)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"3d013319_ccc9cbb8","updated":"2026-06-29 16:01:54.000000000","message":"Thank you, Takashi.  All changes implemented in the latest patchset.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"2c0940d9_8be4a562","updated":"2026-06-15 17:18:50.000000000","message":"The logic update looks good to me know, but I have several suggestions regarding documentation updates.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"7e888fcb841197ecbfc7d71c7d916831c1ebd16c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"a7ed1899_07d29dc4","updated":"2026-07-10 14:40:51.000000000","message":"It says \"The validate_ssl_version class method is kept as a no-op for API compatibility during the deprecation period\", but it\u0027s actually removed entirely in the diff","commit_id":"1d3d2ffe2ec9174732e7c8ae87cfbfe344f9c7a7"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"abdb43c5587b74575b7268775f2b7c8bec8bbc79","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"3c602d92_57d59d2c","in_reply_to":"a7ed1899_07d29dc4","updated":"2026-07-21 11:33:04.000000000","message":"Good catch, thanks. The commit message was stale from an earlier patchset where the method was kept. Fixed and now it states the method was removed.","commit_id":"1d3d2ffe2ec9174732e7c8ae87cfbfe344f9c7a7"}],"oslo_messaging/_drivers/impl_rabbit.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d004e5f92756cef3d02fce327a2a0fcf30797b2d","unresolved":true,"context_lines":[{"line_number":38,"context_line":"from oslo_log import log as logging"},{"line_number":39,"context_line":"from oslo_utils import eventletutils"},{"line_number":40,"context_line":"from oslo_utils import netutils"},{"line_number":41,"context_line":"from oslo_utils import versionutils"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"import oslo_messaging"},{"line_number":44,"context_line":"from oslo_messaging._drivers import amqp as rpc_amqp"}],"source_content_type":"text/x-python","patch_set":2,"id":"1dc04ae8_0762ef44","line":41,"range":{"start_line":41,"start_character":0,"end_line":41,"end_character":35},"updated":"2026-06-03 14:05:07.000000000","message":"I\u0027m afraid you include an irrelevant change ?","commit_id":"9004d73344cf84db427552c5f1257b99c384b2dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"e0e24e6102b813002f303566dc0a94e73b7e3a4b","unresolved":true,"context_lines":[{"line_number":38,"context_line":"from oslo_log import log as logging"},{"line_number":39,"context_line":"from oslo_utils import eventletutils"},{"line_number":40,"context_line":"from oslo_utils import netutils"},{"line_number":41,"context_line":"from oslo_utils import versionutils"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"import oslo_messaging"},{"line_number":44,"context_line":"from oslo_messaging._drivers import amqp as rpc_amqp"}],"source_content_type":"text/x-python","patch_set":2,"id":"093bbbf4_2e220a9a","line":41,"range":{"start_line":41,"start_character":0,"end_line":41,"end_character":35},"in_reply_to":"01b718ee_38ebd0ce","updated":"2026-06-04 14:55:29.000000000","message":"I don\u0027t get your point. Could you please explain how that \"migration to SSLContext enables ssl_enforce_hostname_verification\" ?\n\nI believe we have already merged the required fixes for SSL problems during failover, and didn\u0027t expect anything additionally caused this change. For example after we merged https://review.opendev.org/c/openstack/oslo.messaging/+/989344 we always require kombu\u003e\u003d5.2.0 and that version check does not make any sense to me.","commit_id":"9004d73344cf84db427552c5f1257b99c384b2dc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"39d5f091e77109b9ae33f3be7130412439e4e9de","unresolved":false,"context_lines":[{"line_number":38,"context_line":"from oslo_log import log as logging"},{"line_number":39,"context_line":"from oslo_utils import eventletutils"},{"line_number":40,"context_line":"from oslo_utils import netutils"},{"line_number":41,"context_line":"from oslo_utils import versionutils"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"import oslo_messaging"},{"line_number":44,"context_line":"from