)]}'
{"specs/stein/support-validate-image-certificate.rst":[{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"834a9984af067c35e209931b71ecf5ead864c00d","unresolved":false,"context_lines":[{"line_number":33,"context_line":"of the signed image is currently limited to a timestamp validity check,"},{"line_number":34,"context_line":"ensuring only that the certificate is valid for use at the time of signature"},{"line_number":35,"context_line":"verification. There is no mechanism to ensure that the certificate used is"},{"line_number":36,"context_line":"one approved by the end user. An attacker with access to glance could replace"},{"line_number":37,"context_line":"a user\u0027s signed image with a modified, malicious image signed with the"},{"line_number":38,"context_line":"attacker\u0027s certificate, stored in the OpenStack deployment\u0027s certificate"},{"line_number":39,"context_line":"manager. If asked to create volume from the modified image, cinder would"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_186e932c","line":36,"range":{"start_line":36,"start_character":70,"end_line":36,"end_character":77},"updated":"2018-11-09 07:57:38.000000000","message":"How? Glance doesn\u0027t support replace a image\u0027s data.","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":33,"context_line":"of the signed image is currently limited to a timestamp validity check,"},{"line_number":34,"context_line":"ensuring only that the certificate is valid for use at the time of signature"},{"line_number":35,"context_line":"verification. There is no mechanism to ensure that the certificate used is"},{"line_number":36,"context_line":"one approved by the end user. An attacker with access to glance could replace"},{"line_number":37,"context_line":"a user\u0027s signed image with a modified, malicious image signed with the"},{"line_number":38,"context_line":"attacker\u0027s certificate, stored in the OpenStack deployment\u0027s certificate"},{"line_number":39,"context_line":"manager. If asked to create volume from the modified image, cinder would"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_a88747b4","line":36,"range":{"start_line":36,"start_character":70,"end_line":36,"end_character":77},"in_reply_to":"3f79a3b5_186e932c","updated":"2018-11-23 02:41:15.000000000","message":"Only case I can image it\u0027s that the glance has been hacked. and I agree it\u0027s a extreme case. :)","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5166adf71831e0a6a979cb2fd6ec5142b0efee41","unresolved":false,"context_lines":[{"line_number":38,"context_line":"attacker\u0027s certificate, stored in the OpenStack deployment\u0027s certificate"},{"line_number":39,"context_line":"manager. If asked to create volume from the modified image, cinder would"},{"line_number":40,"context_line":"retrieve the image and its corresponding certificate, verify the image"},{"line_number":41,"context_line":"signature, and build volume using the malicious image data. Providing"},{"line_number":42,"context_line":"support for certificate validation in cursive helps cinder detect this"},{"line_number":43,"context_line":"attack scenario and take steps to alert the user of the potential compromise."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_8bceb3b4","line":41,"range":{"start_line":41,"start_character":11,"end_line":41,"end_character":27},"updated":"2018-10-29 19:22:07.000000000","message":"and build a volume","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":38,"context_line":"attacker\u0027s certificate, stored in the OpenStack deployment\u0027s certificate"},{"line_number":39,"context_line":"manager. If asked to create volume from the modified image, cinder would"},{"line_number":40,"context_line":"retrieve the image and its corresponding certificate, verify the image"},{"line_number":41,"context_line":"signature, and build volume using the malicious image data. Providing"},{"line_number":42,"context_line":"support for certificate validation in cursive helps cinder detect this"},{"line_number":43,"context_line":"attack scenario and take steps to alert the user of the potential compromise."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_482f93f3","line":41,"range":{"start_line":41,"start_character":11,"end_line":41,"end_character":27},"in_reply_to":"3f79a3b5_8bceb3b4","updated":"2018-11-23 02:41:15.000000000","message":"Done","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5166adf71831e0a6a979cb2fd6ec5142b0efee41","unresolved":false,"context_lines":[{"line_number":54,"context_line":"Use Cases"},{"line_number":55,"context_line":"---------"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Cinder users want to ensure that they are creating from image they trust by"},{"line_number":58,"context_line":"controlling the set of certificates used to sign their images."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"With this change, a cinder user can specify the identities of trusted"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_2bbd1f02","line":57,"range":{"start_line":57,"start_character":56,"end_line":57,"end_character":60},"updated":"2018-10-29 19:22:07.000000000","message":"images","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":54,"context_line":"Use Cases"},{"line_number":55,"context_line":"---------"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Cinder users want to ensure that they are creating from image they trust by"},{"line_number":58,"context_line":"controlling the set of certificates used to sign their images."