all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble-large:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe74:cc4b
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 3c33efd3-1b0d-40f2-9774-af17b544ea14
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe74:cc4b
        label: ubuntu-noble-large
        node_properties: {}
        private_ipv4: 10.128.7.249
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.96
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe74:cc4b
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job metalbox-mirror-debian-packages explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/metalbox/.zuul.yaml@main#74>'
      - '<Job metalbox-mirror-debian-packages explicit: None implied: None source:
        osism/metalbox/.zuul.yaml@main#231>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 3636afc525974d858b4682f7391344d9
      build_refs:
      - branch: main
        change: '373'
        change_message: "mirror: refuse to build an incomplete mirror\n\nPart of:\n\n-
          osism/metalbox#375\n\n---\n\nThe policy layer of this stack. Everything
          below it fixes defects without\nchanging when the job passes or fails; this
          commit changes that, and is\nseparated so it can be accepted or rejected
          on its own.\n\nIt depends on the cold-cache fix in #372 \u2014 without atomic
          index publication the\nguard would have failed the job on most nights.\n\n---\n\nThe
          run built and published whatever it managed to download. A mirror\nmissing
          most of its packages was reported as a success:\n\n  SUCCESS: Successfully
          downloaded 222 .deb files\n  SUCCESS: Repository created with 222 packages\n
          \ SUCCESS: Mirror creation finished successfully\n\nThat matters because
          publishing is destructive. The tarball is uploaded\nto a fixed S3 object
          name with no history, so a short mirror does not\nmerely fail to improve
          on the previous one, it replaces it. A failed run\nleaves the previous night's
          mirror in place, which is strictly better.\n\nThe 222-package run above
          was produced while the configured mirror,\nftp.halifax.rwth-aachen.de, stopped
          accepting connections from the test\nhost: 16 of its indexes could not be
          fetched and 699 packages were\nconsequently reported as not found. The same
          conditions on a CI node\nwould publish that mirror.\n\nAbort before create_repository()
          if, after the retry rounds, any package\nindex could not be fetched, any
          download is still missing, or any\npackage named in packages.list is absent.
          Metadata-stage index failures\nare counted directly; lookup-stage failures
          happen in worker processes,\nso they are counted from the markers report_index_fetch_failure()\nleaves.\n\nA
          marker records one failed attempt, not a missing index, and markers\nare
          never removed. An index can still arrive after one: a concurrent\nworker
          may publish a complete copy while this one fails over between\nformats --
          which is why cache_packages_file() refuses to remove the\ncache file on
          that path -- and a later worker retries the download\nbecause no cache file
          exists yet. Counting markers alone would abort a\nrun whose indexes were
          all fetched in the end, so a marker counts only\nwhen its cache file is
          absent.\n\nNone of these conditions occur on a healthy run. Ten runs sampled\nbetween
          2026-07-03 and 2026-08-02 fetched every index, lost no download,\nand were
          missing exactly one requested package -- libstdc++6, which was\nnever found
          because of the regex bug fixed earlier in this series. So\nthe guard adds
          no false positives against observed history; 2026-08-01\nwould have failed
          here instead of 30 minutes later with an opaque\ndpkg-scanpackages exit
          code.\n\nKnown consequence: if upstream drops a package that packages.list
          still\nnames, the job goes red until the list is updated.\n\nAssisted-by:
          Claude:claude-opus-5\nSigned-off-by: Roger Luethi <luethi@osism.tech>\n\n---\n\n###
          What to scrutinise\n\nZero tolerance is deliberate. The artifact is a mirror
          for air-gapped installs,\npublished to a fixed S3 object name with no history,
          so a short mirror\noverwrites a working one \u2014 and a percentage threshold
          would not help, since a\nmirror missing one dependency is 99.9% complete
          and still unusable for whatever\nneeded it. A failed run costs a red notification
          and leaves last night's\nartifact in place.\n\nThe cost is that ordinary
          upstream flakiness now turns the nightly red. The\nretry-round budget added