oslo_messaging._drivers import amqp as rpc_amqp"}],"source_content_type":"text/x-python","patch_set":2,"id":"eb23d6c5_cf8348f0","line":41,"range":{"start_line":41,"start_character":0,"end_line":41,"end_character":35},"in_reply_to":"093bbbf4_2e220a9a","updated":"2026-06-05 12:21:01.000000000","message":"You are right, and I apologize for the confusion. The Kombu version check was unnecessary since patch 989344 already requires kombu \u003e\u003d 5.2.0. I should have checked the current requirements before adding that logic. Removed the version check, the `importlib.metadata` import, and the `versionutils` import entirely. `_get_ssl_server_hostname()` now returns None directly for multi-host setups, relying on Kombu\u0027s built-in hostname substitution.","commit_id":"9004d73344cf84db427552c5f1257b99c384b2dc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"297145f4a09ec293b93dcc595942f642c8eb36cc","unresolved":false,"context_lines":[{"line_number":38,"context_line":"from oslo_log import log as logging"},{"line_number":39,"context_line":"from oslo_utils import eventletutils"},{"line_number":40,"context_line":"from oslo_utils import netutils"},{"line_number":41,"context_line":"from oslo_utils import versionutils"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"import oslo_messaging"},{"line_number":44,"context_line":"from oslo_messaging._drivers import amqp as rpc_amqp"}],"source_content_type":"text/x-python","patch_set":2,"id":"01b718ee_38ebd0ce","line":41,"range":{"start_line":41,"start_character":0,"end_line":41,"end_character":35},"in_reply_to":"1dc04ae8_0762ef44","updated":"2026-06-04 13:32:19.000000000","message":"The `versionutils` import is used at L936 inside `_get_ssl_server_hostname()` to check the Kombu version for multi-host TLS hostname verification. This logic was added because the migration to `SSLContext` enables `ssl_enforce_hostname_verification`, which needs to resolve the correct broker hostname during failover. Happy to split into a separate patch if you prefer.","commit_id":"9004d73344cf84db427552c5f1257b99c384b2dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d004e5f92756cef3d02fce327a2a0fcf30797b2d","unresolved":true,"context_lines":[{"line_number":917,"context_line":"        return self.amqp_durable_queues or self.rabbit_quorum_queue"},{"line_number":918,"context_line":""},{"line_number":919,"context_line":"    @classmethod"},{"line_number":920,"context_line":"    def validate_ssl_version(cls, version):"},{"line_number":921,"context_line":"        \"\"\"No-op kept for API compatibility during deprecation period.\"\"\""},{"line_number":922,"context_line":"        pass"},{"line_number":923,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"abfdc7f2_b5648e5d","line":920,"range":{"start_line":920,"start_character":8,"end_line":920,"end_character":28},"updated":"2026-06-03 14:05:07.000000000","message":"Can we add a warning message to indicate this is deprecated ? We could even remove it though, seeing this is only used internally atm.","commit_id":"9004d73344cf84db427552c5f1257b99c384b2dc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"297145f4a09ec293b93dcc595942f642c8eb36cc","unresolved":false,"context_lines":[{"line_number":917,"context_line":"        return self.amqp_durable_queues or self.rabbit_quorum_queue"},{"line_number":918,"context_line":""},{"line_number":919,"context_line":"    @classmethod"},{"line_number":920,"context_line":"    def validate_ssl_version(cls, version):"},{"line_number":921,"context_line":"        \"\"\"No-op kept for API compatibility during deprecation period.\"\"\""},{"line_number":922,"context_line":"        pass"},{"line_number":923,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"53abc680_af93fff7","line":920,"range":{"start_line":920,"start_character":8,"end_line":920,"end_character":28},"in_reply_to":"abfdc7f2_b5648e5d","updated":"2026-06-04 13:32:19.000000000","message":"Done. Added a `LOG.warning` indicating this method is deprecated and will be removed in a future release.","commit_id":"9004d73344cf84db427552c5f1257b99c384b2dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"81289462e299f3a71cf6bef17e7a55ecd7bbb53d","unresolved":true,"context_lines":[{"line_number":93,"context_line":"                    \u0027(valid only if SSL enabled).