)]}'
{"id":"openstack%2Fironic-python-agent~927984","triplet_id":"openstack%2Fironic-python-agent~bugfix%2F9.9~I5254b80717cb5a7f9084e3eff32a00b968f987b7","project":"openstack/ironic-python-agent","branch":"bugfix/9.9","topic":"ossa-2024-003","attention_set":{},"removed_from_attention_set":{"10342":{"account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"last_update":"2024-11-25 15:07:07.000000000","reason":"Change was abandoned"},"4571":{"account":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"last_update":"2024-11-25 15:07:07.000000000","reason":"Change was abandoned"},"15519":{"account":{"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"},"last_update":"2024-11-25 15:07:07.000000000","reason":"Change was abandoned"}},"hashtags":["ironic-week-prio"],"change_id":"I5254b80717cb5a7f9084e3eff32a00b968f987b7","subject":"Inspect non-raw images for safety","status":"ABANDONED","created":"2024-09-04 14:11:29.000000000","updated":"2024-11-25 15:07:07.000000000","total_comment_count":3,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"6c8fe798aba864eabf666acb7de75a67c40b4765","_number":927984,"virtual_id_number":927984,"owner":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2024-11-25 14:45:19.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"all":[{"value":2,"date":"2024-11-18 22:10:21.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"value":2,"date":"2024-11-10 02:53:51.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"all":[{"value":1,"date":"2024-11-18 22:10:21.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"}],"values":{"-1":"Do Not Backport"," 0":"Backport Review Needed","+1":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"}],"REVIEWER":[{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2024-09-04 14:54:12.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2024-09-04 23:04:40.000000000","updated_by":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"reviewer":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"state":"REVIEWER"},{"updated":"2024-09-04 23:28:28.000000000","updated_by":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"reviewer":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"state":"REVIEWER"},{"updated":"2024-10-07 12:28:26.000000000","updated_by":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"reviewer":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"state":"CC"},{"updated":"2024-10-17 23:53:24.000000000","updated_by":{"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"},"reviewer":{"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"},"state":"REVIEWER"},{"updated":"2024-11-25 14:32:10.000000000","updated_by":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"reviewer":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"state":"CC"}],"messages":[{"id":"7d7e2c77b73bb5bd695a1f11f4c7bccd5ee4c2cb","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2024-09-04 14:11:29.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ccc46fff7755a49ddacf8c33cd05a29749de527e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-09-04 14:54:12.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bd3c8ba30cce4349b2f5486771354257\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/8e9203669477449ab1236fca94fa2896 : SUCCESS in 4m 00s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d950ad6c608046a58603be65f388f0b6 : SUCCESS in 4m 10s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/871c625cea854b8ba2dcbb0a93b88773 : SUCCESS in 5m 15s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9908e3a49cb64096a41042f3fa33ae3f : SUCCESS in 3m 00s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/946cbd2c2a4e4dd7b08736c2e40877d8 : SUCCESS in 3m 18s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/c03bb18ca28a4797b66f3f1234f8c16e : SUCCESS in 3m 42s\n- ipa-tox-examples https://zuul.opendev.org/t/openstack/build/4c35781b54594e368f60a5aa02d6056a : SUCCESS in 3m 50s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/8763b071fb994de3b07cf5ff49f390bf : FAILURE in 3m 21s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"b30fbbb564edc5ec554952bd569ad226a5994a19","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2024-09-04 15:10:22.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1\n","accounts_in_message":[],"_revision_number":2},{"id":"d16031fa5ab2d9d25ef8731fd294bd4cbf673493","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-09-04 15:21:25.