{"push_id":771178566,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"d0e4a224009d024b42162a53a56b4b344d4be779","before":"944a5559b25a2e635fab4bc1f7e00723e0f1e920","commits":[{"sha":"d0e4a224009d024b42162a53a56b4b344d4be779","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Updated openstack/openstack\nProject: openstack/python-glanceclient  f25eb5e114bfa7eb82d3bb8b179840af03d43d8f\n\nRemove custom SSL compression handling\n\nCustom SSL handling was introduced because disabling SSL layer compression\nprovided an approximately five fold performance increase in some\ncases. Without SSL layer compression disabled the image transfer would be\nCPU bound -- with the CPU performing the DEFLATE algorithm.  This would\ntypically limit image transfers to < 20 MB/s. When --no-ssl-compression\nwas specified the client would not negotiate any compression algorithm\nduring the SSL handshake with the server which would remove the CPU\nbottleneck and transfers could approach wire speed.\n\nIn order to support '--no-ssl-compression' two totally separate code\npaths exist depending on whether this is True or False.  When SSL\ncompression is disabled, rather than using the standard 'requests'\nlibrary, we enter some custom code based on pyopenssl and httplib in\norder to disable compression.\n\nThis patch/spec proposes removing the custom code because:\n\n* It is a burden to maintain\n\n Eg adding new code such as keystone session support is more complicated\n\n* It can introduce additional failure modes\n\n We have seen some bugs related to the 'custom' certificate checking\n\n* Newer Operating Systems disable SSL for us.\n\n Eg. While Debian 7 defaulted to compression 'on', Debian 8 has compression\n 'off'. This makes both servers and client less likely to have compression\n enabled.\n\n* Newer combinations of 'requests' and 'python' do this for us\n\n Requests disables compression when backed by a version of python which\n supports it (>= 2.7.9). This makes clients more likely to disable\n compression out-of-the-box.\n\n* It is (in principle) possible to do this on older versions too\n\n If pyopenssl, ndg-httpsclient and pyasn1 are installed on older\n operating system/python combinations, the requests library should\n disable SSL compression on the client side.\n\n* Systems that have SSL compression enabled may be vulnerable to the CRIME\n(https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4929) attack.\nInstallations which are security conscious should be running the Glance\nserver with SSL disabled.\n\nFull Spec: https://review.openstack.org/#/c/187674\nBlueprint: remove-custom-client-ssl-handling\n\nChange-Id: I7e7761fc91b0d6da03939374eeedd809534f6edf","distinct":true,"url":"https://api.github.com/repos/openstack/openstack/commits/d0e4a224009d024b42162a53a56b4b344d4be779"}]}