)]}'
{"id":"openstack%2Fkeystone~990488","triplet_id":"openstack%2Fkeystone~master~I0bbb8520e12c52edd01fb47c873f0227819706f5","project":"openstack/keystone","branch":"master","topic":"review/990488","attention_set":{},"removed_from_attention_set":{"7973":{"account":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"last_update":"2026-06-01 11:08:18.000000000","reason":"Change was submitted"},"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-06-01 11:08:18.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-01 08:55:24.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-01 11:08:18.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-44394"],"change_id":"I0bbb8520e12c52edd01fb47c873f0227819706f5","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","status":"MERGED","created":"2026-05-28 15:05:16.000000000","updated":"2026-06-01 11:08:18.000000000","submitted":"2026-06-01 11:08:18.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990488-review/990488","meta_rev_id":"6e045349f0ad5f742c02cf951c0f6dbb5fc3ca22","_number":990488,"virtual_id_number":990488,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-01 11:08:18.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-01 08:55:24.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2026-05-29 12:38:18.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-01 08:55:24.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}],"reviewers":{"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}],"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:05:16.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:02:40.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"CC"},{"updated":"2026-05-28 17:52:59.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-28 19:41:49.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 20:07:12.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"},{"updated":"2026-05-28 20:07:12.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-05-29 10:00:24.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"5b4ad99adabdf3da1e7f1e4f2187a5cc805d2a8b","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:05:16.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"e04c7dc3c812ca148726579738ea584a659c383a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 16:02:40.000000000","message":"Uploaded patch set 2: New patch set was added with same tree, parent tree, and commit message as Patch Set 1.","accounts_in_message":[],"_revision_number":2},{"id":"82be168428e473ea6b4b6b3dfa0a64e27495a5cb","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:52:59.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/9e79c2a54e074faaabb4956a73473a79\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/76757dd70055436f990ea74a1e72d552 : SUCCESS in 15m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/08fb7d6ba3e34a8dbf0d6cbd63ab1d88 : FAILURE in 4m 14s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/1231bcbf6e14401cbf391637d7b44888 : SUCCESS in 11m 49s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/eaa655059156467e9f7d94eb512fa3b7 : SUCCESS in 11m 54s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/83032b93b70c4886bb144f580bbc41ee : SUCCESS in 9m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/943017346e5e4275ad21217468170d2f : SUCCESS in 15m 22s\n- grenade https://zuul.opendev.org/t/openstack/build/b7c84d21acc14e799240248a6d36848d : SUCCESS in 1h 03m 37s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3b3080131a1e4a0199fcf06a83e86311 : SUCCESS in 1h 47m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/5e49f0a5056847dbb0fb27436412e876 : SUCCESS in 6m 48s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b40e3f2f3bb64a4a8a4b334de8fec393 : SUCCESS in 8m 29s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/bd1f30c3244f4c5fb2f29084247def5b : SUCCESS in 30m 24s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/5a6cdbf9e899463ab01fce243e3e9f46 : FAILURE in 9m 40s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/d4b40e7f0e4d473c9ee4cedcc2bcbbce : FAILURE in 24m 40s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/e9f2b2e1acf7405d8ae9108621520512 : SUCCESS in 29m 14s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/0a2ceb989a5f4c84acd240fec80eb4a0 : FAILURE in 18m 04s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8625463027a047f49e7d8495116703d2 : SUCCESS in 40m 17s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/663c5dd77c3d4cdcb04494d59bffc38f : SUCCESS in 1h 02m 33s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/974fb50e05124522a5ebf6547e6e8f9e : SUCCESS in 46m 17s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/2932cfebd5864aa886b4b59c34c24eb2 : SUCCESS in 7m 16s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f59fa4ad43ee6a55866b93ceb0d84e51d5c28a3e","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:55:58.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/36bea0cddc954c7b911d7bdd0b71a511\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/c807efcac3014c9688b0e493ad0716de : NODE_FAILURE Node(set) request 4581aa96941e4df8bf612404b917f817 failed in 0s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/70c63d9528ca420ca32a2533f20b8404 : NODE_FAILURE Node(set) request 5a177d138611429eaf6d0c94e41ab00f failed in 0s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/64f22e5e2a8d4348b76eee73cc731d98 : NODE_FAILURE Node(set) request 024e3264b3774b7fa35002ee0dc9a6b5 failed in 0s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"da24f0edf87c697923af2fa81194aa924ea84d33","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 19:41:49.