)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"7ddb0f3f_1e7d1637","updated":"2026-10-29 09:35:00.000000000","message":"Thank you for working on this.\nExplore how we can use https://review.opendev.org/c/openstack/os-test-images/+/926942 for local testing and is it possible to enable DNM job which can help reviewers to understand the outcome.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"37fb5218_37736a6c","updated":"2026-10-30 09:29:17.000000000","message":"Abhishek and Dan thanks for the review !","commit_id":"765e365d69af7e74f74e63fc3ed733dcddd233f2"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"a6737d958700ec8027334d3ed0f6ebb8970613c7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"345d2a2f_7df2985c","updated":"2026-10-30 10:21:37.000000000","message":"Please close the open review comments if those are addressed.\nThank you, mostly looks good, one functional gap noted inline.","commit_id":"765e365d69af7e74f74e63fc3ed733dcddd233f2"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"ae0cc5eba9de6e243fd25d7d810fa7d7f32f0f00","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"3e2a6ed4_7e1a7f93","updated":"2026-11-02 08:49:16.000000000","message":"Thanks Dan !","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"6dbcc011734368f4087fda6004e95d5c1d327553","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"46685ac2_3fba0966","updated":"2026-11-03 08:37:29.000000000","message":"recheck","commit_id":"877f7ee8e59827359c1fa241bdeb4fb3b2aa6b17"}],"glance/async_/flows/parallel_api_image_import.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":true,"context_lines":[{"line_number":190,"context_line":"def _prepare_upload_data(data_iter, container_format, disk_format):"},{"line_number":191,"context_line":"    \"\"\"Apply in-flight format inspection for bare and LUKS images."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"    See ``glance.location.ImageProxy.set_data``. LUKS images are wrapped so"},{"line_number":194,"context_line":"    the container header can be checked; the payload is not decrypted."},{"line_number":195,"context_line":"    \"\"\""},{"line_number":196,"context_line":"    if container_format in (\u0027bare\u0027, \u0027luks\u0027):"},{"line_number":197,"context_line":"        LOG.debug(\u0027Enabling in-flight format inspection for %s\u0027, disk_format)"}],"source_content_type":"text/x-python","patch_set":2,"id":"b1deed56_449e63a3","line":194,"range":{"start_line":193,"start_character":0,"end_line":194,"end_character":70},"updated":"2026-10-29 09:35:00.000000000","message":"Don\u0027t need to add this or mention deep inspection will be addressed later.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":false,"context_lines":[{"line_number":190,"context_line":"def _prepare_upload_data(data_iter, container_format, disk_format):"},{"line_number":191,"context_line":"    \"\"\"Apply in-flight format inspection for bare and LUKS images."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"    See ``glance.location.ImageProxy.set_data``. LUKS images are wrapped so"},{"line_number":194,"context_line":"    the container header can be checked; the payload is not decrypted."},{"line_number":195,"context_line":"    \"\"\""},{"line_number":196,"context_line":"    if container_format in (\u0027bare\u0027, \u0027luks\u0027):"},{"line_number":197,"context_line":"        LOG.debug(\u0027Enabling in-flight format inspection for %s\u0027, disk_format)"}],"source_content_type":"text/x-python","patch_set":2,"id":"d2570111_c16ad180","line":194,"range":{"start_line":193,"start_character":0,"end_line":194,"end_character":70},"in_reply_to":"b1deed56_449e63a3","updated":"2026-10-30 09:29:17.000000000","message":"Done","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":true,"context_lines":[{"line_number":194,"context_line":"    the container header can be checked; the payload is not decrypted."},{"line_number":195,"context_line":"    \"\"\""},{"line_number":196,"context_line":"    if container_format in (\u0027bare\u0027, \u0027luks\u0027):"},{"line_number":197,"context_line":"        LOG.debug(\u0027Enabling in-flight format inspection for %s\u0027, disk_format)"},{"line_number":198,"context_line":"        return format_inspector.InspectWrapper(data_iter)"},{"line_number":199,"context_line":"    return data_iter"},{"line_number":200,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3a0cf636_fe985bc6","line":197,"range":{"start_line":197,"start_character":8,"end_line":197,"end_character":77},"updated":"2026-10-29 09:35:00.000000000","message":"Should we also log container format here?","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b7b99538973a0d55bd3905b5a0de1a038725c9a6","unresolved":true,"context_lines":[{"line_number":194,"context_line":"    the container header can be checked; the payload is not decrypted."