Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Glance import task should check supplied checksum of image #340

Open
berendt opened this issue Sep 28, 2022 · 2 comments · May be fixed by #627
Open

Glance import task should check supplied checksum of image #340

berendt opened this issue Sep 28, 2022 · 2 comments · May be fixed by #627
Assignees
@gndrmnn
Labels
enhancement New feature or request SCS Sovereign Cloud Stack

Comments

@berendt
Copy link
Member

berendt commented Sep 28, 2022

No description provided.

@berendt berendt added enhancement New feature or request upstream Implemented directly in the upstream labels Sep 28, 2022
@berendt
Copy link
Member Author

berendt commented Sep 28, 2022

@fkr fkr mentioned this issue Oct 4, 2022
Closed
11 tasks
@berendt berendt added the SCS Sovereign Cloud Stack label Nov 2, 2022
@frittentheke
Copy link

I quite like the idea!

But with the Victoria release the former single MD5 hash was deprecated: https://docs.openstack.org/releasenotes/glance/victoria.html#deprecation-notes in favor of "multihash". While this sounds cool, multihash is only about being able to configure(!) a single hash algo that is then used: https://github.com/openstack/glance/blob/b023562e1d31d3e60c195d701e6a9ff52e2fc956/doc/source/admin/os_hash_algo.rst#secure-hash-algorithm-support-multihash, or https://docs.openstack.org/glance/latest/configuration/sample-configuration.html:

#
# Secure hashing algorithm used for computing the 'os_hash_value' property.
#
# This option configures the Glance "multihash", which consists of two
# image properties: the 'os_hash_algo' and the 'os_hash_value'.  The
# 'os_hash_algo' will be populated by the value of this configuration
# option, and the 'os_hash_value' will be populated by the hexdigest computed
# when the algorithm is applied to the uploaded or imported image data.
#
# The value must be a valid secure hash algorithm name recognized by the
# python 'hashlib' library.  You can determine what these are by examining
# the 'hashlib.algorithms_available' data member of the version of the
# library being used in your Glance installation.  For interoperability
# purposes, however, we recommend that you use the set of secure hash
# names supplied by the 'hashlib.algorithms_guaranteed' data member because
# those algorithms are guaranteed to be supported by the 'hashlib' library
# on all platforms.  Thus, any image consumer using 'hashlib' locally should
# be able to verify the 'os_hash_value' of the image.
#
# The default value of 'sha512' is a performant secure hash algorithm.
#
# If this option is misconfigured, any attempts to store image data will fail.
# For that reason, we recommend using the default value.
#
# Possible values:
#     * Any secure hash algorithm name recognized by the Python 'hashlib'
#       library
#
# Related options:
#     * None
#
#  (string value)
#hashing_algorithm = sha512

The default of SHA-512 is not provided by most image upstreams though. SHA-256 is very common, but for upstreams not providing the chosen hash algo, no checkum verification can be done. Would be nice to be able to provide any hash value of supported algos with the webdownload via image_url ... but that's an upstream change and will even if implemented take a while until is reaches most OpenStack installations.

gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 10, 2023
@gndrmnn
Validate provided checksum after successful import
85e871b 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
@gndrmnn gndrmnn linked a pull request Aug 10, 2023 that will close this issue
Draft
2 tasks
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 10, 2023
@gndrmnn
Validate provided checksum after successful import
f077bcd 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 10, 2023
@gndrmnn
Validate provided checksum after successful import
adab6da 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 10, 2023
@gndrmnn
Validate provided checksum after successful import
4b8a8a3 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
@gndrmnn gndrmnn mentioned this issue Aug 30, 2023
Open
@gndrmnn gndrmnn removed the upstream Implemented directly in the upstream label Aug 30, 2023
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 30, 2023
@gndrmnn
Validate provided checksum after successful import
a5b5785 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 30, 2023
@gndrmnn
Validate provided checksum after successful import
b0d0fdf 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 31, 2023
@gndrmnn
Validate provided checksum after successful import
dd4da5e 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Aug 31, 2023
@gndrmnn
Validate provided checksum after successful import
2be165f 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Sep 19, 2023
@gndrmnn
Validate provided checksum after successful import
921ae5f 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Sep 21, 2023
@gndrmnn
Validate provided checksum after successful import
6b590e9 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Sep 21, 2023
@gndrmnn
Validate provided checksum after successful import
e4d4124 
Use the 'checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Sep 21, 2023
@gndrmnn
Validate provided checksum after successful import
ef1ef55 
Use the 'verify_checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
@gndrmnn gndrmnn self-assigned this Sep 22, 2023
gndrmnn added a commit to gndrmnn/openstack-image-manager that referenced this issue Sep 26, 2023
@gndrmnn
Validate provided checksum after successful import
e42012d 
Use the 'verify_checksum' hash value in the yaml files to
verify the image integrity after it has been successfully
imported. Show a warning, if either the hash algorithm
or the hash value does not match the expected fields.

Fixes osism#340

Signed-off-by: Gondermann <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gndrmnn gndrmnn

Labels
enhancement New feature or request SCS Sovereign Cloud Stack
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Validate checksum after successful import gndrmnn/openstack-image-manager
3 participants
@berendt @frittentheke @gndrmnn