all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe7c:a0e
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      docker_namespace: kolla
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: f606254a-6da2-479c-8ef4-c2139257025e
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe7c:a0e
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.230
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.125
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe7c:a0e
        region: null
        slot: null
      push_images: false
      version_openstack: '2024.2'
  vars:
    docker_namespace: kolla
    push_images: false
    version_openstack: '2024.2'
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job container-images-kolla-patch explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#76>'
      - '<Job container-images-kolla-patch-2024.2 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#108>'
      - '<Job container-images-kolla-patch-2024.2 explicit: None implied: None source:
        osism/container-images-kolla/.zuul.yaml@main#213>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 8cb3d8919e64484f991cd7bf6e8ad5d0
      build_refs:
      - branch: main
        change: '739'
        change_message: "keystone: Drop 2025.1 CVE patches merged upstream\n\n## What\n\nDrops
          the carried keystone CVE backport patches `0001`\u2013`0005` for\n2025.1.
          They were added in #731 and have since merged upstream on\n`stable/2025.1`,
          so they now apply as \"already applied\"/reversed (and\n`0001` has context-drifted
          hunks too) against the\n`keystone-27.0.2.dev20` tarball. `patch --dry-run`
          exits non-zero, so\n`container-images-kolla-push-2025.1` aborts at *Run
          build script* every\nnightly run.\n\n## Why now\n\nThis is the 2025.1 analogue
          of the 2025.2 drift already resolved in the\n`#736`/`#737`/`#738` series.
          First surfaced on the 2026-06-13\nperiodic-midnight build:\n\n- https://zuul.services.osism.tech/t/osism/build/6b20bdb9f17540fcac88ee175f59baad\n\n##
          Verification\n\nChecked each patch against the current `stable/2025.1` source\n(`HEAD
          5613a37d4`, = tarball `keystone-27.0.2.dev20`):\n\n| patch | fix | upstream?
          | action |\n|-------|-----|-----------|--------|\n| 0001 | Enforce delegation
          project boundary (bug #2150089) | yes | drop |\n| 0002 | Fix user impersonation
          (CVE-2026-42998) | yes | drop |\n| 0003 | Forbid trust ops via app credentials
          (CVE-2026-43000) | yes | drop |\n| 0004 | Preserve expires_at when rescoping
          (CVE-2026-44394) | yes | drop |\n| 0005 | Prevent RBAC policy bypass (CVE-2026-42999)
          | yes | drop |\n| 0006 | Block app credential token rescoping (bug 2144966)
          | no | **keep** |\n| 0007 | Include system scope in rescope guard | no |
          **keep** |\n\n`0001`\u2013`0005` were confirmed present in the upstream
          `stable/2025.1` log\n(merge commits for each CVE); `0006`/`0007` are absent
          upstream and still\napply cleanly (forward, no fuzz) at their existing numbers.
          Same\nkeep-numbering approach as `b769eb1` (#648) / the 2025.2 series.\n\nCVE
          coverage is preserved \u2014 the fixes now live in the upstream tarball\ninstead
          of local patches.\n\n## Related\n\n- #731 \u2014 added the 2025.1 keystone
          CVE patches being dropped here\n- #736 \u2014 equivalent 2025.2 drop (0001\u20130003)\n-
          #737 \u2014 equivalent 2025.2 drop (0004)\n- #738 \u2014 equivalent 2025.2
          drop (0005)"
        change_url: https://github.com/osism/container-images-kolla/pull/739
        commit_id: bf006dcf0abf121da403cb158f4da080c090beba
        patchset: bf006dcf0abf121da403cb158f4da080c090beba
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      buildset: 5e32e9c486bc45a69d4d2e378767e0aa
      buildset_refs:
      - branch: main
        change: '739'
        change_message: "keystone: Drop 2025.1 CVE patches merged upstream\n\n## What\n\nDrops
          the carried keystone CVE backport patches `0001`\u2013`0005` for\n2025.1.
