)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"23bc6482b0f452731160c28151954739b243e7bc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"429d50e6_334ca019","updated":"2026-10-09 15:40:51.000000000","message":"I set the release date for today","commit_id":"0857cbcf3b1075c5b1df44c1583156ca3fb0e60e"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"515e6acc8f77889c0b7bbae4c2a6ca49f62724be","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"696d09d4_8a9348e3","updated":"2026-10-09 17:44:17.000000000","message":"Some question as to if we should announce an OSSN on a Friday (we target Tues-Thurs, no holidays for OSSAs).","commit_id":"0857cbcf3b1075c5b1df44c1583156ca3fb0e60e"}],"security-notes/OSSN-0113.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"2a254551fbca81e60d816e3991015734712699f9","unresolved":true,"context_lines":[{"line_number":27,"context_line":"  In practice, default policies across services commonly check ``role:admin``"},{"line_number":28,"context_line":"  (or equivalent) without requiring the token\u0027s project to match the target"},{"line_number":29,"context_line":"  resource. A project-scoped token that carries ``admin`` therefore satisfies"},{"line_number":30,"context_line":"  those checks for resources in *other* projects. The VMT treats reports of"},{"line_number":31,"context_line":"  this pattern as expected behavior unless a service\u0027s own documentation"},{"line_number":32,"context_line":"  claims that project-admin is tenant-scoped."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"  The Consistent and Secure Default RBAC (SRBAC) effort introduced system"},{"line_number":35,"context_line":"  scope and default personas (``admin`` / ``member`` / ``reader``, later"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"c2a6e151_1785c3de","line":32,"range":{"start_line":30,"start_character":50,"end_line":32,"end_character":45},"updated":"2026-10-09 17:11:44.000000000","message":"Honestly, I don\u0027t love how this is stated. It\u0027s more that VMT only enforces a project\u0027s own requirements for security -- there is no mechanism in OpenStack governance for the VMT to tell a project \"project admin must be project scoped\".\n\nI\u0027m not going to make this blocking feedback because this patch has ping-ponged a lot already, but generally speaking, VMT doesn\u0027t enforce *any* generic security behavior beyond helping coordinate projects\u0027 fixes for things they see as vulnerabilities.","commit_id":"0857cbcf3b1075c5b1df44c1583156ca3fb0e60e"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"d650d66e8ccc4a8d7da8a1f07ebbc5dd7f166968","unresolved":false,"context_lines":[{"line_number":27,"context_line":"  In practice, default policies across services commonly check ``role:admin``"},{"line_number":28,"context_line":"  (or equivalent) without requiring the token\u0027s project to match the target"},{"line_number":29,"context_line":"  resource. A project-scoped token that carries ``admin`` therefore satisfies"},{"line_number":30,"context_line":"  those checks for resources in *other* projects. The VMT treats reports of"},{"line_number":31,"context_line":"  this pattern as expected behavior unless a service\u0027s own documentation"},{"line_number":32,"context_line":"  claims that project-admin is tenant-scoped."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"  The Consistent and Secure Default RBAC (SRBAC) effort introduced system"},{"line_number":35,"context_line":"  scope and default personas (``admin`` / ``member`` / ``reader``, later"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"54a6f3ad_937b8ae6","line":32,"range":{"start_line":30,"start_character":50,"end_line":32,"end_character":45},"in_reply_to":"c2a6e151_1785c3de","updated":"2026-10-12 12:43:52.000000000","message":"I changed the wording.","commit_id":"0857cbcf3b1075c5b1df44c1583156ca3fb0e60e"}]}