September 2021 - Release-announce

keystone 17.0.1 (ussuri)
by no-reply＠openstack.org 01 Sep '21

01 Sep '21

We are stoked to announce the release of: keystone 17.0.1: OpenStack Identity This release is part of the ussuri stable release series. The source is available from: https://opendev.org/openstack/keystone Download the package from: https://tarballs.openstack.org/keystone/ Please report issues through: https://bugs.launchpad.net/keystone/+bugs For more details, please see below. 17.0.1 ^^^^^^ Security Issues *************** * [bug 1901207 (https://bugs.launchpad.net/keystone/+bug/1901207) Policy enforcement for application credentials has been updated to protect against invalid ownership checks resulting in unauthorized users being able to get and delete application credentials for other users. Bug Fixes ********* * [bug 1688137 (https://bugs.launchpad.net/keystone/+bug/1688137) Fixed the AccountLocked exception being shown to the end user since it provides some information that could be exploited by a malicious user. The end user will now see Unauthorized instead of AccountLocked, preventing user info oracle exploitation. * [bug 1878938 (https://bugs.launchpad.net/keystone/+bug/1878938) Previously when a user used to have system role assignment and tries to delete the same role, the system role assignments still existed in system_assignment table. This causes keystone to return *HTTP 404 Not Found* errors when listing role assignments with names (e.g., *--names* or *?include_names*). If you are affected by this bug, you must remove stale role assignments manually. The following is an example SQL statement you can use to fix the issue, but you should verify it's applicability to your deployment's SQL implementation and version. SQL: * delete from system_assignment where role_id not in (select id from role); * [bug 1885753 (https://bugs.launchpad.net/keystone/+bug/1885753) Keystone's SQL identity backend now retries update user requests to safely handle stale data when two clients update a user at the same time. * [bug 1889936 (https://bugs.launchpad.net/keystone/+bug/1889936) Properly decode octet strings, or byte arrays, returned from LDAP. * [bug 1896125 (https://bugs.launchpad.net/keystone/+bug/1896125) Introduced more robust connection handling for asynchronous LDAP requests to address memory leaks fetching data from LDAP backends with low page sizes. * [bug 1901654 (https://bugs.launchpad.net/keystone/+bug/1901654) Previously, generate_public_ID() in sha256.py assumed the passed arguments is str data type. However, python-ldap 3.0 or later returns bytes data type for attribute values except fields of distinguished names, relative distinguished names, attribute names, queries. If keystone running on Python3 is integrated with LDAP and the LDAP server has local_id variable in its attribute, user login operations will fail due to the assumption and modifiation of python-ldap. By this fix, generate_public_ID() properly handles bytes data type in the parameter. Changes in keystone 17.0.0..17.0.1 ---------------------------------- 8ab4eb27b Hide AccountLocked exception from end users 07d3a3d3f Retry update_user when sqlalchemy raises StaleDataErrors 6b739ffc3 Use app cred user ID in policy enforcement d55c6c705 Drop lower-constraints job f4819fe36 Support bytes type in generate_public_ID() 7ac089137 Delete system role assignments from system_assignment table 35c7406bf Implement more robust connection handling for asynchronous LDAP calls c202bd506 Add vine to lower-constraints d5870f69c Properly handle octet (byte) strings when converting LDAP responses 300e79e93 Fix lower-constraint for PyMySQL 1c37797c5 Port the grenade multinode job to Zuul v3 6b8e036ba Fix UserNotFound exception for expiring groups 1f0603598 Switch to new grenade job name Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 23 ++-- keystone/api/users.py | 47 +++++++- keystone/assignment/backends/sql.py | 5 + keystone/identity/backends/ldap/common.py | 118 ++++++++++++++------- keystone/identity/backends/sql.py | 8 ++ keystone/identity/id_generators/sha256.py | 10 +- keystone/identity/shadow_backends/sql.py | 2 +- keystone/notifications.py | 2 + .../protection/v3/test_application_credential.py | 66 ++++++++++++ .../unit/identity/backends/test_ldap_common.py | 14 +++ lower-constraints.txt | 2 + .../keystone-dsvm-grenade-multinode/post.yaml | 15 --- .../keystone-dsvm-grenade-multinode/run.yaml | 48 --------- .../notes/bug-1688137-e4203c9a728690a7.yaml | 8 ++ .../notes/bug-1878938-70ee2af6fdf66004.yaml | 16 +++ .../notes/bug-1885753-51df25f3ff1d9ae8.yaml | 6 ++ .../notes/bug-1889936-78d6853b5212b8f1.yaml | 5 + .../notes/bug-1896125-b17a4d12730fe493.yaml | 7 ++ .../notes/bug-1901207-13762f85b8a04481.yaml | 7 ++ .../notes/bug-1901654-69b9f35d11cd0c75.yaml | 10 ++ 25 files changed, 382 insertions(+), 123 deletions(-)