},{"line_number":195,"context_line":"    \"\"\""},{"line_number":196,"context_line":"    if container_format in (\u0027bare\u0027, \u0027luks\u0027):"},{"line_number":197,"context_line":"        LOG.debug(\u0027Enabling in-flight format inspection for %s\u0027, disk_format)"},{"line_number":198,"context_line":"        return format_inspector.InspectWrapper(data_iter)"},{"line_number":199,"context_line":"    return data_iter"},{"line_number":200,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ece0f605_8037049d","line":197,"range":{"start_line":197,"start_character":8,"end_line":197,"end_character":77},"in_reply_to":"3a0cf636_fe985bc6","updated":"2026-10-29 15:51:57.000000000","message":"Yeah would be good","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":false,"context_lines":[{"line_number":194,"context_line":"    the container header can be checked; the payload is not decrypted."},{"line_number":195,"context_line":"    \"\"\""},{"line_number":196,"context_line":"    if container_format in (\u0027bare\u0027, \u0027luks\u0027):"},{"line_number":197,"context_line":"        LOG.debug(\u0027Enabling in-flight format inspection for %s\u0027, disk_format)"},{"line_number":198,"context_line":"        return format_inspector.InspectWrapper(data_iter)"},{"line_number":199,"context_line":"    return data_iter"},{"line_number":200,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"19994922_49f2c2be","line":197,"range":{"start_line":197,"start_character":8,"end_line":197,"end_character":77},"in_reply_to":"ece0f605_8037049d","updated":"2026-10-30 09:29:17.000000000","message":"Done","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":true,"context_lines":[{"line_number":245,"context_line":"        except format_inspector.ImageFormatError as exc:"},{"line_number":246,"context_line":"            raise exception.InvalidImageData(str(exc))"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        if image.container_format \u003d\u003d \u0027luks\u0027:"},{"line_number":249,"context_line":"            try:"},{"line_number":250,"context_line":"                glance_location.check_luks_container(upload_data)"},{"line_number":251,"context_line":"            except format_inspector.ImageFormatError as exc:"},{"line_number":252,"context_line":"                if CONF.image_format.require_image_format_match:"},{"line_number":253,"context_line":"                    raise exception.InvalidImageData(str(exc))"},{"line_number":254,"context_line":"                LOG.warning(\u0027Image container_format luks did not match; \u0027"},{"line_number":255,"context_line":"                            \u0027unable to calculate virtual size\u0027)"},{"line_number":256,"context_line":"            except format_inspector.SafetyCheckFailed:"},{"line_number":257,"context_line":"                LOG.warning(\u0027LUKS image failed safety checks\u0027)"},{"line_number":258,"context_line":"                raise exception.InvalidImageData("},{"line_number":259,"context_line":"                    \u0027Image failed safety checks\u0027)"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"        locs \u003d [{\u0027url\u0027: location, \u0027metadata\u0027: store_meta or {}}]"},{"line_number":262,"context_line":"        locs \u003d store_utils.get_updated_store_location(locs, context\u003dcontext)"}],"source_content_type":"text/x-python","patch_set":2,"id":"bffcf9cc_a15b6c1d","line":259,"range":{"start_line":248,"start_character":0,"end_line":259,"end_character":49},"updated":"2026-10-29 09:35:00.000000000","message":"I think this is going to conflict your other work (https://review.opendev.org/c/openstack/glance/+/933601) majorly. So I would suggest you to rebase this patch on top of GPT work. The new dependency chain should be;\n\nNative image encryption \u003e\u003e Add GPT disk format \u003e\u003e Format inspection for LUKSv1","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":false,"context_lines":[{"line_number":245,"context_line":"        except format_inspector.ImageFormatError as exc:"},{"line_number":246,"context_line":"            raise exception.InvalidImageData(str(exc))"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"        if image.container_format \u003d\u003d \u0027luks\u0027:"},{"line_number":249,"context_line":"            try:"},{"line_number":250,"context_line":"                glance_location.check_luks_container(upload_data)"},{"line_number":251,"context_line":"            except format_inspector.ImageFormatError as exc:"},{"line_number":252,"context_line":"                if CONF.image_format.require_image_format_match:"},{"line_number":253,"context_line":"                    raise exception.InvalidImageData(str(exc))"},{"line_number":254,"context_line":"                LOG.warning(\u0027Image container_format luks did not match; \u0027"},{"line_number":255,"context_line":"                            \u0027unable to calculate virtual size\u0027)"},{"line_number":256,"context_line":"            except format_inspector.SafetyCheckFailed:"},{"line_number":257,"context_line":"                LOG.warning(\u0027LUKS