IRC logs for #cip for Thursday, 2021-10-14

« Wednesday, 2021-10-13 Index Friday, 2021-10-15 »
*** rajm <rajm!~robert@cpc126990-macc4-2-0-cust43.1-3.cable.virginm.net> has joined #cip06:25
*** toscalix_ <toscalix_!~agustinbe@174.red-79-144-82.dynamicip.rima-tde.net> has joined #cip08:14
*** rajm <rajm!~robert@cpc126990-macc4-2-0-cust43.1-3.cable.virginm.net> has quit IRC09:42
*** uli <uli!~uli@55d41653.access.ecotel.net> has joined #cip11:16
*** masami <masami!~masami@FL1-122-133-108-128.tky.mesh.ad.jp> has joined #cip11:51
*** rajm <rajm!~robert@cpc126990-macc4-2-0-cust43.1-3.cable.virginm.net> has joined #cip12:45
*** josiah|2 <josiah|2!~kvirc@pool-100-16-211-90.bltmmd.fios.verizon.net> has joined #cip12:59
*** iwamatsu` is now known as iwamatsu13:00
*** jki <jki!~jki@88.215.84.132> has joined #cip13:00
jki#startmeeting CIP IRC weekly meeting13:01
brloggerMeeting started Thu Oct 14 13:01:19 2021 UTC and is due to finish in 60 minutes.  The chair is jki. Information about MeetBot at http://wiki.debian.org/MeetBot.13:01
brloggerUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.13:01
brloggerThe meeting name has been set to 'cip_irc_weekly_meeting'13:01
*** brlogger changes topic to " (Meeting topic: CIP IRC weekly meeting)"13:01
*** pavel <pavel!~pavel@88.103.239.87> has joined #cip13:01
jkihi all, please say hello if you are around13:01
pavelhi13:01
ulihello13:01
iwamatsuhi13:01
masamihello13:01
josiah|2hi13:01
alicefo/13:01
patersonc[m]hello13:02
josiah|2Hi13:02
jkifull house, great13:02
jki#topic AI review13:02
*** brlogger changes topic to "AI review (Meeting topic: CIP IRC weekly meeting)"13:02
jki1. Combine root filesystem with kselftest binary - iwamatsu & alicef13:03
alicefhi o/13:03
iwamatsuno update13:03
alicefthe kernelci patch for using the gz isar-core-cip is almost finished and will be merged probably this week13:03
patersonc[m]\o/13:04
jkigreat!13:04
iwamatsuyey13:04
alicefdepend from how much it will take other pull request to be checked13:04
alicefthat are conflicting with our pull request13:04
alicefthis is only for managing gz compression13:05
alicefso I'm currently starting to test the pull request for implement isar-core-cip13:06
aliceffor check that everything work correctly with kernelci13:06
alicefand maybe do some changes depending from the result13:07
jkivery good news13:08
jki2. Document new LAVA domains in wiki - patersonc13:08
patersonc[m]Done13:08
jki\o/13:08
jki3. Look into S3 artifact upload issues - patersonc13:09
patersonc[m]Not done13:09
jkiany new AIs?13:10
alicefone13:10
jki313:10
jkigo ahead!13:10
aliceflooks like lava is using jquery 3.4.0 and could be affected by XSS CVE-2020-1102313:11
alicefI'm trying to fix it upstream but I have no replay from lavasoftware people13:12
jkiuh13:12
aliceffor getting permission to send merge request13:13
jkido we have an idea where this could be affecting security?13:13
aliceflava.ciplatform.org is using lava13:13
jkii know13:14
alicefGKernelCI is also13:14
alicefI'm currently working on patching GKernelCI and trying to send the patch upstream if something come out13:15
jkiquestion is, e.g., if only authorized users to exploit that or any visitor13:15
*** pav3l <pav3l!~user@37-48-8-177.nat.epc.tmcz.cz> has joined #cip13:16
aliceffrom the CVE: passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.13:16
alicefis affecting jquery equal to 1.0.3 and before 3.5.013:16
jkishould we ping someone from kernelci on that directly?13:18
alicefcurrently I'm trying to talk about it with #lavasoftware and wait for their replay13:18
jkiok13:18
jkithen lets wait and meanwhile at this as AI on the stack13:19
alicefmy idea is to just trying to update jquery as was arleady updated also in the pust for some security concern13:19
patersonc[m]Thanks alicef13:19
alicefs/pust/past13:20
alicefs/arleady/already13:20
jkiQuirin just pointed me to https://git.lavasoftware.org/lava/lava/-/issues/421 - TL;DR No fix because we don't use the dangerous code13:20
alicefthat's nice13:21
jkiwait, that is not the same one, is it?13:21
jkiCVE-2020-1102213:21
alicefmmm oh right13:21
jkiyou wrote CVE-2020-1102313:21
aliceflet me open a new issue if so13:21
jkithanks!13:22
jkiany other AIs?13:22
jki313:23
jki213:23
jki113:23
jki#topic Kernel maintenance updates13:23
*** brlogger changes topic to "Kernel maintenance updates (Meeting topic: CIP IRC weekly meeting)"13:23
pavelI have reviewed patches for 5.10.72,73,74.13:23
ulireviewed for 5.10.7113:23
masamiThere is four new CVEs this week13:23
masamiCVE-2021-0935: 4.4 hasn't been fixed yet. other stable kernels have been fixed.13:24
iwamatsuI reviewed 5.10.72 and 73.13:24
