)]}'
{"id":"openstack%2Fkeystone~990502","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~I750156df18a1d6293ce99c42eb524575fcf16ea3","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-12 16:06:53.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-12 16:06:53.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-43000"],"change_id":"I750156df18a1d6293ce99c42eb524575fcf16ea3","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","status":"MERGED","created":"2026-05-28 15:06:35.000000000","updated":"2026-06-12 16:06:53.000000000","submitted":"2026-06-12 16:06:53.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990502","meta_rev_id":"d92aaec271ca789b2c00b8ddc0a72b15d7afda9d","_number":990502,"virtual_id_number":990502,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-12 16:06:52.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"recommended":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"all":[{"value":1,"date":"2026-06-05 15:28:45.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},{"value":2,"date":"2026-06-11 10:52:36.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-02 15:27:42.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":0,"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},{"value":1,"date":"2026-06-11 10:52:36.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}],"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:35.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 17:13:16.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-05 15:28:45.000000000","updated_by":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"reviewer":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"state":"REVIEWER"},{"updated":"2026-06-12 12:14:28.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"2dfe3b7ea77c92638d2b9592ed254ce447225180","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:35.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"adcae0f11acff07efbd565efbb25616a21188d51","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:13:16.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/e86ea10f2b2845abbcbe112a2ff5ecad\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/46dc5d37bcb44557b68789a75ed9b76a : SUCCESS in 20m 27s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/60607440a4764251bbd24932f140a462 : FAILURE in 7m 29s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/c062144e675244ee9d9b3c429c87c43c : SUCCESS in 14m 21s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/d6c2a780132f4360bc20ac1350d28dbe : SUCCESS in 12m 56s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b9808d9ebc174b0a8547c465f77f78d8 : SUCCESS in 12m 57s\n- grenade https://zuul.opendev.org/t/openstack/build/3957f2c81b1048fda1ebba98db48c010 : FAILURE in 31m 08s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6e70790b52fb40b9a3cafc07be8f9297 : SUCCESS in 1h 48m 49s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f8a2486777e141b49d5d60f22fcc5268 : SUCCESS in 13m 01s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/16118733062c4a6b9bb3e84ec1faecf3 : SUCCESS in 19m 13s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/fd8b449e7603472884d6b7a4e9171852 : FAILURE in 16m 53s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/4c526969962f43149e93552aebc80069 : FAILURE in 29m 45s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/102e962257b143ec8f2565d1dd9eb8bc : FAILURE in 28m 25s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/db060535a3b34bd0a6d8f70daca32188 : SUCCESS in 22m 11s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/6c3c2c7f94af434a8e3c425696e7b5b7 : SUCCESS in 41m 28s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4db8f5ff25714021bba828a6ae1e7570 : SUCCESS in 1h 00m 54s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a0847f7e42b4497bbccb184d5a84b104 : FAILURE in 7m 29s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/f21ff9e66e744b988573b311c3a435fa : FAILURE in 31m 19s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"16cdc53be58145f52cafa1b2a69fbc6cc4c369c9","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:33.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"3777f0e34a25a2d82b6532926531b7594a5abdf4","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:28:24.