)]}'
{"nova/virt/libvirt/imagebackend.py":[{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"738ad65fd5cab5f44e71d5adee1283ac0724992b","unresolved":false,"context_lines":[{"line_number":890,"context_line":"        # prepare_template() may have cloned the image into a new rbd"},{"line_number":891,"context_line":"        # image already instead of downloading it locally"},{"line_number":892,"context_line":"        if not self.exists():"},{"line_number":893,"context_line":"            fmt \u003d None"},{"line_number":894,"context_line":"            if not CONF.force_raw_images:"},{"line_number":895,"context_line":"                image_meta \u003d IMAGE_API.get(kwargs.get(\u0027context\u0027),"},{"line_number":896,"context_line":"                                           kwargs.get(\u0027image_id\u0027))"},{"line_number":897,"context_line":"                fmt \u003d image_meta.get(\u0027disk_format\u0027)"},{"line_number":898,"context_line":"            self.driver.import_image(base, self.rbd_name, fmt)"},{"line_number":899,"context_line":"        self.verify_base_size(base, size)"},{"line_number":900,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"9fdfeff1_c22d9e46","line":897,"range":{"start_line":893,"start_character":0,"end_line":897,"end_character":51},"updated":"2019-02-27 10:32:32.000000000","message":"This is user-defined, so this is not a trusted source either. If you have a look at how we handle this in fetch_to_raw we explicitly sanity check the backing file because we can\u0027t trust it.\n\nPlease don\u0027t duplicate that code here, when we can just use it directly to do the conversion for us, making this code redundant. Also please don\u0027t add any code which relies on a malicious qcow2 header having been previously detected, because there is no strong guarantee that this will always be the case in the future, and an innocuous and easy-to-miss mistake would re-introduce a severe security hole.","commit_id":"b50b0fd2ac72dd1b9409ba1836e89d9f8f9f6fbb"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"7ab0be18dde6cdb7246f4ef9a9b74f6dfa2efc40","unresolved":false,"context_lines":[{"line_number":890,"context_line":"        # prepare_template() may have cloned the image into a new rbd"},{"line_number":891,"context_line":"        # image already instead of downloading it locally"},{"line_number":892,"context_line":"        if not self.exists():"},{"line_number":893,"context_line":"            fmt \u003d None"},{"line_number":894,"context_line":"            if not CONF.force_raw_images:"},{"line_number":895,"context_line":"                image_meta \u003d IMAGE_API.get(kwargs.get(\u0027context\u0027),"},{"line_number":896,"context_line":"                                           kwargs.get(\u0027image_id\u0027))"},{"line_number":897,"context_line":"                fmt \u003d image_meta.get(\u0027disk_format\u0027)"},{"line_number":898,"context_line":"            self.driver.import_image(base, self.rbd_name, fmt)"},{"line_number":899,"context_line":"        self.verify_base_size(base, size)"},{"line_number":900,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"9fdfeff1_af538715","line":897,"range":{"start_line":893,"start_character":0,"end_line":897,"end_character":51},"in_reply_to":"9fdfeff1_c22d9e46","updated":"2019-02-28 07:48:02.000000000","message":"Done","commit_id":"b50b0fd2ac72dd1b9409ba1836e89d9f8f9f6fbb"}],"nova/virt/libvirt/storage/rbd_utils.py":[{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"f268286b8c9fd6e37160e808c4008f4d2cbf1d5b","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        if self.ceph_conf:"},{"line_number":327,"context_line":"            target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":328,"context_line":"        args.append(target)"},{"line_number":329,"context_line":"        processutils.execute(\u0027qemu-img\u0027, \u0027convert\u0027, *args)"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":332,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_138fac2a","line":329,"updated":"2019-02-25 13:26:55.000000000","message":"This does implicit format detection on the imported disk, which is a well-known security hole. In this specific case a malicious user could create a \u0027raw\u0027 image which actually contained a malicious qcow2 header specifying a backing file of the the compute host\u0027s root disk. This would result in copying the compute host\u0027s root disk to the specified rbd volume and exposing it to the user.","commit_id":"79a2583efa835372fa375506e88aac92370ab98a"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"8461862236ccbec937f1838dadece15ca2b5170f","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        