\u0027),"},{"line_number":94,"context_line":"    cfg.BoolOpt(\u0027ssl_enforce_hostname_verification\u0027,"},{"line_number":95,"context_line":"                default\u003dTrue,"},{"line_number":96,"context_line":"                deprecated_for_removal\u003dTrue,"},{"line_number":97,"context_line":"                deprecated_reason\u003d\u0027Hostname verification should remain \u0027"},{"line_number":98,"context_line":"                                  \u0027enabled once operators have completed \u0027"},{"line_number":99,"context_line":"                                  \u0027the migration.\u0027,"},{"line_number":100,"context_line":"                help\u003d\u0027When true, verify the broker hostname against the \u0027"},{"line_number":101,"context_line":"                     \u0027certificate when ``ssl_ca_file`` is set. When false, \u0027"},{"line_number":102,"context_line":"                     \u0027``ssl`` with ``ssl_ca_file`` still validates the \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"07e0be6c_97abb0c6","line":99,"range":{"start_line":96,"start_character":44,"end_line":99,"end_character":51},"updated":"2026-06-05 14:00:40.000000000","message":"What\u0027s the reason of this change ?","commit_id":"9f4539f0c4b96f875059ae17157d4d8790d2ea50"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"0db9dcfe9668f4be1531f9d381ea95908671e7ff","unresolved":false,"context_lines":[{"line_number":93,"context_line":"                    \u0027(valid only if SSL enabled).\u0027),"},{"line_number":94,"context_line":"    cfg.BoolOpt(\u0027ssl_enforce_hostname_verification\u0027,"},{"line_number":95,"context_line":"                default\u003dTrue,"},{"line_number":96,"context_line":"                deprecated_for_removal\u003dTrue,"},{"line_number":97,"context_line":"                deprecated_reason\u003d\u0027Hostname verification should remain \u0027"},{"line_number":98,"context_line":"                                  \u0027enabled once operators have completed \u0027"},{"line_number":99,"context_line":"                                  \u0027the migration.\u0027,"},{"line_number":100,"context_line":"                help\u003d\u0027When true, verify the broker hostname against the \u0027"},{"line_number":101,"context_line":"                     \u0027certificate when ``ssl_ca_file`` is set. When false, \u0027"},{"line_number":102,"context_line":"                     \u0027``ssl`` with ``ssl_ca_file`` still validates the \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"2c0861e8_816d6fc3","line":99,"range":{"start_line":96,"start_character":44,"end_line":99,"end_character":51},"in_reply_to":"07e0be6c_97abb0c6","updated":"2026-06-15 13:52:54.000000000","message":"You\u0027re right, this was an unintentional revert of your change in patch 989344. Fixed in the latest patchset - the `deprecated_reason` now matches master (\"Verification is always enabled now\").ed.","commit_id":"9f4539f0c4b96f875059ae17157d4d8790d2ea50"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"81289462e299f3a71cf6bef17e7a55ecd7bbb53d","unresolved":true,"context_lines":[{"line_number":762,"context_line":"            self.ssl_version \u003d driver_conf.ssl_version"},{"line_number":763,"context_line":"            self.ssl_key_file \u003d driver_conf.ssl_key_file"},{"line_number":764,"context_line":"            self.ssl_cert_file \u003d driver_conf.ssl_cert_file"},{"line_number":765,"context_line":"            self.ssl_ca_file \u003d driver_conf.ssl_ca_file"},{"line_number":766,"context_line":"            self.ssl_enforce_hostname_verification \u003d ("},{"line_number":767,"context_line":"                driver_conf.ssl_enforce_hostname_verification)"},{"line_number":768,"context_line":"            self.ssl_server_hostname \u003d None"},{"line_number":769,"context_line":"            if (self.ssl_ca_file and self.ssl_enforce_hostname_verification):"},{"line_number":770,"context_line":"                self.ssl_server_hostname \u003d