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1f092173c7ac466abbefca0d88f293b6\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/fd01c57961be4b3f9518a5e3c5b4aea3 : SUCCESS in 20m 43s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0416df0da67b4ed0bbca7b37c38fc0f0 : SUCCESS in 4m 31s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/b2ab677eb5a64d579a7132680dd31088 : SUCCESS in 14m 02s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/130575df891b4b73bb15947fbc8633c8 : SUCCESS in 9m 32s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/aafdca98e48140b4934036c99cee4362 : SUCCESS in 13m 31s\n- grenade https://zuul.opendev.org/t/openstack/build/1e898650b5534b8e87badfb7f7f8752b : SUCCESS in 56m 51s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7b96ee6dc3b54bb09064cb34188d161a : SUCCESS in 1h 26m 43s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/444ef8795a864a3397995beaa11b08dd : SUCCESS in 6m 53s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/e2224c2b43d94e9dab2fc8859339549d : SUCCESS in 29m 38s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/4cc5c60c4fbf4ddfb13d0039ff4f5e5b : FAILURE in 19m 04s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/2d792856e146462397711cd78e789e79 : FAILURE in 27m 31s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/13d7c9cc74604d7bb1411e2669a5235e : FAILURE in 28m 34s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/757db7db386d4260b70597edb891c373 : SUCCESS in 18m 42s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/04f01466dc8b454787f8d86c8d3d4357 : SUCCESS in 37m 00s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5cff57faa3394cd1b7dd1069701ffdc0 : SUCCESS in 1h 01m 29s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e345cbecc983495db37b2f8cb5190e50 : FAILURE in 6m 57s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/f39bdd9b590a4ef9b8ffad0ac1fee10e : FAILURE in 23m 04s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"db8d7e08f1a23fd44ac20f99f17c0d9772a0de81","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:13.000000000","message":"Hashtag added: CVE-2026-43000","accounts_in_message":[],"_revision_number":2},{"id":"a5029d5aa7c5f18a478e3c687ddba7f5d1afc4a3","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-02 15:27:42.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"d774d971cfaf4797b375bd0914d46c321c3a3b9f","author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"date":"2026-06-05 15:28:45.000000000","message":"Patch Set 2: Code-Review+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"69409d25583af55adab47e69e86789c0aa502422","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-11 10:52:36.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"cd1249cc410c6120353726eed62615b3df211dd3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 10:53:34.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"737bc941c93895591065c43aeaad62afce7ebc22","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 11:53:49.000000000","message":"Patch Set 2: Verified-2\n\nThis change depends on a change that failed to merge.\n\nChange https://review.opendev.org/c/openstack/keystone/+/990501 is needed.","accounts_in_message":[],"_revision_number":2},{"id":"6e22f1a622591c4089de212bf910ed492fe23aae","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-06-12 12:14:28.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"75b7d20ab30e79dd53d7e5048d503b3320ab5364","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 14:10:42.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/709ad49700fb4bffa6ecaf5cab9db35d\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9fdecde649e34bef96640dc6bd2effc9 : SUCCESS in 17m 31s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/55751c190dcd4181ade70b4c28b97c10 : SUCCESS in 4m 43s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e64b09cdcf104ee0b6d843eba3c8d495 : SUCCESS in 16m 01s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/f78e202340e54cce8e891bf2fb3e179a : SUCCESS in 13m 57s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2a6bbe053f484c37bf00167a9406f899 : SUCCESS in 13m 45s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/5c8e6cc8a9b44b0cb9674d930e04f46e : SUCCESS in 10m 51s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/bd6330fae4ac46db8c1bce9c1229e837 : SUCCESS in 29m 13s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/951a00219a1e4780825fd8463d984c04 : FAILURE in 35m 43s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/bf8af9191fda4f53849dd55db52e3cc1 : FAILURE in 24m 43s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/a25212cac3c740618e481b320c47695b : SUCCESS in 26m 35s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/4835b42d51e24c65b9d9cfc82af052ac : SUCCESS in 17m 58s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c416d8368fe24c15bf1c2602ba424468 : SUCCESS in 35m 28s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5325e3113fcf402c93083a0c8bcdc980 : SUCCESS in 1h 46m 55s\n- grenade https://zuul.opendev.org/t/openstack/build/8328b4b4fa444bd3aa123530f507cd7e : FAILURE in 51m 29s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/bf4a20a3ca684f9b8a96f3d970832a5d : SUCCESS in 56m 32s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/cd3dfea599f14042a889c90bc6488e29 : FAILURE in 6m 38s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/e1cf2580b31c4bf39f8cecd39abfdd5e : SUCCESS in 30m 55s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"0bc78cd22ad953b83f2e0ba1ac36f9f79972d713","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 14:11:23.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"63d6cce694d0ff937637285945b7f13fef0f7597","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:06:52.