          They were added in #731 and have since merged upstream on\n`stable/2025.1`,
          so they now apply as \"already applied\"/reversed (and\n`0001` has context-drifted
          hunks too) against the\n`keystone-27.0.2.dev20` tarball. `patch --dry-run`
          exits non-zero, so\n`container-images-kolla-push-2025.1` aborts at *Run
          build script* every\nnightly run.\n\n## Why now\n\nThis is the 2025.1 analogue
          of the 2025.2 drift already resolved in the\n`#736`/`#737`/`#738` series.
          First surfaced on the 2026-06-13\nperiodic-midnight build:\n\n- https://zuul.services.osism.tech/t/osism/build/6b20bdb9f17540fcac88ee175f59baad\n\n##
          Verification\n\nChecked each patch against the current `stable/2025.1` source\n(`HEAD
          5613a37d4`, = tarball `keystone-27.0.2.dev20`):\n\n| patch | fix | upstream?
          | action |\n|-------|-----|-----------|--------|\n| 0001 | Enforce delegation
          project boundary (bug #2150089) | yes | drop |\n| 0002 | Fix user impersonation
          (CVE-2026-42998) | yes | drop |\n| 0003 | Forbid trust ops via app credentials
          (CVE-2026-43000) | yes | drop |\n| 0004 | Preserve expires_at when rescoping
          (CVE-2026-44394) | yes | drop |\n| 0005 | Prevent RBAC policy bypass (CVE-2026-42999)
          | yes | drop |\n| 0006 | Block app credential token rescoping (bug 2144966)
          | no | **keep** |\n| 0007 | Include system scope in rescope guard | no |
          **keep** |\n\n`0001`\u2013`0005` were confirmed present in the upstream
          `stable/2025.1` log\n(merge commits for each CVE); `0006`/`0007` are absent
          upstream and still\napply cleanly (forward, no fuzz) at their existing numbers.
          Same\nkeep-numbering approach as `b769eb1` (#648) / the 2025.2 series.\n\nCVE
          coverage is preserved \u2014 the fixes now live in the upstream tarball\ninstead
          of local patches.\n\n## Related\n\n- #731 \u2014 added the 2025.1 keystone
          CVE patches being dropped here\n- #736 \u2014 equivalent 2025.2 drop (0001\u20130003)\n-
          #737 \u2014 equivalent 2025.2 drop (0004)\n- #738 \u2014 equivalent 2025.2
          drop (0005)"
        change_url: https://github.com/osism/container-images-kolla/pull/739
        commit_id: bf006dcf0abf121da403cb158f4da080c090beba
        patchset: bf006dcf0abf121da403cb158f4da080c090beba
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      change: '739'
      change_message: "keystone: Drop 2025.1 CVE patches merged upstream\n\n## What\n\nDrops
        the carried keystone CVE backport patches `0001`\u2013`0005` for\n2025.1.
        They were added in #731 and have since merged upstream on\n`stable/2025.1`,
        so they now apply as \"already applied\"/reversed (and\n`0001` has context-drifted
        hunks too) against the\n`keystone-27.0.2.dev20` tarball. `patch --dry-run`
        exits non-zero, so\n`container-images-kolla-push-2025.1` aborts at *Run build
        script* every\nnightly run.\n\n## Why now\n\nThis is the 2025.1 analogue of
        the 2025.2 drift already resolved in the\n`#736`/`#737`/`#738` series. First
        surfaced on the 2026-06-13\nperiodic-midnight build:\n\n- https://zuul.services.osism.tech/t/osism/build/6b20bdb9f17540fcac88ee175f59baad\n\n##
        Verification\n\nChecked each patch against the current `stable/2025.1` source\n(`HEAD
        5613a37d4`, = tarball `keystone-27.0.2.dev20`):\n\n| patch | fix | upstream?
