MANIFEST.in | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 fixes manifest.in so that alembic.ini is packaged

ironic/drivers/modules/initial_grub_cfg.template | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix initial_grub_cfg.template
 The default grub.cfg happen /srv/tftp, but tftp-hpa is, in Debian,
 already doing a chroot in there.

ironic/tests/unit/api/base.py | 5 3 + 2 - 0 !
1 file changed, 3 insertions(+), 2 deletions(-)

 do not print
 Without this patch, we're getting:
 .
  File "/<<PKGBUILDDIR>>/ironic/tests/unit/api/base.py", line 115, in _request_json
   print(method.upper(), full_path, "WITH", params, "GOT", str(response))
 BlockingIOError: [Errno 11] write could not complete without blocking
 .
 about 60 times (not always the same number of times...).

doc/source/install/standalone/enrollment.rst | 17 12 + 5 - 0 !
ironic/common/image_service.py | 22 20 + 2 - 0 !
ironic/conf/conductor.py | 15 15 + 0 - 0 !
ironic/conf/types.py | 55 55 + 0 - 0 !
ironic/tests/unit/common/test_image_service.py | 44 41 + 3 - 0 !
ironic/tests/unit/conf/test_conductor.py | 34 34 + 0 - 0 !
ironic/tests/unit/conf/test_types.py | 63 63 + 0 - 0 !
releasenotes/notes/ossa-2025-001-disallow-unsafe-image-paths-670fdcfe3e4647d4.yaml | 29 29 + 0 - 0 !
8 files changed, 269 insertions(+), 10 deletions(-)

 cve-2025-44021 / ossa-2025-001: disallow unsafe image file:// paths
 Before this change, Ironic did not filter file:// paths when used as an
 image source except to ensure they were a file (and not, e.g. a
 character device). This is problematic from a security perspective
 because you could end up with config files from well-known paths being
 written to disk on a node.
 .
 The allowlist default list is huge, but it includes all known usages of
 file:// URLs across Bifrost, Ironic, Metal3, and OpenShift in both CI
 and default configuration.
 .
 For the backportable version of this patch for stable branches, we have
 omitted the unconditional block of system paths in order to permit
 operators using those branches to fully disable the new security
 functionality.
Generated-by: Jetbrains Junie
Bug: https://launchpad.net/bugs/2107847
Bug-Debian: https://bugs.debian.org/1104964