)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"fd45a8bec7edb3bc9724da37446e822fe4c9e97d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"01411743_4c96ca05","updated":"2026-05-04 18:01:18.000000000","message":"Good start.  Lets fix the tests.","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"43397fadf0914b3d349e83f5a652f6085b8c53f9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"ae9e49c1_7ffc8003","updated":"2026-05-08 20:45:54.000000000","message":"Almost there.  Nice to see the new tests.","commit_id":"429417a493d6bd51e3153be822c6e4f2f732332e"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"7b60564fc956c73b5f3b6af5ce1d353b83521095","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"3a219aab_4d0a27eb","updated":"2026-05-06 12:48:59.000000000","message":"Thanks for the review.  All comments were addressed.  Mind reviewing again?","commit_id":"429417a493d6bd51e3153be822c6e4f2f732332e"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"cdcdc3688066c20a891704324d5ec7e8b7652fff","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"43fed321_f0536cdb","updated":"2026-05-11 10:46:54.000000000","message":"Thanks, new patchset was submitted.","commit_id":"dce1d1ca7e9900031cb3b5824666370871014bb0"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"f0c9b89fd4d287ec9d86c8d9a4aae4f79ad140e4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"b547e310_9aaf0972","updated":"2026-06-02 21:19:27.000000000","message":"Still looks ok to me - but you have to fix PEP8","commit_id":"508b8716806d3ba764440f71e48ecc4a6097e350"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"0ad1a8d510ea1ad34467fb1835b97d7021498429","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"4548b034_4c87ed11","updated":"2026-06-29 15:41:35.000000000","message":"Thanks","commit_id":"36e78caec3f214fba8537687c476630fd2ed29fd"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"7b1e64cf09f6cfdb378ddfd871922c72339445ac","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"748d2345_804a2e9e","updated":"2026-07-10 14:20:03.000000000","message":"_is_algorithm_supported has a cross-contamination bug. It checks algorithm in ASYMMETRIC_ALGORITHMS and bit_length in ASYMMETRIC_KEY_LENGTHS independently. Now that both lists are merged, these combinations all pass supports() but fail or produce broken results at generation time:\n\n  • RSA, 256 → supports() True → rsa.generate_private_key(256) creates a trivially breakable key\n  • EC, 2048 → supports() True → _EC_CURVE_MAP.get(2048) is None → CryptoPrivateKeyFailureException (inconsistency: plugin claimed to support it)\n  • DSA, 521 → supports() True → DSA doesn\u0027t have a 521-bit mode\n\nThe tests don\u0027t cover these invalid cross-combinations — they only check that valid ones work and completely invalid ones (e.g., EC with 128-bit) fail, but 128 was already absent from ASYMMETRIC_KEY_LENGTHS.\n\nThe fix is per-algorithm key length mapping instead of a merged flat list, either in base.py or in _is_algorithm_supported:\n\n  _ASYMMETRIC_KEY_LENGTHS_BY_ALGO \u003d {\n      \u0027rsa\u0027: {1024, 2048, 4096},\n      \u0027dsa\u0027: {1024, 2048, 4096},\n      \u0027ec\u0027:  {256, 384, 521},\n  }\n\nAlso, one small thing:\n  • _SUPPORTED_ASYMMETRIC_ALGORITHMS is defined but never referenced anywhere — dead code.","commit_id":"36e78caec3f214fba8537687c476630fd2ed29fd"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"af974748b8ef0aceba85e4d8e13803353a4d2c39","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"ddd765c7_ec80054a","updated":"2026-07-17 16:01:21.000000000","message":"The functional test failures (barbican-tox-functional, barbican-vault-tox-functional, barbican-openbao-tox-functional) are pre-existing and unrelated to this change. They are caused by the ACL policy enforcement fix (297127cc) that was merged after PS 12, which broke 250 RBAC/ACL/quota/consumer tests for all open patches. Change 984422 (\"Enable SRBAC by default\") fixes these tests and has already passed all CI jobs (PS 11, Verified+1). Once 984422 merges, these jobs will pass for this change as well.\n\nThe only failure specific to this patch was the PEP8 W391 (trailing blank line), which is fixed in this patchset.","commit_id":"53b0f197edf58b4ae6ad4de0d513e736df5c3b64"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"b465dad63639981f25a77e10e35a247907235f11","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"0cb5cf6d_93c3645c","in_reply_to":"2ad04bab_408602a0","updated":"2026-07-30 10:51:00.000000000","message":"Thanks.  Last patchset is passing.  The functional test failures are pre-existing and affect all open Barbican patches.  They depend on #984422 (Enable SRBAC by default), which is still in review. I\u0027ll rebase as soon as it merges.","commit_id":"53b0f197edf58b4ae6ad4de0d513e736df5c3b64"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"7e451687a7f38dadc6656df936be224020760020","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"2ad04bab_408602a0","in_reply_to":"ddd765c7_ec80054a","updated":"2026-07-20 13:01:39.000000000","message":"You can rebase on top of that change, so that we can see that it all passes.","commit_id":"53b0f197edf58b4ae6ad4de0d513e736df5c3b64"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"7e451687a7f38dadc6656df936be224020760020","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":14,"id":"6d9abcb6_458d0a0d","updated":"2026-07-20 13:01:39.000000000","message":"waiting for passing CI.","commit_id":"d6ec0a87bbfb60b602906ffd49a08d5ee7e56ea1"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"b465dad63639981f25a77e10e35a247907235f11","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":14,"id":"314fee87_939d7fd5","in_reply_to":"6d9abcb6_458d0a0d","updated":"2026-07-30 10:51:00.000000000","message":"Done","commit_id":"d6ec0a87bbfb60b602906ffd49a08d5ee7e56ea1"}],"barbican/plugin/crypto/simple_crypto.py":[{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"fd45a8bec7edb3bc9724da37446e822fe4c9e97d","unresolved":true,"context_lines":[{"line_number":233,"context_line":"                backend\u003ddefault_backend()"},{"line_number":234,"context_line":"            )"},{"line_number":235,"context_line":"        elif algorithm \u003d\u003d \u0027dsa\u0027:"},{"line_number":236,"context_line":"            warnings.warn("},{"line_number":237,"context_line":"                \"DSA key generation is deprecated per NIST SP 800-131A \""},{"line_number":238,"context_line":"                \"Rev.2. Consider using RSA or EC instead.