OpenStack Security Notes

Bug #1823200
Comment #36

Comment 36 for bug 1823200

Revision history for this message

Brian Rosmaita (brian-rosmaita) wrote on 2020-05-28:

#36

According to the stable branch policy [0], "OpenStack Vulnerability Management will be reasonable efforts only" for branches in Extended Maintenance mode.

The following cinder and os-brick branches are in EM mode:
- ocata
- pike
- queens
- rocky

I think it is reasonable to push this fix as far back as Queens.

Ocata will take unreasonable effort. The requirements team was able to make some changes to get their Ocata gate moving again so they could push some requirements changes to hopefully unblock everyone else, but it hasn't worked for cinder [1] and os-brick [2], at least, and there seems to be a consensus building on the mailing list that Ocata needs to go EOL [3]. So I will declare right now we do not need to prepare an Ocata patch for this bug.

I'm willing to hear opinions about Pike (my personal opinion is that it is *not* reasonable effort). Right now, the cinder [4] and os-brick [5] gates are broken. The word on the street is that it can be fixed by modifying some of the test jobs to native zuul v3 jobs, but I haven't looked into it because the last change to cinder:stable/pike was 6 months ago, and the last change to os-brick:stable/pike was over 1 year ago. I am dubious that we will get the cinder/os-brick Pike gates working before 3 June (the PTG is next week, which basically leaves us tomorrow to get the gates fixed, and I would rather spend the time reviewing and getting the patches in place for Queens through master (Victoria). Further, there has not been a lot of interest in Pike (as evidenced by lack of backport activity), so I think it makes sense not to put effort into making a patch available for Pike.

So, to be completely clear:
* Ocata - no patch
* Pike - I'm inclined to say no patch, but am interested in other opinions.
* Queens through Victoria - we should have patches available

[0] https://docs.openstack.org/project-team-guide/stable-branches.html#extended-maintenance
[1] https://review.opendev.org/730938
[2] https://review.opendev.org/#/c/731193/
[3] http://lists.openstack.org/pipermail/openstack-discuss/2020-May/015112.html
[4] https://review.opendev.org/730959
[5] https://review.opendev.org/731196

According to the stable branch policy [0], "OpenStack Vulnerability Management will be reasonable efforts only" for branches in Extended Maintenance mode.

The following cinder and os-brick branches are in EM mode:
- ocata
- pike
- queens
- rocky

I think it is reasonable to push this fix as far back as Queens.

Ocata will take unreasonable effort.  The requirements team was able to make some changes to get their Ocata gate moving again so they could push some requirements changes to hopefully unblock everyone else, but it hasn't worked for cinder [1] and os-brick [2], at least, and there seems to be a consensus building on the mailing list that Ocata needs to go EOL [3].  So I will declare right now we do not need to prepare an Ocata patch for this bug.

I'm willing to hear opinions about Pike (my personal opinion is that it is *not* reasonable effort).  Right now, the cinder [4] and os-brick [5] gates are broken.  The word on the street is that it can be fixed by modifying some of the test jobs to native zuul v3 jobs, but I haven't looked into it because the last change to cinder:stable/pike was 6 months ago, and the last change to os-brick:stable/pike was over 1 year ago.  I am dubious that we will get the cinder/os-brick Pike gates working before 3 June (the PTG is next week, which basically leaves us tomorrow to get the gates fixed, and I would rather spend the time reviewing and getting the patches in place for Queens through master (Victoria).  Further, there has not been a lot of interest in Pike (as evidenced by lack of backport activity), so I think it makes sense not to put effort into making a patch available for Pike.

So, to be completely clear:
* Ocata - no patch
* Pike - I'm inclined to say no patch, but am interested in other opinions.
* Queens through Victoria - we should have patches available