)]}'
{"id":"openstack%2Fkeystone~990498","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I0bbb8520e12c52edd01fb47c873f0227819706f5","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-09 14:48:00.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-09 14:48:00.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-44394"],"change_id":"I0bbb8520e12c52edd01fb47c873f0227819706f5","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","status":"MERGED","created":"2026-05-28 15:06:15.000000000","updated":"2026-06-09 14:49:35.000000000","submitted":"2026-06-09 14:48:00.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":3,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990498","meta_rev_id":"072a4ca821b37dffdfd9b7fcc4ed4ac1c205c042","_number":990498,"virtual_id_number":990498,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-09 14:48:00.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-03 12:06:03.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2026-06-08 16:56:41.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":1,"date":"2026-06-08 16:56:41.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"CC":[{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:15.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 17:04:58.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-08 19:40:58.000000000","updated_by":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"reviewer":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"state":"CC"},{"updated":"2026-06-09 10:41:17.000000000","updated_by":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"reviewer":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"state":"CC"}],"messages":[{"id":"c2b790b9a6ada3b6f9a25a76a8ec1f0bfbb33805","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:15.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"47f775d2cf3dddf45053e000526d6b5afe58fd74","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:04:58.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/34ca44599a694a999482b9fce6d4366a\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/c25251cf6ef74ca0b554b9a5e1f65c8f : SUCCESS in 19m 30s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4455857005184894bb448f2d341fc2c0 : FAILURE in 8m 06s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/5a157b75faf54ccfbc9553b3a6c220e8 : SUCCESS in 13m 23s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c60467ba4be7478bb2f02963824c2c0a : SUCCESS in 15m 12s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/041c085d372e4d00b013c1d3cde02a79 : SUCCESS in 16m 38s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6e622081b8ce45d4ba720dd5264fed4e : SUCCESS in 15m 50s\n- grenade https://zuul.opendev.org/t/openstack/build/0065fa45e832495bbc1c831b19fc1c7f : SUCCESS in 59m 57s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a243c4d1a25a4d6084271c5f31d27b62 : SUCCESS in 1h 43m 15s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/059b3271a4474e499251133b8768aaf1 : SUCCESS in 6m 23s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/70c027cefeeb4d068e419ba536a6911b : SUCCESS in 21m 32s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/02d16fb9b05c4e0793edcfe12bd5ce00 : SUCCESS in 42m 54s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/e7d6b3d3ff8f4034a18530cbff040552 : FAILURE in 18m 02s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/cc6516238245410da61731c83cff7764 : FAILURE in 20m 02s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/719f0ac54af941e982507ac6c7898df7 : FAILURE in 28m 25s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c539ac18374645acb2a42afce8b428bf : FAILURE in 34m 23s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/43c4bbef98344cc985cc9e3ab697d838 : SUCCESS in 26m 42s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/03b0419b219d4e778cd6c79bf6a0c652 : SUCCESS in 1h 04m 07s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/b8c2f34a07854499bcbd2e6d6415c1b0 : FAILURE in 24m 52s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/c1092182397046aaba8d1fc1c689b0b2 : FAILURE in 8m 41s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"237d5666ac290accf4e2ae23bcd2394c025c06cc","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:15.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"3768cce5032f992f913ee07103e4aa2ab774a504","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:48:58.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/bec0306eb6274088a8527221daf7eb0c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/c7aaab72069947a8ba2204d410b98c4e : SUCCESS in 17m 33s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1b8042430099464597e206f592840a6d : SUCCESS in 6m 55s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a3783c84b9e94dc3bc6ac9f39039e966 : SUCCESS in 14m 52s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/867eea06454d4991bb9c60dfd1d157dd : SUCCESS in 13m 16s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/8e92c6f051bb4d17b42e752656ed930c : SUCCESS in 17m 13s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3b411c0b0f3740b18504347338490e74 : SUCCESS in 14m 08s\n- grenade https://zuul.opendev.org/t/openstack/build/c97febb1af814f3698bb12549825c4af : SUCCESS in 1h 03m 30s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/87c4bfa86e4a42e79f7bda3bde45e1b0 : SUCCESS in 1h 42m 25s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4effa404f3574b3daedf6c047a00a4d1 : SUCCESS in 13m 47s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e4ccb739601a47e3942a4faa6ad29e66 : SUCCESS in 19m 20s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/8bdc9794473349efad30eda58cf9e26b : SUCCESS in 32m 