)]}'
{"id":"openstack%2Fcyborg~987684","triplet_id":"openstack%2Fcyborg~master~I7ee74b61de044845756443fe7e2dc806b7a14f86","project":"openstack/cyborg","branch":"master","topic":"bug/2144056","attention_set":{},"removed_from_attention_set":{"11604":{"account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"last_update":"2026-05-07 17:28:12.000000000","reason":"\u003cGERRIT_ACCOUNT_11604\u003e replied on the change","reason_account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}},"hashtags":[],"change_id":"I7ee74b61de044845756443fe7e2dc806b7a14f86","subject":"Require service token for bound ARQ operations","status":"MERGED","created":"2026-05-07 15:05:05.000000000","updated":"2026-05-07 18:40:31.000000000","submitted":"2026-05-07 18:38:14.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987684-bug/2144056","meta_rev_id":"8c159e1163474374e59d20348264c186db53af50","_number":987684,"virtual_id_number":987684,"owner":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-07 18:38:13.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":0,"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"recommended":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-05-07 16:26:10.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":2,"date":"2026-05-07 17:28:12.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":1,"date":"2026-05-07 17:28:12.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-07 16:16:56.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-07 16:26:10.000000000","updated_by":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"reviewer":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"state":"REVIEWER"}],"messages":[{"id":"d6c73879738661a3c456fe0c90a2a24ad3feeb80","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 15:05:05.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"41920beb4cf63aefeefa570a9b0d546834d8b80a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 16:16:56.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/504c0372f0f74d959089f103cff9a625\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/be163ac8f32f47d8ba4bc3510b0ab3f5 : SUCCESS in 5m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ff92238c362c4f72ba9866c7425941f4 : SUCCESS in 3m 04s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/348a2b25ead7473589473133e799c1df : SUCCESS in 7m 04s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/da9f4834f2c848d38a03d0b794ff9c8a : SUCCESS in 4m 56s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/d6f13c6fb0984c9fa9f4ecc47dc20501 : SUCCESS in 4m 20s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/8c5104a96a3d4ff6911b5ede3f2c06f2 : SUCCESS in 4m 14s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/1b9e77076ccb4a9e899616e7b92eb6c5 : SUCCESS in 7m 08s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/b09ff3d84859412b9a2d04a240112f70 : SUCCESS in 14m 13s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/53048026082442fa8ddb901f6071cc2a : SUCCESS in 34m 50s\n- cyborg-grenade https://zuul.opendev.org/t/openstack/build/7b84d99bc99c49e8b71a2ae862e581f5 : SUCCESS in 45m 38s\n- cyborg-grenade-skip-level-always https://zuul.opendev.org/t/openstack/build/3999966b2bf643d5b41fa48426ed3ba6 : SUCCESS in 52m 59s","accounts_in_message":[],"_revision_number":1},{"id":"2b7cecaa9eb22d8ba1677a2655cca1e638507ec0","author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"date":"2026-05-07 16:26:10.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"e205c1bba403e0a9f91c847aca90617056c296d3","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 17:28:12.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"cd51ad36c14bc3a97a576d94eba6c1c776122174","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 17:35:10.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"6f44287438fb3ae4d0e2ebd73a8643f3a1d2421e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 18:38:13.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/69ff49cb2fd749758f0b4d4fd9338420\n\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/fe0128cfa1c54a67ae266a3b14d0a263 : SUCCESS in 3m 22s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8b34a17c418e4076adc6f3ec1521c4b1 : SUCCESS in 9m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/65421babf2524f258391a484e117f664 : SUCCESS in 4m 47s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7a924c28cbef48b8b19a986856b01900 : SUCCESS in 3m 26s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0bdd0adec8e94497bf7306e2960b529f : SUCCESS in 3m 57s\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/63e257092dbd4428b9766cfad8364c93 : SUCCESS in 19m 31s\n- cyborg-grenade https://zuul.opendev.org/t/openstack/build/09e0483782e44d268ad05a65b7473d98 : SUCCESS in 31m 37s\n- cyborg-grenade-skip-level-always https://zuul.opendev.org/t/openstack/build/8bcc0bd998d848b09b5777aa9f3101a2 : SUCCESS in 46m 27s","accounts_in_message":[],"_revision_number":1},{"id":"efbae7f1144b6a3e9b78ecd26212f3353a770d8d","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 18:38:14.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"8c159e1163474374e59d20348264c186db53af50","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 18:40:31.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/81a798284aae48828f16baac90cd959d\n\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/01e4d5ba65bd4ee181ea0ef3ce19588e : SUCCESS in 52s\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/92b95e9d8c274d079007d00eb8bad58a : SUCCESS in 51s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"9e38e24905ae705c22fdbb66ba21464b4f397d6d","revisions":{"9e38e24905ae705c22fdbb66ba21464b4f397d6d":{"kind":"REWORK","_number":1,"created":"2026-05-07 15:05:05.000000000","uploader":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"ref":"refs/changes/84/987684/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/cyborg","ref":"refs/changes/84/987684/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/84/987684/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/84/987684/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/84/987684/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/cyborg refs/changes/84/987684/1"}}},"commit":{"parents":[{"commit":"ebfe43710988b764b969d5f2301e22069da670d7","subject":"Enforce project-scoped access for ARQs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/ebfe43710988b764b969d5f2301e22069da670d7"}]}],"author":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-03-13 14:48:28.000000000","tz":0},"committer":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:16:50.000000000","tz":0},"subject":"Require service token for bound ARQ operations","message":"Require service token for bound ARQ operations\n\nUsers should not be able to directly delete or unbind ARQs\nthat are bound to instances. Only Nova, identified by a\nvalid service token, should perform these operations as\npart of instance lifecycle.\n\nAdd is_service_request() check (following Cinder\u0027s\nOSSA-2023-003 pattern) hardcoded in the API layer so it\ncannot be bypassed via policy overrides. Unbound ARQs can\nstill be deleted by their owner without a service token.\n\nRequires Nova [service_user] send_service_user_token\u003dtrue\nand Cyborg [keystone_authtoken]\nservice_token_roles_required\u003dtrue.\n\nCVE-2026-40214\n\nCloses-Bug: #2144056\nGenerated-By: Cursor claude-opus-4.6\nSigned-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e\nChange-Id: I7ee74b61de044845756443fe7e2dc806b7a14f86\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/9e38e24905ae705c22fdbb66ba21464b4f397d6d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/9e38e24905ae705c22fdbb66ba21464b4f397d6d"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}