self._get_ssl_server_hostname(url)"}],"source_content_type":"text/x-python","patch_set":4,"id":"04f257a3_1d89a9f2","line":767,"range":{"start_line":765,"start_character":54,"end_line":767,"end_character":62},"updated":"2026-06-05 14:00:40.000000000","message":"Same here. It reverts the earlier change of kombu version bump","commit_id":"9f4539f0c4b96f875059ae17157d4d8790d2ea50"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"0db9dcfe9668f4be1531f9d381ea95908671e7ff","unresolved":false,"context_lines":[{"line_number":762,"context_line":"            self.ssl_version \u003d driver_conf.ssl_version"},{"line_number":763,"context_line":"            self.ssl_key_file \u003d driver_conf.ssl_key_file"},{"line_number":764,"context_line":"            self.ssl_cert_file \u003d driver_conf.ssl_cert_file"},{"line_number":765,"context_line":"            self.ssl_ca_file \u003d driver_conf.ssl_ca_file"},{"line_number":766,"context_line":"            self.ssl_enforce_hostname_verification \u003d ("},{"line_number":767,"context_line":"                driver_conf.ssl_enforce_hostname_verification)"},{"line_number":768,"context_line":"            self.ssl_server_hostname \u003d None"},{"line_number":769,"context_line":"            if (self.ssl_ca_file and self.ssl_enforce_hostname_verification):"},{"line_number":770,"context_line":"                self.ssl_server_hostname \u003d self._get_ssl_server_hostname(url)"}],"source_content_type":"text/x-python","patch_set":4,"id":"0f1c67ff_60e50e21","line":767,"range":{"start_line":765,"start_character":54,"end_line":767,"end_character":62},"in_reply_to":"04f257a3_1d89a9f2","updated":"2026-06-15 13:52:54.000000000","message":"You\u0027re right, this was an unintentional revert of the unconditional hostname verification you introduced in patch 989344. Fixed in the latest patchset - `ssl_server_hostname` is now set unconditionally, matching master.","commit_id":"9f4539f0c4b96f875059ae17157d4d8790d2ea50"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":true,"context_lines":[{"line_number":70,"context_line":"    cfg.StrOpt(\u0027ssl_version\u0027,"},{"line_number":71,"context_line":"               default\u003d\u0027\u0027,"},{"line_number":72,"context_line":"               deprecated_for_removal\u003dTrue,"},{"line_number":73,"context_line":"               deprecated_reason\u003d\u0027Individual TLS protocol version selection \u0027"},{"line_number":74,"context_line":"                                 \u0027via ssl.PROTOCOL_* constants is deprecated \u0027"},{"line_number":75,"context_line":"                                 \u0027in Python. The driver now negotiates the \u0027"},{"line_number":76,"context_line":"                                 \u0027highest TLS version supported by both \u0027"},{"line_number":77,"context_line":"                                 \u0027endpoints (TLS 1.2 or 1.3). This option \u0027"},{"line_number":78,"context_line":"                                 \u0027is ignored.\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"6093f50a_addc1b6f","line":75,"range":{"start_line":73,"start_character":34,"end_line":75,"end_character":44},"updated":"2026-06-15 17:18:50.000000000","message":"This is too much internal detail and actually the selction is not deprecated but is removed.. Lets remove this.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    cfg.StrOpt(\u0027ssl_version\u0027,"},{"line_number":71,"context_line":"               default\u003d\u0027\u0027,"},{"line_number":72,"context_line":"               deprecated_for_removal\u003dTrue,"},{"line_number":73,"context_line":"               deprecated_reason\u003d\u0027Individual TLS protocol version selection \u0027"},{"line_number":74,"context_line":"                                 \u0027via ssl.PROTOCOL_* constants is deprecated \u0027"},{"line_number":75,"context_line":"                                 \u0027in Python. The driver now negotiates the \u0027"},{"line_number":76,"context_line":"                                 \u0027highest TLS version supported by both \u0027"},{"line_number":77,"context_line":"                                 \u0027endpoints (TLS 1.2 or 1.3). This option \u0027"},{"line_number":78,"context_line":"                                 \u0027is ignored.