)]}'
{"barbican/cmd/barbican_manage.py":[{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"377b58adebc7e85fa309bc7d6f64d4db3d7e36e5","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    @args(\u0027--library-path\u0027, metavar\u003d\u0027\u003clibrary-path\u003e\u0027, dest\u003d\u0027libpath\u0027,"},{"line_number":178,"context_line":"          default\u003d\u0027/usr/lib64/pkcs11/libsofthsm2.so\u0027,"},{"line_number":179,"context_line":"          help\u003d\u0027Path to vendor PKCS11 library\u0027)"},{"line_number":180,"context_line":"    @args(\u0027--slot-id\u0027, metavar\u003d\u0027\u003cslot-id\u003e\u0027, dest\u003d\u0027slotid\u0027, default\u003d1,"},{"line_number":181,"context_line":"          help\u003d\u0027HSM Slot id (Should correspond to a configured PKCS11 slot, \\"},{"line_number":182,"context_line":"          default is 1)\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_0e224a53","line":179,"updated":"2018-08-09 19:40:41.000000000","message":"Whats the motivation behind changing this default?  We may end up breaking someone.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"b888378e02742464c7199b8b99f1f4cc2b5bcd6f","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    @args(\u0027--library-path\u0027, metavar\u003d\u0027\u003clibrary-path\u003e\u0027, dest\u003d\u0027libpath\u0027,"},{"line_number":178,"context_line":"          default\u003d\u0027/usr/lib64/pkcs11/libsofthsm2.so\u0027,"},{"line_number":179,"context_line":"          help\u003d\u0027Path to vendor PKCS11 library\u0027)"},{"line_number":180,"context_line":"    @args(\u0027--slot-id\u0027, metavar\u003d\u0027\u003cslot-id\u003e\u0027, dest\u003d\u0027slotid\u0027, default\u003d1,"},{"line_number":181,"context_line":"          help\u003d\u0027HSM Slot id (Should correspond to a configured PKCS11 slot, \\"},{"line_number":182,"context_line":"          default is 1)\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_0a7bddf4","line":179,"in_reply_to":"3f79a3b5_0e224a53","updated":"2018-08-10 18:43:11.000000000","message":"Initially, I just got tired of typing the SoftHSM location while working on this patch, but I would like to see it changed because I think libCryptoki2_64.so is the Safenet PKCS#11 library, and I think it would be better to default to open source tools.\n\nI will put this change on its own patch so we can discuss separately from this change.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"377b58adebc7e85fa309bc7d6f64d4db3d7e36e5","unresolved":false,"context_lines":[{"line_number":203,"context_line":""},{"line_number":204,"context_line":"    @args(\u0027--library-path\u0027, metavar\u003d\u0027\u003clibrary-path\u003e\u0027, dest\u003d\u0027libpath\u0027,"},{"line_number":205,"context_line":"          default\u003d\u0027/usr/lib64/pkcs11/libsofthsm2.so\u0027,"},{"line_number":206,"context_line":"          help\u003d\u0027Path to vendor PKCS11 library\u0027)"},{"line_number":207,"context_line":"    @args(\u0027--slot-id\u0027, metavar\u003d\u0027\u003cslot-id\u003e\u0027, dest\u003d\u0027slotid\u0027, default\u003d1,"},{"line_number":208,"context_line":"          help\u003d\u0027HSM Slot id (Should correspond to a configured PKCS11 slot, \\"},{"line_number":209,"context_line":"          default is 1)\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_86d148fe","line":206,"updated":"2018-08-09 19:40:41.000000000","message":"ditto as above.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"4a0ab3a011d2e0872abf9292fae0fc0a6b282c01","unresolved":false,"context_lines":[{"line_number":242,"context_line":"            library_path\u003dlibpath, login_passphrase\u003dpassphrase,"},{"line_number":243,"context_line":"            rw_session\u003dTrue, slot_id\u003dslotid,"},{"line_number":244,"context_line":"            encryption_mechanism\u003d\u0027CKM_AES_CBC\u0027,"},{"line_number":245,"context_line":"            hmac_keygen_mechanism\u003d\u0027CKM_AES_KEY_GEN\u0027"},{"line_number":246,"context_line":"        )"},{"line_number":247,"context_line":"        self.session \u003d self.pkcs11.get_session()"},{"line_number":248,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_8be84fe2","line":245,"range":{"start_line":245,"start_character":12,"end_line":245,"end_character":51},"updated":"2018-08-10 19:40:58.000000000","message":"No longer needed - right?","commit_id":"8e41bcd0b04b28b62185db75e316035b7ce51385"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"efe6cb210122e45369a77fb182ace99923373a0a","unresolved":false,"context_lines":[{"line_number":242,"context_line":"            library_path\u003dlibpath, login_passphrase\u003dpassphrase,"},{"line_number":243,"context_line":"            rw_session\u003dTrue, slot_id\u003dslotid,"},{"line_number":244,"context_line":"            encryption_mechanism\u003d\u0027CKM_AES_CBC\u0027,"},{"line_number":245,"context_line":"            hmac_keygen_mechanism\u003d\u0027CKM_AES_KEY_GEN\u0027"},{"line_number":246,"context_line":"        )"},{"line_number":247,"context_line":"        self.session \u003d self.pkcs11.get_session()"},{"line_number":248,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_2be49be0","line":245,"range":{"start_line":245,"start_character":12,"end_line":245,"end_character":51},"in_reply_to":"3f79a3b5_8be84fe2","updated":"2018-08-10 19:43:38.000000000","message":"Done","commit_id":"8e41bcd0b04b28b62185db75e316035b7ce51385"}],"barbican/plugin/crypto/pkcs11.py":[{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"377b58adebc7e85fa309bc7d6f64d4db3d7e36e5","unresolved":false,"context_lines":[{"line_number":147,"context_line":"_ENCRYPTION_MECHANISMS \u003d {"},{"line_number":148,"context_line":"    \u0027CKM_AES_CBC\u0027: CKM_AES_CBC,"},{"line_number":149,"context_line":"    # TODO(dmend): Implement CMK_AES_GCM encrypt and decrypt"},{"line_number":150,"context_line":"    # \u0027CKM_AES_GCM\u0027: CKM_AES_GCM,"},{"line_number":151,"context_line":"    \u0027VENDOR_SAFENET_CKM_AES_GCM\u0027: VENDOR_SAFENET_CKM_AES_GCM,"},{"line_number":152,"context_line":"}"},{"line_number":153,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_b97ee268","line":150,"updated":"2018-08-09 19:40:41.000000000","message":"This used to be the default.  By not implementing it, are we potentially going to break folks?","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"b888378e02742464c7199b8b99f1f4cc2b5bcd6f","unresolved":false,"context_lines":[{"line_number":147,"context_line":"_ENCRYPTION_MECHANISMS \u003d {"},{"line_number":148,"context_line":"    \u0027CKM_AES_CBC\u0027: CKM_AES_CBC,"},{"line_number":149,"context_line":"    # TODO(dmend): Implement CMK_AES_GCM encrypt and decrypt"},{"line_number":150,"context_line":"    # \u0027CKM_AES_GCM\u0027: CKM_AES_GCM,"},{"line_number":151,"context_line":"    \u0027VENDOR_SAFENET_CKM_AES_GCM\u0027: VENDOR_SAFENET_CKM_AES_GCM,"},{"line_number":152,"context_line":"}"},{"line_number":153,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_4561c6d2","line":150,"in_reply_to":"3f79a3b5_b97ee268","updated":"2018-08-10 18:43:11.000000000","message":"The current default is \"VENDOR_SAFENET_CKM_AES_GCM\" http://git.openstack.org/cgit/openstack/barbican/tree/barbican/plugin/crypto/p11_crypto.py#n65\n\nI\u0027m not entirely sure that the Safenet GCM mechanism works the same way as CKM_AES_GCM, so I was trying to add this todo to look into testing/implementing it.\n\nI\u0027ll update this to use the Safenet GCM implementation just in case someone out there is using it with the current \"algorithm\" option.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"377b58adebc7e85fa309bc7d6f64d4db3d7e36e5","unresolved":false,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"class PKCS11(object):"},{"line_number":359,"context_line":"    def __init__(self, library_path, login_passphrase, rw_session, slot_id,"},{"line_number":360,"context_line":"                 encryption_mechanism\u003dNone, hmac_keygen_mechanism\u003dNone,"},{"line_number":361,"context_line":"                 ffi\u003dNone, algorithm\u003dNone,"},{"line_number":362,"context_line":"                 seed_random_buffer\u003dNone,"},{"line_number":363,"context_line":"                 generate_iv\u003dNone):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_3955f2c6","line":360,"range":{"start_line":360,"start_character":44,"end_line":360,"end_character":65},"updated":"2018-08-09 19:40:41.000000000","message":"Where is this parameter used?","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"b888378e02742464c7199b8b99f1f4cc2b5bcd6f","unresolved":false,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"class PKCS11(object):"},{"line_number":359,"context_line":"    def __init__(self, library_path, login_passphrase, rw_session, slot_id,"},{"line_number":360,"context_line":"                 encryption_mechanism\u003dNone, hmac_keygen_mechanism\u003dNone,"},{"line_number":361,"context_line":"                 ffi\u003dNone, algorithm\u003dNone,"},{"line_number":362,"context_line":"                 seed_random_buffer\u003dNone,"},{"line_number":363,"context_line":"                 generate_iv\u003dNone):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_857fde13","line":360,"range":{"start_line":360,"start_character":44,"end_line":360,"end_character":65},"in_reply_to":"3f79a3b5_3955f2c6","updated":"2018-08-10 18:43:11.000000000","message":"Oops.  I added that thinking I was going to need it, but ended up just passing the mechanism into the generate_key function.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"377b58adebc7e85fa309bc7d6f64d4db3d7e36e5","unresolved":false,"context_lines":[{"line_number":580,"context_line":"        extractable \u003d not master_key"},{"line_number":581,"context_line":"        # in some HSMs extractable keys cannot be marked sensitive"},{"line_number":582,"context_line":"        sensitive \u003d not extractable"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        ck_attributes \u003d ["},{"line_number":585,"context_line":"            Attribute(CKA_CLASS, CKO_SECRET_KEY),"},{"line_number":586,"context_line":"            Attribute(CKA_KEY_TYPE, _KEY_TYPES[key_type]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_a720feb1","line":583,"updated":"2018-08-09 19:40:41.000000000","message":"This is presumably to get around having to set that extractable setting in the Thales HSM ...