)]}'
{"specs/rocky/support-image-signature-verification.rst":[{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"a20e6f404a6d89c9465e5a9e6eba2b2e320324c1","unresolved":false,"context_lines":[{"line_number":338,"context_line":"_`[1]` https://review.openstack.org/#/c/252462/"},{"line_number":339,"context_line":"_`[2]` https://en.wikipedia.org/wiki/MD5#Security"},{"line_number":340,"context_line":"_`[3]` https://blueprints.launchpad.net/cinder/+spec/summarymessage"},{"line_number":341,"context_line":"_`[4]` https://github.com/openstack/cursive"},{"line_number":342,"context_line":"_`[5]` http://specs.openstack.org/openstack/nova-specs/specs/queens/approved/nova-validate-certificates.html"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3fa0c359_f801716b","line":341,"range":{"start_line":341,"start_character":7,"end_line":341,"end_character":43},"updated":"2018-02-12 16:12:17.000000000","message":"https://git.openstack.org/cgit/openstack/cursive is the correct home for cursive, not github.","commit_id":"b64a61b4ddfdd9f2ea0386cf0923e74a5639d9f0"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1309cb7c90bb96d1b33849b085aa07e70a8e3409","unresolved":false,"context_lines":[{"line_number":338,"context_line":"_`[1]` https://review.openstack.org/#/c/252462/"},{"line_number":339,"context_line":"_`[2]` https://en.wikipedia.org/wiki/MD5#Security"},{"line_number":340,"context_line":"_`[3]` https://blueprints.launchpad.net/cinder/+spec/summarymessage"},{"line_number":341,"context_line":"_`[4]` https://github.com/openstack/cursive"},{"line_number":342,"context_line":"_`[5]` http://specs.openstack.org/openstack/nova-specs/specs/queens/approved/nova-validate-certificates.html"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3fa0c359_b9ac419f","line":341,"range":{"start_line":341,"start_character":7,"end_line":341,"end_character":43},"in_reply_to":"3fa0c359_f801716b","updated":"2018-02-13 02:51:10.000000000","message":"Done","commit_id":"b64a61b4ddfdd9f2ea0386cf0923e74a5639d9f0"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Previously, OpenStack\u0027s protection against unexpected modification of images"},{"line_number":25,"context_line":"is limited to verifying an MD5 checksum. While this may be sufficient for"},{"line_number":26,"context_line":"protecting against accidental modifications, MD5 is a hash function, not an"},{"line_number":27,"context_line":"authentication primitive `[2]`_, and thus provides no protection against"},{"line_number":28,"context_line":"deliberate, malicious modification of images. An image could potentially be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_a227cd12","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":2},"updated":"2018-03-09 00:33:57.000000000","message":"was","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":29,"context_line":"modified in transit, such as when it is uploaded to Glance or transferred to"},{"line_number":30,"context_line":"Cinder. An image that is modified could include malicious code."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Currently, Glance has supported image signature verification upon upload,"},{"line_number":33,"context_line":"but Cinder does not support the feature to ensure the integrity of the image"},{"line_number":34,"context_line":"data before using it. Providing support for signature verification would allow"},{"line_number":35,"context_line":"Cinder to verify the signature before creating volume from image. This feature"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_22797dfb","line":32,"range":{"start_line":32,"start_character":22,"end_line":32,"end_character":31},"updated":"2018-03-09 00:33:57.000000000","message":"support for","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* A user wants a high degree of assurance that a customized image which they"},{"line_number":60,"context_line":"  have uploaded to Glance has not been accidentally or maliciously modified"},{"line_number":61,"context_line":"  prior to creating volume from the image."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"With this proposed change, Cinder will verify the signature of a signed image"},{"line_number":64,"context_line":"while downloading that image. If the image signature can not be verified, then"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_8273a915","line":61,"range":{"start_line":61,"start_character":11,"end_line":61,"end_character":26},"updated":"2018-03-09 00:33:57.000000000","message":"creating a volume","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"With this proposed change, Cinder will verify the signature of a signed image"},{"line_number":64,"context_line":"while downloading that image. If the image signature can not be verified, then"},{"line_number":65,"context_line":"Cinder will not create volume from the image and instead place the volume into"},{"line_number":66,"context_line":"an error state. The user will begin to use this feature by uploading the image"},{"line_number":67,"context_line":"and the image signature metadata to Glance via the Glance API\u0027s image-create"},{"line_number":68,"context_line":"method. The required image signature metadata properties are as follows:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_a2558d52","line":65,"range":{"start_line":65,"start_character":16,"end_line":65,"end_character":34},"updated":"2018-03-09 00:33:57.000000000","message":"create a volume from","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":100,"context_line":"exception. If signature verification succeeds, Cinder will create volume"},{"line_number":101,"context_line":"from the image and log a message indicating that image signature verification"},{"line_number":102,"context_line":"succeeded along with detailed information about the signing certificate."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Proposed change"},{"line_number":105,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_62abf51c","line":103,"updated":"2018-03-09 00:33:57.000000000","message":"Also need to talk about an option for strict checking here for end users that want to require image signing and to cover the case where someone maliciously deletes the signature.  I.E. glance_signatures_strict_checking .  