)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"1592a70077303b01799d3ab07d9a0162c16f9849","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"a3967ce4_57294394","updated":"2026-08-27 16:33:06.000000000","message":"This depends on the microversion 1.3 API in 1002398, which is still WIP.  Please hold this until that settles.  Also, CI is currently failing (Verified-1); can you check that before this goes further?","commit_id":"a6abf650bb04c359a250caf8d9dbc89c54deaaff"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"f2d1990338e1bd0daa0a35ff0ba6d6ec922f2437","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"ccc7a5a5_d4b95933","in_reply_to":"a3967ce4_57294394","updated":"2026-10-02 14:24:37.000000000","message":"Done","commit_id":"a6abf650bb04c359a250caf8d9dbc89c54deaaff"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"a3045606475fa9bfa54ccaf20dc9deb626fc3321","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"d0870364_f5b9d36a","updated":"2026-09-08 21:27:41.000000000","message":"I\u0027m not sure this patch really adds any great benefit as it currently is formulated.  If we want this, it needs to be a more robust admin tool that , for example, allows the admin to migrate any project\u0027s secrets, or migrate all the secrets on a given backend.","commit_id":"eafbf91b8af4a05c0b5d477a10e8f0d809b3d586"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"79b4c98e7a0adcded50d142d64757afabfd70a3e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"96b3b67f_778150e3","in_reply_to":"a3967ce4_57294394","updated":"2026-10-02 19:07:32.000000000","message":"Done — microversion 1.3 API (1002398) is merged. Rebased this change onto that tip; leaving WIP until the --include-expired / SKIP follow-ups are re-reviewed.","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"a5fd62766d01b83ec72f4088db9f7959876a4d91","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"31210178_3cefa8a9","updated":"2026-10-06 14:36:00.000000000","message":"my AI minion jumped the gun in posting the last patch.  I am reviewing and testing.","commit_id":"71bde0cb0a7d86466b8376c868c72154c57223cf"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"bfe3b2eea5f7cfaad4f46b53289c6be84cdf4f97","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"60f4cbc2_a23e03c7","updated":"2026-10-06 20:03:42.000000000","message":"Newly tested.  Addresses @dmendiza@redhat.com comments and a few nits of my own.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"fb443ffa3761d92813585646ee488458fdd25f62","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":17,"id":"808f5e3f_a909fcf3","updated":"2026-10-08 10:08:57.000000000","message":"The rollback fix and the expired-secrets simplification both look correct in last patchset.\n\nOne non-blocking usability note for a follow-up: the `--error-file` output is JSONL with full failure records, but `--secret-ids-file` expects one UUID or href per line. Reusing a failed run\u0027s error file directly as `--secret-ids-file` fails on the first line. Worth aligning the two formats (or adding a small helper to pull secret_id out of the JSONL) in a follow-up patch.","commit_id":"83b55ee8819f14f88d3e7ad246a2bd7dea224863"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"fa5fed380e622d9938bf5c108a2a544685a8218e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":17,"id":"861665d7_3938fcf5","updated":"2026-10-08 13:10:01.000000000","message":"recheck","commit_id":"83b55ee8819f14f88d3e7ad246a2bd7dea224863"}],"barbican/api/controllers/secrets.py":[{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f1cfa9761d7a4028ea917950c5dc55a86bd4e81","unresolved":true,"context_lines":[{"line_number":421,"context_line":"        if not utils.validate_id_is_uuid(secret_id):"},{"line_number":422,"context_line":"            _invalid_secret_id()()"},{"line_number":423,"context_line":"        # GET/metadata still hide expired secrets. Migrate must be able"},{"line_number":424,"context_line":"        # to load them so operators can drain expired payloads off a"},{"line_number":425,"context_line":"        # backend (see barbican-manage secret migrate --include-expired)."},{"line_number":426,"context_line":"        include_expired \u003d bool("},{"line_number":427,"context_line":"            remainder and remainder[0] \u003d\u003d \u0027secret-store\u0027)"},{"line_number":428,"context_line":"        secret \u003d self.secret_repo.get_secret_by_id("}],"source_content_type":"text/x-python","patch_set":14,"id":"955263cb_d72e5d10","line":425,"range":{"start_line":424,"start_character":46,"end_line":425,"end_character":17},"updated":"2026-10-06 13:37:50.000000000","message":"IIRC, expired secrets should be treated as deleted.  Why would we want to migrate those?","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"e50678fc7096a6ac77caab4abd5a4303bfb70248","unresolved":false,"context_lines":[{"line_number":421,"context_line":"        if not utils.validate_id_is_uuid(secret_id):"},{"line_number":422,"context_line":"            _invalid_secret_id()()"},{"line_number":423,"context_line":"        # GET/metadata still hide expired secrets. Migrate must be able"},{"line_number":424,"context_line":"        # to load them so operators can drain expired payloads off a"},{"line_number":425,"context_line":"        # backend (see barbican-manage secret migrate --include-expired)."