)]}'
{"barbican/plugin/kmip_secret_store.py":[{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"7767967548ad28e18e1c1c90f2e422eb20846661","unresolved":false,"context_lines":[{"line_number":36,"context_line":"from oslo.config import cfg"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"CONF \u003d cfg.CONF"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"kmip_opt_group \u003d cfg.OptGroup(name\u003d\u0027kmip_plugin\u0027, title\u003d\u0027KMIP Plugin\u0027)"},{"line_number":41,"context_line":"kmip_opts \u003d ["},{"line_number":42,"context_line":"    cfg.StrOpt(\u0027username\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_8f872cd7","line":39,"updated":"2014-11-18 22:09:09.000000000","message":"I think we have to be little precise here. These config are for KMIP HSM host.\nIMO it is better to name the group \"kmip host\"\n\nthoughts?","commit_id":"bcb1905a2b0b870a79aceee9abb0b2940827d8c7"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"6921653e648d052e903a8ca8063a1e04df1799b4","unresolved":false,"context_lines":[{"line_number":36,"context_line":"from oslo.config import cfg"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"CONF \u003d cfg.CONF"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"kmip_opt_group \u003d cfg.OptGroup(name\u003d\u0027kmip_plugin\u0027, title\u003d\u0027KMIP Plugin\u0027)"},{"line_number":41,"context_line":"kmip_opts \u003d ["},{"line_number":42,"context_line":"    cfg.StrOpt(\u0027username\u0027,"}],"source_content_type":"text/x-python","patch_set":2,"id":"5a890539_c972feac","line":39,"in_reply_to":"5a890539_8f872cd7","updated":"2014-11-19 11:47:12.000000000","message":"Humm, well this option set holds everything to do with this plugin, this could eventually be more than just connection and auth info. Calling it \"kmip host\" is probably a little too specific. I agree that \"kmip plugin\" is quite nonedescript, though it follows the pattern i.e. the dog tag one is just \"dogtag_plugin\"","commit_id":"bcb1905a2b0b870a79aceee9abb0b2940827d8c7"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"580e8c2813f9d38a98ec8f9413164938c595ec7e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"               help\u003du._(\u0027File path to concatenated \"certification authority\" \u0027"},{"line_number":67,"context_line":"                        \u0027certificates\u0027),"},{"line_number":68,"context_line":"               ),"},{"line_number":69,"context_line":"    cfg.StrOpt(\u0027cert_file\u0027,"},{"line_number":70,"context_line":"               default\u003dNone,"},{"line_number":71,"context_line":"               help\u003du._(\u0027File path to local client certificate\u0027),"},{"line_number":72,"context_line":"               ),"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_f56115d4","line":69,"updated":"2014-11-20 18:31:42.000000000","message":"Can these be renamed to \u0027certfile\u0027 and \u0027keyfile\u0027 to line up with the PyKMIP names?","commit_id":"3c0002d0500839d6945302a9e6285f0ddaae77d2"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"4a4c888269b6de136992f32f7b9a286e4122ed4d","unresolved":false,"context_lines":[{"line_number":66,"context_line":"               help\u003du._(\u0027File path to concatenated \"certification authority\" \u0027"},{"line_number":67,"context_line":"                        \u0027certificates\u0027),"},{"line_number":68,"context_line":"               ),"},{"line_number":69,"context_line":"    cfg.StrOpt(\u0027cert_file\u0027,"},{"line_number":70,"context_line":"               default\u003dNone,"},{"line_number":71,"context_line":"               help\u003du._(\u0027File path to local client certificate\u0027),"},{"line_number":72,"context_line":"               ),"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_906b36b8","line":69,"in_reply_to":"5a890539_f56115d4","updated":"2014-11-24 11:14:04.000000000","message":"Seems reasonable.","commit_id":"3c0002d0500839d6945302a9e6285f0ddaae77d2"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"556ded5bd69b703d4685a4595dee64a89d8c8597","unresolved":false,"context_lines":[{"line_number":103,"context_line":"            ss.KeyAlgorithm.DES: {"},{"line_number":104,"context_line":"                KMIPSecretStore.VALID_BIT_LENGTHS: [56],"},{"line_number":105,"context_line":"                KMIPSecretStore.KMIP_ALGORITHM_ENUM:"},{"line_number":106,"context_line":"                enums.CryptographicAlgorithm.DES},"},{"line_number":107,"context_line":"            ss.KeyAlgorithm.DESEDE: {"},{"line_number":108,"context_line":"                