          earlier in the stack is the only thing standing between\na transient blip
          and a failed job, and that budget has not been exercised\nagainst real CI
          conditions.\n\nTwo conditions feed the guard:\n\n- `INDEX_FETCH_FAILURES`
          is counted sequentially at the metadata stage, after\n  `download_packages_index()`
          has tried `.gz`, `.xz` and plain \u2014 so the netdata\n  flat repo, which
          404s on `Packages.gz`, does not trip it.\n- The lookup-stage count comes
          from markers left by worker processes, which is\n  why it needs the cache-file
          check described above; without it a fetch that\n  recovered would still
          fail the run.\n\n`failed_packages` iterates `PACKAGES` only, so the ~19
          virtual and transitional\ndependency names the script cannot resolve through
          `Provides:` do not trip the\nguard either. That match is a substring test,
          so it can also mark a requested\npackage present because an unrelated `.deb`
          filename contains its name \u2014 a\nfalse negative, which weakens the guard
          rather than making it fire spuriously.\n\n"
        change_url: https://github.com/osism/metalbox/pull/373
        commit_id: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
        patchset: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          name: osism/metalbox
          short_name: metalbox
        src_dir: src/github.com/osism/metalbox
        topic: null
      buildset: 73c054fea260423aa948a0965deeb44d
      buildset_refs:
      - branch: main
        change: '373'
        change_message: "mirror: refuse to build an incomplete mirror\n\nPart of:\n\n-
          osism/metalbox#375\n\n---\n\nThe policy layer of this stack. Everything
          below it fixes defects without\nchanging when the job passes or fails; this
          commit changes that, and is\nseparated so it can be accepted or rejected
          on its own.\n\nIt depends on the cold-cache fix in #372 \u2014 without atomic
          index publication the\nguard would have failed the job on most nights.\n\n---\n\nThe
          run built and published whatever it managed to download. A mirror\nmissing
          most of its packages was reported as a success:\n\n  SUCCESS: Successfully
          downloaded 222 .deb files\n  SUCCESS: Repository created with 222 packages\n
          \ SUCCESS: Mirror creation finished successfully\n\nThat matters because
          publishing is destructive. The tarball is uploaded\nto a fixed S3 object
          name with no history, so a short mirror does not\nmerely fail to improve
          on the previous one, it replaces it. A failed run\nleaves the previous night's
          mirror in place, which is strictly better.\n\nThe 222-package run above
          was produced while the configured mirror,\nftp.halifax.rwth-aachen.de, stopped
          accepting connections from the test\nhost: 16 of its indexes could not be
          fetched and 699 packages were\nconsequently reported as not found. The same
          conditions on a CI node\nwould publish that mirror.\n\nAbort before create_repository()
          if, after the retry rounds, any package\nindex could not be fetched, any
          download is still missing, or any\npackage named in packages.list is absent.
          Metadata-stage index failures\nare counted directly; lookup-stage failures
          happen in worker processes,\nso they are counted from the markers report_index_fetch_failure()\nleaves.\n\nA
          marker records one failed attempt, not a missing index, and markers\nare
          never removed. An index can still arrive after one: a concurrent\nworker
          may publish a complete copy while this one fails over between\nformats --
          which is why cache_packages_file() refuses to remove the\ncache file on
          that path -- and a later worker retries the download\nbecause no cache file
          exists yet. Counting markers alone would abort a\nrun whose indexes were
          all fetched in the end, so a marker counts only\nwhen its cache file is
          absent.\n\nNone of these conditions occur on a healthy run. Ten runs sampled\nbetween
          2026-07-03 and 2026-08-02 fetched every index, lost no download,\nand were
          missing exactly one requested package -- libstdc++6, which was\nnever found
          because of the regex bug fixed earlier in this series. So\nthe guard adds
          no false positives against observed history; 2026-08-01\nwould have failed
          here instead of 30 minutes later with an opaque\ndpkg-scanpackages exit
          code.\n\nKnown consequence: if upstream drops a package that packages.list
          still\nnames, the job goes red until the list is updated.\n\nAssisted-by:
