all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe1a:bb89
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: d3031380-ff0e-45c5-837c-ef1844150323
        host_id: 55633341e2323245483187cac115f046b03a9f9bdd80b43c7e9345ac
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe1a:bb89
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.106
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.226
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe1a:bb89
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/container-images-kolla/.zuul.yaml@main#185>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: e6bf938ec05d47f98f7fd1526458bc08
      build_refs:
      - branch: main
        change: '688'
        change_message: "nova: Add fixes for cve-2026-24708\n\nSubject: [PATCH] Make
          disk.extend() pass format to qemu-img\r\n\r\nThis fixes an instance of us
          passing a disk image to qemu-img for resize where we don't constrain the
          format. As has previously been identified, it is never safe to do that when
          the image itself is not trusted. In this case, an instance with a previously-raw
          disk image being used by imagebackend.Flat is susceptible to the user writing
          a qcow2 (or other) header to their disk causing the unconstrained qemu-img
          resize operation to interpret it as a qcow2 file.\r\n\r\nSince Flat maintains
          the intended disk format in the disk.info file, and since we would have
          safety-checked images we got from glance, we should be able to trust the
          image.format specifier, which comes from driver_format in imagebackend,
          which is read from disk.info. Since only raw or qcow2 files should be resized
          anyway, we can further constrain it to those.\r\n\r\nNotes:\r\n 1. qemu-img
          refuses to resize some types of VMDK files, but it may be able to resize
          others (there are many subformats). Technically, Flat will allow running
          an instance directly from a VMDK file, and so this change _could_ be limiting
          existing \"unintentionally works\" behavior.\r\n 2. This assumes that disk.info
          is correct, present, etc. The code to handle disk.info will regenerate the
          file if it's missing or unreadable by probing the image without a safety
          check, which would be unsafe. However, that is a much more sophisticated
          attack, requiring either access to the system to delete the file or an errant
          operator action in the first place."
        change_url: https://github.com/osism/container-images-kolla/pull/688
        commit_id: cffeb268edfc504f1fdf8977d62723d30b73a75b
        patchset: cffeb268edfc504f1fdf8977d62723d30b73a75b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      buildset: dfa02bd7f18342fdb97db51f507fbe38
      buildset_refs:
      - branch: main
        change: '688'
        change_message: "nova: Add fixes for cve-2026-24708\n\nSubject: [PATCH] Make
          disk.extend() pass format to qemu-img\r\n\r\nThis fixes an instance of us
          passing a disk image to qemu-img for resize where we don't constrain the
          format. As has previously been identified, it is never safe to do that when
          the image itself is not trusted. In this case, an instance with a previously-raw
          disk image being used by imagebackend.Flat is susceptible to the user writing
          a qcow2 (or other) header to their disk causing the unconstrained qemu-img
          resize operation to interpret it as a qcow2 file.\r\n\r\nSince Flat maintains
          the intended disk format in the disk.info file, and since we would have
          safety-checked images we got from glance, we should be able to trust the
          image.format specifier, which comes from driver_format in imagebackend,
          which is read from disk.info. Since only raw or qcow2 files should be resized
          anyway, we can further constrain it to those.\r\n\r\nNotes:\r\n 1. qemu-img
          refuses to resize some types of VMDK files, but it may be able to resize
          others (there are many subformats). Technically, Flat will allow running
          an instance directly from a VMDK file, and so this change _could_ be limiting
          existing \"unintentionally works\" behavior.\r\n 2. This assumes that disk.info
          is correct, present, etc. The code to handle disk.info will regenerate the
          file if it's missing or unreadable by probing the image without a safety
          check, which would be unsafe. However, that is a much more sophisticated
          attack, requiring either access to the system to delete the file or an errant
          operator action in the first place."
        change_url: https://github.com/osism/container-images-kolla/pull/688
        commit_id: cffeb268edfc504f1fdf8977d62723d30b73a75b
        patchset: cffeb268edfc504f1fdf8977d62723d30b73a75b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      change: '688'
      change_message: "nova: Add fixes for cve-2026-24708\n\nSubject: [PATCH] Make
        disk.extend() pass format to qemu-img\r\n\r\nThis fixes an instance of us
        passing a disk image to qemu-img for resize where we don't constrain the format.
        As has previously been identified, it is never safe to do that when the image
        itself is not trusted. In this case, an instance with a previously-raw disk
        image being used by imagebackend.Flat is susceptible to the user writing a
        qcow2 (or other) header to their disk causing the unconstrained qemu-img resize
        operation to interpret it as a qcow2 file.\r\n\r\nSince Flat maintains the
        intended disk format in the disk.info file, and since we would have safety-checked
        images we got from glance, we should be able to trust the image.format specifier,
        which comes from driver_format in imagebackend, which is read from disk.info.
