)]}'
{"id":"openstack%2Fkeystone~1002323","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~I4dd5817d20394369cfadd20ccf476a0660760c52","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-31 21:26:11.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I4dd5817d20394369cfadd20ccf476a0660760c52","subject":"Ban ec2credential tokens from Keystone API","status":"MERGED","created":"2026-08-25 15:22:42.000000000","updated":"2026-08-31 21:28:05.000000000","submitted":"2026-08-31 21:26:11.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002323","cherry_pick_of_change":1002082,"cherry_pick_of_patch_set":3,"meta_rev_id":"bae781a2082faa1863b8cb624e4d796c5b148339","_number":1002323,"virtual_id_number":1002323,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-31 21:26:11.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-08-31 11:50:28.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-08-31 11:50:28.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"CC":[{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 15:22:42.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2026-08-25 17:45:46.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 11:50:28.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-08-31 17:16:36.000000000","updated_by":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"reviewer":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"state":"CC"}],"messages":[{"id":"f3d1610e7ea8a7818e82bf9ffc6bdef4040fc884","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:22:42.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2026.1.","accounts_in_message":[],"_revision_number":1},{"id":"0d2d8d9402ddf5b41038354bc6732826ad7ded7c","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 16:14:21.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"91b2cf0d2e1ee834bdc78373db617ce42493ed63","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 17:45:46.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/8c3c646035f741d8b29b0fca68358857\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bfad2d6e441045e58b64f9f698582c5c : FAILURE in 17m 00s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e46cfe8e16244523bcee51ea359c330e : FAILURE in 4m 44s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/758ee08492414e6f9f06170b13ae713f : FAILURE in 11m 39s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/34d69eb23017444c83c304d917643a03 : FAILURE in 13m 26s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0d51d323f26e4bfa8926712da239205d : SUCCESS in 15m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/08be5267c06f4d04b0dc58bf6c1c1dee : SUCCESS in 14m 15s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/b62fef4973f842e89e67d79370cebccf : SUCCESS in 36m 12s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/139490f094e242e6843d11d599c2b26f : FAILURE in 32m 17s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/1551880b992f4c11bb45d8da9309d353 : FAILURE in 20m 04s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/71a37f3e67894804be73268700e407fc : SUCCESS in 23m 17s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e3ed386f572548148cd6e104975ad54a : SUCCESS in 17m 38s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d104595874414477801a376d8c019df7 : SUCCESS in 38m 21s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/1647edd68015468bbd4c991462db42d4 : FAILURE in 8m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/deb2ae24d4064c3c97995e18a61f4ae7 : FAILURE in 57m 46s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/40811c82d29e49f9b6ce8e16d8ed1f64 : SUCCESS in 48m 10s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/fb28862c88f94a29bb500a7f9e048673 : SUCCESS in 20m 42s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-dsvm-py3-functional-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-dsvm-py3-functional-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_auth.py\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":2},{"id":"cd4fadb666860034caaed99aab529d46bbcb6c24","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:48:40.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"7b662f105a903851a8e12d5491682e98eb86ee50","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 00:23:02.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/73f71e3ca28542a78c9d8ee7bad45271\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/57d7d2509ccb488fbe8c720ab83bbc24 : SUCCESS in 18m 08s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c82e6b226cd94bbfa3dda212991fa766 : SUCCESS in 6m 58s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/185b20de5a4f459880ea8189f0498b82 : SUCCESS in 11m 31s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/de31fda9857e418586e33c29084c1b1d : SUCCESS in 12m 15s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3c5d77b2e1ad4140b89ed847cedf389e : SUCCESS in 13m 29s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9f6bcb01ff114d028931946ad3f2b9f4 : SUCCESS in 13m 29s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/f1adcafb1cac4ba0bc39a884e2edf5ad : SUCCESS in 29m 37s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/f7f34e660d96400e88c505c2e7f203ca : FAILURE