masamiCVE-2021-0937, CVE-2021-0938, CVE-2021-0941: all stable kernels have been fixed.13:24
masamiCVE-2021-41864: 4.9 and 4.14 haven't been fixed yet.13:24
pavel4.19 and 4.14 are not really our focus; we can let someone else handle that.13:24
masamis/four/five/s13:24
pavelCVE..-0935: it is networking but not remotely exploitable afaict. I guess we can wait few weeks and try to do something about it if not fixed by then...?13:25
masamipavel: 4.19 and 4.14? you mean 4.9 and 4.14?13:26
pavelmasami: Sorry. I meant 4.9 and 4.14. We do care about 4.19.13:26
masamipavel: no problem.13:26
iwamatsuAbout CVE-2021-0935, I am trying backportting.13:27
masamiiwamatsu: thank you13:27
jkianything else under this topic?13:29
jki313:29
jki213:29
jki113:30
jki#topic Kernel testing13:30
*** brlogger changes topic to "Kernel testing (Meeting topic: CIP IRC weekly meeting)"13:30
patersonc[m]Other then what Alice has been said previously I don't have much to add13:30
jkithen let's make it short, or?13:30
jki313:31
jki213:31
jki113:31
jki#topic AOB13:31
*** brlogger changes topic to "AOB (Meeting topic: CIP IRC weekly meeting)"13:31
jkiI would like to hear if there is anything (further) to do regarding that wireless topic13:32
*** pavel <pavel!~pavel@88.103.239.87> has quit IRC13:33
pav3lNot really, I believe.13:34
jkiTSC meeting sounded like Security is expecting some statement from Kernel WG13:35
jkibut I may have misunderstood that13:35
pav3lI missed that. What kind of statement?13:35
pav3lWe can't really promise them anything.13:36
jkisomeone said kernel team would be "looking" into that13:36
jkiyeah, understood13:36
jkisummary would be kernel team can handle few selected wifi drivers, doing basic testing only, correct?13:36
pav3ljki basically no testing.13:37
jkicompile "testing" only, ok13:37
pav3ljki we can review patches from upstream, that's it.13:37
jkiwas this communicated already?13:37
iwamatsuwe can not  test it on LAVA.13:38
pav3ljki but that should be enough... And yes, I tried to explain that.13:38
jki"building and probing seem reasonable tests currently"13:38
jkiwhat was meant by "probing"?13:38
pav3lWe want to have driver present on boards that have it...13:39
jkiok13:39
iwamatsu+113:39
pav3l...to catch unlikely error that it fails during probe or something like that.13:39
jkithen I will try to point this out again during next TSC13:40
pav3lSounds good.13:41
jkiany other AOB?13:41
patersonc[m]We may be able to add wifi to a LAVA lab if really needed13:41
jkiyeah, maybe just check if scanning works (known networks visible), that's what I tend to do manually13:42
jkibut already that requires that the thing is not in a metal box...13:43
jkiso, anything else?13:43
jki313:43
jki213:43
jki113:44
jki#endmeeting13:44
brloggerMeeting ended Thu Oct 14 13:44:06 2021 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)13:44
brloggerMinutes:        https://irclogs.baserock.org/meetings/cip/2021/10/cip.2021-10-14-13.01.html13:44
brloggerMinutes (text): https://irclogs.baserock.org/meetings/cip/2021/10/cip.2021-10-14-13.01.txt13:44
brloggerLog:            https://irclogs.baserock.org/meetings/cip/2021/10/cip.2021-10-14-13.01.log.html13:44
*** brlogger changes topic to "Civil Infrastructure Platform Project. Find the logs at https://irclogs.baserock.org/cip/"13:44
alicefopened issue to lava hoping it dosen't affect anything ttps://git.lavasoftware.org/lava/lava/-/issues/51313:44
jkithen thank you all!13:44
jkithanks, alicef!13:44
alicefah it was for end the meeting I thought related to kernel testing sorry13:44
jkiwe were already AOB :)13:44
alicefok :)13:45
aliceftoday my typo are on fire ...13:45
pav3lThank you!13:45
patersonc[m]typos ;)13:45
alicefthank you13:45
masamibye!13:45
iwamatsuThank you13:45
jkitoo many stuck keys ;)13:45
jkibye!13:45
*** josiah|2 <josiah|2!~kvirc@pool-100-16-211-90.bltmmd.fios.verizon.net> has quit IRC13:45
ulibye13:45
alicefpatersonc[m]: :'|13:45
*** masami <masami!~masami@FL1-122-133-108-128.tky.mesh.ad.jp> has quit IRC13:47
* patersonc[m] runs away13:47
alicefbye!13:47
*** jki <jki!~jki@88.215.84.132> has quit IRC13:49
*** pav3l <pav3l!~user@37-48-8-177.nat.epc.tmcz.cz> has quit IRC13:51
*** uli <uli!~uli@55d41653.access.ecotel.net> has left #cip15:36
*** patersonc[m] <patersonc[m]!~patersonc@2001:470:69fc:105::aaf> has quit IRC16:08
*** patersonc[m] <patersonc[m]!~patersonc@2001:470:69fc:105::aaf> has joined #cip16:12
*** toscalix_ <toscalix_!~agustinbe@174.red-79-144-82.dynamicip.rima-tde.net> has quit IRC16:48
*** rajm <rajm!~robert@cpc126990-macc4-2-0-cust43.1-3.cable.virginm.net> has quit IRC22:02
« Wednesday, 2021-10-13 Index Friday, 2021-10-15 »

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!