all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:feb7:cf98
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      docker_namespace: kolla
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 9ee55bbc-152a-49af-aeaa-e729e420dbe4
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:feb7:cf98
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.0.110
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.140
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:feb7:cf98
        region: null
        slot: null
      push_images: false
      version_openstack: '2025.2'
  vars:
    docker_namespace: kolla
    push_images: false
    version_openstack: '2025.2'
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job container-images-kolla-patch explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#76>'
      - '<Job container-images-kolla-patch-2025.2 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#136>'
      - '<Job container-images-kolla-patch-2025.2 explicit: None implied: None source:
        osism/container-images-kolla/.zuul.yaml@main#213>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 9ee457090fed4ad58ccd1548699ce8b8
      build_refs:
      - branch: main
        change: '762'
        change_message: "Build 2024.1 from unmaintained sources\n\n> [!IMPORTANT]\n>
          Cross-repo change. The companion `osism/release#2640` is **already merged**,\n>
          so `main` is currently in the bad window: `container-images-kolla-push-2024.1`\n>
          fails every midnight at keystone `0002` until this lands. Landing this is
          the\n> fix. See [Merge order](#merge-order).\n\nOpenStack 2024.1 is in the
          unmaintained phase upstream. `001-prepare.sh`\nalready checks out `origin/unmaintained/2024.1`
          for the kolla repository, but\nthe OpenStack project sources are fetched
          as branch tarballs from\n`tarballs.opendev.org`, and those were still requested
          under their\n`stable-2024.1` names.\n\nopendev keeps serving the `stable-2024.1`
          artifacts but stopped refreshing them\nwhen the branches were renamed, so
          they are frozen at the final\n`stable/2024.1` state. The `wget` succeeds
          and `kolla-build` reports no error,\nso the 2024.1 images were silently
          built from Sep/Oct 2025 sources \u2014 the\n`neutron-server:2024.1` image
          rebuilt on 2026-07-30 still ships\n`neutron-24.2.2.dev23` and is still vulnerable
          to CVE-2026-55707.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
          https://bugs.launchpad.net/neutron/+bug/2152113\n- https://review.opendev.org/c/openstack/neutron/+/999186\n\n##
          Change\n\n**1. Requirements tarball.** `scripts/002-generate.sh` hardcoded\n`requirements-stable-$OPENSTACK_VERSION`.
          It now selects the branch explicitly,\nmirroring the checkout already present
          in `001-prepare.sh`. Verified:\n2024.1 \u2192 `requirements-unmaintained-2024.1.tar.gz`;
          2024.2 and 2025.1\nunchanged on `stable-`.\n\nThe per-project source refs
          live in the release repository and are switched\nthere.\n\n**2. Eight patches
          removed.** These have merged upstream into\n`unmaintained/2024.1` and no
          longer apply once the sources come from that\nbranch. A failing `patch --dry-run`
          aborts `003-patch.sh`, so leaving them in\nwould break the build:\n\n```\nneutron:
          \ 0001-Fix-cross-project-access-to-router-conntrack-helpers\nkeystone: 0002,
          0004, 0005, 0006, 0007\nnova:     0001-Fix-mutating-global-config-in-websocket-proxy\n
          \         cve-2026-46448-eom-2024.1\n```\n\nThat these eight were already
          upstream is itself the argument for this change:\nthey were re-carried downstream
          by hand while upstream had backported them to\nthe branch we were not reading.\n\n`patches/2024.1/neutron/`
          becomes empty. The CVE-2026-55707 fix now comes from\nupstream instead of
          the downstream patch that was added in #758 and dropped\nagain in #760.\n\n**3.
          keystone `0008` is kept, with one re-anchored hunk.** It is the only patch\nof
          the `0002`\u2013`0012` series that opendev did **not** backport, so dropping
          it\nwould silently lose a security fix. Absent from `keystone-25.0.1.dev27`:\n\n-
          `_check_credential_project_scope` \u2014 0 hits\n- `_check_delegation_for_ec2`
          \u2014 0 hits\n- `allow_insecure_admin_trust_cross_project_credentials_access`
          in\n  `keystone/conf/security_compliance.py` \u2014 0 hits\n- `releasenotes/notes/bug-2150089-*.yaml`
          \u2014 absent\n\nand `keystone/api/_shared/EC2_S3_Resource.py` still loads
          the OAuth1 access\ntoken without comparing `cred_data['project_id']` to\n`access_token['project_id']`
          \u2014 precisely what `0008` adds.\n\nAll four of its production hunks apply
          unmodified. Only the trailing test hunk\nneeded re-anchoring, because the
          upstream `0006`/`0007` backports extended\n`TestCredentialEc2` past the
          end of the file the hunk was generated against:\n\n```diff\n-@@ -1124,3
          +1416,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n-         self.assertRaises(exception.CredentialNotFound,\n-
          \                          PROVIDERS.credential_api.get_credential,\n-                           cred_from_credential_api[0]['id'])\n+@@
          -1170,3 +1462,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n+
          \        ec2_cred = r.result['credential']\n+         self.assertEqual(self.user_id,
          ec2_cred['user_id'])\n+         self.assertEqual(self.project_id, ec2_cred['tenant_id'])\n```\n\nNo
          patch content changes; none of the five methods it adds collide with\nupstream,
          and no other carried patch touches that file.\n\n## Verification\n\nEvery
          patch dry-run against the `unmaintained-2024.1` tarballs the way\n`003-patch.sh`
          does it \u2014 cumulative, `sort` order, `patch --forward --batch -p1`.\n\nDropped
          \u2014 each reports **every** hunk as already applied, and reverse-applies:\n\n|
          Project | patch | forward | reverse |\n|---|---|---|---|\n| keystone | 0002,
          0004, 0005, 0007 | all hunks ignored | clean |\n| keystone | 0006 | all
          hunks ignored | n/a \u2014 upstream reordered `lazy_validate` and stacked
          code on top; confirmed present at `keystone/api/credentials.py:35,171` |\n|
          neutron | 0001 conntrack helpers | all hunks ignored | clean |\n| nova |
          0001 websocket proxy | all hunks ignored | clean |\n| nova | cve-2026-46448
