)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f67e6e1cd73276496074bac029b1fdf81d1ce0ea","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     Julia Kreger \u003cjuliaashleykreger@gmail.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2025-12-02 10:16:31 -0800"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add an option to fallback to HTTP"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"While working on trying to get OCI support in CI, I realized that the"},{"line_number":10,"context_line":"default pattern setup with Bifrost was to setup a registry *without*"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"0170b1a1_7b7f6a03","line":7,"updated":"2025-12-03 15:57:19.000000000","message":"self nit: Add OCI:","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"3ca9111dde2baaee22c4f48cc6cef5645ccd2eb9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"bc24dc3b_0d68ace6","updated":"2025-12-18 15:03:02.000000000","message":"Doug\u0027s time window passed a couple days ago. Workflowing.","commit_id":"595258da9f4e09dd8dbdbae5308a441a51c5cb2e"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"a8c615b9a5c1b8b841c6673da33ad9af56042f9b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"512c95fb_064cf575","updated":"2025-12-16 02:17:32.000000000","message":"I’ll wait to +W until tomorrow for @dtantsur@protonmail.com","commit_id":"595258da9f4e09dd8dbdbae5308a441a51c5cb2e"}],"ironic/common/oci_registry.py":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"839467f37d5769594dd6e8937233a3335b833037","unresolved":false,"context_lines":[{"line_number":397,"context_line":"        try:"},{"line_number":398,"context_line":"            r \u003d self.session.get(url,"},{"line_number":399,"context_line":"                                 timeout\u003dCONF.webserver_connection_timeout)"},{"line_number":400,"context_line":"        except requests.exceptions.SSLError:"},{"line_number":401,"context_line":"            if CONF.oci.permit_fallback_to_http_transport:"},{"line_number":402,"context_line":"                url \u003d self._build_url(parsed_url, path\u003d\u0027/\u0027, scheme\u003d\u0027http\u0027)"},{"line_number":403,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":2,"id":"438b818c_5b841157","line":400,"updated":"2025-12-06 17:36:23.000000000","message":"Let\u0027s at least log this error. The situation I\u0027m worried about is getting a valid TLS error (certificate expired, self-signed) and shadowing error by a non-sensual error from trying to talk HTTP to an HTTPS endpoint.","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"d0e3753f6cfe3c90ea556dd5ad317976656639a4","unresolved":false,"context_lines":[{"line_number":397,"context_line":"        try:"},{"line_number":398,"context_line":"            r \u003d self.session.get(url,"},{"line_number":399,"context_line":"                                 timeout\u003dCONF.webserver_connection_timeout)"},{"line_number":400,"context_line":"        except requests.exceptions.SSLError:"},{"line_number":401,"context_line":"            if CONF.oci.permit_fallback_to_http_transport:"},{"line_number":402,"context_line":"                url \u003d self._build_url(parsed_url, path\u003d\u0027/\u0027, scheme\u003d\u0027http\u0027)"},{"line_number":403,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":2,"id":"82097b9b_88f9e530","line":400,"in_reply_to":"438b818c_5b841157","updated":"2025-12-15 21:14:46.000000000","message":"That is a really good point. I\u0027m going down the path of in the conditional, if we fallback to capture the error that way and highlight the fallback as well. Otherwise an error occuring, say on line 406 already gets logged out.","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"839467f37d5769594dd6e8937233a3335b833037","unresolved":false,"context_lines":[{"line_number":403,"context_line":"            else:"},{"line_number":404,"context_line":"                raise"},{"line_number":405,"context_line":"            # Retry without https if permitted by configuration."},{"line_number":406,"context_line":"            r \u003d self.session.get(url,"},{"line_number":407,"context_line":"                                 timeout\u003dCONF.webserver_connection_timeout)"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"        LOG.debug(\u0027%s status code %s\u0027, url, r.status_code)"}],"source_content_type":"text/x-python","patch_set":2,"id":"c57f26b4_eae5871d","line":406,"updated":"2025-12-06 17:36:23.000000000","message":"I wonder which exception is raised on talking HTTP to an HTTPS server (cannot check right now). Maybe we can catch that and raise the initial exception instead?","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"d0e3753f6cfe3c90ea556dd5ad317976656639a4","unresolved":false,"context_lines":[{"line_number":403,"context_line":"            else:"},{"line_number":404,"context_line":"                raise"},{"line_number":405,"context_line":"            # Retry without https if permitted by configuration."