openstack/keystone — Week of 2026-10-24

EC2 credential hardening. The dominant work this week closes a trust-impersonation hole in the EC2 credentials path: clients can no longer forge a trust_id in signed requests, with the fix landing on master and backported across four stable branches (1009275 and siblings). Alongside it, _check_timestamp now requires a timestamp to be present rather than treating absence as valid, tightening signature replay protection on the same subsystem.

API correctness. Several schema and response-code bugs were corrected on the HTTP surface. Renaming a project to a name that already exists now returns 409 instead of a generic error. Federation protocol PATCH no longer insists on mapping_id being supplied, and the IdP remote_ids JSON schema maxLength was aligned to the SQL column (landed on two branches). Domain-targeted role grants now enforce domain scope, the domain schema accepts additional properties, and a stray leading space was stripped from a user policy operation path.

Maintenance. Python 3.14 support was declared and some dead compatibility logic for older interpreters removed; pre-commit switched to running bandit via ruff, a catalog schema typo was fixed, and translations were resynced from Zanata.