all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe4e:1ddf
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 318ce124-2050-4e5e-9283-d9ef6cdb9381
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe4e:1ddf
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.101
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.143
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe4e:1ddf
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job python-black explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#54>'
      - '<Job python-black explicit: None implied: None source: osism/openstack-image-manager/.zuul.yaml@main#16>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 242b2bd41c3a42a09711ae6f7dfe6fd9
      build_refs:
      - branch: main
        change: '1235'
        change_message: "Harden upstream checksum fetching and validation\n\nFollow-up
          to the review of the `checksum_url` feature:\n\n- #1202\n\nThese robustness
          gaps predate that PR \u2014 it merely duplicated existing patterns onto
          the new `checksum_url` path \u2014 so they are fixed here uniformly across
          both checksum paths instead of being requested as changes on the contribution.\n\n##
          Changes\n\n**Harden both checksum fetch sites.** `get_checksum_from_checksums_url`
          and `get_checksum_from_checksum_url` called `requests.get()` with no timeout,
          status check, or exception handling, outside any `try/except` on the `process_image`
          path. A connection failure or invalid URL aborted the entire run, a hung
          server blocked it indefinitely, and an HTTP error page was parsed as a checksums
          file, producing a misleading \"could not find checksum\" message. Both sites
          now use a bounded timeout, call `raise_for_status()`, and catch `requests.RequestException`
          by logging and returning an empty checksum, so a failing checksum URL only
          skips that image.\n\n**Validate hexadecimal content in `is_checksum()`.**
          It previously accepted any 32/40/64/128-character string without a period
          (e.g. `\"x\" * 64`). Since this value is stored as the `upstream_checksum`
          property and drives latest-image change detection, fixed-length junk could
          suppress a needed update or force a spurious re-import.\n\n**Restrict checksum
          URL schemes to HTTP(S).** The schema accepted `ftp://`/`ftps://` for `checksum_url`,
          `checksums_url`, and `latest_checksum_url`, but `requests.get()` has no
          FTP adapter and raises `InvalidSchema`, so a schema-valid configuration
          could abort the manager. No existing image definition uses FTP URLs.\n\n**Add
          unit tests** for `is_checksum`, both fetch functions (bare digest, manifest
          matching, junk body, HTTP error, connection failure, timeout usage), and
          the schema URL scheme restriction.\n\n**Document the field contract**: `checksums_url`
          expects a manifest containing the image filename; `checksum_url` expects
          a single bare digest (e.g. Alpine sidecar files).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/openstack-image-manager/pull/1235
        commit_id: d5d7e734f37dafacae7b74243d64029e4369551b
        patchset: d5d7e734f37dafacae7b74243d64029e4369551b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/openstack-image-manager
          name: osism/openstack-image-manager
          short_name: openstack-image-manager
        src_dir: src/github.com/osism/openstack-image-manager
        topic: null
      buildset: 0864ee89004640ad9b855f372e527c32
      buildset_refs:
      - branch: main
        change: '1235'
        change_message: "Harden upstream checksum fetching and validation\n\nFollow-up
          to the review of the `checksum_url` feature:\n\n- #1202\n\nThese robustness
          gaps predate that PR \u2014 it merely duplicated existing patterns onto
          the new `checksum_url` path \u2014 so they are fixed here uniformly across