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/60fda9d263444a559618469b14528c96\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f35daaf3bb41495a85e52f4cae14737f : SUCCESS in 3m 47s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5619863aad40480493ee86b94193ecee : SUCCESS in 3m 06s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ceb2be5f7de14654952a577d9e61318e : SUCCESS in 7m 10s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/242ebc24e87b41df8292d4439d3d38aa : SUCCESS in 2m 44s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/3913ed3daa394a0cbbabf516ead4bc98 : SUCCESS in 3m 57s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/a0cd0e3a324848558680b19313b32683 : SUCCESS in 3m 25s\n- ipa-tox-examples https://zuul.opendev.org/t/openstack/build/cf44689cc48241eea413f70adf1e83dc : SUCCESS in 4m 13s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/ef261557cbe8400a90eef1224905df2c : FAILURE in 3m 18s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"ce6ba333f4460a58bd868bbc016bde0961e9f70f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2024-09-04 16:23:40.000000000","message":"Uploaded patch set 3: Patch Set 2 was rebased.\n\nOutdated Votes:\n* Verified+1\n","accounts_in_message":[],"_revision_number":3},{"id":"3b1a47fcfee2878220db0bcc7dc12b9d360855e2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-09-04 16:35:42.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d4881a402092452eb6264675177b1bd5\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/19715db6647a4493bd95e2a3a6a3c272 : SUCCESS in 4m 02s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d852556506ea4b7fbd79204ed6a0f906 : SUCCESS in 3m 21s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/13d31a30e3954d7e8d728883b0f54e16 : SUCCESS in 6m 08s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d0289de3e1f14f439dec2f7184f96a1b : SUCCESS in 2m 42s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/569f879e9f44470dbf935456e596e552 : SUCCESS in 3m 28s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/dc8dd80d2ae448fe85b56f7804a39dfc : SUCCESS in 3m 22s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/b2257148d276400f9733f698be57917c : FAILURE in 3m 15s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"68a2c36da736664da04c887859253bd42edcebfe","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2024-09-04 17:26:03.000000000","message":"Topic set to ossa-2024-003","accounts_in_message":[],"_revision_number":3},{"id":"ac9e499f83403a0e9b9d06bd16e8975a8124a7d1","author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"date":"2024-09-04 23:04:40.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"3f5fcd038f527967f0ef57ee8bc4e5775669a7cd","author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"date":"2024-09-04 23:28:28.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"6f847839dc2305c178691985394716c594e684c0","author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"date":"2024-09-05 03:47:34.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"9e1427f3f3339387dc8e6f45326dc7118f427dd6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-09-05 04:02:02.000000000","message":"Patch Set 3:\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bb60b6775daa4312834826aed2dd0acf\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9b5436b078c949b1abb446265bbb04a3 : SUCCESS in 3m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9c78e8f4350a4452abf2987977ae759e : SUCCESS in 3m 02s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/360dd2e745a141cab916f816e334156b : SUCCESS in 5m 24s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/fdae06fa524d48cea4d2b9fc77902b69 : SUCCESS in 2m 43s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/51cb8ee1bfaa416cb7410a01b10f61b0 : SUCCESS in 3m 48s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/6311a52289d74f40ae64a2718d3ecc6f : SUCCESS in 3m 33s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/ab10d9014e4e42618c4b7effdcb03482 : FAILURE in 2m 55s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"ae97f1645ffd1fbba79bb649c01d3188d39f94d4","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2024-10-07 12:28:26.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"1f7f8f27868e35a57fb2f018a26c1ef6302935a9","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-10-07 12:40:06.000000000","message":"Patch Set 3:\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2e98e2071ba24fb6895e6e930e885218\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/e70347673f9c4967a50bb6353ecc06f3 : SUCCESS in 3m 50s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/52cbf896a0304aa3b8d3e203c3f683ab : SUCCESS in 4m 21s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3c9020884c0c467588d950268bde3974 : SUCCESS in 6m 52s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/656dd4fac933440794139998ca0120a4 : SUCCESS in 3m 37s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/e939b297202d4e4cab32c453e3eca8a6 : SUCCESS in 4m 18s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/60657fdec89c4bf0989078cf8b4baa75 : SUCCESS in 3m 42s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/6889c566ad0a4e40a659241b79a0b1b0 : FAILURE in 3m 28s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"274242ed9c90cb893d224a3331fc3dd86763c355","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"date":"2024-10-17 23:04:53.000000000","message":"Uploaded patch set 4: Patch Set 3 was rebased.