Can default to False.","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":150,"context_line":"    except cryptography.exceptions.InvalidSignature:"},{"line_number":151,"context_line":"        #Image signature verification failed"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Nova will verify the content when image is downloaded from"},{"line_number":154,"context_line":"glance, compared with Cinder, we have different approaches"},{"line_number":155,"context_line":"at different layers when creating volume from images, the"},{"line_number":156,"context_line":"most secure way to verify image signature is to attach the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_a276edd7","line":153,"range":{"start_line":153,"start_character":29,"end_line":153,"end_character":39},"updated":"2018-03-09 00:33:57.000000000","message":"when the image","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":157,"context_line":"volume, read the content and verify the image signature"},{"line_number":158,"context_line":"every time no matter the volume is created from download"},{"line_number":159,"context_line":"image, cached volume or cloned by driver. This can be"},{"line_number":160,"context_line":"discussable as it has a performance impact as well as"},{"line_number":161,"context_line":"redundant for cached volume."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"**Verify certificate with trusted certificates**"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_224c1d9d","line":160,"range":{"start_line":160,"start_character":0,"end_line":160,"end_character":11},"updated":"2018-03-09 00:33:57.000000000","message":"discussed","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":"**Verify certificate with trusted certificates**"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"This feature try to find a way to determine if the certificate"},{"line_number":166,"context_line":"used to generate and verify that signature is a certificate that"},{"line_number":167,"context_line":"is trusted by the user, we could find more detail in Nova spec `[5]`_,"},{"line_number":168,"context_line":"in short, within that feature end user can also validate the image\u0027s"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_c25c414d","line":165,"range":{"start_line":165,"start_character":13,"end_line":165,"end_character":16},"updated":"2018-03-09 00:33:57.000000000","message":"tries","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":209,"context_line":"has specified creating a volume of the volume type which includes"},{"line_number":210,"context_line":"\"verify_glance_signatures\u003dTrue\" type-key."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"Another alternative to using the verify_glance_signatures configuration flag"},{"line_number":213,"context_line":"to specify that Cinder should perform image signature verification is amending"},{"line_number":214,"context_line":"the Cinder create command to accept an additional parameter specifying whether"},{"line_number":215,"context_line":"image signature verification should occur. This may be added in a later"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_a20d8d3f","line":212,"updated":"2018-03-09 00:33:57.000000000","message":"Would prefer to not due this.  Don\u0027t need to keep piling more options in create.","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5d7909abfc0319654139727b37a4594564c6beb7","unresolved":false,"context_lines":[{"line_number":264,"context_line":"If the verification of a signature fails, then Cinder will not create a"},{"line_number":265,"context_line":"volume from the image, and an error message will be logged and recorded."},{"line_number":266,"context_line":"The user can get the error messages through the log file or CLI command,"},{"line_number":267,"context_line":"and know the reason for the error. In this case, the use have to edit the"},{"line_number":268,"context_line":"image\u0027s metadata through the Glance API, or the Horizon interface;"},{"line_number":269,"context_line":"or reinitiate an upload of the image to Glance with the correct signature"},{"line_number":270,"context_line":"metadata in order to create a volume from the image."}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_452d9b93","line":267,"range":{"start_line":267,"start_character":49,"end_line":267,"end_character":64},"updated":"2018-03-09 00:33:57.000000000","message":"the user will have to","commit_id":"a284f606698db086537ab5a87759168acadbed0d"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"86997b7dd89e55b2f81c552117a1014d97703946","unresolved":false,"context_lines":[{"line_number":29,"context_line":"modified in transit, such as when it is uploaded to Glance or transferred to"},{"line_number":30,"context_line":"Cinder. An image that is modified could include malicious code."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Currently, Glance has supported for image signature verification upon upload,"},{"line_number":33,"context_line":"but Cinder does not support the feature to ensure the integrity of the image"},{"line_number":34,"context_line":"data before using it. Providing support for signature verification would allow"},{"line_number":35,"context_line":"Cinder to verify the signature before creating volume from image. This feature"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_c890654d","line":32,"range":{"start_line":32,"start_character":22,"end_line":32,"end_character":31},"updated":"2018-03-14 15:29:14.000000000","message":"support","commit_id":"e1b083f57c8c625ac5433c8cbd7282784b87a8a2"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"946c7bb509dba9b9890b68fb93926562b3928150","unresolved":false,"context_lines":[{"line_number":122,"context_line":"3. ``disabled``: verification is turned off."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Upon downloading an image, Cinder will both check the new configuration"},{"line_number":125,"context_line":"flag and image\u0027s metadata. If needs , the module will perform image signature"},{"line_number":126,"context_line":"verification using image properties passed to Cinder by Glance. If this fails,"},{"line_number":127,"context_line":"or if the image signature metadata is incomplete or missing, Cinder will not"},{"line_number":128,"context_line":"create the volume from the image. Instead, Cinder will throw an exception and"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_0dbaef08","line":125,"range":{"start_line":125,"start_character":35,"end_line":125,"end_character":37},"updated":"2018-03-14 14:48:11.000000000","message":"nit: extra space before the , can be removed if you do another update.","commit_id":"e1b083f57c8c625ac5433c8cbd7282784b87a8a2"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"946c7bb509dba9b9890b68fb93926562b3928150","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    img_sig_key_type \u003d image_meta.properties.get("},{"line_number":147,"context_line":"        \u0027img_signature_key_type\u0027"},{"line_number":148,"context_line":"    )"},{"line_number":149,"context_line":"    if"},{"line_number":150,"context_line":"    try:"},{"line_number":151,"context_line":"        verifier \u003d signature_utils.get_verifier("},{"line_number":152,"context_line":"            context\u003dcontext,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_2d4c9340","line":149,"range":{"start_line":149,"start_character":4,"end_line":149,"end_character":6},"updated":"2018-03-14 14:48:11.000000000","message":"?","commit_id":"e1b083f57c8c625ac5433c8cbd7282784b87a8a2"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"946c7bb509dba9b9890b68fb93926562b3928150","unresolved":false,"context_lines":[{"line_number":166,"context_line":"Nova will verify the content when the image is downloaded from"},{"line_number":167,"context_line":"glance, compared with Cinder, we have different approaches"},{"line_number":168,"context_line":"at different layers when creating volume from images, so we"},{"line_number":169,"context_line":"have to mention this feature will not cover every approaches"},{"line_number":170,"context_line":"especially when volume is created at backend, to be clear, we"},{"line_number":171,"context_line":"will verify the image\u0027s signature only when image is downloaded"},{"line_number":172,"context_line":"from glance and content is copied to volume on host."