)]}'
{"specs/mitaka/restore-secrets.rst":[{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Barbican can use soft-deletions in the database. This means that the"},{"line_number":19,"context_line":"entry is marked for deletion but not removed."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A user may accidently delete a secret that contains their encryption key. They"},{"line_number":22,"context_line":"would not be able to recover an encrypted volume."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_8fd0b920","line":19,"updated":"2016-02-01 14:41:46.000000000","message":"This means that the entry is marked  for deletion \"and hidden from the user\" but not removed.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Barbican can use soft-deletions in the database. This means that the"},{"line_number":19,"context_line":"entry is marked for deletion but not removed."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A user may accidently delete a secret that contains their encryption key. They"},{"line_number":22,"context_line":"would not be able to recover an encrypted volume."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_efadad9b","line":21,"updated":"2016-02-01 14:41:46.000000000","message":"If they do so, they will not be able to recover the item they have encrypted.(encrypted volume, encrypted object, etc.)","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"1. Add a REST API call (HTTP PATCH verb) for undeleting a secret and"},{"line_number":42,"context_line":"   make this command available in the barbican-client. This would let"},{"line_number":43,"context_line":"   the user to be able to undelete their accidents themselves."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_0f912947","line":41,"updated":"2016-02-01 14:41:46.000000000","message":"I don\u0027t think users should be able to do this. Better for operations or support. I like the barbican-manage command better, the good thing about this alternative is that the keystone user can be logged.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Data model impact"},{"line_number":47,"context_line":"-----------------"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"This script affects the secret model since it looks for secrets where"},{"line_number":50,"context_line":"\u0027deleted \u003d\u003d 1\u0027."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_6f71bd43","line":49,"updated":"2016-02-01 14:41:46.000000000","message":"What is the actual impact?","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Security impact"},{"line_number":60,"context_line":"---------------"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"The script should have valid barbican admin user"},{"line_number":63,"context_line":"permissions. No global user should be able to modify/run the script."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_afa25597","line":62,"updated":"2016-02-01 14:41:46.000000000","message":"System User?","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"45ff06de5765748c44d02240e682919d752891f3","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"A log should be kept that contains the information for which secret was"},{"line_number":70,"context_line":"undeleted. This information includes uuid of the secret, date when deleted,"},{"line_number":71,"context_line":"date when restored, and ID of who deleted the secret."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Python and Command Line Client Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_1299ed1f","line":71,"updated":"2016-01-15 23:20:57.000000000","message":"and ID of who restored the secret.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"b917acfa257ca2867a75670f7ae922b3c4c73247","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"A log should be kept that contains the information for which secret was"},{"line_number":70,"context_line":"undeleted. This information includes uuid of the secret, date when deleted,"},{"line_number":71,"context_line":"date when restored, and ID of who deleted the secret."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Python and Command Line Client Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a5ae5dd_7ddd7b13","line":71,"in_reply_to":"7a5de9d1_6fa8dd77","updated":"2016-02-03 14:54:20.000000000","message":"I think that it wouldn\u0027t be worth it as the system user could be a shared account such as the root user or some user account with admin privileges.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"A log should be kept that contains the information for which secret was"},{"line_number":70,"context_line":"undeleted. This information includes uuid of the secret, date when deleted,"},{"line_number":71,"context_line":"date when restored, and ID of who deleted the secret."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Python and Command Line Client Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_6fa8dd77","line":71,"in_reply_to":"ba63e191_50edd923","updated":"2016-02-01 14:41:46.000000000","message":"Maybe just store the system user name as well.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"92dff76e537c2ad8452c083a2cc51928c4236508","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"A log should be kept that contains the information for which secret was"},{"line_number":70,"context_line":"undeleted. This information includes uuid of the secret, date when deleted,"},{"line_number":71,"context_line":"date when restored, and ID of who deleted the secret."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Python and Command Line Client Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba63e191_50edd923","line":71,"in_reply_to":"da6ed579_1299ed1f","updated":"2016-01-19 19:09:51.000000000","message":"The barbican admin, or deployer who will have access to the barbican command is a system user so there is no keystone user ID that will be stored.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"05d0cab79cf3564d8752fa4a56e38054875a1bd4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"---------------------"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"User will have to go to the barbican operator and ask to have their"},{"line_number":84,"context_line":"secret undeleted."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a5de9d1_2fbd05b7","line":84,"updated":"2016-02-01 14:41:46.000000000","message":"restored.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"45ff06de5765748c44d02240e682919d752891f3","unresolved":false,"context_lines":[{"line_number":138,"context_line":"Documentation Impact"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Documentation on usage of the undelete script will be created. This feature"},{"line_number":142,"context_line":"should be used when soft-deletion is enabled."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_d2159549","line":141,"updated":"2016-01-15 23:20:57.000000000","message":"this document should be in Operation Guide","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"92dff76e537c2ad8452c083a2cc51928c4236508","unresolved":false,"context_lines":[{"line_number":138,"context_line":"Documentation Impact"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Documentation on usage of the undelete script will be created. This feature"},{"line_number":142,"context_line":"should be used when soft-deletion is enabled."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba63e191_10ce81b4","line":141,"in_reply_to":"da6ed579_d2159549","updated":"2016-01-19 19:09:51.000000000","message":"A wiki for database management will be made for the blue print that implements soft deletion clean up. The documentation for the undelete will go there.","commit_id":"8089e9017184355c50c35e29eb91f583f5d0f321"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"1f182cbbfb4b73216f9a43fd5b55315efdd8d852","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Barbican can use soft-deletions in the database. This means that the"},{"line_number":19,"context_line":"entry is marked for deletion and hidden from the user but not removed."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A user may accidently delete a secret that contains their encryption key. They"},{"line_number":22,"context_line":"would not be able to recover an item that they have encrypted (encrypted"},{"line_number":23,"context_line":"volume, encrypted object, etc.)."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a57f1b5_340787cb","line":23,"range":{"start_line":21,"start_character":74,"end_line":23,"end_character":32},"updated":"2016-02-12 15:49:05.000000000","message":"In that case, user will lost access to any data encrypted by deleted key ( for example, encrypted volume, encrypted object etc).\n\nThis blueprint provides barbican admin a way of recovering deleted secret when user call barbican operator\u0027s help desk.","commit_id":"49371f7d443b65a674ee3ac016aa8b9db787db12"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"1356c0dde98df2bf6feb8c1fb9030d3ed74dceb6","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Example:"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"barbican-db-manage restore --secret-id \u003csoft deleted secret_id\u003e"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"},{"line_number":40,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_c7970c39","line":37,"updated":"2016-02-09 06:04:05.000000000","message":"If the secret was hard-deleted what type of error would be returned? 404?","commit_id":"49371f7d443b65a674ee3ac016aa8b9db787db12"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"1356c0dde98df2bf6feb8c1fb9030d3ed74dceb6","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"There are no changes to the data model."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"This script looks for secrets where \u0027deleted \u003d\u003d 1\u0027 and changes"},{"line_number":55,"context_line":"it to deleted."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a5ae5dd_67a9787b","line":54,"updated":"2016-02-09 06:04:05.000000000","message":"Add information on how children are affected.","commit_id":"49371f7d443b65a674ee3ac016aa8b9db787db12"}]}