)]}'
{"id":"openstack%2Fossa~971988","triplet_id":"openstack%2Fossa~master~I3f1ded8c991308ee6d30449428b780895223d0b5","project":"openstack/ossa","branch":"master","attention_set":{},"removed_from_attention_set":{"5263":{"account":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"last_update":"2026-03-26 18:53:54.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I3f1ded8c991308ee6d30449428b780895223d0b5","subject":"Admin-only bugs are hardening opportunities","status":"MERGED","created":"2025-12-30 16:12:42.000000000","updated":"2026-03-26 18:54:52.000000000","submitted":"2026-03-26 18:53:54.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"971988","meta_rev_id":"e40aac38ac73e15a57949048560489e908fa4f8e","_number":971988,"virtual_id_number":971988,"owner":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},{"value":0,"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},{"value":0,"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-03-26 18:53:54.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"all":[{"value":2,"date":"2026-03-26 18:38:35.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},{"value":2,"date":"2026-03-26 18:38:47.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},{"value":2,"date":"2026-03-26 18:38:35.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"all":[{"value":0,"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},{"value":1,"date":"2026-03-26 18:38:47.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},{"value":0,"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-12-30 16:15:46.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-01-08 16:38:26.000000000","updated_by":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"reviewer":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"state":"REVIEWER"},{"updated":"2026-01-12 14:51:01.000000000","updated_by":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"reviewer":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"state":"REVIEWER"},{"updated":"2026-03-26 18:38:47.000000000","updated_by":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"reviewer":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"state":"REVIEWER"}],"messages":[{"id":"578d5edb4aec9d2e5f4736029cbf3437ef03a001","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"date":"2025-12-30 16:12:42.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"5901e151ce532ba27959c11b5c030458f21682f8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-30 16:15:46.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a031c2bbfb4b422e88388e9689c17482\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ae10d0b08d7442f285305297534369a5 : SUCCESS in 2m 26s","accounts_in_message":[],"_revision_number":1},{"id":"5ae5cdeb10c18a41439db762c722a6ea2711a753","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-01-08 16:38:26.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"fc04fcfb42104ce90f5040051f3fe6a563626fd5","author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"date":"2026-01-12 14:51:01.000000000","message":"Patch Set 1: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"9629620de2295c66f7b76ffc96d521a61c82b9af","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"real_author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-03-26 18:38:35.000000000","message":"Patch Set 2: Patch Set 1 was rebased on behalf of \u003cGERRIT_ACCOUNT_5263\u003e\n\nCopied Votes:\n* Code-Review+2 (copy condition: \"**changekind:TRIVIAL_REBASE** OR is:MIN\")\n\nOutdated Votes:\n* Verified+1\n","accounts_in_message":[{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"}],"_revision_number":2},{"id":"6dd468b518f0ef678fb52a5c21464e621924e13b","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-03-26 18:38:47.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"6eff3f7fba3a260a9bc52c94da7a83b028823eb0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-26 18:46:59.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/545e9d522b754c0a86da2d6c05f1ecac\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/311546540651409fbf4fff04170f3ea8 : SUCCESS in 3m 07s","accounts_in_message":[],"_revision_number":2},{"id":"53097f8a66e74bc31c59d1594a9a7280b2197bee","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-26 18:47:47.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"46a3571c2af8f7c54a6efea339ec119ca18010d9","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-26 18:53:54.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/59234a3f892043a2abb1321a55b8fbcf\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fb7dabf383be4dc3b17072e20c0f6546 : SUCCESS in 4m 49s","accounts_in_message":[],"_revision_number":2},{"id":"744d3f58383bcb6ead6c18c56641786e5ef0f75c","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-26 18:53:54.