)]}'
{"id":"openstack%2Fcyborg~987703","triplet_id":"openstack%2Fcyborg~stable%2F2025.1~I7ee74b61de044845756443fe7e2dc806b7a14f86","project":"openstack/cyborg","branch":"stable/2025.1","topic":"bug/2144056","attention_set":{},"removed_from_attention_set":{"34452":{"account":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"last_update":"2026-05-08 14:03:43.000000000","reason":"Change was submitted"},"11604":{"account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"last_update":"2026-05-08 12:45:34.000000000","reason":"\u003cGERRIT_ACCOUNT_11604\u003e replied on the change","reason_account":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}},"hashtags":[],"change_id":"I7ee74b61de044845756443fe7e2dc806b7a14f86","subject":"Require service token for bound ARQ operations","status":"MERGED","created":"2026-05-07 15:05:59.000000000","updated":"2026-05-08 14:04:49.000000000","submitted":"2026-05-08 14:03:43.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987703-bug/2144056","meta_rev_id":"4ec8c9070b1f518fe681655ea08111667735f3b2","_number":987703,"virtual_id_number":987703,"owner":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":0,"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-08 14:03:42.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"all":[{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":2,"date":"2026-05-08 12:45:34.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"all":[{"value":0,"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},{"value":1,"date":"2026-05-08 12:45:34.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-07 16:00:30.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-07 16:27:20.000000000","updated_by":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"reviewer":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"state":"REVIEWER"}],"messages":[{"id":"d8adc3b1eb7dcd6e9573d01f8cd57609f9d98e46","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-07 15:05:59.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"8e36db1fafe45fa0759af144c6820934c1c412b0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 16:00:30.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/929816d061e340cc9a3a01deefe95e5a\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6a4e8430c9b74e1aab17a6a11274c79f : SUCCESS in 5m 08s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/b68458ffa80d4c298f9422ceeb6f1cf1 : SUCCESS in 4m 30s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3782269f18234220952e3390dad7e872 : SUCCESS in 9m 07s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/44755d00cfd14743931eeacec8bdf792 : FAILURE in 4m 31s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/75655494898542c18677f511255de25a : SUCCESS in 3m 45s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/91ab82f65c564a11af0a3b7328b06bc8 : SUCCESS in 5m 13s\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/9aa91f1a9fcf470b92eb4e9d5874f294 : FAILURE in 23m 55s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e35131d1750e46eca7a9376572c9915b : FAILURE in 31m 32s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/ef55f96f553c4ae5b61e13deb5fd056e : SUCCESS in 4m 16s","accounts_in_message":[],"_revision_number":1},{"id":"6d7d54b1b272669a57af1e730cf8478d2a74fabc","author":{"_account_id":34452,"name":"Joan Gilabert","display_name":"jgilaber","email":"jgilaber@redhat.com","username":"jgilaber"},"date":"2026-05-07 16:27:20.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"a03a3c9654b0e8b386ce859f4e47c5f568215735","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 12:43:16.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased. Commit message was updated.\n\nOutdated Votes:\n* Code-Review+1 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"4e0ce71a86b590e5f8590316331f2b30ef94bd43","author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"date":"2026-05-08 12:45:34.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"aa59024831703ff04fe997b7df5fa56a6c1ffddd","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 13:18:47.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c0ad4bfe34a84675bca1b9a4a4da3d36\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/a642467290504574ab8f939aaa74a666 : SUCCESS in 6m 15s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4cb63eafece8490f9413985fa3af82ed : SUCCESS in 3m 17s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4493815b3fa647e38bd24884502f210a : SUCCESS in 8m 08s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/58e3ea217eb641f9a33636b15e771e50 : SUCCESS in 3m 42s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/a4cff47a14bd470aa8599f1f4946ff0f : SUCCESS in 3m 43s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/f64c0a00eef54188bd270bc3a66ed2f0 : SUCCESS in 4m 01s\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/e0285d8ff24742d69b43c0ad55be3e34 : SUCCESS in 29m 32s\n- cyborg-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/23f14d3d0776468aa2ded7748a00b450 : SUCCESS in 30m 45s\n- cyborg-tox-bandit https://zuul.opendev.org/t/openstack/build/7988afe85053428291371cf6b46fb231 : SUCCESS in 3m 28s","accounts_in_message":[],"_revision_number":2},{"id":"fc7b15d3839a62029118247b2588b9e354a398f5","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 13:26:01.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"3e4979b1ef9ed79b624c05d8eacb5e3953d5b1de","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 14:03:42.