          | all hunks ignored | clean |\n\nKept \u2014 all apply cleanly:\n\n| Project
          | patches after this change | result |\n|---|---|---|\n| neutron | 0 | \u2014
          |\n| keystone | 5 (`0008`\u2013`0012`) | all apply, 0 rejects, all 7 touched
          files `py_compile` clean |\n| nova | 1 (domain isolation feature patch)
          | applies |\n| cinder | 1 | applies |\n| neutron-dynamic-routing | 1 | applies
          |\n\nAlso confirmed: all 21 projects plus `requirements` have an\n`unmaintained-2024.1`
          artifact, and the extracted\n`neutron-unmaintained-2024.1.tar.gz` contains
          the ownership check.\n\nNote that the failing `post` build proves only **one**
          drop: `003-patch.sh`\nexits on the first failing patch and tarballs are
          processed alphabetically, so\nit aborted at keystone `0002` and never reached
          neutron or nova. The table\nabove comes from checking each patch against
          the tarballs directly.\n\n## Merge order\n\nThere is no `gate` pipeline,
          so the two PRs could not be co-merged.\n\n| Order | Effect in the window
          between merges |\n|---|---|\n| **Companion first, then this** \u2190 what
          happened | New refs while the dropped patches are still present \u2192 `003-patch.sh`
          fails loudly on an already-applied patch. Nothing bad ships. |\n| This PR
          first | Patches removed while refs are still frozen \u2192 builds succeed
          and **silently drop** the fixes. Avoided. |\n\n## After merge\n\n`post`
          fires `container-images-kolla-push-2024.1`. Verify the published image\nby
          content rather than by label or build date:\n\n```sh\ndocker run --rm --entrypoint
          sh registry.osism.tech/kolla/neutron-server:2024.1 -c \\\n  'sed -n \"/def
          onboard_network_subnets/,/return onboard_info/p\" \\\n   /var/lib/kolla/venv/lib/python3.*/site-packages/neutron/db/db_base_plugin_v2.py'\n```\n\nExpect
          the `context.is_admin` / `project_id != context.project_id` /\n`NotAuthorized`
          block, and the source directory to advance from\n`neutron-24.2.2.dev23`
          to `neutron-24.2.3.dev33` or later.\n\n## Companion PR\n\n- osism/release#2640\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images-kolla/pull/762
        commit_id: b288d349f01c0d3435f7bcf5633557380722a988
        patchset: b288d349f01c0d3435f7bcf5633557380722a988
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      buildset: 3fdc5c6089db4b61b56b8c55a426702a
      buildset_refs:
      - branch: main
        change: '762'
        change_message: "Build 2024.1 from unmaintained sources\n\n> [!IMPORTANT]\n>
          Cross-repo change. The companion `osism/release#2640` is **already merged**,\n>
          so `main` is currently in the bad window: `container-images-kolla-push-2024.1`\n>
          fails every midnight at keystone `0002` until this lands. Landing this is
          the\n> fix. See [Merge order](#merge-order).\n\nOpenStack 2024.1 is in the
          unmaintained phase upstream. `001-prepare.sh`\nalready checks out `origin/unmaintained/2024.1`
          for the kolla repository, but\nthe OpenStack project sources are fetched
          as branch tarballs from\n`tarballs.opendev.org`, and those were still requested
          under their\n`stable-2024.1` names.\n\nopendev keeps serving the `stable-2024.1`
          artifacts but stopped refreshing them\nwhen the branches were renamed, so
          they are frozen at the final\n`stable/2024.1` state. The `wget` succeeds
          and `kolla-build` reports no error,\nso the 2024.1 images were silently
          built from Sep/Oct 2025 sources \u2014 the\n`neutron-server:2024.1` image
          rebuilt on 2026-07-30 still ships\n`neutron-24.2.2.dev23` and is still vulnerable
          to CVE-2026-55707.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
          https://bugs.launchpad.net/neutron/+bug/2152113\n- https://review.opendev.org/c/openstack/neutron/+/999186\n\n##
          Change\n\n**1. Requirements tarball.** `scripts/002-generate.sh` hardcoded\n`requirements-stable-$OPENSTACK_VERSION`.
          It now selects the branch explicitly,\nmirroring the checkout already present
          in `001-prepare.sh`. Verified:\n2024.1 \u2192 `requirements-unmaintained-2024.1.tar.gz`;
          2024.2 and 2025.1\nunchanged on `stable-`.\n\nThe per-project source refs
          live in the release repository and are switched\nthere.\n\n**2. Eight patches
          removed.** These have merged upstream into\n`unmaintained/2024.1` and no
          longer apply once the sources come from that\nbranch. A failing `patch --dry-run`
          aborts `003-patch.sh`, so leaving them in\nwould break the build:\n\n```\nneutron:
          \ 0001-Fix-cross-project-access-to-router-conntrack-helpers\nkeystone: 0002,
          0004, 0005, 0006, 0007\nnova:     0001-Fix-mutating-global-config-in-websocket-proxy\n
          \         cve-2026-46448-eom-2024.1\n```\n\nThat these eight were already
          upstream is itself the argument for this change:\nthey were re-carried downstream
          by hand while upstream had backported them to\nthe branch we were not reading.\n\n`patches/2024.1/neutron/`
          becomes empty. The CVE-2026-55707 fix now comes from\nupstream instead of
          the downstream patch that was added in #758 and dropped\nagain in #760.\n\n**3.
          keystone `0008` is kept, with one re-anchored hunk.** It is the only patch\nof
          the `0002`\u2013`0012` series that opendev did **not** backport, so dropping
          it\nwould silently lose a security fix. Absent from `keystone-25.0.1.dev27`:\n\n-
          `_check_credential_project_scope` \u2014 0 hits\n- `_check_delegation_for_ec2`
          \u2014 0 hits\n- `allow_insecure_admin_trust_cross_project_credentials_access`
          in\n  `keystone/conf/security_compliance.py` \u2014 0 hits\n- `releasenotes/notes/bug-2150089-*.yaml`
          \u2014 absent\n\nand `keystone/api/_shared/EC2_S3_Resource.py` still loads
          the OAuth1 access\ntoken without comparing `cred_data['project_id']` to\n`access_token['project_id']`
          \u2014 precisely what `0008` adds.\n\nAll four of its production hunks apply
          unmodified. Only the trailing test hunk\nneeded re-anchoring, because the
          upstream `0006`/`0007` backports extended\n`TestCredentialEc2` past the
          end of the file the hunk was generated against:\n\n```diff\n-@@ -1124,3
          +1416,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n-         self.assertRaises(exception.CredentialNotFound,\n-
