14:30:39 #startmeeting Pulp Triage 2016-04-22 First pulpbot test 14:30:40 Meeting started Fri Apr 22 14:30:39 2016 UTC and is due to finish in 60 minutes. The chair is mhrivnak. Information about MeetBot at http://wiki.debian.org/MeetBot. 14:30:40 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 14:30:40 The meeting name has been set to 'pulp_triage_2016_04_22_first_pulpbot_test' 14:30:42 !pulptriage join 14:30:42 #info %s has joined triage 14:30:44 !pulptriage join 14:30:44 #info %s has joined triage 14:30:46 #info %s has joined triage 14:30:46 !pulptriage join 14:30:58 !pulptriage join 14:30:58 #info %s has joined triage 14:31:01 !pulptriage join 14:31:01 #info %s has joined triage 14:31:01 #info %s has joined triage 14:31:01 !pulptriage join 14:31:04 yes! 14:31:10 #info %s has joined triage 14:31:10 !pulptriage join 14:31:14 Are these joins working? 14:31:17 !join 14:31:17 Error: You don't have the admin capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified. 14:31:18 mhrivnak you may not issue bot commands in this chat! 14:31:20 Yessir 14:31:26 Great! 14:31:44 !next 14:31:45 OSTree Support Issue #1773 [NEW] (unassigned) - Priority: Normal | Severity: Medium 14:31:46 No "unprotected/http" option available for ostree repos - http://pulp.plan.io/issues/1773 14:31:47 7 issues left to triage 14:31:50 I'm not sure how to give feedback on that without being super spammy. Maybe just be super spammy? 14:32:01 Topic didn't change, I'm a liar. 14:32:05 I'll fix that. 14:32:06 :) 14:32:47 partha responded to that 14:33:02 jortel, thoughts? 14:33:41 the latest comment is still quite non-conclusive. 14:33:51 "might need" 14:34:12 Well since kickstarts today don't really do https, I think it's reasonable to expect we _will_ need http 14:34:14 * jortel looking, mhrivnak 14:34:50 jcline, do kickstart trees not come from the CDN? I don't know enough about them to understand what you mean there. 14:34:55 mhrivnak: sorry, late for triage 14:35:00 There's a long email thread about it also. 14:35:36 smyers: I don't really know either, but I've been told kickstart trees need to be http by people. *shrugs* 14:35:45 One of the key questions is if this can be done with apache config to just make all of them available via http, or if we might need to do per-repo selection for http like we do with pulp_rpm. 14:35:51 mhrivnak: saw that. best I can tell, it's still not settled 14:36:01 It's pretty odd and I've not looked into why that's what people told me 14:36:03 !pulptriage join 14:36:03 #info %s has joined triage 14:36:08 jortel, my read is similar. 14:36:23 jortel, punt another week? 14:36:25 weve bumped this a few times now, i think we should do normal/low and raise priority later if we need to 14:36:27 mhrivnak: yes 14:36:53 I don't have a problem with bumping it again, frankly, if we need more info 14:36:58 There's active discussion happening about it, so I'm inclined to let that go another week. 14:37:14 I don't have a problem bumping it either 14:37:22 objections? asmacdo does that work for you? 14:37:32 !skip 14:37:33 Pulp Issue #1839 [NEW] (unassigned) - Priority: Normal | Severity: Medium 14:37:34 /login/ is not NFS-safe - http://pulp.plan.io/issues/1839 14:37:35 6 issues left to triage 14:37:38 And just a reminder that pulpbot will not (yet) control redmine for you 14:37:46 asmacdo, don't abuse pulpbot. you are not the meeting chair. 14:37:48 * mhrivnak wags a finger at asmacdo 14:38:06 oh sorry, i thought that would propose skip not actually skip 14:38:16 Is !skip in the etherpad? :) 14:38:26 Stick to the etherpad. 14:38:32 mhrivnak, I can manage the topic for you if you'd like. 14:38:53 smyers, works for me. :) 14:40:14 This does look legit. 14:40:24 yep 14:40:29 agreed 14:40:37 Is sn.dat being created by pulp, or openssl? 14:40:43 pulp 14:40:58 So it would actually be trivial to use the db instead? 14:41:11 Probably 14:41:12 yes 14:41:22 I think you can tell openssl to auto-increment it, but we can just not do that 14:41:49 So the severity is low? 14:41:52 any number of solutions would be fine. we don't impl CRL so the serial number really is not that important. 14:42:03 Impact-wise, this only affects users who run the REST API on multiple machines. 14:42:24 right 14:42:40 normal / low ? 14:42:48 That's what I was thinkin' 14:42:51 works for me 14:42:54 +1 14:42:59 +1 14:43:04 last call 14:43:05 fine with me 14:43:15 !next 14:43:16 Python Support Issue #1840 [NEW] (unassigned) - Priority: Normal | Severity: Medium 14:43:17 Proxy feature not working in pulp_python plugin - http://pulp.plan.io/issues/1840 14:43:18 5 issues left to triage 14:43:45 looks like we can close 14:43:55 close it 14:44:11 notabug? worksforme? 