KMIPSecretStore.VALID_BIT_LENGTHS:"},{"line_number":109,"context_line":"                [56, 64, 112, 128, 168, 192],"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_1135e7da","line":106,"updated":"2014-11-20 11:34:44.000000000","message":"WTF, DES?","commit_id":"3c0002d0500839d6945302a9e6285f0ddaae77d2"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"556ded5bd69b703d4685a4595dee64a89d8c8597","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        if conf.kmip_plugin.ca_certs is not None:"},{"line_number":115,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.ca_certs)"},{"line_number":116,"context_line":"        if conf.kmip_plugin.cert_file is not None:"},{"line_number":117,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.cert_file)"},{"line_number":118,"context_line":"        if conf.kmip_plugin.key_file is not None:"},{"line_number":119,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.key_file)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_d15a7f29","line":117,"updated":"2014-11-20 11:34:44.000000000","message":"The client certificate doesn\u0027t need to have 0600 permissions","commit_id":"3c0002d0500839d6945302a9e6285f0ddaae77d2"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"443f09e10f9e3603e76b5cbb71a7803f4a84c9fd","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        if conf.kmip_plugin.ca_certs is not None:"},{"line_number":115,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.ca_certs)"},{"line_number":116,"context_line":"        if conf.kmip_plugin.cert_file is not None:"},{"line_number":117,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.cert_file)"},{"line_number":118,"context_line":"        if conf.kmip_plugin.key_file is not None:"},{"line_number":119,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.key_file)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_fcc2e751","line":117,"in_reply_to":"5a890539_d15a7f29","updated":"2014-11-20 15:27:34.000000000","message":"As long as the permissions allow Barbican to read the cert. Otherwise OpenSSL will fail to load it.","commit_id":"3c0002d0500839d6945302a9e6285f0ddaae77d2"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"4a4c888269b6de136992f32f7b9a286e4122ed4d","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        if conf.kmip_plugin.ca_certs is not None:"},{"line_number":115,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.ca_certs)"},{"line_number":116,"context_line":"        if conf.kmip_plugin.cert_file is not None:"},{"line_number":117,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.cert_file)"},{"line_number":118,"context_line":"        if conf.kmip_plugin.key_file is not None:"},{"line_number":119,"context_line":"            self._validate_file_permissions(conf.kmip_plugin.key_file)"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5a890539_f0655ae1","line":117,"in_reply_to":"5a890539_fcc2e751","updated":"2014-11-24 11:14:04.000000000","message":"When I initially discussed permissions it was more in the vain of verifying that the key file has sane permissions, not world readable for example.","commit_id":"3c0002d0500839d6945302a9e6285f0ddaae77d2"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"b7a08b0332336e59051a81ce07e7bdcf30d7f51e","unresolved":false,"context_lines":[{"line_number":507,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def _validate_file_permissions(self, path):"},{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IWUSR | stat.S_IFREG)  # 0o100600"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"},{"line_number":513,"context_line":"            raise RuntimeError(\"bad file permissions, expected 600: \""}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_5d7b30be","line":510,"updated":"2014-12-05 17:35:33.000000000","message":"Does this mask require the user to have write permissions for the keyfile? It seems like read permissions should be sufficient...","commit_id":"389a3960ab802d83f05da3f5a4f61eb91370653f"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"e34aa6b94525f047be2e67555093281ef0d0a361","unresolved":false,"context_lines":[{"line_number":507,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def _validate_file_permissions(self, path):"},{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IWUSR | stat.S_IFREG)  # 0o100600"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"},{"line_number":513,"context_line":"            raise RuntimeError(\"bad file permissions, expected 600: \""}],"source_content_type":"text/x-python","patch_set":7,"id":"3a961159_d8949346","line":510,"in_reply_to":"5a890539_5d7b30be","updated":"2014-12-08 