all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe68:fa28
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      docker_namespace: kolla
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: b70769fc-df6a-471a-9338-ddc0fa7ad8a5
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe68:fa28
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.205
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.230
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe68:fa28
        region: null
        slot: null
      push_images: false
      version_openstack: '2025.1'
  vars:
    docker_namespace: kolla
    push_images: false
    version_openstack: '2025.1'
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job container-images-kolla-patch explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#76>'
      - '<Job container-images-kolla-patch-2025.1 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#132>'
      - '<Job container-images-kolla-patch-2025.1 explicit: None implied: None source:
        osism/container-images-kolla/.zuul.yaml@main#243>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: dc2f3b7cddc941779cc677cf39b077e4
      build_refs:
      - branch: main
        change: '717'
        change_message: "Update dependency Mako to v1.3.12 [SECURITY]\n\nThis PR contains
          the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [Mako](https://www.makotemplates.org/) ([source](https://redirect.github.com/sqlalchemy/mako))
          | `==1.3.10` \u2192 `==1.3.12` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mako/1.3.12?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mako/1.3.10/1.3.12?slim=true)
          |\n\n---\n\n### Mako: Path traversal via double-slash URI prefix in TemplateLookup\n[CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)
          / [GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n\n`TemplateLookup.get_template()`
          is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`).
          The root cause is an inconsistency between two slash-stripping implementations:\n\n-
          `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()`
          strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI
          like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all
          `/` \u2192 `../../../../etc/passwd` \u2192 file found via `posixpath.join(dir_,
          u)`\n2. `Template.__init__` strips one `/` \u2192 `/../../../../etc/passwd`
          \u2192 `normpath` \u2192 `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`)
          \u2192 `False` \u2192 **check bypassed**\n\n##### Impact\n\nArbitrary file
          read: any file readable by the process can be returned as rendered template
          content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote:
          this is exploitable at the library API level. HTTP-based exploitation is
          mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash
          prefixes since CPython gh-87389. Applications using other HTTP servers that
          do not normalize paths may be affected.\n\n##### Fix\n\nChanged `Template.__init__`
          to use `lstrip(\"/\")` instead of stripping only a single leading slash,
          so both code paths handle leading slashes consistently.\n\n#### Severity\n-
          CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm)\n-
          [https://nvd.nist.gov/vuln/detail/CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)\n-
          [https://github.com/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup\n[CVE-2026-44307](https://nvd.nist.gov/vuln/detail/CVE-2026-44307)
          / [GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n\nOn Windows, a URI
          using backslash traversal (e.g. `\\..\\..\\ secret.txt`) bypasses the directory
          traversal check in `Template.__init__` and the `posixpath`-based normalization
          in `TemplateLookup.get_template()`, allowing reads of files outside the
          configured template directory.\n\n##### Details\n\nThe root cause is a mismatch
          between `posixpath` (used for URI normalization in `get_template()`) and
          `os.path` (used for file access via `os.path.isfile()` and validation via
          `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`,
          which treats `\\` as a path separator, while `posixpath` treats it as a
          literal character.\n\nThe vulnerability chain:\n\n1. `get_template()` strips
          only leading `/` via `re.sub(r\"^\\/+\", \"\", uri)` and normalizes with
          `posixpath` \u2014 backslash `\\` is treated as a literal character, so
          `\\..\\ secret.txt` passes through with `..` undetected.\n2. `Template.__init__()`
          validation uses `os.path.normpath()` \u2014 on Windows this resolves `\\..\\
          secret.txt` to `\\secret.txt`, which does not start with `..`, so the `startswith(\"..\")`
          check passes.\n3. `os.path.isfile()` on Windows interprets `\\` as a path
          separator, resolving the `..` traversal and finding files outside the template
          directory.\n\n##### Affected code\n\n- `mako/lookup.py`: `TemplateLookup.get_template()`
          uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()`
          for existence check\n- `mako/template.py`: `Template.__init__()` URI validation
          uses `os.path.normpath()` which on Windows resolves backslash traversal
          to a form that passes the `startswith(\"..\")` guard\n\n##### Impact\n\nIf
          an application passes user-controlled template names or include paths to
          `TemplateLookup.get_template()`, an attacker on Windows may be able to load
          and disclose readable files outside the configured template directory. The
          primary impact is local file disclosure. If the targeted file contains Mako/Python
          template syntax, it may also be parsed and executed as a template.\n\n#####
          Remediation\n\nThe fix should normalize backslashes to forward slashes early
          in the URI processing pipeline, before any path operations, to ensure consistent
          behavior across platforms.\n\n#### Severity\n- CVSS Score: 8.7 / 10 (High)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq)\n-
          [https://github.com/sqlalchemy/mako/issues/435](https://redirect.github.com/sqlalchemy/mako/issues/435)\n-
          [https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7](https://redirect.github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7)\n-
          [https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12](https://redirect.github.com/sqlalchemy/mako/releases/tag/rel_1_3_12)\n-
          [https://github.com/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
          Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/container-images-kolla).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/container-images-kolla/pull/717
        commit_id: 4350578f31c35158af4dcd8ae1208959b2e7e95e
        patchset: 4350578f31c35158af4dcd8ae1208959b2e7e95e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      buildset: df196f4c23ae4d26a178bbfaebcfb224
      buildset_refs:
      - branch: main
        change: '717'
        change_message: "Update dependency Mako to v1.3.12 [SECURITY]\n\nThis PR contains
          the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [Mako](https://www.makotemplates.org/) ([source](https://redirect.github.com/sqlalchemy/mako))
          | `==1.3.10` \u2192 `==1.3.12` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mako/1.3.12?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mako/1.3.10/1.3.12?slim=true)
          |\n\n---\n\n### Mako: Path traversal via double-slash URI prefix in TemplateLookup\n[CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)
          / [GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n\n`TemplateLookup.get_template()`
          is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`).