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"With this change, a cinder user can specify the identities of trusted"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_e8377f4b","line":57,"range":{"start_line":57,"start_character":56,"end_line":57,"end_character":60},"in_reply_to":"3f79a3b5_2bbd1f02","updated":"2018-11-23 02:41:15.000000000","message":"Done","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5166adf71831e0a6a979cb2fd6ec5142b0efee41","unresolved":false,"context_lines":[{"line_number":58,"context_line":"controlling the set of certificates used to sign their images."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"With this change, a cinder user can specify the identities of trusted"},{"line_number":61,"context_line":"certificates when creating volume from a signed image if"},{"line_number":62,"context_line":"signature verification and certificate validation are enabled. One of these"},{"line_number":63,"context_line":"trusted certificates is expected to be the signing certificate of the"},{"line_number":64,"context_line":"certificate used to generate the image signature."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_ebb2c730","line":61,"range":{"start_line":61,"start_character":27,"end_line":61,"end_character":33},"updated":"2018-10-29 19:22:07.000000000","message":"volumes","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":58,"context_line":"controlling the set of certificates used to sign their images."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"With this change, a cinder user can specify the identities of trusted"},{"line_number":61,"context_line":"certificates when creating volume from a signed image if"},{"line_number":62,"context_line":"signature verification and certificate validation are enabled. One of these"},{"line_number":63,"context_line":"trusted certificates is expected to be the signing certificate of the"},{"line_number":64,"context_line":"certificate used to generate the image signature."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_08351b43","line":61,"range":{"start_line":61,"start_character":27,"end_line":61,"end_character":33},"in_reply_to":"3f79a3b5_ebb2c730","updated":"2018-11-23 02:41:15.000000000","message":"Done","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"e35c697950042b492e546f8c8ee0e7edbacbd836","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"With certificate validation enabled, image signature verification will only"},{"line_number":67,"context_line":"succeed if the image signing certificate was generated by a trusted"},{"line_number":68,"context_line":"certificate. This allows users to place themselves in-the-loop of the"},{"line_number":69,"context_line":"signature verification process, requiring valid certificate information for"},{"line_number":70,"context_line":"boot to succeed."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Note that these trusted certificates are stored in a certificate manager"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_0627b165","line":69,"range":{"start_line":68,"start_character":13,"end_line":69,"end_character":30},"updated":"2018-07-24 18:24:41.000000000","message":"I think it\u0027s important to spell this out carefully... users are in the loop here, but if the deployment is configured to trust certain certificates that the user isn\u0027t aware of, the deployer could still manipulate images in a way that the user wouldn\u0027t detect with this feature.","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"With certificate validation enabled, image signature verification will only"},{"line_number":67,"context_line":"succeed if the image signing certificate was generated by a trusted"},{"line_number":68,"context_line":"certificate. This allows users to place themselves in-the-loop of the"},{"line_number":69,"context_line":"signature verification process, requiring valid certificate information for"},{"line_number":70,"context_line":"boot to succeed."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Note that these trusted certificates are stored in a certificate manager"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_e8653f4b","line":69,"range":{"start_line":68,"start_character":13,"end_line":69,"end_character":30},"in_reply_to":"5f7c97a3_0627b165","updated":"2018-11-23 02:41:15.000000000","message":"Done","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"e35c697950042b492e546f8c8ee0e7edbacbd836","unresolved":false,"context_lines":[{"line_number":309,"context_line":"Performance Impact"},{"line_number":310,"context_line":"------------------"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"Nova will load the user\u0027s trusted certificates via cursive every time"},{"line_number":313,"context_line":"signature verification is performed. Depending upon the size and number of"},{"line_number":314,"context_line":"certificates, and the frequency of signature verification, this could"},{"line_number":315,"context_line":"introduce a performance burden on the volume service. To alleviate this, see"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_a6ab5d1d","line":312,"range":{"start_line":312,"start_character":0,"end_line":312,"end_character":14},"updated":"2018-07-24 18:24:41.000000000","message":"Is this also true when consuming images from the Cinder image cache?  (It needs to be to support revocation.)