)]}'
{"id":"openstack%2Ftempest~676745","triplet_id":"openstack%2Ftempest~master~I35d8eac972a8785b629f4cd538b521021fa33353","project":"openstack/tempest","branch":"master","topic":"fix-trusts","hashtags":[],"change_id":"I35d8eac972a8785b629f4cd538b521021fa33353","subject":"Use list_trusts to check for deleted trust","status":"ABANDONED","created":"2019-08-15 18:06:52.000000000","updated":"2019-08-16 22:03:21.000000000","total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"37715003035d43fc46157b91db93d63df17e10b3","_number":676745,"virtual_id_number":676745,"owner":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"value":1,"date":"2019-08-15 23:22:23.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"recommended":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":2,"date":"2019-08-16 17:51:29.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},{"value":1,"date":"2019-08-15 23:25:53.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":0},"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"permitted_voting_range":{"min":0,"max":2},"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"permitted_voting_range":{"min":0,"max":2},"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},{"value":0,"permitted_voting_range":{"min":0,"max":2},"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"value":0,"permitted_voting_range":{"min":0,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Release Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2019-08-15 23:22:23.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2019-08-15 23:25:53.000000000","updated_by":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"reviewer":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"state":"REVIEWER"},{"updated":"2019-08-16 17:51:29.000000000","updated_by":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"reviewer":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"state":"REVIEWER"}],"messages":[{"id":"4e5d8887386601411822fa219f97dcfc66ec52a1","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 18:06:52.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"67e6f8731c505f4eb85cd5cd7572b708966cafb0","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-08-15 18:40:39.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"ae3fe9dded61e467f0c063e1dd36ace16e540e77","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-08-15 18:41:28.000000000","message":"Patch Set 1:\n\nThis is a very correct solution to the problem and this is security related. The behavior change is warranted to close/harden against leaking trust-existence.","accounts_in_message":[],"_revision_number":1},{"id":"11ab393d8e9c423522fb75d012ceb1ed3389fde3","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 20:02:01.000000000","message":"Patch Set 1: Workflow-1","accounts_in_message":[],"_revision_number":1},{"id":"020e8088290643da861b6bfed35fdbe09b3b768f","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 20:40:26.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"7c374e53961deade5d9b3d9a5bfe1ca99959aae3","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-08-15 23:22:23.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\n\n- tempest-full https://zuul.opendev.org/t/openstack/build/e3c992859add4c1083bfc805a64a6abd : SUCCESS in 2h 00m 19s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/cc914f4147cb4eeb84a61a8cda964152 : SUCCESS in 1h 15m 27s\n- grenade-py3 https://zuul.opendev.org/t/openstack/build/63486799e8314fe59936f82fee50a662 : SUCCESS in 1h 03m 39s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7d45b27ba8f746b4950efd5ebdce799d : SUCCESS in 1h 32m 34s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/874aa6ec222c4eb5932da8d2aa598ddc : SUCCESS in 4m 49s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/055b79c4ca5044a9a57dd48cbbf128af : SUCCESS in 6m 29s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/9784f17a48074fb8ab5ede1a7d28b0a6 : SUCCESS in 5m 13s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/8341f434e8224661b526ec8a9d78a9c4 : SUCCESS in 4m 43s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/9b2c3575b04a4e89891f8a4be823531c : SUCCESS in 4m 22s\n- openstack-tox-py37 https://zuul.opendev.org/t/openstack/build/87a4af779a1d4baab7fd60865e72eaa2 : SUCCESS in 5m 33s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1a6f3b8568d84651a0dab244dc37c904 : SUCCESS