02s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/32bf69bddf404a539c2ae4d723c00eff : FAILURE in 12m 11s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/2ce5760fe8db44cc963c116fd7130e70 : FAILURE in 27m 47s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/22f4bb28039f4236b4e7fd24838c1f6b : FAILURE in 29m 21s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/7477f99134b140d1b5be68c8cf0dcdf9 : FAILURE in 25m 30s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/bae9bac56a0349029bf344a5732fc157 : SUCCESS in 38m 59s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/06b7719130864e95b5476c68537e0de3 : SUCCESS in 58m 07s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/bd8766ca576e4441ab14c41d825d0151 : FAILURE in 18m 07s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/ea22d4f4c0e444af8484fff35eba6512 : FAILURE in 10m 22s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f107bacd4c55eba3e1bec0c49e44a3410d561e74","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:14.000000000","message":"Hashtag added: CVE-2026-44394","accounts_in_message":[],"_revision_number":2},{"id":"fa6b19022a35a801b3f72b44df34cae99fc649ff","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:05:35.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"f2602820606903d17f6dd3da1fabda1e8827fa1c","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:06:03.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"7c6ed39d2d1eb5da1660477d4dfaa37ac2953e66","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-03 14:09:19.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/569bbe703eff435fbf56e19f11052ae8\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/04a6b1b58cbc4faea02f66536ed052a7 : SUCCESS in 18m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/dcc7e463a0e94fa085e4e26c2d23d09b : SUCCESS in 7m 13s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/73757359084f4c69801117258facca8c : SUCCESS in 12m 59s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/6a40b2332ec646ae9e2c4deb71ab4a62 : SUCCESS in 8m 32s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/d5a996ca562b46ecbbbccc9c3ba12f9a : SUCCESS in 15m 33s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5ec204b9143140558f1ef200ebf986fd : SUCCESS in 7m 05s\n- grenade https://zuul.opendev.org/t/openstack/build/7883cdfe388b4a5b9149e11fc75ba6ba : SUCCESS in 1h 10m 14s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a3b260b8f41249daabf9b593a6da856a : SUCCESS in 1h 48m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/b70e13a5881f41b08cad55ffb9e8e818 : SUCCESS in 14m 03s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/5f125b5dbb20456588073e2bc54693a8 : SUCCESS in 19m 01s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/26cdc1fd684749509c4772d12e33263e : SUCCESS in 33m 59s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/3e6f0e06990c4bf0b7c66f91c57ded43 : FAILURE in 18m 44s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/634d347efab84398ab33eac15b770a41 : FAILURE in 27m 36s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/bdfbee37ce1e411582b970e3ab7b3a7b : SUCCESS in 31m 19s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c97b5cae92714cea8e927731b4b371be : SUCCESS in 32m 39s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e43d282b98114c49aead26ba23a7dd21 : SUCCESS in 34m 36s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/05fff124819548ccb704e009fbb954a5 : SUCCESS in 59m 43s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/cf57927f6d264809b1bd7bf0aed087ee : SUCCESS in 40m 21s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/000177a044034d739ef11289b72439fb : FAILURE in 4m 44s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"c7f6fc8a98b5450073a7444f28d49875d2e676c2","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-08 16:56:41.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"919906c726be6105e2fbca375226f07ff5a8b4d9","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 16:58:10.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"84fec18d9b4aae50bcd065b4a047e087d0118e84","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:52:20.000000000","message":"Patch Set 2: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/bcf7300f146e44cd9001591626faa88d\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b7a889f252cd4e9b8add6eb7f0e22d60 : SUCCESS in 5m 09s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a1bc7e9476ca4d28adc4759203aec3d0 : SUCCESS in 14m 27s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/89024cf344244053a37f03814054cc82 : SUCCESS in 13m 56s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3a87a79c8cee4d62801f9aafe0ca98eb : SUCCESS in 15m 01s\n- grenade https://zuul.opendev.org/t/openstack/build/35072f4c97684e5c80d83167fd73aab6 : SUCCESS in 1h 05m 40s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9d345b34a4054dd28db7fc92174c2abc : SUCCESS in 51m 31s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/fafd2ea016304671b94465db5bf34388 : SUCCESS in 13m 06s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e83abc4409784f87af33b37d3c1b88be : SUCCESS in 15m 23s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/07d97f47ae0f4fbd81a8ba962808a098 : SUCCESS in 14m 07s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/c21bf5ce5c094ed2ad51330d50279d47 : SUCCESS in 41m 50s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/4021856301c84aa4827885a31f545b02 : FAILURE in 41m 54s","accounts_in_message":[],"_revision_number":2},{"id":"0de4014af398d06565443991413d3e6fcc9fdc87","author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"date":"2026-06-08 19:40:58.