)]}'
{"id":"openstack%2Fkeystone~987478","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I795bfb7c5dad8949c9879e06ae36784f7856deb8","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-05-07 09:11:13.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},"37598":{"account":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"last_update":"2026-05-07 11:32:08.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I795bfb7c5dad8949c9879e06ae36784f7856deb8","subject":"Include system scope in rescope guard","status":"MERGED","created":"2026-05-06 10:54:25.000000000","updated":"2026-05-07 11:34:08.000000000","submitted":"2026-05-07 11:32:08.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987478","cherry_pick_of_change":986499,"cherry_pick_of_patch_set":1,"meta_rev_id":"576b348084db95ddec822edb939834f11e54ae04","_number":987478,"virtual_id_number":987478,"owner":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-07 11:32:08.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-05-07 09:11:13.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-05-07 09:11:13.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"}],"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-06 10:54:25.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"state":"CC"},{"updated":"2026-05-06 12:46:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-06 14:46:29.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"6f6bd3c3bee8084ab0c03fb66b2b1ecac9af2365","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2026-05-06 10:54:25.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2026.1.","accounts_in_message":[],"_revision_number":1},{"id":"f6f78e96ba7851a5b8767a5985ad6c6bcfb0bfaa","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2026-05-06 10:54:48.000000000","message":"Patch Set 2: Patch Set 1 was rebased","accounts_in_message":[],"_revision_number":2},{"id":"8554a1f6359b919305e28785d0ca30ae85f9e620","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-06 12:46:09.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a57f9e5923284aa7acb52468c2c46b85\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f2935a22dd384499a29688e15ec8d439 : SUCCESS in 11m 10s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9a7f7a93afd147e29b1dfc0e19928814 : SUCCESS in 7m 14s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/5a87d4775c8a4b58b52dd0b940e74f31 : SUCCESS in 9m 50s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/351e9ff5e4514894b1054dd3e0e3e109 : SUCCESS in 8m 14s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/dc5fb6842f3040e2965fa0eb43a53372 : SUCCESS in 18m 32s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4831c930337245d6b808b81f01742416 : SUCCESS in 9m 33s\n- grenade https://zuul.opendev.org/t/openstack/build/803c0544562f494aa73d3b1bf1f9d550 : SUCCESS in 39m 06s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9177b6bb29194722ab47b4a516edcc9f : SUCCESS in 1h 40m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/4737ab8f35d1429c9ae20c1349b1fc9a : SUCCESS in 11m 35s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e67f3eebf54d4edf92dab0fbb72d11f7 : SUCCESS in 30m 09s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/d2b7ce09c14f4e639366f77e3da3fef2 : FAILURE in 12m 16s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/af4bd8d0e8914b1f88f808121f4c8245 : FAILURE in 23m 40s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/07aee741603e4afdb1143a7ccdcfe2b4 : SUCCESS in 30m 29s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/6895b77076944d2b9ea3ac9e4039ef4e : SUCCESS in 33m 01s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/98a3bb84183a4b819aca72a143d57e9c : SUCCESS in 37m 16s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/bbd0df59eb7c4f769fe32166b4316342 : SUCCESS in 1h 06m 26s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/ce91deee882c4100bab1a815ec07248d : FAILURE in 40m 23s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/6eca720a66694b618b7f7f62b54fb7ec : FAILURE in 8m 33s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"05b3b213023d449a541fd827037e1db16a47decc","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-07 09:11:13.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"7fb1a04a428aede73e513fadac293b7ca5f3f15c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 09:11:41.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"f08d6b19cf0c87c2c6a660e656138f6e06317ee8","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 11:32:08.