\n\nThis implies a perf hit to the image cache scheme we use.","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":309,"context_line":"Performance Impact"},{"line_number":310,"context_line":"------------------"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"Nova will load the user\u0027s trusted certificates via cursive every time"},{"line_number":313,"context_line":"signature verification is performed. Depending upon the size and number of"},{"line_number":314,"context_line":"certificates, and the frequency of signature verification, this could"},{"line_number":315,"context_line":"introduce a performance burden on the volume service. To alleviate this, see"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_a86bc71a","line":312,"range":{"start_line":312,"start_character":0,"end_line":312,"end_character":14},"in_reply_to":"5f7c97a3_a6ab5d1d","updated":"2018-11-23 02:41:15.000000000","message":"Done","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"5166adf71831e0a6a979cb2fd6ec5142b0efee41","unresolved":false,"context_lines":[{"line_number":335,"context_line":"Assignee(s)"},{"line_number":336,"context_line":"-----------"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"Primary assignee:"},{"line_number":339,"context_line":"  tommylikehu(tommylikehu@gmail.com)"},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"Work Items"},{"line_number":342,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_cb134b01","line":339,"range":{"start_line":338,"start_character":0,"end_line":339,"end_character":36},"updated":"2018-10-29 19:22:07.000000000","message":"I am guessing this needs to change now.","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"48f5a5aa768a8a4dfa2c7799778cbb254829a713","unresolved":false,"context_lines":[{"line_number":335,"context_line":"Assignee(s)"},{"line_number":336,"context_line":"-----------"},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"Primary assignee:"},{"line_number":339,"context_line":"  tommylikehu(tommylikehu@gmail.com)"},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"Work Items"},{"line_number":342,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_c8688320","line":339,"range":{"start_line":338,"start_character":0,"end_line":339,"end_character":36},"in_reply_to":"3f79a3b5_cb134b01","updated":"2018-11-23 02:41:15.000000000","message":"Done","commit_id":"71c827aa68ce77fc3f0452b19dcd14fbf5c1c69e"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"5964561ff8f4d36a3076fcb30b94f1df544e91d3","unresolved":false,"context_lines":[{"line_number":35,"context_line":"verification. There is no mechanism to ensure that the certificate used is"},{"line_number":36,"context_line":"one approved by the end user. An attacker with access to glance could replace"},{"line_number":37,"context_line":"a user\u0027s signed image with a modified, malicious image signed with the"},{"line_number":38,"context_line":"attacker\u0027s certificate, stored in the OpenStack deployment\u0027s certificate"},{"line_number":39,"context_line":"manager. If asked to create volume from the modified image, cinder would"},{"line_number":40,"context_line":"retrieve the image and its corresponding certificate, verify the image"},{"line_number":41,"context_line":"signature, and build a volume using the malicious image data. Providing"},{"line_number":42,"context_line":"support for certificate validation in cursive helps cinder detect this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_2c593c8f","line":39,"range":{"start_line":38,"start_character":24,"end_line":39,"end_character":7},"updated":"2018-12-17 20:37:31.000000000","message":"Wouldn\u0027t this also imply they have access to the certificate manager and could potentially use the same cert to sign the modified image?","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":7198,"name":"Jay Bryant","email":"jungleboyj@electronicjungle.net","username":"jsbryant"},"change_message_id":"9acc88c0a00539b7ac3e70235d11513305e050d2","unresolved":false,"context_lines":[{"line_number":35,"context_line":"verification. There is no mechanism to ensure that the certificate used is"},{"line_number":36,"context_line":"one approved by the end user. An attacker with access to glance could replace"},{"line_number":37,"context_line":"a user\u0027s signed image with a modified, malicious image signed with the"},{"line_number":38,"context_line":"attacker\u0027s certificate, stored in the OpenStack deployment\u0027s certificate"},{"line_number":39,"context_line":"manager. If asked to create volume from the modified image, cinder would"},{"line_number":40,"context_line":"retrieve the image and its corresponding certificate, verify the image"},{"line_number":41,"context_line":"signature, and build a volume using the malicious image data. Providing"},{"line_number":42,"context_line":"support for certificate validation in cursive helps cinder detect this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_4c2b5899","line":39,"range":{"start_line":38,"start_character":24,"end_line":39,"end_character":7},"in_reply_to":"3f79a3b5_2c593c8f","updated":"2018-12-17 20:53:41.000000000","message":"I think that concern is addressed below.","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"5964561ff8f4d36a3076fcb30b94f1df544e91d3","unresolved":false,"context_lines":[{"line_number":71,"context_line":"certificates that the user isn\u0027t aware of, the deployer could still manipulate"},{"line_number":72,"context_line":"images in a way that the user wouldn\u0027t detect with this feature."