          Claude:claude-opus-5\nSigned-off-by: Roger Luethi <luethi@osism.tech>\n\n---\n\n###
          What to scrutinise\n\nZero tolerance is deliberate. The artifact is a mirror
          for air-gapped installs,\npublished to a fixed S3 object name with no history,
          so a short mirror\noverwrites a working one \u2014 and a percentage threshold
          would not help, since a\nmirror missing one dependency is 99.9% complete
          and still unusable for whatever\nneeded it. A failed run costs a red notification
          and leaves last night's\nartifact in place.\n\nThe cost is that ordinary
          upstream flakiness now turns the nightly red. The\nretry-round budget added
          earlier in the stack is the only thing standing between\na transient blip
          and a failed job, and that budget has not been exercised\nagainst real CI
          conditions.\n\nTwo conditions feed the guard:\n\n- `INDEX_FETCH_FAILURES`
          is counted sequentially at the metadata stage, after\n  `download_packages_index()`
          has tried `.gz`, `.xz` and plain \u2014 so the netdata\n  flat repo, which
          404s on `Packages.gz`, does not trip it.\n- The lookup-stage count comes
          from markers left by worker processes, which is\n  why it needs the cache-file
          check described above; without it a fetch that\n  recovered would still
          fail the run.\n\n`failed_packages` iterates `PACKAGES` only, so the ~19
          virtual and transitional\ndependency names the script cannot resolve through
          `Provides:` do not trip the\nguard either. That match is a substring test,
          so it can also mark a requested\npackage present because an unrelated `.deb`
          filename contains its name \u2014 a\nfalse negative, which weakens the guard
          rather than making it fire spuriously.\n\n"
        change_url: https://github.com/osism/metalbox/pull/373
        commit_id: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
        patchset: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          name: osism/metalbox
          short_name: metalbox
        src_dir: src/github.com/osism/metalbox
        topic: null
      change: '373'
      change_message: "mirror: refuse to build an incomplete mirror\n\nPart of:\n\n-
        osism/metalbox#375\n\n---\n\nThe policy layer of this stack. Everything below
        it fixes defects without\nchanging when the job passes or fails; this commit
        changes that, and is\nseparated so it can be accepted or rejected on its own.\n\nIt
        depends on the cold-cache fix in #372 \u2014 without atomic index publication
        the\nguard would have failed the job on most nights.\n\n---\n\nThe run built
        and published whatever it managed to download. A mirror\nmissing most of its
        packages was reported as a success:\n\n  SUCCESS: Successfully downloaded
        222 .deb files\n  SUCCESS: Repository created with 222 packages\n  SUCCESS:
        Mirror creation finished successfully\n\nThat matters because publishing is
        destructive. The tarball is uploaded\nto a fixed S3 object name with no history,
        so a short mirror does not\nmerely fail to improve on the previous one, it
        replaces it. A failed run\nleaves the previous night's mirror in place, which
        is strictly better.\n\nThe 222-package run above was produced while the configured
        mirror,\nftp.halifax.rwth-aachen.de, stopped accepting connections from the
        test\nhost: 16 of its indexes could not be fetched and 699 packages were\nconsequently
        reported as not found. The same conditions on a CI node\nwould publish that
        mirror.\n\nAbort before create_repository() if, after the retry rounds, any
        package\nindex could not be fetched, any download is still missing, or any\npackage
        named in packages.list is absent. Metadata-stage index failures\nare counted
        directly; lookup-stage failures happen in worker processes,\nso they are counted
        from the markers report_index_fetch_failure()\nleaves.\n\nA marker records
        one failed attempt, not a missing index, and markers\nare never removed. An
        index can still arrive after one: a concurrent\nworker may publish a complete
        copy while this one fails over between\nformats -- which is why cache_packages_file()
        refuses to remove the\ncache file on that path -- and a later worker retries
        the download\nbecause no cache file exists yet. Counting markers alone would
        abort a\nrun whose indexes were all fetched in the end, so a marker counts
        only\nwhen its cache file is absent.\n\nNone of these conditions occur on
        a healthy run. Ten runs sampled\nbetween 2026-07-03 and 2026-08-02 fetched