\","},{"line_number":239,"context_line":"                DeprecationWarning,"},{"line_number":240,"context_line":"                stacklevel\u003d4"},{"line_number":241,"context_line":"            )"},{"line_number":242,"context_line":"            return dsa.generate_private_key("},{"line_number":243,"context_line":"                key_size\u003dgenerate_dto.bit_length,"},{"line_number":244,"context_line":"                backend\u003ddefault_backend()"}],"source_content_type":"text/x-python","patch_set":2,"id":"fb45ef41_ac49532e","line":241,"range":{"start_line":236,"start_character":12,"end_line":241,"end_character":13},"updated":"2026-05-04 18:01:18.000000000","message":"I\u0027m not sure the end user would see this warning.  This just goes into the logs, right?  In which case, I\u0027m not sure it makes sense to warn here.\n\nIf anything, we should probably warn if the default algorithm is set to dsa.","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"7b60564fc956c73b5f3b6af5ce1d353b83521095","unresolved":false,"context_lines":[{"line_number":233,"context_line":"                backend\u003ddefault_backend()"},{"line_number":234,"context_line":"            )"},{"line_number":235,"context_line":"        elif algorithm \u003d\u003d \u0027dsa\u0027:"},{"line_number":236,"context_line":"            warnings.warn("},{"line_number":237,"context_line":"                \"DSA key generation is deprecated per NIST SP 800-131A \""},{"line_number":238,"context_line":"                \"Rev.2. Consider using RSA or EC instead.\","},{"line_number":239,"context_line":"                DeprecationWarning,"},{"line_number":240,"context_line":"                stacklevel\u003d4"},{"line_number":241,"context_line":"            )"},{"line_number":242,"context_line":"            return dsa.generate_private_key("},{"line_number":243,"context_line":"                key_size\u003dgenerate_dto.bit_length,"},{"line_number":244,"context_line":"                backend\u003ddefault_backend()"}],"source_content_type":"text/x-python","patch_set":2,"id":"f31be399_ff005a82","line":241,"range":{"start_line":236,"start_character":12,"end_line":241,"end_character":13},"in_reply_to":"fb45ef41_ac49532e","updated":"2026-05-06 12:48:59.000000000","message":"Done","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"43397fadf0914b3d349e83f5a652f6085b8c53f9","unresolved":true,"context_lines":[{"line_number":238,"context_line":"                backend\u003ddefault_backend()"},{"line_number":239,"context_line":"            )"},{"line_number":240,"context_line":"        elif algorithm \u003d\u003d \u0027dsa\u0027:"},{"line_number":241,"context_line":"            LOG.warning("},{"line_number":242,"context_line":"                \"DSA key generation is deprecated per NIST SP 800-131A \""},{"line_number":243,"context_line":"                \"Rev.2. Consider using RSA or EC instead.\""},{"line_number":244,"context_line":"            )"},{"line_number":245,"context_line":"            return dsa.generate_private_key("},{"line_number":246,"context_line":"                key_size\u003dgenerate_dto.bit_length,"},{"line_number":247,"context_line":"                backend\u003ddefault_backend()"}],"source_content_type":"text/x-python","patch_set":3,"id":"2e49be8d_e99ff486","line":244,"range":{"start_line":241,"start_character":12,"end_line":244,"end_character":13},"updated":"2026-05-08 20:45:54.000000000","message":"The point in my previous comment is that a warning here would just go to the log - which is not visible to the user that is requesting the DSA key.  Therefore, it makes sense not to log anything at all here.\n\nAn warning in the log file makes more sense when the process is starting up and the admin is selecting to use DSA as a default key.  I notice that you have (correctly) added that warning to the init code.","commit_id":"429417a493d6bd51e3153be822c6e4f2f732332e"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"cdcdc3688066c20a891704324d5ec7e8b7652fff","unresolved":false,"context_lines":[{"line_number":238,"context_line":"                backend\u003ddefault_backend()"},{"line_number":239,"context_line":"            )"},{"line_number":240,"context_line":"        elif algorithm \u003d\u003d \u0027dsa\u0027:"},{"line_number":241,"context_line":"            LOG.warning("},{"line_number":242,"context_line":"                \"DSA key generation is deprecated per NIST SP 800-131A \""},{"line_number":243,"context_line":"                \"Rev.2. Consider using RSA or EC instead.