)]}'
{"id":"openstack%2Fcyborg~987697","triplet_id":"openstack%2Fcyborg~stable%2F2025.2~I7ee74b61de044845756443fe7e2dc806b7a14f86","project":"openstack/cyborg","branch":"stable/2025.2","topic":"bug/2144056","attention_set":{},"removed_from_attention_set":{"11604":{"account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"last_update":"2026-05-08 10:36:58.000000000","reason":"\u003cGERRIT_ACCOUNT_11604\u003e replied on the change","reason_account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}},"hashtags":[],"change_id":"I7ee74b61de044845756443fe7e2dc806b7a14f86","subject":"Require service token for bound ARQ operations","status":"MERGED","created":"2026-05-07 15:05:42.000000000","updated":"2026-05-08 11:33:05.000000000","submitted":"2026-05-08 11:31:16.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987697-bug/2144056","meta_rev_id":"fe6b96f40f20608e17dfe82f68a6159e5716dc41","_number":987697,"virtual_id_number":987697,"owner":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-08 11:31:16.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"all":[{"value":2,"date":"2026-05-08 00:40:13.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":1,"date":"2026-05-07 19:21:15.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"all":[{"value":1,"date":"2026-05-08 00:40:13.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-07 15:54:37.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-07 16:27:07.000000000","updated_by":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"reviewer":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"state":"REVIEWER"}],"messages":[{"id":"b354e9b84caecb360707379f0f34cecb9c94c593","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 15:05:42.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"381384d5ab4e0d0dcf14d0b77c0802c276294ddc","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 15:54:37.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/8ecefbecb3b943d28536dfc638d089da\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/da34217cabfb4bc4a7919b37316c9736 : SUCCESS in 3m 28s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ebfcecdec6894fec9e8ba0a4d83c95c2 : SUCCESS in 3m 04s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3607d245b15e4dab87e5de5bc85aec20 : SUCCESS in 7m 48s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/2d16077b23d34a3796e180bd873b93db : FAILURE in 2m 47s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/25301cfe84044f08a80bd033b8434383 : SUCCESS in 3m 59s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/8a844929fb0f4b7ca94e411d626ed383 : SUCCESS in 4m 27s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/00a18213d3844735abcc780a2422f4a7 : SUCCESS in 7m 38s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/0b522a947da84cb8bdf1c8795a4ec043 : FAILURE in 27m 50s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/0462485d24374b919638e9d1991f97db : FAILURE in 15m 57s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/393d72a53b7a4440a099c0b32494f9b6 : SUCCESS in 4m 14s","accounts_in_message":[],"_revision_number":1},{"id":"3e8bedd947abfb260a73807805a47e348ec9df4b","author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"date":"2026-05-07 16:27:07.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"9578f600c46d5dc0fe758b3c486cba05ce48b106","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 19:21:15.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nCopied Votes:\n* Code-Review+1 (copy condition: \"**changekind:TRIVIAL_REBASE** OR is:MIN\")\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"7ef72356e0f82adb410f125d7fd3291ba502cf79","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 19:57:02.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/2356fbdab0fb43fc915393c9446cb2b4\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/df139d29f9ca4e55958f980de21a2256 : SUCCESS in 4m 26s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/bea9ce50bb154b8aaa64f79fbefed2cf : SUCCESS in 4m 05s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ac47879bbfd94e6cacb51784c0c6c42c : SUCCESS in 7m 43s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ce48c7808f6245c3a9eb31248af932f3 : FAILURE in 2m 35s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/7a69e38dbaed42f0bcc27ca50bc2ccdb : SUCCESS in 3m 29s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/8919757dff204d55a7db74d7dcd62ca6 : SUCCESS in 2m 16s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f3f6de44f53b4dcd82d653f1d7316b47 : SUCCESS in 5m 48s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/cdcbb2d068d44771aa0b13e434ae1ab1 : SUCCESS in 28m 55s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2f78139362504d52b887f634dcd44eff : SUCCESS in 27m 53s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/6d169965c56b4b21bf6d72e8f9ada352 : SUCCESS in 3m 41s","accounts_in_message":[],"_revision_number":2},{"id":"3bc55928754f2e120f1d2bbdc477c465063d6f8f","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 00:40:13.