        every index, lost no download,\nand were missing exactly one requested package
        -- libstdc++6, which was\nnever found because of the regex bug fixed earlier
        in this series. So\nthe guard adds no false positives against observed history;
        2026-08-01\nwould have failed here instead of 30 minutes later with an opaque\ndpkg-scanpackages
        exit code.\n\nKnown consequence: if upstream drops a package that packages.list
        still\nnames, the job goes red until the list is updated.\n\nAssisted-by:
        Claude:claude-opus-5\nSigned-off-by: Roger Luethi <luethi@osism.tech>\n\n---\n\n###
        What to scrutinise\n\nZero tolerance is deliberate. The artifact is a mirror
        for air-gapped installs,\npublished to a fixed S3 object name with no history,
        so a short mirror\noverwrites a working one \u2014 and a percentage threshold
        would not help, since a\nmirror missing one dependency is 99.9% complete and
        still unusable for whatever\nneeded it. A failed run costs a red notification
        and leaves last night's\nartifact in place.\n\nThe cost is that ordinary upstream
        flakiness now turns the nightly red. The\nretry-round budget added earlier
        in the stack is the only thing standing between\na transient blip and a failed
        job, and that budget has not been exercised\nagainst real CI conditions.\n\nTwo
        conditions feed the guard:\n\n- `INDEX_FETCH_FAILURES` is counted sequentially
        at the metadata stage, after\n  `download_packages_index()` has tried `.gz`,
        `.xz` and plain \u2014 so the netdata\n  flat repo, which 404s on `Packages.gz`,
        does not trip it.\n- The lookup-stage count comes from markers left by worker
        processes, which is\n  why it needs the cache-file check described above;
        without it a fetch that\n  recovered would still fail the run.\n\n`failed_packages`
        iterates `PACKAGES` only, so the ~19 virtual and transitional\ndependency
        names the script cannot resolve through `Provides:` do not trip the\nguard
        either. That match is a substring test, so it can also mark a requested\npackage
        present because an unrelated `.deb` filename contains its name \u2014 a\nfalse
        negative, which weakens the guard rather than making it fire spuriously.\n\n"
      change_url: https://github.com/osism/metalbox/pull/373
      child_jobs: []
      commit_id: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
      event_id: cadc5bf0-9411-11f1-957d-da75f7fa55d5
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/3636afc525974d858b4682f7391344d9/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/3636afc525974d858b4682f7391344d9/work/logs
        result_data_file: /var/lib/zuul/builds/3636afc525974d858b4682f7391344d9/work/results.json
        src_root: /var/lib/zuul/builds/3636afc525974d858b4682f7391344d9/work/src
        work_root: /var/lib/zuul/builds/3636afc525974d858b4682f7391344d9/work
      include_vars: []
      items:
      - branch: main
        change: '373'
        change_message: "mirror: refuse to build an incomplete mirror\n\nPart of:\n\n-
          osism/metalbox#375\n\n---\n\nThe policy layer of this stack. Everything
          below it fixes defects without\nchanging when the job passes or fails; this
          commit changes that, and is\nseparated so it can be accepted or rejected
          on its own.\n\nIt depends on the cold-cache fix in #372 \u2014 without atomic
          index publication the\nguard would have failed the job on most nights.\n\n---\n\nThe
          run built and published whatever it managed to download. A mirror\nmissing
          most of its packages was reported as a success:\n\n  SUCCESS: Successfully
          downloaded 222 .deb files\n  SUCCESS: Repository created with 222 packages\n
          \ SUCCESS: Mirror creation finished successfully\n\nThat matters because
          publishing is destructive. The tarball is uploaded\nto a fixed S3 object
          name with no history, so a short mirror does not\nmerely fail to improve
          on the previous one, it replaces it. A failed run\nleaves the previous night's
          mirror in place, which is strictly better.\n\nThe 222-package run above
          was produced while the configured mirror,\nftp.halifax.rwth-aachen.de, stopped
          accepting connections from the test\nhost: 16 of its indexes could not be
          fetched and 699 packages were\nconsequently reported as not found. The same
          conditions on a CI node\nwould publish that mirror.\n\nAbort before create_repository()
          if, after the retry rounds, any package\nindex could not be fetched, any
          download is still missing, or any\npackage named in packages.list is absent.