          \                          PROVIDERS.credential_api.get_credential,\n-                           cred_from_credential_api[0]['id'])\n+@@
          -1170,3 +1462,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n+
          \        ec2_cred = r.result['credential']\n+         self.assertEqual(self.user_id,
          ec2_cred['user_id'])\n+         self.assertEqual(self.project_id, ec2_cred['tenant_id'])\n```\n\nNo
          patch content changes; none of the five methods it adds collide with\nupstream,
          and no other carried patch touches that file.\n\n## Verification\n\nEvery
          patch dry-run against the `unmaintained-2024.1` tarballs the way\n`003-patch.sh`
          does it \u2014 cumulative, `sort` order, `patch --forward --batch -p1`.\n\nDropped
          \u2014 each reports **every** hunk as already applied, and reverse-applies:\n\n|
          Project | patch | forward | reverse |\n|---|---|---|---|\n| keystone | 0002,
          0004, 0005, 0007 | all hunks ignored | clean |\n| keystone | 0006 | all
          hunks ignored | n/a \u2014 upstream reordered `lazy_validate` and stacked
          code on top; confirmed present at `keystone/api/credentials.py:35,171` |\n|
          neutron | 0001 conntrack helpers | all hunks ignored | clean |\n| nova |
          0001 websocket proxy | all hunks ignored | clean |\n| nova | cve-2026-46448
          | all hunks ignored | clean |\n\nKept \u2014 all apply cleanly:\n\n| Project
          | patches after this change | result |\n|---|---|---|\n| neutron | 0 | \u2014
          |\n| keystone | 5 (`0008`\u2013`0012`) | all apply, 0 rejects, all 7 touched
          files `py_compile` clean |\n| nova | 1 (domain isolation feature patch)
          | applies |\n| cinder | 1 | applies |\n| neutron-dynamic-routing | 1 | applies
          |\n\nAlso confirmed: all 21 projects plus `requirements` have an\n`unmaintained-2024.1`
          artifact, and the extracted\n`neutron-unmaintained-2024.1.tar.gz` contains
          the ownership check.\n\nNote that the failing `post` build proves only **one**
          drop: `003-patch.sh`\nexits on the first failing patch and tarballs are
          processed alphabetically, so\nit aborted at keystone `0002` and never reached
          neutron or nova. The table\nabove comes from checking each patch against
          the tarballs directly.\n\n## Merge order\n\nThere is no `gate` pipeline,
          so the two PRs could not be co-merged.\n\n| Order | Effect in the window
          between merges |\n|---|---|\n| **Companion first, then this** \u2190 what
          happened | New refs while the dropped patches are still present \u2192 `003-patch.sh`
          fails loudly on an already-applied patch. Nothing bad ships. |\n| This PR
          first | Patches removed while refs are still frozen \u2192 builds succeed
          and **silently drop** the fixes. Avoided. |\n\n## After merge\n\n`post`
          fires `container-images-kolla-push-2024.1`. Verify the published image\nby
          content rather than by label or build date:\n\n```sh\ndocker run --rm --entrypoint
          sh registry.osism.tech/kolla/neutron-server:2024.1 -c \\\n  'sed -n \"/def
          onboard_network_subnets/,/return onboard_info/p\" \\\n   /var/lib/kolla/venv/lib/python3.*/site-packages/neutron/db/db_base_plugin_v2.py'\n```\n\nExpect
          the `context.is_admin` / `project_id != context.project_id` /\n`NotAuthorized`
          block, and the source directory to advance from\n`neutron-24.2.2.dev23`
          to `neutron-24.2.3.dev33` or later.\n\n## Companion PR\n\n- osism/release#2640\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images-kolla/pull/762
        commit_id: b288d349f01c0d3435f7bcf5633557380722a988
        patchset: b288d349f01c0d3435f7bcf5633557380722a988
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      change: '762'
      change_message: "Build 2024.1 from unmaintained sources\n\n> [!IMPORTANT]\n>
        Cross-repo change. The companion `osism/release#2640` is **already merged**,\n>
        so `main` is currently in the bad window: `container-images-kolla-push-2024.1`\n>
        fails every midnight at keystone `0002` until this lands. Landing this is
        the\n> fix. See [Merge order](#merge-order).\n\nOpenStack 2024.1 is in the
        unmaintained phase upstream. `001-prepare.sh`\nalready checks out `origin/unmaintained/2024.1`
        for the kolla repository, but\nthe OpenStack project sources are fetched as
        branch tarballs from\n`tarballs.opendev.org`, and those were still requested
        under their\n`stable-2024.1` names.\n\nopendev keeps serving the `stable-2024.1`
        artifacts but stopped refreshing them\nwhen the branches were renamed, so
        they are frozen at the final\n`stable/2024.1` state. The `wget` succeeds and
        `kolla-build` reports no error,\nso the 2024.1 images were silently built
        from Sep/Oct 2025 sources \u2014 the\n`neutron-server:2024.1` image rebuilt
        on 2026-07-30 still ships\n`neutron-24.2.2.dev23` and is still vulnerable
        to CVE-2026-55707.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
        https://bugs.launchpad.net/neutron/+bug/2152113\n- https://review.opendev.org/c/openstack/neutron/+/999186\n\n##
        Change\n\n**1. Requirements tarball.** `scripts/002-generate.sh` hardcoded\n`requirements-stable-$OPENSTACK_VERSION`.
        It now selects the branch explicitly,\nmirroring the checkout already present
        in `001-prepare.sh`. Verified:\n2024.1 \u2192 `requirements-unmaintained-2024.1.tar.gz`;
        2024.2 and 2025.1\nunchanged on `stable-`.\n\nThe per-project source refs
        live in the release repository and are switched\nthere.\n\n**2. Eight patches
        removed.** These have merged upstream into\n`unmaintained/2024.1` and no longer
        apply once the sources come from that\nbranch. A failing `patch --dry-run`
        aborts `003-patch.sh`, so leaving them in\nwould break the build:\n\n```\nneutron:
        \ 0001-Fix-cross-project-access-to-router-conntrack-helpers\nkeystone: 0002,
        0004, 0005, 0006, 0007\nnova:     0001-Fix-mutating-global-config-in-websocket-proxy\n
        \         cve-2026-46448-eom-2024.1\n```\n\nThat these eight were already
        upstream is itself the argument for this change:\nthey were re-carried downstream
        by hand while upstream had backported them to\nthe branch we were not reading.\n\n`patches/2024.1/neutron/`
        becomes empty. The CVE-2026-55707 fix now comes from\nupstream instead of
        the downstream patch that was added in #758 and dropped\nagain in #760.\n\n**3.