image failed safety checks\u0027)"},{"line_number":258,"context_line":"                raise exception.InvalidImageData("},{"line_number":259,"context_line":"                    \u0027Image failed safety checks\u0027)"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"        locs \u003d [{\u0027url\u0027: location, \u0027metadata\u0027: store_meta or {}}]"},{"line_number":262,"context_line":"        locs \u003d store_utils.get_updated_store_location(locs, context\u003dcontext)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ebe29355_059652ac","line":259,"range":{"start_line":248,"start_character":0,"end_line":259,"end_character":49},"in_reply_to":"bffcf9cc_a15b6c1d","updated":"2026-10-30 09:29:17.000000000","message":"Done","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"}],"glance/common/utils.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"a6737d958700ec8027334d3ed0f6ebb8970613c7","unresolved":true,"context_lines":[{"line_number":1100,"context_line":"        # container_format"},{"line_number":1101,"context_line":"        pass"},{"line_number":1102,"context_line":"    except format_inspector.ImageFormatError as e:"},{"line_number":1103,"context_line":"        if CONF.image_format.require_image_format_match:"},{"line_number":1104,"context_line":"            raise exception.InvalidImageData(str(e))"},{"line_number":1105,"context_line":"        else:"},{"line_number":1106,"context_line":"            LOG.warning(\u0027Image container_format luks did not match; \u0027"},{"line_number":1107,"context_line":"                        \u0027unable to calculate virtual size\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"024886cf_03cc41f6","line":1104,"range":{"start_line":1103,"start_character":8,"end_line":1104,"end_character":52},"updated":"2026-10-30 10:21:37.000000000","message":"I think there is a functional gap here. require_image_format_match is for disk_format matching, not for the outer LUKS container check. Please make rejection of non-LUKS data unconditional.\n\nFor example, test_image_set_data_luks_container_rejects_other_format_when_disabled [1] is named as if it rejects other formats when require_image_format_match\u003dFalse, but the test uploads QCOW2 data with container_format\u003dluks and asserts that the image becomes active. The test should instead assert that InvalidImageData is raised.\n\n[1] https://review.opendev.org/c/openstack/glance/+/1012814/3/glance/tests/unit/test_store_image.py:394","commit_id":"765e365d69af7e74f74e63fc3ed733dcddd233f2"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"5718b8a4cb6d9381cb9fc33019eb2bef8508bf17","unresolved":false,"context_lines":[{"line_number":1100,"context_line":"        # container_format"},{"line_number":1101,"context_line":"        pass"},{"line_number":1102,"context_line":"    except format_inspector.ImageFormatError as e:"},{"line_number":1103,"context_line":"        if CONF.image_format.require_image_format_match:"},{"line_number":1104,"context_line":"            raise exception.InvalidImageData(str(e))"},{"line_number":1105,"context_line":"        else:"},{"line_number":1106,"context_line":"            LOG.warning(\u0027Image container_format luks did not match; \u0027"},{"line_number":1107,"context_line":"                        \u0027unable to calculate virtual size\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"6408efc5_57fa4554","line":1104,"range":{"start_line":1103,"start_character":8,"end_line":1104,"end_character":52},"in_reply_to":"024886cf_03cc41f6","updated":"2026-10-30 13:06:23.000000000","message":"Done","commit_id":"765e365d69af7e74f74e63fc3ed733dcddd233f2"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"eca40f1e4ce8cd3f20bc3db59e95a4992ab8135c","unresolved":true,"context_lines":[{"line_number":975,"context_line":"            \u0027cinder_encryption_key_deletion_policy\u0027, None)"},{"line_number":976,"context_line":""},{"line_number":977,"context_line":""},{"line_number":978,"context_line":"def check_image_format(data, disk_format):"},{"line_number":979,"context_line":"    \"\"\"Check inspected image data against ``disk_format``."},{"line_number":980,"context_line":""},{"line_number":981,"context_line":"    ``data`` is the object passed to the store, usually an"}],"source_content_type":"text/x-python","patch_set":5,"id":"09523d5c_0fe11ebc","line":978,"updated":"2026-10-30 14:07:42.000000000","message":"Why the name \"image format\" instead of \"disk format\" which the docstring uses?","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"ae0cc5eba9de6e243fd25d7d810fa7d7f32f0f00","unresolved":true,"context_lines":[{"line_number":975,"context_line":"            \u0027cinder_encryption_key_deletion_policy\u0027, None)"},{"line_number":976,"context_line":""},{"line_number":977,"context_line":""},{"line_number":978,"context_line":"def check_image_format(data, disk_format):"},{"line_number":979,"context_line":"    \"\"\"Check inspected image data against ``disk_format``."