\""},{"line_number":244,"context_line":"            )"},{"line_number":245,"context_line":"            return dsa.generate_private_key("},{"line_number":246,"context_line":"                key_size\u003dgenerate_dto.bit_length,"},{"line_number":247,"context_line":"                backend\u003ddefault_backend()"}],"source_content_type":"text/x-python","patch_set":3,"id":"8f14dcc8_414beea1","line":244,"range":{"start_line":241,"start_character":12,"end_line":244,"end_character":13},"in_reply_to":"2e49be8d_e99ff486","updated":"2026-05-11 10:46:54.000000000","message":"Done","commit_id":"429417a493d6bd51e3153be822c6e4f2f732332e"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"37e9d9d6f2aee862a529f8ce4136ca89f8fd6048","unresolved":true,"context_lines":[{"line_number":54,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":55,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":56,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":57,"context_line":"    cfg.StrOpt("},{"line_number":58,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":59,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":60,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":61,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":62,"context_line":"                 \u0027Supported values: RSA, DSA, EC. \u0027"},{"line_number":63,"context_line":"                 \u0027Note: DSA is deprecated per NIST SP 800-131A Rev.2.\u0027),"},{"line_number":64,"context_line":"    ),"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":67,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":4,"id":"b0eeff9f_197c4224","line":64,"range":{"start_line":57,"start_character":4,"end_line":64,"end_character":6},"updated":"2026-05-15 14:23:54.000000000","message":"I don\u0027t think we need to add a new option here.  `generate_asymmetric()` is called when an Order is being processed.  The Order request body specifies the algorithm, and if no algorithm is specified we should return a 400 instead of assuming a default algorithm.","commit_id":"dce1d1ca7e9900031cb3b5824666370871014bb0"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"5f3027c4326925eecb3e8515ca413a78b3b5a95b","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":55,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":56,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":57,"context_line":"    cfg.StrOpt("},{"line_number":58,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":59,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":60,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":61,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":62,"context_line":"                 \u0027Supported values: RSA, DSA, EC. \u0027"},{"line_number":63,"context_line":"                 \u0027Note: DSA is deprecated per NIST SP 800-131A Rev.2.\u0027),"},{"line_number":64,"context_line":"    ),"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":67,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":4,"id":"c6cfc2fd_a3bf4d39","line":64,"range":{"start_line":57,"start_character":4,"end_line":64,"end_character":6},"in_reply_to":"b0eeff9f_197c4224","updated":"2026-05-27 15:42:21.000000000","message":"Done. Removed the config option entirely. `generate_asymmetric()` now raises `CryptoPrivateKeyFailureException` if the algorithm is not specified in the order request, which will result in a 400 to the client. Thanks for the feedback!","commit_id":"dce1d1ca7e9900031cb3b5824666370871014bb0"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac217ebc91ebc529699d0432bbe6fde1a4f33c42","unresolved":true,"context_lines":[{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":62,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":63,"context_line":"                 \u0027Supported values: RSA, DSA, EC.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"985e897b_b85b2ec4","line":60,"range":{"start_line":60,"start_character":8,"end_line":60,"end_character":22},"updated":"2026-06-12 06:13:39.000000000","message":"Can we use lower cases here ? It may be consistent with the api input. (or add ignore_case\u003dTrue)\n\nAlso I\u0027d suggest adding `choices\u003d(\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027)` and remove reference to the supported values.","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"99af632d0b9570da7d1d74a0ac5a835528bd8e4c","unresolved":false,"context_lines":[{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":62,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":63,"context_line":"                 \u0027Supported values: RSA, DSA, EC.\u0027),"}],"source_content_type":"text/x-python","patch_set":10,"id":"c6621df6_b6d93a8b","line":60,"range":{"start_line":60,"start_character":8,"end_line":60,"end_character":22},"in_reply_to":"985e897b_b85b2ec4","updated":"2026-06-15 18:31:13.000000000","message":"Done. Added `ignore_case\u003dTrue` and `choices\u003d(\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027)`, and removed the \"Supported values\" from the help text since choices documents them.","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac217ebc91ebc529699d0432bbe6fde1a4f33c42","unresolved":true,"context_lines":[{"line_number":55,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":62,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":63,"context_line":"                 \u0027Supported values: RSA, DSA, EC.\u0027),"},{"line_number":64,"context_line":"    ),"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":67,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":10,"id":"965c7e7e_79d3659c","line":64,"range":{"start_line":58,"start_character":1,"end_line":64,"end_character":6},"updated":"2026-06-12 06:13:39.000000000","message":"We can implemented value validation by\n\n```\n    cfg.StrOpt(\n        \u0027asymmetric_key_default_algorithm\u0027,\n        default\u003d\u0027RSA\u0027,\n        ignore_case\u003dTrue,\n        choices\u003d(\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027),\n        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027\n                 \u0027API request does not specify one.