          The root cause is an inconsistency between two slash-stripping implementations:\n\n-
          `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()`
          strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI
          like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all
          `/` \u2192 `../../../../etc/passwd` \u2192 file found via `posixpath.join(dir_,
          u)`\n2. `Template.__init__` strips one `/` \u2192 `/../../../../etc/passwd`
          \u2192 `normpath` \u2192 `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`)
          \u2192 `False` \u2192 **check bypassed**\n\n##### Impact\n\nArbitrary file
          read: any file readable by the process can be returned as rendered template
          content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote:
          this is exploitable at the library API level. HTTP-based exploitation is
          mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash
          prefixes since CPython gh-87389. Applications using other HTTP servers that
          do not normalize paths may be affected.\n\n##### Fix\n\nChanged `Template.__init__`
          to use `lstrip(\"/\")` instead of stripping only a single leading slash,
          so both code paths handle leading slashes consistently.\n\n#### Severity\n-
          CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm)\n-
          [https://nvd.nist.gov/vuln/detail/CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)\n-
          [https://github.com/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup\n[CVE-2026-44307](https://nvd.nist.gov/vuln/detail/CVE-2026-44307)
          / [GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n\nOn Windows, a URI
          using backslash traversal (e.g. `\\..\\..\\ secret.txt`) bypasses the directory
          traversal check in `Template.__init__` and the `posixpath`-based normalization
          in `TemplateLookup.get_template()`, allowing reads of files outside the
          configured template directory.\n\n##### Details\n\nThe root cause is a mismatch
          between `posixpath` (used for URI normalization in `get_template()`) and
          `os.path` (used for file access via `os.path.isfile()` and validation via
          `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`,
          which treats `\\` as a path separator, while `posixpath` treats it as a
          literal character.\n\nThe vulnerability chain:\n\n1. `get_template()` strips
          only leading `/` via `re.sub(r\"^\\/+\", \"\", uri)` and normalizes with
          `posixpath` \u2014 backslash `\\` is treated as a literal character, so
          `\\..\\ secret.txt` passes through with `..` undetected.\n2. `Template.__init__()`
          validation uses `os.path.normpath()` \u2014 on Windows this resolves `\\..\\
          secret.txt` to `\\secret.txt`, which does not start with `..`, so the `startswith(\"..\")`
          check passes.\n3. `os.path.isfile()` on Windows interprets `\\` as a path
          separator, resolving the `..` traversal and finding files outside the template
          directory.\n\n##### Affected code\n\n- `mako/lookup.py`: `TemplateLookup.get_template()`
          uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()`
          for existence check\n- `mako/template.py`: `Template.__init__()` URI validation
          uses `os.path.normpath()` which on Windows resolves backslash traversal
          to a form that passes the `startswith(\"..\")` guard\n\n##### Impact\n\nIf
          an application passes user-controlled template names or include paths to
          `TemplateLookup.get_template()`, an attacker on Windows may be able to load
          and disclose readable files outside the configured template directory. The
          primary impact is local file disclosure. If the targeted file contains Mako/Python
          template syntax, it may also be parsed and executed as a template.\n\n#####
          Remediation\n\nThe fix should normalize backslashes to forward slashes early
          in the URI processing pipeline, before any path operations, to ensure consistent
          behavior across platforms.\n\n#### Severity\n- CVSS Score: 8.7 / 10 (High)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq)\n-
          [https://github.com/sqlalchemy/mako/issues/435](https://redirect.github.com/sqlalchemy/mako/issues/435)\n-
          [https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7](https://redirect.github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7)\n-
          [https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12](https://redirect.github.com/sqlalchemy/mako/releases/tag/rel_1_3_12)\n-
          [https://github.com/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
          Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/container-images-kolla).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/container-images-kolla/pull/717
        commit_id: 4350578f31c35158af4dcd8ae1208959b2e7e95e
        patchset: 4350578f31c35158af4dcd8ae1208959b2e7e95e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      change: '717'
      change_message: "Update dependency Mako to v1.3.12 [SECURITY]\n\nThis PR contains
        the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
        | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
        [Mako](https://www.makotemplates.org/) ([source](https://redirect.github.com/sqlalchemy/mako))
        | `==1.3.10` \u2192 `==1.3.12` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mako/1.3.12?slim=true)
        | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mako/1.3.10/1.3.12?slim=true)
        |\n\n---\n\n### Mako: Path traversal via double-slash URI prefix in TemplateLookup\n[CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)
        / [GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\n\n`TemplateLookup.get_template()`
        is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`).