\n\nCopied Votes:\n* Code-Review+2 (copy condition: \"**changekind:TRIVIAL_REBASE** OR is:MIN\")\n\nOutdated Votes:\n* Verified+1\n* Workflow+1\n","accounts_in_message":[],"_revision_number":4},{"id":"56ef9cad1eb62999305e96ffd2d4da8df85992f0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-10-17 23:18:38.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b80f410826d9484ca100bc9fcc9093f1\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/911bdee9895d4c84860aec1030c2a7e8 : SUCCESS in 3m 56s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c3d64e14b4e749cd8bf9d6eaffa98ecf : SUCCESS in 2m 40s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/726d18fe9d7743ad84bcf33ebf0ffe24 : SUCCESS in 4m 13s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6cd0fe16a2cb46568183dd995d678d2a : SUCCESS in 3m 05s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/5419bd09620440e4b99e20499bb9ba5c : SUCCESS in 2m 57s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/b9e7439157644c81a893127cfe5a5daf : SUCCESS in 2m 26s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/f1b4e2b45d9b47aa9325313acd851447 : FAILURE in 2m 54s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"db059d103a00b686583f29eaead2da41092ed6a5","author":{"_account_id":15519,"name":"Iury Gregory Melo Ferreira","display_name":"Iury Gregory","email":"iurygregory@gmail.com","username":"iurygregory"},"date":"2024-10-17 23:53:24.000000000","message":"Patch Set 4: Workflow+1","accounts_in_message":[],"_revision_number":4},{"id":"c9f5cd839c4798b60a68083c207380f5f0c5e0a3","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"real_author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2024-11-10 02:53:51.000000000","message":"Patch Set 5: Patch Set 4 was rebased on behalf of \u003cGERRIT_ACCOUNT_4571\u003e\n\nCopied Votes:\n* Code-Review+2 (copy condition: \"**changekind:TRIVIAL_REBASE** OR is:MIN\")\n\nOutdated Votes:\n* Verified+1\n* Workflow+1\n","accounts_in_message":[{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"}],"_revision_number":5},{"id":"1392d95a1b8992f5fd896c5b7870b1b0921b4f99","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-11-10 03:10:40.000000000","message":"Patch Set 5: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6e70d4704c1b4434adbcb57d1cea01af\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/61682a4d01214be29e77464335fa1c4c : SUCCESS in 3m 49s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3cb497eaae4948eb870cee31fdd2b130 : SUCCESS in 3m 06s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1c73ca155a794df18e0b3a3a8f0a654f : SUCCESS in 5m 53s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/57f4f585e2b34744aaff033a98697d59 : SUCCESS in 2m 52s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/97adcb93a1da4921898e65a8dcb264e3 : SUCCESS in 3m 20s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/5bc5afb0dca34c85af5c458a3138b697 : SUCCESS in 2m 35s\n- ipa-tox-examples https://zuul.opendev.org/t/openstack/build/87c3ee9111eb43c89656eb3e743b4d62 : SUCCESS in 3m 47s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/340abdfa709c4a48b4d56e7658cf10b9 : FAILURE in 3m 18s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"a5349a272ad53008cdf2ad7025716c13122d778e","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2024-11-10 04:09:49.000000000","message":"Hashtag added: ironic-week-prio","accounts_in_message":[],"_revision_number":5},{"id":"e00746818e31f5a8669038fbfa3dccca33ccb6a0","author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"date":"2024-11-18 22:10:21.000000000","message":"Patch Set 5: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":5},{"id":"bbed6f8c7402614f25fd0a88ce5e5a20f5cd9507","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-11-18 22:10:46.000000000","message":"Patch Set 5: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":5},{"id":"705add2b4fd8e04227900d64e5f1198eaa3126ea","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-11-18 22:21:37.000000000","message":"Patch Set 5: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/4c7ab760411049f98bdda6c140b499a1\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/79b681d0dbe14ffd90c88377469b29a8 : SUCCESS in 3m 16s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7aa38a8b590b4ae3ad951c243880bc7f : SUCCESS in 4m 29s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/997ba29930a7423080ea7211fa95a8a2 : SUCCESS in 2m 41s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/09c67bd717f44a5c84c69f284e58e5df : FAILURE in 3m 08s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/0967c61612824737b2436751e4f04c91 : SUCCESS in 3m 11s\n- ipa-tox-examples https://zuul.opendev.org/t/openstack/build/431e45311e1142c8b3cba66eed5ac7bf : FAILURE in 3m 16s","accounts_in_message":[],"_revision_number":5},{"id":"408c10d28aa5ccf6abc7b01323bd04fa2094ea02","author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"date":"2024-11-25 14:32:10.000000000","message":"Patch Set 5:\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"f14f668938a562e6da41b6161a7fb0b6694c2146","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-11-25 14:45:19.000000000","message":"Patch Set 5: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/2c9a5a4e505745a79d85cfa6a3070bc1\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b3773196779949b088523cfd186c3fa2 : FAILURE in 3m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/055cc8afedb748e4802d398fbd2bbba3 : SUCCESS in 3m 37s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/02fc4b0531dd47909058932e3721cc74 : SUCCESS in 5m 14s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f3158b9f1e2946af9075548f11aaf727 : SUCCESS in 2m 11s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/3a954ccb285f4a1ab390ec2ca36d6657 : FAILURE in 2m 58s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/541113a7b67641aa970ac8b92e3d7c21 : SUCCESS in 3m 35s\n- ipa-tox-examples https://zuul.opendev.org/t/openstack/build/3579d204f8704bb696b24aed95d01db0 : FAILURE in 4m 41s\n- ipa-tox-codespell https://zuul.opendev.org/t/openstack/build/a61f5f93431541f19ef25e5286a82f53 : FAILURE in 3m 06s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"6c8fe798aba864eabf666acb7de75a67c40b4765","tag":"autogenerated:gerrit:abandon","author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"date":"2024-11-25 15:07:07.000000000","message":"Abandoned\n\nbugfix/9.9 is not supported anymore","accounts_in_message":[],"_revision_number":5}],"current_revision_number":5,"current_revision":"37cf656469ce3cd19caa537a34648d21550d3120","revisions":{"af5fefedde72f7b2761276b9ff27ead0438b344b":{"kind":"REWORK","_number":1,"created":"2024-09-04 14:11:29.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/84/927984/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic-python-agent","ref":"refs/changes/84/927984/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/1"}}},"commit":{"parents":[{"commit":"977046c1df83fb4ceead4b35e6ab6764666c03e4","subject":"Update .gitreview for bugfix/9.9","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/977046c1df83fb4ceead4b35e6ab6764666c03e4"}]}],"author":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-03-11 16:29:58.000000000","tz":60},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-09-04 14:11:27.000000000","tz":-420},"subject":"Inspect non-raw images for safety","message":"Inspect non-raw images for safety\n\nThis is a backport of two changes merged together to facilitate\nbackporting:\n\nThe first is a refactor of disk utilities:\n\nImport disk_{utils,partitioner} from ironic-lib\n\nWith the iscsi deploy long gone, these modules are only used in IPA and\nin fact represent a large part of its critical logic. Having them\nseparately sometimes makes fixing issues tricky if an interface of\na function needs changing.\n\nThis change imports the code mostly as it is, just removing run_as_root and\na deprecated function, as well as moving configuration options to config.py.\n\nAlso migrates one relevant function from ironic_lib.utils.\n\nThe second is the fix for the security issue:\n\nInspect non-raw images for safety\n\nWhen IPA gets a non-raw image, it performs an on-the-fly conversion\nusing qemu-img convert, as well as running qemu-img frequently to get\nbasic information about the image before validating it.\n\nNow, we ensure that before any qemu-img calls are made, that we have\ninspected the image for safety and pass through the detected format.\n\nIf given a disk_format\u003draw image and image streaming is enabled\n(default), we retain the existing behavior of not inspecting it in\nany way and streaming it bit-perfect to the device. In this case, we\nnever use qemu-based tools on the image at all.\n\nIf given a disk_format\u003draw image and image streaming is disabled, this\nchange fixes a bug where the image may have been converted if it was not\nactually raw in the first place. We now stream these bit-perfect to the\ndevice.\n\nAdds two config options:\n- [DEFAULT]/disable_deep_image_inspection, which can be set to \"True\" in\n  order to disable all security features. Do not do this.\n- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types\n  IPA should accept.\n\nBoth of these configuration options are wired up to be set by the lookup\ndata returned by Ironic at lookup time.