10:39:56.000000000","message":"humm, yes lets lock it down to just read only then.","commit_id":"389a3960ab802d83f05da3f5a4f61eb91370653f"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"0c094501a7a9a160a0d948d29db99aad07e47955","unresolved":false,"context_lines":[{"line_number":28,"context_line":"from kmip.core.factories import credentials"},{"line_number":29,"context_line":"from kmip.core.factories import secrets"},{"line_number":30,"context_line":"from kmip.core import objects as kmip_objects"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"from barbican.openstack.common import gettextutils as u"},{"line_number":33,"context_line":"from barbican.openstack.common import log as logging"},{"line_number":34,"context_line":"from barbican.plugin.interface import secret_store as ss"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_acc4ca40","line":31,"updated":"2014-12-09 06:30:06.000000000","message":"Please add this:\nfrom barbican import i18n as u\n\nand remove the \u0027gettextutils\u0027 line below.","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"f16d107351160f59046574d9fdfc2fcbaeec6670","unresolved":false,"context_lines":[{"line_number":28,"context_line":"from kmip.core.factories import credentials"},{"line_number":29,"context_line":"from kmip.core.factories import secrets"},{"line_number":30,"context_line":"from kmip.core import objects as kmip_objects"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"from barbican.openstack.common import gettextutils as u"},{"line_number":33,"context_line":"from barbican.openstack.common import log as logging"},{"line_number":34,"context_line":"from barbican.plugin.interface import secret_store as ss"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_78c0d1e0","line":31,"in_reply_to":"3a961159_acc4ca40","updated":"2014-12-09 13:10:33.000000000","message":"Done","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"361b904033970d7be91fdfd259f4ad6a6b9a4e02","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        LOG.debug(\"ERROR from KMIP server: %s\", msg)"},{"line_number":507,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def _validate_file_permissions(self, path):"},{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_44ca7250","line":509,"updated":"2014-12-08 17:17:17.000000000","message":"I rather have you rename this to be more specific, such as \"_validate_keyfile_file_permissions\" or something more clever. Since the file permissions that are checked for are quite specific and same with the file itself that is checked.","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"0c094501a7a9a160a0d948d29db99aad07e47955","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        LOG.debug(\"ERROR from KMIP server: %s\", msg)"},{"line_number":507,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def _validate_file_permissions(self, path):"},{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_6c6d8232","line":509,"in_reply_to":"3a961159_44ca7250","updated":"2014-12-09 06:30:06.000000000","message":"Yeah, I like \u0027_validate_keyfile_permissions(self, path)\u0027","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1ec79740dc18853f673803f5ce48ebb2688f41d6","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        LOG.debug(\"ERROR from KMIP server: %s\", msg)"},{"line_number":507,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def _validate_file_permissions(self, path):"},{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_bf55ca1e","line":509,"in_reply_to":"3a961159_6c6d8232","updated":"2014-12-09 07:33:47.000000000","message":"+1","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"f16d107351160f59046574d9fdfc2fcbaeec6670","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        LOG.debug(\"ERROR from KMIP server: %s\", msg)"},{"line_number":507,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"    def _validate_file_permissions(self, path):"},{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_98b73d86","line":509,"in_reply_to":"3a961159_bf55ca1e","updated":"2014-12-09 13:10:33.000000000","message":"Done","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"0c094501a7a9a160a0d948d29db99aad07e47955","unresolved":false,"context_lines":[{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"},{"line_number":513,"context_line":"            raise RuntimeError(\"bad file permissions, expected 400: \""},{"line_number":514,"context_line":"                               + path)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_4c89a6ea","line":513,"updated":"2014-12-09 06:30:06.000000000","message":"Please use a