\u0027),\n    ),\n```\n\nthen you don\u0027t need the validation logic at L88","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"0d6b5c6e0f576138a1539815b8d6d4dcf7ce2b2f","unresolved":true,"context_lines":[{"line_number":55,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":62,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":63,"context_line":"                 \u0027Supported values: RSA, DSA, EC.\u0027),"},{"line_number":64,"context_line":"    ),"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":67,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":10,"id":"a3095497_5d05563b","line":64,"range":{"start_line":58,"start_character":1,"end_line":64,"end_character":6},"in_reply_to":"965c7e7e_79d3659c","updated":"2026-06-12 14:59:55.000000000","message":"```suggestion\n    cfg.StrOpt(\n        \u0027asymmetric_key_default_algorithm\u0027,\n        default\u003d\u0027rsa\u0027,\n        ignore_case\u003dTrue,\n        choices\u003d(\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027),\n        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027\n                 \u0027API request does not specify one.\u0027),\n    ),\n```","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"99af632d0b9570da7d1d74a0ac5a835528bd8e4c","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":62,"context_line":"                 \u0027API request does not specify one. \u0027"},{"line_number":63,"context_line":"                 \u0027Supported values: RSA, DSA, EC.\u0027),"},{"line_number":64,"context_line":"    ),"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":67,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":10,"id":"9a7ca1d9_c9b75d96","line":64,"range":{"start_line":58,"start_character":1,"end_line":64,"end_character":6},"in_reply_to":"a3095497_5d05563b","updated":"2026-06-15 18:31:13.000000000","message":"Done. Replaced the manual validation block with oslo.config\u0027s choices parameter. The `__init__` now just does `.lower()` on the value.","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ac217ebc91ebc529699d0432bbe6fde1a4f33c42","unresolved":true,"context_lines":[{"line_number":75,"context_line":"class SimpleCryptoPlugin(c.CryptoPluginBase):"},{"line_number":76,"context_line":"    \"\"\"Insecure implementation of the crypto plugin.\"\"\""},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    _SUPPORTED_ASYMMETRIC_ALGORITHMS \u003d frozenset([\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027])"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    def __init__(self, conf\u003dCONF):"},{"line_number":81,"context_line":"        if not conf.simple_crypto_plugin.kek:"}],"source_content_type":"text/x-python","patch_set":10,"id":"a698a0b6_cba07356","line":78,"range":{"start_line":78,"start_character":49,"end_line":78,"end_character":69},"updated":"2026-06-12 06:13:39.000000000","message":"Can we use _SERIALIZATION_ENCODING.keys() here ?","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"99af632d0b9570da7d1d74a0ac5a835528bd8e4c","unresolved":false,"context_lines":[{"line_number":75,"context_line":"class SimpleCryptoPlugin(c.CryptoPluginBase):"},{"line_number":76,"context_line":"    \"\"\"Insecure implementation of the crypto plugin.\"\"\""},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    _SUPPORTED_ASYMMETRIC_ALGORITHMS \u003d frozenset([\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027])"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    def __init__(self, conf\u003dCONF):"},{"line_number":81,"context_line":"        if not conf.simple_crypto_plugin.kek:"}],"source_content_type":"text/x-python","patch_set":10,"id":"9850aacf_4c2f8870","line":78,"range":{"start_line":78,"start_character":49,"end_line":78,"end_character":69},"in_reply_to":"a698a0b6_cba07356","updated":"2026-06-15 18:31:13.000000000","message":"Done.","commit_id":"9d80b438b32321d21c375c2429a391afc9d5314a"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"aa0898cb26affa32cc381832ef7e68e1df48fb03","unresolved":false,"context_lines":[{"line_number":76,"context_line":"class SimpleCryptoPlugin(c.CryptoPluginBase):"},{"line_number":77,"context_line":"    \"\"\"Insecure implementation of the crypto plugin.\"\"\""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    _SUPPORTED_ASYMMETRIC_ALGORITHMS \u003d frozenset(_SERIALIZATION_ENCODING.keys())"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def __init__(self, conf\u003dCONF):"},{"line_number":82,"context_line":"        if not conf.simple_crypto_plugin.kek:"}],"source_content_type":"text/x-python","patch_set":11,"id":"3b8d5aea_7d58f791","line":79,"updated":"2026-06-15 20:00:28.000000000","message":"pep8: E501 line too long (80 \u003e 79 characters)","commit_id":"a48b4452dfbadd616d47a45c2854da66f019220c"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"fdf8949243fbf5c2431b35c0c734ef80777f29ac","unresolved":true,"context_lines":[{"line_number":55,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        ignore_case\u003dTrue,"},{"line_number":62,"context_line":"        choices\u003d(\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027),"},{"line_number":63,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":64,"context_line":"                 \u0027API request does not specify one.\u0027),"},{"line_number":65,"context_line":"    ),"},{"line_number":66,"context_line":"]"},{"line_number":67,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":68,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":12,"id":"4c58ca6c_05bec5c9","line":65,"range":{"start_line":58,"start_character":4,"end_line":65,"end_character":5},"updated":"2026-07-10 14:24:51.000000000","message":"We don\u0027t need to add a new option for this.  