\n\nThis uses a image format inspection module imported from Nova; this\ninspector will eventually live in oslo.utils, at which point we\u0027ll\nmigrate our usage of the inspector to it.\n\nCloses-Bug: #2071740\nCo-Authored-By: Dmitry Tantsur \u003cdtantsur@protonmail.com\u003e\nChange-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/af5fefedde72f7b2761276b9ff27ead0438b344b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/af5fefedde72f7b2761276b9ff27ead0438b344b"}]},"branch":"refs/heads/bugfix/9.9"},"795b84593025b4a43228dfd3fa06a22eb9a101b8":{"kind":"REWORK","_number":2,"created":"2024-09-04 15:10:22.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/84/927984/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic-python-agent","ref":"refs/changes/84/927984/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/2"}}},"commit":{"parents":[{"commit":"977046c1df83fb4ceead4b35e6ab6764666c03e4","subject":"Update .gitreview for bugfix/9.9","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/977046c1df83fb4ceead4b35e6ab6764666c03e4"}]}],"author":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-03-11 16:29:58.000000000","tz":60},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-09-04 15:10:15.000000000","tz":-420},"subject":"Inspect non-raw images for safety","message":"Inspect non-raw images for safety\n\nThis is a backport of two changes merged together to facilitate\nbackporting:\n\nThe first is a refactor of disk utilities:\n\nImport disk_{utils,partitioner} from ironic-lib\n\nWith the iscsi deploy long gone, these modules are only used in IPA and\nin fact represent a large part of its critical logic. Having them\nseparately sometimes makes fixing issues tricky if an interface of\na function needs changing.\n\nThis change imports the code mostly as it is, just removing run_as_root and\na deprecated function, as well as moving configuration options to config.py.\n\nAlso migrates one relevant function from ironic_lib.utils.\n\nThe second is the fix for the security issue:\n\nInspect non-raw images for safety\n\nWhen IPA gets a non-raw image, it performs an on-the-fly conversion\nusing qemu-img convert, as well as running qemu-img frequently to get\nbasic information about the image before validating it.\n\nNow, we ensure that before any qemu-img calls are made, that we have\ninspected the image for safety and pass through the detected format.\n\nIf given a disk_format\u003draw image and image streaming is enabled\n(default), we retain the existing behavior of not inspecting it in\nany way and streaming it bit-perfect to the device. In this case, we\nnever use qemu-based tools on the image at all.\n\nIf given a disk_format\u003draw image and image streaming is disabled, this\nchange fixes a bug where the image may have been converted if it was not\nactually raw in the first place. We now stream these bit-perfect to the\ndevice.\n\nAdds two config options:\n- [DEFAULT]/disable_deep_image_inspection, which can be set to \"True\" in\n  order to disable all security features. Do not do this.\n- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types\n  IPA should accept.\n\nBoth of these configuration options are wired up to be set by the lookup\ndata returned by Ironic at lookup time.\n\nThis uses a image format inspection module imported from Nova; this\ninspector will eventually live in oslo.utils, at which point we\u0027ll\nmigrate our usage of the inspector to it.\n\nCloses-Bug: #2071740\nCo-Authored-By: Dmitry Tantsur \u003cdtantsur@protonmail.com\u003e\nChange-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/795b84593025b4a43228dfd3fa06a22eb9a101b8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/795b84593025b4a43228dfd3fa06a22eb9a101b8"}]},"branch":"refs/heads/bugfix/9.9"},"1d5c45d703b8343d6683f30056fc2fb01c4405ca":{"kind":"TRIVIAL_REBASE","_number":3,"created":"2024-09-04 16:23:40.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/84/927984/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic-python-agent","ref":"refs/changes/84/927984/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/3"}}},"commit":{"parents":[{"commit":"310a7c6ccc5f729a926762cc20b27c319ec46df4","subject":"Remove and disable examples job","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/310a7c6ccc5f729a926762cc20b27c319ec46df4"}]}],"author":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-03-11 16:29:58.000000000","tz":60},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-09-04 16:23:22.000000000","tz":-420},"subject":"Inspect non-raw images for safety","message":"Inspect non-raw images for safety\n\nThis is a backport of two changes merged together to facilitate\nbackporting:\n\nThe first is a refactor of disk utilities:\n\nImport disk_{utils,partitioner} from ironic-lib\n\nWith the iscsi deploy long gone, these modules are only used in IPA and\nin fact represent a large part of its critical logic. Having them\nseparately sometimes makes fixing issues tricky if an interface of\na function needs changing.