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"e40aac38ac73e15a57949048560489e908fa4f8e","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-03-26 18:54:52.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/09210d1b586f4654b4b5a0da908a82f1\n\n- promote-security https://zuul.opendev.org/t/openstack/build/bf72311add754680b22b37dc5665ba98 : SUCCESS in 40s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"a757db28fb2eba407f06f460b28d2c706a3cbeb3","revisions":{"86ccc8beb59f6da0259819a6a71a0fa6622d877a":{"kind":"REWORK","_number":1,"created":"2025-12-30 16:12:42.000000000","uploader":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"ref":"refs/changes/88/971988/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ossa","ref":"refs/changes/88/971988/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ossa refs/changes/88/971988/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ossa refs/changes/88/971988/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ossa refs/changes/88/971988/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ossa refs/changes/88/971988/1"}}},"commit":{"parents":[{"commit":"59792bf0d431103a5abe96fc7deb650436324a86","subject":"Automated reports are not vulnerabilities","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ossa/commit/59792bf0d431103a5abe96fc7deb650436324a86"}]}],"author":{"name":"Jeremy Stanley","email":"fungi@yuggoth.org","date":"2025-12-30 16:08:12.000000000","tz":0},"committer":{"name":"Jeremy Stanley","email":"fungi@yuggoth.org","date":"2025-12-30 16:08:12.000000000","tz":0},"subject":"Admin-only bugs are hardening opportunities","message":"Admin-only bugs are hardening opportunities\n\nWe\u0027ve treated \"admin-only\" exploitable bugs as security hardening\nopportunities since there are countless ways a system-wide\nadministrator can cause trouble in an OpenStack deployment. Our\nprojects often make no attempt to guarantee that administrator API\nfunctions are safe from granting access at the operating system\nlevel (see unfinished rootwrap/privsep transition), and admin\nprivileges should never be granted to untrusted users.\n\nChange-Id: I3f1ded8c991308ee6d30449428b780895223d0b5\nSigned-off-by: Jeremy Stanley \u003cfungi@yuggoth.org\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ossa/commit/86ccc8beb59f6da0259819a6a71a0fa6622d877a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ossa/commit/86ccc8beb59f6da0259819a6a71a0fa6622d877a"}]},"branch":"refs/heads/master"},"a757db28fb2eba407f06f460b28d2c706a3cbeb3":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-03-26 18:38:35.000000000","uploader":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"real_uploader":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"ref":"refs/changes/88/971988/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/ossa","ref":"refs/changes/88/971988/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/ossa refs/changes/88/971988/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/ossa refs/changes/88/971988/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/ossa refs/changes/88/971988/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/ossa refs/changes/88/971988/2"}}},"commit":{"parents":[{"commit":"eaef018d9f66af917918794149874eb03995a7d7","subject":"Merge \"Add Goutham Pacha Ravi to the VMT member list\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ossa/commit/eaef018d9f66af917918794149874eb03995a7d7"}]}],"author":{"name":"Jeremy Stanley","email":"fungi@yuggoth.org","date":"2025-12-30 16:08:12.000000000","tz":0},"committer":{"name":"Jeremy Stanley","email":"fungi@yuggoth.org","date":"2026-03-26 18:38:35.000000000","tz":0},"subject":"Admin-only bugs are hardening opportunities","message":"Admin-only bugs are hardening opportunities\n\nWe\u0027ve treated \"admin-only\" exploitable bugs as security hardening\nopportunities since there are countless ways a system-wide\nadministrator can cause trouble in an OpenStack deployment. Our\nprojects often make no attempt to guarantee that administrator API\nfunctions are safe from granting access at the operating system\nlevel (see unfinished rootwrap/privsep transition), and admin\nprivileges should never be granted to untrusted users.\n\nChange-Id: I3f1ded8c991308ee6d30449428b780895223d0b5\nSigned-off-by: Jeremy Stanley \u003cfungi@yuggoth.org\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ossa/commit/a757db28fb2eba407f06f460b28d2c706a3cbeb3"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/ossa/commit/a757db28fb2eba407f06f460b28d2c706a3cbeb3"}]},"branch":"refs/heads/master","description":"Rebase"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}