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/063752afb3fb47a8adce1eadf0e54b0e\n\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/c5ac5e5278424aa19a8e8cb20141c26b : SUCCESS in 3m 10s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e879e5fcacfe4741bae6bb229fc17357 : SUCCESS in 4m 09s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/da8dd9a671e14a988de74b0ee9a081ed : SUCCESS in 3m 22s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/294d72452c9b416d80efa77210ac26ce : SUCCESS in 4m 02s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/e27167d81b834c849abdd3393655a8dd : SUCCESS in 4m 14s\n- cyborg-tempest https://zuul.opendev.org/t/openstack/build/2bc2795d06ad4163adbf185d79c18485 : SUCCESS in 28m 50s","accounts_in_message":[],"_revision_number":2},{"id":"3810880f588049e772072883626162aa613348a6","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 14:03:43.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"4ec8c9070b1f518fe681655ea08111667735f3b2","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-08 14:04:49.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/22eb8c17b172496c8831bab3c01d7517\n\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0a84a6692a3443a4b94f683d7ec07d35 : SUCCESS in 41s\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2dc4bd7cfa244178b6b220e47b75bff3 : SUCCESS in 40s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"cef329ae3b9b34a9ef7ec83932a9fc54226d4811","revisions":{"d771dabf8a807579d7af1d9dcbf717b439a8e643":{"kind":"REWORK","_number":1,"created":"2026-05-07 15:05:59.000000000","uploader":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"ref":"refs/changes/03/987703/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/cyborg","ref":"refs/changes/03/987703/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/03/987703/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/03/987703/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/03/987703/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/cyborg refs/changes/03/987703/1"}}},"commit":{"parents":[{"commit":"63a9ddaf7e7ac1c43ecb19a99b6e3258882a6ce8","subject":"Enforce project-scoped access for ARQs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/63a9ddaf7e7ac1c43ecb19a99b6e3258882a6ce8"}]}],"author":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:25:29.000000000","tz":0},"committer":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-28 21:01:15.000000000","tz":0},"subject":"Require service token for bound ARQ operations","message":"Require service token for bound ARQ operations\n\nUsers should not be able to directly delete or unbind ARQs\nthat are bound to instances. Only Nova, identified by a\nvalid service token, should perform these operations as\npart of instance lifecycle.\n\nAdd is_service_request() check (following Cinder\u0027s\nOSSA-2023-003 pattern) hardcoded in the API layer so it\ncannot be bypassed via policy overrides. Unbound ARQs can\nstill be deleted by their owner without a service token.\n\nRequires Nova [service_user] send_service_user_token\u003dtrue\nand Cyborg [keystone_authtoken]\nservice_token_roles_required\u003dtrue.\n\nCVE-2026-40214\n\nCloses-Bug: #2144056\nGenerated-By: Cursor claude-opus-4.6\nSigned-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e\nChange-Id: I7ee74b61de044845756443fe7e2dc806b7a14f86\n(cherry picked from commit 9e38e24905ae705c22fdbb66ba21464b4f397d6d)\n(cherry picked from commit b8edfa06f10af19ec1d02c0ebf8e7e91b7be4817)\n(cherry picked from commit 4f47d7dfecbdc346be310ed634767959aa87ec55)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/d771dabf8a807579d7af1d9dcbf717b439a8e643"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/d771dabf8a807579d7af1d9dcbf717b439a8e643"}]},"branch":"refs/heads/stable/2025.1"},"cef329ae3b9b34a9ef7ec83932a9fc54226d4811":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":2,"created":"2026-05-08 12:43:16.000000000","uploader":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"ref":"refs/changes/03/987703/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/cyborg","ref":"refs/changes/03/987703/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/03/987703/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/03/987703/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/cyborg refs/changes/03/987703/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/cyborg refs/changes/03/987703/2"}}},"commit":{"parents":[{"commit":"64b42e251513197e47bb449a8417efcef7ff6bae","subject":"Enforce project-scoped access for ARQs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/64b42e251513197e47bb449a8417efcef7ff6bae"}]}],"author":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-04-26 18:25:29.000000000","tz":0},"committer":{"name":"Sean Mooney","email":"work@seanmooney.info","date":"2026-05-08 12:28:47.000000000","tz":0},"subject":"Require service token for bound ARQ operations","message":"Require service token for bound ARQ operations\n\nUsers should not be able to directly delete or unbind ARQs\nthat are bound to instances. Only Nova, identified by a\nvalid service token, should perform these operations as\npart of instance lifecycle.\n\nAdd is_service_request() check (following Cinder\u0027s\nOSSA-2023-003 pattern) hardcoded in the API layer so it\ncannot be bypassed via policy overrides. Unbound ARQs can\nstill be deleted by their owner without a service token.\n\nRequires Nova [service_user] send_service_user_token\u003dtrue\nand Cyborg [keystone_authtoken]\nservice_token_roles_required\u003dtrue.\n\nCVE-2026-40214\n\nCloses-Bug: #2144056\nGenerated-By: Cursor claude-opus-4.6\nSigned-off-by: Sean Mooney \u003cwork@seanmooney.info\u003e\nChange-Id: I7ee74b61de044845756443fe7e2dc806b7a14f86\n(cherry picked from commit 9e38e24905ae705c22fdbb66ba21464b4f397d6d)\n(cherry picked from commit b8edfa06f10af19ec1d02c0ebf8e7e91b7be4817)\n(cherry picked from commit 5c7bde4256b0e6fe4ba94fb5ba42a1c9116821af)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/cef329ae3b9b34a9ef7ec83932a9fc54226d4811"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/cyborg/commit/cef329ae3b9b34a9ef7ec83932a9fc54226d4811"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}