        The root cause is an inconsistency between two slash-stripping implementations:\n\n-
        `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()`
        strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI
        like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all
        `/` \u2192 `../../../../etc/passwd` \u2192 file found via `posixpath.join(dir_,
        u)`\n2. `Template.__init__` strips one `/` \u2192 `/../../../../etc/passwd`
        \u2192 `normpath` \u2192 `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`)
        \u2192 `False` \u2192 **check bypassed**\n\n##### Impact\n\nArbitrary file
        read: any file readable by the process can be returned as rendered template
        content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote:
        this is exploitable at the library API level. HTTP-based exploitation is mitigated
        by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes
        since CPython gh-87389. Applications using other HTTP servers that do not
        normalize paths may be affected.\n\n##### Fix\n\nChanged `Template.__init__`
        to use `lstrip(\"/\")` instead of stripping only a single leading slash, so
        both code paths handle leading slashes consistently.\n\n#### Severity\n- CVSS
        Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm)\n-
        [https://nvd.nist.gov/vuln/detail/CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)\n-
        [https://github.com/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\nThis
        data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup\n[CVE-2026-44307](https://nvd.nist.gov/vuln/detail/CVE-2026-44307)
        / [GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\n<details>\n<summary>More
        information</summary>\n\n#### Details\n##### Summary\n\nOn Windows, a URI
        using backslash traversal (e.g. `\\..\\..\\ secret.txt`) bypasses the directory
        traversal check in `Template.__init__` and the `posixpath`-based normalization
        in `TemplateLookup.get_template()`, allowing reads of files outside the configured
        template directory.\n\n##### Details\n\nThe root cause is a mismatch between
        `posixpath` (used for URI normalization in `get_template()`) and `os.path`
        (used for file access via `os.path.isfile()` and validation via `os.path.normpath()`
        in `Template.__init__`). On Windows, `os.path` is `ntpath`, which treats `\\`
        as a path separator, while `posixpath` treats it as a literal character.\n\nThe
        vulnerability chain:\n\n1. `get_template()` strips only leading `/` via `re.sub(r\"^\\/+\",
        \"\", uri)` and normalizes with `posixpath` \u2014 backslash `\\` is treated
        as a literal character, so `\\..\\ secret.txt` passes through with `..` undetected.\n2.
        `Template.__init__()` validation uses `os.path.normpath()` \u2014 on Windows
        this resolves `\\..\\ secret.txt` to `\\secret.txt`, which does not start
        with `..`, so the `startswith(\"..\")` check passes.\n3. `os.path.isfile()`
        on Windows interprets `\\` as a path separator, resolving the `..` traversal
        and finding files outside the template directory.\n\n##### Affected code\n\n-
        `mako/lookup.py`: `TemplateLookup.get_template()` uses `posixpath.normpath`/`posixpath.join`
        for path construction but `os.path.isfile()` for existence check\n- `mako/template.py`:
        `Template.__init__()` URI validation uses `os.path.normpath()` which on Windows
        resolves backslash traversal to a form that passes the `startswith(\"..\")`
        guard\n\n##### Impact\n\nIf an application passes user-controlled template
        names or include paths to `TemplateLookup.get_template()`, an attacker on
        Windows may be able to load and disclose readable files outside the configured
        template directory. The primary impact is local file disclosure. If the targeted
        file contains Mako/Python template syntax, it may also be parsed and executed
        as a template.\n\n##### Remediation\n\nThe fix should normalize backslashes
        to forward slashes early in the URI processing pipeline, before any path operations,
        to ensure consistent behavior across platforms.\n\n#### Severity\n- CVSS Score:
        8.7 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
        References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq)\n-
        [https://github.com/sqlalchemy/mako/issues/435](https://redirect.github.com/sqlalchemy/mako/issues/435)\n-
        [https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7](https://redirect.github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7)\n-
        [https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12](https://redirect.github.com/sqlalchemy/mako/releases/tag/rel_1_3_12)\n-
        [https://github.com/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\nThis
        data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)
        ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
        Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
        **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
        checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
        about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
        to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by
        [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/osism/container-images-kolla).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
      change_url: https://github.com/osism/container-images-kolla/pull/717
      child_jobs: []
      commit_id: 4350578f31c35158af4dcd8ae1208959b2e7e95e
      event_id: f8aca810-4bb3-11f1-8245-170144d3fb59
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/dc2f3b7cddc941779cc677cf39b077e4/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/dc2f3b7cddc941779cc677cf39b077e4/work/logs
        result_data_file: /var/lib/zuul/builds/dc2f3b7cddc941779cc677cf39b077e4/work/results.json
        src_root: /var/lib/zuul/builds/dc2f3b7cddc941779cc677cf39b077e4/work/src
        work_root: /var/lib/zuul/builds/dc2f3b7cddc941779cc677cf39b077e4/work
      include_vars: []
      items:
      - branch: main
        change: '717'
        change_message: "Update dependency Mako to v1.3.12 [SECURITY]\n\nThis PR contains
          the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/)
          | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n|
          [Mako](https://www.makotemplates.org/) ([source](https://redirect.github.com/sqlalchemy/mako))
          | `==1.3.10` \u2192 `==1.3.12` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/mako/1.3.12?slim=true)
          | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/mako/1.3.10/1.3.12?slim=true)
          |\n\n---\n\n### Mako: Path traversal via double-slash URI prefix in TemplateLookup\n[CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)
          / [GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n\n`TemplateLookup.get_template()`
          is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`).