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Note that these trusted certificates are stored in a certificate manager"},{"line_number":75,"context_line":"independent of the volume service. For this work, a certificate manager is"},{"line_number":76,"context_line":"any service backend supported by castellan that provides management"},{"line_number":77,"context_line":"operations for certificates objects. Certificate management is often a"},{"line_number":78,"context_line":"subset of the functionality provided by generic key managers, which are"},{"line_number":79,"context_line":"capable of managing different types of cryptographic secrets (e.g.,"},{"line_number":80,"context_line":"encryption keys, passwords). As of the Pike release, barbican (the OpenStack"},{"line_number":81,"context_line":"key management service) is the only OpenStack service that satisfies the"},{"line_number":82,"context_line":"requirements for a certificate manager. In the future, any OpenStack or"},{"line_number":83,"context_line":"third-party service that is supported by castellan and provides certificate"},{"line_number":84,"context_line":"management could be used instead of barbican."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Proposed change"},{"line_number":87,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_ccce88b9","line":84,"range":{"start_line":74,"start_character":0,"end_line":84,"end_character":45},"updated":"2018-12-17 20:37:31.000000000","message":"This kind of gets into the proposed changes and doesn\u0027t really describe the use case. Might be better to move this detail below.","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"b6ddcf09d727827c4d9dea5c37d117367360e43a","unresolved":false,"context_lines":[{"line_number":71,"context_line":"certificates that the user isn\u0027t aware of, the deployer could still manipulate"},{"line_number":72,"context_line":"images in a way that the user wouldn\u0027t detect with this feature."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Note that these trusted certificates are stored in a certificate manager"},{"line_number":75,"context_line":"independent of the volume service. For this work, a certificate manager is"},{"line_number":76,"context_line":"any service backend supported by castellan that provides management"},{"line_number":77,"context_line":"operations for certificates objects. Certificate management is often a"},{"line_number":78,"context_line":"subset of the functionality provided by generic key managers, which are"},{"line_number":79,"context_line":"capable of managing different types of cryptographic secrets (e.g.,"},{"line_number":80,"context_line":"encryption keys, passwords). As of the Pike release, barbican (the OpenStack"},{"line_number":81,"context_line":"key management service) is the only OpenStack service that satisfies the"},{"line_number":82,"context_line":"requirements for a certificate manager. In the future, any OpenStack or"},{"line_number":83,"context_line":"third-party service that is supported by castellan and provides certificate"},{"line_number":84,"context_line":"management could be used instead of barbican."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Proposed change"},{"line_number":87,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_d599d6cd","line":84,"range":{"start_line":74,"start_character":0,"end_line":84,"end_character":45},"in_reply_to":"3f79a3b5_ccce88b9","updated":"2018-12-21 02:45:42.000000000","message":"OK, sure","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"5964561ff8f4d36a3076fcb30b94f1df544e91d3","unresolved":false,"context_lines":[{"line_number":163,"context_line":"verification would fail, in turn failing volume creation."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Also, there is a difference between validate image signature and validate"},{"line_number":166,"context_line":"certificates process that no matter the volume is created from volume cache,"},{"line_number":167,"context_line":"volume backend or downloaded from glance we always can perform this validation."},{"line_number":168,"context_line":"We will also add a flag in volume image metadata to indicate whether we"},{"line_number":169,"context_line":"validated the certificates during volume creation, and the service will"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_ecd34435","line":166,"range":{"start_line":166,"start_character":63,"end_line":166,"end_character":75},"updated":"2018-12-17 20:37:31.000000000","message":"We may need a little more detail about how this is expected to work when creating the volume from cache.","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"b6ddcf09d727827c4d9dea5c37d117367360e43a","unresolved":false,"context_lines":[{"line_number":163,"context_line":"verification would fail, in turn failing volume creation."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Also, there is a difference between validate image signature and validate"},{"line_number":166,"context_line":"certificates process that no matter the volume is created from volume cache,"},{"line_number":167,"context_line":"volume backend or downloaded from glance we always can perform this validation."},{"line_number":168,"context_line":"We will also add a flag in volume image metadata to indicate whether we"},{"line_number":169,"context_line":"validated the certificates during volume creation, and the service will"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_157d0e6f","line":166,"range":{"start_line":166,"start_character":63,"end_line":166,"end_character":75},"in_reply_to":"3f79a3b5_ecd34435","updated":"2018-12-21 02:45:42.000000000","message":"After talk with tommylike, he said it\u0027s a copy from first version image signature certificates. And for now, we only support to validate certificates when we create from glance.