LoginSign Up
← Back to all sparks
C

Cobbler

INFRA · APIS
Velocity0.0

Linux installation and provisioning server for bare metal and virtual systems

cobbler.github.io ↗

A backport branch kept alive for downstreams, with the main line nowhere in sight.

provisioningbackport-branchcve-backportsdistro-packagingxml-rpc-apistalled-major
◆Current state
Every release in Cobbler's visible history describes itself the same way: backports from main to make Cobbler more stable for the community. The 3.3.x line has absorbed real work under that framing — collection indices, lazy loading, new XML-RPC endpoints — but none of it originates here. The most recent item is a 3.2.3 build carrying the CVE-2024-47533 fix to an older branch, with its Fixed and Added sections left as literal TBD placeholders.
◆Where it's heading
This is a stabilization branch serving downstream packagers rather than a product advancing on its own. The work that does land splits cleanly into three buckets: distribution coverage (Ubuntu 22.04, Debian 12, AlmaLinux, RHEL9, openSUSE and SLE signatures), API surface for integrators, and security backports. 3.3.3 flagged dump_vars as the replacement for get_blended_data as of 3.4.0 — a version that has not appeared in any release since.
◆Prediction
Expect continued single-purpose backports to 3.3.x and older branches as CVEs surface; the entries give no indication of when or whether the 3.4.0 work these releases keep deferring to will ship.

◆Recent moves

  1. 1mo ago

    Cobbler 3.2.3 backports the CVE-2024-47533 admin API fix

    A 3.2.x build whose stated reason for existing is CVE-2024-47533, published with its Fixed and Added sections still reading TBD. The release notes are dated 2024-11-17, the same day as 3.3.7 — this is the same fix carried back to an older branch for downstreams that have not moved.

    View source ↗
  2. 1y ago

    Cobbler 3.3.7 closes an admin-API authentication bypass

    Closes CVE-2024-47533, which allowed anyone to connect to the API as admin, alongside bind cname generation, RHEL9 build breakage from the fence-agents-all split, and a profile-change sync bug. Nearly 10,000 insertions, all of it backported rather than developed on this branch.

    View source ↗
  3. 2y ago

    Cobbler 3.3.6 adds EFI support to buildiso

    EFI support arrives for cobbler buildiso, and extra_settings_list opens up settings definition for integrators. The rest is the usual mix of boot-menu, S390X and rename fixes that characterizes this branch.

    View source ↗
  4. 2y ago

    Cobbler 3.3.5 adds collection indices and lazy loading

    The most performance-minded release in the window: lazy loading of collections at startup, Item.to_dict() caching, and collection indices for UUIDs, MACs, IP addresses and hostnames. These are the changes of a project being pushed by installations large enough for linear scans to hurt.

    View source ↗
  5. 2y ago

    Cobbler 3.3.4 extends packaging to Ubuntu 22.04 and Debian 12

    Mostly distribution reach — Ubuntu 22.04 support, Debian 12 debs, a tests-containers subpackage, and a batch of openSUSE, SLES and SLE Micro signatures — with a long tail of XML-RPC and SELinux fixes underneath. Packaging breadth is how this branch stays relevant to downstreams.

    View source ↗
  6. 4y ago

    Cobbler 3.3.3 adds resolved-value XML-RPC endpoints for Uyuni

    Explicitly framed as getting Cobbler ready to ship in Uyuni, and it shows: schema validation for Uyuni proxies plus new get_item_resolved_value and set_item_resolved_value endpoints. Carries the window's only breaking change, virt_file_size becoming a float, and names dump_vars as the 3.4.0 successor to get_blended_data.

    View source ↗