)]}'
{"id":"openstack%2Foslo.middleware~1002589","triplet_id":"openstack%2Foslo.middleware~master~I696c03ea5118318d5450282992281ca5d29385c1","project":"openstack/oslo.middleware","branch":"master","topic":"deprecate-basic-auth","hashtags":[],"change_id":"I696c03ea5118318d5450282992281ca5d29385c1","subject":"Deprecate basic auth middleware","status":"ABANDONED","created":"2026-08-27 07:30:25.000000000","updated":"2026-08-27 07:39:03.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"1dfb9b01f45990ce4802b1884ee635ced79787e7","_number":1002589,"virtual_id_number":1002589,"owner":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"actions":{},"labels":{"Verified":{"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"values":{"-2":"Do Not Backport","-1":"Not A Backport Candidate"," 0":"Backport Review Needed","+1":"Proposed Backport","+2":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{},"pending_reviewers":{},"reviewer_updates":[],"messages":[{"id":"90b884bd904f0469bed1231639aee9776d43f1b4","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-08-27 07:30:25.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ef2ab94d604f79e90d97cfe54500adb804a2368b","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-08-27 07:33:23.000000000","message":"Uploaded patch set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"b462fe8074f3badd8d67a46d85c19b889737423f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-08-27 07:37:31.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"1dfb9b01f45990ce4802b1884ee635ced79787e7","tag":"autogenerated:gerrit:abandon","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-08-27 07:39:03.000000000","message":"Abandoned\n\nAbandoning for now. This middleware can be enabled through paste configuration alone, without any code referencing it, so the code search this change relied on cannot establish that it has no consumers. Asking on openstack-discuss first; I will restore this or repropose it depending on what comes back.","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"3ec8f25264efde2c0e21a6c9fbead5cae6b5c0e3","revisions":{"3a3993a6b9ebb052c4b3ad387c292ee2602dadc5":{"kind":"REWORK","_number":1,"created":"2026-08-27 07:30:25.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/89/1002589/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/oslo.middleware","ref":"refs/changes/89/1002589/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/1"}}},"commit":{"parents":[{"commit":"464357252b64453aafec004b8c08983907ac7c86","subject":"Merge \"Use typing objects directly\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/464357252b64453aafec004b8c08983907ac7c86"}]}],"author":{"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","date":"2026-08-27 07:15:03.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","date":"2026-08-27 07:30:18.000000000","tz":120},"subject":"Deprecate basic auth middleware","message":"Deprecate basic auth middleware\n\nNothing consumes it. The code was adapted from ironic-lib[1] in 2021 so\nthat ironic and others could share one implementation, but ironic never\nmigrated and still carries its own copy in ironic/common/auth_basic.py,\nwhich also sends WWW-Authenticate and caches credential checks.\nsushy-tools carries a third copy. Searching codesearch.opendev.org,\nwhich indexes all 579 currently governed openstack repositories, finds\nno import of this module, no reference to BasicAuthMiddleware outside\nthose forks, and no use of the egg:oslo.middleware#basic_auth paste\nfilter in any configuration.\n\nThat leaves an authentication path, with the maintenance and security\nexpectations that implies, serving nobody. It also makes bcrypt a hard\nrequirement of a library that most of OpenStack installs, which matters\nfor FIPS deployments: bcrypt is not an approved algorithm, and its\nPython implementation is self contained and never calls into OpenSSL,\nso it cannot fail closed either.\n\nDeprecate rather than remove, since an out of tree consumer cannot be\nruled out by searching. Operators wanting HTTP basic authentication\nshould terminate it in a web server in front of the service, or use\nkeystone.\n\nWarn from BasicAuthMiddleware.__init__ rather than at module scope,\nsince oslo_middleware/__init__.py imports this module and a module\nscope warning would otherwise reach every consumer of the package. The\nSSL middleware deprecation was moved for the same reason[2].\n\n[1] https://review.opendev.org/c/openstack/ironic-lib/+/729070\n[2] 48ca3bda0984e27f88633e74521cc89a20e67f5e\n\nSigned-off-by: Thomas Bechtold \u003cthomas.bechtold@chainguard.dev\u003e\nChange-Id: I696c03ea5118318d5450282992281ca5d29385c1\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/3a3993a6b9ebb052c4b3ad387c292ee2602dadc5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/3a3993a6b9ebb052c4b3ad387c292ee2602dadc5"}]},"branch":"refs/heads/master"},"c57493680dfc0274175b2abc5d8ea78b3c616f02":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2026-08-27 07:33:23.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/89/1002589/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/oslo.middleware","ref":"refs/changes/89/1002589/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/2"}}},"commit":{"parents":[{"commit":"464357252b64453aafec004b8c08983907ac7c86","subject":"Merge \"Use typing objects directly\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/464357252b64453aafec004b8c08983907ac7c86"}]}],"author":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-08-27 07:33:15.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-08-27 07:33:15.000000000","tz":120},"subject":"Deprecate basic auth middleware","message":"Deprecate basic auth middleware\n\nNothing consumes it. The code was adapted from ironic-lib[1] in 2021 so\nthat ironic and others could share one implementation, but ironic never\nmigrated and still carries its own copy in ironic/common/auth_basic.py,\nwhich also sends WWW-Authenticate and caches credential checks.