)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":14394,"name":"Dale Smith","email":"dale@catalystcloud.nz","username":"dalees"},"change_message_id":"25fb66ceb28a89887a506a952fd183f5d9d13509","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"cbd0926c_a4dde159","updated":"2025-02-11 22:43:58.000000000","message":"Hi Rico, thanks for the patch. Certainly looks wrongly defined as it is written, though I\u0027ve not encountered this error yet!","commit_id":"f622116fbdcae12e33fe89f279d6a7a96216da2c"},{"author":{"_account_id":12404,"name":"Rico Lin","email":"ricolin@ricolky.com","username":"rico.lin"},"change_message_id":"d55d5ac186c4eb81379c3c33bfefe869bf544d48","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"a9808f1e_284d641a","in_reply_to":"cbd0926c_a4dde159","updated":"2025-02-18 05:10:41.000000000","message":"Done","commit_id":"f622116fbdcae12e33fe89f279d6a7a96216da2c"}],"magnum/common/keystone.py":[{"author":{"_account_id":14394,"name":"Dale Smith","email":"dale@catalystcloud.nz","username":"dalees"},"change_message_id":"25fb66ceb28a89887a506a952fd183f5d9d13509","unresolved":true,"context_lines":[{"line_number":211,"context_line":"                project\u003dtrustor_project_id,"},{"line_number":212,"context_line":"                trustee_user\u003dtrustee_user,"},{"line_number":213,"context_line":"                impersonation\u003dTrue,"},{"line_number":214,"context_line":"                redelegation_count\u003d0,"},{"line_number":215,"context_line":"                role_names\u003droles)"},{"line_number":216,"context_line":"        except Exception:"},{"line_number":217,"context_line":"            LOG.exception(\u0027Failed to create trust\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"fd3c0d35_2c31881d","line":214,"updated":"2025-02-11 22:43:58.000000000","message":"I\u0027d prefer to see `allow_redelegation\u003dFalse` here, or just drop the parameter entirely?\n\nIt feels like the author of this code intended to disable redelegation on the created trust to reduce the impact of a CVE[1] - though it is already the default. I think this would be easier to read using `allow_redelegation\u003dFalse`.\n\nSetting the field `redelegation_count` to zero appears to ultimately do the same thing in Keystone codebase[2][3], but is less readable in the Magnum codebase (I had to read a lot to understand it was the allowed count rather than how many redelegations had been performed, and that zero meant the same as not allowed).\n\n\n[1] https://review.opendev.org/c/openstack/magnum/+/437051\n[2] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/kilo/trusts-redelegation.html\n[3] https://github.com/openstack/keystone/blob/20484381c71ed903c639386f2b73b031a11e334b/keystone/trust/core.py#L158","commit_id":"f622116fbdcae12e33fe89f279d6a7a96216da2c"},{"author":{"_account_id":12404,"name":"Rico Lin","email":"ricolin@ricolky.com","username":"rico.lin"},"change_message_id":"d55d5ac186c4eb81379c3c33bfefe869bf544d48","unresolved":false,"context_lines":[{"line_number":211,"context_line":"                project\u003dtrustor_project_id,"},{"line_number":212,"context_line":"                trustee_user\u003dtrustee_user,"},{"line_number":213,"context_line":"                impersonation\u003dTrue,"},{"line_number":214,"context_line":"                redelegation_count\u003d0,"},{"line_number":215,"context_line":"                role_names\u003droles)"},{"line_number":216,"context_line":"        except Exception:"},{"line_number":217,"context_line":"            LOG.exception(\u0027Failed to create trust\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"0fa09f8c_2122f859","line":214,"in_reply_to":"fd3c0d35_2c31881d","updated":"2025-02-18 05:10:41.000000000","message":"Done","commit_id":"f622116fbdcae12e33fe89f279d6a7a96216da2c"}]}