all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe1c:7f7f
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 7a77fe88-c691-40c1-a954-c7af4ae0f8ad
        host_id: 5afd8fc909abddfe2ce3a956a91bbe56629648b7209fd0acfa541862
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe1c:7f7f
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.228
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.38
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe1c:7f7f
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job hadolint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#37>'
      - '<Job hadolint explicit: None implied: None source: osism/container-images/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 9c8dfdb58b934501a13ce66b49a8cb78
      build_refs:
      - branch: main
        change: '947'
        change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
          `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
          (same mechanism/gating as the affinity patch) for an\noctavia-tempest-plugin
          cert-fixture bug.\n\n`octavia_tempest_plugin/common/cert_utils.py` builds
          its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
          certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be
          present, and the strict\nX.509 verification now enabled by default in newer
          OpenSSL / Python `ssl`\nrejects the chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED]
          certificate verify failed: Missing Authority Key Identifier\n```\n\nThe
          barbican TLS scenario tests (`test_tls_barbican`) upload such a cert to\nBarbican,
          drive an Octavia TLS-terminating listener with it, then reconnect with\nan
          httpx client that verifies against the test CA \u2014 so every\n`test_http_*_tls_traffic`
          case fails at connect time even though Octavia itself\nis healthy (its own
          amphora/server/client CAs already carry SKI+AKI).\n\n## Fix\n\nAdd the standard
          key-identifier pair: a `SubjectKeyIdentifier` on the CA and a\nmatching
          `AuthorityKeyIdentifier` (derived from the issuer public key) on the\nserver
          and client leaf certs. Both use RFC 5280 method 1 (SHA1 of the public\nkey),
          so the leaf AKI keyid matches the CA SKI keyid and the chain builds.\n\n##
          Verification\n\nApplied inside the built `osism/tempest:latest` image and
          regenerated the test\ncerts:\n\n- before: `CA has SKI: False`, `server has
          AKI: False`; `openssl verify\n  -x509_strict` \u2192 `error 85 ... Missing
          Authority Key Identifier`\n- after: `CA has SKI: True`, `server has AKI:
          True`; `openssl verify\n  -x509_strict` \u2192 `OK`\n\nThe patch also applies
          cleanly under the build's `patch -p1 --forward\n--dry-run` gate and the
          patched file passes `py_compile`.\n\n## Notes\n\n- Self-expiring (OSISM
          P5): once octavia-tempest-plugin ships this upstream and\n  the pin bumps
          past it, the `--dry-run` gate fails the build and this file must\n  be deleted.
          Upstream fix still to be filed.\n- Sibling of the same-mechanism patch:\n
          \ - osism/container-images#945\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/947
        commit_id: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
        patchset: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      buildset: 1e3d5317aabc430a835e126aabb4fff1
      buildset_refs:
      - branch: main
        change: '947'
        change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
          `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
          (same mechanism/gating as the affinity patch) for an\noctavia-tempest-plugin
          cert-fixture bug.\n\n`octavia_tempest_plugin/common/cert_utils.py` builds
          its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
          certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be
          present, and the strict\nX.509 verification now enabled by default in newer
          OpenSSL / Python `ssl`\nrejects the chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED]
          certificate verify failed: Missing Authority Key Identifier\n```\n\nThe
          barbican TLS scenario tests (`test_tls_barbican`) upload such a cert to\nBarbican,
          drive an Octavia TLS-terminating listener with it, then reconnect with\nan
          httpx client that verifies against the test CA \u2014 so every\n`test_http_*_tls_traffic`
          case fails at connect time even though Octavia itself\nis healthy (its own
          amphora/server/client CAs already carry SKI+AKI).\n\n## Fix\n\nAdd the standard
          key-identifier pair: a `SubjectKeyIdentifier` on the CA and a\nmatching
          `AuthorityKeyIdentifier` (derived from the issuer public key) on the\nserver
          and client leaf certs. Both use RFC 5280 method 1 (SHA1 of the public\nkey),
          so the leaf AKI keyid matches the CA SKI keyid and the chain builds.\n\n##
          Verification\n\nApplied inside the built `osism/tempest:latest` image and
          regenerated the test\ncerts:\n\n- before: `CA has SKI: False`, `server has
          AKI: False`; `openssl verify\n  -x509_strict` \u2192 `error 85 ... Missing
          Authority Key Identifier`\n- after: `CA has SKI: True`, `server has AKI:
          True`; `openssl verify\n  -x509_strict` \u2192 `OK`\n\nThe patch also applies
          cleanly under the build's `patch -p1 --forward\n--dry-run` gate and the
          patched file passes `py_compile`.\n\n## Notes\n\n- Self-expiring (OSISM
          P5): once octavia-tempest-plugin ships this upstream and\n  the pin bumps
          past it, the `--dry-run` gate fails the build and this file must\n  be deleted.