in 22m 22s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/97d3588448744200a65209a2ef5728a3 : FAILURE in 23m 42s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/d8b013184b19446183e9f35f2ca2cf37 : SUCCESS in 28m 54s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/0e8e2bdb8bf842fe9f5cf0b151e0197d : SUCCESS in 12m 27s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/68845260904f4a5aaad01471480b8b31 : SUCCESS in 34m 38s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b33fa5c17fa546aa8cab797fa91cb5a6 : SUCCESS in 1h 26m 30s\n- grenade https://zuul.opendev.org/t/openstack/build/bb8664d046834b0590336e787120e76b : FAILURE in 53m 40s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/dd3f55c075d14c4491b105d4ee9d34cf : SUCCESS in 34m 17s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/c515f523d9324dd4baa3401530050806 : SUCCESS in 31m 04s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-dsvm-py3-functional-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-dsvm-py3-functional-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"4ed3972db2112a71745bfb75bbf9184c7cc0831c","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 11:50:28.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"632c7401709baaab4aff0ca45fdae343560fb92d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 11:51:00.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"df9acb21861dbeb4503d47520a976b1f0a632593","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 15:33:30.000000000","message":"Patch Set 3: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/e70ddf2ae25248e0b39604ef1d50534c\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fd1c486fcbc84f7f9af6aede7d3dd74b : SUCCESS in 8m 57s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/47412f7812cf480e99e789c1c0fb89f3 : SUCCESS in 17m 30s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/6d9752864ce84094862c0cad086210ce : POST_FAILURE in 13m 14s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0d87672fdb9041f6b497b0561d370fc6 : POST_FAILURE in 17m 36s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/062830294207413b8f208c5a4d5b6704 : SUCCESS in 8m 38s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/71043e50769b4494b00aa6a868b02816 : SUCCESS in 31m 40s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/76f005ad8f2a41879e5cebd4d1314575 : SUCCESS in 1h 49m 23s\n- grenade https://zuul.opendev.org/t/openstack/build/3fc095b2ffe74f9d834400dfcbe09f61 : FAILURE in 20m 03s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/260eef8536ab43ea8bfe11d7c3523312 : SUCCESS in 56m 00s\n\nWarning:\n  File .ansible/tmp/ansible-tmp-1788183388.8818457-146-199634344830124/AnsiballZ_command.py found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job openstack-tox-py39.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ansible/tmp/ansible-tmp-1788183388.8818457-146-199634344830124/AnsiballZ_command.py found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job openstack-tox-py39.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ansible/tmp/ansible-tmp-1788183388.8818457-146-199634344830124/AnsiballZ_command.py found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job openstack-tox-py39.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"1220197d6ee2da4638864e36ddc846e3f499ad12","author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"date":"2026-08-31 17:16:36.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"a3c755cbae8beb1ea7be30ce58787941065d7bdf","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 19:22:23.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ab6a7e5fe9a34ec58bae3414576db9aa\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/2727a65ef02248f0b92e9fef4d5e0dd1 : SUCCESS in 19m 18s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d6a80edb14d94311a0a4e624059c157f : SUCCESS in 7m 19s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/37b76b1a17fd4f63b0a40fb496303525 : SUCCESS in 14m 03s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/93d3b42eca194c2ea3828f0f621555f6 : SUCCESS in 12m 47s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/08922978b4624080be08a71008108f8f : SUCCESS in 16m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/373003e26fd643c1a7097a4dc85438f7 : SUCCESS in 14m 47s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/0141dd545ebb4ba5b013fa69850ecf6f : SUCCESS in 22m 16s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/2bec50ee5e7b494aa6b120dcd5c8b85a : FAILURE in 39m 01s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/4ee905642de1457283cc1342348198ef : FAILURE in 26m 34s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/2e1f1f1d933649d8911e979d44d38512 : SUCCESS in 29m 16s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/a8c7124c956c4d8183dad8f3c40d8f7c : SUCCESS in 21m 28s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/ddcf76dfc9ef4c1f81d09920a7378e90 : SUCCESS in 45m 17s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7fa31ca994f941e1a8bc67b7b402aba8 : SUCCESS in 1h 57m 00s\n- grenade https://zuul.opendev.org/t/openstack/build/8b67af3e77864cc4bc582ec19a9008f6 : FAILURE in 51m 51s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/cb26e6c568574ec0b465e1eb30bce263 : SUCCESS in 1h 03m 07s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/9fcff795293a4014ae9b812e71ae84d9 : SUCCESS in 34m 26s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-dsvm-py3-functional-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-dsvm-py3-functional-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"858736555d9d7a284b701e44c0f7f2f2b253fdc4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 19:23:02.