The algorithm should be required in the Order request, not assumed to be something in the conf file when it is missing.","commit_id":"36e78caec3f214fba8537687c476630fd2ed29fd"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"d297e83726ed08d03f3a17d98f199bc3ea750142","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    cfg.StrOpt(\u0027plugin_name\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027User friendly plugin name\u0027),"},{"line_number":57,"context_line":"               default\u003d\u0027Software Only Crypto\u0027),"},{"line_number":58,"context_line":"    cfg.StrOpt("},{"line_number":59,"context_line":"        \u0027asymmetric_key_default_algorithm\u0027,"},{"line_number":60,"context_line":"        default\u003d\u0027RSA\u0027,"},{"line_number":61,"context_line":"        ignore_case\u003dTrue,"},{"line_number":62,"context_line":"        choices\u003d(\u0027rsa\u0027, \u0027dsa\u0027, \u0027ec\u0027),"},{"line_number":63,"context_line":"        help\u003du._(\u0027Default algorithm for asymmetric key generation when the \u0027"},{"line_number":64,"context_line":"                 \u0027API request does not specify one.\u0027),"},{"line_number":65,"context_line":"    ),"},{"line_number":66,"context_line":"]"},{"line_number":67,"context_line":"CONF.register_group(simple_crypto_plugin_group)"},{"line_number":68,"context_line":"CONF.register_opts(simple_crypto_plugin_opts, group\u003dsimple_crypto_plugin_group)"}],"source_content_type":"text/x-python","patch_set":12,"id":"685b9516_a735ad0d","line":65,"range":{"start_line":58,"start_character":4,"end_line":65,"end_character":5},"in_reply_to":"4c58ca6c_05bec5c9","updated":"2026-07-17 15:59:21.000000000","message":"Done. `generate_asymmetric()` raises `CryptoPrivateKeyFailureException` when the algorithm is None, which results in a 400 to the client.","commit_id":"36e78caec3f214fba8537687c476630fd2ed29fd"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"dbc152f5ab92f35c22e9c2607705c596fb409bce","unresolved":true,"context_lines":[{"line_number":165,"context_line":"        \"\"\"Generate asymmetric keys."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"        Supported algorithms: RSA, DSA, EC."},{"line_number":168,"context_line":"        When the API request does not specify an algorithm, the configured"},{"line_number":169,"context_line":"        default (asymmetric_key_default_algorithm) is used."},{"line_number":170,"context_line":"        \"\"\""},{"line_number":171,"context_line":"        algorithm \u003d (generate_dto.algorithm.lower()"},{"line_number":172,"context_line":"                     if generate_dto.algorithm"}],"source_content_type":"text/x-python","patch_set":12,"id":"dacfa310_247b4649","line":169,"range":{"start_line":168,"start_character":8,"end_line":169,"end_character":59},"updated":"2026-07-10 14:25:56.000000000","message":"I think it would be better to return a 400 error when the algorithm is missing from the request.","commit_id":"36e78caec3f214fba8537687c476630fd2ed29fd"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"d297e83726ed08d03f3a17d98f199bc3ea750142","unresolved":false,"context_lines":[{"line_number":165,"context_line":"        \"\"\"Generate asymmetric keys."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"        Supported algorithms: RSA, DSA, EC."},{"line_number":168,"context_line":"        When the API request does not specify an algorithm, the configured"},{"line_number":169,"context_line":"        default (asymmetric_key_default_algorithm) is used."},{"line_number":170,"context_line":"        \"\"\""},{"line_number":171,"context_line":"        algorithm \u003d (generate_dto.algorithm.lower()"},{"line_number":172,"context_line":"                     if generate_dto.algorithm"}],"source_content_type":"text/x-python","patch_set":12,"id":"1b02cfe7_b731eff5","line":169,"range":{"start_line":168,"start_character":8,"end_line":169,"end_character":59},"in_reply_to":"dacfa310_247b4649","updated":"2026-07-17 15:59:21.000000000","message":"Done. The config option was removed in PS 5 and has not been re-introduced. The algorithm is now required in the Order request.","commit_id":"36e78caec3f214fba8537687c476630fd2ed29fd"}],"barbican/tests/plugin/crypto/test_crypto.py":[{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"fd45a8bec7edb3bc9724da37446e822fe4c9e97d","unresolved":true,"context_lines":[{"line_number":560,"context_line":"                                            private_dto.kek_meta_extended,"},{"line_number":561,"context_line":"                                            mock.MagicMock())"},{"line_number":562,"context_line":""},{"line_number":563,"context_line":"        private_key \u003d serialization.load_pem_private_key("},{"line_number":564,"context_line":"            data\u003dprivate_bytes,"},{"line_number":565,"context_line":"            password\u003db\u0027changeme\u0027,"},{"line_number":566,"context_line":"            backend\u003ddefault_backend()"}],"source_content_type":"text/x-python","patch_set":2,"id":"99f229ee_3b03771d","line":563,"range":{"start_line":563,"start_character":22,"end_line":563,"end_character":57},"updated":"2026-05-04 18:01:18.000000000","message":"Can we add a negative test here too.   