},{"line_number":426,"context_line":"        include_expired \u003d bool("},{"line_number":427,"context_line":"            remainder and remainder[0] \u003d\u003d \u0027secret-store\u0027)"},{"line_number":428,"context_line":"        secret \u003d self.secret_repo.get_secret_by_id("}],"source_content_type":"text/x-python","patch_set":14,"id":"e9c7a5e7_e1925af2","line":425,"range":{"start_line":424,"start_character":46,"end_line":425,"end_character":17},"in_reply_to":"7d4ade69_1c5b8aa1","updated":"2026-10-07 22:17:58.000000000","message":"as decided in discussion , removed support for migrating expired secrets","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"72b491e086d3aa00b527aed50d007ddccba6bff7","unresolved":true,"context_lines":[{"line_number":421,"context_line":"        if not utils.validate_id_is_uuid(secret_id):"},{"line_number":422,"context_line":"            _invalid_secret_id()()"},{"line_number":423,"context_line":"        # GET/metadata still hide expired secrets. Migrate must be able"},{"line_number":424,"context_line":"        # to load them so operators can drain expired payloads off a"},{"line_number":425,"context_line":"        # backend (see barbican-manage secret migrate --include-expired)."},{"line_number":426,"context_line":"        include_expired \u003d bool("},{"line_number":427,"context_line":"            remainder and remainder[0] \u003d\u003d \u0027secret-store\u0027)"},{"line_number":428,"context_line":"        secret \u003d self.secret_repo.get_secret_by_id("}],"source_content_type":"text/x-python","patch_set":14,"id":"7d4ade69_1c5b8aa1","line":425,"range":{"start_line":424,"start_character":46,"end_line":425,"end_character":17},"in_reply_to":"955263cb_d72e5d10","updated":"2026-10-06 13:49:42.000000000","message":"This was suggested in review.  The use case would be an admin that wants to decommission a particular backend and move all the secrets (including the expired ones) to a new backend.","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"}],"barbican/cmd/barbican_manage.py":[{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"ee96dfc226e8bf33435a8eae1d618c8fff5ca88d","unresolved":true,"context_lines":[{"line_number":485,"context_line":""},{"line_number":486,"context_line":"def main():"},{"line_number":487,"context_line":"    \"\"\"Parse options and call the appropriate class/method.\"\"\""},{"line_number":488,"context_line":"    migrate_argv \u003d _secret_migrate_argv(sys.argv[1:])"},{"line_number":489,"context_line":"    if migrate_argv is not None:"},{"line_number":490,"context_line":"        return secret_store_migrate.main(argv\u003dmigrate_argv)"},{"line_number":491,"context_line":""},{"line_number":492,"context_line":"    CONF \u003d config.new_config()"},{"line_number":493,"context_line":"    CONF.register_cli_opt(category_opt)"}],"source_content_type":"text/x-python","patch_set":14,"id":"1d6a2777_2fd33a94","line":490,"range":{"start_line":488,"start_character":4,"end_line":490,"end_character":59},"updated":"2026-10-06 13:47:10.000000000","message":"Why is this different than parsing all other subcommands?","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":false,"context_lines":[{"line_number":485,"context_line":""},{"line_number":486,"context_line":"def main():"},{"line_number":487,"context_line":"    \"\"\"Parse options and call the appropriate class/method.\"\"\""},{"line_number":488,"context_line":"    migrate_argv \u003d _secret_migrate_argv(sys.argv[1:])"},{"line_number":489,"context_line":"    if migrate_argv is not None:"},{"line_number":490,"context_line":"        return secret_store_migrate.main(argv\u003dmigrate_argv)"},{"line_number":491,"context_line":""},{"line_number":492,"context_line":"    CONF \u003d config.new_config()"},{"line_number":493,"context_line":"    CONF.register_cli_opt(category_opt)"}],"source_content_type":"text/x-python","patch_set":14,"id":"3bdbaf42_79d93ff3","line":490,"range":{"start_line":488,"start_character":4,"end_line":490,"end_character":59},"in_reply_to":"1d6a2777_2fd33a94","updated":"2026-10-07 15:50:44.000000000","message":"It was because we were doing keystone auth.  That is no longer the case and so the parsing should be no different now.","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"dea573d06fdccf79d3b52e3680764e0c9358894b","unresolved":true,"context_lines":[{"line_number":358,"context_line":"    migrate_description \u003d ("},{"line_number":359,"context_line":"        \"Migrate secret payloads onto another secret store\")"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    @args(\u0027--dest-store-id\u0027, \u0027--secret-store-id\u0027, metavar\u003d\u0027\u003cuuid\u003e\u0027,"},{"line_number":362,"context_line":"          dest\u003d\u0027dest_store_id\u0027, required\u003dTrue,"},{"line_number":363,"context_line":"          help\u003d\u0027Destination secret store UUID\u0027)"},{"line_number":364,"context_line":"    @args(\u0027--source-store-id\u0027, metavar\u003d\u0027\u003cuuid\u003e\u0027, dest\u003d\u0027source_store_id\u0027,"}],"source_content_type":"text/x-python","patch_set":16,"id":"6e2c569c_6a9e7d1f","line":361,"range":{"start_line":361,"start_character":10,"end_line":361,"end_character":48},"updated":"2026-10-07 14:35:30.000000000","message":"Should use just one of these to avoid confusion.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":true,"context_lines":[{"line_number":358,"context_line":"    migrate_description \u003d ("},{"line_number":359,"context_line":"        \"Migrate secret payloads onto another secret store\")"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    @args(\u0027--dest-store-id\u0027, \u0027--secret-store-id\u0027, metavar\u003d\u0027\u003cuuid\u003e\u0027,"},{"line_number":362,"context_line":"          dest\u003d\u0027dest_store_id\u0027, required\u003dTrue,"},{"line_number":363,"context_line":"          help\u003d\u0027Destination secret store UUID\u0027)"},{"line_number":364,"context_line":"    @args(\u0027--source-store-id\u0027, metavar\u003d\u0027\u003cuuid\u003e\u0027, dest\u003d\u0027source_store_id\u0027,"}],"source_content_type":"text/x-python","patch_set":16,"id":"c12ec987_dd2ca785","line":361,"range":{"start_line":361,"start_character":10,"end_line":361,"end_character":48},"in_reply_to":"6e2c569c_6a9e7d1f","updated":"2026-10-07 15:50:44.000000000","message":"agreed.  will use --dest-store-id (to match --source-store-id) only.