custom KMIP specific exception here, with a more clear message such as this: \n\nu._(\u0027Bad key file permissions found, expected 400 for path: {file_path}\").format(file_path\u003dpath)","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1ec79740dc18853f673803f5ce48ebb2688f41d6","unresolved":false,"context_lines":[{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"},{"line_number":513,"context_line":"            raise RuntimeError(\"bad file permissions, expected 400: \""},{"line_number":514,"context_line":"                               + path)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_ff367202","line":513,"in_reply_to":"3a961159_4c89a6ea","updated":"2014-12-09 07:33:47.000000000","message":"+1","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"f16d107351160f59046574d9fdfc2fcbaeec6670","unresolved":false,"context_lines":[{"line_number":510,"context_line":"        expected \u003d (stat.S_IRUSR | stat.S_IFREG)  # 0o100400"},{"line_number":511,"context_line":"        st \u003d os.stat(path)"},{"line_number":512,"context_line":"        if st.st_mode !\u003d expected:"},{"line_number":513,"context_line":"            raise RuntimeError(\"bad file permissions, expected 400: \""},{"line_number":514,"context_line":"                               + path)"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a961159_d8b0e58d","line":513,"in_reply_to":"3a961159_4c89a6ea","updated":"2014-12-09 13:10:33.000000000","message":"Done","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"2feb09bb416615a82eae4ff6c3184d1a4598ec65","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        }"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"        if conf.kmip_plugin.keyfile is not None:"},{"line_number":120,"context_line":"            self._validate_keyfile_permissions(conf.kmip_plugin.keyfile)"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"        credential_type \u003d credentials.CredentialType.USERNAME_AND_PASSWORD"},{"line_number":123,"context_line":"        credential_value \u003d {\u0027Username\u0027: conf.kmip_plugin.username,"}],"source_content_type":"text/x-python","patch_set":11,"id":"3a961159_6ffb1b47","line":120,"updated":"2014-12-12 21:22:50.000000000","message":"According to the diffcover job, it looks like this branch isn\u0027t covered by your tests. Would you mind adding a quick test to cover this path?","commit_id":"dcf2cebae59f67aa246c8b98225611ff91154641"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"55eea4a142dd82bd764d7e6af910aea2ba0140c4","unresolved":false,"context_lines":[{"line_number":124,"context_line":"                            \u0027Password\u0027: conf.kmip_plugin.password}"},{"line_number":125,"context_line":"        self.credential \u003d credentials.CredentialFactory().create_credential("},{"line_number":126,"context_line":"            credential_type,"},{"line_number":127,"context_line":"            credential_value)"},{"line_number":128,"context_line":"        self.client \u003d kmip_client.KMIPProxy("},{"line_number":129,"context_line":"            host\u003dconf.kmip_plugin.host,"},{"line_number":130,"context_line":"            port\u003dint(conf.kmip_plugin.port),"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a961159_57769f07","line":127,"updated":"2014-12-16 17:35:52.000000000","message":"What is the use of this credential object. seem not in use. As per Paul\u0027s comment we are pass in the user name and password in KMIPProxy constructor .\n\nPlease check","commit_id":"4bef0a4edff9e9ef6b5c2b9de63e4c8c1dc4ef18"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0cb28adff6d5e924d2f8209b0070fa38577b1bdd","unresolved":false,"context_lines":[{"line_number":124,"context_line":"                            \u0027Password\u0027: conf.kmip_plugin.password}"},{"line_number":125,"context_line":"        self.credential \u003d credentials.CredentialFactory().create_credential("},{"line_number":126,"context_line":"            credential_type,"},{"line_number":127,"context_line":"            credential_value)"},{"line_number":128,"context_line":"        self.client \u003d kmip_client.KMIPProxy("},{"line_number":129,"context_line":"            host\u003dconf.kmip_plugin.host,"},{"line_number":130,"context_line":"            port\u003dint(conf.kmip_plugin.port),"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a961159_b9015b6c","line":127,"in_reply_to":"3a961159_57769f07","updated":"2014-12-17 12:48:32.000000000","message":"The credentials object is used in many places to pass in the provided user credentials. This patch makes no change to how the