LoginSign Up
← Back to all sparks
C

Cobbler

INFRA · APIS
Velocity0.0

Linux installation and provisioning server for bare metal and virtual systems

cobbler.github.io ↗

Cobbler's 3.3 branch adds Kerberos single sign-on to the web UI.

provisioningbackportsauthenticationkerberosdistro-support
◆Current state
Cobbler's public releases are all 3.3-branch backports. 3.3.10 adds Kerberos/GSSAPI single sign-on for the web UI through an Apache-terminated bridge and hardens the passthru authentication module against timing attacks. It follows the 3.3.8/3.3.9 pair, which brought openSUSE Leap 16 and Agama installer support, XCP-ng network installs and Python 3.13 support, and had to be re-cut after a CI publishing failure.
◆Where it's heading
The branch is still gaining features aimed at enterprise data centres rather than winding down: new installer ecosystems in August, directory-backed single sign-on now. Authentication has been a recurring concern since the CVE-2024-47533 admin-API bypass. Releases continue to arrive as rollups from main.
◆Prediction
Expect further 3.3.x rollups; whether the main line cuts a 3.4 is not visible from these entries.

◆Recent moves

  1. 1mo ago

    3.3.10 adds Kerberos single sign-on to the web UI

    Kerberos/GSSAPI single sign-on for the web UI via Apache, plus timing-attack hardening in passthru authentication. A small release, but one that fits Cobbler into directory-managed data centres.

    View source ↗
  2. 2mo ago

    3.3.8 re-cut after fixing the PyPI publish workflow

    The only change is a fix to the pypa/gh-action-pypi-publish SHA-pin that left 3.3.8's packaging workflow unrun on tag pushes. Nothing new ships here, but this is the tag that actually delivers 3.3.8's Leap 16, Agama and XCP-ng work to users.

    View source ↗
  3. 2mo ago

    Leap 16 and Agama support, withdrawn as defunct

    The substantive half of this pair: openSUSE Leap 16 and Agama installer support, interactive and automatic XCP-ng 7.x and 8.x network installs, and basic Python 3.13 support, alongside BIND zone and Windows import fixes. It was marked defunct the same evening when its packaging workflow failed, so the content reached users through 3.3.9 instead.

    View source ↗
  4. 4mo ago

    CVE-2024-47533 backported to the 3.2 branch

    The 3.2-branch twin of 3.3.7, cut for the same CVE-2024-47533 admin-API bypass, with its own fix and feature lists left as TBD. Its feed date sits well after the 2024-11-17 release it describes, so the stamp reads as a re-capture rather than new work.

    View source ↗
  5. 1y ago

    CVE-2024-47533: API admin authentication bypass fixed

    The 3.3-branch fix for an issue that let anyone connect to the API as admin, bundled with BIND cname generation, RHEL9 build and Windows fixes. Backports like this are the clearest justification for keeping 3.3 alive for downstreams.

    View source ↗
  6. 2y ago

    EFI support added to cobbler buildiso

    EFI support in cobbler buildiso is the notable addition, with extra_settings_list giving operators a supported way to carry custom settings. A typical rollup for this branch: a couple of real capabilities wrapped in a long fix list.

    View source ↗