        | action |\n|-------|-----|-----------|--------|\n| 0001 | Enforce delegation
        project boundary (bug #2150089) | yes | drop |\n| 0002 | Fix user impersonation
        (CVE-2026-42998) | yes | drop |\n| 0003 | Forbid trust ops via app credentials
        (CVE-2026-43000) | yes | drop |\n| 0004 | Preserve expires_at when rescoping
        (CVE-2026-44394) | yes | drop |\n| 0005 | Prevent RBAC policy bypass (CVE-2026-42999)
        | yes | drop |\n| 0006 | Block app credential token rescoping (bug 2144966)
        | no | **keep** |\n| 0007 | Include system scope in rescope guard | no | **keep**
        |\n\n`0001`\u2013`0005` were confirmed present in the upstream `stable/2025.1`
        log\n(merge commits for each CVE); `0006`/`0007` are absent upstream and still\napply
        cleanly (forward, no fuzz) at their existing numbers. Same\nkeep-numbering
        approach as `b769eb1` (#648) / the 2025.2 series.\n\nCVE coverage is preserved
        \u2014 the fixes now live in the upstream tarball\ninstead of local patches.\n\n##
        Related\n\n- #731 \u2014 added the 2025.1 keystone CVE patches being dropped
        here\n- #736 \u2014 equivalent 2025.2 drop (0001\u20130003)\n- #737 \u2014
        equivalent 2025.2 drop (0004)\n- #738 \u2014 equivalent 2025.2 drop (0005)"
      change_url: https://github.com/osism/container-images-kolla/pull/739
      child_jobs: []
      commit_id: bf006dcf0abf121da403cb158f4da080c090beba
      event_id: ad349e80-66fa-11f1-8c0d-b6be1ae88342
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/8cb3d8919e64484f991cd7bf6e8ad5d0/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/8cb3d8919e64484f991cd7bf6e8ad5d0/work/logs
        result_data_file: /var/lib/zuul/builds/8cb3d8919e64484f991cd7bf6e8ad5d0/work/results.json
        src_root: /var/lib/zuul/builds/8cb3d8919e64484f991cd7bf6e8ad5d0/work/src
        work_root: /var/lib/zuul/builds/8cb3d8919e64484f991cd7bf6e8ad5d0/work
      include_vars: []
      items:
      - branch: main
        change: '739'
        change_message: "keystone: Drop 2025.1 CVE patches merged upstream\n\n## What\n\nDrops
          the carried keystone CVE backport patches `0001`\u2013`0005` for\n2025.1.
          They were added in #731 and have since merged upstream on\n`stable/2025.1`,
          so they now apply as \"already applied\"/reversed (and\n`0001` has context-drifted
          hunks too) against the\n`keystone-27.0.2.dev20` tarball. `patch --dry-run`
          exits non-zero, so\n`container-images-kolla-push-2025.1` aborts at *Run
          build script* every\nnightly run.\n\n## Why now\n\nThis is the 2025.1 analogue
          of the 2025.2 drift already resolved in the\n`#736`/`#737`/`#738` series.
          First surfaced on the 2026-06-13\nperiodic-midnight build:\n\n- https://zuul.services.osism.tech/t/osism/build/6b20bdb9f17540fcac88ee175f59baad\n\n##
          Verification\n\nChecked each patch against the current `stable/2025.1` source\n(`HEAD
          5613a37d4`, = tarball `keystone-27.0.2.dev20`):\n\n| patch | fix | upstream?
          | action |\n|-------|-----|-----------|--------|\n| 0001 | Enforce delegation
          project boundary (bug #2150089) | yes | drop |\n| 0002 | Fix user impersonation
          (CVE-2026-42998) | yes | drop |\n| 0003 | Forbid trust ops via app credentials
          (CVE-2026-43000) | yes | drop |\n| 0004 | Preserve expires_at when rescoping
          (CVE-2026-44394) | yes | drop |\n| 0005 | Prevent RBAC policy bypass (CVE-2026-42999)
          | yes | drop |\n| 0006 | Block app credential token rescoping (bug 2144966)
          | no | **keep** |\n| 0007 | Include system scope in rescope guard | no |
          **keep** |\n\n`0001`\u2013`0005` were confirmed present in the upstream
          `stable/2025.1` log\n(merge commits for each CVE); `0006`/`0007` are absent
          upstream and still\napply cleanly (forward, no fuzz) at their existing numbers.