That is attempt to load the private key either without or with bad password and catch the error.","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"7b60564fc956c73b5f3b6af5ce1d353b83521095","unresolved":false,"context_lines":[{"line_number":560,"context_line":"                                            private_dto.kek_meta_extended,"},{"line_number":561,"context_line":"                                            mock.MagicMock())"},{"line_number":562,"context_line":""},{"line_number":563,"context_line":"        private_key \u003d serialization.load_pem_private_key("},{"line_number":564,"context_line":"            data\u003dprivate_bytes,"},{"line_number":565,"context_line":"            password\u003db\u0027changeme\u0027,"},{"line_number":566,"context_line":"            backend\u003ddefault_backend()"}],"source_content_type":"text/x-python","patch_set":2,"id":"2f660a58_ba9632b3","line":563,"range":{"start_line":563,"start_character":22,"end_line":563,"end_character":57},"in_reply_to":"99f229ee_3b03771d","updated":"2026-05-06 12:48:59.000000000","message":"Done","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"fd45a8bec7edb3bc9724da37446e822fe4c9e97d","unresolved":true,"context_lines":[{"line_number":589,"context_line":"            generate_dto, kek_meta_dto, mock.MagicMock()"},{"line_number":590,"context_line":"        )"},{"line_number":591,"context_line":""},{"line_number":592,"context_line":"    def test_generate_asymmetric_uses_default_algorithm(self):"},{"line_number":593,"context_line":"        generate_dto \u003d plugin.GenerateDTO(None, 2048, None, None)"},{"line_number":594,"context_line":"        kek_meta_dto \u003d self._get_mocked_kek_meta_dto()"},{"line_number":595,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"0e769d3d_289be106","line":592,"range":{"start_line":592,"start_character":0,"end_line":592,"end_character":2},"updated":"2026-05-04 18:01:18.000000000","message":"This test silently assumes we have rsa as the default algorithm.  I would think that something that were testing the default algorithm would verify that the key that was generated would match the symmetric_key_default_algorithm.","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"7b60564fc956c73b5f3b6af5ce1d353b83521095","unresolved":false,"context_lines":[{"line_number":589,"context_line":"            generate_dto, kek_meta_dto, mock.MagicMock()"},{"line_number":590,"context_line":"        )"},{"line_number":591,"context_line":""},{"line_number":592,"context_line":"    def test_generate_asymmetric_uses_default_algorithm(self):"},{"line_number":593,"context_line":"        generate_dto \u003d plugin.GenerateDTO(None, 2048, None, None)"},{"line_number":594,"context_line":"        kek_meta_dto \u003d self._get_mocked_kek_meta_dto()"},{"line_number":595,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dbff96e4_96331db0","line":592,"range":{"start_line":592,"start_character":0,"end_line":592,"end_character":2},"in_reply_to":"0e769d3d_289be106","updated":"2026-05-06 12:48:59.000000000","message":"Done","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"fd45a8bec7edb3bc9724da37446e822fe4c9e97d","unresolved":true,"context_lines":[{"line_number":609,"context_line":"        )"},{"line_number":610,"context_line":"        self.assertEqual(2048, private_key.key_size)"},{"line_number":611,"context_line":""},{"line_number":612,"context_line":"    def test_dsa_generates_deprecation_warning(self):"},{"line_number":613,"context_line":"        generate_dto \u003d plugin.GenerateDTO(\u0027dsa\u0027, 1024, None, None)"},{"line_number":614,"context_line":"        kek_meta_dto \u003d self._get_mocked_kek_meta_dto()"},{"line_number":615,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9aca5c26_5ba2ea01","line":612,"range":{"start_line":612,"start_character":8,"end_line":612,"end_character":46},"updated":"2026-05-04 18:01:18.000000000","message":"See comment in SimpleCrypto code","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"7b60564fc956c73b5f3b6af5ce1d353b83521095","unresolved":false,"context_lines":[{"line_number":609,"context_line":"        )"},{"line_number":610,"context_line":"        self.assertEqual(2048, private_key.key_size)"},{"line_number":611,"context_line":""},{"line_number":612,"context_line":"    def test_dsa_generates_deprecation_warning(self):"},{"line_number":613,"context_line":"        generate_dto \u003d plugin.GenerateDTO(\u0027dsa\u0027, 1024, None, None)"},{"line_number":614,"context_line":"        kek_meta_dto \u003d self._get_mocked_kek_meta_dto()"},{"line_number":615,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"d5355d8d_29867fa6","line":612,"range":{"start_line":612,"start_character":8,"end_line":612,"end_character":46},"in_reply_to":"9aca5c26_5ba2ea01","updated":"2026-05-06 12:48:59.000000000","message":"Done","commit_id":"73c379617671bcad6404b09aee539f8fbd286d05"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"5a3789589b845c761880d1a2a7bf99962f212b23","unresolved":false,"context_lines":[{"line_number":661,"context_line":"    def test_get_plugin_name(self):"},{"line_number":662,"context_line":"        self.assertIsNotNone(self.plugin.get_plugin_name())"},{"line_number":663,"context_line":""},{"line_number":664,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"90648194_e0d12f48","line":664,"updated":"2026-07-10 17:05:14.000000000","message":"pep8: W391 blank line at end of file","commit_id":"53b0f197edf58b4ae6ad4de0d513e736df5c3b64"}],"releasenotes/notes/add-ec-asymmetric-crypto-agility-pqc-a1b2c3d4e5f6g7h8.yaml":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"852a6bfa4b655aa38d97e31182fafffa0c6a33ad","unresolved":true,"context_lines":[{"line_number":10,"context_line":"    The ``algorithm`` parameter is now mandatory in the asymmetric key"},{"line_number":11,"context_line":"    generation API request.  Requests that do not specify an algorithm will"},{"line_number":12,"context_line":"    receive a 400 error.  Previously, the algorithm defaulted to RSA."