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"2924434ed45a5bd5f54f239aad52537333940307","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 01:17:53.000000000","message":"Patch Set 2:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/46807b05f9d1469ebdc1dde61f174cbb\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b1cf2d3a466e43219e4a3164fe032f61 : SUCCESS in 4m 36s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d266d7b31b8b40c4bdfb7baaeb2bd60e : SUCCESS in 4m 02s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6c153a19a7c0411d8d42c02ebca02176 : SUCCESS in 7m 32s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b97d905b57664367a3404c08ddb6622d : FAILURE in 2m 31s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/35abca7402c44a119b31c04cfab614c9 : SUCCESS in 2m 10s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/9a47305baab94fa4b3420af9eaf74ce2 : SUCCESS in 3m 44s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0954ed0ca8e7437da6f6a9a65d1ac79e : SUCCESS in 6m 10s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/e8cbeedbc1f54361994a820da04d36f7 : SUCCESS in 30m 46s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/aa7868060ae14f4baea6c6e25a608028 : SUCCESS in 17m 29s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/ce33f21400ba4b17aea8898fffec30d9 : SUCCESS in 5m 02s","accounts_in_message":[],"_revision_number":2},{"id":"a75237cad1dc488dcc8c15fe6f9f7248763907fa","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 07:52:46.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"d9c509b1219ca0537738bc2623a7e6c5dd0c598d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 08:30:31.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/48037c65970e40e0ba864793096431f6\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9460ab0b41fd4dacb9c098f87b4cb113 : SUCCESS in 3m 25s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/34cc96a46a0c47d5895cc269ca70c116 : SUCCESS in 2m 50s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b2725a9700cf4c33b70e115c842da4d8 : SUCCESS in 3m 46s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/54e5bd4da3c14e0e83eee07e49cd98ff : SUCCESS in 2m 16s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/83aae454212e4167ac83ffee2e5c9f2c : SUCCESS in 2m 14s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/9dbad064120642f797b987dd9f99e2f9 : SUCCESS in 3m 46s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/26a0b815de724a34bfd079a479fe1874 : SUCCESS in 6m 54s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/099976f22d9d42e0a8bc2b6443d898be : SUCCESS in 25m 25s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ebf73db6fbf1468181da16cf190cbb83 : SUCCESS in 29m 40s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/66a8a2f55e34499d97264e8cda86c665 : SUCCESS in 3m 56s","accounts_in_message":[],"_revision_number":2},{"id":"f19cef63c313de96b6a604a1e94e4dd20527a845","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 09:41:51.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"046c2a3a685b01d792ae686b0df3f8f96e6809f2","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 10:17:31.000000000","message":"Patch Set 2: Verified-2\n\nThis change depends on a change that failed to merge.\n\nChange https://review.opendev.org/c/openstack/cyborg/+/987696 is needed.","accounts_in_message":[],"_revision_number":2},{"id":"6464b2b052aaf5503c993f1e48f0ffe707ee6b51","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 10:36:58.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"b15a7938cb68f6cb85337733777584ae00d72f3e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 11:10:10.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c0bbd26d86ad423eba18ae6a23bb60eb\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/c9d698c70360483e960ada8855ba75ed : SUCCESS in 5m 11s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2e5c4afca10147c1ad9305920f12e830 : SUCCESS in 2m 18s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b388e0b5bfcc446abbf0149df5beaeff : SUCCESS in 7m 19s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cac34e4247b74c948691df96fafc1883 : SUCCESS in 3m 51s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/fad33a2af2ee43eaa3f8ba3581e6de2d : SUCCESS in 3m 28s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/0c5efd734f6e41e2bb0956835a329972 : SUCCESS in 3m 52s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/a7025028ab9d4073af467fafe0e5f7f2 : SUCCESS in 9m 04s (non-voting)\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/1605c6fb7b87448e88ebc245459ee096 : SUCCESS in 28m 06s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f6ae84d606724d67a88d8036bab7f24e : SUCCESS in 27m 55s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/fe95e9cc10fe4d9f8057e08db0076936 : SUCCESS in 3m 16s","accounts_in_message":[],"_revision_number":2},{"id":"1d33144110089b586279bf2a643d041262c8b7f8","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 11:11:25.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"c4c68bff9f787a7c6a31654e3ba56ee6da32132a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 11:31:16.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/76ff64e47b5747ebac52a521f806c5bc\n\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3fdc54e0a64f4937aa88911edbfdccc2 : SUCCESS in 4m 02s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8990f39fa5254c048e7c0bb2fc29054b : SUCCESS in 8m 36s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f6661b8174d648c483db60c06d8527cd : SUCCESS in 3m 36s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/55c6b47a7fa145a99ba8c7b9772a62fe : SUCCESS in 2m 07s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/522a396be8c846e1953e74f3d599c7de : SUCCESS in 3m 54s\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/0fb27925a2584aeb871275f6c38118bc : SUCCESS in 18m 33s","accounts_in_message":[],"_revision_number":2},{"id":"ecd38daa60632b882df957a0e0285dbb59a7fedd","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 11:31:16.