Rationale: Apart of the server-o-openstack specification in order to get nova, glance, and swift into main.
Security: No known security history, however it needs to have a security review by the security team.
Quality Assurance: Package works out of the box but it needs to be configured for your specific setup. There is no major bugs in Ubuntu and the is no major bugs in Debian.
Standards Compliance: FHS and Debian Policy compliant.
Maintenance: Python package that the Ubuntu Server Team will take care of.
Dependencies: All are in main except for python-sqlalchemy-ext, python-mox, python-webob, python-routes, python-eventlet, python-migrate, python-swift, pep8 and python-migrate which all MIR to be done for.
- glance/ common/ config. py find_config_file() should not load config files from "." (e.g. imagine doing "sudo apt-get install glace" from /tmp and being surprised that ./glance- registry. conf gets loaded during the postinst, writing to arbitrary locations for SQL and logs) common/ utils.py creates dangerous "execute" function that uses the shell to run commands without filtering meta characters. Luckily nothing uses it's only user, fetchfile(). These should both be removed, along with the unused runthis().
- I don't see any packaging that replaces the "swift_store_key" or similar items in the default configs.
- packaging lacks a "purge" target that will clean up the added "glance" user from the glance.postinst
- should use SSL by default
- glance/
- is the POSTed image data actually used? I can't find many references to "image_data"