if self.ceph_conf:"},{"line_number":327,"context_line":"            target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":328,"context_line":"        args.append(target)"},{"line_number":329,"context_line":"        processutils.execute(\u0027qemu-img\u0027, \u0027convert\u0027, *args)"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":332,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_f741ab0b","line":329,"in_reply_to":"9fdfeff1_138fac2a","updated":"2019-02-25 18:54:06.000000000","message":"Apologies if this is a dumb question, but would it be acceptable to detect the format first using \u0027qemu-img info\u0027 and then convert to raw only if \u0027qcow2\u0027? Or can we not depend on the format returned by \u0027qemu-img info\u0027?","commit_id":"79a2583efa835372fa375506e88aac92370ab98a"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"99293e2c8b281cbfbababc6fbc1a6d7b66e2843e","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        if self.ceph_conf:"},{"line_number":327,"context_line":"            target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":328,"context_line":"        args.append(target)"},{"line_number":329,"context_line":"        processutils.execute(\u0027qemu-img\u0027, \u0027convert\u0027, *args)"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":332,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_6b4b8fb0","line":329,"in_reply_to":"9fdfeff1_138fac2a","updated":"2019-02-26 03:39:28.000000000","message":"Great. Now I use the function \u0027convert_image\u0027 from \u0027nova/virt/images.py\u0027 to do \u0027qemu-image convert\u0027. It is a safe way to do that convert. Thanks.","commit_id":"79a2583efa835372fa375506e88aac92370ab98a"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"99293e2c8b281cbfbababc6fbc1a6d7b66e2843e","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        if self.ceph_conf:"},{"line_number":327,"context_line":"            target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":328,"context_line":"        args.append(target)"},{"line_number":329,"context_line":"        processutils.execute(\u0027qemu-img\u0027, \u0027convert\u0027, *args)"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":332,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_ab55f751","line":329,"in_reply_to":"9fdfeff1_f741ab0b","updated":"2019-02-26 03:39:28.000000000","message":"Done. Get and check the format of image file before choosing command \u0027qemu-image convert\u0027 or command \u0027rbd import\u0027. Thanks for your advise.","commit_id":"79a2583efa835372fa375506e88aac92370ab98a"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"5bce2892f1865f6a37e29c6b9c0d3709f5b690ba","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        if self.ceph_conf:"},{"line_number":327,"context_line":"            target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":328,"context_line":"        args.append(target)"},{"line_number":329,"context_line":"        processutils.execute(\u0027qemu-img\u0027, \u0027convert\u0027, *args)"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":332,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":2,"id":"9fdfeff1_73ee2123","line":329,"in_reply_to":"9fdfeff1_f741ab0b","updated":"2019-02-26 09:36:29.000000000","message":"No. If the user constructs a malicious header it will fool the qemu-img info first, which doesn\u0027t achieve anything.","commit_id":"79a2583efa835372fa375506e88aac92370ab98a"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"552a75a1ca75ab48296ee228f0a16f0ca09131cc","unresolved":false,"context_lines":[{"line_number":324,"context_line":"        # is QCOW2, the format of image file here is QCOW2."},{"line_number":325,"context_line":"        # So that, get and check the format of image file. Then choose the"},{"line_number":326,"context_line":"        # right way to import rbd volume from image file."},{"line_number":327,"context_line":"        data \u003d images.qemu_img_info(base)"},{"line_number":328,"context_line":"        fmt \u003d data.file_format"},{"line_number":329,"context_line":"        if fmt \u003d\u003d \"raw\":"},{"line_number":330,"context_line":"            args \u003d [\u0027--pool\u0027, self.pool, base, name]"},{"line_number":331,"context_line":"            # Image format 2 supports cloning,"}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_e1147643","line":328,"range":{"start_line":327,"start_character":0,"end_line":328,"end_character":30},"updated":"2019-02-26 14:53:52.000000000","message":"This is the security hole: you\u0027re doing format inspection. It doesn\u0027t matter if you do the format inspection during a convert or in an info command; it\u0027s still the same format inspection.