1 0

swift 2.25.2 (ussuri)
by no-reply＠openstack.org 01 Sep '21

01 Sep '21

We are thrilled to announce the release of: swift 2.25.2: OpenStack Object Storage This release is part of the ussuri stable release series. The source is available from: https://opendev.org/openstack/swift Download the package from: https://tarballs.openstack.org/swift/ Please report issues through: https://bugs.launchpad.net/swift/+bugs For more details, please see below. Changes in swift 2.25.1..2.25.2 ------------------------------- 29eefcd0d Dep's should be restricted by upper-constraints 18d8c15f9 symlink: Ensure headers are returned as a list on py3 4a38f62b2 tempurl: Fix PUT upload to temp url on py3 e69b3c60f Avoid loops when gathering container listings from shards 18cdf9b56 Populate shrinking shards with shard ranges learnt from root 5791cec31 Use swiftclient Connections in sharding probe tests 959a98d7b Refactor audit shard tests 760528cb7 container-sharding: Stable overlap order 94346b134 Address a sharder/replicator race eef68d69c Identify deleted shards as shards f4061c043 swift-container-info: Show shard ranges summary 8588296dc Don't auto-create shard containers 0da122383 Latch shard-stat reporting d1b997889 py27: Suppress UnicodeWarnings in ShardRange setters 1b3b77696 sharding: Add probe test that exercises swift-manage-shard-ranges 9491d73a6 Give probe tests a second chance to pass 69c93dcb1 Bump up probe test timeout ebc023f53 Bump up timeouts for DSVM and probe test jobs 067328c8d Give unit tests a second chance to pass 2e487b42d s3-tests: Use my s3compat fork instead 9820aad4a s3-tests: Only try to copy outputs when there *are* outputs a357fc66a sharding: Don't inject shard ranges when user says quit 69a95a52a Prevent upgrading to pip 21+ b6d320b1d Memcached client TLS support 41bec521f [stable-only] Cap bandit to 1.6.2 Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 + .zuul.yaml | 6 +- bin/swift-container-info | 4 + bin/swift-container-sharder | 4 + etc/memcache.conf-sample | 22 + etc/proxy-server.conf-sample | 4 + swift/cli/info.py | 46 +- swift/cli/manage_shard_ranges.py | 4 +- swift/common/memcached.py | 16 +- swift/common/middleware/memcache.py | 16 +- swift/common/middleware/symlink.py | 2 +- swift/common/middleware/tempurl.py | 2 +- swift/common/utils.py | 53 +- swift/common/wsgi.py | 3 +- swift/container/backend.py | 112 ++++- swift/container/server.py | 44 +- swift/container/sharder.py | 143 ++++-- swift/proxy/controllers/container.py | 18 +- test-requirements.txt | 2 +- test/probe/test_sharder.py | 292 ++++++++++- test/unit/cli/test_info.py | 89 +++- test/unit/cli/test_manage_shard_ranges.py | 21 +- test/unit/common/middleware/test_memcache.py | 21 + test/unit/common/middleware/test_symlink.py | 1 + test/unit/common/middleware/test_tempurl.py | 36 ++ test/unit/common/test_memcached.py | 14 + test/unit/common/test_utils.py | 37 +- test/unit/container/test_backend.py | 221 +++++++- test/unit/container/test_server.py | 110 ++-- test/unit/container/test_sharder.py | 615 ++++++++++++++++------- test/unit/proxy/controllers/test_container.py | 162 +++++- tools/playbooks/common/install_dependencies.yaml | 6 +- tox.ini | 24 +- 36 files changed, 1737 insertions(+), 423 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 085bd3b0e..a9d3a09e0 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -24 +24 @@ keystonemiddleware>=4.17.0 # Apache-2.0 -bandit>=1.1.0 # Apache-2.0 +bandit>=1.1.0,<=1.6.2 # Apache-2.0

1 0

python-zunclient 4.3.0 (xena)
by no-reply＠openstack.org 01 Sep '21

01 Sep '21

We enthusiastically announce the release of: python-zunclient 4.3.0: Client Library for Zun This release is part of the xena release series. The source is available from: https://opendev.org/openstack/python-zunclient Download the package from: https://pypi.org/project/python-zunclient Please report issues through: https://bugs.launchpad.net/python-zunclient/+bugs For more details, please see below. Changes in python-zunclient 4.2.0..4.3.0 ---------------------------------------- 7ca6a6b Uncap PrettyTable 6e7e579 setup.cfg: Replace dashes with underscores 6b6c09e Use py3 as the default runtime for tox dc8db03 Add Python3 xena unit tests 49d0e41 Update master for stable/wallaby bbc32db remove unicode from code Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 +- releasenotes/source/conf.py | 14 +++++++------- releasenotes/source/index.rst | 1 + releasenotes/source/wallaby.rst | 6 ++++++ requirements.txt | 2 +- setup.cfg | 8 ++++---- tox.ini | 2 +- 8 files changed, 24 insertions(+), 17 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 165ea57..8f89f34 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ pbr!=2.1.0,>=2.0.0 # Apache-2.0 -PrettyTable<0.8,>=0.7.1 # BSD +PrettyTable>=0.7.1 # BSD

1 0