October 2020 - openstack-discuss - lists.openstack.org

[tc] Gerrit breach and commit audit
by Ghanshyam Mann 22 Oct '20

22 Oct '20

Hello Everyone, As per the announcement of the Gerrit breach [1], I have audited all repos under the Technical Committee for 1. Suspicious commit 2. Core group list and everything is fine except the one already reported. - https://opendev.org/openstack/governance/src/branch/master/reference/techni… - https://opendev.org/openstack/governance/src/branch/master/reference/user-c… [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html -gmann

2 1

[neutron][ptg] Sessions schedule
by Slawek Kaplonski 22 Oct '20

22 Oct '20

Hi Neutrinos, Thanks for all of You who proposed some topics for our meeting at the PTG. I prepared agenda for that in etherpad [1]. I didn't specify exact time slots for each topics but just moved things around for specific days. We will move through the list of topics and use as much time for each of them as needed. I hope that will work better than scheduled time slots for topic :) Please review that agenda and ping me if You would like to add/change anything there. There is not much time for that but still I can do some changes :) And as it was during last ptg, we are gonna use meetpad [2] for our meetings. Last time it worked fine so I hope it will be like that this time too. If not, we can fallback to zoom during the PTG week. That's all from me for now. Have a great (and safe) weekend and see You on Monday. [1] https://etherpad.opendev.org/p/neutron-wallaby-ptg [2] https://meetpad.opendev.org/neutron-wallaby-ptg -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[oslo][core] gerrit breach and auditing all oslo deliverables [1] since Oct 01
by Herve Beraud 22 Oct '20

22 Oct '20

Hello, As every team we are also concerned by the gerrit breach and we must take a look at our changes during this time frame on all our deliverables [1]. The list of deliverables owned by Oslo is very huge, we need a methodical approach and also external help to check all these repositories. Fortunately oslo was in feature freeze during the majority of this period so I think it will reduce the scope of our investigation to our master branches. Due to the criticality of the problem I propose the following action plan: - first, split our deliverables in group and assign volunteer on them - second, focus us on changes against our scripts, executable files and CI config; - third, inspect documentation; - fourth, inspect other kinds of changes that I missed in previous points. I wrote a script [2][3] to help the release team to extract relevant changes (*.py, *.sh), all the rest (*.yaml, *.rst) have been ignored for now, we could adapt this script to lead our investigation. Example of script usage against our openstack/oslo.messaging repos: ``` $ cd oslo.messaging $ curl https://gist.githubusercontent.com/4383/511359cc2080e06295944c5f40bd1033/ra… | sh ``` Are you interested to follow this action plan? Ben as you are the security liaison are you interested in coordinating these groups/actions? Else any volunteer? Feel free to propose another approach or to propose changes on this one. Please ensure to double check your account activity [4] and make sure nothing is off. Special congrats to Julia Kreger and for her excellent job [5]. Thank you in advance for your help, [1] https://governance.openstack.org/tc/reference/projects/oslo.html#deliverabl… <https://governance.openstack.org/tc/reference/projects/release-management.h…> [2] https://gist.github.com/4383/511359cc2080e06295944c5f40bd1033 [3] https://gist.githubusercontent.com/4383/511359cc2080e06295944c5f40bd1033/ra… [4] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html [5] http://lists.openstack.org/pipermail/openstack-discuss/2020-October/018148.… -- Hervé Beraud Senior Software Engineer Red Hat - Openstack Oslo irc: hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

4 6

[tacker] Gerrit breach and commit audit
by Yasufumi Ogawa 22 Oct '20

22 Oct '20

Hi, As announced for the gerrit breach [1], I have audited all repos under Tacker for 1. Suspicious commit 2. Core group list and everything is fine [2]. [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html [2] https://etherpad.opendev.org/p/tacker-gerrit-breach-audit Regards, Yasufumi

1 0

[tripleo][core] gerrit breach and auditing all tripleo commits since Oct 01
by Marios Andreou 22 Oct '20