in 5m 16s\n- tempest-full-parallel https://zuul.opendev.org/t/openstack/build/b7a8c71cda8f452fab069badd11de77d : SUCCESS in 1h 57m 55s (non-voting)\n- tempest-full-py3-ipv6 https://zuul.opendev.org/t/openstack/build/416a51234f13461e8437c8891dd97265 : SUCCESS in 1h 30m 43s (non-voting)\n- tempest-full-stein https://zuul.opendev.org/t/openstack/build/c7fa9b06d7a84e1c8b78756544cd3f7e : SUCCESS in 1h 40m 47s\n- tempest-full-stein-py3 https://zuul.opendev.org/t/openstack/build/c1285f069ba44e45ab0749b8f30b4e8d : SUCCESS in 1h 46m 01s\n- tempest-full-rocky https://zuul.opendev.org/t/openstack/build/31ee0f76a18f4110b7217be1d4577818 : SUCCESS in 1h 33m 28s\n- tempest-full-rocky-py3 https://zuul.opendev.org/t/openstack/build/41f72c60816d46d69fd1823cb764b0d8 : SUCCESS in 1h 35m 17s\n- tempest-full-queens https://zuul.opendev.org/t/openstack/build/fce0bb77076a408cbc6f7e10fbdc7f80 : SUCCESS in 1h 28m 09s\n- tempest-full-queens-py3 https://zuul.opendev.org/t/openstack/build/79f206ef7de74034a6cba56a2b064b3d : SUCCESS in 1h 23m 56s\n- tempest-multinode-full https://zuul.opendev.org/t/openstack/build/639ea0f07b1e4dcb83ea0887a5f69367 : SUCCESS in 1h 46m 51s\n- tempest-multinode-full-py3 https://zuul.opendev.org/t/openstack/build/2ab4e69242e947e0a802ff27861e06b4 : SUCCESS in 1h 42m 58s\n- tempest-tox-plugin-sanity-check https://zuul.opendev.org/t/openstack/build/7f366a46a926488eb919db5481739d38 : FAILURE in 1h 05m 50s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e356c3eb961d41c19af272e29d9ef492 : SUCCESS in 1h 05m 46s\n- tempest-slow https://zuul.opendev.org/t/openstack/build/ca84c7e050e9414c8a4884b18bb3921e : SUCCESS in 2h 35m 57s\n- tempest-slow-py3 https://zuul.opendev.org/t/openstack/build/e324bd21f3e1438b99f47d3e211c5a8d : SUCCESS in 2h 24m 37s\n- nova-live-migration https://zuul.opendev.org/t/openstack/build/87b3059886174de7a9823142565d0be1 : SUCCESS in 59m 43s (non-voting)\n- neutron-grenade-multinode https://zuul.opendev.org/t/openstack/build/1e8623dbde0f4d609e0aeb6b2c65336c : SUCCESS in 1h 17m 45s\n- devstack-plugin-ceph-tempest https://zuul.opendev.org/t/openstack/build/55bd8ebf4e81400896d2aa4912926f26 : SUCCESS in 1h 15m 21s (non-voting)\n- puppet-openstack-integration-4-scenario004-tempest-centos-7 https://zuul.opendev.org/t/openstack/build/3cffae479699402996fe7b8179f25f43 : FAILURE in 21m 49s (non-voting)\n- neutron-tempest-dvr https://zuul.opendev.org/t/openstack/build/d0d099d3c17c40a6b14561d909d73e5d : SUCCESS in 1h 13m 44s\n- interop-tempest-consistency https://zuul.opendev.org/t/openstack/build/97a64339b37c4ed6a25326760eb9ef5b : SUCCESS in 3m 24s\n- tempest-full-test-account-py3 https://zuul.opendev.org/t/openstack/build/5ec25ff49e0a43ed80353837c383f7aa : SUCCESS in 1h 38m 36s (non-voting)\n- tempest-full-test-account-no-admin-py3 https://zuul.opendev.org/t/openstack/build/e5216ba8d2b84a33a48dff88ae6ceebe : SUCCESS in 1h 06m 47s (non-voting)\n- openstack-tox-bashate https://zuul.opendev.org/t/openstack/build/e0c28cdda4c140d38d86a7c6ec337503 : SUCCESS in 3m 22s","accounts_in_message":[],"_revision_number":2},{"id":"a7da8fdf63a205c47c2884fbf2d5fb0526743ad8","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-08-15 23:25:53.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"26b08b42fa47cbfa72ce76a3fc383f1eab655462","author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"date":"2019-08-16 17:51:29.000000000","message":"Patch Set 2: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"94f131d9648d5a94f4651bbbf268e80394ecf891","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-16 22:03:21.000000000","message":"Abandoned\n\nAs discussed in the bug report, the information leak is not sensitive enough to warrant breaking the API, so abandoning this.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"f986c85c79a2df9b0435cb94b41c39fbebbfbab5","revisions":{"75c99e884738118c7243d4d2ba7f49e864d34577":{"kind":"REWORK","_number":1,"created":"2019-08-15 18:06:52.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/45/676745/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/tempest","ref":"refs/changes/45/676745/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/tempest refs/changes/45/676745/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/tempest refs/changes/45/676745/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/tempest refs/changes/45/676745/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/tempest refs/changes/45/676745/1"}}},"commit":{"parents":[{"commit":"556109dd53f5a7be11261ffab02fb82dace0c9e4","subject":"Merge \"Add API reference for metering_label_rules_client\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/tempest/commit/556109dd53f5a7be11261ffab02fb82dace0c9e4"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 17:56:29.