},{"line_number":980,"context_line":""},{"line_number":981,"context_line":"    ``data`` is the object passed to the store, usually an"}],"source_content_type":"text/x-python","patch_set":5,"id":"aa710219_49dbb90f","line":978,"in_reply_to":"09523d5c_0fe11ebc","updated":"2026-11-02 08:49:16.000000000","message":"Done in the parent patch. Renamed check_image_format() to check_disk_format().","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"eca40f1e4ce8cd3f20bc3db59e95a4992ab8135c","unresolved":true,"context_lines":[{"line_number":1026,"context_line":"        inspector.safety_check()"},{"line_number":1027,"context_line":"    except AttributeError:"},{"line_number":1028,"context_line":"        # We must not have wrapped this for inspection because of"},{"line_number":1029,"context_line":"        # container_format"},{"line_number":1030,"context_line":"        pass"},{"line_number":1031,"context_line":"    except format_inspector.ImageFormatError as e:"},{"line_number":1032,"context_line":"        # No format matched!"}],"source_content_type":"text/x-python","patch_set":5,"id":"edb836bb_512bf992","line":1029,"updated":"2026-10-30 14:07:42.000000000","message":"I don\u0027t think this makes sense anymore because we only ever call this if we\u0027ve checked that `container_format \u003d\u003d \u0027bare\u0027` and we will always wrap in that case. If you keep this exception handler it should probably raise `RuntimeError` or something to indicate that we got to a place we don\u0027t expect.","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"ae0cc5eba9de6e243fd25d7d810fa7d7f32f0f00","unresolved":false,"context_lines":[{"line_number":1026,"context_line":"        inspector.safety_check()"},{"line_number":1027,"context_line":"    except AttributeError:"},{"line_number":1028,"context_line":"        # We must not have wrapped this for inspection because of"},{"line_number":1029,"context_line":"        # container_format"},{"line_number":1030,"context_line":"        pass"},{"line_number":1031,"context_line":"    except format_inspector.ImageFormatError as e:"},{"line_number":1032,"context_line":"        # No format matched!"}],"source_content_type":"text/x-python","patch_set":5,"id":"6065c6e5_829c0064","line":1029,"in_reply_to":"edb836bb_512bf992","updated":"2026-11-02 08:49:16.000000000","message":"Done","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"eca40f1e4ce8cd3f20bc3db59e95a4992ab8135c","unresolved":true,"context_lines":[{"line_number":1103,"context_line":"    except AttributeError:"},{"line_number":1104,"context_line":"        # We must not have wrapped this for inspection because of"},{"line_number":1105,"context_line":"        # container_format"},{"line_number":1106,"context_line":"        pass"},{"line_number":1107,"context_line":"    except format_inspector.ImageFormatError as e:"},{"line_number":1108,"context_line":"        raise exception.InvalidImageData(str(e))"},{"line_number":1109,"context_line":"    except format_inspector.SafetyCheckFailed as e:"}],"source_content_type":"text/x-python","patch_set":5,"id":"8961434b_ba9c9b7b","line":1106,"updated":"2026-10-30 14:07:42.000000000","message":"But we always wrap for luks and we will always call this for luks right? This is copied direct from the disk_format thing I guess, but it doesn\u0027t make sense here, AFAIK.","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"ae0cc5eba9de6e243fd25d7d810fa7d7f32f0f00","unresolved":false,"context_lines":[{"line_number":1103,"context_line":"    except AttributeError:"},{"line_number":1104,"context_line":"        # We must not have wrapped this for inspection because of"},{"line_number":1105,"context_line":"        # container_format"},{"line_number":1106,"context_line":"        pass"},{"line_number":1107,"context_line":"    except format_inspector.ImageFormatError as e:"},{"line_number":1108,"context_line":"        raise exception.InvalidImageData(str(e))"},{"line_number":1109,"context_line":"    except format_inspector.SafetyCheckFailed as e:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5313a0b7_249b05a5","line":1106,"in_reply_to":"8961434b_ba9c9b7b","updated":"2026-11-02 08:49:16.000000000","message":"Done","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"}],"glance/location.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":true,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"def check_luks_container(data):"},{"line_number":41,"context_line":"    \"\"\"Confirm wrapped image data is a LUKSv1 container."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    The encrypted payload is not decrypted, so ``disk_format`` is not"},{"line_number":44,"context_line":"    compared with the content inside the LUKS header. Returns the virtual"}],"source_content_type":"text/x-python","patch_set":2,"id":"dbf357e7_3b9e3775","line":41,"range":{"start_line":41,"start_character":7,"end_line":41,"end_character":56},"updated":"2026-10-29 09:35:00.000000000","message":"If you check the parent patch glance/api/v2/images.py#193 allows os_encrypt_format to be LUKSv1 or LUKSv2 where as here line #58 rejects anything other than version 1\n\nWe either need to support LUKSv2 in inspection, or restrict the API to LUKSv1 until that support exists.