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"b52fb77d2d831eb0303008774424d701175a6fbe","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 20:07:12.000000000","message":"Patch Set 3:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":3},{"id":"9a3743460d6e3eaa8c67d18b13c5303e74d9c192","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:33:23.000000000","message":"Uploaded patch set 4: Patch Set 3 was rebased.","accounts_in_message":[],"_revision_number":4},{"id":"c641f4be9bf69eb1a2b5c2bc9c2825e57a6ea8f5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:24:44.000000000","message":"Patch Set 4: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/aa8ea41a75454cb39997f7021f8f83b4\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/89cf82c68cad45388a92d98fcce8431f : SUCCESS in 16m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/92ad946a3bd84da1b2f123f438fae1cf : SUCCESS in 5m 16s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/9da8032224d04142bbc814210cf89c39 : SUCCESS in 8m 16s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f3c3c0839e3e4724b87b3ec4835f2a05 : SUCCESS in 9m 01s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/0ef6687c9ea746bdbd8f5edb7b2d3a72 : SUCCESS in 14m 01s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8a3238ef77e14c88b7debbf2a555b5b7 : SUCCESS in 14m 46s\n- grenade https://zuul.opendev.org/t/openstack/build/99328b79084c4631961118ef098b1f65 : SUCCESS in 1h 03m 51s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/4db4dec70b044512b224270cf8e2bfba : SUCCESS in 1h 44m 07s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/23098c29a3bd416bbd33a31a1f4ffa79 : SUCCESS in 12m 24s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/983b71276906417b951bd93e9e11400f : SUCCESS in 18m 09s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/007d1339fe994edfa963fc81876c5872 : SUCCESS in 30m 38s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/69c4dfbcc1c7407b9bc5cf4c355f6ee0 : FAILURE in 17m 49s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/530890afa17b4ed09d144ea93e23b18d : FAILURE in 14m 32s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8da3fd71cf294d49802aab426a687f9e : SUCCESS in 32m 46s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/df0096d98b8a4a90b9e1a8429f1eaee9 : FAILURE in 31m 27s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e81827e6c9eb493389e688ede829c12f : SUCCESS in 37m 59s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/68ae7b33a0d249c8a42e667b7ac9db9c : SUCCESS in 1h 06m 42s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/108634b725444697a2565b6dcdc03a80 : SUCCESS in 32m 41s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e186f49fe1364f538f1a8d61fcc77a85 : SUCCESS in 7m 32s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"4331a8ae74eae87e15d687b17fd0e46c82933049","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:59:28.000000000","message":"Patch Set 4:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/abf13dbb833f4bfbb2dc5b6dcbe4be8d\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/ea5f9d3de8bd458db9a2b6e9ed105ca9 : SUCCESS in 21m 19s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/ec71c887514b4c7b92e537c284090c87 : SUCCESS in 26m 09s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/445857fea7bb4073ba02616675f9a820 : SUCCESS in 33m 18s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"34cf943355cc87d21d65364d3efa49875c845606","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:13.000000000","message":"Hashtag added: CVE-2026-44394","accounts_in_message":[],"_revision_number":4},{"id":"bd11e713066f5eaf4dee9b7e9a1b20b1a9214f43","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-05-29 10:00:24.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"d91cf54123ef4b8030c569f2b6cafa125b3b38f6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 11:51:53.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5801f57f1ef04c359149e8313ca02eb6\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/fdbc432590b6470a94b993f725bbbe70 : SUCCESS in 15m 23s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b1be879b73a84248af7eec4281e9161d : SUCCESS in 7m 07s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/180d62df5cae4affbb07720ee7991e2e : SUCCESS in 10m 10s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/8988338ba1d74ac3b6b0dbe895fb7879 : SUCCESS in 7m 20s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/340044d08cdf476989ccbd4e2f884caa : SUCCESS in 10m 34s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/608ae32b29b14b76aeb3d52a0e4a1d94 : SUCCESS in 7m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/a28ca6f67d2b4244b88cfe7494a17644 : SUCCESS in 1h 04m 42s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2585f120e1504ccdaf0eaf35ee2b2059 : SUCCESS in 1h 46m 11s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1d165584003647d1a065eb3e7ad54523 : SUCCESS in 13m 41s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e41a5c1e857a49f386d63fff79733718 : SUCCESS in 18m 08s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/ed044d6d159b49339a5c5e616b4579c4 : SUCCESS in 29m 37s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/44adcfe4188446d8a6cf67558edc2b27 : FAILURE in 16m 47s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/3e15476736114beca21e6a64c5e266b1 : FAILURE in 27m 37s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/83668a5d150b40ca87dc683de8ab11b9 : SUCCESS in 30m 04s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/4c75c0692a274551919bf0e187def388 : SUCCESS in 15m 10s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/f95868ad938b486388ab05f48d87fd72 : SUCCESS in 39m 43s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/c30153e8529c443194d4d4413981e4db : SUCCESS in 1h 00m 01s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/807dbc0107614d72aa20a89e81f79a49 : SUCCESS in 20m 42s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/60591615dc064a488c403243395a5afc : SUCCESS in 7m 41s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"41c96a114a16b19866d1a1cf451578dbbe472293","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-29 12:38:18.000000000","message":"Patch Set 4: Code-Review+2","accounts_in_message":[],"_revision_number":4},{"id":"a49b589bc074a116b35d618f75479b12ec0774dc","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 13:05:55.000000000","message":"Patch Set 4:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/109c3397db2848d89a345f2b361cecca\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/b0bec160fd474875a688cd17cad3f2c3 : SUCCESS in 19m 32s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/053222c0e0934e35a1e3a50d2ecb633d : SUCCESS in 12m 13s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/031df68ab3424f2c93293934778435f5 : SUCCESS in 30m 44s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"5d860d9de49db75797078dd74aeecfca16a554d9","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-01 08:55:24.000000000","message":"Patch Set 4: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":4},{"id":"c8a702c5f3854d654756b83903a6f97def839db3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 08:56:14.000000000","message":"Patch Set 4: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":4},{"id":"5b2173969894f44d87a82b9cbbc2a1296bc4127c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 11:08:18.000000000","message":"Patch Set 4: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4c3154c4bbb049dfb4cc0b4d45357fdc\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5ace84490b794f859ba66e67a5ef8c67 : SUCCESS in 5m 51s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/efd2f366bcaf4472b0259711bfe4bd66 : SUCCESS in 9m 06s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/142b92bb514f426998b72a24c927853f : SUCCESS in 11m 34s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0d426cba0c5146c78653aa7fcda206cc : SUCCESS in 14m 42s\n- grenade https://zuul.opendev.org/t/openstack/build/b07b5c37bffb448aab35f1d84c0b4505 : SUCCESS in 47m 28s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/e857cdf933224c1f949ee8fd9db3dba1 : SUCCESS in 1h 26m 54s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/5f9706203ed94b63a79c1a24a3e21303 : SUCCESS in 8m 21s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/39904aaeb9344b5b894927e4952554fa : SUCCESS in 32m 54s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/0d752cb4b6094ffaa0c133f574a48376 : SUCCESS in 29m 40s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4ffaca78037146478e470db0885be329 : SUCCESS in 46m 18s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/f0911ba5fedb48489c8fa6d286abb70a : SUCCESS in 24m 00s","accounts_in_message":[],"_revision_number":4},{"id":"6e045349f0ad5f742c02cf951c0f6dbb5fc3ca22","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 11:08:18.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"f94605302a742598478328426240b1e2b6a0d6e4","revisions":{"d1510514a3b58af8df2bd9bb381cf0863f40ce3a":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:05:16.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/88/990488/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/88/990488/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/88/990488/1"}}},"commit":{"parents":[{"commit":"3e34867b5b29efdde37a68f38bd430aaa0de6a2b","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3e34867b5b29efdde37a68f38bd430aaa0de6a2b"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:11:24.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:08:11.000000000","tz":120},"subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","message":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)\n\nWhen a federated token is rescoped via POST /v3/auth/tokens the\nhandle_scoped_token function returned response_data without an expires_at\nvalue. Because issue_token falls back to default_expire_time when\nexpires_at is None, each rescope issued a fresh full-TTL token instead of\ninheriting the remaining lifetime of the original token.\n\nA user with a federated token could extend their session indefinitely by\nrescoping repeatedly before expiry, bypassing operator-configured TTL\npolicies and IdP-level account revocation.\n\nFix: propagate token.expires_at from handle_scoped_token so that\nissue_token uses the original token\u0027s expiry rather than resetting to\nthe default. The non-federated path in token.py already did this via\nresponse_data.setdefault(\u0027expires_at\u0027, token.expires_at).\n\nCloses-Bug: #2150379\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I0bbb8520e12c52edd01fb47c873f0227819706f5\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d1510514a3b58af8df2bd9bb381cf0863f40ce3a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d1510514a3b58af8df2bd9bb381cf0863f40ce3a"}]},"branch":"refs/heads/master"},"2a411b529492830b4ddc9126fb90485863d58784":{"kind":"NO_CHANGE","_number":2,"created":"2026-05-28 16:02:40.