\n\nIn order for this to be secure you would have to pass the input format to qemu-img info explicitly, in which case you wouldn\u0027t need to run it anyway. But you can\u0027t pass it, because we don\u0027t have it in this context. IOW: you can\u0027t do this here.\n\nIf a user can construct a malicious qcow2 header, declare the file as raw, and have it processed by this code, then this code will detect it as qcow2 (despite it being raw) and honour the malicious header.","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"b992cf0b7b12fbafacaa7ff707352a439e738fad","unresolved":false,"context_lines":[{"line_number":324,"context_line":"        # is QCOW2, the format of image file here is QCOW2."},{"line_number":325,"context_line":"        # So that, get and check the format of image file. Then choose the"},{"line_number":326,"context_line":"        # right way to import rbd volume from image file."},{"line_number":327,"context_line":"        data \u003d images.qemu_img_info(base)"},{"line_number":328,"context_line":"        fmt \u003d data.file_format"},{"line_number":329,"context_line":"        if fmt \u003d\u003d \"raw\":"},{"line_number":330,"context_line":"            args \u003d [\u0027--pool\u0027, self.pool, base, name]"},{"line_number":331,"context_line":"            # Image format 2 supports cloning,"}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_671e440d","line":328,"range":{"start_line":327,"start_character":0,"end_line":328,"end_character":30},"in_reply_to":"9fdfeff1_e1147643","updated":"2019-02-27 09:57:01.000000000","message":"Now, I do not try to get the image from qemu_img_info. I get it from image meta. And explicitly specify the disk format to avoid the \u0027insecure image format probing\u0027.","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":6962,"name":"Kashyap Chamarthy","email":"kchamart@redhat.com","username":"kashyapc"},"change_message_id":"810b1edf3608e0fbe782c69577742cf7fe1251cd","unresolved":false,"context_lines":[{"line_number":340,"context_line":"                target \u003d \u0027{}:id\u003d{}\u0027.format(target, self.rbd_user)"},{"line_number":341,"context_line":"            if self.ceph_conf:"},{"line_number":342,"context_line":"                target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":343,"context_line":"            images.convert_image(base, target, fmt, \u0027raw\u0027)"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":346,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_7ebd8166","line":343,"range":{"start_line":343,"start_character":39,"end_line":343,"end_character":57},"updated":"2019-02-26 14:41:26.000000000","message":"Okay, you\u0027re now explicitly specifying the target disk format.  And are thus avoiding the mine field of \"insecure image format probing\".\n\nMatt, can you double-check if I\u0027m not complete bonkers here, please...","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"e1c1b3bbc88852fab20af1df4e1ddb3df883f9ae","unresolved":false,"context_lines":[{"line_number":340,"context_line":"                target \u003d \u0027{}:id\u003d{}\u0027.format(target, self.rbd_user)"},{"line_number":341,"context_line":"            if self.ceph_conf:"},{"line_number":342,"context_line":"                target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":343,"context_line":"            images.convert_image(base, target, fmt, \u0027raw\u0027)"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":346,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_e29f82b1","line":343,"range":{"start_line":343,"start_character":39,"end_line":343,"end_character":57},"in_reply_to":"9fdfeff1_2ad9f381","updated":"2019-02-27 10:24:38.000000000","message":"You could safely do a conversion here if you could pass the image format in from a reliable source. The problem is that the interface between the libvirt driver and the imagebackend is the very poorly named cache() method, and all it exposes about the image it\u0027s importing is a callback function, which could be anything at all. IOW the callee doesn\u0027t know anything about the image it\u0027s being given, including its format. My imagebackend series did address this, but it didn\u0027t land and is long abandoned.\n\nIncidentally, this is also a problem for the LVM backend, which also requires raw.