        keystone `0008` is kept, with one re-anchored hunk.** It is the only patch\nof
        the `0002`\u2013`0012` series that opendev did **not** backport, so dropping
        it\nwould silently lose a security fix. Absent from `keystone-25.0.1.dev27`:\n\n-
        `_check_credential_project_scope` \u2014 0 hits\n- `_check_delegation_for_ec2`
        \u2014 0 hits\n- `allow_insecure_admin_trust_cross_project_credentials_access`
        in\n  `keystone/conf/security_compliance.py` \u2014 0 hits\n- `releasenotes/notes/bug-2150089-*.yaml`
        \u2014 absent\n\nand `keystone/api/_shared/EC2_S3_Resource.py` still loads
        the OAuth1 access\ntoken without comparing `cred_data['project_id']` to\n`access_token['project_id']`
        \u2014 precisely what `0008` adds.\n\nAll four of its production hunks apply
        unmodified. Only the trailing test hunk\nneeded re-anchoring, because the
        upstream `0006`/`0007` backports extended\n`TestCredentialEc2` past the end
        of the file the hunk was generated against:\n\n```diff\n-@@ -1124,3 +1416,103
        @@ class TestCredentialEc2(CredentialBaseTestCase):\n-         self.assertRaises(exception.CredentialNotFound,\n-
        \                          PROVIDERS.credential_api.get_credential,\n-                           cred_from_credential_api[0]['id'])\n+@@
        -1170,3 +1462,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n+         ec2_cred
        = r.result['credential']\n+         self.assertEqual(self.user_id, ec2_cred['user_id'])\n+
        \        self.assertEqual(self.project_id, ec2_cred['tenant_id'])\n```\n\nNo
        patch content changes; none of the five methods it adds collide with\nupstream,
        and no other carried patch touches that file.\n\n## Verification\n\nEvery
        patch dry-run against the `unmaintained-2024.1` tarballs the way\n`003-patch.sh`
        does it \u2014 cumulative, `sort` order, `patch --forward --batch -p1`.\n\nDropped
        \u2014 each reports **every** hunk as already applied, and reverse-applies:\n\n|
        Project | patch | forward | reverse |\n|---|---|---|---|\n| keystone | 0002,
        0004, 0005, 0007 | all hunks ignored | clean |\n| keystone | 0006 | all hunks
        ignored | n/a \u2014 upstream reordered `lazy_validate` and stacked code on
        top; confirmed present at `keystone/api/credentials.py:35,171` |\n| neutron
        | 0001 conntrack helpers | all hunks ignored | clean |\n| nova | 0001 websocket
        proxy | all hunks ignored | clean |\n| nova | cve-2026-46448 | all hunks ignored
        | clean |\n\nKept \u2014 all apply cleanly:\n\n| Project | patches after this
        change | result |\n|---|---|---|\n| neutron | 0 | \u2014 |\n| keystone | 5
        (`0008`\u2013`0012`) | all apply, 0 rejects, all 7 touched files `py_compile`
        clean |\n| nova | 1 (domain isolation feature patch) | applies |\n| cinder
        | 1 | applies |\n| neutron-dynamic-routing | 1 | applies |\n\nAlso confirmed:
        all 21 projects plus `requirements` have an\n`unmaintained-2024.1` artifact,
        and the extracted\n`neutron-unmaintained-2024.1.tar.gz` contains the ownership
        check.\n\nNote that the failing `post` build proves only **one** drop: `003-patch.sh`\nexits
        on the first failing patch and tarballs are processed alphabetically, so\nit
        aborted at keystone `0002` and never reached neutron or nova. The table\nabove
        comes from checking each patch against the tarballs directly.\n\n## Merge
        order\n\nThere is no `gate` pipeline, so the two PRs could not be co-merged.\n\n|
        Order | Effect in the window between merges |\n|---|---|\n| **Companion first,
        then this** \u2190 what happened | New refs while the dropped patches are
        still present \u2192 `003-patch.sh` fails loudly on an already-applied patch.
        Nothing bad ships. |\n| This PR first | Patches removed while refs are still
        frozen \u2192 builds succeed and **silently drop** the fixes. Avoided. |\n\n##
        After merge\n\n`post` fires `container-images-kolla-push-2024.1`. Verify the
        published image\nby content rather than by label or build date:\n\n```sh\ndocker
        run --rm --entrypoint sh registry.osism.tech/kolla/neutron-server:2024.1 -c
        \\\n  'sed -n \"/def onboard_network_subnets/,/return onboard_info/p\" \\\n
        \  /var/lib/kolla/venv/lib/python3.*/site-packages/neutron/db/db_base_plugin_v2.py'\n```\n\nExpect
        the `context.is_admin` / `project_id != context.project_id` /\n`NotAuthorized`
        block, and the source directory to advance from\n`neutron-24.2.2.dev23` to
        `neutron-24.2.3.dev33` or later.\n\n## Companion PR\n\n- osism/release#2640\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)\n"
      change_url: https://github.com/osism/container-images-kolla/pull/762
      child_jobs: []
      commit_id: b288d349f01c0d3435f7bcf5633557380722a988
      event_id: 43a0fbae-8cb5-11f1-9d6d-194a599b5d90
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/9ee457090fed4ad58ccd1548699ce8b8/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/9ee457090fed4ad58ccd1548699ce8b8/work/logs
        result_data_file: /var/lib/zuul/builds/9ee457090fed4ad58ccd1548699ce8b8/work/results.json
        src_root: /var/lib/zuul/builds/9ee457090fed4ad58ccd1548699ce8b8/work/src
        work_root: /var/lib/zuul/builds/9ee457090fed4ad58ccd1548699ce8b8/work
      include_vars: []
      items:
      - branch: main
        change: '762'
        change_message: "Build 2024.1 from unmaintained sources\n\n> [!IMPORTANT]\n>
          Cross-repo change. The companion `osism/release#2640` is **already merged**,\n>
          so `main` is currently in the bad window: `container-images-kolla-push-2024.1`\n>
          fails every midnight at keystone `0002` until this lands. Landing this is
          the\n> fix. See [Merge order](#merge-order).\n\nOpenStack 2024.1 is in the
          unmaintained phase upstream. `001-prepare.sh`\nalready checks out `origin/unmaintained/2024.1`
          for the kolla repository, but\nthe OpenStack project sources are fetched
          as branch tarballs from\n`tarballs.opendev.org`, and those were still requested
          under their\n`stable-2024.1` names.\n\nopendev keeps serving the `stable-2024.1`
          artifacts but stopped refreshing them\nwhen the branches were renamed, so
          they are frozen at the final\n`stable/2024.1` state. The `wget` succeeds
          and `kolla-build` reports no error,\nso the 2024.1 images were silently
          built from Sep/Oct 2025 sources \u2014 the\n`neutron-server:2024.1` image
          rebuilt on 2026-07-30 still ships\n`neutron-24.2.2.dev23` and is still vulnerable
          to CVE-2026-55707.\n\n- https://osism.tech/docs/appendix/security/ossa-2026-032/\n-
          https://bugs.launchpad.net/neutron/+bug/2152113\n- https://review.opendev.org/c/openstack/neutron/+/999186\n\n##
          Change\n\n**1. Requirements tarball.** `scripts/002-generate.sh` hardcoded\n`requirements-stable-$OPENSTACK_VERSION`.