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_6d57ebcb","line":169,"range":{"start_line":169,"start_character":50,"end_line":169,"end_character":60},"updated":"2018-03-14 14:48:11.000000000","message":"approach,","commit_id":"e1b083f57c8c625ac5433c8cbd7282784b87a8a2"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"946c7bb509dba9b9890b68fb93926562b3928150","unresolved":false,"context_lines":[{"line_number":167,"context_line":"glance, compared with Cinder, we have different approaches"},{"line_number":168,"context_line":"at different layers when creating volume from images, so we"},{"line_number":169,"context_line":"have to mention this feature will not cover every approaches"},{"line_number":170,"context_line":"especially when volume is created at backend, to be clear, we"},{"line_number":171,"context_line":"will verify the image\u0027s signature only when image is downloaded"},{"line_number":172,"context_line":"from glance and content is copied to volume on host."},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_4d72277d","line":170,"range":{"start_line":170,"start_character":44,"end_line":170,"end_character":47},"updated":"2018-03-14 14:48:11.000000000","message":". To be clear....","commit_id":"e1b083f57c8c625ac5433c8cbd7282784b87a8a2"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"946c7bb509dba9b9890b68fb93926562b3928150","unresolved":false,"context_lines":[{"line_number":275,"context_line":"If the verification of a signature fails, then Cinder will not create a"},{"line_number":276,"context_line":"volume from the image, and an error message will be logged and recorded."},{"line_number":277,"context_line":"The user can get the error messages through the log file or CLI command,"},{"line_number":278,"context_line":"and know the reason for the error. In this case, the use will have to edit the"},{"line_number":279,"context_line":"image\u0027s metadata through the Glance API, or the Horizon interface;"},{"line_number":280,"context_line":"or reinitiate an upload of the image to Glance with the correct signature"},{"line_number":281,"context_line":"metadata in order to create a volume from the image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_2dfa53bc","line":278,"range":{"start_line":278,"start_character":53,"end_line":278,"end_character":56},"updated":"2018-03-14 14:48:11.000000000","message":"user","commit_id":"e1b083f57c8c625ac5433c8cbd7282784b87a8a2"},{"author":{"_account_id":1207,"name":"Duncan Thomas","email":"duncan.thomas@gmail.com","username":"duncan-thomas"},"change_message_id":"e28d70f55b49bfb818f2aea9eabd34dbbdd19550","unresolved":false,"context_lines":[{"line_number":168,"context_line":"have to mention this feature will not cover every approach"},{"line_number":169,"context_line":"especially when volume is created at backend. To be clear, we"},{"line_number":170,"context_line":"will verify the image\u0027s signature only when image is downloaded"},{"line_number":171,"context_line":"from glance and content is copied to volume on host. In order"},{"line_number":172,"context_line":"to supply whether we verified this image when creating to end"},{"line_number":173,"context_line":"user, we will add this into volume\u0027s glance metadata as well."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"**Verify certificate with trusted certificates**"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_5b860ede","line":173,"range":{"start_line":171,"start_character":53,"end_line":173,"end_character":61},"updated":"2018-03-17 23:11:38.000000000","message":"This data isn\u0027t available to the end user directly, is it? I guess we\u0027ll need to do a small API change to return it via volume show or something if not.","commit_id":"311ccf88290acdb95b0b22428769e370f00063e2"},{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"efaec75729ad1fe49fc76fbb18e300d594a0b8ea","unresolved":false,"context_lines":[{"line_number":298,"context_line":"In order to use this feature, a key manager must be deployed and configured."},{"line_number":299,"context_line":"Additionally, Cinder must be configured to use a root certificate which has a"},{"line_number":300,"context_line":"root of trust that can respond to an end user\u0027s certificate signing requests."},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Developer impact"},{"line_number":303,"context_line":"----------------"},{"line_number":304,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_9bf48fd1","line":301,"updated":"2018-03-19 14:57:43.000000000","message":"Does this require a deployment with Barbican to use this feature at all?\n\nhttps://docs.openstack.org/glance/pike/user/signature.html implies so","commit_id":"311ccf88290acdb95b0b22428769e370f00063e2"},{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"2f97b030fdec37689bf09c215127958604dce8f3","unresolved":false,"context_lines":[{"line_number":116,"context_line":"configuration ``verify_glance_signatures`` to turn this on or off."},{"line_number":117,"context_line":"Initially it will have two options (default is ``optional``):"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"1. ``optional``: verify when image has complete signature metadata."},{"line_number":120,"context_line":"2. ``disabled``: verification is turned off."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"**NOTE**: We have discussed to add ``required`` option to introduce a"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf659307_8fb6b03d","line":119,"updated":"2018-04-04 13:37:06.000000000","message":"I think \"optional\" is an odd thing to call this given that there are only two options -- could we just use \"enabled\" instead, which still gives room to add \"strict\" or \"required\" later?