Update Liberty SHAs - 21 Jan 2016

Updates all repo SHAs to open up work on 12.0.5

The global-requirement-pin entry for pip is removed as it is already
catered for in the pip_install role and the repeated entry is not
required.

Some projects name their paste config files with an underscore
instead of a dash. This patch ensures that the source-branch-updater
includes those files too when checking for updates.

The following CVE fix is included:

OSSA-2016-003: Heat denial of service through template-validate
https://security.openstack.org/ossa/OSSA-2016-003.html

Change-Id: I168d1ec9d6a0364d05ae65c3d8e53f1b16d51623

global-requirement-pins.txt

@@ -1,3 +1,2 @@
 # This file was created to set pins that are needed but should not be
 #  installed as base requirements
-pip>7,<8

playbooks/defaults/repo_packages/openstack_other.yml

@@ -27,17 +27,17 @@
 
 ## Tempest service
 tempest_git_repo: https://git.openstack.org/openstack/tempest
-tempest_git_install_branch: f558bb3302b232ebe0c2328ad58b25a0d0af99a5 # HEAD of "master" as of 18.01.2016
+tempest_git_install_branch: b7d85910d5857487b7c01453b63aa51aa1583bcf # HEAD of "master" as of 21.01.2016
 tempest_git_dest: "/opt/tempest_{{ tempest_git_install_branch | replace('/', '_') }}"
 
 
 ## NOVNC from source
 novncproxy_git_repo: https://github.com/kanaka/novnc
-novncproxy_git_install_branch: 670dbddb54264fd0082d0aca1b3acb0f1814b1d2 # HEAD of "master" as of 18.01.2016
+novncproxy_git_install_branch: 670dbddb54264fd0082d0aca1b3acb0f1814b1d2 # HEAD of "master" as of 21.01.2016
 novncproxy_git_dest: "/opt/novnc_{{ novncproxy_git_install_branch | replace('/', '_') }}"
 
 
 ## spice-html5 from source
 spicehtml5_git_repo: https://github.com/SPICE/spice-html5
-spicehtml5_git_install_branch: ab73d009487c8afd4def39b54a422499b4c13c40 # HEAD of "master" as of 18.01.2016
+spicehtml5_git_install_branch: ab73d009487c8afd4def39b54a422499b4c13c40 # HEAD of "master" as of 21.01.2016
 spicehtml5_git_dest: "/opt/spicehtml5_{{ spicehtml5_git_install_branch | replace('/', '_') }}"

playbooks/defaults/repo_packages/openstack_services.yml

@@ -31,77 +31,77 @@
 
 ## Global Requirements
 requirements_git_repo: https://git.openstack.org/openstack/requirements
-requirements_git_install_branch: 4b8e8e2fc86afd61af8452df3d2a8b537d969f29 # HEAD of "stable/liberty" as of 18.01.2016
+requirements_git_install_branch: 4b8e8e2fc86afd61af8452df3d2a8b537d969f29 # HEAD of "stable/liberty" as of 21.01.2016
 requirements_git_dest: "/opt/requirements_{{ requirements_git_install_branch | replace('/', '_') }}"
 
 
 ## Aodh service
 aodh_git_repo: https://git.openstack.org/openstack/aodh
-aodh_git_install_branch: 3a05a1df615e0ae8ce0461dbcabcb763ebbe32bc # HEAD of "stable/liberty" as of 18.01.2016
+aodh_git_install_branch: 3a05a1df615e0ae8ce0461dbcabcb763ebbe32bc # HEAD of "stable/liberty" as of 21.01.2016
 aodh_git_dest: "/opt/aodh_{{ aodh_git_install_branch | replace('/', '_') }}"
 
 
 ## Ceilometer service
 ceilometer_git_repo: https://git.openstack.org/openstack/ceilometer
-ceilometer_git_install_branch: cd2065df67889354703f2a5d38af669630d67760 # HEAD of "stable/liberty" as of 18.01.2016
+ceilometer_git_install_branch: 278c4846efd218c648b76510aba2b52c762866ff # HEAD of "stable/liberty" as of 21.01.2016
 ceilometer_git_dest: "/opt/ceilometer_{{ceilometer_git_install_branch | replace('/', '_') }}"
 
