[SRU] icehouse 2014.1.2 point release

Trove is not covered under the MRE for OpenStack yet.

@jamespage when will this hit t-proposed?

@med hopefully soon - but I have only just finishing reviewing and uploading for Corey.

In the meantime all the pkgs have been built here as well:

  https://launchpad.net/~james-page/+archive/ubuntu/icehouse/+packages

Since a lot of these updates fix security issues, we probably should build them in the security team PPA before copying them -proposed, so we can release them as security updates once the SRU period is over.

ceilometer - CVE-2014-4615
horizon - CVE-2014-3473, CVE-2014-3474, CVE-2014-3475
keystone - CVE-2014-3476, CVE-2014-3520
neutron - CVE-2014-3555, CVE-2014-4615
nova - CVE-2014-3517

Hello Corey, or anyone else affected,

Accepted ceilometer into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/ceilometer/2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Corey, or anyone else affected,

Accepted horizon into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/horizon/1:2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Corey, or anyone else affected,

Accepted glance into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/glance/1:2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Corey, or anyone else affected,

Accepted keystone into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/keystone/1:2014.1.2.1-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Corey, or anyone else affected,

Accepted cinder into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cinder/1:2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Corey, or anyone else affected,

Accepted neutron into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/neutron/1:2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Corey, or anyone else affected,

Accepted nova into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/nova/1:2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Since these are already accepted into -proposed without being built in the security ppa, the security team will do no change rebuilds and issue USNs. Subscribing ubuntu-security.

Hello Corey, or anyone else affected,

Accepted heat into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/heat/2014.1.2-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hi Chris,

Testing of 2014.1.2 from the trusty-proposed repository has completed
successfully.

Thanks,
Corey

This bug was fixed in the package glance - 1:2014.1.2-0ubuntu1

---------------
glance (1:2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (94383db) (LP: #1354159):
    - [5508653] Fix lazy translation UnicodeErrors
    - [94383db] Provide explicit image create value for test_image_paginate case
  * d/p/fix-requirements.patch: Refreshed.
  * d/p/skip-tests.patch: Dropped.
  * d/p/skip-tests-2.patch: Updated description.

  [ James Page ]
  * d/watch: Point to tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Thu, 07 Aug 2014 17:09:28 -0400

The verification of the Stable Release Update for glance has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package horizon - 1:2014.1.2-0ubuntu1

---------------
horizon (1:2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (4a70f4c) (LP: #1354159):
    - [2b9c566] Import translations for Icehouse stable update
    - [015f24c] Fix security group modal header overflow
    - [785a526] Disable broken unit test (related to "Change Password")
    - [eb3a40a] Replace UserManager with None in tests
    - [e66fbc3] Sort security group rules by protocol and port
    - [a855b0c] Avoid AttributeError: SecurityGroup error handle
    - [937436f] adapt to python-novaclient-2.18.0
    - [32a7b71] Fix multiple Cross-Site Scripting (XSS) vulnerabilities.
    - [43ac907] add httplib2 explicitly to requirements.txt
    - [0b2352e] Prevent error message when creating a user
    - [765e6d3] Fix issues with importing the Login form
    - [a29cdbc] Fix formatting of heat exceptions
    - [b527f22] Image uploads should always happen in the background
    - [4a70f4c] Fix the dot overlaps with the table border in Availability Zones table

  [ James Page ]
  * d/watch: Point to tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Fri, 08 Aug 2014 09:50:22 -0400

This bug was fixed in the package ceilometer - 2014.1.2-0ubuntu1

---------------
ceilometer (2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (2b6454f) (LP: #1354159):
    - [e491837] Set python hash seed to 0 in tox.ini
    - [99b7ef8] Update ensure()/reconnect() to catch MessagingError
    - [af1eb64] Sync RPC module from oslo, fixing reconnect failures
    - [47770db] Adds Content-Type to alarm REST notifier
    - [4be8616] Remove low-value logging from publication codepath
    - [096106f] Ensure routing key is specified in the address for a direct producer
    - [2b6454f] remove token from notifier middleware
  * d/p/fix-requirements.patch: Refresh.

  [ James Page ]
  * d/watch: Point to tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Thu, 07 Aug 2014 21:57:17 -0400

This bug was fixed in the package keystone - 1:2014.1.2.1-0ubuntu1

---------------
keystone (1:2014.1.2.1-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (935fd60) (LP: #1354159):
    - [6cbf835] Fix revocation event handling with MySQL
    - [c900a6e] Make test_revoke expiry times distinct
    - [5c89c89] Fix revoking a scoped token from an unscoped token
    - [dfb0ff0] Add a test for revoking a scoped token from an unscoped
    - [317f9d3] Fix revoking domain-scoped tokens
    - [cccc3f3] Correct revocation event test for domain_id
    - [bdb88c6] Fix for V2 token issued_at time changing
    - [0c34e79] Add tests related to V2 token issued_at time changing
    - [8e87504] Don't override tox envdir for pep8
    - [774b6ab] Correct the region table to be InnoDB and UTF8
    - [6f8c444] HEAD responses should return same status as GET
    - [44555e8] Ensure that in v2 auth tenant_id matches trust
    - [2baae78] Do not log 14+ INFO lines on a broken pipe error (eventlet)
    - [cef4fbc] Properly invalidate cache for get_*_by_name methods
    - [e08b62a] Make sure domains are enabled by default
    - [7378512] Block delegation escalation of privilege
    - [935fd60] Encode/Decode LDAP parameters to/from UTF-8
  * d/p/fix-requirements.patch: Refreshed.