\n\n\"optional\" is more confusing than it needs to be IMO.","commit_id":"a397ff2856c5d9c0045a0a274be1d725e7594f25"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"ba97c9e19c7e61c74918904a1ecb1fa922d15053","unresolved":false,"context_lines":[{"line_number":119,"context_line":"1. ``optional``: verify when image has complete signature metadata."},{"line_number":120,"context_line":"2. ``disabled``: verification is turned off."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"**NOTE**: We have discussed to add ``required`` option to introduce a"},{"line_number":123,"context_line":"strict mode on verification, but this can\u0027t be guaranteed as we can\u0027t"},{"line_number":124,"context_line":"do verification when image volume is cloned in backend. Strict mode will"},{"line_number":125,"context_line":"still be considered when we can cover every approach."}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf659307_5ce5ff07","line":122,"updated":"2018-03-30 17:17:45.000000000","message":"Thanks for including this background in here.","commit_id":"a397ff2856c5d9c0045a0a274be1d725e7594f25"},{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"a7b31a6e6be01c83b2dfbeadc5a089148f730f1a","unresolved":false,"context_lines":[{"line_number":122,"context_line":"**NOTE**: We have discussed to add ``required`` option to introduce a"},{"line_number":123,"context_line":"strict mode on verification, but this can\u0027t be guaranteed as we can\u0027t"},{"line_number":124,"context_line":"do verification when image volume is cloned in backend. Strict mode will"},{"line_number":125,"context_line":"still be considered when we can cover every approach."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Upon downloading an image, Cinder will both check the new configuration"},{"line_number":128,"context_line":"flag and image\u0027s metadata. If needs, the module will perform image signature"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf659307_44d46120","line":125,"updated":"2018-04-11 16:09:31.000000000","message":"Not keeping this?","commit_id":"a397ff2856c5d9c0045a0a274be1d725e7594f25"},{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"a7b31a6e6be01c83b2dfbeadc5a089148f730f1a","unresolved":false,"context_lines":[{"line_number":123,"context_line":"log an error. If the signature verification succeeds, Cinder will proceed with"},{"line_number":124,"context_line":"creating the volume. The code sample is below::"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":" if CONF.glance.verify_glance_signatures:"},{"line_number":127,"context_line":"    verifier \u003d None"},{"line_number":128,"context_line":"    image_meta_dict \u003d self.show(context, image_id,"},{"line_number":129,"context_line":"                                include_locations\u003dFalse)"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf659307_a4153de7","line":126,"updated":"2018-04-11 16:09:31.000000000","message":"I don\u0027t think we want this to be a boolean, I think we want it to be a string so we can possibly add a third \"strict\" mode later.","commit_id":"fcd6017b6ed82a2c6d5a0f5d303b1c600cb015af"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"605c9cdcb7cd6bb9768c56415146bdfdc17b1065","unresolved":false,"context_lines":[{"line_number":123,"context_line":"log an error. If the signature verification succeeds, Cinder will proceed with"},{"line_number":124,"context_line":"creating the volume. The code sample is below::"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":" if CONF.glance.verify_glance_signatures:"},{"line_number":127,"context_line":"    verifier \u003d None"},{"line_number":128,"context_line":"    image_meta_dict \u003d self.show(context, image_id,"},{"line_number":129,"context_line":"                                include_locations\u003dFalse)"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf659307_a471bd46","line":126,"in_reply_to":"bf659307_a4153de7","updated":"2018-04-11 16:15:47.000000000","message":"That is a good point. I do think that would be good for long term flexibility.","commit_id":"fcd6017b6ed82a2c6d5a0f5d303b1c600cb015af"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":61,"context_line":"  prior to creating a volume from the image."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"With this proposed change, Cinder will verify the signature of a signed image"},{"line_number":64,"context_line":"while downloading that image. If the image signature can not be verified, then"},{"line_number":65,"context_line":"Cinder will not create a volume from the image and instead place the volume"},{"line_number":66,"context_line":"into an error state. The user will begin to use this feature by uploading the"},{"line_number":67,"context_line":"image and the image signature metadata to Glance via the Glance API\u0027s"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_81fa9072","line":64,"range":{"start_line":64,"start_character":53,"end_line":64,"end_character":60},"updated":"2018-04-19 16:34:54.000000000","message":"cannot","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":61,"context_line":"  prior to creating a volume from the image."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"With this proposed change, Cinder will verify the signature of a signed image"},{"line_number":64,"context_line":"while downloading that image. If the image signature can not be verified, then"},{"line_number":65,"context_line":"Cinder will not create a volume from the image and instead place the volume"},{"line_number":66,"context_line":"into an error state. The user will begin to use this feature by uploading the"},{"line_number":67,"context_line":"image and the image signature metadata to Glance via the Glance API\u0027s"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_8a437b6c","line":64,"range":{"start_line":64,"start_character":53,"end_line":64,"end_character":60},"in_reply_to":"9f6a8fd7_81fa9072","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  supported for this field. Any image signed with an unsupported hash"},{"line_number":78,"context_line":"  algorithm will not pass validation."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* img_signature_key_type - A string designating the signature scheme used to"},{"line_number":81,"context_line":"  generate the signature."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* img_signature_certificate_uuid - A string encoding the certificate"},{"line_number":84,"context_line":"  uuid used to retrieve the certificate from the key manager."}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_a151d464","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":25},"updated":"2018-04-19 16:34:54.000000000","message":"Is there a limited list of schemes that may be used?","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  supported for this field. Any image signed with an unsupported hash"},{"line_number":78,"context_line":"  algorithm will not pass validation."