credentials object is used.","commit_id":"4bef0a4edff9e9ef6b5c2b9de63e4c8c1dc4ef18"},{"author":{"_account_id":8004,"name":"Paul Kehrer","email":"paul.l.kehrer@gmail.com","username":"reaperhulk"},"change_message_id":"da184f52ec3ccc2dd0057ea9bcab21089c6ce48e","unresolved":false,"context_lines":[{"line_number":132,"context_line":"            ca_certs\u003dconf.kmip_plugin.ca_certs,"},{"line_number":133,"context_line":"            certfile\u003dconf.kmip_plugin.certfile,"},{"line_number":134,"context_line":"            keyfile\u003dconf.kmip_plugin.keyfile,"},{"line_number":135,"context_line":"            username\u003dconf.kmip_plugin.username,"},{"line_number":136,"context_line":"            password\u003dconf.kmip_plugin.password)"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"    def generate_symmetric_key(self, key_spec):"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a961159_ffc927ad","line":135,"updated":"2014-12-16 16:35:06.000000000","message":"Why are username/password being passed to the KMIPProxy now? It looks like previously a credential object was created and then later used when the session was opened?","commit_id":"4bef0a4edff9e9ef6b5c2b9de63e4c8c1dc4ef18"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"0cb28adff6d5e924d2f8209b0070fa38577b1bdd","unresolved":false,"context_lines":[{"line_number":132,"context_line":"            ca_certs\u003dconf.kmip_plugin.ca_certs,"},{"line_number":133,"context_line":"            certfile\u003dconf.kmip_plugin.certfile,"},{"line_number":134,"context_line":"            keyfile\u003dconf.kmip_plugin.keyfile,"},{"line_number":135,"context_line":"            username\u003dconf.kmip_plugin.username,"},{"line_number":136,"context_line":"            password\u003dconf.kmip_plugin.password)"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"    def generate_symmetric_key(self, key_spec):"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a961159_39a56b47","line":135,"in_reply_to":"3a961159_ffc927ad","updated":"2014-12-17 12:48:32.000000000","message":"PyKMIP 0.2.0 added these parameters to the KMIPProxy constructor, looking into the code of the lib it will store defaults loaded from a configuration file if they are not provided here. I am unsure as to the exact use that PyKMIP puts these values to, but figured it was better to pass in correct values rather than have it load in defaults from some where other than the provided plugin configuration.","commit_id":"4bef0a4edff9e9ef6b5c2b9de63e4c8c1dc4ef18"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"56c110259cb62a7a6f9636cce476cb4aa1bd78ee","unresolved":false,"context_lines":[{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"class KMIPSecretStoreError(Exception):"},{"line_number":86,"context_line":"    pass"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"class KMIPSecretStore(ss.SecretStoreBase):"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_a5bcc208","line":86,"updated":"2015-01-13 13:26:05.000000000","message":"If this is no longer used it should be deleted.","commit_id":"da04ec014247d87c171f510ec77fe11c6bbf9789"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"56c110259cb62a7a6f9636cce476cb4aa1bd78ee","unresolved":false,"context_lines":[{"line_number":518,"context_line":"        LOG.debug(\"ERROR from KMIP server: %s\", msg)"},{"line_number":519,"context_line":"        raise ss.SecretGeneralException(msg)"},{"line_number":520,"context_line":""},{"line_number":521,"context_line":"    def _validate_keyfile_permissions(self, path):"},{"line_number":522,"context_line":"        \"\"\"Check that file has permissions appropriate for a sensitive key"},{"line_number":523,"context_line":""},{"line_number":524,"context_line":"        Key files are extremely sensitive, they should be owned by the user"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_453f9e87","line":521,"updated":"2015-01-13 13:26:05.000000000","message":"Well... This function doesn\u0027t validate anymore. _check_keyfile_permissions would be a better name maybe?","commit_id":"da04ec014247d87c171f510ec77fe11c6bbf9789"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"56c110259cb62a7a6f9636cce476cb4aa1bd78ee","unresolved":false,"context_lines":[{"line_number":531,"context_line":"            LOG.warning(u._(\u0027Poor key file permissions found, recommend 400 \u0027"},{"line_number":532,"context_line":"                            \u0027for path: {file_path}\u0027).format(file_path\u003dpath))"},{"line_number":533,"context_line":"            return False"},{"line_number":534,"context_line":"        return