[Release] pagure 4.0.2 and 4.0.3
by Pierre-Yves Chibon
Good Morning Everyone,
Yesterday I cut two new releases of pagure: 4.0.2 and 4.0.3.
These are important releases, 4.0.2 addresses a CVE that was reported earlier
in the day, it's not a "sky is falling" type of CVE but still nicer to have it
fixed.
Basically, anyone with an API key that allowed to modify project could create
git branches on any project.
This has been mitigated by having a dedicated ACL for creating git branches. So
if you have an API token that you use to create git branches you will need to
get a new one with this new ACL.
4.0.3 is correcting bugs introduced by backporting some more fixes to 4.0.2 than
just this CVE but not backporting enough, so 4.0.3 basically makes 4.0.2 work.
Here are the corresponding changelogs for these releases:
4.0.3 (2018-05-14)
------------------
- Backport utility method from the 4.1 code to fix the 4.0.2 release
4.0.2 (2018-05-14)
------------------
.. note:: This release fixes CVE-2018-1002151
- Fix showing the list of issues in a timely fashion (Patrick Uiterwijk)
- Fix stats for commits without author (Lubomír Sedlář)
- Explain how to fetch a pull request locally and some grammar fixes
(Todd Zullinger)
- Drop the constraint on the requirement on straight.plugin but document it
- Fix the requirement on bcrypt, it's optional
- Make API endpoint for creating new git branch have its own ACL
fixes CVE-2018-1002151
All known pagure instance have been upgraded to 4.0.3
Happy coding,
Pierre
6 years
FBR: Change to category based crawling
by Adrian Reber
As discussed previously I would like to change the crawler to crawl each
category separately. The goal is to reduce the load on the database by
distributing the crawling better over the whole day and to reduce the
chance of mirrors being disabled because of the high database load.
This should also remove the need for mirror administrators to create
multiple hosts in MirrorManager to work around the 4 hours timeout per
host.
Attached is my patch. Please +1. This affects mm-crawler01 and
mm-crawler02.
Adrian
6 years
Bodhi stakeholders' meeting
by Randy Barlow
Greetings!
I would like feedback from you about the usefulness and/or
format/schedule of the Bodhi stakeholders' meeting.
I've been holding this meeting about once every 4 weeks. It started off
pretty well with lots of seemingly interested participation, but over
time it seems that fewer people attend. I would like to identify why the
attendance is lower so I can adjust to it. Here are some thoughts:
Is the meeting too often?
=========================
I've thought perhaps about reducing it to once every 3 months instead of
once every 4 weeks. Perhaps this way there would be more to discuss?
Is the time of the meeting bad?
===============================
I know it is a bad time for our west coast North America friends. Is it
also a bad time for others? I could try to move it to be later in the
day if that would help.
Is it boring?
=============
Is the meeting just not relevant to you? Does it lack purpose?
Other
=====
Other thoughts?
Proposal
========
I've been considering reducing it to once every 3 months and making it
later in the day for west coast people. I've also considered if it would
be good to make it be part of the weekly infrastructure meeting on that
3 month schedule (i.e., just have an agenda item once every 3 months to
focus on Bodhi in the established infra meeting).
Thoughts on this?
6 years
Slow Pagure.io
by Vít Ondruch
Hi,
Pagure.io is so slow for me to that point that I simple can't open
ticket to report it. IOW, I am trying to load
https://pagure.io/fedora-infrastructure/issues in my browser and it does
not work, it just waits for response :/
~~~
$ curl https://pagure.io/fedora-infrastructure/issues -o /dev/null
% Total % Received % Xferd Average Speed Time Time Time
Current
Dload Upload Total Spent Left
Speed
100 107k 100 107k 0 0 30755 0 0:00:03 0:00:03 --:--:--
30764
$ traceroute pagure.io
traceroute to pagure.io (152.19.134.147), 30 hops max, 60 byte packets
1 _gateway (192.168.0.1) 3.274 ms 4.385 ms 4.320 ms
2 * * *
3 ip-86-49-1-161.net.upcbroadband.cz (86.49.1.161) 22.197 ms 22.094
ms 22.066 ms
4 cz-brn-pop40-ra2-vla2191.net.upc.cz (84.116.220.246) 121.057 ms
124.204 ms 124.182 ms
5 cz-brn-pop40-ra1-vla2110.net.upc.cz (84.116.221.41) 126.583 ms
126.456 ms 126.449 ms
6 cz-prg01a-ra4-vla2109.net.upc.cz (84.116.221.37) 126.402 ms
111.096 ms 116.115 ms
7 de-fra04a-rc1-ae33-0.aorta.net (84.116.135.5) 110.803 ms 137.982
ms 137.875 ms
8 de-fra04d-rc1-ae26-0.aorta.net (84.116.138.238) 137.842 ms 137.777
ms 137.724 ms
9 * * *
10 us-nyc01b-rd2-ae9-0.aorta.net (84.116.140.170) 138.336 ms 138.298
ms 115.267 ms
11 us-nyc01b-ri2-ae3-0.aorta.net (84.116.137.194) 114.465 ms 112.698
ms 110.019 ms
12 nyc2-brdr-01.inet.qwest.net (63.235.40.165) 136.127 ms 136.117 ms
136.086 ms
13 dca-edge-23.inet.qwest.net (67.14.6.158) 159.519 ms 159.547 ms
161.527 ms
14 65.120.78.78 (65.120.78.78) 136.700 ms 135.992 ms 135.886 ms
15 uncmanning-to-rtp-ip-asr-gw.ncren.net (128.109.19.90) 132.844 ms
137.504 ms 136.760 ms
16 core-m-v1214.net.unc.edu (152.19.255.66) 135.283 ms 136.117 ms
138.533 ms
17 152.19.255.70 (152.19.255.70) 128.737 ms 128.655 ms 128.518 ms
18 152.19.255.166 (152.19.255.166) 147.476 ms 132.950 ms 137.336 ms
19 vmhost1-rsa.fedora.ibiblio.org (152.19.134.147) 126.626 ms !X
130.794 ms !X 121.215 ms !X
~~~
The strange thing is that the pagure title page or the project overview
can be loaded just fine and neither the tools above shows any suspicious
behavior to me.
Vít
6 years
Meeting Agenda Item: Introduction Alexander Marek
by Alexander Marek
To whom this may concern,
My name is Alex and I'm studying Cybersecurity, with plans to go into the
IT/Information Security field. Recently I've been studying for my Red Hat
Certified System Administrator certification and hope I can bring my new
skillset to help benefit my favourite distribution. I plan to pass my
Offensive Security Certified Professional certification by the end of
August. Alongside this, I'm currently taking college courses part time.
Hopefully I can be useful, and I'm looking forward to seeing what the
Fedora Project has in store!
Regards,
Alexander Marek
IRC Handle: apmarek
6 years
Introduction
by Alexander Marek
To whom this may concern,
My name is Alex and I'm studying Cybersecurity, with plans to go into the
IT/Information Security field. Recently I've been studying for my Red Hat
Certified System Administrator certification and hope I can bring my new
skillset to help benefit my favourite distribution. I plan to pass my
Offensive Security Certified Professional certification by the end of
August. Alongside this, I'm currently taking college courses part
time.Hopefully I can be useful, and I'm looking forward to seeing what the
Fedora Project has in store!
Regards,
Alexander Marek
6 years