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d16a7f1efcfa4d2392d34445cbbad230\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f935d112c0674de8a0f2cfc5d6a75610 : SUCCESS in 3m 16s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/9db819a42ba24ff0846053ddacd903eb : SUCCESS in 11m 20s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c25dc56e2c7347c9baf66fd594e78e53 : SUCCESS in 11m 38s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b4c901374c2a4502a2f437344fa7bd35 : SUCCESS in 13m 22s\n- grenade https://zuul.opendev.org/t/openstack/build/3799bc06e99e4563aacae2a5478509bb : SUCCESS in 1h 05m 03s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d4c7f34019e044b88591d19dda87ea32 : SUCCESS in 1h 35m 47s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e56902d832fc4333a108680b8401c918 : SUCCESS in 30m 03s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/e1045a1e636a4d6494e1b54f78efd278 : SUCCESS in 19m 33s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9937fe6c49b44d79a26eeeddcb32ec64 : SUCCESS in 1h 00m 06s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/1737c067eaf547918351660d872c6e22 : FAILURE in 41m 03s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"8ab83d7581dae705fd0529f1773f4157463270e8","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 11:32:08.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"576b348084db95ddec822edb939834f11e54ae04","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 11:34:08.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1355f11c50bb43f9b8b8fcf0faf89892\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/86b90a749e7842b4ac08f2dfd26a737f : SUCCESS in 53s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"549a704284269f6bc78367814a172deacf832be1","revisions":{"2db175b7e0ccddc66d0b13f8971f566f1202e001":{"kind":"REWORK","_number":1,"created":"2026-05-06 10:54:25.000000000","uploader":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"ref":"refs/changes/78/987478/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/78/987478/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/78/987478/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/78/987478/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/78/987478/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/78/987478/1"}}},"commit":{"parents":[{"commit":"3f87f91495d25a14b4ef3a82dc6c9a0cf71f2877","subject":"Block app cred tokens from authorizing OAuth1 requests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3f87f91495d25a14b4ef3a82dc6c9a0cf71f2877"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-03-25 21:53:32.000000000","tz":60},"committer":{"name":"Ivan Anfimov","email":"lazekteam@gmail.com","date":"2026-05-06 10:54:25.000000000","tz":0},"subject":"Include system scope in rescope guard","message":"Include system scope in rescope guard\n\nThe allow_rescope_scoped_token\u003dFalse configuration option is\nmeant to prevent any scoped token from being used to create\nanother token. The check only covered project-scoped and\ndomain-scoped tokens but not system-scoped tokens, allowing\na system-scoped token to be rescoped despite the setting.\n\nGenerated-By: claude-opus-4-6 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I795bfb7c5dad8949c9879e06ae36784f7856deb8\n(cherry picked from commit bcc8e819a8611e2f5a8bc1a61cfa792269106c1a)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2db175b7e0ccddc66d0b13f8971f566f1202e001"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2db175b7e0ccddc66d0b13f8971f566f1202e001"}]},"branch":"refs/heads/stable/2025.2","conflicts":{"ours":"3f87f91495d25a14b4ef3a82dc6c9a0cf71f2877","theirs":"60fdde686f006b02a51656c596a3ce505a9292a5","contains_conflicts":false}},"549a704284269f6bc78367814a172deacf832be1":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-06 10:54:48.000000000","uploader":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"ref":"refs/changes/78/987478/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/78/987478/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/78/987478/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/78/987478/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/78/987478/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/78/987478/2"}}},"commit":{"parents":[{"commit":"50436db57373f92bfe0d30ae967e4dcc3d4e2613","subject":"Block app credential token rescoping","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/50436db57373f92bfe0d30ae967e4dcc3d4e2613"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-03-25 21:53:32.000000000","tz":60},"committer":{"name":"Ivan Anfimov","email":"lazekteam@gmail.com","date":"2026-05-06 10:54:48.000000000","tz":0},"subject":"Include system scope in rescope guard","message":"Include system scope in rescope guard\n\nThe allow_rescope_scoped_token\u003dFalse configuration option is\nmeant to prevent any scoped token from being used to create\nanother token. The check only covered project-scoped and\ndomain-scoped tokens but not system-scoped tokens, allowing\na system-scoped token to be rescoped despite the setting.\n\nGenerated-By: claude-opus-4-6 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I795bfb7c5dad8949c9879e06ae36784f7856deb8\n(cherry picked from commit bcc8e819a8611e2f5a8bc1a61cfa792269106c1a)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/549a704284269f6bc78367814a172deacf832be1"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/549a704284269f6bc78367814a172deacf832be1"}]},"branch":"refs/heads/stable/2025.2","description":"Rebase","conflicts":{"ours":"2db175b7e0ccddc66d0b13f8971f566f1202e001","theirs":"50436db57373f92bfe0d30ae967e4dcc3d4e2613","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}