22 Oct '20

Hi folks, as you are undoubtedly aware, gerrit was down yesterday. There was this email to service-announce [1] with more information about what happened (kudos Julia Kreger who sent [2] where I saw that). There is a list of changes [3] since October 1st that we should audit out of precaution and to be responsible and accountable to our community and users. As you can expect there are a great number of changes. I put a full commit list at [5]. I mined those from [3] - see [4] for info about the 'mining' and even better if someone has time to verify that I didn't miss any repos or commits. Please I need help from all core reviewers. We need to check that the commits in [5] appear valid and correct - remember the concern is for any changes that may have been merged by a compromised account. I propose that we do this via Gerrit and that we leave a comment - 'CHECKED' - on each review that we check? Hopefully we can cover all of these before the end of the week by distributing our efforts. I am open to other suggestions though if folks feel this is better done via some document/spreadsheet etc. Of course as stated in [1] it is a good idea for everyone to double check their account activity and make sure nothing is off, Thank you in advance for your help, marios [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html [2] http://lists.openstack.org/pipermail/openstack-discuss/2020-October/018148.… [3] https://static.opendev.org/project/opendev.org/gerrit-diffs/ [4] https://gist.github.com/marios/a44a55998531354dc3d634dddeadf1c0 [5] https://gist.github.com/marios/d1b774c827769373b67d3988105140dd

4 7

[rpm-packaging] Gerrit breach and commit audit
by Javier Pena 22 Oct '20

22 Oct '20

Hi, Following the recent Gerrit breach report [1], I have gone through the changes in rpm-packaging, renderspec and pymod2pkg, and none of them look suspicious. If you see anything strange, please let me know and we will handle it. Regards, Javier [1] - http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html

1 0

[heat] Gerrit breach and commit audit
by Rico Lin 22 Oct '20

22 Oct '20

Hi All, As suggested by the recent announcement of gerrit breach [1], I have audited all commits for heat repos and confirmed that everything looks good. [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html Sorry for any inconvenience. Also feel free to ping me or any of our core reviewers and ask for review on your patches. Best Regards, -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 0

[tripleo][overcloud] setup 2 bonds for overcloud deployment tripleo
by dangerzone ar 22 Oct '20

22 Oct '20

Hi.. I'm looking help to deploy overcloud (openstack train) as per initial req below:- a) 3 controllers b) 5 computes c) 2 bonds (bond0 - all vlan except for tenant , bond1 - for tenant vlan only) *No external storage and dpdk computes for now as trying to deploy these 3 controllers and 5 computes first. I have gone through openstack web, blogs and some other resources and failed to deploy with success. One of my problems is to identify the right templates to use for my setup and config for 2 bonds above. I have struggled to deploy overcloud for a month without success...I really appreciate your help and support to guide me. Please your help and support is much appreciated. I request help from everybody. Thank you

3 4

packstack unable to handle team devices?
by lejeczek 22 Oct '20

22 Oct '20

Hi guys I'm trying to add a second node, both nodes have team devices for: CONFIG_NEUTRON_OVN_TUNNEL_IF=team1056 and I get packstack to keep failing: ... Preparing Nova Common entries [ DONE ] Preparing Neutron API entries [ ERROR ] ERROR : "Couldn't detect ipaddress of interface team1056 on node 172.24.154.201" Please check log file /var/tmp/packstack/20201021-230211-9q243gpi/openstack-setup.log for more information .. Is this by design or it's just my case and if the latter then how to troubleshoot/workaround it? many thanks, L

1 0

[magnum] Gerrit breach and commit audit
by feilong 21 Oct '20

21 Oct '20

Hi everyone, As per the announcement of the Gerrit breach [1], I have audited all repos under Magnum (magnum, python-magnumclient, magnum-ui and magnum-tempest-plugin) for 1. Suspicious commit 2. Core group list Everything looks OK for me, see https://etherpad.opendev.org/p/magnum-gerrit-breach-audit [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html -- Cheers & Best regards, Feilong Wang (王飞龙) ------------------------------------------------------ Senior Cloud Software Engineer Tel: +64-48032246 Email: flwang(a)catalyst.net.nz Catalyst IT Limited Level 6, Catalyst House, 150 Willis Street, Wellington ------------------------------------------------------

1 0