          Metadata-stage index failures\nare counted directly; lookup-stage failures
          happen in worker processes,\nso they are counted from the markers report_index_fetch_failure()\nleaves.\n\nA
          marker records one failed attempt, not a missing index, and markers\nare
          never removed. An index can still arrive after one: a concurrent\nworker
          may publish a complete copy while this one fails over between\nformats --
          which is why cache_packages_file() refuses to remove the\ncache file on
          that path -- and a later worker retries the download\nbecause no cache file
          exists yet. Counting markers alone would abort a\nrun whose indexes were
          all fetched in the end, so a marker counts only\nwhen its cache file is
          absent.\n\nNone of these conditions occur on a healthy run. Ten runs sampled\nbetween
          2026-07-03 and 2026-08-02 fetched every index, lost no download,\nand were
          missing exactly one requested package -- libstdc++6, which was\nnever found
          because of the regex bug fixed earlier in this series. So\nthe guard adds
          no false positives against observed history; 2026-08-01\nwould have failed
          here instead of 30 minutes later with an opaque\ndpkg-scanpackages exit
          code.\n\nKnown consequence: if upstream drops a package that packages.list
          still\nnames, the job goes red until the list is updated.\n\nAssisted-by:
          Claude:claude-opus-5\nSigned-off-by: Roger Luethi <luethi@osism.tech>\n\n---\n\n###
          What to scrutinise\n\nZero tolerance is deliberate. The artifact is a mirror
          for air-gapped installs,\npublished to a fixed S3 object name with no history,
          so a short mirror\noverwrites a working one \u2014 and a percentage threshold
          would not help, since a\nmirror missing one dependency is 99.9% complete
          and still unusable for whatever\nneeded it. A failed run costs a red notification
          and leaves last night's\nartifact in place.\n\nThe cost is that ordinary
          upstream flakiness now turns the nightly red. The\nretry-round budget added
          earlier in the stack is the only thing standing between\na transient blip
          and a failed job, and that budget has not been exercised\nagainst real CI
          conditions.\n\nTwo conditions feed the guard:\n\n- `INDEX_FETCH_FAILURES`
          is counted sequentially at the metadata stage, after\n  `download_packages_index()`
          has tried `.gz`, `.xz` and plain \u2014 so the netdata\n  flat repo, which
          404s on `Packages.gz`, does not trip it.\n- The lookup-stage count comes
