Release notes¶
2.2.0¶
Bodhi 2.2.0 is a security and feature release, with a few bug fixes as well.
Security¶
This update addresses CVE-2016-1000008 by disallowing the re-use of solved captchas. Additionally, the captcha is warped to make it more difficult to solve through automation. Thanks to Patrick Uiterwijk for discovering and reporting this issue.
Features¶
- Bodhi’s
approve_testing.py
script will now comment on updates when they have reached a stable karma threshold (5b0d1c7c). - The web interface now displays a push to stable button when the karma reaches the right level when autokarma is disabled (#772 and #796).
- Masher messages now have an “agent”, so it is possible to tell which user ran the mash (45e4fc9f).
- Locked updates now list the time they were locked (#831).
- Bugs are closed and commented on in the same Bugzilla POST (#404).
- Karma values equal to 0 are no longer displayed with a green background to better distinguish them from positive karma reports (#799).
- Updates display a link to the feedback guidelines (#865).
- The new CLI now has a man page (95574831).
- The CLI now has a
--version
flag (#895).
Bugs¶
- Locked updates that aren’t part of a current push will now be pushed and warnings will be logged (bf4bdeef). This should help us to fix #838.
- Don’t show users an option to push to stable on obsoleted updates (#848).
- taskotron updates are shown per build, rather than per update (ce2394c6, 8e199668).
- The Sphinx documentation now builds again (b3f80b1b).
- Validator messages are now more useful and helpful (#630).
- The Bodhi CLI no longer depends on the server code to function (#900).
- Private bugs will no longer prevent the updates consumer from continuing (#905).
- bootstrap is now included in the setuptools manifest for the server package (#919).