True"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_a543e20f","line":534,"updated":"2015-01-13 13:26:05.000000000","message":"don\u0027t see much value in adding these returns","commit_id":"da04ec014247d87c171f510ec77fe11c6bbf9789"}],"barbican/tests/plugin/test_kmip.py":[{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"0326b7aea5611e0c10c6c8dd29143781a339df05","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        self.kmip_plugin_patcher.start()"},{"line_number":56,"context_line":"        self.addCleanup(self.kmip_plugin_patcher.stop)"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"        self.secret_store \u003d kss.KMIPSecretStore()"},{"line_number":59,"context_line":"        self.secret_store.client \u003d self.kmipclient_mock"},{"line_number":60,"context_line":"        self.secret_store.credential \u003d self.credential"},{"line_number":61,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_4107e281","line":58,"updated":"2014-11-26 17:21:55.000000000","message":"Please add a test for the new _validate_file_permissins() method directly. That would then get that new coverage gate to pass...a step closer to 100% code coverage.","commit_id":"6287ca53f6a3c06a138c88253cf35749a4995639"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"b7a08b0332336e59051a81ce07e7bdcf30d7f51e","unresolved":false,"context_lines":[{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        os_stat_patcher \u003d mock.patch(\u0027os.stat\u0027, **config)"},{"line_number":437,"context_line":"        self.addCleanup(os_stat_patcher.stop)"},{"line_number":438,"context_line":"        os_stat_patcher.start()"},{"line_number":439,"context_line":""},{"line_number":440,"context_line":"        self.assertIsNone("},{"line_number":441,"context_line":"            self.secret_store._validate_file_permissions(\u0027/some/path/\u0027))"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_984f666a","line":438,"updated":"2014-12-05 17:35:33.000000000","message":"Using an annotation\n  @mock.patch(\u0027os.stat\u0027, ...)\nor with statement\n  with mock.patch(\u0027os.stat\u0027, ...)\nseems cleaner than manually starting and stopping the mock. Is there some reason that this approach was selected instead?","commit_id":"389a3960ab802d83f05da3f5a4f61eb91370653f"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"e34aa6b94525f047be2e67555093281ef0d0a361","unresolved":false,"context_lines":[{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        os_stat_patcher \u003d mock.patch(\u0027os.stat\u0027, **config)"},{"line_number":437,"context_line":"        self.addCleanup(os_stat_patcher.stop)"},{"line_number":438,"context_line":"        os_stat_patcher.start()"},{"line_number":439,"context_line":""},{"line_number":440,"context_line":"        self.assertIsNone("},{"line_number":441,"context_line":"            self.secret_store._validate_file_permissions(\u0027/some/path/\u0027))"}],"source_content_type":"text/x-python","patch_set":7,"id":"3a961159_98b4cbf3","line":438,"in_reply_to":"5a890539_984f666a","updated":"2014-12-08 10:39:56.000000000","message":"yes, your right, not sure why I didn\u0027t do it that to begin with, I\u0027ll update.","commit_id":"389a3960ab802d83f05da3f5a4f61eb91370653f"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"1dfbde6bc3c0da1d09bb91efc1f49c0b4199e3de","unresolved":false,"context_lines":[{"line_number":431,"context_line":"                self.secret_store._validate_keyfile_permissions(\u0027/some/path/\u0027))"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"    def test_validate_keyfile_permissions_bad(self):"},{"line_number":434,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027: 0}"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":437,"context_line":"            self.assertRaises("}],"source_content_type":"text/x-python","patch_set":13,"id":"3a961159_b4ad849d","line":434,"updated":"2014-12-19 21:11:10.000000000","message":"It would be good to check for realistic permissions -- e.g., user with read + write, group read, world read, etc. Those cases are probably more likely to be missed if the existing code is modified at some point in the future.","commit_id":"ef367822657146a145f524ad01cfdf0e5ecd0b1c"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"31ae188a2e56f5947638bb92e558a1c01caf1cf9","unresolved":false,"context_lines":[{"line_number":431,"context_line":"                self.secret_store._validate_keyfile_permissions(\u0027/some/path/\u0027))"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"    def test_validate_keyfile_permissions_bad(self):"},{"line_number":434,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027: 