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"    The ``generate_asymmetric()`` method has been refactored into a dispatch"},{"line_number":15,"context_line":"    pattern via ``_generate_private_key()``, providing a single extension point"},{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"99aee20d_ef9e9120","line":17,"range":{"start_line":13,"start_character":0,"end_line":17,"end_character":64},"updated":"2026-06-03 14:12:28.000000000","message":"Release note is for cloud users or operators, and this implementation detail is not needed.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"11cdcd5f9dd92f7ed2f04c6baa0bcd6a06c058b0","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    The ``algorithm`` parameter is now mandatory in the asymmetric key"},{"line_number":11,"context_line":"    generation API request.  Requests that do not specify an algorithm will"},{"line_number":12,"context_line":"    receive a 400 error.  Previously, the algorithm defaulted to RSA."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"    The ``generate_asymmetric()`` method has been refactored into a dispatch"},{"line_number":15,"context_line":"    pattern via ``_generate_private_key()``, providing a single extension point"},{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"56de0f07_8f846e40","line":17,"range":{"start_line":13,"start_character":0,"end_line":17,"end_character":64},"in_reply_to":"99aee20d_ef9e9120","updated":"2026-06-04 13:22:54.000000000","message":"Done. Removed the internal refactoring details from the release note.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"852a6bfa4b655aa38d97e31182fafffa0c6a33ad","unresolved":true,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"c1bf83e0_0196c1a5","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"updated":"2026-06-03 14:12:28.000000000","message":"Doesn\u0027t this immediately break any external tools that creates secret order without this parameter ? This causes huge client impact and should be avoided IMHO.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"5118821913de3379a573c3e09826ce8811b92288","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"47518c80_af44c4ca","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"in_reply_to":"12a87b54_6292b235","updated":"2026-06-05 12:12:22.000000000","message":"You are right, and I apologize for the unnecessary churn. I misunderstood your earlier feedback and went down the wrong path with the deprecation approach.\n\nChanges in this patchset:\n* The implicit RSA default is preserved silently, with no deprecation warning and no plan to remove it.\n* RSA and DSA remain fully functional. No algorithm is being removed or restricted.\n* Removed the runtime `DeprecationWarning` on DSA key generation, per your and  earlier feedback that these warnings are only visible to operators and do not help users.\n* The release note mentions DSA deprecation per NIST SP 800-131A Rev.2 for informational purposes only. DSA continues to work.\n* Removed the upgrade section and algorithm-omission deprecation notice from the release note.\n\nThe scope of this patch remains: add EC key generation support and refactor the dispatch for future extensibility. No behavioral change for existing users.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"4a7bf90b899cbd4cb0781fa85d02c4da88ae6c1d","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"c2057632_9a709539","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"in_reply_to":"3dc16c20_e8f3e24e","updated":"2026-06-11 19:24:50.000000000","message":"Done. Removed all DSA deprecation references: the deprecation note from the upgrade section, the entire deprecations section from the release note, the `LOG.warning` on DSA default in init, and the two related bullet points from the commit message. Also removed the refactoring implementation detail from the features section that was missed in patchset 8.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"693a471f68790cdabaf1fb8fb5954bc7f57a93d5","unresolved":true,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3dc16c20_e8f3e24e","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"in_reply_to":"47518c80_af44c4ca","updated":"2026-06-05 14:11:53.000000000","message":"OK. In case we see problems in the future (like the ones we had in the past with weak key length RSA) we can separately discuss deprecation and removal.\n\nThere are still a few remaining reference to deprecation of DSA support in the commit message and the release note. Can we remove these ?","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"4759fd948b6cd53bd577d9cd1c771ba7adbef0b1","unresolved":true,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"12a87b54_6292b235","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"in_reply_to":"5875ddea_9420ea9b","updated":"2026-06-04 14:46:57.000000000","message":"Alternatively you can implement \"v2\" API for this, to clearly tell backword incompatibility, though that\u0027d be too large work than intended.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f7b7b526e4d6b3a2195f1b8d60ee07c3ffcfdad2","unresolved":true,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"5875ddea_9420ea9b","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"in_reply_to":"9dc83103_078fa72b","updated":"2026-06-04 14:45:31.000000000","message":"The problem with that deprecation is that it impacts users while these warnings are only visible to operators. Can\u0027t we just keep RSA and DSA instead of removing these ? I know these are \"week\" but users can still use these by their own risk. I don\u0027t see any large benefit really in cloud service use case to restrict algorithm for \"better security practice\", breaking existing usage.