)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"8d709e9fb0d9c139e76af15e647fe709a5d7d179","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"27d5281d_da394d5f","updated":"2026-08-26 11:54:18.000000000","message":"debian is in the worst place of all as:\n\n- bookworm (epoxy/flamingo) ships pacific 16.2.15 - vulnerable\n- trixie (master/gazpacho) ships reef 18.2.7 - also vulnerable\n- fix is only in sid (tentacle 20.2.4), not backported yet\n  https://security-tracker.debian.org/tracker/CVE-2025-30156\n\nfor bookworm we can fix it - download.ceph.com has squid 19.2.6 and\ntentacle 20.2.4 there. for trixie there is nothing stable at all, only\numbrella RC.","commit_id":"ae83d8d2ec3838b1f20c41a28085a71feb916413"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"713a4e1f71b064dbffae45fc84da99af84f50dd9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"76acc845_6c70b4de","updated":"2026-08-26 15:23:31.000000000","message":"let\u0027s merge it to get CVE fixes - in CI we get proper packages version and in cephadm jobs clients could connect to ceph with new cephx keys","commit_id":"ae83d8d2ec3838b1f20c41a28085a71feb916413"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"b1964a96291166752172b489bb0057191a23492c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"11aa083c_7ccae3f1","updated":"2026-08-26 11:06:42.000000000","message":"this is the easiest way to fix the ceph CVEs in EL9 - SIG stopped at squid\n19.2.5 there, so download.ceph.com is the only place with 19.2.6. it also\nkeeps epoxy consistent, el10 is already on squid 19.2.6.\n\nalternatives:\n\n- ceph tentacle from EL storage SIG, from master to epoxy (20.2.4, exists\n  for both EL9/EL10, same CVE fixes) - we can hardcode repo files until they\n  exist in rocky repos - https://bugs.rockylinux.org/view.php?id\u003d13729\n\n- or tentacle from download.ceph.com - it\u0027s there for EL9 and EL10, and for\n  ubuntu later when it gets shipped -\n  https://docs.ceph.com/en/latest/start/os-recommendations/#platforms\n\n- eventually umbrella when it\u0027s released -\n  https://review.opendev.org/c/openstack/kolla/+/1002008","commit_id":"ae83d8d2ec3838b1f20c41a28085a71feb916413"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"713a4e1f71b064dbffae45fc84da99af84f50dd9","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"b991d468_b54bb5ab","in_reply_to":"11aa083c_7ccae3f1","updated":"2026-08-26 15:23:31.000000000","message":"btw, there is no EL10 for squid in download.ceph.com - so we can\u0027t use it to have common squid source for EL9 and EL10 - https://download.ceph.com/rpm-squid/el10/","commit_id":"ae83d8d2ec3838b1f20c41a28085a71feb916413"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"713a4e1f71b064dbffae45fc84da99af84f50dd9","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"2695f585_31824e90","in_reply_to":"15d685fa_13319d66","updated":"2026-08-26 15:23:31.000000000","message":"interesting, but we would need to narrow this down to just ceph packages. and apparently there is plan to backport the patches by debian https://bugs.debian.org/1144947","commit_id":"ae83d8d2ec3838b1f20c41a28085a71feb916413"},{"author":{"_account_id":38651,"name":"Taavi Ansper","display_name":"TafkaMax","email":"taaviansperr@gmail.com","username":"taaviansper"},"change_message_id":"53c36fa3528b70582ece9a3dd30b887ea6644863","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"15d685fa_13319d66","in_reply_to":"27d5281d_da394d5f","updated":"2026-08-26 13:16:51.000000000","message":"What about lookign at proxmox repos. I know it is a little unorthodox.\n\nhttps://pve.proxmox.com/wiki/Package_Repositories#sysadmin_package_repositories_ceph","commit_id":"ae83d8d2ec3838b1f20c41a28085a71feb916413"}]}