)]}'
{"id":"openstack%2Fswift~1005650","triplet_id":"openstack%2Fswift~master~I15cd4ef476a462545c85fc7f23ea7b51248bbc49","project":"openstack/swift","branch":"master","topic":"s3-checksum-persistence","attention_set":{"34930":{"account":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"last_update":"2026-09-15 09:32:52.000000000","reason":"\u003cGERRIT_ACCOUNT_7847\u003e replied on the change","reason_account":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"}},"7847":{"account":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"last_update":"2026-09-15 15:55:24.000000000","reason":"\u003cGERRIT_ACCOUNT_1179\u003e replied on the change","reason_account":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"}}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I15cd4ef476a462545c85fc7f23ea7b51248bbc49","subject":"sq? use a self-describing schema for middleware\u0027s own sensitive headers","status":"NEW","created":"2026-09-15 04:19:36.000000000","updated":"2026-09-15 15:55:24.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":10,"unresolved_comment_count":7,"has_review_started":true,"meta_rev_id":"d9572a2a9b47331a08e51ef484ed969604ca86ce","_number":1005650,"virtual_id_number":1005650,"owner":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-09-15 05:45:35.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-15 05:34:41.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-09-15 05:45:35.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-09-15 09:32:52.000000000","updated_by":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"reviewer":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"state":"CC"},{"updated":"2026-09-15 15:55:24.000000000","updated_by":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"reviewer":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"state":"CC"}],"messages":[{"id":"ba05ae0b533a6bddf509d91ec70729541f6a06c6","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"date":"2026-09-15 04:19:36.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"b650e209260719328269ce3b922073305543fb06","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"date":"2026-09-15 04:34:23.000000000","message":"Uploaded patch set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"eabbfec36b5b9e10b8adeea6585103da21d7143c","tag":"autogenerated:gerrit:setWorkInProgress","author":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"date":"2026-09-15 04:34:41.000000000","message":"Set Work In Progress","accounts_in_message":[],"_revision_number":2},{"id":"ce24e966d35c0abe445b171256333e14d382464a","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-15 05:34:41.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1d26f0abc5d847abbcf500956b7de6b5\n\n- swift-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/de4c1712552946cf8afe3c006db885f7 : SUCCESS in 58m 32s","accounts_in_message":[],"_revision_number":2},{"id":"baf9b44875415ef0ebd009c0488673513d5651d5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-15 05:45:35.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9ad29ffb207b41078c116de3bb7ef8d3\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/bfc28de2aac24e6695f1a11ab60f00ef : SUCCESS in 11m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/aff213e66f084be4913c72af48e625ee : SUCCESS in 8m 21s\n- grenade https://zuul.opendev.org/t/openstack/build/b92e7afe1e1b49fea10d85771c605909 : SUCCESS in 1h 05m 42s\n- grenade-skip-level-always https://zuul.opendev.org/t/openstack/build/90ece34ac18b4d4d87a942ae6b6e409c : SUCCESS in 1h 05m 24s\n- tempest-integrated-object-storage https://zuul.opendev.org/t/openstack/build/062af1b69edc4fb3ad0e596b2b8f30b1 : SUCCESS in 26m 55s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/3a95d8f6e76c43be865bca2722129d4a : SUCCESS in 31m 31s\n- swift-tox-func-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/c249332df89e4ff4bdefd7a6bd480973 : SUCCESS in 12m 00s (non-voting)\n- swift-tox-func-encryption-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/a4d20df16f24400f96da512f34d6957a : SUCCESS in 21m 21s (non-voting)\n- swift-tox-func-ec-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/9f43ebdb548e48e9ac9d23e4fc83bff8 : SUCCESS in 16m 19s (non-voting)\n- swift-build-image https://zuul.opendev.org/t/openstack/build/f0aa3bf664bd4a04a0ea16004b5ac3c2 : SUCCESS in 4m 47s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/cdd73389ef324def9cf9161040644dd8 : SUCCESS in 23m 59s\n- swift-tox-py310 https://zuul.opendev.org/t/openstack/build/31e1da4de27a4e8caa4a26933bf35820 : SUCCESS in 9m 02s\n- swift-tox-py313 https://zuul.opendev.org/t/openstack/build/cf425ea7be6243578bdd1d339405ddad : SUCCESS in 13m 33s\n- swift-tox-py314 https://zuul.opendev.org/t/openstack/build/cef2be9113fb40f08b6ca65a91c7839b : SUCCESS in 8m 57s\n- swift-tox-func-py312 https://zuul.opendev.org/t/openstack/build/5653fdb5a8d94697b72e807546bfd25d : SUCCESS in 8m 06s\n- swift-tox-func-encryption-py312 https://zuul.opendev.org/t/openstack/build/78ccd7b8171746eeb74b4969c84d31f2 : SUCCESS in 12m 55s\n- swift-tox-func-ec-py312 https://zuul.opendev.org/t/openstack/build/4be73da64f2549b7870e916ef11e6c3f : SUCCESS in 12m 50s\n- swift-tox-func-py39-centos-9-stream https://zuul.opendev.org/t/openstack/build/0b7baef7f28a4dbebf16619b59bf59c6 : SUCCESS in 17m 17s\n- swift-func-cors https://zuul.opendev.org/t/openstack/build/775c8070790f40f2976256b0d5dde748 : SUCCESS in 5m 08s\n- swift-tox-func-s3api-compat-tests-tempauth https://zuul.opendev.org/t/openstack/build/f4fd4096b00e4918b5d84633fa76a08f : SUCCESS in 8m 00s\n- swift-probetests-centos-9-stream https://zuul.opendev.org/t/openstack/build/06f9c48ee80f48748d91f94eeb16581f : SUCCESS in 47m 35s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/4cc190e617a04917a78b997c20382800 : SUCCESS in 26m 10s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/431a611af56644848a88d2e0a9866be7 : SUCCESS in 52m 40s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/74eacfc04ad048039abb1b3776c60226 : SUCCESS in 13m 15s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4fba76d22ac24ad3bf8c83b1cf776541 : SUCCESS in 2m 56s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/3da672eac5b544f18f3b688ebbf41593 : SUCCESS in 15m 14s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/3c557ea6c65a491ca9005a4dd5dd53c4 : SUCCESS in 31m 00s\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/zuul/zuul-jobs/playbooks/unittests/post.