\nsushy-tools carries a third copy. Searching codesearch.opendev.org,\nwhich indexes all 579 currently governed openstack repositories, finds\nno import of this module, no reference to BasicAuthMiddleware outside\nthose forks, and no use of the egg:oslo.middleware#basic_auth paste\nfilter in any configuration.\n\nThat leaves an authentication path, with the maintenance and security\nexpectations that implies, serving nobody. It also makes bcrypt a hard\nrequirement of a library that most of OpenStack installs, which matters\nfor FIPS deployments: bcrypt is not an approved algorithm, and its\nPython implementation is self contained and never calls into OpenSSL,\nso it cannot fail closed either.\n\nDeprecate rather than remove, since an out of tree consumer cannot be\nruled out by searching. Operators wanting HTTP basic authentication\nshould terminate it in a web server in front of the service, or use\nkeystone.\n\nWarn from BasicAuthMiddleware.__init__ rather than at module scope,\nsince oslo_middleware/__init__.py imports this module and a module\nscope warning would otherwise reach every consumer of the package. The\nSSL middleware deprecation was moved for the same reason[2].\n\n[1] https://review.opendev.org/c/openstack/ironic-lib/+/729070\n[2] 48ca3bda0984e27f88633e74521cc89a20e67f5e\n\nSigned-off-by: Thomas Bechtold \u003cthomasbechtold@jpberlin.de\u003e\nChange-Id: I696c03ea5118318d5450282992281ca5d29385c1\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/c57493680dfc0274175b2abc5d8ea78b3c616f02"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/c57493680dfc0274175b2abc5d8ea78b3c616f02"}]},"branch":"refs/heads/master"},"3ec8f25264efde2c0e21a6c9fbead5cae6b5c0e3":{"kind":"REWORK","_number":3,"created":"2026-08-27 07:37:31.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/89/1002589/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/oslo.middleware","ref":"refs/changes/89/1002589/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/oslo.middleware refs/changes/89/1002589/3"}}},"commit":{"parents":[{"commit":"464357252b64453aafec004b8c08983907ac7c86","subject":"Merge \"Use typing objects directly\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/464357252b64453aafec004b8c08983907ac7c86"}]}],"author":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-08-27 07:33:15.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-08-27 07:37:27.000000000","tz":120},"subject":"Deprecate basic auth middleware","message":"Deprecate basic auth middleware\n\nNothing appears to consume this. The code was adapted from ironic-lib[1]\nin 2021 so that ironic and others could share one implementation rather\nthan each carrying a copy. That consolidation never happened: ironic\nstill has its own copy in ironic/common/auth_basic.py, which is also the\nbetter of the two since it sends WWW-Authenticate and caches credential\nchecks, and sushy-tools has a third copy. No change was ever proposed to\nmigrate either onto this one.\n\nSearching codesearch.opendev.org, which indexes all 579 currently\ngoverned openstack repositories, finds no import of this module and no\nreference to BasicAuthMiddleware outside those two forks.\n\nThat only rules out consumers that are code. The middleware is also\nreachable through configuration alone, by adding\n\n  [filter:basic_auth]\n  use \u003d egg:oslo.middleware#basic_auth\n\nto a service api-paste.ini and setting http_basic_auth_user_file, with\nno Python written at all. Such a deployment lives in /etc rather than in\na repository, so no code search can see it. Deprecate rather than remove\nfor that reason, and let the mailing list find what searching cannot.\n\nWarn both through warnings.warn and to the service log. The log matters\nbecause of exactly the consumer we cannot find: at the stack depth paste\ninstantiates the middleware from, the DeprecationWarning is attributed\nto oslo_middleware/base.py rather than __main__, so Python default\nfilters discard it and an operator who enabled this through paste\nconfiguration would be told nothing at all.\n\nWarn from BasicAuthMiddleware.__init__ rather than at module scope,\nsince oslo_middleware/__init__.py imports this module and a module scope\nwarning would otherwise reach every consumer of the package. The SSL\nmiddleware deprecation was moved for the same reason[2].\n\nSeparately, this is what makes bcrypt a hard requirement of a library\nthat most of OpenStack installs, which matters for FIPS deployments:\nbcrypt is not an approved algorithm under FIPS 140-3, and its Python\nimplementation is self contained and never calls into OpenSSL, so it\ncannot fail closed either. Making that dependency optional is left to a\nfollow-up.\n\nOperators wanting HTTP basic authentication should terminate it in a web\nserver in front of the service, or use keystone.\n\n[1] https://review.opendev.org/c/openstack/ironic-lib/+/729070\n[2] 48ca3bda0984e27f88633e74521cc89a20e67f5e\n\nSigned-off-by: Thomas Bechtold \u003cthomasbechtold@jpberlin.de\u003e\nChange-Id: I696c03ea5118318d5450282992281ca5d29385c1\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/3ec8f25264efde2c0e21a6c9fbead5cae6b5c0e3"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/oslo.middleware/commit/3ec8f25264efde2c0e21a6c9fbead5cae6b5c0e3"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Backport-Candidate","description":"Backport candidate status","status":"NOT_APPLICABLE","is_legacy":false,"applicability_expression_result":{"fulfilled":false,"status":"FAIL"},"submittability_expression_result":{"expression":"is:true","fulfilled":true,"status":"NOT_EVALUATED","passing_atoms":[],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}