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"fe6b96f40f20608e17dfe82f68a6159e5716dc41","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 11:33:05.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/7d6f18cbfe274f3ebe751f2dc2674486\n\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4ec1efe6e4f74b008ef2cd388f9e635d : SUCCESS in 36s\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9c29a37d091e4392867bbc831e75d290 : SUCCESS in 41s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"5c7bde4256b0e6fe4ba94fb5ba42a1c9116821af","revisions":{"4f47d7dfecbdc346be310ed634767959aa87ec55":{"kind":"REWORK","_number":1,"created":"2026-05-07 15:05:42.000000000","uploader":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"ref":"refs/changes/97/987697/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/cyborg","ref":"refs/changes/97/987697/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/97/987697/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/97/987697/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/97/987697/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/cyborg refs/changes/97/987697/1"}}},"commit":{"parents":[{"commit":"74dec3d6a70e66c98b68a97f8f72ad07f018f300","subject":"Enforce project-scoped access for ARQs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/74dec3d6a70e66c98b68a97f8f72ad07f018f300"}]}],"author":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:22:38.000000000","tz":0},"committer":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-28 20:55:33.000000000","tz":0},"subject":"Require service token for bound ARQ operations","message":"Require service token for bound ARQ operations\n\nUsers should not be able to directly delete or unbind ARQs\nthat are bound to instances. Only Nova, identified by a\nvalid service token, should perform these operations as\npart of instance lifecycle.\n\nAdd is_service_request() check (following Cinder\u0027s\nOSSA-2023-003 pattern) hardcoded in the API layer so it\ncannot be bypassed via policy overrides. Unbound ARQs can\nstill be deleted by their owner without a service token.\n\nRequires Nova [service_user] send_service_user_token\u003dtrue\nand Cyborg [keystone_authtoken]\nservice_token_roles_required\u003dtrue.\n\nCVE-2026-40214\n\nCloses-Bug: #2144056\nGenerated-By: Cursor claude-opus-4.6\nSigned-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e\nChange-Id: I7ee74b61de044845756443fe7e2dc806b7a14f86\n(cherry picked from commit 9e38e24905ae705c22fdbb66ba21464b4f397d6d)\n(cherry picked from commit b8edfa06f10af19ec1d02c0ebf8e7e91b7be4817)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/4f47d7dfecbdc346be310ed634767959aa87ec55"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/4f47d7dfecbdc346be310ed634767959aa87ec55"}]},"branch":"refs/heads/stable/2025.2"},"5c7bde4256b0e6fe4ba94fb5ba42a1c9116821af":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-07 19:21:15.000000000","uploader":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"ref":"refs/changes/97/987697/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/cyborg","ref":"refs/changes/97/987697/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/97/987697/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/97/987697/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/97/987697/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/cyborg refs/changes/97/987697/2"}}},"commit":{"parents":[{"commit":"e72db09b5dce8608723c9395b1180191040ec8ea","subject":"Enforce project-scoped access for ARQs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/e72db09b5dce8608723c9395b1180191040ec8ea"}]}],"author":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:22:38.000000000","tz":0},"committer":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-05-07 19:18:42.000000000","tz":0},"subject":"Require service token for bound ARQ operations","message":"Require service token for bound ARQ operations\n\nUsers should not be able to directly delete or unbind ARQs\nthat are bound to instances. Only Nova, identified by a\nvalid service token, should perform these operations as\npart of instance lifecycle.\n\nAdd is_service_request() check (following Cinder\u0027s\nOSSA-2023-003 pattern) hardcoded in the API layer so it\ncannot be bypassed via policy overrides. Unbound ARQs can\nstill be deleted by their owner without a service token.\n\nRequires Nova [service_user] send_service_user_token\u003dtrue\nand Cyborg [keystone_authtoken]\nservice_token_roles_required\u003dtrue.\n\nCVE-2026-40214\n\nCloses-Bug: #2144056\nGenerated-By: Cursor claude-opus-4.6\nSigned-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e\nChange-Id: I7ee74b61de044845756443fe7e2dc806b7a14f86\n(cherry picked from commit 9e38e24905ae705c22fdbb66ba21464b4f397d6d)\n(cherry picked from commit b8edfa06f10af19ec1d02c0ebf8e7e91b7be4817)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/5c7bde4256b0e6fe4ba94fb5ba42a1c9116821af"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/5c7bde4256b0e6fe4ba94fb5ba42a1c9116821af"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}