          Upstream fix still to be filed.\n- Sibling of the same-mechanism patch:\n
          \ - osism/container-images#945\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/947
        commit_id: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
        patchset: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      change: '947'
      change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
        `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
        (same mechanism/gating as the affinity patch) for an\noctavia-tempest-plugin
        cert-fixture bug.\n\n`octavia_tempest_plugin/common/cert_utils.py` builds
        its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client certs
        without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be present,
        and the strict\nX.509 verification now enabled by default in newer OpenSSL
        / Python `ssl`\nrejects the chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED]
        certificate verify failed: Missing Authority Key Identifier\n```\n\nThe barbican
        TLS scenario tests (`test_tls_barbican`) upload such a cert to\nBarbican,
        drive an Octavia TLS-terminating listener with it, then reconnect with\nan
        httpx client that verifies against the test CA \u2014 so every\n`test_http_*_tls_traffic`
        case fails at connect time even though Octavia itself\nis healthy (its own
        amphora/server/client CAs already carry SKI+AKI).\n\n## Fix\n\nAdd the standard
        key-identifier pair: a `SubjectKeyIdentifier` on the CA and a\nmatching `AuthorityKeyIdentifier`
        (derived from the issuer public key) on the\nserver and client leaf certs.
        Both use RFC 5280 method 1 (SHA1 of the public\nkey), so the leaf AKI keyid
        matches the CA SKI keyid and the chain builds.\n\n## Verification\n\nApplied
        inside the built `osism/tempest:latest` image and regenerated the test\ncerts:\n\n-
        before: `CA has SKI: False`, `server has AKI: False`; `openssl verify\n  -x509_strict`
        \u2192 `error 85 ... Missing Authority Key Identifier`\n- after: `CA has SKI:
        True`, `server has AKI: True`; `openssl verify\n  -x509_strict` \u2192 `OK`\n\nThe
        patch also applies cleanly under the build's `patch -p1 --forward\n--dry-run`
        gate and the patched file passes `py_compile`.\n\n## Notes\n\n- Self-expiring
        (OSISM P5): once octavia-tempest-plugin ships this upstream and\n  the pin
        bumps past it, the `--dry-run` gate fails the build and this file must\n  be
        deleted. Upstream fix still to be filed.\n- Sibling of the same-mechanism
        patch:\n  - osism/container-images#945\n\n\U0001F916 Generated with [Claude
        Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/container-images/pull/947
      child_jobs: []
      commit_id: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
      event_id: 47868c40-7dc7-11f1-8e0b-94499023ef4f
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/9c8dfdb58b934501a13ce66b49a8cb78/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/9c8dfdb58b934501a13ce66b49a8cb78/work/logs
        result_data_file: /var/lib/zuul/builds/9c8dfdb58b934501a13ce66b49a8cb78/work/results.json
        src_root: /var/lib/zuul/builds/9c8dfdb58b934501a13ce66b49a8cb78/work/src