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* img_signature_key_type - A string designating the signature scheme used to"},{"line_number":81,"context_line":"  generate the signature."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* img_signature_certificate_uuid - A string encoding the certificate"},{"line_number":84,"context_line":"  uuid used to retrieve the certificate from the key manager."}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_ca4df39a","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":25},"in_reply_to":"9f6a8fd7_a151d464","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":87,"context_line":"cursive.signature_utils module to verify this signature metadata before"},{"line_number":88,"context_line":"storing the image. If the signature is not valid or the metadata is"},{"line_number":89,"context_line":"incomplete, this API method will return a 400 error status and put"},{"line_number":90,"context_line":"the image into a \"killed\" state. Note that, if the signature metadata"},{"line_number":91,"context_line":"is simply not present, the image will be stored as it would normally."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The user would then create a volume from this image using the Cinder API\u0027s"},{"line_number":94,"context_line":"volume create method. If the verify_glance_signatures flag in cinder.conf is"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_8104d04b","line":91,"range":{"start_line":90,"start_character":33,"end_line":91,"end_character":68},"updated":"2018-04-19 16:34:54.000000000","message":"It would be nice to expand the verfiy_glance_signatures flag to image storage so that an image cannot be stored if no signature metadata is provided when it\u0027s should have been","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":87,"context_line":"cursive.signature_utils module to verify this signature metadata before"},{"line_number":88,"context_line":"storing the image. If the signature is not valid or the metadata is"},{"line_number":89,"context_line":"incomplete, this API method will return a 400 error status and put"},{"line_number":90,"context_line":"the image into a \"killed\" state. Note that, if the signature metadata"},{"line_number":91,"context_line":"is simply not present, the image will be stored as it would normally."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The user would then create a volume from this image using the Cinder API\u0027s"},{"line_number":94,"context_line":"volume create method. If the verify_glance_signatures flag in cinder.conf is"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_ea20f7ae","line":91,"range":{"start_line":90,"start_character":33,"end_line":91,"end_character":68},"in_reply_to":"9f6a8fd7_8104d04b","updated":"2018-04-20 03:16:26.000000000","message":"We have discussed to introduce the strict mode for verify_glance_signatures, but agreed to add this later while now only keep two options disabled and enabled. and this will be discussed below.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"6b39d58efbff25b1dba0bd220e6fdaf63ae125cd","unresolved":false,"context_lines":[{"line_number":87,"context_line":"cursive.signature_utils module to verify this signature metadata before"},{"line_number":88,"context_line":"storing the image. If the signature is not valid or the metadata is"},{"line_number":89,"context_line":"incomplete, this API method will return a 400 error status and put"},{"line_number":90,"context_line":"the image into a \"killed\" state. Note that, if the signature metadata"},{"line_number":91,"context_line":"is simply not present, the image will be stored as it would normally."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The user would then create a volume from this image using the Cinder API\u0027s"},{"line_number":94,"context_line":"volume create method. If the verify_glance_signatures flag in cinder.conf is"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_6d75e1ca","line":91,"range":{"start_line":90,"start_character":33,"end_line":91,"end_character":68},"in_reply_to":"9f6a8fd7_ea20f7ae","updated":"2018-04-20 03:53:47.000000000","message":"Ah yes, right. Sorry, I forgot to delete this comment after reading that part. Thanks!","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since Nova has implemented this feature and all of the verification process"},{"line_number":109,"context_line":"has been moved into ``cursive`` module `[4]`_. It\u0027s more convenient to support"},{"line_number":110,"context_line":"this in Cinder now."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"**Verify image signature with certificate**"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_618e5cd1","line":109,"range":{"start_line":109,"start_character":45,"end_line":109,"end_character":51},"updated":"2018-04-19 16:34:54.000000000","message":"NIT: , it\u0027s","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Since Nova has implemented this feature and all of the verification process"},{"line_number":109,"context_line":"has been moved into ``cursive`` module `[4]`_. It\u0027s more convenient to support"},{"line_number":110,"context_line":"this in Cinder now."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"**Verify image signature with certificate**"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_8a113b60","line":109,"range":{"start_line":109,"start_character":45,"end_line":109,"end_character":51},"in_reply_to":"9f6a8fd7_618e5cd1","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":167,"context_line":"**NOTE**: We will try different approaches when"},{"line_number":168,"context_line":"creating volume from images, so we have to mention"},{"line_number":169,"context_line":"this feature will not cover every approach especially"},{"line_number":170,"context_line":"when volume is created at backend."},{"line_number":171,"context_line":"To be clear, we will verify the image\u0027s signature only when"},{"line_number":172,"context_line":"image is downloaded from glance and content is copied to"},{"line_number":173,"context_line":"volume on host. So when image volume is created via"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_6155fc1c","line":170,"range":{"start_line":170,"start_character":34,"end_line":170,"end_character":34},"updated":"2018-04-19 16:34:54.000000000","message":"NIT: I think you intended to have an empty line here to separate the NOTE from the next paragraph","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":167,"context_line":"**NOTE**: We will try different approaches when"},{"line_number":168,"context_line":"creating volume from images, so we have to mention"},{"line_number":169,"context_line":"this feature will not cover every approach especially"},{"line_number":170,"context_line":"when volume is created at backend."