Navigation Menu

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bodhi2 no longer restricts changes to Security Response bugs (Regression) #368

Closed
thoger opened this issue Aug 26, 2015 · 7 comments
Closed

Bodhi2 no longer restricts changes to Security Response bugs (Regression) #368

thoger opened this issue Aug 26, 2015 · 7 comments
Assignees
@lmacken
Labels
API Issues related to Bodhi's REST API Critical We can't go on living in this sqalor, drop everything and fix it!

Comments

@thoger
Copy link

thoger commented Aug 26, 2015

Bodhi2 lost all special handling of security bugs ("Security Response" BZ product, "vulnerability" component) that was implemented in Bodhi1. These are differences from the standard handling I can remember, hopefully not missing anything important. Bodhi1 code should serve as authoritative reference.

  • Bodhi should only add comments to Security Response bugs when update is pushed to stable. No comments are expected to be added when updates are submitted or pushed to testing.
  • Bodhi should never change Security Response bugs status - no change to ON_QA, no close on push to stable.
  • Bodhi should never change content of the Fixed In Version field.

Basically, Bodhi is only expected to add comment when update is pushed to stable and do no other changes to the bugs.

Please handle this as regression that should be corrected ASAP.

Example of bug changes Bodhi should not be doing:
https://bugzilla.redhat.com/show_bug.cgi?id=1254547#c5
@vdanen
Copy link

vdanen commented Aug 26, 2015

Just adding that this is really important to Product Security and is a severe regression for us.

@ralphbean ralphbean added Critical We can't go on living in this sqalor, drop everything and fix it! API Issues related to Bodhi's REST API labels Aug 26, 2015
@lmacken
Copy link
Contributor

lmacken commented Aug 26, 2015

Working on a fix for this now.

From what I can tell from the bodhi1 code (and bodhi2), it will actually close the Security Response parent bugs if all of the bugs it dependson are closed and the bug is not NEW. Do you still want this behavior?

lmacken added a commit that referenced this issue Aug 26, 2015
@lmacken
Don't comment on or modify Security Response bugs for updates in test…
1b72609 
…ing.

This resolves part of issue #368
@lmacken lmacken mentioned this issue Aug 26, 2015
Merged
@lmacken
Copy link
Contributor

lmacken commented Aug 26, 2015

So with the above patch, I think bodhi2 should have the same behavior as bodhi1.

Here is the logic around closing security bugs, which is the same from bodhi1. https://github.com/fedora-infra/bodhi/blob/develop/bodhi/models/models.py#L1115-L1146

@thoger
Copy link
Author

thoger commented Aug 26, 2015

From what I can tell from the bodhi1 code (and bodhi2), it will actually close the Security Response parent bugs if all of the bugs it dependson are closed and the bug is not NEW. Do you still want this behavior?

Those bugs are not really expected to be in any other state than NEW. Hence the code was rarely used and I'd say to not add it to Bodhi2.

@lmacken
Copy link
Contributor

lmacken commented Aug 26, 2015

Okay, cool. I'll remove it.

lmacken added a commit that referenced this issue Aug 26, 2015
@lmacken
Only close the security tracking bugs, not the parent Security Respon…
6983bc1 
…se ones.

#368 (comment)
@lmacken
Copy link
Contributor

lmacken commented Aug 27, 2015

Okay, this fix has been deployed to production. Hopefully it should only comment on Security Response when updates hit stable. Please re-open if this is not the case. Thanks!

@lmacken lmacken closed this as completed Aug 27, 2015
@thoger
Copy link
Author

thoger commented Aug 27, 2015

Previous comment suggests the fix is in production, however I just noticed the following change done when package was pushed to stable:

https://bugzilla.redhat.com/show_bug.cgi?id=1256746#c3

Fixed In Version field was updated and bug CLOSED:NEXTRELEASE.

lmacken added a commit that referenced this issue Sep 9, 2015
@lmacken @ralphbean
Don't comment on or modify Security Response bugs for updates in test…
ae3fd8e 
…ing.

This resolves part of issue #368
lmacken added a commit that referenced this issue Sep 9, 2015
@lmacken @ralphbean
Only close the security tracking bugs, not the parent Security Respon…
b5be729 
…se ones.

#368 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lmacken lmacken

Labels
API Issues related to Bodhi's REST API Critical We can't go on living in this sqalor, drop everything and fix it!
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@lmacken @ralphbean @vdanen @thoger