14:44:15 * asmacdo resists typing !close 14:44:20 * smyers thinks notabug 14:44:28 Yeah 14:44:29 +1 to notabug 14:44:30 notabug 14:44:31 Will close as notabug 14:44:33 !next 14:44:34 Pulp Issue #1847 [NEW] (unassigned) - Priority: Normal | Severity: Medium 14:44:35 last_unit_added is not added in mongo repo collection records - http://pulp.plan.io/issues/1847 14:44:36 4 issues left to triage 14:45:41 Similar to bmbouter 's question, it's not clear to me that this is a bug. It looks a bit like a new feature request. 14:46:08 I agree and the issue that it was blocking used what I suggested in comment 3 14:46:11 The model defines the field she's talking about 14:46:31 oh, it does seem to exist. 14:46:39 Surprise field! :) 14:46:47 it's mentioned in our rest api docs too. 14:46:51 oof 14:46:53 ok then this is legit 14:46:57 Definitely looks like there's a work-around, but sounds like a bug to me 14:47:01 normal / low ? 14:47:08 smyers, +1 14:47:21 yeah 14:47:31 what about normal / normal? a user may rely on this 14:47:47 the last time a unit was added to the db could be an important integration point 14:47:48 Yeah, good call. It's in the docs, it should work 14:47:51 +1 to normal/normal 14:47:53 I like normal/medium. 14:47:54 +1 14:47:56 last call 14:47:59 yes normal/medium 14:48:01 Fine with me 14:48:07 !next 14:48:07 fine 14:48:08 Pulp Issue #1851 [NEW] (unassigned) - Priority: Normal | Severity: Medium 14:48:09 Pulp can't handle special characters in password - http://pulp.plan.io/issues/1851 14:48:10 3 issues left to triage 14:48:45 I'm guessing this password is for a proxy? 14:49:14 or it could be for basic auth against the remote feed. 14:49:27 Yeah, it's gotta some place where we need to use the password, and not just verify it 14:49:37 although it's reported against pulp 2.6, so probably it's proxy auth. 14:49:47 That's still a surprise to me. base64 all the things 14:49:52 I don't think we had basic auth for the feed back then, right? 14:50:12 let's ask for more details 14:50:15 could it be misfiled 14:50:17 ? 14:50:27 It could. 14:50:35 Either way, it's still a bug. 14:50:36 agree with dkliban. 14:51:13 I think more info could help, but we can probably fix this now with the info that's there. 14:51:16 Do we need more detail to triage it? Or to fix it? 14:51:20 And whatever password field it was for they should all be handled the same 14:51:37 I think we can triage with the info we have, but more info might help to fix it. 14:51:43 mhrivnak: agreed 14:51:49 normal/normal 14:51:53 I agree, and think probably prio normal, sev med 14:52:03 that's what i meant :) 14:52:09 *highfive* 14:52:14 other thoughts? 14:52:15 last call 14:52:27 !next 14:52:28 Puppet Support Issue #1853 [NEW] (unassigned) - Priority: Normal | Severity: Medium 14:52:29 pulp-puppet-module-builder should not overwrite existing module files - http://pulp.plan.io/issues/1853 14:52:30 2 issues left to triage 14:54:28 speechless? :) 14:54:31 mhrivnak, can you provide a link to the downstream report? 14:54:43 asmacdo, it's linked from the issue. 14:54:45 asmacdo: bugzilla link 14:54:49 That behavior is what I would expect to happen generically from a thing that builds a thing 14:54:50 asmacdo: you have to be logged in 14:55:03 Yeah. 14:55:05 smyers, I had the same thought. 14:55:06 gotcha 14:55:11 I think it's probably low priority, low severity, but I have some ideas on how to help it out 14:55:28 Mainly just add a flag to not overwrite files without prompting 14:55:32 Agreed 14:56:06 agreed 14:56:08 proposed: low/low 14:56:10 last call 14:56:17 +1 14:56:32 Oh, a quick note about pulpbot, my math might be off by one on the "issues left to triage counter" :D 14:56:38 !next 14:56:40 Pulp Issue #1854 [ASSIGNED] (rbarlow) - Priority: Normal | Severity: Medium 14:56:41 CVE-2016-3696 pulp: Leakage of CA key in pulp-qpid-ssl-cfg - http://pulp.plan.io/issues/1854 14:56:42 1 issues left to triage 14:56:59 It's assigned and being worked on 14:57:18 Leave it the way it is and mark it triaged? 14:57:22 +1 14:57:29 +1 14:57:53 or change to high/high? If it's worth working on immediately, seem like it should be high priority? 14:58:32 Is it reasonable to default to high priority for security issues? 14:58:33 mhrivnak, high priority will put it on QE radar, 14:58:34 I don't have an opinion one way or the other since it's not going to change how we respond to it 14:59:28 high does seem like a reasonable default for security issues. 14:59:40 proposed: high/high 14:59:45 last call 14:59:56 i think high/med 15:00:21 its important bc security, but its not a severe sec bug 15:00:25 that's reasonable. 15:00:53 srt labeled it low impact, even, but I'm happen with medium 15:00:55 happy 15:01:14 https://access.redhat.com/security/cve/CVE-2016-3696 15:01:15 proposed: high/med 15:01:15 Title: CVE-2016-3696 - Red Hat Customer Portal (at access.redhat.com) 15:01:22 last call 15:01:53 * mhrivnak wonders what will happen with the next command 15:01:54 !next 15:01:54 No more issues to triage. 15:02:00 !end 15:02:00 #endmeeting