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"5718b8a4cb6d9381cb9fc33019eb2bef8508bf17","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"def check_luks_container(data):"},{"line_number":41,"context_line":"    \"\"\"Confirm wrapped image data is a LUKSv1 container."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    The encrypted payload is not decrypted, so ``disk_format`` is not"},{"line_number":44,"context_line":"    compared with the content inside the LUKS header. Returns the virtual"}],"source_content_type":"text/x-python","patch_set":2,"id":"980f650b_b71c1883","line":41,"range":{"start_line":41,"start_character":7,"end_line":41,"end_character":56},"in_reply_to":"03cffbe8_d286ce84","updated":"2026-10-30 13:06:23.000000000","message":"Done. LUKS no longer skips the other checks. luks and bare each go through their own helper, and anything else is skipped with a log.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":true,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"def check_luks_container(data):"},{"line_number":41,"context_line":"    \"\"\"Confirm wrapped image data is a LUKSv1 container."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    The encrypted payload is not decrypted, so ``disk_format`` is not"},{"line_number":44,"context_line":"    compared with the content inside the LUKS header. Returns the virtual"}],"source_content_type":"text/x-python","patch_set":2,"id":"03cffbe8_d286ce84","line":41,"range":{"start_line":41,"start_character":7,"end_line":41,"end_character":56},"in_reply_to":"48e1a1f8_ada0425d","updated":"2026-10-30 09:29:17.000000000","message":"Ack, allows only LUKSv1. LUKS v2 is rejected. \nWe can allow LUKSv2 again after oslo.utils can inspect a v2 header.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b7b99538973a0d55bd3905b5a0de1a038725c9a6","unresolved":true,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"def check_luks_container(data):"},{"line_number":41,"context_line":"    \"\"\"Confirm wrapped image data is a LUKSv1 container."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    The encrypted payload is not decrypted, so ``disk_format`` is not"},{"line_number":44,"context_line":"    compared with the content inside the LUKS header. Returns the virtual"}],"source_content_type":"text/x-python","patch_set":2,"id":"48e1a1f8_ada0425d","line":41,"range":{"start_line":41,"start_character":7,"end_line":41,"end_character":56},"in_reply_to":"dbf357e7_3b9e3775","updated":"2026-10-29 15:51:57.000000000","message":"++","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b7b99538973a0d55bd3905b5a0de1a038725c9a6","unresolved":true,"context_lines":[{"line_number":51,"context_line":"    \"\"\""},{"line_number":52,"context_line":"    inspector \u003d data.format"},{"line_number":53,"context_line":"    detected \u003d str(inspector)"},{"line_number":54,"context_line":"    if detected !\u003d \u0027luks\u0027:"},{"line_number":55,"context_line":"        raise format_inspector.ImageFormatError("},{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"}],"source_content_type":"text/x-python","patch_set":2,"id":"7327c910_cb0b0d27","line":54,"updated":"2026-10-29 15:51:57.000000000","message":"This is the only assertion you\u0027re making here.. If you claimed luks and it matches, we allow it. IIRC we\u0027re only ever going to allow LUKS+(raw,gpt) so we could go ahead and reject if `disk_format` is not one of those, even though we\u0027re not inspecting deep enough to validate right? Right now, someone could upload luks+iso or luks+vmdk as far as I can tell.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":false,"context_lines":[{"line_number":51,"context_line":"    \"\"\""},{"line_number":52,"context_line":"    inspector \u003d data.format"},{"line_number":53,"context_line":"    detected \u003d str(inspector)"},{"line_number":54,"context_line":"    if detected !\u003d \u0027luks\u0027:"},{"line_number":55,"context_line":"        raise format_inspector.ImageFormatError("},{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"}],"source_content_type":"text/x-python","patch_set":2,"id":"c08acffa_45c78694","line":54,"in_reply_to":"7327c910_cb0b0d27","updated":"2026-10-30 09:29:17.000000000","message":"Done. disk_format must be raw or gpt. iso, vmdk, and qcow2 are rejected.