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"5591c6518921ef8de30d99de75d28f530ef95aaf","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 21:10:50.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/53fccbb903384ec6ba0461e997e61085\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/a22e7e98fc034c26912500018e199509 : SUCCESS in 17m 10s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/73b661df577d436b8e885e023d4a2ddb : SUCCESS in 6m 05s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a6a22c57167c42dfafd5430c44da06ed : FAILURE in 12m 22s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/720871faad4a4537b5a4c03a0b808257 : SUCCESS in 11m 49s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/8ac874282fb54d1c9c61ebe65e62bd43 : SUCCESS in 9m 13s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5e75869387b748c18a18ef2089734d93 : SUCCESS in 13m 30s\n- grenade https://zuul.opendev.org/t/openstack/build/2b17817e42f84b05a7934663e9c24d75 : SUCCESS in 1h 29m 16s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/75524a224c094c2e9f577035c8ed94e5 : SUCCESS in 54m 38s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4469b72a5486475c934201787bb2ac65 : SUCCESS in 12m 07s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/83a6080424bb4bf9a419e2693cc96cc2 : SUCCESS in 11m 58s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f5dd38d66fbd48d099d74b4126d38a26 : SUCCESS in 13m 44s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/30e34f99cfca4fc0a5c261a17e805ee0 : FAILURE in 15m 31s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/72abb24d26674d99b6216dc8a603f18a : FAILURE in 25m 13s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/ae34c4c3a6d84cd2b383f9845f3a3e54 : SUCCESS in 28m 00s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e6919e2e647a425cb37539d8657a2a98 : SUCCESS in 33m 25s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e865d17e506c4d35a3e930cf9e72b61b : SUCCESS in 18m 56s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6e518afc6a034275a24622e55fb75e74 : SUCCESS in 53m 00s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/eebe377c0cba42ffbb7ce5d176a75592 : FAILURE in 32m 08s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/4ef74c7f9ebf46488b2def74780593a8 : FAILURE in 7m 45s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"1f7960e89712ca54128d6a4c9a881fb91ee1af58","author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"date":"2026-06-09 10:41:17.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"482cf263e6a5888c37608b5c23dd1575b668c1aa","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 12:22:47.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d8e7b2abb6214a9cb5e2a4158eceb2ca\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/5920e31aaa76482b9449551ed7b7b4c9 : SUCCESS in 17m 56s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f3b75c24e9a5457ab8b60b799f242f4d : SUCCESS in 6m 48s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/4e7f444867f940b4998aa3a6e278eeef : SUCCESS in 11m 42s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/e22ce7919d84428a94f3f183e5e791ce : SUCCESS in 12m 14s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/6f73b30e258949e19ac2368d7d444070 : SUCCESS in 15m 50s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/af329800bb1445a18d754f8171e34083 : SUCCESS in 15m 26s\n- grenade https://zuul.opendev.org/t/openstack/build/1f65d367e31040cc8e99b30fce3b9898 : SUCCESS in 1h 04m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/93244b6d46d14667bef8f3f33e9cfc79 : SUCCESS in 1h 36m 20s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a77485164898474dba3d8fe6af2f7dce : SUCCESS in 13m 41s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e1b7991b9c234e0997a64ea5d24b24eb : SUCCESS in 17m 40s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/23081ad93b714284a11972f476d351d3 : SUCCESS in 12m 33s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/3ef6d858c8384e08a928dbbf88b41a31 : FAILURE in 16m 12s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/6db9994c9d02405885a3ed12f1605b61 : FAILURE in 27m 35s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/21595f3928cd473bba90eff750dcda60 : SUCCESS in 30m 12s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/2ef722c4ce7244fdbce575272d34cb99 : SUCCESS in 29m 19s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/0c66e7eebe094f56a5d7f585713e39b2 : SUCCESS in 34m 45s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/62f52f2b4f81488ba34b864f148ab4fe : SUCCESS in 1h 04m 32s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3bae3877881e446c87e11dc86eb4198d : SUCCESS in 43m 47s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f3db9b1e55a644e8ab2d6bcb31b35b8a : FAILURE in 8m 40s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"4f624967eac454e522a7f223a966d8a5285d7205","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 12:23:23.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"25e194cc885ff731c51996502f2ba4ee664ec2c4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 14:48:00.