          from markers left by worker processes, which is\n  why it needs the cache-file
          check described above; without it a fetch that\n  recovered would still
          fail the run.\n\n`failed_packages` iterates `PACKAGES` only, so the ~19
          virtual and transitional\ndependency names the script cannot resolve through
          `Provides:` do not trip the\nguard either. That match is a substring test,
          so it can also mark a requested\npackage present because an unrelated `.deb`
          filename contains its name \u2014 a\nfalse negative, which weakens the guard
          rather than making it fire spuriously.\n\n"
        change_url: https://github.com/osism/metalbox/pull/373
        commit_id: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
        patchset: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          name: osism/metalbox
          short_name: metalbox
          src_dir: src/github.com/osism/metalbox
        topic: null
      job: metalbox-mirror-debian-packages
      jobtags: []
      max_attempts: 3
      message: bWlycm9yOiByZWZ1c2UgdG8gYnVpbGQgYW4gaW5jb21wbGV0ZSBtaXJyb3IKClBhcnQgb2Y6CgotIG9zaXNtL21ldGFsYm94IzM3NQoKLS0tCgpUaGUgcG9saWN5IGxheWVyIG9mIHRoaXMgc3RhY2suIEV2ZXJ5dGhpbmcgYmVsb3cgaXQgZml4ZXMgZGVmZWN0cyB3aXRob3V0CmNoYW5naW5nIHdoZW4gdGhlIGpvYiBwYXNzZXMgb3IgZmFpbHM7IHRoaXMgY29tbWl0IGNoYW5nZXMgdGhhdCwgYW5kIGlzCnNlcGFyYXRlZCBzbyBpdCBjYW4gYmUgYWNjZXB0ZWQgb3IgcmVqZWN0ZWQgb24gaXRzIG93bi4KCkl0IGRlcGVuZHMgb24gdGhlIGNvbGQtY2FjaGUgZml4IGluICMzNzIg4oCUIHdpdGhvdXQgYXRvbWljIGluZGV4IHB1YmxpY2F0aW9uIHRoZQpndWFyZCB3b3VsZCBoYXZlIGZhaWxlZCB0aGUgam9iIG9uIG1vc3QgbmlnaHRzLgoKLS0tCgpUaGUgcnVuIGJ1aWx0IGFuZCBwdWJsaXNoZWQgd2hhdGV2ZXIgaXQgbWFuYWdlZCB0byBkb3dubG9hZC4gQSBtaXJyb3IKbWlzc2luZyBtb3N0IG9mIGl0cyBwYWNrYWdlcyB3YXMgcmVwb3J0ZWQgYXMgYSBzdWNjZXNzOgoKICBTVUNDRVNTOiBTdWNjZXNzZnVsbHkgZG93bmxvYWRlZCAyMjIgLmRlYiBmaWxlcwogIFNVQ0NFU1M6IFJlcG9zaXRvcnkgY3JlYXRlZCB3aXRoIDIyMiBwYWNrYWdlcwogIFNVQ0NFU1M6IE1pcnJvciBjcmVhdGlvbiBmaW5pc2hlZCBzdWNjZXNzZnVsbHkKClRoYXQgbWF0dGVycyBiZWNhdXNlIHB1Ymxpc2hpbmcgaXMgZGVzdHJ1Y3RpdmUuIFRoZSB0YXJiYWxsIGlzIHVwbG9hZGVkCnRvIGEgZml4ZWQgUzMgb2JqZWN0IG5hbWUgd2l0aCBubyBoaXN0b3J5LCBzbyBhIHNob3J0IG1pcnJvciBkb2VzIG5vdAptZXJlbHkgZmFpbCB0byBpbXByb3ZlIG9uIHRoZSBwcmV2aW91cyBvbmUsIGl0IHJlcGxhY2VzIGl0LiBBIGZhaWxlZCBydW4KbGVhdmVzIHRoZSBwcmV2aW91cyBuaWdodCdzIG1pcnJvciBpbiBwbGFjZSwgd2hpY2ggaXMgc3RyaWN0bHkgYmV0dGVyLgoKVGhlIDIyMi1wYWNrYWdlIHJ1biBhYm92ZSB3YXMgcHJvZHVjZWQgd2hpbGUgdGhlIGNvbmZpZ3VyZWQgbWlycm9yLApmdHAuaGFsaWZheC5yd3RoLWFhY2hlbi5kZSwgc3RvcHBlZCBhY2NlcHRpbmcgY29ubmVjdGlvbnMgZnJvbSB0aGUgdGVzdApob3N0OiAxNiBvZiBpdHMgaW5kZXhlcyBjb3VsZCBub3QgYmUgZmV0Y2hlZCBhbmQgNjk5IHBhY2thZ2VzIHdlcmUKY29uc2VxdWVudGx5IHJlcG9ydGVkIGFzIG5vdCBmb3VuZC4gVGhlIHNhbWUgY29uZGl0aW9ucyBvbiBhIENJIG5vZGUKd291bGQgcHVibGlzaCB0aGF0IG1pcnJvci4KCkFib3J0IGJlZm9yZSBjcmVhdGVfcmVwb3NpdG9yeSgpIGlmLCBhZnRlciB0aGUgcmV0cnkgcm91bmRzLCBhbnkgcGFja2FnZQppbmRleCBjb3VsZCBub3QgYmUgZmV0Y2hlZCwgYW55IGRvd25sb2FkIGlzIHN0aWxsIG1pc3NpbmcsIG9yIGFueQpwYWNrYWdlIG5hbWVkIGluIHBhY2thZ2VzLmxpc3QgaXMgYWJzZW50LiBNZXRhZGF0YS1zdGFnZSBpbmRleCBmYWlsdXJlcwphcmUgY291bnRlZCBkaXJlY3RseTsgbG9va3VwLXN0YWdlIGZhaWx1cmVzIGhhcHBlbiBpbiB3b3JrZXIgcHJvY2Vzc2VzLApzbyB0aGV5IGFyZSBjb3VudGVkIGZyb20gdGhlIG1hcmtlcnMgcmVwb3J0X2luZGV4X2ZldGNoX2ZhaWx1cmUoKQpsZWF2ZXMuCgpBIG1hcmtlciByZWNvcmRzIG9uZSBmYWlsZWQgYXR0ZW1wdCwgbm90IGEgbWlzc2luZyBpbmRleCwgYW5kIG1hcmtlcnMKYXJlIG5ldmVyIHJlbW92ZWQuIEFuIGluZGV4IGNhbiBzdGlsbCBhcnJpdmUgYWZ0ZXIgb25lOiBhIGNvbmN1cnJlbnQKd29ya2VyIG1heSBwdWJsaXNoIGEgY29tcGxldGUgY29weSB3aGlsZSB0aGlzIG9uZSBmYWlscyBvdmVyIGJldHdlZW4KZm9ybWF0cyAtLSB3aGljaCBpcyB3aHkgY2FjaGVfcGFja2FnZXNfZmlsZSgpIHJlZnVzZXMgdG8gcmVtb3ZlIHRoZQpjYWNoZSBmaWxlIG9uIHRoYXQgcGF0aCAtLSBhbmQgYSBsYXRlciB3b3JrZXIgcmV0cmllcyB0aGUgZG93bmxvYWQKYmVjYXVzZSBubyBjYWNoZSBmaWxlIGV4aXN0cyB5ZXQuIENvdW50aW5nIG1hcmtlcnMgYWxvbmUgd291bGQgYWJvcnQgYQpydW4gd2hvc2UgaW5kZXhlcyB3ZXJlIGFsbCBmZXRjaGVkIGluIHRoZSBlbmQsIHNvIGEgbWFya2VyIGNvdW50cyBvbmx5CndoZW4gaXRzIGNhY2hlIGZpbGUgaXMgYWJzZW50LgoKTm9uZSBvZiB0aGVzZSBjb25kaXRpb25zIG9jY3VyIG9uIGEgaGVhbHRoeSBydW4uIFRlbiBydW5zIHNhbXBsZWQKYmV0d2VlbiAyMDI2LTA3LTAzIGFuZCAyMDI2LTA4LTAyIGZldGNoZWQgZXZlcnkgaW5kZXgsIGxvc3Qgbm8gZG93bmxvYWQsCmFuZCB3ZXJlIG1pc3NpbmcgZXhhY3RseSBvbmUgcmVxdWVzdGVkIHBhY2thZ2UgLS0gbGlic3RkYysrNiwgd2hpY2ggd2FzCm5ldmVyIGZvdW5kIGJlY2F1c2Ugb2YgdGhlIHJlZ2V4IGJ1ZyBmaXhlZCBlYXJsaWVyIGluIHRoaXMgc2VyaWVzLiBTbwp0aGUgZ3VhcmQgYWRkcyBubyBmYWxzZSBwb3NpdGl2ZXMgYWdhaW5zdCBvYnNlcnZlZCBoaXN0b3J5OyAyMDI2LTA4LTAxCndvdWxkIGhhdmUgZmFpbGVkIGhlcmUgaW5zdGVhZCBvZiAzMCBtaW51dGVzIGxhdGVyIHdpdGggYW4gb3BhcXVlCmRwa2ctc2NhbnBhY2thZ2VzIGV4aXQgY29kZS4KCktub3duIGNvbnNlcXVlbmNlOiBpZiB1cHN0cmVhbSBkcm9wcyBhIHBhY2thZ2UgdGhhdCBwYWNrYWdlcy5saXN0IHN0aWxsCm5hbWVzLCB0aGUgam9iIGdvZXMgcmVkIHVudGlsIHRoZSBsaXN0IGlzIHVwZGF0ZWQuCgpBc3Npc3RlZC1ieTogQ2xhdWRlOmNsYXVkZS1vcHVzLTUKU2lnbmVkLW9mZi1ieTogUm9nZXIgTHVldGhpIDxsdWV0aGlAb3Npc20udGVjaD4KCi0tLQoKIyMjIFdoYXQgdG8gc2NydXRpbmlzZQoKWmVybyB0b2xlcmFuY2UgaXMgZGVsaWJlcmF0ZS4gVGhlIGFydGlmYWN0IGlzIGEgbWlycm9yIGZvciBhaXItZ2FwcGVkIGluc3RhbGxzLApwdWJsaXNoZWQgdG8gYSBmaXhlZCBTMyBvYmplY3QgbmFtZSB3aXRoIG5vIGhpc3RvcnksIHNvIGEgc2hvcnQgbWlycm9yCm92ZXJ3cml0ZXMgYSB3b3JraW5nIG9uZSDigJQgYW5kIGEgcGVyY2VudGFnZSB0aHJlc2hvbGQgd291bGQgbm90IGhlbHAsIHNpbmNlIGEKbWlycm9yIG1pc3Npbmcgb25lIGRlcGVuZGVuY3kgaXMgOTkuOSUgY29tcGxldGUgYW5kIHN0aWxsIHVudXNhYmxlIGZvciB3aGF0ZXZlcgpuZWVkZWQgaXQuIEEgZmFpbGVkIHJ1biBjb3N0cyBhIHJlZCBub3RpZmljYXRpb24gYW5kIGxlYXZlcyBsYXN0IG5pZ2h0J3MKYXJ0aWZhY3QgaW4gcGxhY2UuCgpUaGUgY29zdCBpcyB0aGF0