          The root cause is an inconsistency between two slash-stripping implementations:\n\n-
          `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()`
          strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI
          like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all
          `/` \u2192 `../../../../etc/passwd` \u2192 file found via `posixpath.join(dir_,
          u)`\n2. `Template.__init__` strips one `/` \u2192 `/../../../../etc/passwd`
          \u2192 `normpath` \u2192 `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`)
          \u2192 `False` \u2192 **check bypassed**\n\n##### Impact\n\nArbitrary file
          read: any file readable by the process can be returned as rendered template
          content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote:
          this is exploitable at the library API level. HTTP-based exploitation is
          mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash
          prefixes since CPython gh-87389. Applications using other HTTP servers that
          do not normalize paths may be affected.\n\n##### Fix\n\nChanged `Template.__init__`
          to use `lstrip(\"/\")` instead of stripping only a single leading slash,
          so both code paths handle leading slashes consistently.\n\n#### Severity\n-
          CVSS Score: 6.3 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm)\n-
          [https://nvd.nist.gov/vuln/detail/CVE-2026-41205](https://nvd.nist.gov/vuln/detail/CVE-2026-41205)\n-
          [https://github.com/advisories/GHSA-v92g-xgxw-vvmm](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v92g-xgxw-vvmm)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup\n[CVE-2026-44307](https://nvd.nist.gov/vuln/detail/CVE-2026-44307)
          / [GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\n<details>\n<summary>More
          information</summary>\n\n#### Details\n##### Summary\n\nOn Windows, a URI
          using backslash traversal (e.g. `\\..\\..\\ secret.txt`) bypasses the directory
          traversal check in `Template.__init__` and the `posixpath`-based normalization
          in `TemplateLookup.get_template()`, allowing reads of files outside the
          configured template directory.\n\n##### Details\n\nThe root cause is a mismatch
          between `posixpath` (used for URI normalization in `get_template()`) and
          `os.path` (used for file access via `os.path.isfile()` and validation via
          `os.path.normpath()` in `Template.__init__`). On Windows, `os.path` is `ntpath`,
          which treats `\\` as a path separator, while `posixpath` treats it as a
          literal character.\n\nThe vulnerability chain:\n\n1. `get_template()` strips
          only leading `/` via `re.sub(r\"^\\/+\", \"\", uri)` and normalizes with
          `posixpath` \u2014 backslash `\\` is treated as a literal character, so
          `\\..\\ secret.txt` passes through with `..` undetected.\n2. `Template.__init__()`
          validation uses `os.path.normpath()` \u2014 on Windows this resolves `\\..\\
          secret.txt` to `\\secret.txt`, which does not start with `..`, so the `startswith(\"..\")`
          check passes.\n3. `os.path.isfile()` on Windows interprets `\\` as a path
          separator, resolving the `..` traversal and finding files outside the template
          directory.\n\n##### Affected code\n\n- `mako/lookup.py`: `TemplateLookup.get_template()`
