zuul
/
zuul-jobs
Code Issues Proposed changes
Ansible job definitions for Zuul
999 Commits 1 Branch 0 Tags 34 MiB
Python 88.4%
Jinja 8.9%
Shell 2.3%
Dockerfile 0.2%
Nim 0.1%
Go to file
Jeremy Stanley 3f01dc11f7 Use password lookup for run-buildset-registry role 
Complete a lingering TODO in run-buildset-registry to use a less
guessable password for the intermediate registry service. Timestamps
(even with microsecond precision and even running through a hash
algorithm) are inherently guessable. Someone watching a console
stream of the job could probably narrow down the time that task ran
to at least second precision, which then requires at most a million
guesses to be able to pollute or otherwise compromise the content
jobs are relying on. With reasonable network access and a typical
personal computer this is a rather small work factor to overcome.

Luckily, the Ansible community maintains an in-tree lookup plugin[*]
for strong password generation. Its default is 20 mixed-case
letters, numbers and punctuation, so the same length as the
truncated hash we're replacing.

[*] https://docs.ansible.com/ansible/latest/plugins/lookup/password.html

Depends-On: https://review.opendev.org/662870
Change-Id: I66e60f767328cc3af540ec4b755121da989b5e56
 		2019-06-04 18:43:09 +00:00
doc Add a registry test job 2019-06-03 09:03:35 -07:00
playbooks validate-zone-db : add job and make more generic 2019-05-24 10:00:49 +10:00
roles Use password lookup for run-buildset-registry role 2019-06-04 18:43:09 +00:00
test-playbooks/registry Add a registry test job 2019-06-03 09:03:35 -07:00
tests Add a python unit test framework 2018-07-25 09:11:25 -07:00
tools Organize documentation by subject area 2019-03-25 14:21:04 -07:00
.gitignore Add a python unit test framework 2018-07-25 09:11:25 -07:00
.gitreview OpenDev Migration Patch 2019-04-19 19:25:30 +00:00
.stestr.conf Add a python unit test framework 2018-07-25 09:11:25 -07:00
LICENSE Add initial license, docs, and other config 2017-06-08 14:01:21 -07:00
README.rst Add installation/deprecation documentation 2018-04-11 08:03:57 -07:00
bindep.txt Updated bindep to cover for MacOS requirements 2018-10-27 16:31:33 +00:00
setup.cfg Add initial license, docs, and other config 2017-06-08 14:01:21 -07:00
setup.py Add initial license, docs, and other config 2017-06-08 14:01:21 -07:00
test-requirements.txt Shift doc requirements to doc/requirements.txt 2019-05-09 13:58:56 +00:00
tox.ini Shift doc requirements to doc/requirements.txt 2019-05-09 13:58:56 +00:00
zuul.yaml Add a registry test job 2019-06-03 09:03:35 -07:00

README.rst

Zuul Jobs

This repo contains a set of Zuul jobs and Ansible roles suitable for use by any Zuul system.