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"11cdcd5f9dd92f7ed2f04c6baa0bcd6a06c058b0","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    for future algorithm additions (e.g. ML-KEM, ML-DSA when"},{"line_number":17,"context_line":"    pyca/cryptography adds support for post-quantum algorithms)."},{"line_number":18,"context_line":"upgrade:"},{"line_number":19,"context_line":"  - |"},{"line_number":20,"context_line":"    The ``algorithm`` parameter is now **required** in asymmetric key"},{"line_number":21,"context_line":"    generation API requests.  Existing clients that relied on the implicit"},{"line_number":22,"context_line":"    RSA default must be updated to explicitly pass ``algorithm\u003dRSA`` (or"},{"line_number":23,"context_line":"    ``DSA``, ``EC``) in the order metadata."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"9dc83103_078fa72b","line":21,"range":{"start_line":19,"start_character":5,"end_line":21,"end_character":28},"in_reply_to":"c1bf83e0_0196c1a5","updated":"2026-06-04 13:22:54.000000000","message":"Done. Restored backward compatibility: requests without an algorithm now default to RSA (preserving the previous behavior) with a deprecation warning in the log. The implicit default will be removed in a future release, following the standard deprecate-then-remove cycle.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"852a6bfa4b655aa38d97e31182fafffa0c6a33ad","unresolved":true,"context_lines":[{"line_number":28,"context_line":"    currently using DSA should plan to migrate to RSA or EC."},{"line_number":29,"context_line":"deprecations:"},{"line_number":30,"context_line":"  - |"},{"line_number":31,"context_line":"    DSA key generation in the SimpleCrypto plugin now emits a"},{"line_number":32,"context_line":"    ``DeprecationWarning``.  DSA is deprecated per NIST SP 800-131A Rev.2."},{"line_number":33,"context_line":"    Operators should migrate to RSA or EC for asymmetric key generation."}],"source_content_type":"text/x-yaml","patch_set":7,"id":"51a19bd7_9f484700","line":32,"range":{"start_line":31,"start_character":4,"end_line":32,"end_character":28},"updated":"2026-06-03 14:12:28.000000000","message":"This is too much internal behavior. Can we just mention it\u0027s deprecated ?","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"11cdcd5f9dd92f7ed2f04c6baa0bcd6a06c058b0","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    currently using DSA should plan to migrate to RSA or EC."},{"line_number":29,"context_line":"deprecations:"},{"line_number":30,"context_line":"  - |"},{"line_number":31,"context_line":"    DSA key generation in the SimpleCrypto plugin now emits a"},{"line_number":32,"context_line":"    ``DeprecationWarning``.  DSA is deprecated per NIST SP 800-131A Rev.2."},{"line_number":33,"context_line":"    Operators should migrate to RSA or EC for asymmetric key generation."}],"source_content_type":"text/x-yaml","patch_set":7,"id":"0200fb99_12b8c195","line":32,"range":{"start_line":31,"start_character":4,"end_line":32,"end_character":28},"in_reply_to":"51a19bd7_9f484700","updated":"2026-06-04 13:22:54.000000000","message":"Done. Simplified to just state it is deprecated.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"852a6bfa4b655aa38d97e31182fafffa0c6a33ad","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":7,"id":"b98d09bf_37fbcb5f","line":34,"range":{"start_line":33,"start_character":4,"end_line":34,"end_character":2},"updated":"2026-06-03 14:12:28.000000000","message":"This impacts not only operators but also users (assuming secret order can be created by any cloud user).","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"11cdcd5f9dd92f7ed2f04c6baa0bcd6a06c058b0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"8d6de883_9e491944","line":34,"range":{"start_line":33,"start_character":4,"end_line":34,"end_character":2},"in_reply_to":"b98d09bf_37fbcb5f","updated":"2026-06-04 13:22:54.000000000","message":"Done. Changed audience to \"Users and operators\" throughout.","commit_id":"0e781d60c63a214738b39bd1600bb16b4f1d8216"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"cf3098f94c9ecc38295b632cb9bdc8b681bb2d14","unresolved":true,"context_lines":[{"line_number":8,"context_line":"    respectively).  The default algorithm when none is specified remains RSA."},{"line_number":9,"context_line":"deprecations:"},{"line_number":10,"context_line":"  - |"},{"line_number":11,"context_line":"    DSA key generation is now deprecated.  Users and operators should migrate"},{"line_number":12,"context_line":"    to RSA or EC for asymmetric key generation."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"aff6b254_6935f439","line":12,"range":{"start_line":11,"start_character":4,"end_line":12,"end_character":47},"updated":"2026-06-08 21:06:19.000000000","message":"Agreed.  This should be removed.  As well as the comment in the commit message.","commit_id":"43c33cfa5cbe783fe77d7ec21d6e48cab9f8f57d"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"4a7bf90b899cbd4cb0781fa85d02c4da88ae6c1d","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    respectively).  The default algorithm when none is specified remains RSA."},{"line_number":9,"context_line":"deprecations:"},{"line_number":10,"context_line":"  - |"},{"line_number":11,"context_line":"    DSA key generation is now deprecated.  Users and operators should migrate"},{"line_number":12,"context_line":"    to RSA or EC for asymmetric key generation."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"b2318fa0_7091c805","line":12,"range":{"start_line":11,"start_character":4,"end_line":12,"end_character":47},"in_reply_to":"aff6b254_6935f439","updated":"2026-06-11 19:24:50.000000000","message":"Done, thanks!","commit_id":"43c33cfa5cbe783fe77d7ec21d6e48cab9f8f57d"}]}