)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"2f430843068d78a0af013b8598042c6beb4cd6da","unresolved":true,"context_lines":[{"line_number":12,"context_line":"bucket the caller owns. A grant to another account disappears. Outside"},{"line_number":13,"context_line":"us-east-1 AWS keeps the ACL."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Send the create without the ACL headers. Set the ACL with a POST."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Closes-Bug: #2170830"},{"line_number":18,"context_line":"Co-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"a626207a_ee02ac9c","line":15,"updated":"2026-10-28 06:39:14.000000000","message":"Makes sense, but annoying we have to amplify our requests, so fit their api.","commit_id":"eeb370e248e2f3af4c97cdd770b99417ed89ac83"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"d613246222b9e5de4b0012d3264572756359baac","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"28ae9abd_7d8b04da","updated":"2026-10-14 15:09:17.000000000","message":"I\u0027m quite skeptical of the exact aws s3 behavior here.  rclone didn\u0027t invent `--s3-no-check-bucket` for OUR benifit:\n\nhttps://forum.rclone.org/t/s3-rclone-v-1-52-0-or-after-permission-denied/21961/2\n\nIMHO, it\u0027s almost pointless to try and emulate s3 based on our reading/understanding of their docs.  This change should not merge without a s3api compatibility test.","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"6c28a14d774d2860431c65c9c86bd88bb88bebcb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"f47aaa55_bf75d242","updated":"2026-10-14 14:38:05.000000000","message":"IMHO S3Request has been historically abused to implement API behaviour; I\u0027m really keen that s3api implements API features in the relevant controllers, in this case bucket.\n\nHowever, I\u0027m wondering whether to fix this properly we need the container server to support conditional metadata updates based on a header, something like:\n\n```\nX-Ignore-If-Container-Exists: \u0027X-Container-Read, X-Container-Write\u0027\n```","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"f06ee52f9a302e93bed6859a65ac6f34ddc5c699","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"c5d968b1_7d22b13a","in_reply_to":"28ae9abd_7d8b04da","updated":"2026-10-15 12:04:24.000000000","message":"Added compability tests to this commit. There are now two parent commits to make this work: one to support regions, one to fix another bug.\n\nWith this patch Swift matches with s3 outside us-east-1.","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"2f430843068d78a0af013b8598042c6beb4cd6da","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"bdd59c8d_ad9f344f","updated":"2026-10-28 06:39:14.000000000","message":"If the problem is that the S3api turns a 202 into a 409 and expects nothing to change.. should be instead maybe just add `If-None-Match: *\u0027 support to containers, that way we can just add that header to a container PUT in the s3api case and get the desired effect without having to turn 1 requests into 2.\n\nAlthough, I\u0027m probably just over thinking the possibility of an amplifcation attack, it\u0027s only 1 extra request.\n\nThe If-None-Match support to containers would mean we should return some kind of etag for containers, maybe their chexor, maybe that could also help in db replication, 2 dbs with the same chexor means they agree on the obj table right :hmm:","commit_id":"eeb370e248e2f3af4c97cdd770b99417ed89ac83"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"14f9eb85d48255f5e596561c6f4516e9d36c19eb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"5db5e8cb_f2cffaaa","updated":"2026-10-29 12:39:15.000000000","message":"@clay.gerrard@gmail.com: Rebased, I moved the compatibility tests into 1012860: test/s3api: check that a repeated CreateBucket keeps the ACL | https://review.opendev.org/c/openstack/swift/+/1012860","commit_id":"fb7cc2d920e6346c3d54087266e3cdfb4030023b"}],"swift/common/middleware/s3api/controllers/bucket.py":[{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"2f430843068d78a0af013b8598042c6beb4cd6da","unresolved":true,"context_lines":[{"line_number":427,"context_line":""},{"line_number":428,"context_line":"        # BucketAclHandler.PUT sets the ACL when s3_acl is on"},{"line_number":429,"context_line":"        if \u0027HTTP_X_AMZ_ACL\u0027 in req.environ and not self.conf.s3_acl:"},{"line_number":430,"context_line":"            resp \u003d self._create_bucket_and_set_acl(req)"},{"line_number":431,"context_line":"        else:"},{"line_number":432,"context_line":"            resp \u003d req.get_response(self.app)"},{"line_number":433,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"31706b33_aba7a1b7","line":430,"updated":"2026-10-28 06:39:14.000000000","message":"I guess we only have to send 2 requests for the one PUT when the s3_acl is on and they\u0027re sending one in.","commit_id":"eeb370e248e2f3af4c97cdd770b99417ed89ac83"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"d149ae0de5ee226e94a093ad454c5177a7ab1520","unresolved":true,"context_lines":[{"line_number":452,"context_line":"        # a bucket that exists raises BucketAlreadyOwnedByYou here"},{"line_number":453,"context_line":"        resp \u003d req.get_response(self.app)"},{"line_number":454,"context_line":""},{"line_number":455,"context_line":"        req.headers.update(acl_headers)"},{"line_number":456,"context_line":""},{"line_number":457,"context_line":"        # The POST answer has no policy index. Keep the PUT index for the log."