},{"line_number":406,"context_line":"            r \u003d self.session.get(url,"},{"line_number":407,"context_line":"                                 timeout\u003dCONF.webserver_connection_timeout)"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"        LOG.debug(\u0027%s status code %s\u0027, url, r.status_code)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1baf0e2d_49381afb","line":406,"in_reply_to":"c57f26b4_eae5871d","updated":"2025-12-15 21:14:46.000000000","message":"Looks like it would be ProtocolError or RequestError. I\u0027m not sure catching again would make any sense at that point, since we\u0027re only retrying at that point after another likely failure.\n\nI guess what is weird here is if we\u0027re trying to fallback to using HTTP because we\u0027ve been configured to do so, and then find HTTPS (or a redirect under the hood), then the exception might actually be correct to still raise because if, for example, its an expired or untrusted SSL certificate signer, then we try HTTP and get a redirect back to HTTP, logging as noted above makes sense. But then we can\u0027t proceed due to a different error.","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"839467f37d5769594dd6e8937233a3335b833037","unresolved":false,"context_lines":[{"line_number":557,"context_line":"                    headers\u003dmanifest_headers,"},{"line_number":558,"context_line":"                    timeout\u003dCONF.webserver_connection_timeout"},{"line_number":559,"context_line":"                )"},{"line_number":560,"context_line":"            except requests.exceptions.SSLError:"},{"line_number":561,"context_line":"                if CONF.oci.permit_fallback_to_http_transport:"},{"line_number":562,"context_line":"                    manifest_url \u003d self._build_url("},{"line_number":563,"context_line":"                        image_url,"}],"source_content_type":"text/x-python","patch_set":2,"id":"c471bca0_250e6835","line":560,"updated":"2025-12-06 17:36:23.000000000","message":"Same comments here","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"839467f37d5769594dd6e8937233a3335b833037","unresolved":false,"context_lines":[{"line_number":609,"context_line":"                    headers\u003dindex_headers,"},{"line_number":610,"context_line":"                    timeout\u003dCONF.webserver_connection_timeout"},{"line_number":611,"context_line":"                )"},{"line_number":612,"context_line":"            except requests.exceptions.SSLError:"},{"line_number":613,"context_line":"                if CONF.oci.permit_fallback_to_http_transport:"},{"line_number":614,"context_line":"                    index_url \u003d self._build_url("},{"line_number":615,"context_line":"                        image_url, CALL_MANIFEST % parts, scheme\u003d\u0027http\u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"963c411e_f3eba64a","line":612,"updated":"2025-12-06 17:36:23.000000000","message":"and here","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"839467f37d5769594dd6e8937233a3335b833037","unresolved":false,"context_lines":[{"line_number":691,"context_line":"                        self.session, next_url,"},{"line_number":692,"context_line":"                        headers\u003dtag_headers,"},{"line_number":693,"context_line":"                        timeout\u003dCONF.webserver_connection_timeout)"},{"line_number":694,"context_line":"                except requests.exceptions.SSLError:"},{"line_number":695,"context_line":"                    if CONF.oci.permit_fallback_to_http_transport:"},{"line_number":696,"context_line":"                        # Replace https with http in the next_url"},{"line_number":697,"context_line":"                        next_url \u003d next_url.replace(\u0027https://\u0027, \u0027http://\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"bbe65468_e6f0e466","line":694,"updated":"2025-12-06 17:36:23.000000000","message":"and here","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"}],"ironic/conf/oci.py":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"839467f37d5769594dd6e8937233a3335b833037","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    cfg.BoolOpt(\u0027permit_fallback_to_http_transport\u0027,"},{"line_number":59,"context_line":"                default\u003dFalse,"},{"line_number":60,"context_line":"                mutable\u003dFalse,"},{"line_number":61,"context_line":"                help\u003d_(\u0027Security-Insecure: The OCI client code expects all \u0027"},{"line_number":62,"context_line":"                       \u0027OCI registry interactions to take place utilizing \u0027"},{"line_number":63,"context_line":"                       \u0027HTTPS as the underlying transport mechanism to \u0027"},{"line_number":64,"context_line":"                       \u0027communicate with the remote registry. In reality, \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"b458c577_8c2de66e","line":61,"updated":"2025-12-06 17:36:23.000000000","message":"nit: \"By default, the OCI client ...\"","commit_id":"744a33ea0c42e6cc912ee7cf40e45dc5b6f79e31"}]}