blazar - Debian Package Tracker

general

source: blazar (main)
version: 18.0.0~rc2-1
maintainer: Debian OpenStack (DMD)
uploaders: Thomas Goirand [DMD]
arch: all
std-ver: 4.7.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 15.0.0-3
testing: 18.0.0~rc2-1
unstable: 18.0.0~rc2-1

versioned links

15.0.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.0.0~rc2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

blazar-api
blazar-common
blazar-doc
blazar-manager
python3-blazar

action needed

Marked for autoremoval on 03 November due to python-anyio: #1148561 high

Version 18.0.0~rc2-1 of blazar is marked for autoremoval from testing on Tue 03 Nov 2026. It depends (transitively) on python-anyio, affected by #1148561. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-09-22 Last update: 2026-09-30 05:00

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-08-31 Last update: 2026-09-30 05:32

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 18.0.0~rc2-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 1117d60ca93f8f44d51031c75862ef01a923a1d5
Author: Thomas Goirand <zigo@debian.org>
Date:   Thu Sep 24 21:49:37 2026 +0200

    Add Type=notify to all service units.

Created: 2026-09-24 Last update: 2026-09-29 23:02

2 open merge requests in Salsa normal

There are 2 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-09-29 Last update: 2026-09-29 23:02

lintian reports 15 warnings normal

Lintian reports 15 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-24 Last update: 2026-09-24 03:31

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

blazar-doc could be marked Multi-Arch: foreign

Created: 2025-04-01 Last update: 2026-09-30 05:32

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-93852: (needs triaging) In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases.
CVE-2026-93854: (needs triaging) In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-09-18 Last update: 2026-09-29 11:00

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 18.0.0~rc2-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2025-04-01 Last update: 2026-09-24 09:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.1).

Created: 2025-04-01 Last update: 2026-09-23 22:30

news

[rss feed]

[2026-09-30] blazar 18.0.0~rc2-1 MIGRATED to testing (Debian testing watch)
[2026-09-23] Accepted blazar 18.0.0~rc2-1 (source) into unstable (Thomas Goirand)
[2026-09-21] Accepted blazar 18.0.0~rc1-3 (source) into unstable (Thomas Goirand)
[2026-09-20] Accepted blazar 18.0.0~rc1-2 (source) into unstable (Thomas Goirand)
[2026-09-09] Accepted blazar 18.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2026-04-18] blazar 17.0.0-2 MIGRATED to testing (Debian testing watch)
[2026-04-13] Accepted blazar 17.0.0-2 (source) into unstable (Thomas Goirand)
[2026-04-06] blazar 17.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-01] Accepted blazar 17.0.0-1 (source) into unstable (Thomas Goirand)
[2026-04-01] blazar 17.0.0~rc1-3 MIGRATED to testing (Debian testing watch)
[2026-03-27] Accepted blazar 17.0.0~rc1-3 (source) into unstable (Thomas Goirand)
[2026-03-11] Accepted blazar 17.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2025-10-07] blazar 16.0.0-1 MIGRATED to testing (Debian testing watch)
[2025-10-01] Accepted blazar 16.0.0-1 (source) into unstable (Thomas Goirand)
[2025-09-28] Accepted blazar 16.0.0~rc1-3 (source) into unstable (Thomas Goirand)
[2025-09-18] Accepted blazar 16.0.0~rc1-2 (source) into experimental (Thomas Goirand)
[2025-09-12] Accepted blazar 16.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2025-07-18] blazar 15.0.0-3 MIGRATED to testing (Debian testing watch)
[2025-07-11] Accepted blazar 15.0.0-3 (source) into unstable (Thomas Goirand)
[2025-05-26] blazar 15.0.0-2 MIGRATED to testing (Debian testing watch)
[2025-05-12] Accepted blazar 15.0.0-2 (source) into unstable (Thomas Goirand)
[2025-04-07] blazar 15.0.0-1 MIGRATED to testing (Debian testing watch)
[2025-04-02] Accepted blazar 15.0.0-1 (source) into unstable (Thomas Goirand)
[2025-04-01] Accepted blazar 15.0.0~rc1-3 (source) into unstable (Thomas Goirand)
[2025-03-31] Accepted blazar 15.0.0~rc1-1 (source all) into experimental (Debian FTP Masters) (signed by: Thomas Goirand)
[2025-03-31] Accepted blazar 15.0.0~rc1-2 (source all) into experimental (Debian FTP Masters) (signed by: Thomas Goirand)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 15)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 17.0.0-2