\n\nThis change imports the code mostly as it is, just removing run_as_root and\na deprecated function, as well as moving configuration options to config.py.\n\nAlso migrates one relevant function from ironic_lib.utils.\n\nThe second is the fix for the security issue:\n\nInspect non-raw images for safety\n\nWhen IPA gets a non-raw image, it performs an on-the-fly conversion\nusing qemu-img convert, as well as running qemu-img frequently to get\nbasic information about the image before validating it.\n\nNow, we ensure that before any qemu-img calls are made, that we have\ninspected the image for safety and pass through the detected format.\n\nIf given a disk_format\u003draw image and image streaming is enabled\n(default), we retain the existing behavior of not inspecting it in\nany way and streaming it bit-perfect to the device. In this case, we\nnever use qemu-based tools on the image at all.\n\nIf given a disk_format\u003draw image and image streaming is disabled, this\nchange fixes a bug where the image may have been converted if it was not\nactually raw in the first place. We now stream these bit-perfect to the\ndevice.\n\nAdds two config options:\n- [DEFAULT]/disable_deep_image_inspection, which can be set to \"True\" in\n  order to disable all security features. Do not do this.\n- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types\n  IPA should accept.\n\nBoth of these configuration options are wired up to be set by the lookup\ndata returned by Ironic at lookup time.\n\nThis uses a image format inspection module imported from Nova; this\ninspector will eventually live in oslo.utils, at which point we\u0027ll\nmigrate our usage of the inspector to it.\n\nCloses-Bug: #2071740\nCo-Authored-By: Dmitry Tantsur \u003cdtantsur@protonmail.com\u003e\nChange-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/1d5c45d703b8343d6683f30056fc2fb01c4405ca"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/1d5c45d703b8343d6683f30056fc2fb01c4405ca"}]},"branch":"refs/heads/bugfix/9.9"},"a5530c2eb8fc4570f9f4aee91f742e6945900e77":{"kind":"TRIVIAL_REBASE","_number":4,"created":"2024-10-17 23:04:53.000000000","uploader":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"ref":"refs/changes/84/927984/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic-python-agent","ref":"refs/changes/84/927984/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/4"}}},"commit":{"parents":[{"commit":"714909591c3dd5582a7c1a12037ec13e1cf36dc3","subject":"Remove and disable examples job","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/714909591c3dd5582a7c1a12037ec13e1cf36dc3"}]}],"author":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-03-11 16:29:58.000000000","tz":60},"committer":{"name":"Steve Baker","email":"sbaker@redhat.com","date":"2024-10-17 23:04:38.000000000","tz":780},"subject":"Inspect non-raw images for safety","message":"Inspect non-raw images for safety\n\nThis is a backport of two changes merged together to facilitate\nbackporting:\n\nThe first is a refactor of disk utilities:\n\nImport disk_{utils,partitioner} from ironic-lib\n\nWith the iscsi deploy long gone, these modules are only used in IPA and\nin fact represent a large part of its critical logic. Having them\nseparately sometimes makes fixing issues tricky if an interface of\na function needs changing.\n\nThis change imports the code mostly as it is, just removing run_as_root and\na deprecated function, as well as moving configuration options to config.py.\n\nAlso migrates one relevant function from ironic_lib.utils.\n\nThe second is the fix for the security issue:\n\nInspect non-raw images for safety\n\nWhen IPA gets a non-raw image, it performs an on-the-fly conversion\nusing qemu-img convert, as well as running qemu-img frequently to get\nbasic information about the image before validating it.\n\nNow, we ensure that before any qemu-img calls are made, that we have\ninspected the image for safety and pass through the detected format.\n\nIf given a disk_format\u003draw image and image streaming is enabled\n(default), we retain the existing behavior of not inspecting it in\nany way and streaming it bit-perfect to the device. In this case, we\nnever use qemu-based tools on the image at all.\n\nIf given a disk_format\u003draw image and image streaming is disabled, this\nchange fixes a bug where the image may have been converted if it was not\nactually raw in the first place. We now stream these bit-perfect to the\ndevice.