\n\nIs this something that should be HSM specific -- ie. should require passing in a HSM specific parameter?","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"b888378e02742464c7199b8b99f1f4cc2b5bcd6f","unresolved":false,"context_lines":[{"line_number":580,"context_line":"        extractable \u003d not master_key"},{"line_number":581,"context_line":"        # in some HSMs extractable keys cannot be marked sensitive"},{"line_number":582,"context_line":"        sensitive \u003d not extractable"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        ck_attributes \u003d ["},{"line_number":585,"context_line":"            Attribute(CKA_CLASS, CKO_SECRET_KEY),"},{"line_number":586,"context_line":"            Attribute(CKA_KEY_TYPE, _KEY_TYPES[key_type]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_e5481288","line":583,"in_reply_to":"3f79a3b5_a720feb1","updated":"2018-08-10 18:43:11.000000000","message":"Yeah, that was the main reason for changing this.\n\nI\u0027m not sure that it makes sense to make extractable keys that are sensitive, so I don\u0027t think we need to provide an option.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"8a3aaeb9c477e35cc6c193f59b84967697e2e891","unresolved":false,"context_lines":[{"line_number":580,"context_line":"        extractable \u003d not master_key"},{"line_number":581,"context_line":"        # in some HSMs extractable keys cannot be marked sensitive"},{"line_number":582,"context_line":"        sensitive \u003d not extractable"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        ck_attributes \u003d ["},{"line_number":585,"context_line":"            Attribute(CKA_CLASS, CKO_SECRET_KEY),"},{"line_number":586,"context_line":"            Attribute(CKA_KEY_TYPE, _KEY_TYPES[key_type]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_eb430312","line":583,"in_reply_to":"3f79a3b5_e5481288","updated":"2018-08-10 19:32:35.000000000","message":"What does the \"sensitive\" designation do?  And are we breaking safenet by not using it?","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2fbce3238df64694ff0b42b41a7efec9e630affe","unresolved":false,"context_lines":[{"line_number":580,"context_line":"        extractable \u003d not master_key"},{"line_number":581,"context_line":"        # in some HSMs extractable keys cannot be marked sensitive"},{"line_number":582,"context_line":"        sensitive \u003d not extractable"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        ck_attributes \u003d ["},{"line_number":585,"context_line":"            Attribute(CKA_CLASS, CKO_SECRET_KEY),"},{"line_number":586,"context_line":"            Attribute(CKA_KEY_TYPE, _KEY_TYPES[key_type]),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_2086f5dc","line":583,"in_reply_to":"3f79a3b5_eb430312","updated":"2018-08-10 21:29:16.000000000","message":"\"sensitive\" prevents reading of some attributes on the object.  For example, a CKK_RSA key marked Sensitive would prevent you from reading the P and Q values from CKA_PRIME_2 and CKA_PRIME_2.\n\nI doubt this would affect the Safenet implementation.","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"377b58adebc7e85fa309bc7d6f64d4db3d7e36e5","unresolved":false,"context_lines":[{"line_number":674,"context_line":"        LOG.debug(mech)"},{"line_number":675,"context_line":"        if hmac_key is not None:"},{"line_number":676,"context_line":"            LOG.debug(\"alee: hmac_key\")"},{"line_number":677,"context_line":"            LOG.debug(hmac_key)"},{"line_number":678,"context_line":"        rv \u003d self.lib.C_SignInit(session, mech, hmac_key)"},{"line_number":679,"context_line":"        self._check_error(rv)"},{"line_number":680,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_c75c1a80","line":677,"updated":"2018-08-09 19:40:41.000000000","message":"remove log statements!","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"b888378e02742464c7199b8b99f1f4cc2b5bcd6f","unresolved":false,"context_lines":[{"line_number":674,"context_line":"        LOG.debug(mech)"},{"line_number":675,"context_line":"        if hmac_key is not None:"},{"line_number":676,"context_line":"            LOG.debug(\"alee: hmac_key\")"},{"line_number":677,"context_line":"            LOG.debug(hmac_key)"},{"line_number":678,"context_line":"        rv \u003d self.lib.C_SignInit(session, mech, hmac_key)"},{"line_number":679,"context_line":"        self._check_error(rv)"},{"line_number":680,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_b049f631","line":677,"in_reply_to":"3f79a3b5_c75c1a80","updated":"2018-08-10 18:43:11.000000000","message":"Done","commit_id":"36449a82e9fc1bfc283034aa5d7ed6cc23805f0e"}]}