\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"f436b1d6_0a9dc8c3","line":75,"range":{"start_line":73,"start_character":34,"end_line":75,"end_character":44},"in_reply_to":"6093f50a_addc1b6f","updated":"2026-06-29 16:01:54.000000000","message":"Done","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":true,"context_lines":[{"line_number":900,"context_line":""},{"line_number":901,"context_line":"    # NOTE(mharley): the legacy _SSL_PROTOCOLS / _OPTIONAL_PROTOCOLS maps"},{"line_number":902,"context_line":"    # were removed; TLS version is now negotiated by py-amqp via"},{"line_number":903,"context_line":"    # ssl.PROTOCOL_TLS_CLIENT (TLS 1.2+)."},{"line_number":904,"context_line":""},{"line_number":905,"context_line":"    @property"},{"line_number":906,"context_line":"    def durable(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"b07a5665_2bbfcc91","line":903,"updated":"2026-06-15 17:18:50.000000000","message":"We don\u0027t have to record this here.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[{"line_number":900,"context_line":""},{"line_number":901,"context_line":"    # NOTE(mharley): the legacy _SSL_PROTOCOLS / _OPTIONAL_PROTOCOLS maps"},{"line_number":902,"context_line":"    # were removed; TLS version is now negotiated by py-amqp via"},{"line_number":903,"context_line":"    # ssl.PROTOCOL_TLS_CLIENT (TLS 1.2+)."},{"line_number":904,"context_line":""},{"line_number":905,"context_line":"    @property"},{"line_number":906,"context_line":"    def durable(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"83954521_e3306dfb","line":903,"in_reply_to":"b07a5665_2bbfcc91","updated":"2026-06-29 16:01:54.000000000","message":"Done","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":true,"context_lines":[{"line_number":940,"context_line":""},{"line_number":941,"context_line":"    def _fetch_ssl_params(self):"},{"line_number":942,"context_line":"        \"\"\"Handles fetching what ssl params should be used for the connection"},{"line_number":943,"context_line":"        (if any)."},{"line_number":944,"context_line":""},{"line_number":945,"context_line":"        When no explicit ssl_version is supplied (the recommended default),"},{"line_number":946,"context_line":"        py-amqp creates an ``ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)``"},{"line_number":947,"context_line":"        which negotiates TLS 1.2 or 1.3 — the minimum required for"},{"line_number":948,"context_line":"        PQC hybrid key exchange."},{"line_number":949,"context_line":"        \"\"\""},{"line_number":950,"context_line":"        if self.ssl:"},{"line_number":951,"context_line":"            ssl_params \u003d dict()"}],"source_content_type":"text/x-python","patch_set":5,"id":"59dddd33_d1f3ec7d","line":948,"range":{"start_line":943,"start_character":17,"end_line":948,"end_character":32},"updated":"2026-06-15 17:18:50.000000000","message":"I\u0027d suggest adding this as a NOTE in L952, rather than method documentation.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[{"line_number":940,"context_line":""},{"line_number":941,"context_line":"    def _fetch_ssl_params(self):"},{"line_number":942,"context_line":"        \"\"\"Handles fetching what ssl params should be used for the connection"},{"line_number":943,"context_line":"        (if any)."},{"line_number":944,"context_line":""},{"line_number":945,"context_line":"        When no explicit ssl_version is supplied (the recommended default),"},{"line_number":946,"context_line":"        py-amqp creates an ``ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)``"},{"line_number":947,"context_line":"        which negotiates TLS 1.2 or 1.3 — the minimum required for"},{"line_number":948,"context_line":"        PQC hybrid key exchange."