\n\nAdds two config options:\n- [DEFAULT]/disable_deep_image_inspection, which can be set to \"True\" in\n  order to disable all security features. Do not do this.\n- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types\n  IPA should accept.\n\nBoth of these configuration options are wired up to be set by the lookup\ndata returned by Ironic at lookup time.\n\nThis uses a image format inspection module imported from Nova; this\ninspector will eventually live in oslo.utils, at which point we\u0027ll\nmigrate our usage of the inspector to it.\n\nCloses-Bug: #2071740\nCo-Authored-By: Dmitry Tantsur \u003cdtantsur@protonmail.com\u003e\nChange-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/a5530c2eb8fc4570f9f4aee91f742e6945900e77"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/a5530c2eb8fc4570f9f4aee91f742e6945900e77"}]},"branch":"refs/heads/bugfix/9.9"},"37cf656469ce3cd19caa537a34648d21550d3120":{"kind":"TRIVIAL_REBASE","_number":5,"created":"2024-11-10 02:53:51.000000000","uploader":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"real_uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/84/927984/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic-python-agent","ref":"refs/changes/84/927984/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic-python-agent refs/changes/84/927984/5"}}},"commit":{"parents":[{"commit":"977046c1df83fb4ceead4b35e6ab6764666c03e4","subject":"Update .gitreview for bugfix/9.9","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/977046c1df83fb4ceead4b35e6ab6764666c03e4"}]}],"author":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2024-03-11 16:29:58.000000000","tz":60},"committer":{"name":"Steve Baker","email":"sbaker@redhat.com","date":"2024-11-10 02:53:51.000000000","tz":0},"subject":"Inspect non-raw images for safety","message":"Inspect non-raw images for safety\n\nThis is a backport of two changes merged together to facilitate\nbackporting:\n\nThe first is a refactor of disk utilities:\n\nImport disk_{utils,partitioner} from ironic-lib\n\nWith the iscsi deploy long gone, these modules are only used in IPA and\nin fact represent a large part of its critical logic. Having them\nseparately sometimes makes fixing issues tricky if an interface of\na function needs changing.\n\nThis change imports the code mostly as it is, just removing run_as_root and\na deprecated function, as well as moving configuration options to config.py.\n\nAlso migrates one relevant function from ironic_lib.utils.\n\nThe second is the fix for the security issue:\n\nInspect non-raw images for safety\n\nWhen IPA gets a non-raw image, it performs an on-the-fly conversion\nusing qemu-img convert, as well as running qemu-img frequently to get\nbasic information about the image before validating it.\n\nNow, we ensure that before any qemu-img calls are made, that we have\ninspected the image for safety and pass through the detected format.\n\nIf given a disk_format\u003draw image and image streaming is enabled\n(default), we retain the existing behavior of not inspecting it in\nany way and streaming it bit-perfect to the device. In this case, we\nnever use qemu-based tools on the image at all.\n\nIf given a disk_format\u003draw image and image streaming is disabled, this\nchange fixes a bug where the image may have been converted if it was not\nactually raw in the first place. We now stream these bit-perfect to the\ndevice.\n\nAdds two config options:\n- [DEFAULT]/disable_deep_image_inspection, which can be set to \"True\" in\n  order to disable all security features. Do not do this.\n- [DEFAULT]/permitted_image_formats, default raw,qcow2, for image types\n  IPA should accept.\n\nBoth of these configuration options are wired up to be set by the lookup\ndata returned by Ironic at lookup time.\n\nThis uses a image format inspection module imported from Nova; this\ninspector will eventually live in oslo.utils, at which point we\u0027ll\nmigrate our usage of the inspector to it.\n\nCloses-Bug: #2071740\nCo-Authored-By: Dmitry Tantsur \u003cdtantsur@protonmail.com\u003e\nChange-Id: I5254b80717cb5a7f9084e3eff32a00b968f987b7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/37cf656469ce3cd19caa537a34648d21550d3120"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/37cf656469ce3cd19caa537a34648d21550d3120"}]},"branch":"refs/heads/bugfix/9.9","description":"Rebase"}},"requirements":[],"submit_records":[],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Backport-Candidate","description":"Backport candidate status","status":"NOT_APPLICABLE","is_legacy":false,"applicability_expression_result":{"fulfilled":false,"status":"FAIL"},"submittability_expression_result":{"expression":"is:true","fulfilled":true,"status":"NOT_EVALUATED","passing_atoms":[],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}