[SRU] ussuri stable releases

Thanks Chris. I've uploaded cinder to the focal unapproved queue: https://launchpad.net/ubuntu/focal/+queue?queue_state=1&queue_text=cinder

We'll need to get a new snapshot of cinder into groovy before this can land in focal.

I've asked for cinder to be rejected from the unapproved queue for now. We can upload again (with updated Build-Depends) once we have the os-brick changes uploaded for: https://bugs.launchpad.net/cinder/+bug/1823200.

(Build-)Depends, that is

I've re-uploaded cinder to the focal unapproved queue: https://launchpad.net/ubuntu/focal/+queue?queue_state=1&queue_text=cinder

The python-os-brick update is going through the security team for focal. I'm working with Leo Barbosa on that.

I've unsubscribed the Ubuntu SRU team from this bug. The Ubuntu security team is going to sponsor the upload for this point release.

This is now ready for testing in https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa

For focal ^

This has been confirmed on a focal cloud with the security-proposed PPA enabled:

======
Totals
======
Ran: 92 tests in 1324.6787 sec.
 - Passed: 84
 - Skipped: 8
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 0
Sum of execute time for each test: 1897.1372 sec.

Full tempest smoke output:

{0} tempest.api.compute.flavors.test_flavors.FlavorsV2TestJSON.test_get_flavor [0.544867s] ... ok
{0} tempest.api.compute.flavors.test_flavors.FlavorsV2TestJSON.test_list_flavors [0.085119s] ... ok
{0} tempest.api.compute.security_groups.test_security_group_rules.SecurityGroupRulesTestJSON.test_security_group_rules_create [10.163827s] ... ok
{2} tempest.api.compute.security_groups.test_security_groups.SecurityGroupsTestJSON.test_security_groups_create_list_delete [39.174829s] ... ok
{0} tempest.api.compute.security_groups.test_security_group_rules.SecurityGroupRulesTestJSON.test_security_group_rules_list [28.514631s] ... ok
{1} tempest.api.compute.servers.test_create_server.ServersTestBootFromVolume.test_list_servers [0.208663s] ... ok
{1} tempest.api.compute.servers.test_create_server.ServersTestBootFromVolume.test_verify_server_details [0.002856s] ... ok
{0} tempest.api.compute.servers.test_create_server.ServersTestJSON.test_list_servers [0.183287s] ... ok
{0} tempest.api.compute.servers.test_create_server.ServersTestJSON.test_verify_server_details [0.001245s] ... ok
{3} tempest.api.compute.servers.test_attach_interfaces.AttachInterfacesUnderV243Test.test_add_remove_fixed_ip [287.563552s] ... ok
{1} tempest.api.compute.servers.test_server_addresses.ServerAddressesTestJSON.test_list_server_addresses [0.096926s] ... ok
{1} tempest.api.compute.servers.test_server_addresses.ServerAddressesTestJSON.test_list_server_addresses_by_network [0.170009s] ... ok
{2} tempest.api.compute.servers.test_server_actions.ServerActionsTestJSON.test_reboot_server_hard [53.284471s] ... ok
{1} tempest.api.compute.test_versions.TestVersions.test_get_version_details [0.724917s] ... ok
{1} tempest.api.compute.test_versions.TestVersions.test_list_api_versions [0.012704s] ... ok
{3} tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete [0.185500s] ... ok
{1} setUpClass (tempest.api.identity.admin.v2.test_services.ServicesTestJSON) ... SKIPPED: Identity api v2 is not enabled
{1} setUpClass (tempest.api.identity.admin.v2.test_users.UsersTestJSON) ... SKIPPED: Identity api v2 is not enabled
{1} tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all [4.220641s] ... ok
{3} tempest.api.identity.admin.v3.test_endpoints.EndPointsTestJSON.test_update_endpoint [0.684522s] ... ok
{3} tempest.ap...

This bug was fixed in the package cinder - 2:16.1.0-0ubuntu1

---------------
cinder (2:16.1.0-0ubuntu1) focal-security; urgency=medium

  [ Chris MacNaughton ]
  * New stable point release for OpenStack Ussuri (LP: #1883879).

  [ Corey Bryant ]
  * SECURITY UPDATE: Dell EMC ScaleIO/VxFlex OS Backend Credentials Exposure
    (LP: #1823200)
    - Remove VxFlex OS credentials from connection_properties. Passwords are
      now stored in separate file and are retrieved during each attach/detach
      operation. Cinder is patched in 16.1.0 stable point release.
    - d/control: Align (Build-)Depends with min version of python3-os-brick
      required to fix credential exposure.
    - CVE-2020-10755

 -- Corey Bryant <email address hidden> Tue, 23 Jun 2020 16:52:33 -0400

Hello Chris, or anyone else affected,

Accepted cinder into ussuri-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:ussuri-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-ussuri-needed to verification-ussuri-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-ussuri-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I have confirmed ussuri on a bionic cloud using the Ussuri cloud archive:

======
Totals
======
Ran: 92 tests in 1057.6689 sec.
 - Passed: 84
 - Skipped: 8
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 0
Sum of execute time for each test: 1616.4556 sec.

The verification of the Stable Release Update for cinder has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package cinder - 2:16.1.0-0ubuntu1~cloud0
---------------

 cinder (2:16.1.0-0ubuntu1~cloud0) bionic-ussuri; urgency=medium
 .
   * New upstream release for the Ubuntu Cloud Archive.
 .
 cinder (2:16.1.0-0ubuntu1) focal-security; urgency=medium
 .
   [ Chris MacNaughton ]
   * New stable point release for OpenStack Ussuri (LP: #1883879).
 .
   [ Corey Bryant ]
   * SECURITY UPDATE: Dell EMC ScaleIO/VxFlex OS Backend Credentials Exposure
     (LP: #1823200)
     - Remove VxFlex OS credentials from connection_properties. Passwords are
       now stored in separate file and are retrieved during each attach/detach
       operation. Cinder is patched in 16.1.0 stable point release.
     - d/control: Align (Build-)Depends with min version of python3-os-brick
       required to fix credential exposure.
     - CVE-2020-10755