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":true,"context_lines":[{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"},{"line_number":58,"context_line":"    inspector.safety_check()"},{"line_number":59,"context_line":"    virtual_size \u003d inspector.virtual_size"},{"line_number":60,"context_line":"    LOG.info(\u0027LUKS container format matched and virtual size computed: %i\u0027,"},{"line_number":61,"context_line":"             virtual_size)"},{"line_number":62,"context_line":"    return virtual_size"}],"source_content_type":"text/x-python","patch_set":2,"id":"72af2c2e_11370d08","line":59,"range":{"start_line":59,"start_character":4,"end_line":59,"end_character":41},"updated":"2026-10-29 09:35:00.000000000","message":"LUKS header has payload_offset field. If this value is bigger than actual file size, then virtual_size is becoming negative. I tried with 592 byte file and payload_offset\u003d100, it gives -50608, but image is still active. Please add check for negative virtual_size.\n\nLet me know if you need help in testing this locally in your environment.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"36dfef7898b1263a88172f3c1470b0446fec809c","unresolved":true,"context_lines":[{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"},{"line_number":58,"context_line":"    inspector.safety_check()"},{"line_number":59,"context_line":"    virtual_size \u003d inspector.virtual_size"},{"line_number":60,"context_line":"    LOG.info(\u0027LUKS container format matched and virtual size computed: %i\u0027,"},{"line_number":61,"context_line":"             virtual_size)"},{"line_number":62,"context_line":"    return virtual_size"}],"source_content_type":"text/x-python","patch_set":2,"id":"83ca4276_499931fc","line":59,"range":{"start_line":59,"start_character":4,"end_line":59,"end_character":41},"in_reply_to":"29d63bba_36e5110d","updated":"2026-10-29 16:48:03.000000000","message":"Yes this should be a failure here.\nReference;\nhttps://github.com/openstack/oslo.utils/blob/10.1.1/oslo_utils/imageutils/format_inspector.py#L1690","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b7b99538973a0d55bd3905b5a0de1a038725c9a6","unresolved":true,"context_lines":[{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"},{"line_number":58,"context_line":"    inspector.safety_check()"},{"line_number":59,"context_line":"    virtual_size \u003d inspector.virtual_size"},{"line_number":60,"context_line":"    LOG.info(\u0027LUKS container format matched and virtual size computed: %i\u0027,"},{"line_number":61,"context_line":"             virtual_size)"},{"line_number":62,"context_line":"    return virtual_size"}],"source_content_type":"text/x-python","patch_set":2,"id":"29d63bba_36e5110d","line":59,"range":{"start_line":59,"start_character":4,"end_line":59,"end_character":41},"in_reply_to":"72af2c2e_11370d08","updated":"2026-10-29 15:51:57.000000000","message":"I have to go back and look a these details, but can a valid image result in a negative virtual_size, or are you saying this should be a failure here?","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":true,"context_lines":[{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"},{"line_number":58,"context_line":"    inspector.safety_check()"},{"line_number":59,"context_line":"    virtual_size \u003d inspector.virtual_size"},{"line_number":60,"context_line":"    LOG.info(\u0027LUKS container format matched and virtual size computed: %i\u0027,"},{"line_number":61,"context_line":"             virtual_size)"},{"line_number":62,"context_line":"    return virtual_size"}],"source_content_type":"text/x-python","patch_set":2,"id":"9ae86f61_026eaa44","line":59,"range":{"start_line":59,"start_character":4,"end_line":59,"end_character":41},"in_reply_to":"83ca4276_499931fc","updated":"2026-10-30 09:29:17.000000000","message":"Done. Negative virtual_size now fails the upload.\n\nTested locally the same way you did:\n\n1. Created a 592-byte LUKS v1 header with payload_offset\u003d100 (bytes 104–108).\n2. Created image container_format\u003dluks, disk_format\u003draw.\n3. Uploaded that file.\n\nBefore this change the image became active with virtual_size\u003d-50608. Now the upload is rejected (Image failed safety checks) and the image does not become active.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"5718b8a4cb6d9381cb9fc33019eb2bef8508bf17","unresolved":false,"context_lines":[{"line_number":56,"context_line":"            _(\u0027Image container_format luks does not match stream data %s\u0027)"},{"line_number":57,"context_line":"            % detected)"},{"line_number":58,"context_line":"    inspector.safety_check()"},{"line_number":59,"context_line":"    virtual_size \u003d inspector.virtual_size"},{"line_number":60,"context_line":"    LOG.info(\u0027LUKS container format matched and virtual size computed: %i\u0027,"},{"line_number":61,"context_line":"             virtual_size)"},{"line_number":62,"context_line":"    return virtual_size"}],"source_content_type":"text/x-python","patch_set":2,"id":"4323d5ca_a7c74a01","line":59,"range":{"start_line":59,"start_character":4,"end_line":59,"end_character":41},"in_reply_to":"9ae86f61_026eaa44","updated":"2026-10-30 13:06:23.000000000","message":"Done","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b7b99538973a0d55bd3905b5a0de1a038725c9a6","unresolved":true,"context_lines":[{"line_number":663,"context_line":"                # container\u0027s disk_format describes the still-encrypted"},{"line_number":664,"context_line":"                # payload, which is not inspected in this pass."