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"e50678fc7096a6ac77caab4abd5a4303bfb70248","unresolved":false,"context_lines":[{"line_number":358,"context_line":"    migrate_description \u003d ("},{"line_number":359,"context_line":"        \"Migrate secret payloads onto another secret store\")"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    @args(\u0027--dest-store-id\u0027, \u0027--secret-store-id\u0027, metavar\u003d\u0027\u003cuuid\u003e\u0027,"},{"line_number":362,"context_line":"          dest\u003d\u0027dest_store_id\u0027, required\u003dTrue,"},{"line_number":363,"context_line":"          help\u003d\u0027Destination secret store UUID\u0027)"},{"line_number":364,"context_line":"    @args(\u0027--source-store-id\u0027, metavar\u003d\u0027\u003cuuid\u003e\u0027, dest\u003d\u0027source_store_id\u0027,"}],"source_content_type":"text/x-python","patch_set":16,"id":"860f0022_85bdcc8f","line":361,"range":{"start_line":361,"start_character":10,"end_line":361,"end_character":48},"in_reply_to":"c12ec987_dd2ca785","updated":"2026-10-07 22:17:58.000000000","message":"Done","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"dea573d06fdccf79d3b52e3680764e0c9358894b","unresolved":true,"context_lines":[{"line_number":370,"context_line":"          help\u003d\u0027Secret UUID or href (repeatable)\u0027)"},{"line_number":371,"context_line":"    @args(\u0027--secret-ids-file\u0027, metavar\u003d\u0027\u003cpath\u003e\u0027, dest\u003d\u0027secret_ids_file\u0027,"},{"line_number":372,"context_line":"          help\u003d\u0027File of secret UUIDs/hrefs, one per line\u0027)"},{"line_number":373,"context_line":"    @args(\u0027--yes\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027yes\u0027, default\u003dFalse,"},{"line_number":374,"context_line":"          help\u003d\u0027Required for --project-id / --source-store-id unless \u0027"},{"line_number":375,"context_line":"               \u0027--dry-run is set\u0027)"},{"line_number":376,"context_line":"    @args(\u0027--dry-run\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027dry_run\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":16,"id":"b60dc232_f08ad1d6","line":373,"range":{"start_line":373,"start_character":10,"end_line":373,"end_character":17},"updated":"2026-10-07 14:35:30.000000000","message":"Remove this.  It seems unnecessary since this command also has a `--dry-run` option.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"e50678fc7096a6ac77caab4abd5a4303bfb70248","unresolved":false,"context_lines":[{"line_number":370,"context_line":"          help\u003d\u0027Secret UUID or href (repeatable)\u0027)"},{"line_number":371,"context_line":"    @args(\u0027--secret-ids-file\u0027, metavar\u003d\u0027\u003cpath\u003e\u0027, dest\u003d\u0027secret_ids_file\u0027,"},{"line_number":372,"context_line":"          help\u003d\u0027File of secret UUIDs/hrefs, one per line\u0027)"},{"line_number":373,"context_line":"    @args(\u0027--yes\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027yes\u0027, default\u003dFalse,"},{"line_number":374,"context_line":"          help\u003d\u0027Required for --project-id / --source-store-id unless \u0027"},{"line_number":375,"context_line":"               \u0027--dry-run is set\u0027)"},{"line_number":376,"context_line":"    @args(\u0027--dry-run\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027dry_run\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":16,"id":"0f60cf2f_d781a618","line":373,"range":{"start_line":373,"start_character":10,"end_line":373,"end_character":17},"in_reply_to":"3aa2da85_ac457e69","updated":"2026-10-07 22:17:58.000000000","message":"added prompt as described.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"c46890ad98cd88b799cc994e0a5e7947173d4304","unresolved":true,"context_lines":[{"line_number":370,"context_line":"          help\u003d\u0027Secret UUID or href (repeatable)\u0027)"},{"line_number":371,"context_line":"    @args(\u0027--secret-ids-file\u0027, metavar\u003d\u0027\u003cpath\u003e\u0027, dest\u003d\u0027secret_ids_file\u0027,"},{"line_number":372,"context_line":"          help\u003d\u0027File of secret UUIDs/hrefs, one per line\u0027)"},{"line_number":373,"context_line":"    @args(\u0027--yes\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027yes\u0027, default\u003dFalse,"},{"line_number":374,"context_line":"          help\u003d\u0027Required for --project-id / --source-store-id unless \u0027"},{"line_number":375,"context_line":"               \u0027--dry-run is set\u0027)"},{"line_number":376,"context_line":"    @args(\u0027--dry-run\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027dry_run\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":16,"id":"3aa2da85_ac457e69","line":373,"range":{"start_line":373,"start_character":10,"end_line":373,"end_character":17},"in_reply_to":"415be699_d1c7e1e8","updated":"2026-10-07 18:44:02.000000000","message":"It just seems silly to me to require a second arg when I already provided the arg that triggers the operation.  It would make more sense to me if this `--yes` flag was actually controlling an interactive \"Are you sure?\" prompt, instead of just arbitrarily being required. e.g.\n\n    barbican manage secret migrate --project-id XXX\n    \u003e You\u0027re about to migrate all secrets for project XXX\n    \u003e which may take a long time. Are you sure? [y/N]","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":true,"context_lines":[{"line_number":370,"context_line":"          help\u003d\u0027Secret UUID or href (repeatable)\u0027)"},{"line_number":371,"context_line":"    @args(\u0027--secret-ids-file\u0027, metavar\u003d\u0027\u003cpath\u003e\u0027, dest\u003d\u0027secret_ids_file\u0027,"},{"line_number":372,"context_line":"          help\u003d\u0027File of secret UUIDs/hrefs, one per line\u0027)"},{"line_number":373,"context_line":"    @args(\u0027--yes\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027yes\u0027, default\u003dFalse,"},{"line_number":374,"context_line":"          help\u003d\u0027Required for --project-id / --source-store-id unless \u0027"},{"line_number":375,"context_line":"               \u0027--dry-run is set\u0027)"},{"line_number":376,"context_line":"    @args(\u0027--dry-run\u0027, action\u003d\u0027store_true\u0027, dest\u003d\u0027dry_run\u0027, default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":16,"id":"415be699_d1c7e1e8","line":373,"range":{"start_line":373,"start_character":10,"end_line":373,"end_character":17},"in_reply_to":"b60dc232_f08ad1d6","updated":"2026-10-07 15:50:44.000000000","message":"This is a little different.  --dry-run gives you a preview of what would be done.\n\n--yes is a guard against inadvertently performing footgun bulk operations.  So, these are operations where you move all the secrets in a project, or all the secrets from one backend to another.  As this could involve hundreds or even thousands of secrets, an extra guard does not seem remiss.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"}],"barbican/cmd/secret_store_migrate.py":[{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"ac086b0546107b41925327c67526db4324c35868","unresolved":true,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    def _ensure_base_token(self):"},{"line_number":145,"context_line":"        if self._base_token is not None:"},{"line_number":146,"context_line":"            return"},{"line_number":147,"context_line":"        auth \u003d self._loading.load_auth_from_argparse_arguments("},{"line_number":148,"context_line":"            self.args)"},{"line_number":149,"context_line":"        session \u003d self._loading.load_session_from_argparse_arguments("}],"source_content_type":"text/x-python","patch_set":9,"id":"b9d39c4e_779aa9b0","line":146,"updated":"2026-09-18 14:31:47.000000000","message":"Long --source-store-id drains can outlive the Keystone token. Re-auth on 401, or document the limit.","commit_id":"d7730f1afefe5e25e92cbe92ffb7cc7966951fa3"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"19ab6af960127c1546412649f7e3f3ec2c0eed02","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    def _ensure_base_token(self):"},{"line_number":145,"context_line":"        if self._base_token is not None:"},{"line_number":146,"context_line":"            return"},{"line_number":147,"context_line":"        auth \u003d self._loading.load_auth_from_argparse_arguments("},{"line_number":148,"context_line":"            self.args)"},{"line_number":149,"context_line":"        session \u003d self._loading.load_session_from_argparse_arguments("}],"source_content_type":"text/x-python","patch_set":9,"id":"4692d14d_bc012420","line":146,"in_reply_to":"b9d39c4e_779aa9b0","updated":"2026-10-01 19:24:03.000000000","message":"Done","commit_id":"d7730f1afefe5e25e92cbe92ffb7cc7966951fa3"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"ac086b0546107b41925327c67526db4324c35868","unresolved":true,"context_lines":[{"line_number":310,"context_line":"            continue"},{"line_number":311,"context_line":"        if (args.source_store_id and"},{"line_number":312,"context_line":"                store.id !\u003d args.source_store_id):"},{"line_number":313,"context_line":"            continue"},{"line_number":314,"context_line":"        targets.append(Target("},{"line_number":315,"context_line":"            secret_id\u003dsecret.id,"},{"line_number":316,"context_line":"            project_id\u003dexternal_id,"}],"source_content_type":"text/x-python","patch_set":9,"id":"1f46b053_01f74557","line":313,"updated":"2026-09-18 14:31:47.000000000","message":"Filters source store, but not store.id \u003d\u003d args.dest_store_id. Project-wide runs will PUT secrets already on dest... I think it\u0027s an API no-op, but still","commit_id":"d7730f1afefe5e25e92cbe92ffb7cc7966951fa3"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"9e6075cf6291be5fde4929de9b38c5f5a0d69951","unresolved":false,"context_lines":[{"line_number":310,"context_line":"            continue"},{"line_number":311,"context_line":"        if (args.source_store_id and"},{"line_number":312,"context_line":"                store.id !\u003d args.source_store_id):"},{"line_number":313,"context_line":"            continue"},{"line_number":314,"context_line":"        targets.append(Target("},{"line_number":315,"context_line":"            secret_id\u003dsecret.id,"},{"line_number":316,"context_line":"            project_id\u003dexternal_id,"}],"source_content_type":"text/x-python","patch_set":9,"id":"5c33664a_bc1a2002","line":313,"in_reply_to":"1f46b053_01f74557","updated":"2026-10-02 14:24:04.000000000","message":"Done","commit_id":"d7730f1afefe5e25e92cbe92ffb7cc7966951fa3"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"d2cffccd05a60aae33edefa1f12905d5010ede7c","unresolved":true,"context_lines":[{"line_number":226,"context_line":"def _query_secrets(session, project_id\u003dNone, secret_ids\u003dNone):"},{"line_number":227,"context_line":"    from barbican.model import models"},{"line_number":228,"context_line":"    query \u003d session.query(models.Secret)"},{"line_number":229,"context_line":"    query \u003d query.filter_by(deleted\u003dFalse)"},{"line_number":230,"context_line":"    now \u003d timeutils.utcnow()"},{"line_number":231,"context_line":"    query \u003d query.filter(or_("},{"line_number":232,"context_line":"        models.Secret.expiration.is_(None),"}],"source_content_type":"text/x-python","patch_set":12,"id":"70e07dd9_5cbf456d","line":229,"updated":"2026-10-02 14:46:45.000000000","message":"This excludes secrets from any migration.  