)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"59338d2b65c6a7c54b507ec529ebabdb798bfc0f","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c4c177c4_b972d5d9","updated":"2026-08-25 21:28:52.000000000","message":"Just generally curious: do you think other openstack projects (or maybe keystonemiddleware) SHOULD inspect token.methods?","commit_id":"9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"b38b22916fd4ffc8fefca3557e02a90cb954d08e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"ab2ae5d2_ec457f6b","in_reply_to":"c4c177c4_b972d5d9","updated":"2026-08-25 22:16:19.000000000","message":"All of the mentioned patches are in flight, so I\u0027m not yet sure what the final shape of these will be, but it gets complicated.\n\nWe divided the auth methods into primary and non-primary in this last set of patches, but you can also implement custom auth plugins. So we introduced a config, which lets the operator set their additional plugins as \"primary\". As proposed, only primary tokens can be re-scoped (ex. to switch projects in Horizon). This config would only be present in keystone - other services would have to duplicate it.\n\nThe main issue we are plugging in keystone, was that you could hop between the differently issued tokens back and forth, which looks like an issue limited to Keystone. But there are secondary issues I\u0027m currently thinking about, like when you have MFA enabled, should your application credential be able to change an ssh key in Nova? Nova wouldn\u0027t know if you have MFA enabled just by token introspection...","commit_id":"9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"af7ff9a7f80f33cf6f1bb6eb13fb807e81ab44bc","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"3bec6142_e930de56","updated":"2026-08-27 17:07:30.000000000","message":"Hey Grzegorz, we changed the format of OSSN. I used Claude-code (and my own brain) to translate this into the new yaml format. Let me know if there are any questions.","commit_id":"af299970498913f85406865450f45d763f914831"}],"security-notes/OSSN-0109":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"114c195d10eba8b54f50db59241e527ec7aeb571","unresolved":true,"context_lines":[{"line_number":91,"context_line":"If a deployment does not use Swift\u0027s S3-compatible API (or any other"},{"line_number":92,"context_line":"consumer of EC2-style credentials), disable the feature entirely with a"},{"line_number":93,"context_line":"`policy.yaml` override. There is no code-level switch for this, so the"},{"line_number":94,"context_line":"override must deny every EC2-related policy target directly:"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"~~~"},{"line_number":97,"context_line":"# Drop in as Keystone\u0027s policy.yaml"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"d27bda37_0faa9378","line":94,"updated":"2026-08-25 21:12:28.000000000","message":"Recently when Ironic issued a similarly shaped OSSN, we also suggested folks could use a fronting proxy service or WSGI configuration to block troublesome URLs. If that\u0027s an option here, it might be worth mentioning. ( https://wiki.openstack.org/wiki/OSSN/OSSN-0106 )","commit_id":"66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"5cf368f61004d03ef1d4e85e87fc57dc89ef4266","unresolved":false,"context_lines":[{"line_number":91,"context_line":"If a deployment does not use Swift\u0027s S3-compatible API (or any other"},{"line_number":92,"context_line":"consumer of EC2-style credentials), disable the feature entirely with a"},{"line_number":93,"context_line":"`policy.yaml` override. There is no code-level switch for this, so the"},{"line_number":94,"context_line":"override must deny every EC2-related policy target directly:"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"~~~"},{"line_number":97,"context_line":"# Drop in as Keystone\u0027s policy.yaml"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1505b195_d686c4cd","line":94,"in_reply_to":"d27bda37_0faa9378","updated":"2026-08-25 21:23:40.000000000","message":"Thanks for the review, I\u0027ll add those in, it won\u0027t cover the credentials endpoint though","commit_id":"66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a"}],"security-notes/OSSN-0109.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ccb0935b8d6045648603cf513036ec7f7c1f971d","unresolved":true,"context_lines":[{"line_number":158,"context_line":"    fully-privileged token for the credential\u0027s project."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"credits:"},{"line_number":161,"context_line":"  - Sergey Kanibor (bug 2158931)"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"references:"},{"line_number":164,"context_line":"  links:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"3706d310_508e100f","line":161,"updated":"2026-08-27 17:08:04.000000000","message":"noticed this during my translation: these usually credit the organization/employer in (), not the bug -- although it\u0027s still useful metadata if you wanna include it.","commit_id":"af299970498913f85406865450f45d763f914831"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"4586445faacc9a0f3d67b6c9ca2f00425c4a6242","unresolved":true,"context_lines":[{"line_number":179,"context_line":"  - description: CVE-2026-2035364"},{"line_number":180,"context_line":"    url: https://nvd.nist.gov/vuln/detail/CVE-2026-2035364"},{"line_number":181,"context_line":"  - description: CVE-2026-2035366"},{"line_number":182,"context_line":"    url: https://nvd.nist.gov/vuln/detail/CVE-2026-2035366"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"author: Grzegorz Grasza, Red Hat"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7ac96404_31942167","line":182,"updated":"2026-08-27 17:12:28.000000000","message":"These CVE numbers match the original ones from the txt version, but look strange -- are these CAN IDs?","commit_id":"af299970498913f85406865450f45d763f914831"}]}