        work_root: /var/lib/zuul/builds/9c8dfdb58b934501a13ce66b49a8cb78/work
      include_vars: []
      items:
      - branch: main
        change: '947'
        change_message: "tempest: patch octavia cert-utils for AKI/SKI\n\n## What\n\nAdd
          `tempest/files/patches/0002-octavia-cert-utils-aki.patch`, a self-expiring\npatch
          (same mechanism/gating as the affinity patch) for an\noctavia-tempest-plugin
          cert-fixture bug.\n\n`octavia_tempest_plugin/common/cert_utils.py` builds
          its test CA without a\n`SubjectKeyIdentifier` and the leaf server/client
          certs without an\n`AuthorityKeyIdentifier`. RFC 5280 says both SHOULD be
          present, and the strict\nX.509 verification now enabled by default in newer
          OpenSSL / Python `ssl`\nrejects the chain:\n\n```\n[SSL: CERTIFICATE_VERIFY_FAILED]
          certificate verify failed: Missing Authority Key Identifier\n```\n\nThe
          barbican TLS scenario tests (`test_tls_barbican`) upload such a cert to\nBarbican,
          drive an Octavia TLS-terminating listener with it, then reconnect with\nan
          httpx client that verifies against the test CA \u2014 so every\n`test_http_*_tls_traffic`
          case fails at connect time even though Octavia itself\nis healthy (its own
          amphora/server/client CAs already carry SKI+AKI).\n\n## Fix\n\nAdd the standard
          key-identifier pair: a `SubjectKeyIdentifier` on the CA and a\nmatching
          `AuthorityKeyIdentifier` (derived from the issuer public key) on the\nserver
          and client leaf certs. Both use RFC 5280 method 1 (SHA1 of the public\nkey),
          so the leaf AKI keyid matches the CA SKI keyid and the chain builds.\n\n##
          Verification\n\nApplied inside the built `osism/tempest:latest` image and
          regenerated the test\ncerts:\n\n- before: `CA has SKI: False`, `server has
          AKI: False`; `openssl verify\n  -x509_strict` \u2192 `error 85 ... Missing
          Authority Key Identifier`\n- after: `CA has SKI: True`, `server has AKI:
          True`; `openssl verify\n  -x509_strict` \u2192 `OK`\n\nThe patch also applies
          cleanly under the build's `patch -p1 --forward\n--dry-run` gate and the
          patched file passes `py_compile`.\n\n## Notes\n\n- Self-expiring (OSISM
          P5): once octavia-tempest-plugin ships this upstream and\n  the pin bumps
          past it, the `--dry-run` gate fails the build and this file must\n  be deleted.
          Upstream fix still to be filed.\n- Sibling of the same-mechanism patch:\n
          \ - osism/container-images#945\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images/pull/947
        commit_id: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
        patchset: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
          src_dir: src/github.com/osism/container-images
        topic: null
      job: hadolint
      jobtags: []
      max_attempts: 3