},{"line_number":171,"context_line":"To be clear, we will verify the image\u0027s signature only when"},{"line_number":172,"context_line":"image is downloaded from glance and content is copied to"},{"line_number":173,"context_line":"volume on host. So when image volume is created via"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_6a0ce740","line":170,"range":{"start_line":170,"start_character":34,"end_line":170,"end_character":34},"in_reply_to":"9f6a8fd7_6155fc1c","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":173,"context_line":"volume on host. So when image volume is created via"},{"line_number":174,"context_line":"``clone_image`` or ``clone_image_volume`` we will skip this"},{"line_number":175,"context_line":"verification process regardless of configuration option and"},{"line_number":176,"context_line":"provided signature metadata, in order not to confusing end users,"},{"line_number":177,"context_line":"we will add verification flag ``signature_verified`` in volume\u0027s"},{"line_number":178,"context_line":"image metadata when creating from image."},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_412f98a0","line":176,"range":{"start_line":176,"start_character":45,"end_line":176,"end_character":54},"updated":"2018-04-19 16:34:54.000000000","message":"confuse","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":173,"context_line":"volume on host. So when image volume is created via"},{"line_number":174,"context_line":"``clone_image`` or ``clone_image_volume`` we will skip this"},{"line_number":175,"context_line":"verification process regardless of configuration option and"},{"line_number":176,"context_line":"provided signature metadata, in order not to confusing end users,"},{"line_number":177,"context_line":"we will add verification flag ``signature_verified`` in volume\u0027s"},{"line_number":178,"context_line":"image metadata when creating from image."},{"line_number":179,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_0a7e8bae","line":176,"range":{"start_line":176,"start_character":45,"end_line":176,"end_character":54},"in_reply_to":"9f6a8fd7_412f98a0","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":179,"context_line":""},{"line_number":180,"context_line":"**Verify certificate with trusted certificates**"},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"This feature tries to find a way to determine if the certificate"},{"line_number":183,"context_line":"used to generate and verify that signature is a certificate that"},{"line_number":184,"context_line":"is trusted by the user, we could find more detail in Nova spec `[5]`_,"},{"line_number":185,"context_line":"in short, within that feature end user can also validate the image\u0027s"},{"line_number":186,"context_line":"certificate with the given trusted certificates (specified via API"},{"line_number":187,"context_line":"or config option), considering the feature is in the process of"},{"line_number":188,"context_line":"being added to Nova now, we will follow this up with another spec"},{"line_number":189,"context_line":"when it\u0027s merged into Nova for the purpose of consistency."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Alternatives"},{"line_number":192,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_dc5aab28","line":189,"range":{"start_line":182,"start_character":0,"end_line":189,"end_character":58},"updated":"2018-04-19 16:34:54.000000000","message":"NIT: This is a really long sentence, and could benefit from being re-worded.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"cad8f8948e0aed358ffaed5d7fc7bc331c3b9f11","unresolved":false,"context_lines":[{"line_number":184,"context_line":"is trusted by the user, we could find more detail in Nova spec `[5]`_,"},{"line_number":185,"context_line":"in short, within that feature end user can also validate the image\u0027s"},{"line_number":186,"context_line":"certificate with the given trusted certificates (specified via API"},{"line_number":187,"context_line":"or config option), considering the feature is in the process of"},{"line_number":188,"context_line":"being added to Nova now, we will follow this up with another spec"},{"line_number":189,"context_line":"when it\u0027s merged into Nova for the purpose of consistency."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Alternatives"},{"line_number":192,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_b6903850","line":189,"range":{"start_line":187,"start_character":19,"end_line":189,"end_character":58},"updated":"2018-04-19 15:43:32.000000000","message":"OK this is what I was looking for in this spec given the recent discussion in the mailing list about creating volume-backed servers with trusted certificates:\n\nhttp://lists.openstack.org/pipermail/openstack-dev/2018-April/129494.html\n\nSo this spec lays all the backend (cinder-volume) groundwork and then there would be later API changes, described in another spec, for creating volumes where the user can pass in trusted certificate IDs, and nova would leverage that to pass through to Cinder (or I guess nova could just not pass it through and require that if you want trusted certs with volume-backed servers, you have to create those volumes in cinder first).","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":184,"context_line":"is trusted by the user, we could find more detail in Nova spec `[5]`_,"},{"line_number":185,"context_line":"in short, within that feature end user can also validate the image\u0027s"},{"line_number":186,"context_line":"certificate with the given trusted certificates (specified via API"},{"line_number":187,"context_line":"or config option), considering the feature is in the process of"},{"line_number":188,"context_line":"being added to Nova now, we will follow this up with another spec"},{"line_number":189,"context_line":"when it\u0027s merged into Nova for the purpose of consistency."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Alternatives"},{"line_number":192,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_dc9ceb5e","line":189,"range":{"start_line":187,"start_character":19,"end_line":189,"end_character":58},"in_reply_to":"9f6a8fd7_b6903850","updated":"2018-04-19 16:34:54.000000000","message":"I see, Matt. This is great.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":272,"context_line":"This change will involve adding log messages to indicate the success or"},{"line_number":273,"context_line":"failure of signature verification and creation."},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"A later change will involve notifing the user about failure in case signature"},{"line_number":276,"context_line":"verification fails, this will use async error notification feature `[3]`_."