)]}'
{"id":"openstack%2Fkeystone~990497","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I750156df18a1d6293ce99c42eb524575fcf16ea3","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-08 18:52:18.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-08 16:56:30.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}},"hashtags":["CVE-2026-43000"],"change_id":"I750156df18a1d6293ce99c42eb524575fcf16ea3","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","status":"MERGED","created":"2026-05-28 15:06:15.000000000","updated":"2026-06-08 18:53:23.000000000","submitted":"2026-06-08 18:52:18.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990497","meta_rev_id":"a59d0aec41d78c86d0bee517d91a2fe0a9c386f5","_number":990497,"virtual_id_number":990497,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-08 18:52:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"recommended":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"all":[{"value":1,"date":"2026-06-05 15:28:15.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},{"value":2,"date":"2026-06-03 12:05:59.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-08 16:56:30.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-06-08 16:56:30.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:15.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:55:36.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-05 15:28:15.000000000","updated_by":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"reviewer":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"state":"REVIEWER"}],"messages":[{"id":"8faf2e206daa99e6a8cae67e3d61e8e31594c972","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:15.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"f070d9de7bdca295097b2c3cee74bbc3e7203085","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:55:36.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/ad5fde6a4ddc4b4c9bb5b80f494ae27f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b95d5620054449db9c3f6c63010b3703 : SUCCESS in 17m 45s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7f00542916e84fad822ebeebd002da2e : FAILURE in 7m 53s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/f181f90730f5449ba565fc0b099cfecf : SUCCESS in 12m 32s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/e389f8fa3ac64bd3b59683cdc83b61c3 : SUCCESS in 15m 04s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/217480043e4d4fd7a1f2b6b8ab34dd65 : SUCCESS in 17m 21s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b444941b9b954555aef53578e59ebf89 : SUCCESS in 16m 12s\n- grenade https://zuul.opendev.org/t/openstack/build/1959f32785e94fe9bc264707426b83f5 : SUCCESS in 1h 08m 45s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d55f83989a284296a5f5f7c1d57876f8 : SUCCESS in 1h 38m 35s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6ea78a77e6c240d5b811c5eb83b26ec8 : SUCCESS in 13m 33s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/a85b813d982348e688953ed0cc695e2d : SUCCESS in 14m 41s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/76483d77071e48a382e6793379d43248 : SUCCESS in 30m 03s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/ad3533e6ae87479aa9625ea7e7a1d72c : FAILURE in 12m 34s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/ea49e2e44ba14eaca121c87a230bdb2c : FAILURE in 24m 17s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/b4667cc80043440ba3e3c3195f529b9a : FAILURE in 29m 07s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e6b96b23892546b5abfd77ad12421510 : FAILURE in 29m 20s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/9afaa2fad2584ff2892e6c7f75a7b052 : SUCCESS in 32m 45s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ea313cf04fa74e5586687ce68b402846 : SUCCESS in 1h 00m 50s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/13c212f7890e43c59367f40c53277762 : FAILURE in 29m 57s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/b1b3e7ef04ae4aaf8bc713dc1b3a3d38 : FAILURE in 8m 13s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"938805f470e23b218c490128877418f47f6c0036","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:12.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"2d5c60eab059f6f5c614bcfcbbde38c478daa691","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:51:17.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/7007ec74c6644b58b78cbadfb455637f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/eb754d515db64afc996f682e35bf88e6 : SUCCESS in 17m 47s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ffd3848eecc34f95b2380253ef4487bb : SUCCESS in 7m 06s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/f743d39be60e455b9f272a389c91487d : SUCCESS in 11m 30s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/a056c2ff0a9a4b4dacb3045b5148be6a : SUCCESS in 12m 53s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/bf7ea300246045c391bd441fdaf69a33 : SUCCESS in 15m 57s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6d4cba6d38c7481388dcf35ad9212287 : SUCCESS in 14m 23s\n- grenade https://zuul.opendev.org/t/openstack/build/944f4546078a46b097df68ffc0334928 : SUCCESS in 1h 06m 