        Since only raw or qcow2 files should be resized anyway, we can further constrain
        it to those.\r\n\r\nNotes:\r\n 1. qemu-img refuses to resize some types of
        VMDK files, but it may be able to resize others (there are many subformats).
        Technically, Flat will allow running an instance directly from a VMDK file,
        and so this change _could_ be limiting existing \"unintentionally works\"
        behavior.\r\n 2. This assumes that disk.info is correct, present, etc. The
        code to handle disk.info will regenerate the file if it's missing or unreadable
        by probing the image without a safety check, which would be unsafe. However,
        that is a much more sophisticated attack, requiring either access to the system
        to delete the file or an errant operator action in the first place."
      change_url: https://github.com/osism/container-images-kolla/pull/688
      child_jobs: []
      commit_id: cffeb268edfc504f1fdf8977d62723d30b73a75b
      event_id: 99943090-0c0d-11f1-94ea-5d3b67d939e7
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/e6bf938ec05d47f98f7fd1526458bc08/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/e6bf938ec05d47f98f7fd1526458bc08/work/logs
        result_data_file: /var/lib/zuul/builds/e6bf938ec05d47f98f7fd1526458bc08/work/results.json
        src_root: /var/lib/zuul/builds/e6bf938ec05d47f98f7fd1526458bc08/work/src
        work_root: /var/lib/zuul/builds/e6bf938ec05d47f98f7fd1526458bc08/work
      include_vars: []
      items:
      - branch: main
        change: '688'
        change_message: "nova: Add fixes for cve-2026-24708\n\nSubject: [PATCH] Make
          disk.extend() pass format to qemu-img\r\n\r\nThis fixes an instance of us
          passing a disk image to qemu-img for resize where we don't constrain the
          format. As has previously been identified, it is never safe to do that when
          the image itself is not trusted. In this case, an instance with a previously-raw
          disk image being used by imagebackend.Flat is susceptible to the user writing
          a qcow2 (or other) header to their disk causing the unconstrained qemu-img
          resize operation to interpret it as a qcow2 file.\r\n\r\nSince Flat maintains
          the intended disk format in the disk.info file, and since we would have
          safety-checked images we got from glance, we should be able to trust the
          image.format specifier, which comes from driver_format in imagebackend,
          which is read from disk.info. Since only raw or qcow2 files should be resized
          anyway, we can further constrain it to those.\r\n\r\nNotes:\r\n 1. qemu-img
          refuses to resize some types of VMDK files, but it may be able to resize
          others (there are many subformats). Technically, Flat will allow running
          an instance directly from a VMDK file, and so this change _could_ be limiting
          existing \"unintentionally works\" behavior.\r\n 2. This assumes that disk.info
          is correct, present, etc. The code to handle disk.info will regenerate the
          file if it's missing or unreadable by probing the image without a safety
          check, which would be unsafe. However, that is a much more sophisticated
          attack, requiring either access to the system to delete the file or an errant
          operator action in the first place."