          uses `posixpath.normpath`/`posixpath.join` for path construction but `os.path.isfile()`
          for existence check\n- `mako/template.py`: `Template.__init__()` URI validation
          uses `os.path.normpath()` which on Windows resolves backslash traversal
          to a form that passes the `startswith(\"..\")` guard\n\n##### Impact\n\nIf
          an application passes user-controlled template names or include paths to
          `TemplateLookup.get_template()`, an attacker on Windows may be able to load
          and disclose readable files outside the configured template directory. The
          primary impact is local file disclosure. If the targeted file contains Mako/Python
          template syntax, it may also be parsed and executed as a template.\n\n#####
          Remediation\n\nThe fix should normalize backslashes to forward slashes early
          in the URI processing pipeline, before any path operations, to ensure consistent
          behavior across platforms.\n\n#### Severity\n- CVSS Score: 8.7 / 10 (High)\n-
          Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`\n\n####
          References\n- [https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq)\n-
          [https://github.com/sqlalchemy/mako/issues/435](https://redirect.github.com/sqlalchemy/mako/issues/435)\n-
          [https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7](https://redirect.github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7)\n-
          [https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12](https://redirect.github.com/sqlalchemy/mako/releases/tag/rel_1_3_12)\n-
          [https://github.com/advisories/GHSA-2h4p-vjrc-8xpq](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)\n\nThis
          data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2h4p-vjrc-8xpq)
          ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          \"\"\n- Automerge\n  - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**:
          Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B
          **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry
          checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded
          about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want
          to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated
          by [Mend Renovate](https://mend.io/renovate/). View the [repository job
          log](https://developer.mend.io/github/osism/container-images-kolla).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==-->\n"
        change_url: https://github.com/osism/container-images-kolla/pull/717
        commit_id: 4350578f31c35158af4dcd8ae1208959b2e7e95e
        patchset: 4350578f31c35158af4dcd8ae1208959b2e7e95e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
        topic: null
      job: container-images-kolla-patch-2025.1
      jobtags: []
      max_attempts: 3
      message: VXBkYXRlIGRlcGVuZGVuY3kgTWFrbyB0byB2MS4zLjEyIFtTRUNVUklUWV0KClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgQ2hhbmdlIHwgW0FnZV0oaHR0cHM6Ly9kb2NzLnJlbm92YXRlYm90LmNvbS9tZXJnZS1jb25maWRlbmNlLykgfCBbQ29uZmlkZW5jZV0oaHR0cHM6Ly9kb2NzLnJlbm92YXRlYm90LmNvbS9tZXJnZS1jb25maWRlbmNlLykgfAp8LS0tfC0tLXwtLS18LS0tfAp8IFtNYWtvXShodHRwczovL3d3dy5tYWtvdGVtcGxhdGVzLm9yZy8pIChbc291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvKSkgfCBgPT0xLjMuMTBgIOKGkiBgPT0xLjMuMTJgIHwgIVthZ2VdKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vYXBpL21jL2JhZGdlcy9hZ2UvcHlwaS9tYWtvLzEuMy4xMj9zbGltPXRydWUpIHwgIVtjb25