IG9yZGluYXJ5IHVwc3RyZWFtIGZsYWtpbmVzcyBub3cgdHVybnMgdGhlIG5pZ2h0bHkgcmVkLiBUaGUKcmV0cnktcm91bmQgYnVkZ2V0IGFkZGVkIGVhcmxpZXIgaW4gdGhlIHN0YWNrIGlzIHRoZSBvbmx5IHRoaW5nIHN0YW5kaW5nIGJldHdlZW4KYSB0cmFuc2llbnQgYmxpcCBhbmQgYSBmYWlsZWQgam9iLCBhbmQgdGhhdCBidWRnZXQgaGFzIG5vdCBiZWVuIGV4ZXJjaXNlZAphZ2FpbnN0IHJlYWwgQ0kgY29uZGl0aW9ucy4KClR3byBjb25kaXRpb25zIGZlZWQgdGhlIGd1YXJkOgoKLSBgSU5ERVhfRkVUQ0hfRkFJTFVSRVNgIGlzIGNvdW50ZWQgc2VxdWVudGlhbGx5IGF0IHRoZSBtZXRhZGF0YSBzdGFnZSwgYWZ0ZXIKICBgZG93bmxvYWRfcGFja2FnZXNfaW5kZXgoKWAgaGFzIHRyaWVkIGAuZ3pgLCBgLnh6YCBhbmQgcGxhaW4g4oCUIHNvIHRoZSBuZXRkYXRhCiAgZmxhdCByZXBvLCB3aGljaCA0MDRzIG9uIGBQYWNrYWdlcy5nemAsIGRvZXMgbm90IHRyaXAgaXQuCi0gVGhlIGxvb2t1cC1zdGFnZSBjb3VudCBjb21lcyBmcm9tIG1hcmtlcnMgbGVmdCBieSB3b3JrZXIgcHJvY2Vzc2VzLCB3aGljaCBpcwogIHdoeSBpdCBuZWVkcyB0aGUgY2FjaGUtZmlsZSBjaGVjayBkZXNjcmliZWQgYWJvdmU7IHdpdGhvdXQgaXQgYSBmZXRjaCB0aGF0CiAgcmVjb3ZlcmVkIHdvdWxkIHN0aWxsIGZhaWwgdGhlIHJ1bi4KCmBmYWlsZWRfcGFja2FnZXNgIGl0ZXJhdGVzIGBQQUNLQUdFU2Agb25seSwgc28gdGhlIH4xOSB2aXJ0dWFsIGFuZCB0cmFuc2l0aW9uYWwKZGVwZW5kZW5jeSBuYW1lcyB0aGUgc2NyaXB0IGNhbm5vdCByZXNvbHZlIHRocm91Z2ggYFByb3ZpZGVzOmAgZG8gbm90IHRyaXAgdGhlCmd1YXJkIGVpdGhlci4gVGhhdCBtYXRjaCBpcyBhIHN1YnN0cmluZyB0ZXN0LCBzbyBpdCBjYW4gYWxzbyBtYXJrIGEgcmVxdWVzdGVkCnBhY2thZ2UgcHJlc2VudCBiZWNhdXNlIGFuIHVucmVsYXRlZCBgLmRlYmAgZmlsZW5hbWUgY29udGFpbnMgaXRzIG5hbWUg4oCUIGEKZmFsc2UgbmVnYXRpdmUsIHdoaWNoIHdlYWtlbnMgdGhlIGd1YXJkIHJhdGhlciB0aGFuIG1ha2luZyBpdCBmaXJlIHNwdXJpb3VzbHkuCgo=
      patchset: b13fa6a4e5210a2c41c788e0bb04cdb360dc16f7
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: b7c70f39598a39998dbbc6f833779355630f3a39
          untrusted/project_0/github.com/osism/metalbox:
            canonical_name: github.com/osism/metalbox
            checkout: main
            commit: 44566d12d45d24b2d2b0432b419fb1f19b7fa9e6
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: b7c70f39598a39998dbbc6f833779355630f3a39
        playbooks:
        - path: untrusted/project_0/github.com/osism/metalbox/zuul/mirror-debian-packages.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/metalbox
        name: osism/metalbox
        short_name: metalbox
        src_dir: src/github.com/osism/metalbox
      projects:
        github.com/osism/metalbox:
          canonical_hostname: github.com
          canonical_name: github.com/osism/metalbox
          checkout: main
          checkout_description: zuul branch
          commit: 44566d12d45d24b2d2b0432b419fb1f19b7fa9e6
          name: osism/metalbox
          required: false
          short_name: metalbox
          src_dir: src/github.com/osism/metalbox
      ref: refs/pull/373/head
      resources: {}
      tenant: osism
      timeout: 16200
      topic: null
      voting: true