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/88/990488/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/88/990488/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/88/990488/2"}}},"commit":{"parents":[{"commit":"631c9e584008ea52484a1f9ce363b329716815f3","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/631c9e584008ea52484a1f9ce363b329716815f3"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:11:24.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-28 16:02:27.000000000","tz":120},"subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","message":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)\n\nWhen a federated token is rescoped via POST /v3/auth/tokens the\nhandle_scoped_token function returned response_data without an expires_at\nvalue. Because issue_token falls back to default_expire_time when\nexpires_at is None, each rescope issued a fresh full-TTL token instead of\ninheriting the remaining lifetime of the original token.\n\nA user with a federated token could extend their session indefinitely by\nrescoping repeatedly before expiry, bypassing operator-configured TTL\npolicies and IdP-level account revocation.\n\nFix: propagate token.expires_at from handle_scoped_token so that\nissue_token uses the original token\u0027s expiry rather than resetting to\nthe default. The non-federated path in token.py already did this via\nresponse_data.setdefault(\u0027expires_at\u0027, token.expires_at).\n\nCloses-Bug: #2150379\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I0bbb8520e12c52edd01fb47c873f0227819706f5\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2a411b529492830b4ddc9126fb90485863d58784"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2a411b529492830b4ddc9126fb90485863d58784"}]},"branch":"refs/heads/master"},"aeb3e775d31ce33401fa9d3857c4e411848569ce":{"kind":"REWORK","_number":3,"created":"2026-05-28 19:41:49.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/88/990488/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/88/990488/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/88/990488/3"}}},"commit":{"parents":[{"commit":"98979c60331a963209c1d58d5f7097d2b5491803","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/98979c60331a963209c1d58d5f7097d2b5491803"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:11:24.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 19:40:18.000000000","tz":120},"subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","message":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)\n\nWhen a federated token is rescoped via POST /v3/auth/tokens the\nhandle_scoped_token function returned response_data without an expires_at\nvalue. Because issue_token falls back to default_expire_time when\nexpires_at is None, each rescope issued a fresh full-TTL token instead of\ninheriting the remaining lifetime of the original token.\n\nA user with a federated token could extend their session indefinitely by\nrescoping repeatedly before expiry, bypassing operator-configured TTL\npolicies and IdP-level account revocation.\n\nFix: propagate token.expires_at from handle_scoped_token so that\nissue_token uses the original token\u0027s expiry rather than resetting to\nthe default. The non-federated path in token.py already did this via\nresponse_data.setdefault(\u0027expires_at\u0027, token.expires_at).\n\nCloses-Bug: #2150379\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I0bbb8520e12c52edd01fb47c873f0227819706f5\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/aeb3e775d31ce33401fa9d3857c4e411848569ce"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/aeb3e775d31ce33401fa9d3857c4e411848569ce"}]},"branch":"refs/heads/master"},"f94605302a742598478328426240b1e2b6a0d6e4":{"kind":"TRIVIAL_REBASE","_number":4,"created":"2026-05-28 21:33:23.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/88/990488/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/88/990488/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/990488/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/88/990488/4"}}},"commit":{"parents":[{"commit":"14a14473998e7bb2193d316039fde75412517b08","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/14a14473998e7bb2193d316039fde75412517b08"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:11:24.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:32:50.000000000","tz":120},"subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","message":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)\n\nWhen a federated token is rescoped via POST /v3/auth/tokens the\nhandle_scoped_token function returned response_data without an expires_at\nvalue. Because issue_token falls back to default_expire_time when\nexpires_at is None, each rescope issued a fresh full-TTL token instead of\ninheriting the remaining lifetime of the original token.\n\nA user with a federated token could extend their session indefinitely by\nrescoping repeatedly before expiry, bypassing operator-configured TTL\npolicies and IdP-level account revocation.\n\nFix: propagate token.expires_at from handle_scoped_token so that\nissue_token uses the original token\u0027s expiry rather than resetting to\nthe default. The non-federated path in token.py already did this via\nresponse_data.setdefault(\u0027expires_at\u0027, token.expires_at).\n\nCloses-Bug: #2150379\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I0bbb8520e12c52edd01fb47c873f0227819706f5\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f94605302a742598478328426240b1e2b6a0d6e4"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f94605302a742598478328426240b1e2b6a0d6e4"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}