0}"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":437,"context_line":"            self.assertRaises("}],"source_content_type":"text/x-python","patch_set":13,"id":"3a961159_354c87c8","line":434,"in_reply_to":"3a961159_5ff5c682","updated":"2015-01-13 10:04:51.000000000","message":"I actually don\u0027t mind there being checks like this in the barbican code. Checks like this could be quite useful for the deployer, in order to have a more product. But I would argue for, either having checks like this in other parts of barbican too; Or not having these OS dependant checks at all.","commit_id":"ef367822657146a145f524ad01cfdf0e5ecd0b1c"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"5b11364bbbc559322d69928768b71aaf7b2810e8","unresolved":false,"context_lines":[{"line_number":431,"context_line":"                self.secret_store._validate_keyfile_permissions(\u0027/some/path/\u0027))"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"    def test_validate_keyfile_permissions_bad(self):"},{"line_number":434,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027: 0}"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":437,"context_line":"            self.assertRaises("}],"source_content_type":"text/x-python","patch_set":13,"id":"3a961159_339cb15d","line":434,"in_reply_to":"3a961159_5ff5c682","updated":"2015-01-13 17:11:32.000000000","message":"Per the IRC meeting today, it seems it was best to log permissions issues but not raise exceptions for them. Unit tests can check for the presence of specific log message.","commit_id":"ef367822657146a145f524ad01cfdf0e5ecd0b1c"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"400946f0cd98be9e1873332c09779cf7d23f8330","unresolved":false,"context_lines":[{"line_number":431,"context_line":"                self.secret_store._validate_keyfile_permissions(\u0027/some/path/\u0027))"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"    def test_validate_keyfile_permissions_bad(self):"},{"line_number":434,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027: 0}"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":437,"context_line":"            self.assertRaises("}],"source_content_type":"text/x-python","patch_set":13,"id":"3a961159_5ff5c682","line":434,"in_reply_to":"3a961159_8920e0f9","updated":"2015-01-12 20:19:45.000000000","message":"So...do we really need to be (or should we be) checking permissions within the Barbican code? I think that is a deployment concern, and would best be documented in a deployers/deployment guide doc someplace. Thoughts?","commit_id":"ef367822657146a145f524ad01cfdf0e5ecd0b1c"},{"author":{"_account_id":8004,"name":"Paul Kehrer","email":"paul.l.kehrer@gmail.com","username":"reaperhulk"},"change_message_id":"6fcf275dd169ceab5d765a7edbde94a5df957d57","unresolved":false,"context_lines":[{"line_number":431,"context_line":"                self.secret_store._validate_keyfile_permissions(\u0027/some/path/\u0027))"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"    def test_validate_keyfile_permissions_bad(self):"},{"line_number":434,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027: 0}"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":437,"context_line":"            self.assertRaises("}],"source_content_type":"text/x-python","patch_set":13,"id":"3a961159_8920e0f9","line":434,"in_reply_to":"3a961159_b4ad849d","updated":"2015-01-12 19:20:37.000000000","message":"Agreed, we need a check against a file that will elicit the expected permissions. We also don\u0027t have an explicit dependency on running on a POSIX platform but these permission checks may cause that. Does this work on Windows?","commit_id":"ef367822657146a145f524ad01cfdf0e5ecd0b1c"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"1dfbde6bc3c0da1d09bb91efc1f49c0b4199e3de","unresolved":false,"context_lines":[{"line_number":449,"context_line":"            kss.KMIPSecretStore(CONF)"},{"line_number":450,"context_line":""},{"line_number":451,"context_line":"    def test_with_keyfile_permissions_bad(self):"},{"line_number":452,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027: 0}"},{"line_number":453,"context_line":""},{"line_number":454,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":455,"context_line":"            CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":13,"id":"3a961159_d495b040","line":452,"updated":"2014-12-19 21:11:10.000000000","message":"See comment