\n\nHowever we already have a mechanism in place to do this: force_raw_images. This will ensure that a downloaded glance image will be converted to raw before import if it is not already, and this conversion is done safely. The default setting of force_raw_images is True, so unless it is changed explicitly this would already work correctly. I discussed this with Zhu Boxiang earlier in the week in case they had already deployed this fix in production and confirmed that they have explicitly changed this setting to False. force_raw_images\u003dFalse is incompatible with the rbd and lvm backends for this reason.\n\nGiven that this is an incompatibility between 2 config variables, we could reasonably improve the user experience by detecting it at startup in init_host in the libvirt driver. We could go one of 2 ways:\n\n* Raise an error and refuse to start.\n\n* Log a warning and automatically change force_raw_images to True if the image backend requires raw images.\n\nTo your original question: I would abandon this patch. I can\u0027t see a simple way to get enough context to do this safely here, and it\u0027s not required anyway if you fix the config.","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"606f14596c5a530d5984942c14294289f187c756","unresolved":false,"context_lines":[{"line_number":340,"context_line":"                target \u003d \u0027{}:id\u003d{}\u0027.format(target, self.rbd_user)"},{"line_number":341,"context_line":"            if self.ceph_conf:"},{"line_number":342,"context_line":"                target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":343,"context_line":"            images.convert_image(base, target, fmt, \u0027raw\u0027)"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":346,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_2ad9f381","line":343,"range":{"start_line":343,"start_character":39,"end_line":343,"end_character":57},"in_reply_to":"9fdfeff1_417f8216","updated":"2019-02-26 16:49:38.000000000","message":"OK, so my question is, is there a way to do this securely? Or should this patch be abandoned?","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":6962,"name":"Kashyap Chamarthy","email":"kchamart@redhat.com","username":"kashyapc"},"change_message_id":"7d7e436aa2ae6c8f909f43c4034732d2a77d398f","unresolved":false,"context_lines":[{"line_number":340,"context_line":"                target \u003d \u0027{}:id\u003d{}\u0027.format(target, self.rbd_user)"},{"line_number":341,"context_line":"            if self.ceph_conf:"},{"line_number":342,"context_line":"                target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":343,"context_line":"            images.convert_image(base, target, fmt, \u0027raw\u0027)"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":346,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_417f8216","line":343,"range":{"start_line":343,"start_character":39,"end_line":343,"end_character":57},"in_reply_to":"9fdfeff1_41c78299","updated":"2019-02-26 15:02:51.000000000","message":"Ah, thanks for correcting me.  Your new explanation adds more context to me.\n\nIn summary, I agree and retract my comment.","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"552a75a1ca75ab48296ee228f0a16f0ca09131cc","unresolved":false,"context_lines":[{"line_number":340,"context_line":"                target \u003d \u0027{}:id\u003d{}\u0027.format(target, self.rbd_user)"},{"line_number":341,"context_line":"            if self.ceph_conf:"},{"line_number":342,"context_line":"                target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":343,"context_line":"            images.convert_image(base, target, fmt, \u0027raw\u0027)"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":346,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":5,"id":"9fdfeff1_41c78299","line":343,"range":{"start_line":343,"start_character":39,"end_line":343,"end_character":57},"in_reply_to":"9fdfeff1_7ebd8166","updated":"2019-02-26 14:53:52.000000000","message":"No, this is not secure because we obtained the format by format inspection. This is no different to just doing the format inspection in qemu-img convert.","commit_id":"026b135d879fb0f67bb1de191fa57681205b0ac7"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"b4c5cbf995da31c65028d59ddf8fed5cb28c5616","unresolved":false,"context_lines":[{"line_number":311,"context_line":"                          \u0027snapshots, failed to remove\u0027,"},{"line_number":312,"context_line":"                          {\u0027volume\u0027: name, \u0027pool\u0027: self.pool})"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"    def import_image(self, base, name, fmt):"},{"line_number":315,"context_line":"        \"\"\"Import RBD volume from image file."