3 +contextlib2>=0.4.0 # PSF License + @@ -23 +29 @@ networkx>=1.8 -stevedore>=1.3.0 # Apache-2.0 +stevedore>=1.5.0 # Apache-2.0 @@ -26 +32 @@ stevedore>=1.3.0 # Apache-2.0 -futures>=2.1.6 +futures>=3.0 @@ -29 +35 @@ futures>=2.1.6 -jsonschema>=2.0.0,<3.0.0 +jsonschema>=2.0.0,<3.0.0,!=2.5.0 @@ -34,0 +41,3 @@ oslo.serialization>=1.4.0 # Apache-2.0 +# For lru caches and such +cachetools>=1.0.0 # MIT License + diff --git a/test-requirements.txt b/test-requirements.txt index a6a7a19..f25f6d4 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -16 +16 @@ zake>=0.1.6 # Apache-2.0 -kazoo>=1.3.1 +kazoo>=1.3.1,!=2.1 @@ -19,9 +19 @@ kazoo>=1.3.1 -# -# NOTE(harlowja): SQLAlchemy isn't listed here currently but is -# listed in our tox.ini files so that we can test multiple varying SQLAlchemy -# versions to ensure a wider range of compatibility. -# -# Explict mysql drivers are also not listed here so that we can test against -# PyMySQL or MySQL-python depending on the python version the tests are being -# ran in (MySQL-python is currently preferred for 2.x environments, since -# it has been used in openstack for the longest). +SQLAlchemy>=0.9.7,<1.1.0 @@ -29,0 +22,4 @@ psycopg2 +PyMySQL>=0.6.2 # MIT License + +# Used for making sure we still work with eventlet. +eventlet>=0.17.3

1 0

[OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850)
by Tristan Cacqueray 16 Jun '15

16 Jun '15

===================================================================== OSSA-2015-011: Cinder host file disclosure through qcow2 backing file ===================================================================== :Date: June 16, 2015 :CVE: CVE-2015-1850 Affects ~~~~~~~ - Cinder: versions through 2014.1.4, and 2014.2 versions through 2014.2.3, and version 2015.1.0 Description ~~~~~~~~~~~ Bastian Blank from credativ reported a vulnerability in Cinder. By overwriting an image with a malicious qcow2 header, an authenticated user may mislead Cinder upload-to-image action, resulting in disclosure of any file from the Cinder server. All Cinder setups are affected. Patches ~~~~~~~ - https://review.openstack.org/191871 (Icehouse) - https://review.openstack.org/191865 (Juno) - https://review.openstack.org/191786 (Kilo) - https://review.openstack.org/191785 (Liberty) Credits ~~~~~~~ - Bastian Blank from Credativ (CVE-2015-1850) References ~~~~~~~~~~ - https://launchpad.net/bugs/1415087 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1850 Notes ~~~~~ - This fix will be included in future 2014.1.5 (icehouse), 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[release][openstackclient] python-openstackclient release 1.4.0 (liberty)
by doug＠doughellmann.com 15 Jun '15