 
 ## Cinder service
 cinder_git_repo: https://git.openstack.org/openstack/cinder
-cinder_git_install_branch: b98d0fac84c3a736a3a92e5e0036f7eaccd30207 # HEAD of "stable/liberty" as of 18.01.2016
+cinder_git_install_branch: 6d0981b252835a525149714e39cc1e4ee7568315 # HEAD of "stable/liberty" as of 21.01.2016
 cinder_git_dest: "/opt/cinder_{{ cinder_git_install_branch | replace('/', '_') }}"
 
 
 ## Glance service
 glance_git_repo: https://git.openstack.org/openstack/glance
-glance_git_install_branch: b61b199afdba606bad12b4812a088dbcd0e7637d # HEAD of "stable/liberty" as of 18.01.2016
+glance_git_install_branch: b9c9ac736361c42afdc46cd772b7e0741372fc78 # HEAD of "stable/liberty" as of 21.01.2016
 glance_git_dest: "/opt/glance_{{ glance_git_install_branch | replace('/', '_') }}"
 
 
 ## Heat service
 heat_git_repo: https://git.openstack.org/openstack/heat
-heat_git_install_branch: 71d7b4572f717b10429dc02760b1d41121ecfc84 # HEAD of "stable/liberty" as of 18.01.2016
+heat_git_install_branch: dc8ccd8ee15bb336c4704ac1ff628bfb245a5593 # HEAD of "stable/liberty" as of 21.01.2016
 heat_git_dest: "/opt/heat_{{ heat_git_install_branch | replace('/', '_') }}"
 
 
 ## Horizon service
 horizon_git_repo: https://git.openstack.org/openstack/horizon
-horizon_git_install_branch: 38aee7b5e07ceb327203af4c23f31194733c6435 # HEAD of "stable/liberty" as of 18.01.2016
+horizon_git_install_branch: 38aee7b5e07ceb327203af4c23f31194733c6435 # HEAD of "stable/liberty" as of 21.01.2016
 horizon_git_dest: "/opt/horizon_{{ horizon_git_install_branch | replace('/', '_') }}"
 
 
 ## Keystone service
 keystone_git_repo: https://git.openstack.org/openstack/keystone
-keystone_git_install_branch: 25a62094a840abc632ecbfbc7b74bf14dcf2baab # HEAD of "stable/liberty" as of 18.01.2016
+keystone_git_install_branch: 25a62094a840abc632ecbfbc7b74bf14dcf2baab # HEAD of "stable/liberty" as of 21.01.2016
 keystone_git_dest: "/opt/keystone_{{ keystone_git_install_branch | replace('/', '_') }}"
 
 
 ## Neutron service
 neutron_git_repo: https://git.openstack.org/openstack/neutron
-neutron_git_install_branch: ba9485d2cceb993c1cc955144366817f229f0036 # HEAD of "stable/liberty" as of 18.01.2016
+neutron_git_install_branch: cc6b16558e72619a50ba8ce7b7fc5b75645c6b6b # HEAD of "stable/liberty" as of 21.01.2016
 neutron_git_dest: "/opt/neutron_{{ neutron_git_install_branch | replace('/', '_') }}"
 
 neutron_lbaas_git_repo: https://git.openstack.org/openstack/neutron-lbaas
-neutron_lbaas_git_install_branch: eb7590c78a9185112f6600aa4c9a2d45fefa85fa # HEAD of "stable/liberty" as of 18.01.2016
+neutron_lbaas_git_install_branch: eb7590c78a9185112f6600aa4c9a2d45fefa85fa # HEAD of "stable/liberty" as of 21.01.2016
 neutron_lbaas_git_dest: "/opt/neutron_lbaas_{{ neutron_lbaas_git_install_branch | replace('/', '_') }}"
 
 neutron_vpnaas_git_repo: https://git.openstack.org/openstack/neutron-vpnaas
-neutron_vpnaas_git_install_branch: 427ba7e748ad19e230a6d04b6888331cc49ef868 # HEAD of "stable/liberty" as of 18.01.2016
+neutron_vpnaas_git_install_branch: 427ba7e748ad19e230a6d04b6888331cc49ef868 # HEAD of "stable/liberty" as of 21.01.2016
 neutron_vpnaas_git_dest: "/opt/neutron_vpnaas_{{ neutron_vpnaas_git_install_branch | replace('/', '_') }}"
 
