From f35d2688742208757f019b1bf2c5c9f37db0811b Mon Sep 17 00:00:00 2001 From: Matt Clay Date: Tue, 29 Oct 2024 11:53:45 -0700 Subject: [PATCH] New release v2.17.6rc1 (#84194) --- changelogs/CHANGELOG-v2.17.rst | 33 +++++++++++++ changelogs/changelog.yaml | 51 +++++++++++++++++++++ changelogs/fragments/2.17.6rc1_summary.yaml | 3 ++ lib/ansible/release.py | 2 +- pyproject.toml | 2 +- 5 files changed, 89 insertions(+), 2 deletions(-) create mode 100644 changelogs/fragments/2.17.6rc1_summary.yaml diff --git a/changelogs/CHANGELOG-v2.17.rst b/changelogs/CHANGELOG-v2.17.rst index 2fd1bcac9be..33441b5384a 100644 --- a/changelogs/CHANGELOG-v2.17.rst +++ b/changelogs/CHANGELOG-v2.17.rst @@ -4,6 +4,39 @@ ansible-core 2.17 "Gallows Pole" Release Notes .. contents:: Topics +v2.17.6rc1 +========== + +Release Summary +--------------- + +| Release Date: 2024-10-29 +| `Porting Guide `__ + +Minor Changes +------------- + +- ansible-test - Improve container runtime probe error handling. When unexpected probe output is encountered, an error with more useful debugging information is provided. + +Security Fixes +-------------- + +- include_vars action - Ensure that result masking is correctly requested when vault-encrypted files are read. (CVE-2024-8775) +- task result processing - Ensure that action-sourced result masking (``_ansible_no_log=True``) is preserved. (CVE-2024-8775) +- user action won't allow ssh-keygen, chown and chmod to run on existing ssh public key file, avoiding traversal on existing symlinks (CVE-2024-9902). + +Bugfixes +-------- + +- Fix disabling SSL verification when installing collections and roles from git repositories. If ``--ignore-certs`` isn't provided, the value for the ``GALAXY_IGNORE_CERTS`` configuration option will be used (https://github.com/ansible/ansible/issues/83326). +- Improve performance on large inventories by reducing the number of implicit meta tasks. +- Use the requested error message in the ansible.module_utils.facts.timeout timeout function instead of hardcoding one. +- ansible-test - Enable the ``sys.unraisablehook`` work-around for the ``pylint`` sanity test on Python 3.11. Previously the work-around was only enabled for Python 3.12 and later. However, the same issue has been discovered on Python 3.11. +- debconf - set empty password values (https://github.com/ansible/ansible/issues/83214). +- facts - skip if distribution file path is directory, instead of raising error (https://github.com/ansible/ansible/issues/84006). +- user action will now require O(force) to overwrite the public part of an ssh key when generating ssh keys, as was already the case for the private part. +- user module now avoids changing ownership of files symlinked in provided home dir skeleton + v2.17.5 ======= diff --git a/changelogs/changelog.yaml b/changelogs/changelog.yaml index cccb8d9598b..27835cb0a42 100644 --- a/changelogs/changelog.yaml +++ b/changelogs/changelog.yaml @@ -926,3 +926,54 @@ releases: - delay_type.yml - fix_errors.yml release_date: '2024-09-30' + 2.17.6rc1: + changes: + bugfixes: + - Fix disabling SSL verification when installing collections and roles from + git repositories. If ``--ignore-certs`` isn't provided, the value for the + ``GALAXY_IGNORE_CERTS`` configuration option will be used (https://github.com/ansible/ansible/issues/83326). + - Improve performance on large inventories by reducing the number of implicit + meta tasks. + - Use the requested error message in the ansible.module_utils.facts.timeout + timeout function instead of hardcoding one. + - ansible-test - Enable the ``sys.unraisablehook`` work-around for the ``pylint`` + sanity test on Python 3.11. Previously the work-around was only enabled for + Python 3.12 and later. However, the same issue has been discovered on Python + 3.11. + - debconf - set empty password values (https://github.com/ansible/ansible/issues/83214). + - facts - skip if distribution file path is directory, instead of raising error + (https://github.com/ansible/ansible/issues/84006). + - user action will now require O(force) to overwrite the public part of an ssh + key when generating ssh keys, as was already the case for the private part. + - user module now avoids changing ownership of files symlinked in provided home + dir skeleton + minor_changes: + - ansible-test - Improve container runtime probe error handling. When unexpected + probe output is encountered, an error with more useful debugging information + is provided. + release_summary: '| Release Date: 2024-10-29 + + | `Porting Guide `__ + + ' + security_fixes: + - include_vars action - Ensure that result masking is correctly requested when + vault-encrypted files are read. (CVE-2024-8775) + - task result processing - Ensure that action-sourced result masking (``_ansible_no_log=True``) + is preserved. (CVE-2024-8775) + - user action won't allow ssh-keygen, chown and chmod to run on existing ssh + public key file, avoiding traversal on existing symlinks (CVE-2024-9902). + codename: Gallows Pole + fragments: + - 2.17.6rc1_summary.yaml + - ansible-test-probe-error-handling.yml + - ansible-test-pylint-fix.yml + - cve-2024-8775.yml + - debconf_empty_password.yml + - fix-ansible-galaxy-ignore-certs.yml + - fix-module-utils-facts-timeout.yml + - os_family.yml + - skip-implicit-flush_handlers-no-notify.yml + - user_action_fix.yml + - user_ssh_fix.yml + release_date: '2024-10-29' diff --git a/changelogs/fragments/2.17.6rc1_summary.yaml b/changelogs/fragments/2.17.6rc1_summary.yaml new file mode 100644 index 00000000000..c8b0205cb35 --- /dev/null +++ b/changelogs/fragments/2.17.6rc1_summary.yaml @@ -0,0 +1,3 @@ +release_summary: | + | Release Date: 2024-10-29 + | `Porting Guide `__ diff --git a/lib/ansible/release.py b/lib/ansible/release.py index 27c6d55e8c6..3d3a5e00d09 100644 --- a/lib/ansible/release.py +++ b/lib/ansible/release.py @@ -17,6 +17,6 @@ from __future__ import annotations -__version__ = '2.17.5.post0' +__version__ = '2.17.6rc1' __author__ = 'Ansible, Inc.' __codename__ = "Gallows Pole" diff --git a/pyproject.toml b/pyproject.toml index 2338997faa2..e9bbf9eace5 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,3 +1,3 @@ [build-system] -requires = ["setuptools >= 66.1.0, <= 75.1.0"] # lower bound to support controller Python versions, upper bound for latest version tested at release +requires = ["setuptools >= 66.1.0, <= 75.3.0"] # lower bound to support controller Python versions, upper bound for latest version tested at release build-backend = "setuptools.build_meta"