Python 3.13 dropped crypt from the stdlib, and openSUSE Leap 16 packages
neither legacycrypt nor crypt_r, so the server did not start there
without a pip install. Both of those only call crypt(3) from libcrypt,
which every distribution ships, so do that through ctypes as the last
resort, serialized because crypt(3) returns a static buffer. Its hashes
match the stdlib module byte for byte.
Move the import chain both callers carried into confluent.pwcrypt. The
legacycrypt Recommends is no longer needed.
Neither is packaged by EPEL or Ubuntu, so the hard dependency made the
server uninstallable there without --nodeps or a stub package. Both are
already optional in the code: httpapi drops passkey support when
webauthn does not import, and the Lenovo IMM2 BIOS settings path reports
the missing module as unsupported functionality. Recommend them instead,
as the SUSE branch already does for webauthn.
See xcat2/confluent#192.
The spec carried a copy of a terminal session after %changelog: a shell
prompt followed by a second full copy of the spec. Also fix the
debug_package macro name typo.
For one, at the time an XCC emits a NOTIFY, it's DeviceDescription.json is also very sluggish. Extend timeout
knowing this may be delayed.
Further, if snoop comes back with only one address family, do not
perturb existing address families.
- A manager that is not a confluent node is pinned on the guest's node
(pubkeys.tls_hardwaremanager), as the console already does.
- user@realm!tokenid with the token secret is accepted as the login;
VNC needs a password login and says so.
- Route every API call through one checked path: non-2xx answers raise
with PVE's message, a 401 logs in again, a migrated guest is re-mapped.
- Report login failures other than 401 instead of a TypeError.
- Power changes are bounded and reported per node; 'on' when on is a
no-op; every live QEMU state counts as on.
- Read and set the boot order in every form PVE accepts, keeping disks.
- Stop toggling Content-Type on the shared client headers.
- Inventory from the current config, all SMBIOS forms.
- Refuse ambiguous guest names; skip templates.
- Keep the serial console alive and report how it ends.
- Let the self-test run without a config manager.
asyncssh relationship with cryptography can be messy, but it's not up to us, so discard those.
Change osdeploy to not use fork to avoid that deprecationwarning.
The vncwebsocket URL used the name of the Proxmox node running the
guest as host. That name often does not resolve on the management
node, and the fingerprint checked is the one of the manager anyway.
Connect to the manager instead, which forwards the websocket to the
right node.
netplan and NetworkManager both scope dns to interface.
In certain cases, it can really mean it, so try to match the nameservers to the appropriate interface,
falling back to adding to every interface with a gateway.
Some devices have multiple BMCs, but we don't know
the 'right' one.
In such a scenario, search for BMC NICs for any that match the address we are using.
In the process of reworking cache logic, a temporary disabling was left in.
Before the logic change, 'cache' of '1' meant 'True', but the intent was a max age to decline to reply. This allows very close together requests to be cached.
Proivde support for API keys. Users can register by doing a POST like:
/confluent-api/sessions/current/apikey/create with body of '{"expiration":null}
API keys can be reset by doing a POST to /confluent-api/sessions/current/apikey/revokeall
A secret is provisioned per user to allow them to clear all keys, while remaining mostly stateless to avoid having to manage every key server side.
The password change and the account update set If-Match: * on the
connection itself, and after a forced password change that connection
is handed back, so every later request carried it. Pass the header
with the PATCH alone. Also drop an unused asyncio import.
get_health looked only at each node's State, so an Enabled node whose
Health was Warning or Critical left the chassis reported as ok. It also
skipped a node whose resource could not be read, counting it as
healthy while an unreadable chassis was flagged. Report the node's
Health when it is not OK, and a node that cannot be read as
Unreachable.
The sensor collection has 668 members, and reading each one on its own
takes about 92 seconds and rebuilds on every nodesensors call. Opt in
to $expand=. for that collection, checking once whether the firmware
really inlines the members, so firmware that ignores $expand keeps the
per-member reads.
Markus Hilger
Jarrod Johnson
Jarrod Johnson
Laurence