Hi Ben, Does this make sense? Lot of people (outside of redhat) are using API keys just for abrt, so when something crashes they can report bug to bugzilla. I report about 1-2 bugs /year, and it would be inconvenient for me for every bugreport to regenerate/reactivate API keys. I would do it, but I can imagine lot of people would not do it and you'll get fewer bug reports, or at least fewer bug reports with proper backtrace and stuff. On 2/22/23 16:46, Ben Cotton wrote: -- Kind regards, b.

To make things slightly worse, it looks like an API key that is manually “un-revoked” will be revoked again the next day if it is not also *actually used*. So the 30 days are evaluated every day based on time since the last API call, and “un-revoking” the key does not count as using it. On Wed, Feb 22, 2023, at 10:56 AM, Ben Beasley wrote: > Am I missing something, or does this basically break ABRT for users, > since that has required an API key rather than a username and password > for some time, and it’s not usual to report bugs with ABRT even as > often as once a month? It doesn’t seem reasonable to have to go > manually reset an API key every time I want to report a bug, and I’m > concerned that this will reduce the number of useful crash reports we > get. > > On Wed, Feb 22, 2023, at 10:46 AM, Ben Cotton wrote: >> If you did not see the bugzilla-announce-list post[1], there are new >> requirements for API keys in Red Hat Bugzilla: >> >> Red Hat Bugzilla has introduced a 12 month lifetimes for API keys. You >> must replace your API keys at least once a year. Additionally, any API >> key that is not used for 30 days will be suspended but can be >> re-enabled on the account's preferences tab. >> >> All existing API keys have had their creation date set to 2023-02-19. >> For more details, see the announcement[1]. >> >> [1] >> https://listman.redhat.com/archives/bugzilla-announce-list/2023-February/... >> >> -- >> Ben Cotton >> He / Him / His >> Fedora Program Manager >> Red Hat >> TZ=America/Indiana/Indianapolis >> _______________________________________________ >> devel-announce mailing list -- devel-announce(a)lists.fedoraproject.org >> To unsubscribe send an email to >> devel-announce-leave(a)lists.fedoraproject.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedora... >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue >> _______________________________________________ >> devel mailing list -- devel(a)lists.fedoraproject.org >> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue > _______________________________________________ > devel mailing list -- devel(a)lists.fedoraproject.org > To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue

Yes, as I understand it, this will make abrt difficult to use. Historically, we get about 2500 bug reports via abrt per release. That's roughly a quarter of reports per release on average. On the other hand, we're not particularly good at fixing abrt-reported bugs. Here's the resolution (excluding duplicates) of abrt-reported bugs for F19–34: EOL 32675 ERRATA 3565 INSUFFICIENT_DATA 2965 CURRENTRELEASE 1162 NOTABUG 983 UPSTREAM 823 WORKSFORME 680 WONTFIX 529 CANTFIX 461 NEXTRELEASE 423 RAWHIDE 199 That's a ~73% EOL closure rate, compared to roughly 50% for all bugs. Depending on which resolutions you include as "fixed", we fix roughly 14% of abrt-reported bugs. I just found out about this change yesterday. I suspect it's a security-driven requirement, so I don't know how much room there will be for changes. I'll pass this on to the Bugzilla team and see what they say. -- Ben Cotton He / Him / His Fedora Program Manager Red Hat TZ=America/Indiana/Indianapolis

On 22. 02. 23 17:27, Ben Cotton wrote: I suspect the same. Maybe accounts without additional Bugzilla rights/groups might be exempted from this policy? -- Miro Hrončok -- Phone: +420777974800 IRC: mhroncok

I think this should be sufficient (according original e-mail): ``` curl "https://bugzilla.redhat.com//rest/user/1?exclude_fields=name" -H "Authorization: Bearer YOUR_API_KEY" ``` But do you really want to ask users to put this to their cron? On 2/22/23 18:05, Fabio Valentini wrote: > Does anybody here know the BugZilla Python API? > /me wonders how hard it would be to write a script that posts bogus "I > am still using the API token" requests to RHBZ, and to run that with a > cron job twice a month ... >