      message: dGVtcGVzdDogcGF0Y2ggb2N0YXZpYSBjZXJ0LXV0aWxzIGZvciBBS0kvU0tJCgojIyBXaGF0CgpBZGQgYHRlbXBlc3QvZmlsZXMvcGF0Y2hlcy8wMDAyLW9jdGF2aWEtY2VydC11dGlscy1ha2kucGF0Y2hgLCBhIHNlbGYtZXhwaXJpbmcKcGF0Y2ggKHNhbWUgbWVjaGFuaXNtL2dhdGluZyBhcyB0aGUgYWZmaW5pdHkgcGF0Y2gpIGZvciBhbgpvY3RhdmlhLXRlbXBlc3QtcGx1Z2luIGNlcnQtZml4dHVyZSBidWcuCgpgb2N0YXZpYV90ZW1wZXN0X3BsdWdpbi9jb21tb24vY2VydF91dGlscy5weWAgYnVpbGRzIGl0cyB0ZXN0IENBIHdpdGhvdXQgYQpgU3ViamVjdEtleUlkZW50aWZpZXJgIGFuZCB0aGUgbGVhZiBzZXJ2ZXIvY2xpZW50IGNlcnRzIHdpdGhvdXQgYW4KYEF1dGhvcml0eUtleUlkZW50aWZpZXJgLiBSRkMgNTI4MCBzYXlzIGJvdGggU0hPVUxEIGJlIHByZXNlbnQsIGFuZCB0aGUgc3RyaWN0ClguNTA5IHZlcmlmaWNhdGlvbiBub3cgZW5hYmxlZCBieSBkZWZhdWx0IGluIG5ld2VyIE9wZW5TU0wgLyBQeXRob24gYHNzbGAKcmVqZWN0cyB0aGUgY2hhaW46CgpgYGAKW1NTTDogQ0VSVElGSUNBVEVfVkVSSUZZX0ZBSUxFRF0gY2VydGlmaWNhdGUgdmVyaWZ5IGZhaWxlZDogTWlzc2luZyBBdXRob3JpdHkgS2V5IElkZW50aWZpZXIKYGBgCgpUaGUgYmFyYmljYW4gVExTIHNjZW5hcmlvIHRlc3RzIChgdGVzdF90bHNfYmFyYmljYW5gKSB1cGxvYWQgc3VjaCBhIGNlcnQgdG8KQmFyYmljYW4sIGRyaXZlIGFuIE9jdGF2aWEgVExTLXRlcm1pbmF0aW5nIGxpc3RlbmVyIHdpdGggaXQsIHRoZW4gcmVjb25uZWN0IHdpdGgKYW4gaHR0cHggY2xpZW50IHRoYXQgdmVyaWZpZXMgYWdhaW5zdCB0aGUgdGVzdCBDQSDigJQgc28gZXZlcnkKYHRlc3RfaHR0cF8qX3Rsc190cmFmZmljYCBjYXNlIGZhaWxzIGF0IGNvbm5lY3QgdGltZSBldmVuIHRob3VnaCBPY3RhdmlhIGl0c2VsZgppcyBoZWFsdGh5IChpdHMgb3duIGFtcGhvcmEvc2VydmVyL2NsaWVudCBDQXMgYWxyZWFkeSBjYXJyeSBTS0krQUtJKS4KCiMjIEZpeAoKQWRkIHRoZSBzdGFuZGFyZCBrZXktaWRlbnRpZmllciBwYWlyOiBhIGBTdWJqZWN0S2V5SWRlbnRpZmllcmAgb24gdGhlIENBIGFuZCBhCm1hdGNoaW5nIGBBdXRob3JpdHlLZXlJZGVudGlmaWVyYCAoZGVyaXZlZCBmcm9tIHRoZSBpc3N1ZXIgcHVibGljIGtleSkgb24gdGhlCnNlcnZlciBhbmQgY2xpZW50IGxlYWYgY2VydHMuIEJvdGggdXNlIFJGQyA1MjgwIG1ldGhvZCAxIChTSEExIG9mIHRoZSBwdWJsaWMKa2V5KSwgc28gdGhlIGxlYWYgQUtJIGtleWlkIG1hdGNoZXMgdGhlIENBIFNLSSBrZXlpZCBhbmQgdGhlIGNoYWluIGJ1aWxkcy4KCiMjIFZlcmlmaWNhdGlvbgoKQXBwbGllZCBpbnNpZGUgdGhlIGJ1aWx0IGBvc2lzbS90ZW1wZXN0OmxhdGVzdGAgaW1hZ2UgYW5kIHJlZ2VuZXJhdGVkIHRoZSB0ZXN0CmNlcnRzOgoKLSBiZWZvcmU6IGBDQSBoYXMgU0tJOiBGYWxzZWAsIGBzZXJ2ZXIgaGFzIEFLSTogRmFsc2VgOyBgb3BlbnNzbCB2ZXJpZnkKICAteDUwOV9zdHJpY3RgIOKGkiBgZXJyb3IgODUgLi4uIE1pc3NpbmcgQXV0aG9yaXR5IEtleSBJZGVudGlmaWVyYAotIGFmdGVyOiBgQ0EgaGFzIFNLSTogVHJ1ZWAsIGBzZXJ2ZXIgaGFzIEFLSTogVHJ1ZWA7IGBvcGVuc3NsIHZlcmlmeQogIC14NTA5X3N0cmljdGAg4oaSIGBPS2AKClRoZSBwYXRjaCBhbHNvIGFwcGxpZXMgY2xlYW5seSB1bmRlciB0aGUgYnVpbGQncyBgcGF0Y2ggLXAxIC0tZm9yd2FyZAotLWRyeS1ydW5gIGdhdGUgYW5kIHRoZSBwYXRjaGVkIGZpbGUgcGFzc2VzIGBweV9jb21waWxlYC4KCiMjIE5vdGVzCgotIFNlbGYtZXhwaXJpbmcgKE9TSVNNIFA1KTogb25jZSBvY3RhdmlhLXRlbXBlc3QtcGx1Z2luIHNoaXBzIHRoaXMgdXBzdHJlYW0gYW5kCiAgdGhlIHBpbiBidW1wcyBwYXN0IGl0LCB0aGUgYC0tZHJ5LXJ1bmAgZ2F0ZSBmYWlscyB0aGUgYnVpbGQgYW5kIHRoaXMgZmlsZSBtdXN0CiAgYmUgZGVsZXRlZC4gVXBzdHJlYW0gZml4IHN0aWxsIHRvIGJlIGZpbGVkLgotIFNpYmxpbmcgb2YgdGhlIHNhbWUtbWVjaGFuaXNtIHBhdGNoOgogIC0gb3Npc20vY29udGFpbmVyLWltYWdlcyM5NDUKCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUpCg==
      patchset: 3f177a5eaed3a985a4b3ad5c21d5e411ff0d6713
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/hadolint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images
        name: osism/container-images
        short_name: container-images
        src_dir: src/github.com/osism/container-images
      projects:
        github.com/osism/container-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          checkout: main
          checkout_description: zuul branch
          commit: 061c89cec364bc02485f2f58641398654d24aa27
          name: osism/container-images
          required: false
          short_name: container-images
          src_dir: src/github.com/osism/container-images
      ref: refs/pull/947/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