32s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/76f6fd6196844f3887e6d73903ccd081 : SUCCESS in 1h 47m 00s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/35cf8dd4de2a45af80a5c0b06c192dd9 : SUCCESS in 13m 22s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9c9297dcb0a04398bcf3dd620327d895 : SUCCESS in 16m 54s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/21d61a89ff2a48a1b08a683957a3d334 : SUCCESS in 31m 22s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/91036c6fe894410da44582e64bd8afe7 : FAILURE in 12m 13s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/97e41b26694746b0886a6e2747cf65d7 : FAILURE in 23m 44s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/3d0630527ec5430c9f7c12056e374cc6 : FAILURE in 27m 17s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/ace1d3f717a647cc9fcaade388907fc1 : FAILURE in 34m 43s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/634ca3d22602466ab077228250325872 : SUCCESS in 36m 52s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e88278398896437598363831ea4c2f05 : SUCCESS in 53m 44s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/7d6f20de36da428e8e5e810afda44ed1 : FAILURE in 41m 02s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/54180cc7bad14d72b4725901209bc0dc : FAILURE in 7m 54s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"fc4e2bbe4ce921271d8794badd1cb51d3f65d350","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:12.000000000","message":"Hashtag added: CVE-2026-43000","accounts_in_message":[],"_revision_number":2},{"id":"057e18f37edd4e16c8551471c9a9893b77780d7f","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:05:28.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"86ac1c091dbcbe2b4bcee76063f0f6a7583d61ef","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:05:59.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"5873fb58413e9ebb5a245b14f51fe65d6599d8da","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-03 13:55:14.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f4366233b1a546e0a593c6bd15247db2\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/c837f7cb281b4999b8e278b31cdd7a3c : SUCCESS in 18m 22s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1f5eb7b8b3764fd6b3f86459abdc158f : SUCCESS in 6m 39s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/4b47df3112004d058f790626c79b30a7 : SUCCESS in 13m 14s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/3cea70f61c2544758c359e61a53df6d8 : SUCCESS in 13m 07s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/1f2ce2d29adb419986d2b872f2463c94 : SUCCESS in 21m 27s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3183977833ba465d9e0c2d1561a9f901 : SUCCESS in 14m 15s\n- grenade https://zuul.opendev.org/t/openstack/build/5e92c5f2950f41c0a5b63abc127b1785 : SUCCESS in 1h 08m 33s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3e5b4632bd7b49c3bdd544bef3578e86 : SUCCESS in 1h 39m 54s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e2edbe7dcc8e40b6af27047a4c53851f : SUCCESS in 13m 12s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/3a38e795680f4f3eb5f0424f3fa1af3b : SUCCESS in 10m 38s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/db094b530f414824afd9a99d753e0a35 : SUCCESS in 28m 58s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/749d0f972b834bb19dc9f67c967148e2 : FAILURE in 18m 29s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/4323e78479a74648b296b7849bfefa27 : FAILURE in 25m 42s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/0dada6bdb3ec4923a4247980d647185d : SUCCESS in 30m 10s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/ee0ca9008a3048fa943379a9d3296a05 : SUCCESS in 17m 02s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a010ef6c78e747e5bc2abad6487f0e78 : SUCCESS in 36m 20s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/81e377fa09354961abe61dd1055e581e : SUCCESS in 1h 02m 02s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/485b89c8e10f4fd092faeb3dbe303f05 : SUCCESS in 43m 59s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/896a23a58be24799962933981cc65b3b : FAILURE in 7m 41s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"1b725e2123df6d3100e40d7da720e1f70d5b510b","author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"date":"2026-06-05 15:28:15.000000000","message":"Patch Set 2: Code-Review+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"e83c8f2a4edcc5851808ab58a70b07a998b2186b","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-08 16:56:30.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"d4da174e71373687ae25ade7142c80c4d8a50789","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 16:57:44.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"5468e266ef20e6ac061665a419dba2239c2c7ed9","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:52:17.