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Other end user impact"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_3c03a7ba","line":275,"range":{"start_line":275,"start_character":28,"end_line":275,"end_character":36},"updated":"2018-04-19 16:34:54.000000000","message":"notifying","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":272,"context_line":"This change will involve adding log messages to indicate the success or"},{"line_number":273,"context_line":"failure of signature verification and creation."},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"A later change will involve notifing the user about failure in case signature"},{"line_number":276,"context_line":"verification fails, this will use async error notification feature `[3]`_."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Other end user impact"}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_ad0bf921","line":275,"range":{"start_line":275,"start_character":28,"end_line":275,"end_character":36},"in_reply_to":"9f6a8fd7_3c03a7ba","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"cad8f8948e0aed358ffaed5d7fc7bc331c3b9f11","unresolved":false,"context_lines":[{"line_number":300,"context_line":"Other deployer impact"},{"line_number":301,"context_line":"---------------------"},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"In order to use this feature, The key manager service Barbican `[6]`_ must"},{"line_number":304,"context_line":"be deployed and configured."},{"line_number":305,"context_line":""},{"line_number":306,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_d684cc0e","line":303,"range":{"start_line":303,"start_character":54,"end_line":303,"end_character":62},"updated":"2018-04-19 15:43:32.000000000","message":"Technically I thought the Castellan library is required, which is the front-end to whatever key manager service implements the Castellan API, one of which is Barbican but not necessary has to be Barbican.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":300,"context_line":"Other deployer impact"},{"line_number":301,"context_line":"---------------------"},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"In order to use this feature, The key manager service Barbican `[6]`_ must"},{"line_number":304,"context_line":"be deployed and configured."},{"line_number":305,"context_line":""},{"line_number":306,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_fc8a0f19","line":303,"range":{"start_line":303,"start_character":30,"end_line":303,"end_character":33},"updated":"2018-04-19 16:34:54.000000000","message":"the","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":300,"context_line":"Other deployer impact"},{"line_number":301,"context_line":"---------------------"},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"In order to use this feature, The key manager service Barbican `[6]`_ must"},{"line_number":304,"context_line":"be deployed and configured."},{"line_number":305,"context_line":""},{"line_number":306,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_fcdd2f14","line":303,"range":{"start_line":303,"start_character":54,"end_line":303,"end_character":62},"in_reply_to":"9f6a8fd7_d684cc0e","updated":"2018-04-19 16:34:54.000000000","message":"Correct. You don\u0027t _have_ to use Barbican.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":300,"context_line":"Other deployer impact"},{"line_number":301,"context_line":"---------------------"},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"In order to use this feature, The key manager service Barbican `[6]`_ must"},{"line_number":304,"context_line":"be deployed and configured."},{"line_number":305,"context_line":""},{"line_number":306,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_8d25d55e","line":303,"range":{"start_line":303,"start_character":54,"end_line":303,"end_character":62},"in_reply_to":"9f6a8fd7_d684cc0e","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":300,"context_line":"Other deployer impact"},{"line_number":301,"context_line":"---------------------"},{"line_number":302,"context_line":""},{"line_number":303,"context_line":"In order to use this feature, The key manager service Barbican `[6]`_ must"},{"line_number":304,"context_line":"be deployed and configured."},{"line_number":305,"context_line":""},{"line_number":306,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_6d208149","line":303,"range":{"start_line":303,"start_character":54,"end_line":303,"end_character":62},"in_reply_to":"9f6a8fd7_fcdd2f14","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"cad8f8948e0aed358ffaed5d7fc7bc331c3b9f11","unresolved":false,"context_lines":[{"line_number":343,"context_line":"Testing"},{"line_number":344,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"Unit tests and integration tests(3rd party CI) will be needed to test the"},{"line_number":347,"context_line":"functionality implemented in Cinder. We will need to implement Tempest and"},{"line_number":348,"context_line":"functional tests to test the interoperability of this feature with the"},{"line_number":349,"context_line":"accompanying functionality in Glance."},{"line_number":350,"context_line":"Tempest tests will also be added into barbican-tempest-plugin to cover the"},{"line_number":351,"context_line":"case of upload signed image and then create volume from image."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_96a3b49e","line":349,"range":{"start_line":346,"start_character":15,"end_line":349,"end_character":37},"updated":"2018-04-19 15:43:32.000000000","message":"I would think this is all part of the barbican-tempest-plugin now, that\u0027s what is being run against the nova changes for this, albeit in the nova experimental queue I think.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":343,"context_line":"Testing"},{"line_number":344,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"Unit tests and integration tests(3rd party CI) will be needed to test the"},{"line_number":347,"context_line":"functionality implemented in Cinder. We will need to implement Tempest and"},{"line_number":348,"context_line":"functional tests to test the interoperability of this feature with the"},{"line_number":349,"context_line":"accompanying functionality in Glance."},{"line_number":350,"context_line":"Tempest tests will also be added into barbican-tempest-plugin to cover the"},{"line_number":351,"context_line":"case of upload signed image and then create volume from image."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_ed349195","line":349,"range":{"start_line":346,"start_character":15,"end_line":349,"end_character":37},"in_reply_to":"9f6a8fd7_7c6d9f30","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":23083,"name":"TommyLike","email":"tommylikehu@gmail.com","username":"TommyLike"},"change_message_id":"1c0ec8a86a220275f467ccbb9427f8a4a9cd2b41","unresolved":false,"context_lines":[{"line_number":343,"context_line":"Testing"},{"line_number":344,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"Unit tests and integration tests(3rd party CI) will be needed to test the"},{"line_number":347,"context_line":"functionality implemented in Cinder. We will need to implement Tempest and"},{"line_number":348,"context_line":"functional tests to test the interoperability of this feature with the"},{"line_number":349,"context_line":"accompanying functionality in Glance."