  [ James Page ]
  * d/watch: Point to tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Fri, 08 Aug 2014 16:47:10 -0400

This bug was fixed in the package cinder - 1:2014.1.2-0ubuntu1

---------------
cinder (1:2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (00d456b) (LP: #1354159):
    - [a1135b7] Fix solidfire accept_transfer
    - [00b7574] Fixes HP LeftHand driver with Paramiko 1.13.0
    - [22e451b] Set python hash seed to 0 in tox.ini
    - [cd7dd94] Get updated model info on volume transfer
    - [f6df82c] Ensure flushing of IO prior to removing FC device
    - [63ba651] Don't leave snapshots on the floor
    - [c74efd7] Retry lvremove with ignore_suspended_devices
    - [fe37a6e] Remove second get call to list/show volumes
    - [1d80539] Add cinder-manage cmd to update host column
    - [d12c513] Fix host option isn't set when using multiple backend
    - [570c90f] Add the -f option back to lvremove
    - [170632f] Update requirements.txt to disallow alpha libs
    - [04c7431] Allow host config to be overriden in backend
    - [f96e991] Storwize/SVC driver detach volume failed
    - [c4d3c1c] Fix handling multiple WWPNs on preferred FC node
    - [3877a73] vmware: Fix problems with VIM API retry logic
    - [cab4ef6] Specify lld in tgt config backends
    - [d4392f3] Fix retyping volume that has volume type None
    - [d6829c1] Ensure that lun_id is an int
    - [00d456b] GET details REST API next link missing 'details'
  * d/p/fix-requirements.patch: Refreshed.

  [ James Page ]
  * d/watch: Point to tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Fri, 08 Aug 2014 11:21:47 -0400

This bug was fixed in the package neutron - 1:2014.1.2-0ubuntu1

---------------
neutron (1:2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (5db494d) (LP: #1354159):
    - [1d4a3e3] Add dsvm-functional tox env to fix functional job
    - [c19633d] Fix deprecated opt in haproxy driver
    - [2c762be] Add configurable http_timeout parameter for Cisco N1K
    - [9c94d96] Avoid notifying while inside transaction opened in delete_port()
    - [f9379ef] BSN: Remove db lock and add missing contexts
    - [bea1e2d] Set python hash seed to 0 in tox.ini
    - [f427754] Big Switch: Remove consistency hash on full sync
    - [3ad288d] Add -s option for neutron metering rules
    - [231010b] Do not mark device as processed if it wasn't
    - [72edc13] Big Switch: Lock consistency table for REST calls
    - [b65c036] NSX: fix router ports port_security_enabled=False
    - [9dcc476] NSX: Remove unneed call to _ensure_default_security_group
    - [2ce59ec] Added support for NOS version 4.1.0, 5.0.0 and greater
    - [2c4828e] no quota for allowed address pair
    - [46a37e2] NSX: neutron router-interface-add should clear security-groups
    - [5d0d72b] Control update, delete for cisco-network-profile
    - [0459a6a] NSX: return 400 if dscp set for trusted queue
    - [d880134] Fix typo in ml2 configuration file
    - [fb40f65] Register LBaaS resources to quotas engine
    - [0cb4aaa] Make plugin deallocation check optional
    - [478f487] Ensure core plugin deallocation after every test
    - [ea5ecf9] OVS agent: Correct bridge setup ordering
    - [98ef1bc] Fixed dhcp & gateway ip conflict in PLUMgrid plugin
    - [38bf2be] Exit rpc_loop when SIGTERM is recieved in ovs-agent
    - [67ef62d] NSX sync cache: add a flag to skip item deletion
    - [d2c11e5] OFAgent: Avoid processing ports which are not yet ready
    - [c02763a] OFAgent: Fixing lost vlan ids on interfaces
    - [8d56f44] OFAgent: Improve handling of security group updates
    - [63d3a54] OFAgent: Avoid re-wiring ports unnecessarily
    - [8131a2e] Synced jsonutils from oslo-incubator
    - [33992c8] Brocade mechanism driver depends on the brocade plugin templates
    - [1da7abd] ofagent: Fix VLAN usage for TYPE_FLAT and TYPE_VLAN
    - [2a79749] netaddr<=0.7.10 raises ValueError instead of AddrFormatError
    - [45281bb] Brocade mechanism driver should be derived from ML2 plugin base class
    - [3eeda2c] Add missing keyword raise to get_profile_binding function
    - [e517da2] Big Switch: Remove unnecessary initialization code
    - [2f65656] ovs-agent: Ensure integration bridge is created
    - [0324965] remove token from notifier middleware
    - [6d62c91] Big Switch: Add missing data to topology sync
    - [fac71fe] Added missing core_plugins symbolic names
    - [505f902] Big Switch: Catch exceptions in watchdog thread
    - [ac90f9b] Segregate the VSM calls from database calls in N1kv plugin
    - [86e4b80] Fix network profile subtype validation in N1kv plugin
    - [24f2460] ofagent: Add a missing push_vlan action
    - [50408e6] OFA agent: use hexadecimal IP address in tunnel port name
    - [f0af041] Big Switch: Call correct method i...