          It now selects the branch explicitly,\nmirroring the checkout already present
          in `001-prepare.sh`. Verified:\n2024.1 \u2192 `requirements-unmaintained-2024.1.tar.gz`;
          2024.2 and 2025.1\nunchanged on `stable-`.\n\nThe per-project source refs
          live in the release repository and are switched\nthere.\n\n**2. Eight patches
          removed.** These have merged upstream into\n`unmaintained/2024.1` and no
          longer apply once the sources come from that\nbranch. A failing `patch --dry-run`
          aborts `003-patch.sh`, so leaving them in\nwould break the build:\n\n```\nneutron:
          \ 0001-Fix-cross-project-access-to-router-conntrack-helpers\nkeystone: 0002,
          0004, 0005, 0006, 0007\nnova:     0001-Fix-mutating-global-config-in-websocket-proxy\n
          \         cve-2026-46448-eom-2024.1\n```\n\nThat these eight were already
          upstream is itself the argument for this change:\nthey were re-carried downstream
          by hand while upstream had backported them to\nthe branch we were not reading.\n\n`patches/2024.1/neutron/`
          becomes empty. The CVE-2026-55707 fix now comes from\nupstream instead of
          the downstream patch that was added in #758 and dropped\nagain in #760.\n\n**3.
          keystone `0008` is kept, with one re-anchored hunk.** It is the only patch\nof
          the `0002`\u2013`0012` series that opendev did **not** backport, so dropping
          it\nwould silently lose a security fix. Absent from `keystone-25.0.1.dev27`:\n\n-
          `_check_credential_project_scope` \u2014 0 hits\n- `_check_delegation_for_ec2`
          \u2014 0 hits\n- `allow_insecure_admin_trust_cross_project_credentials_access`
          in\n  `keystone/conf/security_compliance.py` \u2014 0 hits\n- `releasenotes/notes/bug-2150089-*.yaml`
          \u2014 absent\n\nand `keystone/api/_shared/EC2_S3_Resource.py` still loads
          the OAuth1 access\ntoken without comparing `cred_data['project_id']` to\n`access_token['project_id']`
          \u2014 precisely what `0008` adds.\n\nAll four of its production hunks apply
          unmodified. Only the trailing test hunk\nneeded re-anchoring, because the
          upstream `0006`/`0007` backports extended\n`TestCredentialEc2` past the
          end of the file the hunk was generated against:\n\n```diff\n-@@ -1124,3
          +1416,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n-         self.assertRaises(exception.CredentialNotFound,\n-
          \                          PROVIDERS.credential_api.get_credential,\n-                           cred_from_credential_api[0]['id'])\n+@@
          -1170,3 +1462,103 @@ class TestCredentialEc2(CredentialBaseTestCase):\n+
          \        ec2_cred = r.result['credential']\n+         self.assertEqual(self.user_id,
          ec2_cred['user_id'])\n+         self.assertEqual(self.project_id, ec2_cred['tenant_id'])\n```\n\nNo
          patch content changes; none of the five methods it adds collide with\nupstream,
          and no other carried patch touches that file.\n\n## Verification\n\nEvery
          patch dry-run against the `unmaintained-2024.1` tarballs the way\n`003-patch.sh`
          does it \u2014 cumulative, `sort` order, `patch --forward --batch -p1`.\n\nDropped
          \u2014 each reports **every** hunk as already applied, and reverse-applies:\n\n|
          Project | patch | forward | reverse |\n|---|---|---|---|\n| keystone | 0002,
          0004, 0005, 0007 | all hunks ignored | clean |\n| keystone | 0006 | all
          hunks ignored | n/a \u2014 upstream reordered `lazy_validate` and stacked
          code on top; confirmed present at `keystone/api/credentials.py:35,171` |\n|
          neutron | 0001 conntrack helpers | all hunks ignored | clean |\n| nova |
          0001 websocket proxy | all hunks ignored | clean |\n| nova | cve-2026-46448
          | all hunks ignored | clean |\n\nKept \u2014 all apply cleanly:\n\n| Project
          | patches after this change | result |\n|---|---|---|\n| neutron | 0 | \u2014
          |\n| keystone | 5 (`0008`\u2013`0012`) | all apply, 0 rejects, all 7 touched