},{"line_number":949,"context_line":"        \"\"\""},{"line_number":950,"context_line":"        if self.ssl:"},{"line_number":951,"context_line":"            ssl_params \u003d dict()"}],"source_content_type":"text/x-python","patch_set":5,"id":"3dba4bdf_81c60a76","line":948,"range":{"start_line":943,"start_character":17,"end_line":948,"end_character":32},"in_reply_to":"59dddd33_d1f3ec7d","updated":"2026-06-29 16:01:54.000000000","message":"Done","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"}],"releasenotes/notes/migrate-rabbit-ssl-to-sslcontext-a7f3c2e91d04b8e0.yaml":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":true,"context_lines":[{"line_number":2,"context_line":"deprecations:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The ``[oslo_messaging_rabbit] ssl_version`` configuration option is now"},{"line_number":5,"context_line":"    deprecated and ignored.  The RabbitMQ driver no longer passes an explicit"},{"line_number":6,"context_line":"    ``ssl.PROTOCOL_*`` constant to py-amqp, so TLS protocol negotiation uses"},{"line_number":7,"context_line":"    ``ssl.PROTOCOL_TLS_CLIENT`` which automatically negotiates the highest"},{"line_number":8,"context_line":"    mutually supported version (TLS 1.2 or 1.3)."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"    Deployments should remove ``ssl_version`` from their configuration files."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"6bcf1479_00b2533c","line":7,"range":{"start_line":5,"start_character":29,"end_line":7,"end_character":37},"updated":"2026-06-15 17:18:50.000000000","message":"This is internal detail which may not be helpful to users. Just mention \"The RabbitMQ driver now automatically negotiates...\"","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[{"line_number":2,"context_line":"deprecations:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The ``[oslo_messaging_rabbit] ssl_version`` configuration option is now"},{"line_number":5,"context_line":"    deprecated and ignored.  The RabbitMQ driver no longer passes an explicit"},{"line_number":6,"context_line":"    ``ssl.PROTOCOL_*`` constant to py-amqp, so TLS protocol negotiation uses"},{"line_number":7,"context_line":"    ``ssl.PROTOCOL_TLS_CLIENT`` which automatically negotiates the highest"},{"line_number":8,"context_line":"    mutually supported version (TLS 1.2 or 1.3)."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"    Deployments should remove ``ssl_version`` from their configuration files."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3d929991_7dc6f650","line":7,"range":{"start_line":5,"start_character":29,"end_line":7,"end_character":37},"in_reply_to":"6bcf1479_00b2533c","updated":"2026-06-29 16:01:54.000000000","message":"Done","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":true,"context_lines":[{"line_number":10,"context_line":"    Deployments should remove ``ssl_version`` from their configuration files."},{"line_number":11,"context_line":"    The option will be removed in a future release."},{"line_number":12,"context_line":"upgrade:"},{"line_number":13,"context_line":"  - |"},{"line_number":14,"context_line":"    The legacy ``_SSL_PROTOCOLS`` map that translated ``ssl_version`` string"},{"line_number":15,"context_line":"    values (``TLSv1``, ``SSLv23``, etc.) into deprecated ``ssl.PROTOCOL_*``"},{"line_number":16,"context_line":"    constants has been removed.  RabbitMQ TLS connections now rely on"},{"line_number":17,"context_line":"    ``ssl.PROTOCOL_TLS_CLIENT`` (via py-amqp) which supports TLS 1.2 and"},{"line_number":18,"context_line":"    TLS 1.3 by default and sets a minimum of TLS 1.2."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    This change enables PQC (Post-Quantum Cryptography) hybrid key exchange"},{"line_number":21,"context_line":"    algorithms such as X25519MLKEM768 on platforms with OpenSSL 3.5+."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    No configuration changes are required unless ``ssl_version`` was"},{"line_number":24,"context_line":"    explicitly set; in that case, remove the option."},{"line_number":25,"context_line":"security:"},{"line_number":26,"context_line":"  - |"},{"line_number":27,"context_line":"    RabbitMQ TLS connections no longer accept TLS 1.0 or 1.1 when"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"2d4fe632_5225a45b","line":24,"range":{"start_line":13,"start_character":5,"end_line":24,"end_character":52},"updated":"2026-06-15 17:18:50.000000000","message":"_SSL_PROTOCOLS is internal variable and should not appear in release note really.