)]}'
{"README.md":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"642c699b29255a9c276eca240d809c8f3dcb1573","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Usual CA behaviour is to generate and assign long-term certificates, typically"},{"line_number":12,"context_line":"valid for months, or years. This results in a few issues. The most important is"},{"line_number":13,"context_line":"that in case of compromise clients need to know the old certificate is invalid,"},{"line_number":14,"context_line":"but CSRs are almost never used. Anchor uses a different approach, where"},{"line_number":15,"context_line":"certificates are constantly rotated - typical grant time is expected to be for"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_a2bbc174","line":12,"updated":"2015-06-22 09:11:27.000000000","message":"months isn\u0027t typical, one-two years is :)","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Usual CA behaviour is to generate and assign long-term certificates, typically"},{"line_number":12,"context_line":"valid for months, or years. This results in a few issues. The most important is"},{"line_number":13,"context_line":"that in case of compromise clients need to know the old certificate is invalid,"},{"line_number":14,"context_line":"but CSRs are almost never used. Anchor uses a different approach, where"},{"line_number":15,"context_line":"certificates are constantly rotated - typical grant time is expected to be for"},{"line_number":16,"context_line":"24 hour period. This means a completely automated rotation can be achieved each"},{"line_number":17,"context_line":"day."}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_1daf72e4","line":14,"updated":"2015-06-22 09:18:07.000000000","message":"CRLs ?","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"642c699b29255a9c276eca240d809c8f3dcb1573","unresolved":false,"context_lines":[{"line_number":14,"context_line":"but CSRs are almost never used. Anchor uses a different approach, where"},{"line_number":15,"context_line":"certificates are constantly rotated - typical grant time is expected to be for"},{"line_number":16,"context_line":"24 hour period. This means a completely automated rotation can be achieved each"},{"line_number":17,"context_line":"day."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"The benefits of using Anchor instead of manual long-term certificates are:"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_9de86218","line":17,"updated":"2015-06-22 09:11:27.000000000","message":"First half of this is a bit clunky. In one place you mention CSRs where I think you mean CRLs. Here\u0027s some words that might help.\n\nA critical capability within PKI is to revoke a certificate - to ensure that it is no longer trusted by any peer. Unfortunately research has demonstrated that the two typical methods of revocation (Certificate Revocation Lists and Online Certificate Status Protocol) both have failings that make them unreliable, especially when attempting to leverage PKI outside of web-browser software. \n\nThrough the use of short-lifetime certificates Anchor introduces the concept of \"passive revocation\". By issuing certificates with lifetimes measured in hours, revocation can be achieved by simply not re-issuing certificates to clients.","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":58,"context_line":"Running the service"},{"line_number":59,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"In order to run the service, it needs to be started via `pecan` application"},{"line_number":62,"context_line":"server. The only extra parameter is a config file:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    pecan serve config.py"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_3dda7679","line":61,"updated":"2015-06-22 09:18:07.000000000","message":".. via the `pecan` ..","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":102,"context_line":"Anchor shouldn\u0027t be exposed directly to the network. It\u0027s running via an"},{"line_number":103,"context_line":"application server (Pecan) and doesn\u0027t have all the features you\u0027d normally"},{"line_number":104,"context_line":"expect from a http proxy - for example dealing well with deliberately slow"},{"line_number":105,"context_line":"connections, or using multiple workers. Anchor can be however run in production"},{"line_number":106,"context_line":"using a better frontend."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"To run Anchor using uwsgi you can use the following command:"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_9d5dc2ee","line":105,"updated":"2015-06-22 09:18:07.000000000","message":".. can however be run ... reads better to me","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":128,"context_line":"requests match a given set of rules. They\u0027re configured in `config.json` and"},{"line_number":129,"context_line":"the sample configuration includes a few of them."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Each validator takes dictionary of options which provide the specific matching"},{"line_number":132,"context_line":"conditions."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Currenly available validators are:"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_1df9b2c8","line":131,"updated":"2015-06-22 09:18:07.000000000","message":".. a dictionary ..","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":139,"context_line":"* `alternative_names` ensures alternative names match one of the names in"},{"line_number":140,"context_line":"  `allowed_domains`"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"* `alternative_names_ip` ensures alternative names match one of the names in"},{"line_number":143,"context_line":"  `allowed_domains` or ranges in `allowed_networks`"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* `server_group` ensures the group the requester belongs to one of"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_3d1d960f","line":142,"updated":"2015-06-22 09:18:07.000000000","message":"s/names/IPs/","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"28fb308c6747da00a93083e8c2ba6acfbb95f58b","unresolved":false,"context_lines":[{"line_number":139,"context_line":"* `alternative_names` ensures alternative names match one of the names in"},{"line_number":140,"context_line":"  `allowed_domains`"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"* `alternative_names_ip` ensures alternative names match one of the names in"},{"line_number":143,"context_line":"  `allowed_domains` or ranges in `allowed_networks`"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* `server_group` ensures the group the requester belongs to one of"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_10917099","line":142,"in_reply_to":"fa32b979_3d1d960f","updated":"2015-06-22 23:34:11.000000000","message":"No, this is correct. It matches either names or IPs. I changed it to say \"IP ranges\" below to clarify","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":142,"context_line":"* `alternative_names_ip` ensures alternative names match one of the names in"},{"line_number":143,"context_line":"  `allowed_domains` or ranges in `allowed_networks`"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* `server_group` ensures the group the requester belongs to one of"},{"line_number":146,"context_line":"  `group_prefixes`"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"* `extensions` ensures only `allowed_extensions` are present in the request"}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_9da062a7","line":145,"updated":"2015-06-22 09:18:07.000000000","message":"s/one of `group_prefixes`/is contained within `group_prefixes`/","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* `source_cidrs` ensures the request comes from one of the ranges in `cidrs`"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"A configuration entry for a validator looks like this one from sample config:"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"    \"key_usage\": {"},{"line_number":159,"context_line":"      \"allowed_usage\": ["}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_3da03690","line":156,"updated":"2015-06-22 09:18:07.000000000","message":"A configuration entry for a validator might look like this one from the sample config","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"c4a4ea10994e8dab9b42196281d050fd15cd3d11","unresolved":false,"context_lines":[{"line_number":166,"context_line":"Authentication"},{"line_number":167,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"Anchor can use following authentication modules: static, keystone, ldap."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Static: Username and password are present in `config.json`. This mode should be"},{"line_number":172,"context_line":"used only for development and testing."}],"source_content_type":"text/x-gfm","patch_set":1,"id":"fa32b979_3dc7d646","line":169,"updated":"2015-06-22 09:18:07.000000000","message":".. use one of the following ..","commit_id":"b05f3a44fd4feb34b91a7046a326f4314932d6b4"}]}