          files `py_compile` clean |\n| nova | 1 (domain isolation feature patch)
          | applies |\n| cinder | 1 | applies |\n| neutron-dynamic-routing | 1 | applies
          |\n\nAlso confirmed: all 21 projects plus `requirements` have an\n`unmaintained-2024.1`
          artifact, and the extracted\n`neutron-unmaintained-2024.1.tar.gz` contains
          the ownership check.\n\nNote that the failing `post` build proves only **one**
          drop: `003-patch.sh`\nexits on the first failing patch and tarballs are
          processed alphabetically, so\nit aborted at keystone `0002` and never reached
          neutron or nova. The table\nabove comes from checking each patch against
          the tarballs directly.\n\n## Merge order\n\nThere is no `gate` pipeline,
          so the two PRs could not be co-merged.\n\n| Order | Effect in the window
          between merges |\n|---|---|\n| **Companion first, then this** \u2190 what
          happened | New refs while the dropped patches are still present \u2192 `003-patch.sh`
          fails loudly on an already-applied patch. Nothing bad ships. |\n| This PR
          first | Patches removed while refs are still frozen \u2192 builds succeed
          and **silently drop** the fixes. Avoided. |\n\n## After merge\n\n`post`
          fires `container-images-kolla-push-2024.1`. Verify the published image\nby
          content rather than by label or build date:\n\n```sh\ndocker run --rm --entrypoint
          sh registry.osism.tech/kolla/neutron-server:2024.1 -c \\\n  'sed -n \"/def
          onboard_network_subnets/,/return onboard_info/p\" \\\n   /var/lib/kolla/venv/lib/python3.*/site-packages/neutron/db/db_base_plugin_v2.py'\n```\n\nExpect
          the `context.is_admin` / `project_id != context.project_id` /\n`NotAuthorized`
          block, and the source directory to advance from\n`neutron-24.2.2.dev23`
          to `neutron-24.2.3.dev33` or later.\n\n## Companion PR\n\n- osism/release#2640\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)\n"
        change_url: https://github.com/osism/container-images-kolla/pull/762
        commit_id: b288d349f01c0d3435f7bcf5633557380722a988
        patchset: b288d349f01c0d3435f7bcf5633557380722a988
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
        topic: null
      job: container-images-kolla-patch-2025.2
      jobtags: []
      max_attempts: 3
      message: QnVpbGQgMjAyNC4xIGZyb20gdW5tYWludGFpbmVkIHNvdXJjZXMKCj4gWyFJTVBPUlRBTlRdCj4gQ3Jvc3MtcmVwbyBjaGFuZ2UuIFRoZSBjb21wYW5pb24gYG9zaXNtL3JlbGVhc2UjMjY0MGAgaXMgKiphbHJlYWR5IG1lcmdlZCoqLAo+IHNvIGBtYWluYCBpcyBjdXJyZW50bHkgaW4gdGhlIGJhZCB3aW5kb3c6IGBjb250YWluZXItaW1hZ2VzLWtvbGxhLXB1c2gtMjAyNC4xYAo+IGZhaWxzIGV2ZXJ5IG1pZG5pZ2h0IGF0IGtleXN0b25lIGAwMDAyYCB1bnRpbCB0aGlzIGxhbmRzLiBMYW5kaW5nIHRoaXMgaXMgdGhlCj4gZml4LiBTZWUgW01lcmdlIG9yZGVyXSgjbWVyZ2Utb3JkZXIpLgoKT3BlblN0YWNrIDIwMjQuMSBpcyBpbiB0aGUgdW5tYWludGFpbmVkIHBoYXNlIHVwc3RyZWFtLiBgMDAxLXByZXBhcmUuc2hgCmFscmVhZHkgY2hlY2tzIG91dCBgb3JpZ2luL3VubWFpbnRhaW5lZC8yMDI0LjFgIGZvciB0aGUga29sbGEgcmVwb3NpdG9yeSwgYnV0CnRoZSBPcGVuU3RhY2sgcHJvamVjdCBzb3VyY2VzIGFyZSBmZXRjaGVkIGFzIGJyYW5jaCB0YXJiYWxscyBmcm9tCmB0YXJiYWxscy5vcGVuZGV2Lm9yZ2AsIGFuZCB0aG9zZSB3ZXJlIHN0aWxsIHJlcXVlc3RlZCB1bmRlciB0aGVpcgpgc3RhYmxlLTIwMjQuMWAgbmFtZXMuCgpvcGVuZGV2IGtlZXBzIHNlcnZpbmcgdGhlIGBzdGFibGUtMjAyNC4xYCBhcnRpZmFjdHMgYnV0IHN0b3BwZWQgcmVmcmVzaGluZyB0aGVtCndoZW4gdGhlIGJyYW5jaGVzIHdlcmUgcmVuYW1lZCwgc28gdGhleSBhcmUgZnJvemVuIGF0IHRoZSBmaW5hbApgc3RhYmxlLzIwMjQuMWAgc3RhdGUuIFRoZSBgd2dldGAgc3VjY2VlZHMgYW5kIGBrb2xsYS1idWlsZGAgcmVwb3J0cyBubyBlcnJvciwKc28gdGhlIDIwMjQuMSBpbWFnZXMgd2VyZSBzaWxlbnRseSBidWlsdCBmcm9tIFNlcC9PY3QgMjAyNSBzb3VyY2VzIOKAlCB0aGUKYG5ldXRyb24tc2VydmVyOjIwMjQuMWAgaW1hZ2UgcmVidWlsdCBvbiAyMDI2LTA3LTMwIHN0aWxsIHNoaXBzCmBuZXV0cm9uLTI0LjIuMi5kZXYyM2AgYW5kIGlzIHN0aWxsIHZ1bG5lcmFibGUgdG8gQ1ZFLTIwMjYtNTU3MDcuCgotIGh0dHBzOi8vb3Npc20udGVjaC9kb2NzL2FwcGVuZGl4L3NlY3VyaXR5L29zc2EtMjAyNi0wMzIvCi0gaHR0cHM6Ly9idWdzLmxhdW5jaHBhZC5uZXQvbmV1dHJvbi8rYnVnLzIxNTIxMTMKLSBodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9jL29wZW5zdGFjay9uZXV0cm9uLysvOTk5MTg2CgojIyBDaGFuZ2UKCioqMS4gUmVxdWlyZW1lbnRzIHRhcmJhbGwuKiogYHNjcmlwdHMvMDAyLWdlbmVyYXRlLnNoYCBoYXJkY29kZWQKYHJlcXVpcmVtZW50cy1zdGFibGUtJE9QRU5TVEFDS19WRVJTSU9OYC4gSXQgbm93IHNlbGVjdHMgdGhlIGJyYW5jaCBleHBsaWNpdGx5LAptaXJyb3JpbmcgdGhlIGNoZWNrb3V0IGFscmVhZHkgcHJlc2VudCBpbiBgMDAxLXByZXBhcmUuc2hgLiBWZXJpZmllZDoKMjAyNC4xIOKGkiBgcmVxdWlyZW1lbnRzLXVubWFpbnRhaW5lZC0yMDI0LjEudGFyLmd6YDsgMjAyNC4yIGFuZCAyMDI1LjEKdW5jaGFuZ2VkIG9uIGBzdGFibGUtYC4KClRoZSBwZXItcHJvamVjdCBzb3VyY2UgcmVmcyBsaXZlIGluIHRoZSByZWxlYXNlIHJlcG9zaXRvcnkgYW5kIGFyZSBzd2l0Y2hlZAp0aGVyZS4KCioqMi4gRWlnaHQgcGF0Y2hlcyByZW1vdmVkLioqIFRoZXNlIGhhdmUgbWVyZ2VkIHVwc3RyZWFtIGludG8KYHVubWFpbnRhaW5lZC8yMDI0LjFgIGFuZCBubyBsb25nZXIgYXBwbHkgb25jZSB0aGUgc291cmNlcyBjb21lIGZyb20gdGhhdApicmFuY2guIEEgZmFpbGluZyBgcGF0Y2ggLS1kcnktcnVuYCBhYm9ydHMgYDAwMy1wYXRjaC5zaGAsIHNvIGxlYXZpbmcgdGhlbSBpbgp3b3VsZCBicmVhayB0aGUgYnVpbGQ6CgpgYGAKbmV1dHJvbjogIDAwMDEtRml4LWNyb3NzLXByb2plY3QtYWNjZXNzLXRvLXJvdXRlci1jb25udHJhY2staGVscGVycwprZXlzdG9uZTogMDAwMiwgMDAwNCwgMDAwNSwgMDAwNiwgMDAwNwpub3ZhOiAgICAgMDAwMS1GaXgtbXV0YXRpbmctZ2xvYmFsLWNvbmZpZy1pbi13ZWJzb2NrZXQtcHJveHkKICAgICAgICAgIGN2ZS0yMDI2LTQ2NDQ4LWVvbS0yMDI0LjEKYGBgCgpUaGF0IHRoZXNlIGVpZ2h0IHdlcmUgYWxyZWFkeSB1cHN0cmVhbSBpcyBpdHNlbGYgdGhlIGFyZ3VtZW50IGZvciB0aGlzIGNoYW5nZToKdGhleSB3ZXJlIHJlLWNhcnJpZWQgZG93bnN0cmVhbSBieSBoYW5kIHdoaWxlIHVwc3RyZWFtIGhhZCBiYWNrcG9ydGVkIHRoZW0gdG8KdGhlIGJyYW5jaCB3ZSB3ZXJlIG5vdCByZWFkaW5nLgoKYHBhdGNoZXMvMjAyNC4xL25ldXRyb24vYCBiZWNvbWVzIGVtcHR5LiBUaGUgQ1ZFLTIwMjYtNTU3MDcgZml4IG5vdyBjb21lcyBmcm9tCnVwc3RyZWFtIGluc3RlYWQgb2YgdGhlIGRvd25zdHJlYW0gcGF0Y2ggdGhhdCB3YXMgYWRkZWQgaW4gIzc1OCBhbmQgZHJvcHBlZAphZ2FpbiBpbiAjNzYwLgoKKiozLiBrZXlzdG9uZSBgMDAwOGAgaXMga2VwdCwgd2l0aCBvbmUgcmUtYW5jaG9yZWQgaHVuay4qKiBJdCBpcyB0aGUgb25seSBwYXRjaApvZiB0aGUgYDAwMDJg4oCTYDAwMTJgIHNlcmllcyB0aGF0IG9wZW5kZXYgZGlkICoqbm90KiogYmFja3BvcnQsIHNvIGRyb3BwaW5nIGl0CndvdWxkIHNpbGVudGx5IGxvc2UgYSBzZWN1cml0eSBmaXguIEFic2VudCBmcm9tIGBrZXlzdG9uZS0yNS4wLjEuZGV2MjdgOgoKLSBgX2NoZWNrX2NyZWRlbnRpYWxfcHJvamVjdF9zY29wZWAg4oCUIDAgaGl0cwotIGBfY2hlY2tfZGVsZWdhdGlvbl9mb3JfZWMyYCDigJQgMCBoaXRzCi0gYGFsbG93X2luc2VjdXJlX2FkbWluX3RydXN0X2Nyb3NzX3Byb2plY3RfY3JlZGVudGlhbHNfYWNjZXNzYCBpbgogIGBrZXlzdG9uZS9jb25mL3NlY3VyaXR5X2NvbXBsaWFuY2UucHlgIOKAlCAwIGhpdHMKLSBgcmVsZWFzZW5vdGVzL25vdGVzL2J1Zy0yMTUwMDg5LSoueWFtbGAg4oCUIGFic2VudAoKYW5kIGBrZXlzdG9uZS9hcGkvX3NoYXJlZC9FQzJfUzNfUmVzb3VyY2UucHlgIHN0aWxsIGxvYWRzIHRoZSBPQXV0aDEgYWNjZXNzCnRva2VuIHdpdGhvdXQgY29tcGFyaW5nIGBjcmVkX2RhdGFbJ3Byb2plY3RfaWQnXWAgdG8KYGFjY2Vzc190b2tlblsncHJvamVjdF9pZCddYCDigJQgcHJlY2lzZWx5IHdoYXQgYDAwMDhgIGFkZHMuCgpBbGwgZm91ciBvZiBpdHMgcHJvZHVjdGlvbiBodW5rcyBhcHBseSB1bm1vZGlmaWVkLiBPbmx5IHRoZSB0cmFpbGluZyB0ZXN0IGh1bmsKbmVlZGVkIHJlLWFuY2hvcmluZywgYmVjYXVzZSB0aGUgdXBzdHJlYW0gYDAwMDZgL2AwMDA3YCBiYWNrcG9ydHMgZXh0ZW5kZWQKYFRlc3RDcmVkZW50aWFsRWMyYCBwYXN0IHRoZSBlbmQgb2YgdGhlIGZpbGUgdGhlIGh1bmsgd2FzIGdlbmVyYXRlZCBhZ2FpbnN0OgoKYGBgZGlmZgotQEAgLTExMjQsMyArMTQxNiwxMDMgQEAgY2xhc3MgVGVzdENyZWRlbnRpYWxFYzIoQ3JlZGVudGlhbEJhc2VUZXN0Q2FzZSk6Ci0gICAgICAgICBzZWxmLmFzc2VydFJhaXNlcyhleGNlcHRpb24uQ3JlZGVudGlhbE5vdEZvdW5kLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgUFJPVklERVJTLmNyZWRlbnRpYWxfYXBpLmdldF9jcmVkZW50aWFsLAotICAgICAgICAgICAgICAgICAgICAgICAgICAgY3JlZF9mcm9tX2NyZWRlbnRpYWxfYXBpWzBdWydpZCddKQorQEAgLTExNzAsMyArMTQ2MiwxMDMgQEAgY2xhc3MgVGVzdENyZWRlbnRpYWxFYzIoQ3JlZGVudGlhbEJhc2VUZXN0Q2FzZSk6CisgICAgICAgICBlYzJfY3JlZCA9IHIucmVzdWx0WydjcmVkZW50aWFsJ10KKyAgICAgICAgIHNlbGYuYXNzZXJ0RXF1YWwoc2VsZi51c2VyX2lkLCBlYzJfY3JlZFsndXNlcl9pZCddKQorICAgICAgICAgc2VsZi5hc3NlcnRFcXVhbChzZWxmLnByb2plY3RfaWQsIGVjMl9jcmVkWyd0ZW5hbnRfaWQnXSkKYGBgCgpObyBwYXRjaCBjb250ZW50IGNoYW5nZXM7IG5vbmUgb2YgdGhlIGZpdmUgbWV0aG9kcyBpdCBhZGRzIGNvbGxpZGUgd2l0aAp1cHN0cmVhbSwgYW5kIG5vIG90aGVyIGNhcnJpZWQgcGF0Y2ggdG91Y2hlcyB0aGF0IGZpbGUuCgojIyBWZXJpZmljYXRpb24KCkV2ZXJ5IHBhdGNoIGRyeS1ydW4gYWdhaW5zdCB0aGUgYHVubWFpbnRhaW5lZC0yMDI0LjFgIHRhcmJhbGxzIHRoZSB3YXkKYDAwMy1wYXRjaC5zaGAgZG9lcyBpdCDigJQgY3VtdWxhdGl2ZSwgYHNvcnRgIG9yZGVyLCBgcGF0Y2ggLS1mb3J3YXJkIC0tYmF0Y2ggLXAxYC4KCkRyb3BwZWQg4oCUIGVhY2ggcmVwb3J0cyAqKmV2ZXJ5KiogaHVuayBhcyBhbHJlYWR5IGFwcGxpZWQsIGFuZCByZXZlcnNlLWFwcGxpZXM6Cgp8IFByb2plY3QgfCBwYXRjaCB8IGZvcndhcmQgfCByZXZlcnNlIHwKfC0tLXwtLS18LS0tfC0tLXwKfCBrZXlzdG9uZSB8IDAwMDIsIDAwMDQsIDAwMDUsIDAwMDcgfCBhbGwgaHVua3MgaWdub3JlZCB8IGNsZWFuIHwKfCBrZXlzdG9uZSB8IDAwMDYgfCBhbGwgaHVua