},{"line_number":665,"context_line":"                virtual_size \u003d check_luks_container(data)"},{"line_number":666,"context_line":"            else:"},{"line_number":667,"context_line":"                if format \u003d\u003d self.image.disk_format:"},{"line_number":668,"context_line":"                    virtual_size \u003d inspector.virtual_size"},{"line_number":669,"context_line":"                    LOG.info(\u0027Image format matched and virtual size \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a2a38f7_9f71facf","line":666,"updated":"2026-10-29 15:51:57.000000000","message":"I\u0027m trying to determine if this is really necessary or appropriate. I\u0027m concerned about losing some of the checks below in the case of luks. If I declare my container_format as luks I bypass all these other checks. I wonder if this whole set of conditionals should be rewritten with container/disk formats in mind.\n\nPerhaps `elif container_format \u003d\u003d \u0027bare\u0027: check_bare_container(data)` and move this logic up near the other helper? Then an `else` for `container_format` being neither could be handled generically, I assume with a LOG about why we\u0027re doing no inspection.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"5718b8a4cb6d9381cb9fc33019eb2bef8508bf17","unresolved":false,"context_lines":[{"line_number":663,"context_line":"                # container\u0027s disk_format describes the still-encrypted"},{"line_number":664,"context_line":"                # payload, which is not inspected in this pass."},{"line_number":665,"context_line":"                virtual_size \u003d check_luks_container(data)"},{"line_number":666,"context_line":"            else:"},{"line_number":667,"context_line":"                if format \u003d\u003d self.image.disk_format:"},{"line_number":668,"context_line":"                    virtual_size \u003d inspector.virtual_size"},{"line_number":669,"context_line":"                    LOG.info(\u0027Image format matched and virtual size \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"342d768c_dab0e373","line":666,"in_reply_to":"3a2a38f7_9f71facf","updated":"2026-10-30 13:06:23.000000000","message":"Done","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"}],"glance/tests/unit/common/test_utils.py":[{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"eca40f1e4ce8cd3f20bc3db59e95a4992ab8135c","unresolved":true,"context_lines":[{"line_number":944,"context_line":"        self.config(require_image_format_match\u003dFalse, group\u003d\u0027image_format\u0027)"},{"line_number":945,"context_line":"        self.assertRaises("},{"line_number":946,"context_line":"            exception.InvalidImageData,"},{"line_number":947,"context_line":"            utils.check_luks_container, self._wrapper(fmt\u003d\u0027qcow2\u0027), \u0027raw\u0027)"},{"line_number":948,"context_line":""},{"line_number":949,"context_line":"    def test_rejects_disallowed_disk_format(self):"},{"line_number":950,"context_line":"        self.config(require_image_format_match\u003dFalse, group\u003d\u0027image_format\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"c1ca9e58_a4227eed","line":947,"updated":"2026-10-30 14:07:42.000000000","message":"I think it\u0027s probably okay but I think technically you should have both the old and new cases covered","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"ae0cc5eba9de6e243fd25d7d810fa7d7f32f0f00","unresolved":false,"context_lines":[{"line_number":944,"context_line":"        self.config(require_image_format_match\u003dFalse, group\u003d\u0027image_format\u0027)"},{"line_number":945,"context_line":"        self.assertRaises("},{"line_number":946,"context_line":"            exception.InvalidImageData,"},{"line_number":947,"context_line":"            utils.check_luks_container, self._wrapper(fmt\u003d\u0027qcow2\u0027), \u0027raw\u0027)"},{"line_number":948,"context_line":""},{"line_number":949,"context_line":"    def test_rejects_disallowed_disk_format(self):"},{"line_number":950,"context_line":"        self.config(require_image_format_match\u003dFalse, group\u003d\u0027image_format\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"2afba871_39a87b6b","line":947,"in_reply_to":"c1ca9e58_a4227eed","updated":"2026-11-02 08:49:16.000000000","message":"Done","commit_id":"e31e780a4374521b311f999fbcb6420d4197ee78"}],"releasenotes/notes/luks-container-format-inspection-8c1f0a2b7d4e4a11.yaml":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"a6737d958700ec8027334d3ed0f6ebb8970613c7","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Uploads and imports with ``container_format\u003dluks`` are now inspected to"},{"line_number":5,"context_line":"    confirm the file is a LUKS version 1 image. The ``disk_format`` must be"},{"line_number":6,"context_line":"    ``raw`` or ``gpt``. ``os_encrypt_format`` accepts only ``LUKSv1``."