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 17:56:29.000000000","tz":-420},"subject":"Use list_trusts to check for deleted trust","message":"Use list_trusts to check for deleted trust\n\nThe keystone trusts API currently makes some flawed choices about access\ncontrol. First, there is a security issue whereby trust existence is\nleaked to unauthorized users (see related bug). Second, it explicitly\nprevents the admin user from retrieving a trust. In order to correct the\nfirst issue, we need to change the keystone API to correctly return an\nHTTP 403 Forbidden in the case that a trust does not exist. This impacts\ntempest, which runs as the admin user, and is expecting to be able to\nvalidate a trust deletion by checking for an HTTP 404 Not Found. We will\nbe able to correct the bad assumptions about the admin user by updating\nthe default trust policies to be aware of system scope[1] and default\nroles[2]. But in all cases, the list_trusts request works properly for\nthe admin user and is a reliable indicator of whether a trust exists.\n\n[1] https://launchpad.net/bugs/1818850\n[2] https://launchpad.net/bugs/1818846\n\nChange-Id: I35d8eac972a8785b629f4cd538b521021fa33353\nNeeded-by: https://review.opendev.org/676528\nRelated-bug: #1840288\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/tempest/commit/75c99e884738118c7243d4d2ba7f49e864d34577"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/tempest/commit/75c99e884738118c7243d4d2ba7f49e864d34577"}]},"branch":"refs/heads/master"},"f986c85c79a2df9b0435cb94b41c39fbebbfbab5":{"kind":"REWORK","_number":2,"created":"2019-08-15 20:40:26.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/45/676745/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/tempest","ref":"refs/changes/45/676745/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/tempest refs/changes/45/676745/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/tempest refs/changes/45/676745/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/tempest refs/changes/45/676745/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/tempest refs/changes/45/676745/2"}}},"commit":{"parents":[{"commit":"556109dd53f5a7be11261ffab02fb82dace0c9e4","subject":"Merge \"Add API reference for metering_label_rules_client\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/tempest/commit/556109dd53f5a7be11261ffab02fb82dace0c9e4"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 17:56:29.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 20:40:17.000000000","tz":-420},"subject":"Use list_trusts to check for deleted trust","message":"Use list_trusts to check for deleted trust\n\nThe keystone trusts API currently makes some flawed choices about access\ncontrol. First, there is a security issue whereby trust existence is\nleaked to unauthorized users (see related bug). Second, it explicitly\nprevents the admin user from retrieving a trust. In order to correct the\nfirst issue, we need to change the keystone API to correctly return an\nHTTP 403 Forbidden in the case that a trust does not exist. This impacts\ntempest, which runs as the admin user, and is expecting to be able to\nvalidate a trust deletion by checking for an HTTP 404 Not Found. We will\nbe able to correct the bad assumptions about the admin user by updating\nthe default trust policies to be aware of system scope[1] and default\nroles[2]. But in all cases, the list_trusts request works properly for\nthe admin user and is a reliable indicator of whether a trust exists.\n\n[1] https://launchpad.net/bugs/1818850\n[2] https://launchpad.net/bugs/1818846\n\nChange-Id: I35d8eac972a8785b629f4cd538b521021fa33353\nNeeded-by: https://review.opendev.org/676528\nRelated-bug: #1840288\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/tempest/commit/f986c85c79a2df9b0435cb94b41c39fbebbfbab5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/tempest/commit/f986c85c79a2df9b0435cb94b41c39fbebbfbab5"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}