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"        :base: Path to image file"}],"source_content_type":"text/x-python","patch_set":8,"id":"9fdfeff1_c1c60017","line":314,"range":{"start_line":314,"start_character":39,"end_line":314,"end_character":42},"updated":"2019-02-27 09:16:13.000000000","message":"Now here, I get the image format from the upper method by the image_id when the force_raw_images is False.","commit_id":"b50b0fd2ac72dd1b9409ba1836e89d9f8f9f6fbb"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"a1a544de06cdcb3babb0500d8ffa4195935703e2","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        # right way to import rbd volume from image file."},{"line_number":327,"context_line":"        data \u003d images.qemu_img_info(base)"},{"line_number":328,"context_line":"        fmt \u003d data.file_format"},{"line_number":329,"context_line":"        backing_file \u003d data.backing_file"},{"line_number":330,"context_line":"        if backing_file is not None:"},{"line_number":331,"context_line":"            raise exception.ImageUnacceptable(image_id\u003d\u0027\u0027,"},{"line_number":332,"context_line":"                reason\u003d(_(\"fmt\u003d%(fmt)s backed by: %(backing_file)s\") %"},{"line_number":333,"context_line":"                        {\u0027fmt\u0027: fmt, \u0027backing_file\u0027: backing_file}))"},{"line_number":334,"context_line":""},{"line_number":335,"context_line":"        if fmt \u003d\u003d \u0027raw\u0027:"},{"line_number":336,"context_line":"            args \u003d [\u0027--pool\u0027, self.pool, base, name]"}],"source_content_type":"text/x-python","patch_set":9,"id":"9fdfeff1_2c732518","line":333,"range":{"start_line":329,"start_character":0,"end_line":333,"end_character":68},"updated":"2019-02-28 07:23:13.000000000","message":"Check the backing file of the image here to avoid the secure hole.","commit_id":"88a39c5ddba4c5467b8c5b666da1a31786b83e53"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"3890a21c838b088eac1142c1dcbeb5d02c373096","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        # right way to import rbd volume from image file."},{"line_number":327,"context_line":"        data \u003d images.qemu_img_info(base)"},{"line_number":328,"context_line":"        fmt \u003d data.file_format"},{"line_number":329,"context_line":"        backing_file \u003d data.backing_file"},{"line_number":330,"context_line":"        if backing_file is not None:"},{"line_number":331,"context_line":"            raise exception.ImageUnacceptable(image_id\u003d\u0027\u0027,"},{"line_number":332,"context_line":"                reason\u003d(_(\"fmt\u003d%(fmt)s backed by: %(backing_file)s\") %"},{"line_number":333,"context_line":"                        {\u0027fmt\u0027: fmt, \u0027backing_file\u0027: backing_file}))"},{"line_number":334,"context_line":""},{"line_number":335,"context_line":"        if fmt \u003d\u003d \u0027raw\u0027:"},{"line_number":336,"context_line":"            args \u003d [\u0027--pool\u0027, self.pool, base, name]"}],"source_content_type":"text/x-python","patch_set":9,"id":"9fdfeff1_9defd91b","line":333,"range":{"start_line":329,"start_character":0,"end_line":333,"end_character":68},"in_reply_to":"9fdfeff1_2c732518","updated":"2019-02-28 09:30:15.000000000","message":"This duplicates code from the only place where we handle untrusted qcow2 files. This is not a road we want to go down.","commit_id":"88a39c5ddba4c5467b8c5b666da1a31786b83e53"},{"author":{"_account_id":28706,"name":"Boxiang Zhu","email":"bxzhu_5355@163.com","username":"ZhuBoxiang"},"change_message_id":"a1a544de06cdcb3babb0500d8ffa4195935703e2","unresolved":false,"context_lines":[{"line_number":346,"context_line":"                target \u003d \u0027{}:id\u003d{}\u0027.format(target, self.rbd_user)"},{"line_number":347,"context_line":"            if self.ceph_conf:"},{"line_number":348,"context_line":"                target \u003d \u0027{}:conf\u003d{}\u0027.format(target, self.ceph_conf)"},{"line_number":349,"context_line":"            images.convert_image(base, target, fmt, \u0027raw\u0027)"},{"line_number":350,"context_line":""},{"line_number":351,"context_line":"    def _destroy_volume(self, client, volume, pool\u003dNone):"},{"line_number":352,"context_line":"        \"\"\"Destroy an RBD volume, retrying as needed."}],"source_content_type":"text/x-python","patch_set":9,"id":"9fdfeff1_6c560d5f","line":349,"range":{"start_line":349,"start_character":12,"end_line":349,"end_character":58},"updated":"2019-02-28 07:23:13.000000000","message":"Explicitly specify the target disk format here to call the safe convert.","commit_id":"88a39c5ddba4c5467b8c5b666da1a31786b83e53"}]}