(and it the same \n behavwith nova and cinder signature validation). So, I think we need reword this paragraph.","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"5964561ff8f4d36a3076fcb30b94f1df544e91d3","unresolved":false,"context_lines":[{"line_number":190,"context_line":"some cloud deployments."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"An alternative to the user providing trusted certificates, or storing trusted"},{"line_number":193,"context_line":"certificates in a trust store, would be to dynamically fetch certificates"},{"line_number":194,"context_line":"using information stored in the Private Internet Extension of the signed"},{"line_number":195,"context_line":"certificate being validated. This approach allows deployers and users to use"},{"line_number":196,"context_line":"signing certificates without needing to pre-fetch all of the root and"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_2c229c0f","line":193,"updated":"2018-12-17 20:37:31.000000000","message":"Another alternative coming to mind instead of having a trust store would be just a database table that could be used by the user to store a list of the IDs.","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"3792f9685645a4b8e054cdb9a38e3534baf8d0c8","unresolved":false,"context_lines":[{"line_number":190,"context_line":"some cloud deployments."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"An alternative to the user providing trusted certificates, or storing trusted"},{"line_number":193,"context_line":"certificates in a trust store, would be to dynamically fetch certificates"},{"line_number":194,"context_line":"using information stored in the Private Internet Extension of the signed"},{"line_number":195,"context_line":"certificate being validated. This approach allows deployers and users to use"},{"line_number":196,"context_line":"signing certificates without needing to pre-fetch all of the root and"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_f51f3207","line":193,"in_reply_to":"3f79a3b5_2c229c0f","updated":"2018-12-27 01:42:52.000000000","message":"Done","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"5964561ff8f4d36a3076fcb30b94f1df544e91d3","unresolved":false,"context_lines":[{"line_number":226,"context_line":"REST API impact"},{"line_number":227,"context_line":"---------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"1. Now Cinder supports specify ``trusted_image_certificates``"},{"line_number":230,"context_line":"   when creating volume::"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"    POST: /V3/{tenant_id}/volumes"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_2c985c7a","line":229,"range":{"start_line":229,"start_character":3,"end_line":229,"end_character":22},"updated":"2018-12-17 20:37:31.000000000","message":"Add ability to specify","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"b6ddcf09d727827c4d9dea5c37d117367360e43a","unresolved":false,"context_lines":[{"line_number":226,"context_line":"REST API impact"},{"line_number":227,"context_line":"---------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"1. Now Cinder supports specify ``trusted_image_certificates``"},{"line_number":230,"context_line":"   when creating volume::"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"    POST: /V3/{tenant_id}/volumes"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_7581e245","line":229,"range":{"start_line":229,"start_character":3,"end_line":229,"end_character":22},"in_reply_to":"3f79a3b5_2c985c7a","updated":"2018-12-21 02:45:42.000000000","message":"Done","commit_id":"dcc56ccfc6e6c0da6300f4ce1f1648604a56ef87"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"efaf4128cae318a5ab28b5fcb217dd8b01ddda5b","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"None"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"REST API impact"},{"line_number":228,"context_line":"---------------"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"1. Add ability to specify ``trusted_image_certificates``"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1f769fc5_9dafac93","line":227,"updated":"2018-12-26 16:30:14.000000000","message":"I don\u0027t see it called out anywhere specifically, but I assume the new parameter to the volume create API will include a new microversion, correct? Because I brought this up during the nova implementation of the same feature and noted the gap in support for trusted image certs with boot from volume where nova-compute creates the root volume. So assuming there is a new microversion with this change, nova would eventually be able to pass through the trusted image certs when creating the root volume so we have end-to-end support.","commit_id":"903b5e3665ec6812edd233981a5d0f5cd5b782cf"},{"author":{"_account_id":20722,"name":"Yikun Jiang","email":"yikunkero@gmail.com","username":"yikunkero"},"change_message_id":"3792f9685645a4b8e054cdb9a38e3534baf8d0c8","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"None"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"REST API impact"},{"line_number":228,"context_line":"---------------"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"1. Add ability to specify ``trusted_image_certificates``"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1f769fc5_b32df947","line":227,"in_reply_to":"1f769fc5_9dafac93","updated":"2018-12-27 01:42:52.000000000","message":"Yes, it will include a new microversion, and mentioned it in L276. I think we can highlight it in first line:\n\nAdd new microversion to support specifying ``trusted_image_certificates`` ...","commit_id":"903b5e3665ec6812edd233981a5d0f5cd5b782cf"}]}