maWRlbmNlXShodHRwczovL2RldmVsb3Blci5tZW5kLmlvL2FwaS9tYy9iYWRnZXMvY29uZmlkZW5jZS9weXBpL21ha28vMS4zLjEwLzEuMy4xMj9zbGltPXRydWUpIHwKCi0tLQoKIyMjIE1ha286IFBhdGggdHJhdmVyc2FsIHZpYSBkb3VibGUtc2xhc2ggVVJJIHByZWZpeCBpbiBUZW1wbGF0ZUxvb2t1cApbQ1ZFLTIwMjYtNDEyMDVdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2LTQxMjA1KSAvIFtHSFNBLXY5MmcteGd4dy12dm1tXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLXY5MmcteGd4dy12dm1tKQoKPGRldGFpbHM+CjxzdW1tYXJ5Pk1vcmUgaW5mb3JtYXRpb248L3N1bW1hcnk+CgojIyMjIERldGFpbHMKIyMjIyMgU3VtbWFyeQoKYFRlbXBsYXRlTG9va3VwLmdldF90ZW1wbGF0ZSgpYCBpcyB2dWxuZXJhYmxlIHRvIHBhdGggdHJhdmVyc2FsIHdoZW4gYSBVUkkgc3RhcnRzIHdpdGggYC8vYCAoZS5nLiwgYC8vLi4vLi4vLi4vc2VjcmV0LnR4dGApLiBUaGUgcm9vdCBjYXVzZSBpcyBhbiBpbmNvbnNpc3RlbmN5IGJldHdlZW4gdHdvIHNsYXNoLXN0cmlwcGluZyBpbXBsZW1lbnRhdGlvbnM6CgotIGBUZW1wbGF0ZS5fX2luaXRfX2Agc3RyaXBzICoqb25lKiogbGVhZGluZyBgL2AgdXNpbmcgYGlmYC9zbGljZQotIGBUZW1wbGF0ZUxvb2t1cC5nZXRfdGVtcGxhdGUoKWAgc3RyaXBzICoqYWxsKiogbGVhZGluZyBgL2AgdXNpbmcgYHJlLnN1YihyIl5cLysiLCAiIilgCgpXaGVuIGEgVVJJIGxpa2UgYC8vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZGAgaXMgcGFzc2VkOgoxLiBgZ2V0X3RlbXBsYXRlKClgIHN0cmlwcyBhbGwgYC9gIOKGkiBgLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZGAg4oaSIGZpbGUgZm91bmQgdmlhIGBwb3NpeHBhdGguam9pbihkaXJfLCB1KWAKMi4gYFRlbXBsYXRlLl9faW5pdF9fYCBzdHJpcHMgb25lIGAvYCDihpIgYC8uLi8uLi8uLi8uLi9ldGMvcGFzc3dkYCDihpIgYG5vcm1wYXRoYCDihpIgYC9ldGMvcGFzc3dkYAozLiBgL2V0Yy9wYXNzd2RgLnN0YXJ0c3dpdGgoYC4uYCkg4oaSIGBGYWxzZWAg4oaSICoqY2hlY2sgYnlwYXNzZWQqKgoKIyMjIyMgSW1wYWN0CgpBcmJpdHJhcnkgZmlsZSByZWFkOiBhbnkgZmlsZSByZWFkYWJsZSBieSB0aGUgcHJvY2VzcyBjYW4gYmUgcmV0dXJuZWQgYXMgcmVuZGVyZWQgdGVtcGxhdGUgY29udGVudCB3aGVuIGFuIGFwcGxpY2F0aW9uIHBhc3NlcyB1bnRydXN0ZWQgaW5wdXQgZGlyZWN0bHkgdG8gYFRlbXBsYXRlTG9va3VwLmdldF90ZW1wbGF0ZSgpYC4KCk5vdGU6IHRoaXMgaXMgZXhwbG9pdGFibGUgYXQgdGhlIGxpYnJhcnkgQVBJIGxldmVsLiBIVFRQLWJhc2VkIGV4cGxvaXRhdGlvbiBpcyBtaXRpZ2F0ZWQgYnkgUHl0aG9uJ3MgYEJhc2VIVFRQUmVxdWVzdEhhbmRsZXJgIHdoaWNoIG5vcm1hbGl6ZXMgZG91YmxlLXNsYXNoIHByZWZpeGVzIHNpbmNlIENQeXRob24gZ2gtODczODkuIEFwcGxpY2F0aW9ucyB1c2luZyBvdGhlciBIVFRQIHNlcnZlcnMgdGhhdCBkbyBub3Qgbm9ybWFsaXplIHBhdGhzIG1heSBiZSBhZmZlY3RlZC4KCiMjIyMjIEZpeAoKQ2hhbmdlZCBgVGVtcGxhdGUuX19pbml0X19gIHRvIHVzZSBgbHN0cmlwKCIvIilgIGluc3RlYWQgb2Ygc3RyaXBwaW5nIG9ubHkgYSBzaW5nbGUgbGVhZGluZyBzbGFzaCwgc28gYm90aCBjb2RlIHBhdGhzIGhhbmRsZSBsZWFkaW5nIHNsYXNoZXMgY29uc2lzdGVudGx5LgoKIyMjIyBTZXZlcml0eQotIENWU1MgU2NvcmU6IDYuMyAvIDEwIChNZWRpdW0pCi0gVmVjdG9yIFN0cmluZzogYENWU1M6NC4wL0FWOk4vQUM6TC9BVDpQL1BSOk4vVUk6Ti9WQzpML1ZJOk4vVkE6Ti9TQzpOL1NJOk4vU0E6TmAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS12OTJnLXhneHctdnZtbV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3NxbGFsY2hlbXkvbWFrby9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtdjkyZy14Z3h3LXZ2bW0pCi0gW2h0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2LTQxMjA1XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyNi00MTIwNSkKLSBbaHR0cHM6Ly9naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS12OTJnLXhneHctdnZtbV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS12OTJnLXhneHctdnZtbSkKClRoaXMgZGF0YSBpcyBwcm92aWRlZCBieSB0aGUgW0dpdEh1YiBBZHZpc29yeSBEYXRhYmFzZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS12OTJnLXhneHctdnZtbSkgKFtDQy1CWSA0LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9naXRodWIvYWR2aXNvcnktZGF0YWJhc2UvYmxvYi9tYWluL0xJQ0VOU0UubWQpKS4KPC9kZXRhaWxzPgoKLS0tCgojIyMgTWFrbyB2dWxuZXJhYmxlIHRvIHBhdGggdHJhdmVyc2FsIHZpYSBiYWNrc2xhc2ggVVJJIG9uIFdpbmRvd3MgaW4gVGVtcGxhdGVMb29rdXAKW0NWRS0yMDI2