Comment 132 for bug 2004555

We're 5 weekdays away from our self-imposed publication deadline, so unless we've got the text and backported patches ready to distribute downstream tomorrow, we should probably push that out. Our vulnerability management policy[*] states, "Embargoes for privately-submitted reports of suspected vulnerabilities shall not last more than 90 days, except under unusual circumstances." While we didn't start making headway on this report as early as I would have preferred, the cross-project nature of the problem and broad impact does qualify as an "unusual circumstance" in my opinion so I'm proposing we extend the deadline by a week to Wednesday, May 10 in order to complete proper due diligence of review and testing of the proposed solutions. Are there any objections?

As for where we are now... It appears we have consensus and no new concerns raised on patches for the cinder, glance_store, nova, os-brick and tempest repositories, with backports as far as the stable/xena branch (even though we assume stable/yoga will be the oldest non-EM branch by the time we publish, since stable/xena was supposed to reach EM a week ago). For the document, we seem to have most of the details filled in but are still working to finalize the prose for accuracy and clarity. I think once everyone following is happy enough with what's there, we'll be ready to pick a publication date and distribute advance copies of the document and patches to our downstream stakeholders.