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4a79a6a3d12a483980b2ef0aadd8a4c6\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/dd327a5353ec4b65a81e0d06418d4e1e : SUCCESS in 6m 59s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/5eb39d889ac24e0593414ef87d4e4f59 : SUCCESS in 8m 26s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/568a732f86134d66b4f697f52d4d457f : SUCCESS in 9m 32s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/c2f19b0cf53542d386e0d2b1b9876fbf : SUCCESS in 11m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6e010e138974432c9a10d05ffcfaf0c6 : SUCCESS in 13m 47s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/f5efa52ea77641418499918c98a0d82e : SUCCESS in 34m 27s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8c5ed81944db44e59f559a5b9f7425d2 : SUCCESS in 1h 38m 29s\n- grenade https://zuul.opendev.org/t/openstack/build/01025a4c324c4ec9bf02059f48dfa671 : FAILURE in 51m 02s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ef63b7cae3e84361af963b49866ab207 : SUCCESS in 49m 13s","accounts_in_message":[],"_revision_number":2},{"id":"d92aaec271ca789b2c00b8ddc0a72b15d7afda9d","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:06:53.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"50c30d16994511925d23975481993bb8395ab0d7","revisions":{"6310718ff6ecb19e23ae89feb1ece227c27fc6ee":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:35.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/02/990502/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/02/990502/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/990502/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/990502/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/990502/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/02/990502/1"}}},"commit":{"parents":[{"commit":"0eaf4ea5e4cedb30a776e845391112bf098a19ad","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0eaf4ea5e4cedb30a776e845391112bf098a19ad"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:47.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:23:07.000000000","tz":120},"subject":"Forbid trust operations using application credentials (CVE-2026-43000)","message":"Forbid trust operations using application credentials (CVE-2026-43000)\n\nPreviously only restricted application credentials were blocked, and only\nfor trust create and delete. This change blocks all application credentials\n(restricted and unrestricted alike) from all trust operations: list, get,\ncreate, delete, list-roles, and get-role. The \u0027unrestricted\u0027 flag governs\ncredential management, not trust management.\n\nCloses-Bug: #2148477\nRelated-Bug: #2149789\nRelated-Bug: #2150089\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I750156df18a1d6293ce99c42eb524575fcf16ea3\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 3c2043ab003cb4b8aa34502fe9a5a69b0a6a6e54)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6310718ff6ecb19e23ae89feb1ece227c27fc6ee"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6310718ff6ecb19e23ae89feb1ece227c27fc6ee"}]},"branch":"refs/heads/stable/2025.1"},"50c30d16994511925d23975481993bb8395ab0d7":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:33.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/02/990502/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/02/990502/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/990502/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/990502/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/990502/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/02/990502/2"}}},"commit":{"parents":[{"commit":"90fe79c82e9eb16547e3e4aa69f9f8cb8daa8bc6","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/90fe79c82e9eb16547e3e4aa69f9f8cb8daa8bc6"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:47.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:57:05.000000000","tz":120},"subject":"Forbid trust operations using application credentials (CVE-2026-43000)","message":"Forbid trust operations using application credentials (CVE-2026-43000)\n\nPreviously only restricted application credentials were blocked, and only\nfor trust create and delete. This change blocks all application credentials\n(restricted and unrestricted alike) from all trust operations: list, get,\ncreate, delete, list-roles, and get-role. The \u0027unrestricted\u0027 flag governs\ncredential management, not trust management.\n\nCloses-Bug: #2148477\nRelated-Bug: #2149789\nRelated-Bug: #2150089\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I750156df18a1d6293ce99c42eb524575fcf16ea3\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 3c2043ab003cb4b8aa34502fe9a5a69b0a6a6e54)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/50c30d16994511925d23975481993bb8395ab0d7"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/50c30d16994511925d23975481993bb8395ab0d7"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}