LTQ0MzA3XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyNi00NDMwNykgLyBbR0hTQS0yaDRwLXZqcmMtOHhwcV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS0yaDRwLXZqcmMtOHhwcSkKCjxkZXRhaWxzPgo8c3VtbWFyeT5Nb3JlIGluZm9ybWF0aW9uPC9zdW1tYXJ5PgoKIyMjIyBEZXRhaWxzCiMjIyMjIFN1bW1hcnkKCk9uIFdpbmRvd3MsIGEgVVJJIHVzaW5nIGJhY2tzbGFzaCB0cmF2ZXJzYWwgKGUuZy4gYFwuLlwuLlwgc2VjcmV0LnR4dGApIGJ5cGFzc2VzIHRoZSBkaXJlY3RvcnkgdHJhdmVyc2FsIGNoZWNrIGluIGBUZW1wbGF0ZS5fX2luaXRfX2AgYW5kIHRoZSBgcG9zaXhwYXRoYC1iYXNlZCBub3JtYWxpemF0aW9uIGluIGBUZW1wbGF0ZUxvb2t1cC5nZXRfdGVtcGxhdGUoKWAsIGFsbG93aW5nIHJlYWRzIG9mIGZpbGVzIG91dHNpZGUgdGhlIGNvbmZpZ3VyZWQgdGVtcGxhdGUgZGlyZWN0b3J5LgoKIyMjIyMgRGV0YWlscwoKVGhlIHJvb3QgY2F1c2UgaXMgYSBtaXNtYXRjaCBiZXR3ZWVuIGBwb3NpeHBhdGhgICh1c2VkIGZvciBVUkkgbm9ybWFsaXphdGlvbiBpbiBgZ2V0X3RlbXBsYXRlKClgKSBhbmQgYG9zLnBhdGhgICh1c2VkIGZvciBmaWxlIGFjY2VzcyB2aWEgYG9zLnBhdGguaXNmaWxlKClgIGFuZCB2YWxpZGF0aW9uIHZpYSBgb3MucGF0aC5ub3JtcGF0aCgpYCBpbiBgVGVtcGxhdGUuX19pbml0X19gKS4gT24gV2luZG93cywgYG9zLnBhdGhgIGlzIGBudHBhdGhgLCB3aGljaCB0cmVhdHMgYFxgIGFzIGEgcGF0aCBzZXBhcmF0b3IsIHdoaWxlIGBwb3NpeHBhdGhgIHRyZWF0cyBpdCBhcyBhIGxpdGVyYWwgY2hhcmFjdGVyLgoKVGhlIHZ1bG5lcmFiaWxpdHkgY2hhaW46CgoxLiBgZ2V0X3RlbXBsYXRlKClgIHN0cmlwcyBvbmx5IGxlYWRpbmcgYC9gIHZpYSBgcmUuc3ViKHIiXlwvKyIsICIiLCB1cmkpYCBhbmQgbm9ybWFsaXplcyB3aXRoIGBwb3NpeHBhdGhgIOKAlCBiYWNrc2xhc2ggYFxgIGlzIHRyZWF0ZWQgYXMgYSBsaXRlcmFsIGNoYXJhY3Rlciwgc28gYFwuLlwgc2VjcmV0LnR4dGAgcGFzc2VzIHRocm91Z2ggd2l0aCBgLi5gIHVuZGV0ZWN0ZWQuCjIuIGBUZW1wbGF0ZS5fX2luaXRfXygpYCB2YWxpZGF0aW9uIHVzZXMgYG9zLnBhdGgubm9ybXBhdGgoKWAg4oCUIG9uIFdpbmRvd3MgdGhpcyByZXNvbHZlcyBgXC4uXCBzZWNyZXQudHh0YCB0byBgXHNlY3JldC50eHRgLCB3aGljaCBkb2VzIG5vdCBzdGFydCB3aXRoIGAuLmAsIHNvIHRoZSBgc3RhcnRzd2l0aCgiLi4iKWAgY2hlY2sgcGFzc2VzLgozLiBgb3MucGF0aC5pc2ZpbGUoKWAgb24gV2luZG93cyBpbnRlcnByZXRzIGBcYCBhcyBhIHBhdGggc2VwYXJhdG9yLCByZXNvbHZpbmcgdGhlIGAuLmAgdHJhdmVyc2FsIGFuZCBmaW5kaW5nIGZpbGVzIG91dHNpZGUgdGhlIHRlbXBsYXRlIGRpcmVjdG9yeS4KCiMjIyMjIEFmZmVjdGVkIGNvZGUKCi0gYG1ha28vbG9va3VwLnB5YDogYFRlbXBsYXRlTG9va3VwLmdldF90ZW1wbGF0ZSgpYCB1c2VzIGBwb3NpeHBhdGgubm9ybXBhdGhgL2Bwb3NpeHBhdGguam9pbmAgZm9yIHBhdGggY29uc3RydWN0aW9uIGJ1dCBgb3MucGF0aC5pc2ZpbGUoKWAgZm9yIGV4aXN0ZW5jZSBjaGVjawotIGBtYWtvL3RlbXBsYXRlLnB5YDogYFRlbXBsYXRlLl9faW5pdF9fKClgIFVSSSB2YWxpZGF0aW9uIHVzZXMgYG9zLnBhdGgubm9ybXBhdGgoKWAgd2hpY2ggb24gV2luZG93cyByZXNvbHZlcyBiYWNrc2xhc2ggdHJhdmVyc2FsIHRvIGEgZm9ybSB0aGF0IHBhc3NlcyB0aGUgYHN0YXJ0c3dpdGgoIi4uIilgIGd1YXJkCgojIyMjIyBJbXBhY3QKCklmIGFuIGFwcGxpY2F0aW9uIHBhc3NlcyB1c2VyLWNvbnRyb2xsZWQgdGVtcGxhdGUgbmFtZXMgb3IgaW5jbHVkZSBwYXRocyB0byBgVGVtcGxhdGVMb29rdXAuZ2V0X3RlbXBsYXRlKClgLCBhbiBhdHRhY2tlciBvbiBXaW5kb3dzIG1heSBiZSBhYmxlIHRvIGxvYWQgYW5kIGRpc2Nsb3NlIHJlYWRhYmxlIGZpbGVzIG91dHNpZGUgdGhlIGNvbmZpZ3VyZWQgdGVtcGxhdGUgZGlyZWN0b3J5LiBUaGUgcHJpbWFyeSBpbXBhY3QgaXMgbG9jYWwgZmlsZSBkaXNjbG9zdXJlLiBJZiB0aGUgdGFyZ2V0ZWQgZmlsZSBjb250YWlucyBNYWtvL1B5dGhvbiB0ZW1wbGF0ZSBzeW50YXgsIGl0IG1heSBhbHNvIGJlIHBhcnNlZCBhbmQgZXhlY3V0ZWQgYXMgYSB0ZW1wbGF0ZS4KCiMjIyMjIFJlbWVkaWF0aW9uCgpUaGUgZml4IHNob3VsZCBub3JtYWxpemUgYmFja3NsYXNoZXMgdG8gZm9yd2FyZCBzbGFzaGVzIGVhcmx5IGluIHRoZSBVUkkgcHJvY2Vzc2luZyBwaXBlbGluZSwgYmVmb3JlIGFueSBwYXRoIG9wZXJhdGlvbnMsIHRvIGVuc3VyZSBjb25zaXN0ZW50IGJlaGF2aW9yIGFjcm9zcyBwbGF0Zm9ybXMuCgojIyMjIFNldmVyaXR5Ci0gQ1ZTUyBTY29yZTogOC43IC8gMTAgKEhpZ2gpCi0gVmVjdG9yIFN0cmluZzogYENWU1M6NC4wL0FWOk4vQUM6TC9BVDpOL1BSOk4vVUk6Ti9WQzpIL1ZJOk4vVkE6Ti9TQzpOL1NJOk4vU0E6TmAKCiMjIyMgUmVmZXJlbmNlcwotIFtodHRwczovL2dpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS0yaDRwLXZqcmMtOHhwcV