This bug was fixed in the package nova - 1:2014.1.2-0ubuntu1

---------------
nova (1:2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (c545075) (LP: #1354159):
    - [1408081] Mask block_device_info auth_password in virt driver debug logs
    - [8d7de91] VMware: Add check for datacenter with no datastore
    - [0d9419f] Fixes hyper-v volume attach when host is AD member
    - [1469c8e] Prevent clean-up of migrating instances on compute init
    - [0617601] VMware: use default values in get_info() when properties are missing
    - [c8df2ac] Set python hash seed to 0 in tox.ini
    - [7de0132] Do not pass instances without host to compute API
    - [811cab7] Do not process events for instances without host
    - [0e1580e] Attach/detach interface to paused instance with affect live flag
    - [397de7b] Turn periodic tasks off in all unit tests
    - [9f59ca7] Avoid possible timing attack in metadata api
    - [72cc37d] Handle service creation race by service workers
    - [af7ba1c] Fixes rbd backend image size
    - [a8b52c0] VMware: Fix race in spawn() when resizing cached image
    - [132d5a2] Avoid re-adding iptables rules for instances that have disappeared
    - [0142324] VMware: Fix fake raising the wrong exception in _remove_file
    - [b08f62a] Fix security group list when not defined for an instance
    - [f598864] libvirt: Make nwfilter driver use right filterref
    - [da777f1] Make sure domain exists before referencing it
    - [8d260a8] Scheduler: enable scheduler hint to pass the group name
    - [4c551d9] Instance groups: add method get_by_hint
    - [9f5d2a6] Avoid referencing stale instance/network_info dicts in firewall
    - [e43c43e] Neutronv2 api does not support neutron without port quota
    - [120ecf3] Fix the wrong dest of 'vlan' option and add new 'vlan_start' option
    - [f864329] Use default rpc_response_timeout in unit tests
    - [4aeefa7] Network: ensure that ports are 'unset' when instance is deleted
    - [a365897] Save connection info in libvirt after volume connect
    - [d1c5736] Cleanup allocating networks when InstanceNotFound is raised
    - [2f40191] Failure during termination should always leave state as error()
    - [485f25d] Use no_timer_check with soft-qemu
    - [0994254] Use correct project/user for quotas
    - [4c6b0f7] Revert "Remove broken quota-classes API"
    - [96212b1] libvirt: Refresh volume connection_info after volume snapshot
    - [c104f2f] Set the volume access mode during volume attach
    - [c754305] VCDriver - Ignore host in Maintenance mode in stats update
    - [4820dbb] VMware: Fix memory leaks caused by caches
    - [0252c87] Include pending task in log message on skip sync_power_state
    - [9095bcf] Fixes Hyper-V iSCSI target login method
    - [17e71f7] VMware: prevent image snapshot if no root disk defined
    - [c545075] versions API: ignore request with a body
  * d/p/fix-requirements.patch: Refreshed.
  * d/p/Fixes-rdb-backend-image-size.patch: Dropped. Fixed upstream in 2014.1.2.

  [ James Page ]
  * d/watch: Point to tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Thu, ...

This bug was fixed in the package heat - 2014.1.2-0ubuntu1

---------------
heat (2014.1.2-0ubuntu1) trusty; urgency=medium

  [ Corey Bryant ]
  * Resynchronize with stable/icehouse (6facf30) (LP: #1354159):
    - [48ed483] Stop periodic watcher tasks before deleting stack
    - [a855f5d] Sync threadgroup module from the oslo stable branch
    - [bd4ed52] Move novaclient exceptions to heat.tests.v1_1.fakes
    - [2db68e5] Pass the parent's registry into child stacks
    - [57f8eaa] Fix String Parameter Receive a unicode
    - [2aee296] Allow metadata updates to provider resources
    - [a39ee7c] Do no re-validate parameters for existing stacks
    - [aa7c030] Do not validate constraints in schema constructor
    - [6facf30] Ensure routing key is specified in the address for a direct producer

  [ James Page ]
  * d/watch: Use tarballs.openstack.org for release artifacts.
 -- Corey Bryant <email address hidden> Fri, 08 Aug 2014 08:12:40 -0400