Comment 39 for bug 1872735

Revision history for this message
Colleen Murphy (krinkle) wrote : Re: EC2 and/or credential endpoints are not protected from a scoped context

I'd like to propose squashing the patches for this and the other currently-private EC2 bugs reported by kay into one patch, with the fix for the OAuth1 bug 1873290 kept as its own patch that will only affect the token model code and not the EC2 credential code. This cuts the number of patches needed from 4 per branch down to 2, so with 4 branches the total number is cut from 16 to 8. This eliminates the merge conflicts, will make it easier for stakeholders to patch their packages and deployments and will make the public review and backporting process in gerrit much smoother. I've reworked the patches for master in my development environment and am currently validating them, and if the VMT is okay with this approach I will do the same for ussuri, train, and stein and attach them to the relevant bugs.

If, on the other hand, it is too late to do this reorganization since the embargo notification has already been sent, I will instead just update the patches to resolve the merge conflict with the now-landed https://review.opendev.org/724124.