15 Jun '15

We are thrilled to announce the release of: python-openstackclient 1.4.0: OpenStack Command-line Client This release is part of the liberty release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient For more details, please see the git log history below and: https://launchpad.net/python-openstackclient/+milestone/1.4.0 Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient Changes in python-openstackclient 1.3.0..1.4.0 ---------------------------------------------- 9f69b43 Improve the hint message b328960 Fix the typo in `openstackclient/shell.py` ec903a1 Add oidc plugin for listing federation projects aac0d58 Skip trying to set project_domain_id if not using password f3725b4 Updated from global requirements 18991ab Updated from global requirements 1f1ed4c Imported Translations from Transifex 4afd308 Include links to developer workflow documentation f7feef7 Enable specifying domain for group and role commands 7cf7790 Not use the deprecated argument b808566 Create 1.4.0 release notes 43d12db Updated from global requirements 31d785e Allow --insecure to override --os-cacert 3fa0bbc Clean up ec2 credentials help text 8d185a6 Add functional tests for volume set and unset 7665d52 Add domain support for ec2creds in v3 identity 15d3717 Add EC2 support for identity v3 API db7d4eb Imported Translations from Transifex bf99218 Add a reference to the IRC channels 226fc6c Change Credentials header to Blob from data f737160 Get rid of oslo_i18n deprecation notice b2cf651 Fix security group list command a05cbf4 Rework shell tests 746f642 Add image functional tests f9fa307 Add volume functional tests 0c9f5c2 Ignore cover directory from git 3ae247f Set tenant options on parsed namespace 5361652 Add support for volume v2 API d14316a add domain scope arguments to v3 role add in doc 01573be project create is missing --parent in doc 542f587 add --domain argument to v3 project set 224d375 Add --wait to server delete ae29f7f Use ostestr for test runs 2c4b878 Add cli tests for --verify and friends da083d1 Small tweaks to osc plugin docs 211c14c Fix shell tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 + README.rst | 5 + examples/object_api.py | 4 +- examples/osc-lib.py | 4 +- functional/common/test.py | 2 +- openstackclient/api/auth.py | 10 +- openstackclient/common/clientmanager.py | 4 + openstackclient/common/utils.py | 46 ++ openstackclient/compute/v2/security_group.py | 2 +- openstackclient/compute/v2/server.py | 17 + openstackclient/i18n.py | 4 +- openstackclient/identity/common.py | 16 +- openstackclient/identity/v2_0/ec2creds.py | 18 +- openstackclient/identity/v3/credential.py | 5 +- openstackclient/identity/v3/ec2creds.py | 251 +++++++ openstackclient/identity/v3/group.py | 116 ++- openstackclient/identity/v3/project.py | 8 + openstackclient/identity/v3/role.py | 321 +++------ openstackclient/identity/v3/unscoped_saml.py | 2 +- openstackclient/identity/v3/user.py | 2 +- openstackclient/shell.py | 50 +- openstackclient/volume/client.py | 3 +- openstackclient/volume/v2/__init__.py | 0 openstackclient/volume/v2/backup.py | 70 ++ openstackclient/volume/v2/snapshot.py | 71 ++ openstackclient/volume/v2/volume.py | 83 +++ openstackclient/volume/v2/volume_type.py | 68 ++ .../de/LC_MESSAGES/python-openstackclient.po | 783 +++++++++++---------- .../locale/python-openstackclient.pot | 208 +++--- .../zh_TW/LC_MESSAGES/python-openstackclient.po | 687 +++++++++--------- requirements.txt | 8 +- setup.cfg | 18 + test-requirements.txt | 1 + tox.ini | 4 +- 60 files changed, 2907 insertions(+), 1337 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 415d27a..d420b1a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10 +10 @@ cliff-tablib>=1.0 -os-client-config +os-client-config>=1.2.0 @@ -14,2 +14,2 @@ oslo.utils>=1.4.0 # Apache-2.0 -python-glanceclient>=0.17.1 -python-keystoneclient>=1.3.0 +python-glanceclient>=0.18.0 +python-keystoneclient>=1.6.0 @@ -20 +20 @@ requests>=2.5.2 -stevedore>=1.3.0 # Apache-2.0 +stevedore>=1.5.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 24f5c68..f82e48d 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -13,0 +14 @@ sphinx>=1.1.2,!=1.2.0,!=1.3b1,<1.3 +os-testr>=0.1.0

1 0

OpenStack Community Weekly Newsletter (June 5 - 12)
by Stefano Maffulli 12 Jun '15

12 Jun '15

1 0

[OSSA 2015-010] XSS in Horizon Heat stack creation (CVE-2015-3219)
by Tristan Cacqueray 10 Jun '15

10 Jun '15

================================================= OSSA-2015-010: XSS in Horizon Heat stack creation ================================================= :Date: June 09, 2015 :CVE: CVE-2015-3219 Affects ~~~~~~~ - Horizon: 2014.2 versions through 2014.2.3 and version 2015.1.0 Description ~~~~~~~~~~~ Nikita Konovalov from Mirantis reported a vulnerability in Horizon. By tricking a Horizon user into using a malicious template in the Orchestration/Stack section of Horizon, a remote attacker may trigger a cross-site-scripting vulnerability during the stack creation. It may result in potential assets theft like user access credentials. Only setups exposing the orchestration dashboard in Horizon are affected. Patches ~~~~~~~ - https://review.openstack.org/189821 (Juno) - https://review.openstack.org/189822 (Kilo) - https://review.openstack.org/189820 (Liberty) Credits ~~~~~~~ - Nikita Konovalov from Mirantis (CVE-2015-3219) References ~~~~~~~~~~ - https://launchpad.net/bugs/1453074 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3219 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.1 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0