},{"line_number":458,"context_line":"        policy_index \u003d req.policy_index"}],"source_content_type":"text/x-python","patch_set":3,"id":"11d2ceba_459d3b42","line":455,"updated":"2026-10-29 16:01:04.000000000","message":"Small optimization for the maybe-common case of creating a bucket with default perms?\n```\nif not acl_headers:\n    return resp\n```\nOr is the idea that this should already be covered by the `\u0027HTTP_X_AMZ_ACL\u0027 in req.environ` check? *Surely* there\u0027s a way to set `x-amz-acl` for the default, only-owner-has-access perms, though, right?","commit_id":"fb7cc2d920e6346c3d54087266e3cdfb4030023b"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"d149ae0de5ee226e94a093ad454c5177a7ab1520","unresolved":true,"context_lines":[{"line_number":458,"context_line":"        policy_index \u003d req.policy_index"},{"line_number":459,"context_line":"        try:"},{"line_number":460,"context_line":"            # FIXME: A failed POST leaves a new bucket with the default ACL."},{"line_number":461,"context_line":"            # A retry does not repair it. The s3_acl path has the same fault."},{"line_number":462,"context_line":"            req.get_response(self.app, \u0027POST\u0027, body\u003db\u0027\u0027)"},{"line_number":463,"context_line":"        finally:"},{"line_number":464,"context_line":"            req.policy_index \u003d policy_index"}],"source_content_type":"text/x-python","patch_set":3,"id":"d517a1aa_331b180d","line":461,"range":{"start_line":461,"start_character":42,"end_line":461,"end_character":76},"updated":"2026-10-29 16:01:04.000000000","message":"So where does *that one* happen? It seems like it\u0027d be nice to at least have this fault centrally-located... but maybe the way `s3_acl` adds on this whole other layer makes it tricky...","commit_id":"fb7cc2d920e6346c3d54087266e3cdfb4030023b"}],"swift/common/middleware/s3api/s3request.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"6c28a14d774d2860431c65c9c86bd88bb88bebcb","unresolved":true,"context_lines":[{"line_number":2267,"context_line":""},{"line_number":2268,"context_line":"        raise InternalError(\u0027unexpected status code %d\u0027 % status)"},{"line_number":2269,"context_line":""},{"line_number":2270,"context_line":"    def _is_create_bucket(self, method, container, obj):"},{"line_number":2271,"context_line":"        \"\"\""},{"line_number":2272,"context_line":"        Return True if this request creates the bucket that it names."},{"line_number":2273,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"07f6930c_31aec2c5","line":2270,"updated":"2026-10-14 14:38:05.000000000","message":"it seems odd to have this test when there is a bucket controller than handles all bucket requests. Should we not be adding bucket specific functionality to the bucket controller?","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"f06ee52f9a302e93bed6859a65ac6f34ddc5c699","unresolved":false,"context_lines":[{"line_number":2267,"context_line":""},{"line_number":2268,"context_line":"        raise InternalError(\u0027unexpected status code %d\u0027 % status)"},{"line_number":2269,"context_line":""},{"line_number":2270,"context_line":"    def _is_create_bucket(self, method, container, obj):"},{"line_number":2271,"context_line":"        \"\"\""},{"line_number":2272,"context_line":"        Return True if this request creates the bucket that it names."},{"line_number":2273,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"b296d502_2aaa8f74","line":2270,"in_reply_to":"07f6930c_31aec2c5","updated":"2026-10-15 12:04:24.000000000","message":"Ack, fixed.","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"6c28a14d774d2860431c65c9c86bd88bb88bebcb","unresolved":true,"context_lines":[{"line_number":2272,"context_line":"        Return True if this request creates the bucket that it names."},{"line_number":2273,"context_line":""},{"line_number":2274,"context_line":"        A PutBucketAcl request is also a PUT on a bucket, but its controller"},{"line_number":2275,"context_line":"        sends a container POST, so the method here is POST. A multipart"},{"line_number":2276,"context_line":"        upload creates its +segments container from an object request, so"},{"line_number":2277,"context_line":"        is_bucket_request is False there."},{"line_number":2278,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"545d310d_4ef2fbea","line":2275,"range":{"start_line":2275,"start_character":39,"end_line":2275,"end_character":58},"updated":"2026-10-14 14:38:05.000000000","message":"where is \"here\"? The method used here in this function is \u0027PUT\u0027","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"f06ee52f9a302e93bed6859a65ac6f34ddc5c699","unresolved":true,"context_lines":[{"line_number":2272,"context_line":"        Return True if this request creates the bucket that it names."