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/73cb01f7b4344d6dbf9bb5d10e5a38b2\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e019822c804b47e28b517d422ad31eb0 : SUCCESS in 7m 08s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/79d616064fd84d02a538615459089ab2 : SUCCESS in 17m 31s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/b08d879644184aa1862afb2910c26d99 : SUCCESS in 11m 56s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3a6e407c01b74e1f9b04f86b10c2a2be : SUCCESS in 14m 53s\n- grenade https://zuul.opendev.org/t/openstack/build/802c4d7a7da242a8bf0401a3ee2aedea : SUCCESS in 34m 12s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/674f346e309f4e44a2d80e6ffeb5a064 : SUCCESS in 1h 42m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9d27fecdd5b049ca8d7788b386efc04c : SUCCESS in 7m 42s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/414e3baebdcb47e1b9b8b335ad4a4fa1 : SUCCESS in 23m 48s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/db400decb29d450bba24a934266f9537 : SUCCESS in 30m 02s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/749b518347d847f2819b20429ca496a5 : SUCCESS in 34m 20s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/9814820120a945b2a62cb2429e24136e : SUCCESS in 42m 02s","accounts_in_message":[],"_revision_number":2},{"id":"9b90c74f8091f17f088391cd85dfdceaf06b6c17","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 14:48:00.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"072a4ca821b37dffdfd9b7fcc4ed4ac1c205c042","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 14:49:35.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/996ee5137d604f4bb0abfe4f3ebdacb7\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/956cb45a741940feb8de2286ecbdefb2 : SUCCESS in 1m 05s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"98359b2bb57f80e63ed8668c0d6abc37fdc5fbac","revisions":{"fac6a5ff9620be2632d02d0003d56dcb9ceae551":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:15.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/98/990498/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/98/990498/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/98/990498/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/98/990498/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/98/990498/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/98/990498/1"}}},"commit":{"parents":[{"commit":"62f2c28c664495dd7540590c26e2a6a90bb07f92","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/62f2c28c664495dd7540590c26e2a6a90bb07f92"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:11:24.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:18:41.000000000","tz":120},"subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","message":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)\n\nWhen a federated token is rescoped via POST /v3/auth/tokens the\nhandle_scoped_token function returned response_data without an expires_at\nvalue. Because issue_token falls back to default_expire_time when\nexpires_at is None, each rescope issued a fresh full-TTL token instead of\ninheriting the remaining lifetime of the original token.\n\nA user with a federated token could extend their session indefinitely by\nrescoping repeatedly before expiry, bypassing operator-configured TTL\npolicies and IdP-level account revocation.\n\nFix: propagate token.expires_at from handle_scoped_token so that\nissue_token uses the original token\u0027s expiry rather than resetting to\nthe default. The non-federated path in token.py already did this via\nresponse_data.setdefault(\u0027expires_at\u0027, token.expires_at).\n\nCloses-Bug: #2150379\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I0bbb8520e12c52edd01fb47c873f0227819706f5\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 75a4a0c354c7f568b28dd85182dc729553fb3a33)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fac6a5ff9620be2632d02d0003d56dcb9ceae551"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fac6a5ff9620be2632d02d0003d56dcb9ceae551"}]},"branch":"refs/heads/stable/2025.2"},"98359b2bb57f80e63ed8668c0d6abc37fdc5fbac":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:15.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/98/990498/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/98/990498/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/98/990498/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/98/990498/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/98/990498/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/98/990498/2"}}},"commit":{"parents":[{"commit":"68f4807773cea484012b19194b2179d43fed7d3b","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/68f4807773cea484012b19194b2179d43fed7d3b"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:11:24.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:58.000000000","tz":120},"subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","message":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)\n\nWhen a federated token is rescoped via POST /v3/auth/tokens the\nhandle_scoped_token function returned response_data without an expires_at\nvalue. Because issue_token falls back to default_expire_time when\nexpires_at is None, each rescope issued a fresh full-TTL token instead of\ninheriting the remaining lifetime of the original token.\n\nA user with a federated token could extend their session indefinitely by\nrescoping repeatedly before expiry, bypassing operator-configured TTL\npolicies and IdP-level account revocation.\n\nFix: propagate token.expires_at from handle_scoped_token so that\nissue_token uses the original token\u0027s expiry rather than resetting to\nthe default. The non-federated path in token.py already did this via\nresponse_data.setdefault(\u0027expires_at\u0027, token.expires_at).\n\nCloses-Bug: #2150379\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I0bbb8520e12c52edd01fb47c873f0227819706f5\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 75a4a0c354c7f568b28dd85182dc729553fb3a33)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/98359b2bb57f80e63ed8668c0d6abc37fdc5fbac"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/98359b2bb57f80e63ed8668c0d6abc37fdc5fbac"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}