It\u0027s OK for `--project-id`, but it doesn\u0027t seem consistent with the documented `--source-store-id` use case. If the goal is to fully decommission a backend, expired secrets\u0027 payloads stay behind, and the command reports success without ever touching them. I think it\u0027s worth confirming whether this is intentional or whether `--source-store-id` should ignore the expiration filter.","commit_id":"b9064c4bbc601c2848cb66c472e075f53b3edd04"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"d28bd1f2a32a98af21f0ff98938e0d285add28dc","unresolved":true,"context_lines":[{"line_number":226,"context_line":"def _query_secrets(session, project_id\u003dNone, secret_ids\u003dNone):"},{"line_number":227,"context_line":"    from barbican.model import models"},{"line_number":228,"context_line":"    query \u003d session.query(models.Secret)"},{"line_number":229,"context_line":"    query \u003d query.filter_by(deleted\u003dFalse)"},{"line_number":230,"context_line":"    now \u003d timeutils.utcnow()"},{"line_number":231,"context_line":"    query \u003d query.filter(or_("},{"line_number":232,"context_line":"        models.Secret.expiration.is_(None),"}],"source_content_type":"text/x-python","patch_set":12,"id":"bdc668b3_afbb3ee1","line":229,"in_reply_to":"70e07dd9_5cbf456d","updated":"2026-10-02 15:20:00.000000000","message":"The above query (deleted\u003dfalse)  excludes soft deleted secrets.  It doesn\u0027t make sense to migrate these secrets because the payload for these secrets no longer exist on any backend.  All that remains of these secrets is a tombstone.\n\nThere is a current spec to try to resurrect a secret that was accidentally deleted using the tombstone, but this requires you to have the payload and store it again.\n\nA case could be made for expired secrets - which is the filter below. Maybe the answer here is to provide an option for the caller to decide whether to include expired secrets or not - with the default being not to.","commit_id":"b9064c4bbc601c2848cb66c472e075f53b3edd04"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"d2cffccd05a60aae33edefa1f12905d5010ede7c","unresolved":true,"context_lines":[{"line_number":323,"context_line":"        # Skip secrets already on the destination; the API is a no-op"},{"line_number":324,"context_line":"        # for those, but bulk runs should not issue needless PUTs."},{"line_number":325,"context_line":"        if store.id \u003d\u003d args.dest_store_id:"},{"line_number":326,"context_line":"            continue"},{"line_number":327,"context_line":"        targets.append(Target("},{"line_number":328,"context_line":"            secret_id\u003dsecret.id,"},{"line_number":329,"context_line":"            project_id\u003dexternal_id,"}],"source_content_type":"text/x-python","patch_set":12,"id":"0765560a_386915da","line":326,"updated":"2026-10-02 14:46:45.000000000","message":"This continue is unconditional, even when secret_ids was passed explicitly. The result is in a retry flow via `--secret-ids-file` (reusing a previous run\u0027s error-file), an id that was already migrated vanishes from the summary\u0027s total with no log line at all. This can confuse when auditing \"what happened to each requested id.\"","commit_id":"b9064c4bbc601c2848cb66c472e075f53b3edd04"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"d28bd1f2a32a98af21f0ff98938e0d285add28dc","unresolved":true,"context_lines":[{"line_number":323,"context_line":"        # Skip secrets already on the destination; the API is a no-op"},{"line_number":324,"context_line":"        # for those, but bulk runs should not issue needless PUTs."},{"line_number":325,"context_line":"        if store.id \u003d\u003d args.dest_store_id:"},{"line_number":326,"context_line":"            continue"},{"line_number":327,"context_line":"        targets.append(Target("},{"line_number":328,"context_line":"            secret_id\u003dsecret.id,"},{"line_number":329,"context_line":"            project_id\u003dexternal_id,"}],"source_content_type":"text/x-python","patch_set":12,"id":"10bf4294_7614a5a1","line":326,"in_reply_to":"0765560a_386915da","updated":"2026-10-02 15:20:00.000000000","message":"It definitely makes sense to exclude these secrets here.\n\nIn --dry-run mode, you get a bunch of output that says \"I would migrate these secrets x,y,z to backend B\".  It doesn\u0027t have any output that says \"I\u0027m not migrating a,b,c because they are already on the backend\".  And if all the secrets are on the backend, it will output \"No secrets to migrate\".\n\nIs this OK?  I can keep track of the IDs that are already migrated and list them if we think that is more helpful.","commit_id":"b9064c4bbc601c2848cb66c472e075f53b3edd04"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"79b4c98e7a0adcded50d142d64757afabfd70a3e","unresolved":false,"context_lines":[{"line_number":231,"context_line":"    from barbican.model import models"},{"line_number":232,"context_line":"    query \u003d session.query(models.Secret)"},{"line_number":233,"context_line":"    query \u003d query.filter_by(deleted\u003dFalse)"},{"line_number":234,"context_line":"    if not include_expired:"},{"line_number":235,"context_line":"        now \u003d timeutils.utcnow()"},{"line_number":236,"context_line":"        query \u003d query.filter(or_("},{"line_number":237,"context_line":"            models.Secret.expiration.is_(None),"}],"source_content_type":"text/x-python","patch_set":13,"id":"c0d22bd8_a5dd1d01","line":234,"in_reply_to":"70e07dd9_5cbf456d","updated":"2026-10-02 19:07:32.000000000","message":"Agreed — excluding expired by default is intentional for normal --project-id runs, but a full backend drain needs them. Added --include-expired for that case (soft-deleted still never migrate).