},{"line_number":350,"context_line":"Tempest tests will also be added into barbican-tempest-plugin to cover the"},{"line_number":351,"context_line":"case of upload signed image and then create volume from image."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_2dfda9b0","line":349,"range":{"start_line":346,"start_character":15,"end_line":349,"end_character":37},"in_reply_to":"9f6a8fd7_96a3b49e","updated":"2018-04-20 03:16:26.000000000","message":"Done","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"1f918a26d925ef1f29ec35971bbdfcecf115c317","unresolved":false,"context_lines":[{"line_number":343,"context_line":"Testing"},{"line_number":344,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"Unit tests and integration tests(3rd party CI) will be needed to test the"},{"line_number":347,"context_line":"functionality implemented in Cinder. We will need to implement Tempest and"},{"line_number":348,"context_line":"functional tests to test the interoperability of this feature with the"},{"line_number":349,"context_line":"accompanying functionality in Glance."},{"line_number":350,"context_line":"Tempest tests will also be added into barbican-tempest-plugin to cover the"},{"line_number":351,"context_line":"case of upload signed image and then create volume from image."},{"line_number":352,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"9f6a8fd7_7c6d9f30","line":349,"range":{"start_line":346,"start_character":15,"end_line":349,"end_character":37},"in_reply_to":"9f6a8fd7_96a3b49e","updated":"2018-04-19 16:34:54.000000000","message":"Yep. The barbican-tempest-plugin alread includes integration tests for image signature verification and certificate validation.","commit_id":"4ac78a148f9b551406503a96f91de4707ecc62f3"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"6b39d58efbff25b1dba0bd220e6fdaf63ae125cd","unresolved":false,"context_lines":[{"line_number":303,"context_line":"Other deployer impact"},{"line_number":304,"context_line":"---------------------"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"We will recommend you to deploy Barbican service `[6]`_ to store your"},{"line_number":307,"context_line":"certificate info as other projects suggest, although you can integrate"},{"line_number":308,"context_line":"any other secret manager service via Castellan `[8]`_."},{"line_number":309,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9f6a8fd7_8d43956c","line":306,"range":{"start_line":306,"start_character":22,"end_line":306,"end_character":24},"updated":"2018-04-20 03:53:47.000000000","message":"NIT: delete \"to\"","commit_id":"3ce3aa17af140a0830835bd8f2de788ae64f7a11"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"6b39d58efbff25b1dba0bd220e6fdaf63ae125cd","unresolved":false,"context_lines":[{"line_number":304,"context_line":"---------------------"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"We will recommend you to deploy Barbican service `[6]`_ to store your"},{"line_number":307,"context_line":"certificate info as other projects suggest, although you can integrate"},{"line_number":308,"context_line":"any other secret manager service via Castellan `[8]`_."},{"line_number":309,"context_line":""},{"line_number":310,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9f6a8fd7_ed52513b","line":307,"range":{"start_line":307,"start_character":12,"end_line":307,"end_character":16},"updated":"2018-04-20 03:53:47.000000000","message":"NIT: information","commit_id":"3ce3aa17af140a0830835bd8f2de788ae64f7a11"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"6b39d58efbff25b1dba0bd220e6fdaf63ae125cd","unresolved":false,"context_lines":[{"line_number":349,"context_line":""},{"line_number":350,"context_line":"Unit tests and also, tempest tests will be added into"},{"line_number":351,"context_line":"barbican-tempest-plugin to cover the case of upload"},{"line_number":352,"context_line":"signed image and then create volume from image."},{"line_number":353,"context_line":""},{"line_number":354,"context_line":""},{"line_number":355,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9f6a8fd7_d0004204","line":352,"range":{"start_line":352,"start_character":22,"end_line":352,"end_character":46},"updated":"2018-04-20 03:53:47.000000000","message":"NIT: create volume from signed image","commit_id":"3ce3aa17af140a0830835bd8f2de788ae64f7a11"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"6b39d58efbff25b1dba0bd220e6fdaf63ae125cd","unresolved":false,"context_lines":[{"line_number":348,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":349,"context_line":""},{"line_number":350,"context_line":"Unit tests and also, tempest tests will be added into"},{"line_number":351,"context_line":"barbican-tempest-plugin to cover the case of upload"},{"line_number":352,"context_line":"signed image and then create volume from image."},{"line_number":353,"context_line":""},{"line_number":354,"context_line":""},{"line_number":355,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9f6a8fd7_0d054514","line":352,"range":{"start_line":351,"start_character":45,"end_line":352,"end_character":12},"updated":"2018-04-20 03:53:47.000000000","message":"NIT: upload signed image to cinder","commit_id":"3ce3aa17af140a0830835bd8f2de788ae64f7a11"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"13b25b44be8b10962bdd61ce1586d8af17c8f137","unresolved":false,"context_lines":[{"line_number":348,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":349,"context_line":""},{"line_number":350,"context_line":"Unit tests and also, tempest tests will be added into"},{"line_number":351,"context_line":"barbican-tempest-plugin to cover the case of upload"},{"line_number":352,"context_line":"signed image to glance and then create volume from signed image."},{"line_number":353,"context_line":""},{"line_number":354,"context_line":""},{"line_number":355,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":19,"id":"9f6a8fd7_b326e614","line":352,"range":{"start_line":351,"start_character":45,"end_line":352,"end_character":22},"updated":"2018-04-20 18:15:14.000000000","message":"This is already be covered in barbican-tempest-plugin:\nhttps://github.com/openstack/barbican-tempest-plugin/blob/master/barbican_tempest_plugin/tests/scenario/barbican_manager.py#L154-L174\n\nSo you should just need to test creating a volume from a signed image.","commit_id":"42918418992425b485e412b0b66ec2f2df663e53"}]}