        change_url: https://github.com/osism/container-images-kolla/pull/688
        commit_id: cffeb268edfc504f1fdf8977d62723d30b73a75b
        patchset: cffeb268edfc504f1fdf8977d62723d30b73a75b
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: bm92YTogQWRkIGZpeGVzIGZvciBjdmUtMjAyNi0yNDcwOAoKU3ViamVjdDogW1BBVENIXSBNYWtlIGRpc2suZXh0ZW5kKCkgcGFzcyBmb3JtYXQgdG8gcWVtdS1pbWcNCg0KVGhpcyBmaXhlcyBhbiBpbnN0YW5jZSBvZiB1cyBwYXNzaW5nIGEgZGlzayBpbWFnZSB0byBxZW11LWltZyBmb3IgcmVzaXplIHdoZXJlIHdlIGRvbid0IGNvbnN0cmFpbiB0aGUgZm9ybWF0LiBBcyBoYXMgcHJldmlvdXNseSBiZWVuIGlkZW50aWZpZWQsIGl0IGlzIG5ldmVyIHNhZmUgdG8gZG8gdGhhdCB3aGVuIHRoZSBpbWFnZSBpdHNlbGYgaXMgbm90IHRydXN0ZWQuIEluIHRoaXMgY2FzZSwgYW4gaW5zdGFuY2Ugd2l0aCBhIHByZXZpb3VzbHktcmF3IGRpc2sgaW1hZ2UgYmVpbmcgdXNlZCBieSBpbWFnZWJhY2tlbmQuRmxhdCBpcyBzdXNjZXB0aWJsZSB0byB0aGUgdXNlciB3cml0aW5nIGEgcWNvdzIgKG9yIG90aGVyKSBoZWFkZXIgdG8gdGhlaXIgZGlzayBjYXVzaW5nIHRoZSB1bmNvbnN0cmFpbmVkIHFlbXUtaW1nIHJlc2l6ZSBvcGVyYXRpb24gdG8gaW50ZXJwcmV0IGl0IGFzIGEgcWNvdzIgZmlsZS4NCg0KU2luY2UgRmxhdCBtYWludGFpbnMgdGhlIGludGVuZGVkIGRpc2sgZm9ybWF0IGluIHRoZSBkaXNrLmluZm8gZmlsZSwgYW5kIHNpbmNlIHdlIHdvdWxkIGhhdmUgc2FmZXR5LWNoZWNrZWQgaW1hZ2VzIHdlIGdvdCBmcm9tIGdsYW5jZSwgd2Ugc2hvdWxkIGJlIGFibGUgdG8gdHJ1c3QgdGhlIGltYWdlLmZvcm1hdCBzcGVjaWZpZXIsIHdoaWNoIGNvbWVzIGZyb20gZHJpdmVyX2Zvcm1hdCBpbiBpbWFnZWJhY2tlbmQsIHdoaWNoIGlzIHJlYWQgZnJvbSBkaXNrLmluZm8uIFNpbmNlIG9ubHkgcmF3IG9yIHFjb3cyIGZpbGVzIHNob3VsZCBiZSByZXNpemVkIGFueXdheSwgd2UgY2FuIGZ1cnRoZXIgY29uc3RyYWluIGl0IHRvIHRob3NlLg0KDQpOb3RlczoNCiAxLiBxZW11LWltZyByZWZ1c2VzIHRvIHJlc2l6ZSBzb21lIHR5cGVzIG9mIFZNREsgZmlsZXMsIGJ1dCBpdCBtYXkgYmUgYWJsZSB0byByZXNpemUgb3RoZXJzICh0aGVyZSBhcmUgbWFueSBzdWJmb3JtYXRzKS4gVGVjaG5pY2FsbHksIEZsYXQgd2lsbCBhbGxvdyBydW5uaW5nIGFuIGluc3RhbmNlIGRpcmVjdGx5IGZyb20gYSBWTURLIGZpbGUsIGFuZCBzbyB0aGlzIGNoYW5nZSBfY291bGRfIGJlIGxpbWl0aW5nIGV4aXN0aW5nICJ1bmludGVudGlvbmFsbHkgd29ya3MiIGJlaGF2aW9yLg0KIDIuIFRoaXMgYXNzdW1lcyB0aGF0IGRpc2suaW5mbyBpcyBjb3JyZWN0LCBwcmVzZW50LCBldGMuIFRoZSBjb2RlIHRvIGhhbmRsZSBkaXNrLmluZm8gd2lsbCByZWdlbmVyYXRlIHRoZSBmaWxlIGlmIGl0J3MgbWlzc2luZyBvciB1bnJlYWRhYmxlIGJ5IHByb2JpbmcgdGhlIGltYWdlIHdpdGhvdXQgYSBzYWZldHkgY2hlY2ssIHdoaWNoIHdvdWxkIGJlIHVuc2FmZS4gSG93ZXZlciwgdGhhdCBpcyBhIG11Y2ggbW9yZSBzb3BoaXN0aWNhdGVkIGF0dGFjaywgcmVxdWlyaW5nIGVpdGhlciBhY2Nlc3MgdG8gdGhlIHN5c3RlbSB0byBkZWxldGUgdGhlIGZpbGUgb3IgYW4gZXJyYW50IG9wZXJhdG9yIGFjdGlvbiBpbiB0aGUgZmlyc3QgcGxhY2Uu
      patchset: cffeb268edfc504f1fdf8977d62723d30b73a75b
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: a01eed06dffe368c1d01819193bfadccb137414d
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images-kolla
        name: osism/container-images-kolla
        short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
      projects:
        github.com/osism/container-images-kolla:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          checkout: main
          checkout_description: zuul branch
          commit: eaeae3f9b7e2f672668a2cff35b660ec20f2747c
          name: osism/container-images-kolla
          required: false
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
      ref: refs/pull/688/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