\n\nAlso fixed the migrate API path: GET still 404s expired secrets, but PUT .../secret-store/{id} can load them so --include-expired can actually move the payload. Verified on ITUP SoftHSM lab.","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"79b4c98e7a0adcded50d142d64757afabfd70a3e","unresolved":false,"context_lines":[{"line_number":231,"context_line":"    from barbican.model import models"},{"line_number":232,"context_line":"    query \u003d session.query(models.Secret)"},{"line_number":233,"context_line":"    query \u003d query.filter_by(deleted\u003dFalse)"},{"line_number":234,"context_line":"    if not include_expired:"},{"line_number":235,"context_line":"        now \u003d timeutils.utcnow()"},{"line_number":236,"context_line":"        query \u003d query.filter(or_("},{"line_number":237,"context_line":"            models.Secret.expiration.is_(None),"}],"source_content_type":"text/x-python","patch_set":13,"id":"e25c531a_f0ca2837","line":234,"in_reply_to":"bdc668b3_afbb3ee1","updated":"2026-10-02 19:07:32.000000000","message":"Follow-up from that discussion: --include-expired is in, and the migrate API accepts expired secrets for this path. Soft-deleted remain excluded (tombstones only).","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"79b4c98e7a0adcded50d142d64757afabfd70a3e","unresolved":false,"context_lines":[{"line_number":338,"context_line":"                project_id\u003dexternal_id,"},{"line_number":339,"context_line":"                name\u003dsecret.name or \u0027\u0027,"},{"line_number":340,"context_line":"                current_store_id\u003dstore.id,"},{"line_number":341,"context_line":"                skip_reason\u003d\u0027already on destination store\u0027))"},{"line_number":342,"context_line":"            continue"},{"line_number":343,"context_line":"        targets.append(Target("},{"line_number":344,"context_line":"            secret_id\u003dsecret.id,"}],"source_content_type":"text/x-python","patch_set":13,"id":"91e1e3ef_acf6e245","line":341,"in_reply_to":"0765560a_386915da","updated":"2026-10-02 19:07:32.000000000","message":"Fixed. Already-on-destination ids are no longer dropped silently: they become Target(skip_reason\u003d\u0027already on destination store\u0027), count in Summary skipped\u003d, and print per-id SKIP lines for --dry-run and explicit --secret-id / --secret-ids-file (bulk --project-id live runs only count them to avoid flooding).","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"79b4c98e7a0adcded50d142d64757afabfd70a3e","unresolved":false,"context_lines":[{"line_number":338,"context_line":"                project_id\u003dexternal_id,"},{"line_number":339,"context_line":"                name\u003dsecret.name or \u0027\u0027,"},{"line_number":340,"context_line":"                current_store_id\u003dstore.id,"},{"line_number":341,"context_line":"                skip_reason\u003d\u0027already on destination store\u0027))"},{"line_number":342,"context_line":"            continue"},{"line_number":343,"context_line":"        targets.append(Target("},{"line_number":344,"context_line":"            secret_id\u003dsecret.id,"}],"source_content_type":"text/x-python","patch_set":13,"id":"ac1fe611_349425d1","line":341,"in_reply_to":"10bf4294_7614a5a1","updated":"2026-10-02 19:07:32.000000000","message":"Went with the SKIP accounting approach above so dry-run / retry audits still see every requested id, without dumping SKIP lines for every already-on-dest secret in a large --project-id --yes run.","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"79b4c98e7a0adcded50d142d64757afabfd70a3e","unresolved":false,"context_lines":[{"line_number":338,"context_line":"                project_id\u003dexternal_id,"},{"line_number":339,"context_line":"                name\u003dsecret.name or \u0027\u0027,"},{"line_number":340,"context_line":"                current_store_id\u003dstore.id,"},{"line_number":341,"context_line":"                skip_reason\u003d\u0027already on destination store\u0027))"},{"line_number":342,"context_line":"            continue"},{"line_number":343,"context_line":"        targets.append(Target("},{"line_number":344,"context_line":"            secret_id\u003dsecret.id,"}],"source_content_type":"text/x-python","patch_set":13,"id":"4ca1d6a6_9f6abd54","line":341,"in_reply_to":"1f46b053_01f74557","updated":"2026-10-02 19:07:32.000000000","message":"Addressed: already-on-dest secrets are skipped (no needless PUT) and recorded via skip_reason / Summary skipped\u003d as above.","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"216c4c966a5cbf20e1f85b381f991dd941d56661","unresolved":false,"context_lines":[{"line_number":366,"context_line":"    return False, status, error_from_response(resp)"},{"line_number":367,"context_line":""},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"def _migrate_with_reauth(api_factory, project_id, secret_id, store_id):"},{"line_number":370,"context_line":"    \"\"\"Migrate one secret; re-authenticate once on HTTP 401.\"\"\""},{"line_number":371,"context_line":"    api \u003d api_factory.api_for_project(project_id)"},{"line_number":372,"context_line":"    ok, status, err \u003d migrate_one(api, secret_id, store_id)"}],"source_content_type":"text/x-python","patch_set":13,"id":"f3b51730_614c425c","line":369,"in_reply_to":"b9d39c4e_779aa9b0","updated":"2026-10-02 19:07:39.000000000","message":"Done earlier: _migrate_with_reauth rebuilds the project-scoped session and retries the PUT once on HTTP 401.","commit_id":"d97d178265657d3ef6008418169ccd77ad440fc4"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"ee96dfc226e8bf33435a8eae1d618c8fff5ca88d","unresolved":true,"context_lines":[{"line_number":101,"context_line":"    return reason or (\u0027HTTP %s\u0027 % status)"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"class BarbicanMigrateApi(object):"},{"line_number":105,"context_line":"    \"\"\"HTTP helper around a keystoneauth Adapter.\"\"\""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    def __init__(self, adapter):"}],"source_content_type":"text/x-python","patch_set":14,"id":"897943da_910939c5","line":104,"range":{"start_line":104,"start_character":6,"end_line":104,"end_character":24},"updated":"2026-10-06 13:47:10.000000000","message":"I don\u0027t like that we\u0027re adding yet another HTTP client to the codebase.  `barbican-manage` is a CLI tool that is installed with Barbican and is intended to have direct access to the database and not require HTTP access from within the Barbican node itself.","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    return reason or (\u0027HTTP %s\u0027 % status)"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"class BarbicanMigrateApi(object):"},{"line_number":105,"context_line":"    \"\"\"HTTP helper around a keystoneauth Adapter.\"\"\""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    def __init__(self, adapter):"}],"source_content_type":"text/x-python","patch_set":14,"id":"6b6b00a9_a7235b07","line":104,"range":{"start_line":104,"start_character":6,"end_line":104,"end_character":24},"in_reply_to":"22bef7f7_116c0445","updated":"2026-10-07 15:50:44.000000000","message":"Agreed on not calling barbican API and importing specific barbican modules instead.  This is done in the next patchset.","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"dbed5294df0fe8cf3dd27b698ebefeb1c741e659","unresolved":true,"context_lines":[{"line_number":101,"context_line":"    return reason or (\u0027HTTP %s\u0027 % status)"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"class BarbicanMigrateApi(object):"},{"line_number":105,"context_line":"    \"\"\"HTTP helper around a keystoneauth Adapter.\"\"\""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    def __init__(self, adapter):"}],"source_content_type":"text/x-python","patch_set":14,"id":"22bef7f7_116c0445","line":104,"range":{"start_line":104,"start_character":6,"end_line":104,"end_character":24},"in_reply_to":"897943da_910939c5","updated":"2026-10-06 14:00:49.000000000","message":"@dmendiza how do you add the migration functionality to barbican-manage without adding a http client?  We\u0027e not just moving database entries around.  We need to make a call that will decrypt and re-encrypt secrets.\n\nAlso, using barbican-manage to generate keys (hmac/pkek) will use the underlying libraries to access  the hsms - which often include for example an http client.","commit_id":"4994e6f5075cee1039a5b5ecdeb5ff76739d106c"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"dea573d06fdccf79d3b52e3680764e0c9358894b","unresolved":true,"context_lines":[{"line_number":234,"context_line":"def add_migrate_arguments(parser):"},{"line_number":235,"context_line":"    \"\"\"Register migrate flags on an argparse parser.\"\"\""},{"line_number":236,"context_line":"    parser.add_argument("},{"line_number":237,"context_line":"        \u0027--dest-store-id\u0027, \u0027--secret-store-id\u0027,"},{"line_number":238,"context_line":"        dest\u003d\u0027dest_store_id\u0027,"},{"line_number":239,"context_line":"        required\u003dTrue,"},{"line_number":240,"context_line":"        help\u003d\u0027Destination secret store UUID\u0027)"}],"source_content_type":"text/x-python","patch_set":16,"id":"4e26aaa7_0645623d","line":237,"range":{"start_line":237,"start_character":8,"end_line":237,"end_character":46},"updated":"2026-10-07 14:35:30.000000000","message":"Zen: \"There should be one-- and preferably only one --obvious way to do it.\"","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":true,"context_lines":[{"line_number":234,"context_line":"def add_migrate_arguments(parser):"},{"line_number":235,"context_line":"    \"\"\"Register migrate flags on an argparse parser.\"\"\""},{"line_number":236,"context_line":"    parser.add_argument("},{"line_number":237,"context_line":"        \u0027--dest-store-id\u0027, \u0027--secret-store-id\u0027,"},{"line_number":238,"context_line":"        dest\u003d\u0027dest_store_id\u0027,"},{"line_number":239,"context_line":"        required\u003dTrue,"},{"line_number":240,"context_line":"        help\u003d\u0027Destination secret store UUID\u0027)"}],"source_content_type":"text/x-python","patch_set":16,"id":"59a579e7_054c50bb","line":237,"range":{"start_line":237,"start_character":8,"end_line":237,"end_character":46},"in_reply_to":"4e26aaa7_0645623d","updated":"2026-10-07 15:50:44.000000000","message":"agreed, zen master.  will fix.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"e50678fc7096a6ac77caab4abd5a4303bfb70248","unresolved":false,"context_lines":[{"line_number":234,"context_line":"def add_migrate_arguments(parser):"},{"line_number":235,"context_line":"    \"\"\"Register migrate flags on an argparse parser.\"\"\""},{"line_number":236,"context_line":"    parser.add_argument("},{"line_number":237,"context_line":"        \u0027--dest-store-id\u0027, \u0027--secret-store-id\u0027,"},{"line_number":238,"context_line":"        dest\u003d\u0027dest_store_id\u0027,"},{"line_number":239,"context_line":"        required\u003dTrue,"},{"line_number":240,"context_line":"        help\u003d\u0027Destination secret store UUID\u0027)"}],"source_content_type":"text/x-python","patch_set":16,"id":"a8ede165_fb23bfaf","line":237,"range":{"start_line":237,"start_character":8,"end_line":237,"end_character":46},"in_reply_to":"59a579e7_054c50bb","updated":"2026-10-07 22:17:58.000000000","message":"Done","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"184e2be02a20e14d3021d62e6a527d2d5950a188","unresolved":true,"context_lines":[{"line_number":417,"context_line":""},{"line_number":418,"context_line":"        try:"},{"line_number":419,"context_line":"            _rewrap_secret_by_id(target.secret_id, args.dest_store_id)"},{"line_number":420,"context_line":"        except (barbican_exc.BarbicanException, RuntimeError) as exc:"},{"line_number":421,"context_line":"            err \u003d \u0027%s: %s\u0027 % (type(exc).__name__, exc)"},{"line_number":422,"context_line":"            failures.append(_failure_row("},{"line_number":423,"context_line":"                target, args.dest_store_id, err))"}],"source_content_type":"text/x-python","patch_set":16,"id":"f7a48247_88df8b70","line":420,"updated":"2026-10-07 13:14:06.000000000","message":"Missing a rollback here. `rewrap_secret()` already flushes changes (deleting old metadata, inserting new) before raising, and this `except` just records the failure and moves on. Since the session is shared across the whole loop, if the next secret succeeds and commits, it commits this one\u0027s partial state along with it.