 neutron_fwaas_git_repo: https://git.openstack.org/openstack/neutron-fwaas
-neutron_fwaas_git_install_branch: 33c06d9c703d4dbe65a3c0d5a7f4db61d86c7e26 # HEAD of "stable/liberty" as of 18.01.2016
+neutron_fwaas_git_install_branch: 33c06d9c703d4dbe65a3c0d5a7f4db61d86c7e26 # HEAD of "stable/liberty" as of 21.01.2016
 neutron_fwaas_git_dest: "/opt/neutron_fwaas_{{ neutron_fwaas_git_install_branch | replace('/', '_') }}"
 
 
 ## Nova service
 nova_git_repo: https://git.openstack.org/openstack/nova
-nova_git_install_branch: cc0bc4be85b2f51fdc30dd99fa231c7e6af61485 # HEAD of "stable/liberty" as of 18.01.2016
+nova_git_install_branch: cc0bc4be85b2f51fdc30dd99fa231c7e6af61485 # HEAD of "stable/liberty" as of 21.01.2016
 nova_git_dest: "/opt/nova_{{ nova_git_install_branch | replace('/', '_') }}"
 
 
 ## Swift service
 swift_git_repo: https://git.openstack.org/openstack/swift
-swift_git_install_branch: 74b12f26c43b3afca90a4b49f1e5a9503548ec0f # HEAD of "stable/liberty" as of 18.01.2016
+swift_git_install_branch: 74b12f26c43b3afca90a4b49f1e5a9503548ec0f # HEAD of "stable/liberty" as of 21.01.2016
 swift_git_dest: "/opt/swift_{{ swift_git_install_branch | replace('/', '_') }}"

playbooks/defaults/repo_packages/python2_lxc.yml

@@ -15,5 +15,5 @@
 
 ## Git Source for python2-lxc library
 git_repo: https://github.com/lxc/python2-lxc
-git_install_branch: 0553f05d23b56b59bf3015fa5e45bfbfab9021ef # HEAD of "master" as of 18.01.2016
+git_install_branch: 0553f05d23b56b59bf3015fa5e45bfbfab9021ef # HEAD of "master" as of 21.01.2016
 git_dest: "/opt/lxc_python2_{{ git_install_branch|replace('/', '_') }}"

playbooks/inventory/group_vars/all.yml

@@ -14,7 +14,7 @@
 # limitations under the License.
 
 ## OpenStack Source Code Release
-openstack_release: 12.0.4
+openstack_release: 12.0.5
 
 # Global minimum kernel requirement
 openstack_host_required_kernel: 3.13.0-34-generic

playbooks/roles/os_aodh/templates/api_paste.ini.j2

@@ -16,3 +16,4 @@ oslo_config_project = aodh
 
 [filter:request_id]
 paste.filter_factory = oslo_middleware:RequestId.factory
+

playbooks/roles/os_ceilometer/templates/api_paste.ini.j2

@@ -14,4 +14,5 @@ paste.app_factory = ceilometer.api.app:app_factory
 paste.filter_factory = keystonemiddleware.auth_token:filter_factory
 
 [filter:request_id]
-paste.filter_factory = oslo.middleware:RequestId.factory
+paste.filter_factory = oslo_middleware:RequestId.factory
+

scripts/sources-branch-updater.sh

@@ -95,11 +95,11 @@ for repo in $(grep 'git_repo\:' ${SERVICE_FILE}); do
         cp {} "playbooks/roles/os_${repo_name}/templates/policy.json.j2" \;
 
       # Tweak the paste files
-      find ${repo_tmp_path}/etc -name "*-paste.ini" -exec \
+      find ${repo_tmp_path}/etc -name "*[_-]paste.ini" -exec \
         sed -i.bak "s|hmac_keys = SECRET_KEY|hmac_keys = {{ ${repo_name}_profiler_hmac_key }}|" {} \;
 
       # Update the paste files
-      find ${repo_tmp_path}/etc -name "*-paste.ini" -exec \
+      find ${repo_tmp_path}/etc -name "*[_-]paste.ini" -exec \
         bash -c "name=\"{}\"; cp \${name} \"playbooks/roles/os_${repo_name}/templates/\$(basename \${name}).j2\"" \;
 
       # Tweak the rootwrap conf files