          Same\nkeep-numbering approach as `b769eb1` (#648) / the 2025.2 series.\n\nCVE
          coverage is preserved \u2014 the fixes now live in the upstream tarball\ninstead
          of local patches.\n\n## Related\n\n- #731 \u2014 added the 2025.1 keystone
          CVE patches being dropped here\n- #736 \u2014 equivalent 2025.2 drop (0001\u20130003)\n-
          #737 \u2014 equivalent 2025.2 drop (0004)\n- #738 \u2014 equivalent 2025.2
          drop (0005)"
        change_url: https://github.com/osism/container-images-kolla/pull/739
        commit_id: bf006dcf0abf121da403cb158f4da080c090beba
        patchset: bf006dcf0abf121da403cb158f4da080c090beba
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
        topic: null
      job: container-images-kolla-patch-2024.2
      jobtags: []
      max_attempts: 3
      message: a2V5c3RvbmU6IERyb3AgMjAyNS4xIENWRSBwYXRjaGVzIG1lcmdlZCB1cHN0cmVhbQoKIyMgV2hhdAoKRHJvcHMgdGhlIGNhcnJpZWQga2V5c3RvbmUgQ1ZFIGJhY2twb3J0IHBhdGNoZXMgYDAwMDFg4oCTYDAwMDVgIGZvcgoyMDI1LjEuIFRoZXkgd2VyZSBhZGRlZCBpbiAjNzMxIGFuZCBoYXZlIHNpbmNlIG1lcmdlZCB1cHN0cmVhbSBvbgpgc3RhYmxlLzIwMjUuMWAsIHNvIHRoZXkgbm93IGFwcGx5IGFzICJhbHJlYWR5IGFwcGxpZWQiL3JldmVyc2VkIChhbmQKYDAwMDFgIGhhcyBjb250ZXh0LWRyaWZ0ZWQgaHVua3MgdG9vKSBhZ2FpbnN0IHRoZQpga2V5c3RvbmUtMjcuMC4yLmRldjIwYCB0YXJiYWxsLiBgcGF0Y2ggLS1kcnktcnVuYCBleGl0cyBub24temVybywgc28KYGNvbnRhaW5lci1pbWFnZXMta29sbGEtcHVzaC0yMDI1LjFgIGFib3J0cyBhdCAqUnVuIGJ1aWxkIHNjcmlwdCogZXZlcnkKbmlnaHRseSBydW4uCgojIyBXaHkgbm93CgpUaGlzIGlzIHRoZSAyMDI1LjEgYW5hbG9ndWUgb2YgdGhlIDIwMjUuMiBkcmlmdCBhbHJlYWR5IHJlc29sdmVkIGluIHRoZQpgIzczNmAvYCM3MzdgL2AjNzM4YCBzZXJpZXMuIEZpcnN0IHN1cmZhY2VkIG9uIHRoZSAyMDI2LTA2LTEzCnBlcmlvZGljLW1pZG5pZ2h0IGJ1aWxkOgoKLSBodHRwczovL3p1dWwuc2VydmljZXMub3Npc20udGVjaC90L29zaXNtL2J1aWxkLzZiMjBiZGI5ZjE3NTQwZmNhYzg4ZWUxNzVmNTliYWFkCgojIyBWZXJpZmljYXRpb24KCkNoZWNrZWQgZWFjaCBwYXRjaCBhZ2FpbnN0IHRoZSBjdXJyZW50IGBzdGFibGUvMjAyNS4xYCBzb3VyY2UKKGBIRUFEIDU2MTNhMzdkNGAsID0gdGFyYmFsbCBga2V5c3RvbmUtMjcuMC4yLmRldjIwYCk6Cgp8IHBhdGNoIHwgZml4IHwgdXBzdHJlYW0/IHwgYWN0aW9uIHwKfC0tLS0tLS18LS0tLS18LS0tLS0tLS0tLS18LS0tLS0tLS18CnwgMDAwMSB8IEVuZm9yY2UgZGVsZWdhdGlvbiBwcm9qZWN0IGJvdW5kYXJ5IChidWcgIzIxNTAwODkpIHwgeWVzIHwgZHJvcCB8CnwgMDAwMiB8IEZpeCB1c2VyIGltcGVyc29uYXRpb24gKENWRS0yMDI2LTQyOTk4KSB8IHllcyB8IGRyb3AgfAp8IDAwMDMgfCBGb3JiaWQgdHJ1c3Qgb3BzIHZpYSBhcHAgY3JlZGVudGlhbHMgKENWRS0yMDI2LTQzMDAwKSB8IHllcyB8IGRyb3AgfAp8IDAwMDQgfCBQcmVzZXJ2ZSBleHBpcmVzX2F0IHdoZW4gcmVzY29waW5nIChDVkUtMjAyNi00NDM5NCkgfCB5ZXMgfCBkcm9wIHwKfCAwMDA1IHwgUHJldmVudCBSQkFDIHBvbGljeSBieXBhc3MgKENWRS0yMDI2LTQyOTk5KSB8IHllcyB8IGRyb3AgfAp8IDAwMDYgfCBCbG9jayBhcHAgY3JlZGVudGlhbCB0b2tlbiByZXNjb3BpbmcgKGJ1ZyAyMTQ0OTY2KSB8IG5vIHwgKiprZWVwKiogfAp8IDAwMDcgfCBJbmNsdWRlIHN5c3RlbSBzY29wZSBpbiByZXNjb3BlIGd1YXJkIHwgbm8gfCAqKmtlZXAqKiB8CgpgMDAwMWDigJNgMDAwNWAgd2VyZSBjb25maXJtZWQgcHJlc2VudCBpbiB0aGUgdXBzdHJlYW0gYHN0YWJsZS8yMDI1LjFgIGxvZwoobWVyZ2UgY29tbWl0cyBmb3IgZWFjaCBDVkUpOyBgMDAwNmAvYDAwMDdgIGFyZSBhYnNlbnQgdXBzdHJlYW0gYW5kIHN0aWxsCmFwcGx5IGNsZWFubHkgKGZvcndhcmQsIG5vIGZ1enopIGF0IHRoZWlyIGV4aXN0aW5nIG51bWJlcnMuIFNhbWUKa2VlcC1udW1iZXJpbmcgYXBwcm9hY2ggYXMgYGI3NjllYjFgICgjNjQ4KSAvIHRoZSAyMDI1LjIgc2VyaWVzLgoKQ1ZFIGNvdmVyYWdlIGlzIHByZXNlcnZlZCDigJQgdGhlIGZpeGVzIG5vdyBsaXZlIGluIHRoZSB1cHN0cmVhbSB0YXJiYWxsCmluc3RlYWQgb2YgbG9jYWwgcGF0Y2hlcy4KCiMjIFJlbGF0ZWQKCi0gIzczMSDigJQgYWRkZWQgdGhlIDIwMjUuMSBrZXlzdG9uZSBDVkUgcGF0Y2hlcyBiZWluZyBkcm9wcGVkIGhlcmUKLSAjNzM2IOKAlCBlcXVpdmFsZW50IDIwMjUuMiBkcm9wICgwMDAx4oCTMDAwMykKLSAjNzM3IOKAlCBlcXVpdmFsZW50IDIwMjUuMiBkcm9wICgwMDA0KQotICM3Mzgg4oCUIGVxdWl2YWxlbnQgMjAyNS4yIGRyb3AgKDAwMDUp
      patchset: bf006dcf0abf121da403cb158f4da080c090beba
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/container-images-kolla:
            canonical_name: github.com/osism/container-images-kolla
            checkout: main
            commit: 2112ed4ae4fa6fc6632d67060a91d00a5b0a5fb0
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 688445d15ac2c497396b682f69c57ccd484f5f25
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
        playbooks:
        - path: untrusted/project_0/github.com/osism/container-images-kolla/playbooks/patch.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images-kolla
        name: osism/container-images-kolla
        short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
      projects:
        github.com/osism/container-images-kolla:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          checkout: main
          checkout_description: zuul branch
          commit: 2112ed4ae4fa6fc6632d67060a91d00a5b0a5fb0
          name: osism/container-images-kolla
          required: false
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
      ref: refs/pull/739/head
      resources: {}
      tenant: osism
      timeout: 10800
      topic: null
      voting: true