          both checksum paths instead of being requested as changes on the contribution.\n\n##
          Changes\n\n**Harden both checksum fetch sites.** `get_checksum_from_checksums_url`
          and `get_checksum_from_checksum_url` called `requests.get()` with no timeout,
          status check, or exception handling, outside any `try/except` on the `process_image`
          path. A connection failure or invalid URL aborted the entire run, a hung
          server blocked it indefinitely, and an HTTP error page was parsed as a checksums
          file, producing a misleading \"could not find checksum\" message. Both sites
          now use a bounded timeout, call `raise_for_status()`, and catch `requests.RequestException`
          by logging and returning an empty checksum, so a failing checksum URL only
          skips that image.\n\n**Validate hexadecimal content in `is_checksum()`.**
          It previously accepted any 32/40/64/128-character string without a period
          (e.g. `\"x\" * 64`). Since this value is stored as the `upstream_checksum`
          property and drives latest-image change detection, fixed-length junk could
          suppress a needed update or force a spurious re-import.\n\n**Restrict checksum
          URL schemes to HTTP(S).** The schema accepted `ftp://`/`ftps://` for `checksum_url`,
          `checksums_url`, and `latest_checksum_url`, but `requests.get()` has no
          FTP adapter and raises `InvalidSchema`, so a schema-valid configuration
          could abort the manager. No existing image definition uses FTP URLs.\n\n**Add
          unit tests** for `is_checksum`, both fetch functions (bare digest, manifest
          matching, junk body, HTTP error, connection failure, timeout usage), and
          the schema URL scheme restriction.\n\n**Document the field contract**: `checksums_url`
          expects a manifest containing the image filename; `checksum_url` expects
          a single bare digest (e.g. Alpine sidecar files).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/openstack-image-manager/pull/1235
        commit_id: d5d7e734f37dafacae7b74243d64029e4369551b
        patchset: d5d7e734f37dafacae7b74243d64029e4369551b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/openstack-image-manager
          name: osism/openstack-image-manager
          short_name: openstack-image-manager
        src_dir: src/github.com/osism/openstack-image-manager
        topic: null
      change: '1235'
      change_message: "Harden upstream checksum fetching and validation\n\nFollow-up
        to the review of the `checksum_url` feature:\n\n- #1202\n\nThese robustness
        gaps predate that PR \u2014 it merely duplicated existing patterns onto the
        new `checksum_url` path \u2014 so they are fixed here uniformly across both
        checksum paths instead of being requested as changes on the contribution.\n\n##
        Changes\n\n**Harden both checksum fetch sites.** `get_checksum_from_checksums_url`
        and `get_checksum_from_checksum_url` called `requests.get()` with no timeout,
        status check, or exception handling, outside any `try/except` on the `process_image`
        path. A connection failure or invalid URL aborted the entire run, a hung server
        blocked it indefinitely, and an HTTP error page was parsed as a checksums
        file, producing a misleading \"could not find checksum\" message. Both sites
        now use a bounded timeout, call `raise_for_status()`, and catch `requests.RequestException`
        by logging and returning an empty checksum, so a failing checksum URL only
        skips that image.\n\n**Validate hexadecimal content in `is_checksum()`.**
        It previously accepted any 32/40/64/128-character string without a period
        (e.g. `\"x\" * 64`). Since this value is stored as the `upstream_checksum`
        property and drives latest-image change detection, fixed-length junk could
        suppress a needed update or force a spurious re-import.\n\n**Restrict checksum