},{"line_number":2273,"context_line":""},{"line_number":2274,"context_line":"        A PutBucketAcl request is also a PUT on a bucket, but its controller"},{"line_number":2275,"context_line":"        sends a container POST, so the method here is POST. A multipart"},{"line_number":2276,"context_line":"        upload creates its +segments container from an object request, so"},{"line_number":2277,"context_line":"        is_bucket_request is False there."},{"line_number":2278,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"bb3f8cee_2d85e606","line":2275,"range":{"start_line":2275,"start_character":39,"end_line":2275,"end_character":58},"in_reply_to":"545d310d_4ef2fbea","updated":"2026-10-15 12:04:24.000000000","message":"You\u0027re right - my fault, was meant to say \"needs to be used here\" as in \"needs to be used in this case\". Changed.","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"6c28a14d774d2860431c65c9c86bd88bb88bebcb","unresolved":true,"context_lines":[{"line_number":2283,"context_line":"                not obj)"},{"line_number":2284,"context_line":""},{"line_number":2285,"context_line":"    def _create_bucket_and_set_acl(self, app, container, headers, body,"},{"line_number":2286,"context_line":"                                   query):"},{"line_number":2287,"context_line":"        \"\"\""},{"line_number":2288,"context_line":"        Create a bucket, then apply the ACL of the x-amz-acl header."},{"line_number":2289,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"0ab50f6e_f3d85f47","line":2286,"updated":"2026-10-14 14:38:05.000000000","message":"I may be missing something, but I don\u0027t understand why this is not in BucketController.PUT - are there other API operations where we want to intercept a bucket PUT and defer the acl\u0027s to a POST?","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"f06ee52f9a302e93bed6859a65ac6f34ddc5c699","unresolved":true,"context_lines":[{"line_number":2283,"context_line":"                not obj)"},{"line_number":2284,"context_line":""},{"line_number":2285,"context_line":"    def _create_bucket_and_set_acl(self, app, container, headers, body,"},{"line_number":2286,"context_line":"                                   query):"},{"line_number":2287,"context_line":"        \"\"\""},{"line_number":2288,"context_line":"        Create a bucket, then apply the ACL of the x-amz-acl header."},{"line_number":2289,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"8e47f23c_c35ee173","line":2286,"in_reply_to":"0ab50f6e_f3d85f47","updated":"2026-10-15 12:04:24.000000000","message":"No, there are not. Fixed.","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"6c28a14d774d2860431c65c9c86bd88bb88bebcb","unresolved":true,"context_lines":[{"line_number":2309,"context_line":"        # a bucket that exists answers 202, and it keeps the ACL it has"},{"line_number":2310,"context_line":"        if resp.status_int \u003d\u003d HTTP_CREATED:"},{"line_number":2311,"context_line":"            self.headers.update(acl_headers)"},{"line_number":2312,"context_line":"            # FIXME As in the s3_acl path, a failed POST leaves a new"},{"line_number":2313,"context_line":"            # bucket with the default ACL."},{"line_number":2314,"context_line":"            self._get_response(app, \u0027POST\u0027, container, None, body\u003db\u0027\u0027)"},{"line_number":2315,"context_line":"        return resp"},{"line_number":2316,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"c27320ac_db539d65","line":2313,"range":{"start_line":2312,"start_character":14,"end_line":2313,"end_character":42},"updated":"2026-10-14 14:38:05.000000000","message":"IIUC in this case we also return success to the client, not 503? would it not be better for the client to retry...except a retry will NOT set the acl because the bucket has been created??","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"f06ee52f9a302e93bed6859a65ac6f34ddc5c699","unresolved":true,"context_lines":[{"line_number":2309,"context_line":"        # a bucket that exists answers 202, and it keeps the ACL it has"},{"line_number":2310,"context_line":"        if resp.status_int \u003d\u003d HTTP_CREATED:"},{"line_number":2311,"context_line":"            self.headers.update(acl_headers)"},{"line_number":2312,"context_line":"            # FIXME As in the s3_acl path, a failed POST leaves a new"},{"line_number":2313,"context_line":"            # bucket with the default ACL."},{"line_number":2314,"context_line":"            self._get_response(app, \u0027POST\u0027, container, None, body\u003db\u0027\u0027)"},{"line_number":2315,"context_line":"        return resp"},{"line_number":2316,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bc6a7a80_7464bd33","line":2313,"range":{"start_line":2312,"start_character":14,"end_line":2313,"end_character":42},"in_reply_to":"c27320ac_db539d65","updated":"2026-10-15 12:04:24.000000000","message":"It does no longer return a success in this case. You\u0027re right on the retry, the bucket might have been created by then. The client has to use PutBucketAcl.","commit_id":"29880db7a3f19bcc2b21fd197a577d7670a8cc17"}]}