Version in base suite: 30.0.0-3+deb13u2 Version in overlay suite: 30.0.0-3+deb13u4 Base version: glance_30.0.0-3+deb13u4 Target version: glance_30.0.0-3+deb13u5 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/glance/glance_30.0.0-3+deb13u4.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/glance/glance_30.0.0-3+deb13u5.dsc changelog | 9 +++ patches/series | 1 patches/test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch | 30 ++++++++++ 3 files changed, 40 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpltza__z1/glance_30.0.0-3+deb13u4.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpltza__z1/glance_30.0.0-3+deb13u5.dsc: no acceptable signature found diff -Nru glance-30.0.0/debian/changelog glance-30.0.0/debian/changelog --- glance-30.0.0/debian/changelog 2026-08-31 20:49:17.000000000 +0000 +++ glance-30.0.0/debian/changelog 2026-11-07 23:03:06.000000000 +0000 @@ -1,3 +1,12 @@ +glance (2:30.0.0-3+deb13u5) trixie; urgency=medium + + * Fixed FTBFS on buildds without network access, mock DNS resolution in + test_new_image_with_location (Closes: #1149421): + - test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch + Thanks Santiago Vila for the bug report. + + -- Thomas Goirand Sun, 08 Nov 2026 00:03:06 +0100 + glance (2:30.0.0-3+deb13u4) trixie; urgency=medium * CVE-2026-71196, CVE-2026-71197, CVE-2026-71198: Multiple SSRF diff -Nru glance-30.0.0/debian/patches/series glance-30.0.0/debian/patches/series --- glance-30.0.0/debian/patches/series 2026-08-31 20:49:17.000000000 +0000 +++ glance-30.0.0/debian/patches/series 2026-11-07 23:03:06.000000000 +0000 @@ -7,3 +7,4 @@ CVE-2026-71196-71197-71198_2_Block_restricted_addresses_in_web-download_import_URIs.patch CVE-2026-71196-71197-71198_3_Pin_import_downloads_to_validated_destination_addresses.patch CVE-2026-71196-71197-71198_4_Block_restricted_hosts_when_adding_HTTP_image_locations.patch +test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch diff -Nru glance-30.0.0/debian/patches/test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch glance-30.0.0/debian/patches/test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch --- glance-30.0.0/debian/patches/test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch 1970-01-01 00:00:00.000000000 +0000 +++ glance-30.0.0/debian/patches/test_new_image_with_location_Do_not_rely_on_DNS_resolution.patch 2026-11-07 23:03:06.000000000 +0000 @@ -0,0 +1,30 @@ +Description: test_new_image_with_location: Do not rely on DNS resolution + Tests are often run in an environment that does not have any kind of + Internet access and cannot use DNS resolution. + . + Fixes FTBFS on Debian buildds without network access (Closes: #1149421). +Author: Cyril Roelandt +Date: Mon, 28 Sep 2026 19:25:45 +0200 +Origin: upstream, https://review.opendev.org/c/openstack/glance/+/1007874 +Bug-Debian: https://bugs.debian.org/1149421 +Last-Update: 2026-10-01 + +Index: glance/glance/tests/unit/test_store_image.py +=================================================================== +--- glance.orig/glance/tests/unit/test_store_image.py ++++ glance/glance/tests/unit/test_store_image.py +@@ -1200,7 +1200,13 @@ class TestImageFactory(unit_test_base.St + self.assertEqual('private', image.visibility) + self.assertEqual([], image.locations) + +- def test_new_image_with_location(self): ++ @mock.patch("glance.common.utils.socket.getaddrinfo") ++ def test_new_image_with_location(self, mock_getaddrinfo): ++ # This avoid internet access in validate_external_location() ++ # (ie: DNS resolution of storeurl.com) ++ mock_getaddrinfo.return_value = [ ++ (None, None, None, None, ('93.184.216.34', 80)) ++ ] + locations = [{'url': '%s/%s' % (BASE_URI, UUID1), + 'metadata': {}}] + image = self.image_factory.new_image(locations=locations)