\n\nAlso this is mostly duplicate of the deprecation note so we can remove this. Instead, please mention removal of TLS1.0/1.1 support.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    Deployments should remove ``ssl_version`` from their configuration files."},{"line_number":11,"context_line":"    The option will be removed in a future release."},{"line_number":12,"context_line":"upgrade:"},{"line_number":13,"context_line":"  - |"},{"line_number":14,"context_line":"    The legacy ``_SSL_PROTOCOLS`` map that translated ``ssl_version`` string"},{"line_number":15,"context_line":"    values (``TLSv1``, ``SSLv23``, etc.) into deprecated ``ssl.PROTOCOL_*``"},{"line_number":16,"context_line":"    constants has been removed.  RabbitMQ TLS connections now rely on"},{"line_number":17,"context_line":"    ``ssl.PROTOCOL_TLS_CLIENT`` (via py-amqp) which supports TLS 1.2 and"},{"line_number":18,"context_line":"    TLS 1.3 by default and sets a minimum of TLS 1.2."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    This change enables PQC (Post-Quantum Cryptography) hybrid key exchange"},{"line_number":21,"context_line":"    algorithms such as X25519MLKEM768 on platforms with OpenSSL 3.5+."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    No configuration changes are required unless ``ssl_version`` was"},{"line_number":24,"context_line":"    explicitly set; in that case, remove the option."},{"line_number":25,"context_line":"security:"},{"line_number":26,"context_line":"  - |"},{"line_number":27,"context_line":"    RabbitMQ TLS connections no longer accept TLS 1.0 or 1.1 when"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"afbceae1_2c4ffe9c","line":24,"range":{"start_line":13,"start_character":5,"end_line":24,"end_character":52},"in_reply_to":"2d4fe632_5225a45b","updated":"2026-06-29 16:01:54.000000000","message":"Done","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"30575dfcece8d661731673906dda353760486298","unresolved":true,"context_lines":[{"line_number":24,"context_line":"    explicitly set; in that case, remove the option."},{"line_number":25,"context_line":"security:"},{"line_number":26,"context_line":"  - |"},{"line_number":27,"context_line":"    RabbitMQ TLS connections no longer accept TLS 1.0 or 1.1 when"},{"line_number":28,"context_line":"    ``ssl_version`` is left at its default (empty).  Previously, setting"},{"line_number":29,"context_line":"    ``ssl_version\u003dTLSv1`` or ``ssl_version\u003dSSLv23`` could allow negotiation"},{"line_number":30,"context_line":"    of older, insecure protocol versions.  The driver now enforces a minimum"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"0dc28a57_47845a3f","line":27,"range":{"start_line":27,"start_character":61,"end_line":27,"end_character":65},"updated":"2026-06-15 17:18:50.000000000","message":"This isn\u0027t true, right ? There is no way to enable TLS 1.0 or 1.1 now. Also the upgrade section may be more suitable for this.","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"c278f25c218502f2e94218bcebea6d776da14e24","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    explicitly set; in that case, remove the option."},{"line_number":25,"context_line":"security:"},{"line_number":26,"context_line":"  - |"},{"line_number":27,"context_line":"    RabbitMQ TLS connections no longer accept TLS 1.0 or 1.1 when"},{"line_number":28,"context_line":"    ``ssl_version`` is left at its default (empty).  Previously, setting"},{"line_number":29,"context_line":"    ``ssl_version\u003dTLSv1`` or ``ssl_version\u003dSSLv23`` could allow negotiation"},{"line_number":30,"context_line":"    of older, insecure protocol versions.  The driver now enforces a minimum"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"99def1b7_09d850d8","line":27,"range":{"start_line":27,"start_character":61,"end_line":27,"end_character":65},"in_reply_to":"0dc28a57_47845a3f","updated":"2026-06-29 16:01:54.000000000","message":"Done","commit_id":"5ab672f43d422620cc4bca0339e00d47b6567ffc"}]}