)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"892f148a0457b415882d6bd34c2736751f0675d9","unresolved":false,"context_lines":[{"line_number":12,"context_line":"The sha-1 hash was added to the existing blacklist check B303 which"},{"line_number":13,"context_line":"currently checks for MD5 and variants."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[1]: https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: I411d8d4aeb4d740635c60b559ecda72ab951b629"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"da36d5c6_2689ea75","line":15,"range":{"start_line":15,"start_character":5,"end_line":15,"end_character":81},"updated":"2017-02-23 20:07:38.000000000","message":"interesting!","commit_id":"c9f16361d8d6ef8f5d187d17f04d06faccf7a527"}],"bandit/blacklists/calls.py":[{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"4638442842059c3d35af0fee535e79f734043757","unresolved":false,"context_lines":[{"line_number":323,"context_line":"    sets.append(utils.build_conf_dict("},{"line_number":324,"context_line":"        \u0027md5\u0027, \u0027B303\u0027,"},{"line_number":325,"context_line":"        [\u0027hashlib.md5\u0027,"},{"line_number":326,"context_line":"         \u0027hashlib.sha1\u0027,"},{"line_number":327,"context_line":"         \u0027Crypto.Hash.MD2.new\u0027,"},{"line_number":328,"context_line":"         \u0027Crypto.Hash.MD4.new\u0027,"},{"line_number":329,"context_line":"         \u0027Crypto.Hash.MD5.new\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"1f1a1f67_746162a9","line":326,"range":{"start_line":326,"start_character":10,"end_line":326,"end_character":24},"updated":"2017-07-14 16:03:31.000000000","message":"Not sure why, but this line is making `integration-test.sh openstack python-keystoneclient` fail. If I comment out 326 the tests pass.","commit_id":"35e35446b00bceea5bebf028567e4f99bd29dc98"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"0ab09a3e2a1666f4c197b45a34b99538c4ed0011","unresolved":false,"context_lines":[{"line_number":323,"context_line":"    sets.append(utils.build_conf_dict("},{"line_number":324,"context_line":"        \u0027md5\u0027, \u0027B303\u0027,"},{"line_number":325,"context_line":"        [\u0027hashlib.md5\u0027,"},{"line_number":326,"context_line":"         \u0027hashlib.sha1\u0027,"},{"line_number":327,"context_line":"         \u0027Crypto.Hash.MD2.new\u0027,"},{"line_number":328,"context_line":"         \u0027Crypto.Hash.MD4.new\u0027,"},{"line_number":329,"context_line":"         \u0027Crypto.Hash.MD5.new\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"1f1a1f67_2dcb981e","line":326,"range":{"start_line":326,"start_character":10,"end_line":326,"end_character":24},"in_reply_to":"1f1a1f67_746162a9","updated":"2017-07-14 21:02:07.000000000","message":"keystoneclient uses SHA-1 still, but it uses HMAC-SHA1. Bandit still catches the SHA1 usage and that is why this fails.\n\nhttps://review.openstack.org/#/c/453365/","commit_id":"35e35446b00bceea5bebf028567e4f99bd29dc98"}]}