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"2a0adccef986fb089e742ea95d4f5c060043218e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 21:26:11.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/35e2651479d748aabcf584e3f07f2cde\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/dd80aacc9662424aa552751b58d5d9cb : SUCCESS in 7m 22s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/3d14ac4aa871453491bf7e118903ede4 : SUCCESS in 11m 46s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/f031f7d5de9f40bcbf2ff87b57476e49 : SUCCESS in 12m 29s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b9454443b9a341d9b7e6a5cef123d8ef : SUCCESS in 6m 48s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/40f1a396004b431f915255be3a2faf66 : SUCCESS in 10m 02s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/2d5140d0466a4500a67b41d1640a75bf : SUCCESS in 29m 37s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/197c4b9f35894ef6b2966dd15b96b945 : SUCCESS in 1h 36m 21s\n- grenade https://zuul.opendev.org/t/openstack/build/78ddfba537bd4a0385ec316d2290db1c : FAILURE in 48m 33s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ef6ce3e80c5a4b1fa39ac0ac82a31397 : SUCCESS in 58m 24s","accounts_in_message":[],"_revision_number":3},{"id":"c668ed6a88600d98e718b87928e5410502eea385","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 21:26:11.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"bae781a2082faa1863b8cb624e4d796c5b148339","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 21:28:05.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6a4b41ca816d4802a4cd0567df8aa540\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9a055775e002425b832a2838bcdabf1f : SUCCESS in 56s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d37a4ac6340647bf8020dd731456b6ca : SUCCESS in 46s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"9297efeb7ed0cc82ce67418b697e9645492f94d8","revisions":{"205ba87e85f3813d29275351c7ff6718bf09d643":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:22:42.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/23/1002323/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/23/1002323/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/23/1002323/1"}}},"commit":{"parents":[{"commit":"8b5cf08d5516380325e371cb0cdfb9b38e75a9b0","subject":"Merge \"Block app credential token rescoping\" into stable/2025.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8b5cf08d5516380325e371cb0cdfb9b38e75a9b0"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:22:42.000000000","tz":0},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/205ba87e85f3813d29275351c7ff6718bf09d643"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/205ba87e85f3813d29275351c7ff6718bf09d643"}]},"branch":"refs/heads/stable/2025.1","conflicts":{"base":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","ours":"8b5cf08d5516380325e371cb0cdfb9b38e75a9b0","theirs":"050ff690849c88a7a24ca7d858be43696e7d5c2f","merge_strategy":"recursive","contains_conflicts":false}},"6cdd2fdfe4e011e946e4297603aaf3cbfdadb704":{"kind":"REWORK","_number":2,"created":"2026-08-25 16:14:21.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/23/1002323/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/23/1002323/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/23/1002323/2"}}},"commit":{"parents":[{"commit":"645e01796946d5858fafb7cacbc12e6222166c8d","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/645e01796946d5858fafb7cacbc12e6222166c8d"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 16:09:43.000000000","tz":120},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6cdd2fdfe4e011e946e4297603aaf3cbfdadb704"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6cdd2fdfe4e011e946e4297603aaf3cbfdadb704"}]},"branch":"refs/heads/stable/2025.1"},"9297efeb7ed0cc82ce67418b697e9645492f94d8":{"kind":"REWORK","_number":3,"created":"2026-08-25 22:48:40.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/23/1002323/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/23/1002323/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/23/1002323/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/23/1002323/3"}}},"commit":{"parents":[{"commit":"f2761bb60a7e48510ab22c4865d9601345422ce9","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f2761bb60a7e48510ab22c4865d9601345422ce9"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:45:39.000000000","tz":120},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9297efeb7ed0cc82ce67418b697e9645492f94d8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9297efeb7ed0cc82ce67418b697e9645492f94d8"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}