        URL schemes to HTTP(S).** The schema accepted `ftp://`/`ftps://` for `checksum_url`,
        `checksums_url`, and `latest_checksum_url`, but `requests.get()` has no FTP
        adapter and raises `InvalidSchema`, so a schema-valid configuration could
        abort the manager. No existing image definition uses FTP URLs.\n\n**Add unit
        tests** for `is_checksum`, both fetch functions (bare digest, manifest matching,
        junk body, HTTP error, connection failure, timeout usage), and the schema
        URL scheme restriction.\n\n**Document the field contract**: `checksums_url`
        expects a manifest containing the image filename; `checksum_url` expects a
        single bare digest (e.g. Alpine sidecar files).\n\n\U0001F916 Generated with
        [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/openstack-image-manager/pull/1235
      child_jobs: []
      commit_id: d5d7e734f37dafacae7b74243d64029e4369551b
      event_id: 4f910420-6557-11f1-9792-ea4b354969a0
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/242b2bd41c3a42a09711ae6f7dfe6fd9/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/242b2bd41c3a42a09711ae6f7dfe6fd9/work/logs
        result_data_file: /var/lib/zuul/builds/242b2bd41c3a42a09711ae6f7dfe6fd9/work/results.json
        src_root: /var/lib/zuul/builds/242b2bd41c3a42a09711ae6f7dfe6fd9/work/src
        work_root: /var/lib/zuul/builds/242b2bd41c3a42a09711ae6f7dfe6fd9/work
      include_vars: []
      items:
      - branch: main
        change: '1235'
        change_message: "Harden upstream checksum fetching and validation\n\nFollow-up
          to the review of the `checksum_url` feature:\n\n- #1202\n\nThese robustness
          gaps predate that PR \u2014 it merely duplicated existing patterns onto
          the new `checksum_url` path \u2014 so they are fixed here uniformly across
          both checksum paths instead of being requested as changes on the contribution.\n\n##
          Changes\n\n**Harden both checksum fetch sites.** `get_checksum_from_checksums_url`
          and `get_checksum_from_checksum_url` called `requests.get()` with no timeout,
          status check, or exception handling, outside any `try/except` on the `process_image`
          path. A connection failure or invalid URL aborted the entire run, a hung
          server blocked it indefinitely, and an HTTP error page was parsed as a checksums
          file, producing a misleading \"could not find checksum\" message. Both sites
          now use a bounded timeout, call `raise_for_status()`, and catch `requests.RequestException`
          by logging and returning an empty checksum, so a failing checksum URL only
          skips that image.\n\n**Validate hexadecimal content in `is_checksum()`.**
          It previously accepted any 32/40/64/128-character string without a period
          (e.g. `\"x\" * 64`). Since this value is stored as the `upstream_checksum`
          property and drives latest-image change detection, fixed-length junk could
          suppress a needed update or force a spurious re-import.\n\n**Restrict checksum
          URL schemes to HTTP(S).** The schema accepted `ftp://`/`ftps://` for `checksum_url`,
          `checksums_url`, and `latest_checksum_url`, but `requests.get()` has no
          FTP adapter and raises `InvalidSchema`, so a schema-valid configuration
          could abort the manager. No existing image definition uses FTP URLs.\n\n**Add
          unit tests** for `is_checksum`, both fetch functions (bare digest, manifest
          matching, junk body, HTTP error, connection failure, timeout usage), and
          the schema URL scheme restriction.\n\n**Document the field contract**: `checksums_url`
          expects a manifest containing the image filename; `checksum_url` expects
          a single bare digest (e.g. Alpine sidecar files).\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/openstack-image-manager/pull/1235
        commit_id: d5d7e734f37dafacae7b74243d64029e4369551b
