Changes for version 0.005 - 2026-09-20
- Security
- Check the hostname of the TLS certificate of each OpenStack endpoint. OpenStack::Client makes its user agents with verify_hostname => 0, so the X-Auth-Token of every request went to whichever server answered. new() now gives OpenStack::Client::Auth the new class OpenStack::MetaAPI::UserAgent as package_ua, which leaves the check to LWP: on, unless PERL_LWP_SSL_VERIFY_HOSTNAME=0. If that variable is not set, HTTPS_CA_FILE or HTTPS_CA_DIR also turns it off. A caller that builds its own auth object passes package_ua => 'OpenStack::MetaAPI::UserAgent' to get the same. A cloud with a self-signed certificate now needs PERL_LWP_SSL_CA_FILE, or PERL_LWP_SSL_VERIFY_HOSTNAME=0.
- Dependencies
- LWP::UserAgent is now a direct requirement. OpenStack::MetaAPI::UserAgent subclasses it. It was already pulled in by OpenStack::Client, but the distribution now asks for it by name.
Modules
Perl5 OpenStack API abstraction on top of OpenStack::Client
an LWP::UserAgent that leaves TLS hostname verification to LWP