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/zuul/zuul-jobs/playbooks/unittests/post.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/zuul/zuul-jobs/playbooks/unittests/post.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"c8c44baf18e98af8565eafc5de9d9648b4287537","author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"date":"2026-09-15 09:32:52.000000000","message":"Patch Set 2:\n\n(8 comments)","accounts_in_message":[],"_revision_number":2},{"id":"d9572a2a9b47331a08e51ef484ed969604ca86ce","author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"date":"2026-09-15 15:55:24.000000000","message":"Patch Set 2:\n\n(2 comments)\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4","revisions":{"37db60032842c5ef808a92e51196e6f96573429c":{"kind":"REWORK","_number":1,"created":"2026-09-15 04:19:36.000000000","uploader":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"ref":"refs/changes/50/1005650/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/50/1005650/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/1005650/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/1005650/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/1005650/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/50/1005650/1"}}},"commit":{"parents":[{"commit":"4d36f9e79587fcc807a511b933d097fdfac2eedd","subject":"crypto: Encrypt object sysmeta declared sensitive","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/4d36f9e79587fcc807a511b933d097fdfac2eedd"}]}],"author":{"name":"Jianjian Huo","email":"jhuo@nvidia.com","date":"2026-09-15 03:04:00.000000000","tz":-420},"committer":{"name":"Jianjian Huo","email":"jhuo@nvidia.com","date":"2026-09-15 04:14:29.000000000","tz":-420},"subject":"sq? use a self-describing schema for middleware\u0027s own sensitive headers","message":"sq? use a self-describing schema for middleware\u0027s own sensitive headers\n\nUse X-Object-Sysmeta-\u003cowner\u003e-Sensitive-\u003cname\u003e for sensitive plaintext. Store\nciphertext as X-Object-Sysmeta-Crypto-\u003cowner\u003e-Sensitive-\u003cname\u003e. Require a\nnon-empty owner and field name, and reserve the crypto namespace.\n\nThe header name declares sensitivity without a registry or producer\nmiddleware in the pipeline. Existing owner-prefix copy hooks cover these\nfields. Reuse remove_items() to collect sensitive headers and footers.\n\nChange-Id: I15cd4ef476a462545c85fc7f23ea7b51248bbc49\nAssisted-By: Codex:GPT-5.6\nSigned-off-by: Jianjian Huo \u003cjhuo@nvidia.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/37db60032842c5ef808a92e51196e6f96573429c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/37db60032842c5ef808a92e51196e6f96573429c"}]},"branch":"refs/heads/master"},"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2026-09-15 04:34:23.000000000","uploader":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"ref":"refs/changes/50/1005650/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/50/1005650/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/1005650/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/1005650/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/50/1005650/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/50/1005650/2"}}},"commit":{"parents":[{"commit":"4d36f9e79587fcc807a511b933d097fdfac2eedd","subject":"crypto: Encrypt object sysmeta declared sensitive","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/4d36f9e79587fcc807a511b933d097fdfac2eedd"}]}],"author":{"name":"Jianjian Huo","email":"jhuo@nvidia.com","date":"2026-09-15 03:04:00.000000000","tz":-420},"committer":{"name":"Jianjian Huo","email":"jhuo@nvidia.com","date":"2026-09-15 04:32:22.000000000","tz":-420},"subject":"sq? use a self-describing schema for middleware\u0027s own sensitive headers","message":"sq? use a self-describing schema for middleware\u0027s own sensitive headers\n\nUse X-Object-Sysmeta-\u003cowner\u003e-Sensitive-\u003cname\u003e for sensitive plaintext.\nStore ciphertext as X-Object-Sysmeta-Crypto-\u003cowner\u003e-Sensitive-\u003cname\u003e.\nRequire a non-empty owner and field name, and reserve the crypto\nnamespace.\n\nThe header name declares sensitivity without a registry or producer\nmiddleware in the pipeline. Existing owner-prefix copy hooks cover\nthese fields. Reuse remove_items() to collect sensitive headers and\nfooters.\n\nThe sensitive marker controls encryption, not copy semantics.\nExisting owner-prefix copy hooks also match the owner\u0027s sensitive\nfields. Middleware that requires these fields to be removed or\nchanged during server-side copy must install an appropriate\ncopy-source hook in each pipeline where that policy is required.\nWithout such a hook, generic copy preserves the fields.\n\nS3API\u0027s existing hook already removes all S3API object sysmeta\nbefore restoring selected fields, so it also removes the\nowner-first sensitive checksum value without a new special case.\n\nChange-Id: I15cd4ef476a462545c85fc7f23ea7b51248bbc49\nAssisted-By: Codex:GPT-5.6\nSigned-off-by: Jianjian Huo \u003cjhuo@nvidia.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}