)]}'
{"id":"openstack%2Fkeystone~998102","triplet_id":"openstack%2Fkeystone~master~I06e66a44b69c52ca60a6c1fc85bd072e6364763b","project":"openstack/keystone","branch":"master","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-05 10:09:03.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I06e66a44b69c52ca60a6c1fc85bd072e6364763b","subject":"Cap trust-scoped token expiry at trust expiry","status":"NEW","created":"2026-07-21 09:54:34.000000000","updated":"2026-08-05 10:09:03.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"4a6e6d19d21931ca159e11b5de75adb6e5d6a9ea","_number":998102,"virtual_id_number":998102,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-07-21 11:16:36.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-08-05 10:09:03.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-07-21 10:57:00.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-07-21 11:16:36.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-05 10:09:03.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"4ff56ebdb5794610344de05f09528c618e9b26b6","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-21 09:54:34.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"f6673565fd9dfc6e29049ecc7d47ee8def9388c2","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-21 09:55:46.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":1},{"id":"394d2d4e01a4a1fb4ac062ffc890b418ea59cddb","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-21 10:57:00.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8cbc968b8a844d93ba95140c184b3765\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/fe5227e943d04f5a8b910f08367ae057 : SUCCESS in 17m 03s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/67ede4098e7a4e3da4e800c3a040b264 : SUCCESS in 15m 31s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/5583a82552df4c0fbaaed00dc116c3e7 : SUCCESS in 36m 43s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"8b0be812cc83e72e2fb7cd74c7e0461a9189401d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-21 11:16:36.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/09b6c16728bb403b9f6816efe160af61\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/3d57d76b4a8a47a1b59b32cb3ad9d24f : SUCCESS in 20m 47s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5f91ba96a5204fe7a21b3ecc19d2ae21 : SUCCESS in 5m 32s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/80b27a31ecbb4409bdb92039bbef289c : SUCCESS in 9m 43s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/62b3ac1481b741b293c63b44dadb8de9 : SUCCESS in 9m 00s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/6479ec67718c4a00836b49035f25b4c2 : SUCCESS in 13m 02s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/705361203eb84008a6fbd68d6f021a3d : SUCCESS in 12m 09s\n- grenade https://zuul.opendev.org/t/openstack/build/47b4fa7099ca447387829566a7bdacf9 : SUCCESS in 1h 07m 55s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/cb919f4c963e467e89b8bd281fb8b21a : SUCCESS in 1h 20m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/bf61e400c4c64c55b2a6178e1e3b6d62 : SUCCESS in 12m 25s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9286657dd0d44c62ad28121857efc380 : SUCCESS in 17m 54s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b828c5a5a3ea422a94c1dfc8a8756cd7 : SUCCESS in 1h 02m 54s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/223d1d9e2d584d8bb395b87a16af9697 : FAILURE in 21m 49s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/2f4e2baba6cc41aa83438f23a6920cb4 : FAILURE in 25m 26s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/9dab65ae34c54046af35fe1e4480a6c0 : SUCCESS in 46m 48s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/d5f336ad386e4f1e964fff31f0740a49 : SUCCESS in 44m 12s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/f7197f5aa03648c2b540ff3719233adf : SUCCESS in 37m 28s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/14986eb734304e12a539cb6fd869032d : SUCCESS in 59m 58s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/82bb8f7192404167ad8780a513a17021 : SUCCESS in 54m 02s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/7a866e219fa143818ac8aae778c3297f : SUCCESS in 9m 34s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"4a6e6d19d21931ca159e11b5de75adb6e5d6a9ea","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-05 10:09:03.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"c61e46f857feb92738be10400504218d6bcfb140","revisions":{"c61e46f857feb92738be10400504218d6bcfb140":{"kind":"REWORK","_number":1,"created":"2026-07-21 09:54:34.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/02/998102/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/02/998102/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/998102/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/998102/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/998102/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/02/998102/1"}}},"commit":{"parents":[{"commit":"30ef2ffa65a3486ef882f00538e20f2253c57d4c","subject":"Merge \"Make JWT token signing algorithm configurable\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/30ef2ffa65a3486ef882f00538e20f2253c57d4c"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-20 08:49:18.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 09:54:03.000000000","tz":120},"subject":"Cap trust-scoped token expiry at trust expiry","message":"Cap trust-scoped token expiry at trust expiry\n\nWhen a trust-scoped token is issued, its expiration was not capped at\nthe trust\u0027s expires_at. A trust that expires in 60 seconds would issue\na token valid for the full default token duration (typically 1 hour),\nand that token remained valid for the full hour even after the trust\nitself expired, because validate_token() only checks the token\u0027s own\nexpires_at field and never re-validates the trust\u0027s expiry.\n\nThis is the trust equivalent of CVE-2022-2447 (LP#1992183), which\ncapped application credential token expiry at the application\ncredential\u0027s own expires_at in issue_token(). Trusts were not covered\nby that fix.\n\nA trust granted for a short maintenance window now correctly issues\ntokens that expire no later than the trust itself, matching the\nexisting behavior for application credentials.\n\nCloses-Bug: #2156586\nChange-Id: I06e66a44b69c52ca60a6c1fc85bd072e6364763b\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c61e46f857feb92738be10400504218d6bcfb140"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c61e46f857feb92738be10400504218d6bcfb140"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}