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3NxbGFsY2hlbXkvbWFrby9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtMmg0cC12anJjLTh4cHEpCi0gW2h0dHBzOi8vZ2l0aHViLmNvbS9zcWxhbGNoZW15L21ha28vaXNzdWVzLzQzNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3NxbGFsY2hlbXkvbWFrby9pc3N1ZXMvNDM1KQotIFtodHRwczovL2dpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvL2NvbW1pdC83MmUxMGM1NzNjYTBmYmNiZGRkNDQ1NWFiY2E4Y2U5MmE2MTc4MGQ3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvL2NvbW1pdC83MmUxMGM1NzNjYTBmYmNiZGRkNDQ1NWFiY2E4Y2U5MmE2MTc4MGQ3KQotIFtodHRwczovL2dpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvL3JlbGVhc2VzL3RhZy9yZWxfMV8zXzEyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vc3FsYWxjaGVteS9tYWtvL3JlbGVhc2VzL3RhZy9yZWxfMV8zXzEyKQotIFtodHRwczovL2dpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLTJoNHAtdmpyYy04eHBxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLTJoNHAtdmpyYy04eHBxKQoKVGhpcyBkYXRhIGlzIHByb3ZpZGVkIGJ5IHRoZSBbR2l0SHViIEFkdmlzb3J5IERhdGFiYXNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLTJoNHAtdmpyYy04eHBxKSAoW0NDLUJZIDQuMF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2dpdGh1Yi9hZHZpc29yeS1kYXRhYmFzZS9ibG9iL21haW4vTElDRU5TRS5tZCkpLgo8L2RldGFpbHM+CgotLS0KCiMjIyBDb25maWd1cmF0aW9uCgrwn5OFICoqU2NoZWR1bGUqKjogKFVUQykKCi0gQnJhbmNoIGNyZWF0aW9uCiAgLSAiIgotIEF1dG9tZXJnZQogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCgrwn5qmICoqQXV0b21lcmdlKio6IERpc2FibGVkIGJ5IGNvbmZpZy4gUGxlYXNlIG1lcmdlIHRoaXMgbWFudWFsbHkgb25jZSB5b3UgYXJlIHNhdGlzZmllZC4KCuKZuyAqKlJlYmFzaW5nKio6IFdoZW5ldmVyIFBSIGJlY29tZXMgY29uZmxpY3RlZCwgb3IgeW91IHRpY2sgdGhlIHJlYmFzZS9yZXRyeSBjaGVja2JveC4KCvCflJUgKipJZ25vcmUqKjogQ2xvc2UgdGhpcyBQUiBhbmQgeW91IHdvbid0IGJlIHJlbWluZGVkIGFib3V0IHRoaXMgdXBkYXRlIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL29zaXNtL2NvbnRhaW5lci1pbWFnZXMta29sbGEpLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUkwTXk0eE1qTXVPQ0lzSW5Wd1pHRjBaV1JKYmxabGNpSTZJalF6TGpFMU9TNHlJaXdpZEdGeVoyVjBRbkpoYm1Ob0lqb2liV0ZwYmlJc0lteGhZbVZzY3lJNld5SnlaVzV2ZG1GMFpTSmRmUT09LS0+Cg==
      patchset: 4350578f31c35158af4dcd8ae1208959b2e7e95e
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 58f24f5b479e15eb2d520850d27e3b1b6fc66aa6
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 9f81d10d2ad8048ca14142fe6063afb5d3bd998b
          untrusted/project_0/github.com/osism/container-images-kolla:
            canonical_name: github.com/osism/container-images-kolla
            checkout: main
            commit: bb4d8ad9bdc18efda0aa2f158ea38bd48d503294
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 58f24f5b479e15eb2d520850d27e3b1b6fc66aa6
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 9f81d10d2ad8048ca14142fe6063afb5d3bd998b
        playbooks:
        - path: untrusted/project_0/github.com/osism/container-images-kolla/playbooks/patch.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images-kolla
        name: osism/container-images-kolla
        short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
      projects:
        github.com/osism/container-images-kolla:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          checkout: main
          checkout_description: zuul branch
          commit: bb4d8ad9bdc18efda0aa2f158ea38bd48d503294
          name: osism/container-images-kolla
          required: false
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
      ref: refs/pull/717/head
      resources: {}
      tenant: osism
      timeout: 10800
      topic: null
      voting: true