\n\nThat breaks the documented guarantee that a failed secret stays untouched on the source store. The HTTP path is safe because pecan\u0027s `TransactionHook` rolls back per request; nothing equivalent exists in this loop.\n\nSuggest adding `repos.rollback()` at the start of this `except`, before the `continue`, so each secret is isolated regardless of its neighbors in the batch.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"e50678fc7096a6ac77caab4abd5a4303bfb70248","unresolved":false,"context_lines":[{"line_number":417,"context_line":""},{"line_number":418,"context_line":"        try:"},{"line_number":419,"context_line":"            _rewrap_secret_by_id(target.secret_id, args.dest_store_id)"},{"line_number":420,"context_line":"        except (barbican_exc.BarbicanException, RuntimeError) as exc:"},{"line_number":421,"context_line":"            err \u003d \u0027%s: %s\u0027 % (type(exc).__name__, exc)"},{"line_number":422,"context_line":"            failures.append(_failure_row("},{"line_number":423,"context_line":"                target, args.dest_store_id, err))"}],"source_content_type":"text/x-python","patch_set":16,"id":"f9e7ec8d_f4c1ba4b","line":420,"in_reply_to":"5c8b184a_a6c1b5e1","updated":"2026-10-07 22:17:58.000000000","message":"Done","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":true,"context_lines":[{"line_number":417,"context_line":""},{"line_number":418,"context_line":"        try:"},{"line_number":419,"context_line":"            _rewrap_secret_by_id(target.secret_id, args.dest_store_id)"},{"line_number":420,"context_line":"        except (barbican_exc.BarbicanException, RuntimeError) as exc:"},{"line_number":421,"context_line":"            err \u003d \u0027%s: %s\u0027 % (type(exc).__name__, exc)"},{"line_number":422,"context_line":"            failures.append(_failure_row("},{"line_number":423,"context_line":"                target, args.dest_store_id, err))"}],"source_content_type":"text/x-python","patch_set":16,"id":"5c8b184a_a6c1b5e1","line":420,"in_reply_to":"f7a48247_88df8b70","updated":"2026-10-07 15:50:44.000000000","message":"agreed - nice catch.  will fix.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"}],"barbican/model/repositories.py":[{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"dea573d06fdccf79d3b52e3680764e0c9358894b","unresolved":true,"context_lines":[{"line_number":758,"context_line":""},{"line_number":759,"context_line":"    def get_secret_by_id(self, entity_id, suppress_exception\u003dFalse,"},{"line_number":760,"context_line":"                         session\u003dNone, for_update\u003dFalse,"},{"line_number":761,"context_line":"                         include_expired\u003dFalse):"},{"line_number":762,"context_line":"        \"\"\"Gets secret by its entity id without project id check."},{"line_number":763,"context_line":""},{"line_number":764,"context_line":"        :param for_update: When True, issue SELECT ... FOR UPDATE so"}],"source_content_type":"text/x-python","patch_set":16,"id":"3518a338_bfdc091d","line":761,"range":{"start_line":761,"start_character":25,"end_line":761,"end_character":40},"updated":"2026-10-07 14:35:30.000000000","message":"Still unsure about this.  Expired is pretty much equal to delted state.  I don\u0027t think it is possible to un-expire a secret unless you go mess with the database directly, which is an admin op and at that point the admin can also migrate after un-expiring.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"970ce2bf03e5a28b7db302c63c901c0144341e80","unresolved":false,"context_lines":[{"line_number":758,"context_line":""},{"line_number":759,"context_line":"    def get_secret_by_id(self, entity_id, suppress_exception\u003dFalse,"},{"line_number":760,"context_line":"                         session\u003dNone, for_update\u003dFalse,"},{"line_number":761,"context_line":"                         include_expired\u003dFalse):"},{"line_number":762,"context_line":"        \"\"\"Gets secret by its entity id without project id check."},{"line_number":763,"context_line":""},{"line_number":764,"context_line":"        :param for_update: When True, issue SELECT ... FOR UPDATE so"}],"source_content_type":"text/x-python","patch_set":16,"id":"a9ea0e13_c68eac13","line":761,"range":{"start_line":761,"start_character":25,"end_line":761,"end_character":40},"in_reply_to":"221a59e6_dd45730b","updated":"2026-10-07 22:18:41.000000000","message":"as decided, removed support for migrating expired secrets","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ee11c88d13af87bbe2e0141b2591eb89b850bbb3","unresolved":true,"context_lines":[{"line_number":758,"context_line":""},{"line_number":759,"context_line":"    def get_secret_by_id(self, entity_id, suppress_exception\u003dFalse,"},{"line_number":760,"context_line":"                         session\u003dNone, for_update\u003dFalse,"},{"line_number":761,"context_line":"                         include_expired\u003dFalse):"},{"line_number":762,"context_line":"        \"\"\"Gets secret by its entity id without project id check."},{"line_number":763,"context_line":""},{"line_number":764,"context_line":"        :param for_update: When True, issue SELECT ... FOR UPDATE so"}],"source_content_type":"text/x-python","patch_set":16,"id":"221a59e6_dd45730b","line":761,"range":{"start_line":761,"start_character":25,"end_line":761,"end_character":40},"in_reply_to":"3518a338_bfdc091d","updated":"2026-10-07 15:50:44.000000000","message":"I\u0027m OK with removing this for simplicity , and waiting to see if anyone requests it.","commit_id":"711ebce6bd559d30b4a648bedd958267efdcf75f"}]}