        patchset: d5d7e734f37dafacae7b74243d64029e4369551b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/openstack-image-manager
          name: osism/openstack-image-manager
          short_name: openstack-image-manager
          src_dir: src/github.com/osism/openstack-image-manager
        topic: null
      job: python-black
      jobtags: []
      max_attempts: 3
      message: SGFyZGVuIHVwc3RyZWFtIGNoZWNrc3VtIGZldGNoaW5nIGFuZCB2YWxpZGF0aW9uCgpGb2xsb3ctdXAgdG8gdGhlIHJldmlldyBvZiB0aGUgYGNoZWNrc3VtX3VybGAgZmVhdHVyZToKCi0gIzEyMDIKClRoZXNlIHJvYnVzdG5lc3MgZ2FwcyBwcmVkYXRlIHRoYXQgUFIg4oCUIGl0IG1lcmVseSBkdXBsaWNhdGVkIGV4aXN0aW5nIHBhdHRlcm5zIG9udG8gdGhlIG5ldyBgY2hlY2tzdW1fdXJsYCBwYXRoIOKAlCBzbyB0aGV5IGFyZSBmaXhlZCBoZXJlIHVuaWZvcm1seSBhY3Jvc3MgYm90aCBjaGVja3N1bSBwYXRocyBpbnN0ZWFkIG9mIGJlaW5nIHJlcXVlc3RlZCBhcyBjaGFuZ2VzIG9uIHRoZSBjb250cmlidXRpb24uCgojIyBDaGFuZ2VzCgoqKkhhcmRlbiBib3RoIGNoZWNrc3VtIGZldGNoIHNpdGVzLioqIGBnZXRfY2hlY2tzdW1fZnJvbV9jaGVja3N1bXNfdXJsYCBhbmQgYGdldF9jaGVja3N1bV9mcm9tX2NoZWNrc3VtX3VybGAgY2FsbGVkIGByZXF1ZXN0cy5nZXQoKWAgd2l0aCBubyB0aW1lb3V0LCBzdGF0dXMgY2hlY2ssIG9yIGV4Y2VwdGlvbiBoYW5kbGluZywgb3V0c2lkZSBhbnkgYHRyeS9leGNlcHRgIG9uIHRoZSBgcHJvY2Vzc19pbWFnZWAgcGF0aC4gQSBjb25uZWN0aW9uIGZhaWx1cmUgb3IgaW52YWxpZCBVUkwgYWJvcnRlZCB0aGUgZW50aXJlIHJ1biwgYSBodW5nIHNlcnZlciBibG9ja2VkIGl0IGluZGVmaW5pdGVseSwgYW5kIGFuIEhUVFAgZXJyb3IgcGFnZSB3YXMgcGFyc2VkIGFzIGEgY2hlY2tzdW1zIGZpbGUsIHByb2R1Y2luZyBhIG1pc2xlYWRpbmcgImNvdWxkIG5vdCBmaW5kIGNoZWNrc3VtIiBtZXNzYWdlLiBCb3RoIHNpdGVzIG5vdyB1c2UgYSBib3VuZGVkIHRpbWVvdXQsIGNhbGwgYHJhaXNlX2Zvcl9zdGF0dXMoKWAsIGFuZCBjYXRjaCBgcmVxdWVzdHMuUmVxdWVzdEV4Y2VwdGlvbmAgYnkgbG9nZ2luZyBhbmQgcmV0dXJuaW5nIGFuIGVtcHR5IGNoZWNrc3VtLCBzbyBhIGZhaWxpbmcgY2hlY2tzdW0gVVJMIG9ubHkgc2tpcHMgdGhhdCBpbWFnZS4KCioqVmFsaWRhdGUgaGV4YWRlY2ltYWwgY29udGVudCBpbiBgaXNfY2hlY2tzdW0oKWAuKiogSXQgcHJldmlvdXNseSBhY2NlcHRlZCBhbnkgMzIvNDAvNjQvMTI4LWNoYXJhY3RlciBzdHJpbmcgd2l0aG91dCBhIHBlcmlvZCAoZS5nLiBgIngiICogNjRgKS4gU2luY2UgdGhpcyB2YWx1ZSBpcyBzdG9yZWQgYXMgdGhlIGB1cHN0cmVhbV9jaGVja3N1bWAgcHJvcGVydHkgYW5kIGRyaXZlcyBsYXRlc3QtaW1hZ2UgY2hhbmdlIGRldGVjdGlvbiwgZml4ZWQtbGVuZ3RoIGp1bmsgY291bGQgc3VwcHJlc3MgYSBuZWVkZWQgdXBkYXRlIG9yIGZvcmNlIGEgc3B1cmlvdXMgcmUtaW1wb3J0LgoKKipSZXN0cmljdCBjaGVja3N1bSBVUkwgc2NoZW1lcyB0byBIVFRQKFMpLioqIFRoZSBzY2hlbWEgYWNjZXB0ZWQgYGZ0cDovL2AvYGZ0cHM6Ly9gIGZvciBgY2hlY2tzdW1fdXJsYCwgYGNoZWNrc3Vtc191cmxgLCBhbmQgYGxhdGVzdF9jaGVja3N1bV91cmxgLCBidXQgYHJlcXVlc3RzLmdldCgpYCBoYXMgbm8gRlRQIGFkYXB0ZXIgYW5kIHJhaXNlcyBgSW52YWxpZFNjaGVtYWAsIHNvIGEgc2NoZW1hLXZhbGlkIGNvbmZpZ3VyYXRpb24gY291bGQgYWJvcnQgdGhlIG1hbmFnZXIuIE5vIGV4aXN0aW5nIGltYWdlIGRlZmluaXRpb24gdXNlcyBGVFAgVVJMcy4KCioqQWRkIHVuaXQgdGVzdHMqKiBmb3IgYGlzX2NoZWNrc3VtYCwgYm90aCBmZXRjaCBmdW5jdGlvbnMgKGJhcmUgZGlnZXN0LCBtYW5pZmVzdCBtYXRjaGluZywganVuayBib2R5LCBIVFRQIGVycm9yLCBjb25uZWN0aW9uIGZhaWx1cmUsIHRpbWVvdXQgdXNhZ2UpLCBhbmQgdGhlIHNjaGVtYSBVUkwgc2NoZW1lIHJlc3RyaWN0aW9uLgoKKipEb2N1bWVudCB0aGUgZmllbGQgY29udHJhY3QqKjogYGNoZWNrc3Vtc191cmxgIGV4cGVjdHMgYSBtYW5pZmVzdCBjb250YWluaW5nIHRoZSBpbWFnZSBmaWxlbmFtZTsgYGNoZWNrc3VtX3VybGAgZXhwZWN0cyBhIHNpbmdsZSBiYXJlIGRpZ2VzdCAoZS5nLiBBbHBpbmUgc2lkZWNhciBmaWxlcykuCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQ==
      patchset: d5d7e734f37dafacae7b74243d64029e4369551b
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/python-black/run.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/openstack-image-manager
        name: osism/openstack-image-manager
        short_name: openstack-image-manager
        src_dir: src/github.com/osism/openstack-image-manager
      projects:
        github.com/osism/openstack-image-manager:
          canonical_hostname: github.com
          canonical_name: github.com/osism/openstack-image-manager
          checkout: main
          checkout_description: zuul branch
          commit: 404a184b64b4eb627aac3df818bad076202dca6f
          name: osism/openstack-image-manager
          required: false
          short_name: openstack-image-manager
          src_dir: src/github.com/osism/openstack-image-manager
      ref: refs/pull/1235/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
