)]}'
{"id":"openstack%2Fkeystone~961585","triplet_id":"openstack%2Fkeystone~master~I1a0ecd80a44eae6032e985091032aa91ee5c81a5","project":"openstack/keystone","branch":"master","topic":"use-secrets-library-in-oauth1-sql-backend","attention_set":{},"removed_from_attention_set":{"35986":{"account":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"last_update":"2025-09-19 16:33:26.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I1a0ecd80a44eae6032e985091032aa91ee5c81a5","subject":"Replace the random library with secrets in oauth1","status":"MERGED","created":"2025-09-18 05:00:20.000000000","updated":"2025-09-19 16:34:24.000000000","submitted":"2025-09-19 16:33:26.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"961585-use-secrets-library-in-oauth1-sql-backend","meta_rev_id":"634b87ae4fecd370fc297588ff306bd7ff20464b","_number":961585,"virtual_id_number":961585,"owner":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2025-09-19 16:33:26.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"all":[{"value":2,"date":"2025-09-19 14:10:48.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":2,"date":"2025-09-18 16:23:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"all":[{"value":1,"date":"2025-09-19 14:10:48.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-09-18 05:50:46.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2025-09-18 06:43:29.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2025-09-18 16:23:17.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2025-09-19 14:10:48.000000000","updated_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"}],"messages":[{"id":"893affc126f132c4418823d3224575ccc87a2dac","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"date":"2025-09-18 05:00:20.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"9937d326b7dd4606f72b16f1ba9d6212c629c4cd","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"date":"2025-09-18 05:02:20.000000000","message":"Uploaded patch set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"85086fdff94309066916f4ea3bee60257072c09e","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-09-18 05:50:46.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c37a8e59d0584a5d862d3b2f9964445a\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/a337e555ad124bdf983a40f3cd4d56ef : SUCCESS in 21m 45s (non-voting)\n- openstack-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/bd13563f43f14f2bae0e939ac6b74be7 : SUCCESS in 35m 19s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/4e1c3f525e4044bc94452c495229606f : SUCCESS in 41m 32s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"bb740ec0ce7697b8a24dc865e75fbea3a2157bb0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-09-18 06:43:29.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/96c34bb6815b47aba2146f7edab77a06\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/5f3bf0abcf384abca6ecea436eccf524 : SUCCESS in 10m 18s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/8058681ba0f8496d8ccc1deb0125c626 : SUCCESS in 5m 01s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/3e20b411ed9349738a17b1b43493af19 : SUCCESS in 9m 32s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/fb185e9fb9a04417abcdffb2d8180178 : SUCCESS in 9m 39s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/b53bf93a0bbf4c91bc8e31878f419f51 : SUCCESS in 15m 01s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/07ccd17dc4744845aa4e8227a9cc6179 : SUCCESS in 10m 53s\n- grenade https://zuul.opendev.org/t/openstack/build/c3a3c5b17db441f8a29a3993eae93a61 : SUCCESS in 57m 39s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/fb7d111f8b3742a4909a997234eb624a : SUCCESS in 1h 36m 24s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/73403c6c911f48c699e402d14401190e : SUCCESS in 16m 59s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/cfc0c1b5f721489eaf8ce4f0c205cd79 : SUCCESS in 28m 55s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/f6c3e21bc3954cfbb1b7728efd24a45d : FAILURE in 24m 10s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/4a97a0a4e9b14ffab9d329c10ef4b986 : FAILURE in 15m 32s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/b6978c03cbe248bb9ec9c0f116171c9d : SUCCESS in 25m 20s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b837f92d76af41549bab49e653b79578 : SUCCESS in 19m 03s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/2387d2942e1940c5a27120e142e07b56 : SUCCESS in 37m 18s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/124464bff9c34ddea1f98304c4f88b87 : SUCCESS in 36m 25s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/2bc4b66471a24e6eb8bde547f759db0e : FAILURE in 38m 26s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f2e0a3362a3d402181cae51f9d1b9956 : SUCCESS in 5m 53s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"1fd5999d59740dd4b1536f18dcb20dc9deadd8f6","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2025-09-18 16:23:17.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"03dccede53eac23374a027d6c2027c2676f1cce3","author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"date":"2025-09-19 14:10:48.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"c949eaf2292c7864f1def5be55980ffa17b5ba94","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-09-19 14:11:23.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"2244b6b1ff070f0d93da4b82488d3231a39d36cc","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-09-19 16:33:26.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c54cf5e417ea4757a59dfdbc4840ffeb\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cd7c247581614aeaa98698afe4c87457 : SUCCESS in 4m 19s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/ae30f6236e7342c0bcf3487b171cf29b : SUCCESS in 11m 18s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/226f4698d788469598d26fc714f9656e : SUCCESS in 8m 53s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5a24672ac11a4b268165a5e7c49ad1d7 : SUCCESS in 12m 47s\n- grenade https://zuul.opendev.org/t/openstack/build/1739618564ed49b69a05adfd35f18f80 : SUCCESS in 31m 45s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2b1b6b4e680f4242a7cac55fa5bb38ca : SUCCESS in 2h 15m 03s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/15c3016971214306b0e8535a70da1da0 : SUCCESS in 26m 37s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/2ff1d94b677b4eceb42d8fc37ea00119 : SUCCESS in 11m 34s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/96bb0eb30aa74b85a93f94c5916f1acb : SUCCESS in 43m 57s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/ddb3eed334e84bacbf7e6315aac4254b : FAILURE in 41m 36s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"a084b28b337cc6fc5b6619aab2ca1c19f5c3791a","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-09-19 16:33:26.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"634b87ae4fecd370fc297588ff306bd7ff20464b","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-09-19 16:34:24.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/81dde38b7f0940eda10fa8614b9b8d34\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7c9ce49e3c8647a688756759c988a0e2 : SUCCESS in 47s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"420503a3731fec618e4e8a83415e8ec416ca35da","revisions":{"552081a905d3a8cb3d934582507c5d55cfb8c0e2":{"kind":"REWORK","_number":1,"created":"2025-09-18 05:00:20.000000000","uploader":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"ref":"refs/changes/85/961585/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/85/961585/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/85/961585/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/85/961585/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/85/961585/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/85/961585/1"}}},"commit":{"parents":[{"commit":"a568938e0c967a56ade269c93f42718008487b14","subject":"Merge \"Fix AD nested groups issues\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a568938e0c967a56ade269c93f42718008487b14"}]}],"author":{"name":"Adrian Jarvis","email":"adrian.jarvis@catalystcloud.nz","date":"2025-09-18 04:39:16.000000000","tz":720},"committer":{"name":"Adrian Jarvis","email":"adrian.jarvis@catalystcloud.nz","date":"2025-09-18 04:58:49.000000000","tz":720},"subject":"Replace the random library with secrets in oauth1","message":"Replace the random library with secrets in oauth1\n\nThe module keystone.oauth1.backends.sql was using the random library to\ngenerate the verifier of a request token.  The bandit security scanner tool\nfrom version 1.8.4 onwards identifies the use random.sample as a low security\nissue, despite random actually being an alias to random.SystemRandom(). This\nchange replaces the use of random library with the secrets library and avoids\nthe use of shadowing random.\n\nChange-Id: I1a0ecd80a44eae6032e985091032aa91ee5c81a5\nSigned-off-by: Adrian Jarvis \u003cadrian.jarvis@catalystcloud.nz\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/552081a905d3a8cb3d934582507c5d55cfb8c0e2"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/552081a905d3a8cb3d934582507c5d55cfb8c0e2"}]},"branch":"refs/heads/master"},"420503a3731fec618e4e8a83415e8ec416ca35da":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2025-09-18 05:02:20.000000000","uploader":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"ref":"refs/changes/85/961585/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/85/961585/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/85/961585/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/85/961585/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/85/961585/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/85/961585/2"}}},"commit":{"parents":[{"commit":"a568938e0c967a56ade269c93f42718008487b14","subject":"Merge \"Fix AD nested groups issues\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a568938e0c967a56ade269c93f42718008487b14"}]}],"author":{"name":"Adrian Jarvis","email":"adrian.jarvis@catalystcloud.nz","date":"2025-09-18 04:39:16.000000000","tz":720},"committer":{"name":"Adrian Jarvis","email":"adrian.jarvis@catalystcloud.nz","date":"2025-09-18 05:01:23.000000000","tz":720},"subject":"Replace the random library with secrets in oauth1","message":"Replace the random library with secrets in oauth1\n\nThe module keystone.oauth1.backends.sql was using the random library to\ngenerate the verifier of a request token.  The bandit security scanner\ntool from version 1.8.4 onwards identifies the use random.sample as a\nlow security issue, despite random actually being an alias to\nrandom.SystemRandom(). This change replaces the use of random library\nwith the secrets library and avoids the use of shadowing random.\n\nChange-Id: I1a0ecd80a44eae6032e985091032aa91ee5c81a5\nSigned-off-by: Adrian Jarvis \u003cadrian.jarvis@catalystcloud.nz\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/420503a3731fec618e4e8a83415e8ec416ca35da"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/420503a3731fec618e4e8a83415e8ec416ca35da"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}