Hi, tl;dr if you rely on package reviews for your development process in OBS make sure requests have a revision. Only osc shows the information you are looking for. Turns out submit request in OBS do not necessarily refer to a specific revision in the originating package. Means the sources can change after a review passed. Unfortunately changing the sources does not reset reviews and reviews do not record the revision they were done for. That obviously defeats the purpose of source reviews. Accepting a request without revision may therefore lead to accepting something different from what was reviewed (resp staged). AFAIK this feature has been in OBS since the very beginning, it's just well hidden as the official interfaces osc and the webui do add a revision when creating requests. There is no way to turn that off either. Also tools such as bots that use osc as python module automatically generate submit request with revision. This is not because the server enforces it but because the client code does it. So anyone who wants to fool reviewers just has to use a custom client. According to the OBS team this hidden behavior is actually considered a feature. The security team doesn't treat it as security issue as it's kind of documented¹, even though osc doesn't behave in the documented way. There are plans to add a special attribute to disallow unversioned requests per project². IMHO a global setting to require revisions by default with the option for exceptions would have been more sensible. Anyway, apparently the fix needs some time to ripe still. Meanwhile the factory-auto bot was enhanced to decline unversioned requests to Factory (thanks Fabian). If you are using reviews in eg your devel project or run your own OBS you need to create your own bot or watch out manually. The webui does not seem to display any revision at all, so not helpful. In osc it looks like this: Request: #12345 submit: foo:bar/baz@42 -> blah Absence of the @number means no revision. cu Ludwig [1] https://openbuildservice.org/help/manuals/obs-user-guide/cha.obs.request_and... [2] https://github.com/openSUSE/open-build-service/pull/10992 -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer HRB 36809 (AG Nürnberg)