LoginSign Up
← Back to all sparks
C

Cobbler

INFRA · APIS
Velocity5.0

Linux installation and provisioning server for bare metal and virtual systems

cobbler.github.io ↗

Cobbler's 3.3 backport branch ships Leap 16 and Agama support, then has to re-cut the release

provisioningbackportsdistro-supportinstaller-supportrelease-engineeringcve-fixes
◆Current state
Cobbler's public releases are all 3.3-branch backports, and the branch just had its most substantial drop in nearly two years. 3.3.8 added import and manage support for openSUSE Leap 16 and its Agama installer, interactive and automatic XCP-ng network installs, and basic Python 3.13 support. It was withdrawn 76 minutes after it appeared because its CI packaging workflow never ran on the tag, and 3.3.9 re-shipped the same content once the PyPI publish action was fixed. Before that pair, recent history is dominated by the CVE-2024-47533 admin-API bypass, patched on both 3.3 and 3.2.
◆Where it's heading
The branch is tracking new installer and distro ecosystems rather than winding down: Agama and XCP-ng are current targets, and Python 3.13 support keeps the package installable on newer hosts. Release engineering is the weak point, and the entries show why - SHA-pinning GitHub Actions inside CI is what broke the publish step, at the cost of a same-day defunct-and-replace. Feature work continues to arrive as rollups from main rather than as branch-native development.
◆Prediction
Expect the next 3.3.x tag to be another backport rollup, with CI hardening following the 3.3.9 failure. Whether the main line cuts a 3.4 is not something these entries show.

◆Recent moves

  1. 17d ago

    3.3.8 re-cut after fixing the PyPI publish workflow

    The only change is a fix to the pypa/gh-action-pypi-publish SHA-pin that left 3.3.8's packaging workflow unrun on tag pushes. Nothing new ships here, but this is the tag that actually delivers 3.3.8's Leap 16, Agama and XCP-ng work to users.

    View source ↗
  2. 17d ago

    Leap 16 and Agama support, withdrawn as defunct

    The substantive half of this pair: openSUSE Leap 16 and Agama installer support, interactive and automatic XCP-ng 7.x and 8.x network installs, and basic Python 3.13 support, alongside BIND zone and Windows import fixes. It was marked defunct the same evening when its packaging workflow failed, so the content reached users through 3.3.9 instead.

    View source ↗
  3. 2mo ago

    CVE-2024-47533 backported to the 3.2 branch

    The 3.2-branch twin of 3.3.7, cut for the same CVE-2024-47533 admin-API bypass, with its own fix and feature lists left as TBD. Its feed date sits well after the 2024-11-17 release it describes, so the stamp reads as a re-capture rather than new work.

    View source ↗
  4. 1y ago

    CVE-2024-47533: API admin authentication bypass fixed

    The 3.3-branch fix for an issue that let anyone connect to the API as admin, bundled with BIND cname generation, RHEL9 build and Windows fixes. Backports like this are the clearest justification for keeping 3.3 alive for downstreams.

    View source ↗
  5. 2y ago

    EFI support added to cobbler buildiso

    EFI support in cobbler buildiso is the notable addition, with extra_settings_list giving operators a supported way to carry custom settings. A typical rollup for this branch: a couple of real capabilities wrapped in a long fix list.

    View source ↗
  6. 2y ago

    Lazy collection loading and UUID, MAC and IP indices

    Startup lazy-loading plus new indices for UUIDs, MACs, IP addresses and hostnames - work aimed at installations large enough for linear scans to hurt. It marks the point where the backport branch starts absorbing performance work, not just fixes.

    View source ↗