)]}'
{"id":"openstack%2Fironic-python-agent~998375","triplet_id":"openstack%2Fironic-python-agent~master~I366aaac2f8be75c8b4bea51268180463baed0f54","project":"openstack/ironic-python-agent","branch":"master","attention_set":{"36770":{"account":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"last_update":"2026-07-30 16:38:06.000000000","reason":"\u003cGERRIT_ACCOUNT_10342\u003e replied on the change","reason_account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}}},"removed_from_attention_set":{},"hashtags":["ironic-week-prio"],"change_id":"I366aaac2f8be75c8b4bea51268180463baed0f54","subject":"security: Fix the container allowlist not being enforced","status":"NEW","created":"2026-07-22 23:28:51.000000000","updated":"2026-07-31 14:00:36.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":6,"unresolved_comment_count":5,"has_review_started":true,"meta_rev_id":"6324d31eb1d50c85b2e0c85330fa5cdccf3c2eee","_number":998375,"virtual_id_number":998375,"owner":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-07-23 00:32:54.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"recommended":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"all":[{"value":1,"date":"2026-07-30 16:38:06.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"value":1,"date":"2026-07-31 14:00:22.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Do Not Backport"," 0":"Backport Review Needed","+1":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"}],"REVIEWER":[{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-07-22 23:41:27.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-07-23 00:32:54.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-07-30 16:38:06.000000000","updated_by":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"reviewer":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"state":"REVIEWER"},{"updated":"2026-07-30 21:36:56.000000000","updated_by":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"reviewer":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"state":"CC"},{"updated":"2026-07-31 14:00:22.000000000","updated_by":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"reviewer":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"state":"REVIEWER"}],"messages":[{"id":"f17b2511710a43674b740aa1186a296e8b307b56","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"date":"2026-07-22 23:28:51.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"4ef2b58562d5fff219a2198d44cde32955de1e08","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-22 23:41:27.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c0025b9b4e0f4152854e3e705d546d6b\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/de9ac7d4df1442b681ae74b18fa9b501 : SUCCESS in 5m 47s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/002111dcc0c04de68c1746d4abe1c1b2 : SUCCESS in 6m 01s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/1378221375bc4f39b9bfabbc9d1775c5 : SUCCESS in 10m 05s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"ed30860126e61d2336fcbffb609757253f38b370","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-23 00:32:54.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/036bf2bff35c4fa5acc46910edc9b8d3\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/aee38268302b4508a0d0f89e86af32a5 : SUCCESS in 4m 14s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/6ad87647821d437aa028336799fefe28 : SUCCESS in 5m 15s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/2ef7f07342c6437ea07760ee3f0bb08c : SUCCESS in 4m 08s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/9d5787b271244ce6b5b1708e88c4409c : SUCCESS in 3m 50s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/11a1e5812fb2440497b9c927c0d64e46 : SUCCESS in 4m 49s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5bca763073d34c56be1833169a15e2ae : SUCCESS in 7m 40s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/b25b52b6ebf04051a3e3926779a6aaae : SUCCESS in 5m 18s\n- openstack-tox-functional https://zuul.opendev.org/t/openstack/build/672d412c99b54dbaa47a9e569fc741d1 : SUCCESS in 5m 23s\n- ipa-tox-bandit https://zuul.opendev.org/t/openstack/build/7f5bc2df3016498b8e0f7a71c94ed69e : SUCCESS in 2m 53s\n- ipa-tempest-bios-ipmi-direct-src https://zuul.opendev.org/t/openstack/build/285b2de4ad1e4f3d84c451e4d19655ea : SUCCESS in 1h 01m 55s\n- ipa-tempest-uefi-redfish-vmedia-src https://zuul.opendev.org/t/openstack/build/d6ed7fb7f89a4d1091c96427e3248f35 : SUCCESS in 52m 26s\n- ironic-standalone-ipa-src https://zuul.opendev.org/t/openstack/build/c7652934504744eca29d9402e35caf37 : SUCCESS in 57m 33s\n- ironic-python-agent-check-image-dib-centos9 https://zuul.opendev.org/t/openstack/build/851cf683b38849868c7426dacc529cd0 : SUCCESS in 10m 03s (non-voting)\n- ironic-python-agent-check-image-dib-centos10 https://zuul.opendev.org/t/openstack/build/2f7cdef0404945e68f75f705a85582a5 : SUCCESS in 9m 15s (non-voting)\n- ironic-python-agent-check-image-dib-debian https://zuul.opendev.org/t/openstack/build/eb0e93dcfb704292af4cd04d7cc1c8f8 : SUCCESS in 7m 10s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"b98316cda972f6c07a1078aa518e37d19809c36b","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-07-30 16:38:06.000000000","message":"Patch Set 1: Code-Review+1\n\n(3 comments)","accounts_in_message":[],"_revision_number":1},{"id":"233bfb4ce3983aa2e949eae0932f1f1e67c01680","author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"date":"2026-07-30 21:36:56.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"6257ccfe07d96e6bf0d82a089b0086bb08eb4c1d","author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"date":"2026-07-31 14:00:22.000000000","message":"Patch Set 1: Code-Review+1\n\n(2 comments)","accounts_in_message":[],"_revision_number":1},{"id":"6324d31eb1d50c85b2e0c85330fa5cdccf3c2eee","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"date":"2026-07-31 14:00:36.000000000","message":"Hashtag added: ironic-week-prio","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"55bc9e7cfafa83175539c68019862bcb63d96c5d","revisions":{"55bc9e7cfafa83175539c68019862bcb63d96c5d":{"kind":"REWORK","_number":1,"created":"2026-07-22 23:28:51.000000000","uploader":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"ref":"refs/changes/75/998375/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ironic-python-agent","ref":"refs/changes/75/998375/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/75/998375/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/75/998375/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ironic-python-agent refs/changes/75/998375/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ironic-python-agent refs/changes/75/998375/1"}}},"commit":{"parents":[{"commit":"9b002bde0d63d73d9338dd497ebafa0311b1a183","subject":"Move container execution into a single method","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/9b002bde0d63d73d9338dd497ebafa0311b1a183"}]}],"author":{"name":"Afonne-CID","email":"afonnepaulc@gmail.com","date":"2026-07-22 21:28:40.000000000","tz":60},"committer":{"name":"Afonne-CID","email":"afonnepaulc@gmail.com","date":"2026-07-22 23:28:26.000000000","tz":60},"subject":"security: Fix the container allowlist not being enforced","message":"security: Fix the container allowlist not being enforced\n\n[container]allow_arbitrary_containers and allowed_containers had no\neffect. A missing line continuation split the check into two\nstatements, so it tested a configuration group object which is always\ntrue, and the allowlist was never read. container_clean_step did not\nconsult the allowlist at all, so the runbook and deploy template path\nwas unguarded regardless.\n\nThe check now lives in _check_permitted(), which every execution path\npasses through, and takes into account where the step came from. Steps\nbaked into the ramdisk are written by the operator at build time and\nremain exempt. Steps naming an image in their arguments are checked.\n\npull_options and run_options given as step arguments are also ignored\nwhile the allowlist is in effect. Options alone are enough to get\naround it (--privileged, -v /:/host, --entrypoint), so a caller which\nmay not choose the image does not choose the flags either.\n\nCloses-Bug: #2160143\nAssisted-by: Claude Opus 4.8\nChange-Id: I366aaac2f8be75c8b4bea51268180463baed0f54\nSigned-off-by: Afonne-CID \u003cafonnepaulc@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/55bc9e7cfafa83175539c68019862bcb63d96c5d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ironic-python-agent/commit/55bc9e7cfafa83175539c68019862bcb63d96c5d"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"}},{"label":"Workflow","status":"MAY"},{"label":"Backport-Candidate","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Backport-Candidate","description":"Backport candidate status","status":"NOT_APPLICABLE","is_legacy":false,"applicability_expression_result":{"fulfilled":false,"status":"FAIL"},"submittability_expression_result":{"expression":"is:true","fulfilled":true,"status":"NOT_EVALUATED","passing_atoms":[],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}