3MgaWdub3JlZCB8IG4vYSDigJQgdXBzdHJlYW0gcmVvcmRlcmVkIGBsYXp5X3ZhbGlkYXRlYCBhbmQgc3RhY2tlZCBjb2RlIG9uIHRvcDsgY29uZmlybWVkIHByZXNlbnQgYXQgYGtleXN0b25lL2FwaS9jcmVkZW50aWFscy5weTozNSwxNzFgIHwKfCBuZXV0cm9uIHwgMDAwMSBjb25udHJhY2sgaGVscGVycyB8IGFsbCBodW5rcyBpZ25vcmVkIHwgY2xlYW4gfAp8IG5vdmEgfCAwMDAxIHdlYnNvY2tldCBwcm94eSB8IGFsbCBodW5rcyBpZ25vcmVkIHwgY2xlYW4gfAp8IG5vdmEgfCBjdmUtMjAyNi00NjQ0OCB8IGFsbCBodW5rcyBpZ25vcmVkIHwgY2xlYW4gfAoKS2VwdCDigJQgYWxsIGFwcGx5IGNsZWFubHk6Cgp8IFByb2plY3QgfCBwYXRjaGVzIGFmdGVyIHRoaXMgY2hhbmdlIHwgcmVzdWx0IHwKfC0tLXwtLS18LS0tfAp8IG5ldXRyb24gfCAwIHwg4oCUIHwKfCBrZXlzdG9uZSB8IDUgKGAwMDA4YOKAk2AwMDEyYCkgfCBhbGwgYXBwbHksIDAgcmVqZWN0cywgYWxsIDcgdG91Y2hlZCBmaWxlcyBgcHlfY29tcGlsZWAgY2xlYW4gfAp8IG5vdmEgfCAxIChkb21haW4gaXNvbGF0aW9uIGZlYXR1cmUgcGF0Y2gpIHwgYXBwbGllcyB8CnwgY2luZGVyIHwgMSB8IGFwcGxpZXMgfAp8IG5ldXRyb24tZHluYW1pYy1yb3V0aW5nIHwgMSB8IGFwcGxpZXMgfAoKQWxzbyBjb25maXJtZWQ6IGFsbCAyMSBwcm9qZWN0cyBwbHVzIGByZXF1aXJlbWVudHNgIGhhdmUgYW4KYHVubWFpbnRhaW5lZC0yMDI0LjFgIGFydGlmYWN0LCBhbmQgdGhlIGV4dHJhY3RlZApgbmV1dHJvbi11bm1haW50YWluZWQtMjAyNC4xLnRhci5nemAgY29udGFpbnMgdGhlIG93bmVyc2hpcCBjaGVjay4KCk5vdGUgdGhhdCB0aGUgZmFpbGluZyBgcG9zdGAgYnVpbGQgcHJvdmVzIG9ubHkgKipvbmUqKiBkcm9wOiBgMDAzLXBhdGNoLnNoYApleGl0cyBvbiB0aGUgZmlyc3QgZmFpbGluZyBwYXRjaCBhbmQgdGFyYmFsbHMgYXJlIHByb2Nlc3NlZCBhbHBoYWJldGljYWxseSwgc28KaXQgYWJvcnRlZCBhdCBrZXlzdG9uZSBgMDAwMmAgYW5kIG5ldmVyIHJlYWNoZWQgbmV1dHJvbiBvciBub3ZhLiBUaGUgdGFibGUKYWJvdmUgY29tZXMgZnJvbSBjaGVja2luZyBlYWNoIHBhdGNoIGFnYWluc3QgdGhlIHRhcmJhbGxzIGRpcmVjdGx5LgoKIyMgTWVyZ2Ugb3JkZXIKClRoZXJlIGlzIG5vIGBnYXRlYCBwaXBlbGluZSwgc28gdGhlIHR3byBQUnMgY291bGQgbm90IGJlIGNvLW1lcmdlZC4KCnwgT3JkZXIgfCBFZmZlY3QgaW4gdGhlIHdpbmRvdyBiZXR3ZWVuIG1lcmdlcyB8CnwtLS18LS0tfAp8ICoqQ29tcGFuaW9uIGZpcnN0LCB0aGVuIHRoaXMqKiDihpAgd2hhdCBoYXBwZW5lZCB8IE5ldyByZWZzIHdoaWxlIHRoZSBkcm9wcGVkIHBhdGNoZXMgYXJlIHN0aWxsIHByZXNlbnQg4oaSIGAwMDMtcGF0Y2guc2hgIGZhaWxzIGxvdWRseSBvbiBhbiBhbHJlYWR5LWFwcGxpZWQgcGF0Y2guIE5vdGhpbmcgYmFkIHNoaXBzLiB8CnwgVGhpcyBQUiBmaXJzdCB8IFBhdGNoZXMgcmVtb3ZlZCB3aGlsZSByZWZzIGFyZSBzdGlsbCBmcm96ZW4g4oaSIGJ1aWxkcyBzdWNjZWVkIGFuZCAqKnNpbGVudGx5IGRyb3AqKiB0aGUgZml4ZXMuIEF2b2lkZWQuIHwKCiMjIEFmdGVyIG1lcmdlCgpgcG9zdGAgZmlyZXMgYGNvbnRhaW5lci1pbWFnZXMta29sbGEtcHVzaC0yMDI0LjFgLiBWZXJpZnkgdGhlIHB1Ymxpc2hlZCBpbWFnZQpieSBjb250ZW50IHJhdGhlciB0aGFuIGJ5IGxhYmVsIG9yIGJ1aWxkIGRhdGU6CgpgYGBzaApkb2NrZXIgcnVuIC0tcm0gLS1lbnRyeXBvaW50IHNoIHJlZ2lzdHJ5Lm9zaXNtLnRlY2gva29sbGEvbmV1dHJvbi1zZXJ2ZXI6MjAyNC4xIC1jIFwKICAnc2VkIC1uICIvZGVmIG9uYm9hcmRfbmV0d29ya19zdWJuZXRzLywvcmV0dXJuIG9uYm9hcmRfaW5mby9wIiBcCiAgIC92YXIvbGliL2tvbGxhL3ZlbnYvbGliL3B5dGhvbjMuKi9zaXRlLXBhY2thZ2VzL25ldXRyb24vZGIvZGJfYmFzZV9wbHVnaW5fdjIucHknCmBgYAoKRXhwZWN0IHRoZSBgY29udGV4dC5pc19hZG1pbmAgLyBgcHJvamVjdF9pZCAhPSBjb250ZXh0LnByb2plY3RfaWRgIC8KYE5vdEF1dGhvcml6ZWRgIGJsb2NrLCBhbmQgdGhlIHNvdXJjZSBkaXJlY3RvcnkgdG8gYWR2YW5jZSBmcm9tCmBuZXV0cm9uLTI0LjIuMi5kZXYyM2AgdG8gYG5ldXRyb24tMjQuMi4zLmRldjMzYCBvciBsYXRlci4KCiMjIENvbXBhbmlvbiBQUgoKLSBvc2lzbS9yZWxlYXNlIzI2NDAKCvCfpJYgR2VuZXJhdGVkIHdpdGggW0NsYXVkZSBDb2RlXShodHRwczovL2NsYXVkZS5jb20vY2xhdWRlLWNvZGUpCg==
      patchset: b288d349f01c0d3435f7bcf5633557380722a988
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/container-images-kolla:
            canonical_name: github.com/osism/container-images-kolla
            checkout: main
            commit: cdda60495631e5a885320440937eccf489c27009
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
        playbooks:
        - path: untrusted/project_0/github.com/osism/container-images-kolla/playbooks/patch.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images-kolla
        name: osism/container-images-kolla
        short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
      projects:
        github.com/osism/container-images-kolla:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          checkout: main
          checkout_description: zuul branch
          commit: cdda60495631e5a885320440937eccf489c27009
          name: osism/container-images-kolla
          required: false
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
      ref: refs/pull/762/head
      resources: {}
      tenant: osism
      timeout: 10800
      topic: null
      voting: true
