)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"9168cc2603dfd6d53def5764f506edd7ff1504fe","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"06e7d312_13bcc9c9","updated":"2026-08-22 06:56:21.000000000","message":"recheck depends-on changed","commit_id":"915a7d7ab1332ede5e2ec7d8c91955a2d2e3586a"}],"playbooks/proposal/check_sources.py":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"d53a7a77de0cc7bfb81764353ed73c9b150e59d1","unresolved":true,"context_lines":[{"line_number":198,"context_line":"    return hashes"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"def apply_update(name, info, new_v, new_hashes, sources_path):"},{"line_number":202,"context_line":"    \"\"\"Update version and sha256 entries for one source in sources.py.\"\"\""},{"line_number":203,"context_line":"    with open(sources_path) as f:"},{"line_number":204,"context_line":"        content \u003d f.read()"}],"source_content_type":"text/x-python","patch_set":4,"id":"26b5d7aa_255bc8db","line":201,"updated":"2026-08-21 17:57:03.000000000","message":"See comment below, but wouldn\u0027t using a serializable data format make this portion of the script simpler too? You could simply update the datastructure, serialize it, then write it to disk.","commit_id":"cd5961c1aff5e4ba5b3eb7afa00de77dbc5590b9"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"3476d66b3a6a6ae1f2346a29a4d0d03497a390be","unresolved":false,"context_lines":[{"line_number":198,"context_line":"    return hashes"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"def apply_update(name, info, new_v, new_hashes, sources_path):"},{"line_number":202,"context_line":"    \"\"\"Update version and sha256 entries for one source in sources.py.\"\"\""},{"line_number":203,"context_line":"    with open(sources_path) as f:"},{"line_number":204,"context_line":"        content \u003d f.read()"}],"source_content_type":"text/x-python","patch_set":4,"id":"8944c3e9_ca34789e","line":201,"in_reply_to":"26b5d7aa_255bc8db","updated":"2026-08-22 06:56:28.000000000","message":"Done","commit_id":"cd5961c1aff5e4ba5b3eb7afa00de77dbc5590b9"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"d53a7a77de0cc7bfb81764353ed73c9b150e59d1","unresolved":true,"context_lines":[{"line_number":368,"context_line":"    # repository, so chdir there before importing."},{"line_number":369,"context_line":"    os.chdir(repo_root)"},{"line_number":370,"context_line":"    sys.path.insert(0, repo_root)"},{"line_number":371,"context_line":"    from kolla.common.sources import SOURCES  # noqa: E402"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"    check_versions(SOURCES, sources_path, repo_root, update\u003dargs.update)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9ee52e3a_8d95467b","line":371,"updated":"2026-08-21 17:57:03.000000000","message":"I\u0027m not sure how comfortable we should be with exec\u0027ing code from a completely different context within trusted zuul jobs. I am less concerned about kolla doing something nefarious and more about accidentail disclosures.\n\nWe run tools like twine, reno, git-review, and openssh-client within these contenxts, but these tools all know not to expose credentials or other secrets accidentailly. The kolla/common/sources.py file is currently just a  dictionary (https://opendev.org/openstack/kolla/src/branch/master/kolla/common/sources.py) but could grow other functionality.\n\nIs there a reason we did not use a storage format like ini, json, yaml, etc? I think this is maybe the source of my concern. The data lends itself to a datastructure rather than executable code (which we execute here)","commit_id":"cd5961c1aff5e4ba5b3eb7afa00de77dbc5590b9"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"7c15ce75f6ee825bf61f5134874207a387f745bc","unresolved":false,"context_lines":[{"line_number":368,"context_line":"    # repository, so chdir there before importing."},{"line_number":369,"context_line":"    os.chdir(repo_root)"},{"line_number":370,"context_line":"    sys.path.insert(0, repo_root)"},{"line_number":371,"context_line":"    from kolla.common.sources import SOURCES  # noqa: E402"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"    check_versions(SOURCES, sources_path, repo_root, update\u003dargs.update)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f5dd05f_62918e66","line":371,"in_reply_to":"9ee52e3a_8d95467b","updated":"2026-08-22 06:56:11.000000000","message":"It\u0027s just Kolla history, I reworked it in a dependent patch to yaml which is easier to update and updated the vendored in script (it\u0027s better that it\u0027s vendored here so the trusted zuul job that is proposing updates keeps control of the script that is being run).","commit_id":"cd5961c1aff5e4ba5b3eb7afa00de77dbc5590b9"}],"playbooks/proposal/pre.yaml":[{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"d53a7a77de0cc7bfb81764353ed73c9b150e59d1","unresolved":true,"context_lines":[{"line_number":35,"context_line":"        name: requests"},{"line_number":36,"context_line":"        virtualenv: \u0027{{ cpe_venv_path }}\u0027"},{"line_number":37,"context_line":"        virtualenv_command: \u0027{{ ensure_pip_virtualenv_command }}\u0027"},{"line_number":38,"context_line":"      become: yes"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    - name: Copy scripts to the script dir on the node"},{"line_number":41,"context_line":"      copy:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"d4bc5ab0_fa5ac16a","line":38,"updated":"2026-08-21 17:57:03.000000000","message":"Should we just stick requests in the list of cpe_tools so that it will get installed by the loop above? Maybe with a comment about which proposal scripts require each of the tools listed above?\n\nConsider this a nit, it isn\u0027t critical.","commit_id":"cd5961c1aff5e4ba5b3eb7afa00de77dbc5590b9"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"7c15ce75f6ee825bf61f5134874207a387f745bc","unresolved":false,"context_lines":[{"line_number":35,"context_line":"        name: requests"},{"line_number":36,"context_line":"        virtualenv: \u0027{{ cpe_venv_path }}\u0027"},{"line_number":37,"context_line":"        virtualenv_command: \u0027{{ ensure_pip_virtualenv_command }}\u0027"},{"line_number":38,"context_line":"      become: yes"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    - name: Copy scripts to the script dir on the node"},{"line_number":41,"context_line":"      copy:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"29de52c2_2d6b534b","line":38,"in_reply_to":"d4bc5ab0_fa5ac16a","updated":"2026-08-22 06:56:11.000000000","message":"Done","commit_id":"cd5961c1aff5e4ba5b3eb7afa00de77dbc5590b9"}]}