},{"line_number":7,"context_line":"upgrade:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    Recognizing LUKS images requires ``oslo.utils`` 10.1.0 or later with the"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"0f337d9b_19bae5bb","line":6,"range":{"start_line":4,"start_character":0,"end_line":6,"end_character":70},"updated":"2026-10-30 10:21:37.000000000","message":"As this patch does not decrypt the payload or validate the inner disk_format, and that will be handled in follow-up work. I think we should mention the same in releasenote and commit message as well","commit_id":"765e365d69af7e74f74e63fc3ed733dcddd233f2"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"5718b8a4cb6d9381cb9fc33019eb2bef8508bf17","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Uploads and imports with ``container_format\u003dluks`` are now inspected to"},{"line_number":5,"context_line":"    confirm the file is a LUKS version 1 image. The ``disk_format`` must be"},{"line_number":6,"context_line":"    ``raw`` or ``gpt``. ``os_encrypt_format`` accepts only ``LUKSv1``."},{"line_number":7,"context_line":"upgrade:"},{"line_number":8,"context_line":"  - |"},{"line_number":9,"context_line":"    Recognizing LUKS images requires ``oslo.utils`` 10.1.0 or later with the"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"525cb7b5_e7b020d0","line":6,"range":{"start_line":4,"start_character":0,"end_line":6,"end_character":70},"in_reply_to":"0f337d9b_19bae5bb","updated":"2026-10-30 13:06:23.000000000","message":"Done","commit_id":"765e365d69af7e74f74e63fc3ed733dcddd233f2"}],"requirements.txt":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"491a274911e344db5bcff69e580b3f10b3300acd","unresolved":true,"context_lines":[{"line_number":15,"context_line":"oslo.concurrency\u003e\u003d4.5.1 # Apache-2.0"},{"line_number":16,"context_line":"oslo.context\u003e\u003d2.22.0 # Apache-2.0"},{"line_number":17,"context_line":"oslo.upgradecheck\u003e\u003d1.3.0 # Apache-2.0"},{"line_number":18,"context_line":"oslo.utils[image-inspection]\u003e\u003d10.1.0 # Apache-2.0"},{"line_number":19,"context_line":"stevedore!\u003d3.0.0,\u003e\u003d1.20.0 # Apache-2.0"},{"line_number":20,"context_line":"taskflow\u003e\u003d4.0.0 # Apache-2.0"},{"line_number":21,"context_line":"keystoneauth1\u003e\u003d3.4.0 # Apache-2.0"}],"source_content_type":"text/plain","patch_set":2,"id":"6f646d0b_5824e01d","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":36},"updated":"2026-10-29 09:35:00.000000000","message":"10.1.0 is affected with security issue, so we need to wait or check if new release is available with the fix and pin that.\n\n https://docs.openstack.org/security-notes/OSSN-0111.html","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e6c04545d7cdbda3210be96ecb8725d15864089f","unresolved":true,"context_lines":[{"line_number":15,"context_line":"oslo.concurrency\u003e\u003d4.5.1 # Apache-2.0"},{"line_number":16,"context_line":"oslo.context\u003e\u003d2.22.0 # Apache-2.0"},{"line_number":17,"context_line":"oslo.upgradecheck\u003e\u003d1.3.0 # Apache-2.0"},{"line_number":18,"context_line":"oslo.utils[image-inspection]\u003e\u003d10.1.0 # Apache-2.0"},{"line_number":19,"context_line":"stevedore!\u003d3.0.0,\u003e\u003d1.20.0 # Apache-2.0"},{"line_number":20,"context_line":"taskflow\u003e\u003d4.0.0 # Apache-2.0"},{"line_number":21,"context_line":"keystoneauth1\u003e\u003d3.4.0 # Apache-2.0"}],"source_content_type":"text/plain","patch_set":2,"id":"82cd01d4_fbc16e0b","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":36},"in_reply_to":"6f646d0b_5824e01d","updated":"2026-10-30 09:29:17.000000000","message":"I think OSSN-0111 is only when oslo decrypts LUKS with a passphrase (the LUKS password) and DEBUG logging is on. This patch only reads the LUKS header and does not pass a passphrase, so 10.1.0 is fine.","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"5718b8a4cb6d9381cb9fc33019eb2bef8508bf17","unresolved":false,"context_lines":[{"line_number":15,"context_line":"oslo.concurrency\u003e\u003d4.5.1 # Apache-2.0"},{"line_number":16,"context_line":"oslo.context\u003e\u003d2.22.0 # Apache-2.0"},{"line_number":17,"context_line":"oslo.upgradecheck\u003e\u003d1.3.0 # Apache-2.0"},{"line_number":18,"context_line":"oslo.utils[image-inspection]\u003e\u003d10.1.0 # Apache-2.0"},{"line_number":19,"context_line":"stevedore!\u003d3.0.0,\u003e\u003d1.20.0 # Apache-2.0"},{"line_number":20,"context_line":"taskflow\u003e\u003d4.0.0 # Apache-2.0"},{"line_number":21,"context_line":"keystoneauth1\u003e\u003d3.4.0 # Apache-2.0"}],"source_content_type":"text/plain","patch_set":2,"id":"4059b755_65a96537","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":36},"in_reply_to":"82cd01d4_fbc16e0b","updated":"2026-10-30 13:06:23.000000000","message":"Done","commit_id":"7756c97c973b11caac63adc53a8191099d6b7eac"}]}