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2e8ab29a454f4672b0231e8cd04b8cdb\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/bde77592791a4a8582612207eced0a5a : SUCCESS in 7m 25s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/6518c696f1464b0d8baa3411955c2d95 : SUCCESS in 15m 04s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/f7a7c4f1ba0b4a99836b782c4dc8f523 : SUCCESS in 13m 33s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/00c0954149e54065a9620605cb7f398d : SUCCESS in 15m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/c4ce07adbc5f471789e7a6c4c2f5d441 : SUCCESS in 33m 23s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5c1bcaf748984e8b9db4c60bf612fb13 : SUCCESS in 1h 40m 39s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9b6aa10530144ef8baf03c0908835211 : SUCCESS in 6m 39s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3848011dd9994534a2f55edf22d9e917 : SUCCESS in 18m 40s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/e119b697ce8e4398b297cbc862fc3ce4 : SUCCESS in 22m 35s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4b53ae88056f44a09c50484ed626a5a8 : SUCCESS in 1h 02m 51s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/fa33f9b29995453db119e3f432775673 : SUCCESS in 41m 38s","accounts_in_message":[],"_revision_number":2},{"id":"10aaa5cee4a60c5d737f1c43c2f501809e36b972","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:52:18.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"a59d0aec41d78c86d0bee517d91a2fe0a9c386f5","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:53:23.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/43627bb7c8b6401dbd013222e257e393\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/c0e3a348c8124d2d8b5e8264e69d0b87 : SUCCESS in 49s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"68f4807773cea484012b19194b2179d43fed7d3b","revisions":{"62f2c28c664495dd7540590c26e2a6a90bb07f92":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:15.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/97/990497/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/97/990497/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/990497/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/990497/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/990497/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/97/990497/1"}}},"commit":{"parents":[{"commit":"74ab55e6b2161264f16f9f0d006ff06b56d6e480","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/74ab55e6b2161264f16f9f0d006ff06b56d6e480"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:47.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:18:41.000000000","tz":120},"subject":"Forbid trust operations using application credentials (CVE-2026-43000)","message":"Forbid trust operations using application credentials (CVE-2026-43000)\n\nPreviously only restricted application credentials were blocked, and only\nfor trust create and delete. This change blocks all application credentials\n(restricted and unrestricted alike) from all trust operations: list, get,\ncreate, delete, list-roles, and get-role. The \u0027unrestricted\u0027 flag governs\ncredential management, not trust management.\n\nCloses-Bug: #2148477\nRelated-Bug: #2149789\nRelated-Bug: #2150089\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I750156df18a1d6293ce99c42eb524575fcf16ea3\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 3c2043ab003cb4b8aa34502fe9a5a69b0a6a6e54)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/62f2c28c664495dd7540590c26e2a6a90bb07f92"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/62f2c28c664495dd7540590c26e2a6a90bb07f92"}]},"branch":"refs/heads/stable/2025.2"},"68f4807773cea484012b19194b2179d43fed7d3b":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:12.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/97/990497/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/97/990497/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/990497/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/990497/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/990497/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/97/990497/2"}}},"commit":{"parents":[{"commit":"8e1ec7d6af44c4f183cf7c9ebe14a1dc94f001fa","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8e1ec7d6af44c4f183cf7c9ebe14a1dc94f001fa"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:47.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:58.000000000","tz":120},"subject":"Forbid trust operations using application credentials (CVE-2026-43000)","message":"Forbid trust operations using application credentials (CVE-2026-43000)\n\nPreviously only restricted application credentials were blocked, and only\nfor trust create and delete. This change blocks all application credentials\n(restricted and unrestricted alike) from all trust operations: list, get,\ncreate, delete, list-roles, and get-role. The \u0027unrestricted\u0027 flag governs\ncredential management, not trust management.\n\nCloses-Bug: #2148477\nRelated-Bug: #2149789\nRelated-Bug: #2150089\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I750156df18a1d6293ce99c42eb524575fcf16ea3\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 3c2043ab003cb4b8aa34502fe9a5a69b0a6a6e54)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/68f4807773cea484012b19194b2179d43fed7d3b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/68f4807773cea484012b19194b2179d43fed7d3b"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}