above.","commit_id":"ef367822657146a145f524ad01cfdf0e5ecd0b1c"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"56c110259cb62a7a6f9636cce476cb4aa1bd78ee","unresolved":false,"context_lines":[{"line_number":428,"context_line":""},{"line_number":429,"context_line":"        with mock.patch(\u0027os.stat\u0027, **config):"},{"line_number":430,"context_line":"            self.assertTrue("},{"line_number":431,"context_line":"                self.secret_store._validate_keyfile_permissions(\u0027/some/path/\u0027))"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"    def test_validate_keyfile_permissions_bad(self):"},{"line_number":434,"context_line":"        config \u003d {\u0027return_value.st_mode\u0027:"}],"source_content_type":"text/x-python","patch_set":14,"id":"3a961159_856fc692","line":431,"updated":"2015-01-13 13:26:05.000000000","message":"perhaps using a mock.patch and patching the log.WARN to see that it wasn\u0027t called? or something of the sort. If in the end you get rid of those \"return\"s","commit_id":"da04ec014247d87c171f510ec77fe11c6bbf9789"}],"etc/barbican/barbican-api.conf":[{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"7767967548ad28e18e1c1c90f2e422eb20846661","unresolved":false,"context_lines":[{"line_number":226,"context_line":"[kmip_plugin]"},{"line_number":227,"context_line":"username \u003d \u0027admin\u0027"},{"line_number":228,"context_line":"password \u003d \u0027password\u0027"},{"line_number":229,"context_line":"host \u003d localhost"},{"line_number":230,"context_line":"port \u003d 9090"},{"line_number":231,"context_line":"key_file \u003d \u0027/path/to/certs/cert.key\u0027"},{"line_number":232,"context_line":"cert_file \u003d \u0027/path/to/certs/cert.crt\u0027"}],"source_content_type":"text/plain","patch_set":2,"id":"5a890539_2fdc7818","line":229,"updated":"2014-11-18 22:09:09.000000000","message":"is it KMIP HSM host?","commit_id":"bcb1905a2b0b870a79aceee9abb0b2940827d8c7"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"0c094501a7a9a160a0d948d29db99aad07e47955","unresolved":false,"context_lines":[{"line_number":228,"context_line":"password \u003d \u0027password\u0027"},{"line_number":229,"context_line":"host \u003d localhost"},{"line_number":230,"context_line":"port \u003d 9090"},{"line_number":231,"context_line":"keyfile \u003d \u0027/path/to/certs/cert.key\u0027"},{"line_number":232,"context_line":"certfile \u003d \u0027/path/to/certs/cert.crt\u0027"},{"line_number":233,"context_line":"ca_certs \u003d \u0027/path/to/certs/LocalCA.crt\u0027"},{"line_number":234,"context_line":""}],"source_content_type":"text/plain","patch_set":8,"id":"3a961159_8cd8eef0","line":231,"updated":"2014-12-09 06:30:06.000000000","message":"Do these new params have to be supplied for a \u0027default\u0027 KMIP operation? Otherwise they probably should be commented out?","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"f16d107351160f59046574d9fdfc2fcbaeec6670","unresolved":false,"context_lines":[{"line_number":228,"context_line":"password \u003d \u0027password\u0027"},{"line_number":229,"context_line":"host \u003d localhost"},{"line_number":230,"context_line":"port \u003d 9090"},{"line_number":231,"context_line":"keyfile \u003d \u0027/path/to/certs/cert.key\u0027"},{"line_number":232,"context_line":"certfile \u003d \u0027/path/to/certs/cert.crt\u0027"},{"line_number":233,"context_line":"ca_certs \u003d \u0027/path/to/certs/LocalCA.crt\u0027"},{"line_number":234,"context_line":""}],"source_content_type":"text/plain","patch_set":8,"id":"3a961159_d82545c3","line":231,"in_reply_to":"3a961159_8cd8eef0","updated":"2014-12-09 13:10:33.000000000","message":"There\u0027s only one Oasis Conformance tested KMIP device at the moment which is the ESKM, so in effect this is the default. I also anticipate it being the most desirable mode of operation for future  KMIP HSMs","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"26ef4cf78bf49e7620e25d0206dbdeb106eb057f","unresolved":false,"context_lines":[{"line_number":228,"context_line":"password \u003d \u0027password\u0027"},{"line_number":229,"context_line":"host \u003d localhost"},{"line_number":230,"context_line":"port \u003d 9090"},{"line_number":231,"context_line":"keyfile \u003d \u0027/path/to/certs/cert.key\u0027"},{"line_number":232,"context_line":"certfile \u003d \u0027/path/to/certs/cert.crt\u0027"},{"line_number":233,"context_line":"ca_certs \u003d \u0027/path/to/certs/LocalCA.crt\u0027"},{"line_number":234,"context_line":""}],"source_content_type":"text/plain","patch_set":8,"id":"3a961159_be0dc139","line":231,"in_reply_to":"3a961159_d82545c3","updated":"2014-12-09 13:51:01.000000000","message":"Sounds good, thanks.","commit_id":"55850cba211a4143353a5ab2e1c4882ac5dfba84"}]}