cyborg - Debian Package Tracker

general

source: cyborg (main)
version: 16.0.0+git+2026.04.26.b8edfa06f1-1
maintainer: Debian OpenStack (DMD)
uploaders: Thomas Goirand [DMD]
arch: all
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 14.0.0-3
testing: 16.0.0+git+2026.04.26.b8edfa06f1-1
unstable: 16.0.0+git+2026.04.26.b8edfa06f1-1

versioned links

14.0.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
16.0.0+git+2026.04.26.b8edfa06f1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

cyborg-agent
cyborg-api
cyborg-common
cyborg-conductor
cyborg-doc
python3-cyborg

action needed

A new upstream version is available: 16.0.1 high

A new upstream version 16.0.1 is available, you should consider packaging it.

Created: 2026-05-15 Last update: 2026-05-30 15:02

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-40213: OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.
CVE-2026-40214: In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

Created: 2026-05-08 Last update: 2026-05-20 18:30

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-05-20 Last update: 2026-05-30 13:32

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-05-27 Last update: 2026-05-27 10:32

4 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit dc3626d2bdde0efb1c5c4db43a6d95ad611c885e
Author: Sakirnth Nagarasa <sakirnth@gmail.com>
Date:   Wed May 27 11:13:58 2026 +0200

    Revert "debian/cyborg-api.postinst.in: Adding directories for uwsgi ssl certificates."
    
    This reverts commit ddd3818f248625353d3b5968e60b30877235b1ea.

commit fe2b05689cb65cb4b35c25652dce78e4dde936ff
Author: Sakirnth Nagarasa <sakirnth@gmail.com>
Date:   Wed May 27 11:13:45 2026 +0200

    Revert "debian/cyborg-api.postrm: Remove ssl certificates directories when purging."
    
    This reverts commit 68fbee4dd8b83ce53c271087abc4d17722f7b059.

commit 68fbee4dd8b83ce53c271087abc4d17722f7b059
Author: Sakirnth Nagarasa <sakirnth@gmail.com>
Date:   Wed May 27 11:10:21 2026 +0200

    debian/cyborg-api.postrm: Remove ssl certificates directories when purging.

commit ddd3818f248625353d3b5968e60b30877235b1ea
Author: Sakirnth Nagarasa <sakirnth@gmail.com>
Date:   Wed May 27 11:08:08 2026 +0200

    debian/cyborg-api.postinst.in: Adding directories for uwsgi ssl certificates.

Created: 2026-05-27 Last update: 2026-05-27 10:32

lintian reports 17 warnings normal

Lintian reports 17 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-27 Last update: 2026-03-27 23:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.4.1).

Created: 2024-09-08 Last update: 2026-05-11 18:02

news

[rss feed]

[2026-05-21] cyborg 16.0.0+git+2026.04.26.b8edfa06f1-1 MIGRATED to testing (Debian testing watch)
[2026-05-11] Accepted cyborg 16.0.0+git+2026.04.26.b8edfa06f1-1 (source) into unstable (Thomas Goirand)
[2026-04-15] cyborg 16.0.0-2 MIGRATED to testing (Debian testing watch)
[2026-04-13] Accepted cyborg 16.0.0-2 (source) into unstable (Thomas Goirand)
[2026-04-03] cyborg 16.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-01] Accepted cyborg 16.0.0-1 (source) into unstable (Thomas Goirand)
[2026-04-01] cyborg 16.0.0~rc2-1 MIGRATED to testing (Debian testing watch)
[2026-03-27] Accepted cyborg 16.0.0~rc2-1 (source) into unstable (Thomas Goirand)
[2026-03-18] Accepted cyborg 16.0.0~rc1-2 (source) into experimental (Thomas Goirand)
[2026-03-17] Accepted cyborg 16.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2025-10-04] cyborg 15.0.0-1 MIGRATED to testing (Debian testing watch)
[2025-10-01] Accepted cyborg 15.0.0-1 (source) into unstable (Thomas Goirand)
[2025-10-01] cyborg 15.0.0~rc1-3 MIGRATED to testing (Debian testing watch)
[2025-09-28] Accepted cyborg 15.0.0~rc1-3 (source) into unstable (Thomas Goirand)
[2025-09-18] Accepted cyborg 15.0.0~rc1-2 (source) into experimental (Thomas Goirand)
[2025-09-12] Accepted cyborg 15.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2025-07-18] cyborg 14.0.0-3 MIGRATED to testing (Debian testing watch)
[2025-07-12] Accepted cyborg 14.0.0-3 (source) into unstable (Thomas Goirand)
[2025-04-05] cyborg 14.0.0-2 MIGRATED to testing (Debian testing watch)
[2025-04-02] Accepted cyborg 14.0.0-2 (source) into unstable (Thomas Goirand)
[2025-04-02] Accepted cyborg 14.0.0-1 (source) into unstable (Thomas Goirand)
[2025-03-31] cyborg 14.0.0~rc1-2 MIGRATED to testing (Debian testing watch)
[2025-03-28] Accepted cyborg 14.0.0~rc1-2 (source) into unstable (Thomas Goirand)
[2025-03-14] Accepted cyborg 14.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2024-12-22] cyborg 13.0.0-2 MIGRATED to testing (Debian testing watch)
[2024-12-19] Accepted cyborg 13.0.0-2 (source) into unstable (Thomas Goirand)
[2024-10-05] cyborg 13.0.0-1 MIGRATED to testing (Debian testing watch)
[2024-10-02] Accepted cyborg 13.0.0-1 (source) into unstable (Thomas Goirand)
[2024-09-25] cyborg 13.0.0~rc1-1 MIGRATED to testing (Debian testing watch)
[2024-09-23] Accepted cyborg 13.0.0~rc1-1 (source) into unstable (Thomas Goirand)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 0
F&P: 1
patch: 0

links

homepage
lintian (0, 17)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 16.0.0+git+2026.04.26.b8edfa06f1-1
1 bug