)]}'
{"elements/gentoo-cloud-nomultilib/README.rst":[{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"414e3162a1f9c278f3e5f916539613763c9a0cfa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Gentoo"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Use an Gentoo cloud image as the baseline for built disk images. The images are"},{"line_number":5,"context_line":"located in distribution specific sub directories under"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    http://distfiles.gentoo.org/releases/amd64/autobuilds/"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_fd959386","line":4,"updated":"2016-01-04 22:01:19.000000000","message":"s/an/a/","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"414e3162a1f9c278f3e5f916539613763c9a0cfa","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Gentoo"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Use an Gentoo cloud image as the baseline for built disk images. The images are"},{"line_number":5,"context_line":"located in distribution specific sub directories under"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    http://distfiles.gentoo.org/releases/amd64/autobuilds/"},{"line_number":8,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_9d8ed777","line":5,"updated":"2016-01-04 22:01:19.000000000","message":"nit pick, but I don\u0027t like the dangling \"... under\". How about \"... under this url::\" ?","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"414e3162a1f9c278f3e5f916539613763c9a0cfa","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    http://distfiles.gentoo.org/releases/amd64/autobuilds/"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"There are curently only x86_64 images."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Notes:"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_bd8b9b67","line":9,"updated":"2016-01-04 22:01:19.000000000","message":"Typically it\u0027s a more true statement to say \"As of this writing\" than \"currently\", since we are referring to a 3rd party thing that may change before the reader has encoutered this statement.","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"}],"elements/gentoo-cloud-nomultilib/bin/install-packages":[{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"5804f084cb9aadeace599a0cd363dc80fd7afaae","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# will return 0 if grub, 1 if anything else"},{"line_number":2,"context_line":"echo $@ | grep -iq grub"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"fa69d971_e0d3a602","line":2,"updated":"2016-01-04 22:36:58.000000000","message":"Huh? You definitely need to mention that in the README! and why not.. emerge isn\u0027t a thing anymore?","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"414e3162a1f9c278f3e5f916539613763c9a0cfa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# will return 0 if grub, 1 if anything else"},{"line_number":2,"context_line":"echo $@ | grep -iq grub"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"fa69d971_dd98cfc2","line":2,"updated":"2016-01-04 22:01:19.000000000","message":"I\u0027m not sure I understand why your install-packages command would do nothing. ?","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"96fc2a64f4ecc9330de6094c436f4d61303cfe40","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# will return 0 if grub, 1 if anything else"},{"line_number":2,"context_line":"echo $@ | grep -iq grub"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"fa69d971_9dd9f724","line":2,"in_reply_to":"fa69d971_dd98cfc2","updated":"2016-01-04 22:13:21.000000000","message":"additional packages are not supported","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"9c7f614a7e038fbdc912fbbba3a7080acd4f6624","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# will return 0 if grub, 1 if anything else"},{"line_number":2,"context_line":"echo $@ | grep -iq grub"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"fa69d971_80ce6a2c","line":2,"in_reply_to":"fa69d971_e0d3a602","updated":"2016-01-04 22:43:10.000000000","message":"emerge is a thing, and it is mentioned in the next revision","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"}],"elements/gentoo-cloud-nomultilib/root.d/10-cloud-image":[{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"5804f084cb9aadeace599a0cd363dc80fd7afaae","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    # import the key only if needed"},{"line_number":42,"context_line":"    gpg --list-keys \"${SIGNING_KEY}\""},{"line_number":43,"context_line":"    if [[ $? !\u003d 0 ]]; then"},{"line_number":44,"context_line":"        gpg --recv-keys \"${SIGNING_KEY}\""},{"line_number":45,"context_line":"    fi"},{"line_number":46,"context_line":"    # check the sig file"},{"line_number":47,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""}],"source_content_type":"application/x-shellscript","patch_set":2,"id":"fa69d971_40eab2ad","line":44,"updated":"2016-01-04 22:36:58.000000000","message":"ID\u0027s are all too short, though I apologize for making the confusing statement as the terms short/long ID have specific meaning which I failed to disambiguate from my general statement.\n\nhttp://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery\n\nThe key itself is really needed here. Note that the ways the PGP manual suggest to prevent forgery all involve verifying the ID, size, and fingerprint, none of which you\u0027ve done here. By the time you add all of that, you\u0027ve done a lot more work than just putting in the key itself.","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"414e3162a1f9c278f3e5f916539613763c9a0cfa","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    # import the key only if needed"},{"line_number":42,"context_line":"    gpg --list-keys \"${SIGNING_KEY}\""},{"line_number":43,"context_line":"    if [[ $? !\u003d 0 ]]; then"},{"line_number":44,"context_line":"        gpg --recv-keys \"${SIGNING_KEY}\""},{"line_number":45,"context_line":"    fi"},{"line_number":46,"context_line":"    # check the sig file"},{"line_number":47,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""}],"source_content_type":"application/x-shellscript","patch_set":2,"id":"fa69d971_3d7fab67","line":44,"updated":"2016-01-04 22:01:19.000000000","message":"This is totally insecure. Anyone can create another key with the exact same short key ID. Just embed the actual key _in the elements_. This way as long as somebody has received diskimage-builder via a trusted source, they will be able to trust gentoo.","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"96fc2a64f4ecc9330de6094c436f4d61303cfe40","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    # import the key only if needed"},{"line_number":42,"context_line":"    gpg --list-keys \"${SIGNING_KEY}\""},{"line_number":43,"context_line":"    if [[ $? !\u003d 0 ]]; then"},{"line_number":44,"context_line":"        gpg --recv-keys \"${SIGNING_KEY}\""},{"line_number":45,"context_line":"    fi"},{"line_number":46,"context_line":"    # check the sig file"},{"line_number":47,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""}],"source_content_type":"application/x-shellscript","patch_set":2,"id":"fa69d971_3d86cbdb","line":44,"in_reply_to":"fa69d971_3d7fab67","updated":"2016-01-04 22:13:21.000000000","message":"This is a long key ID.\n\nlook above at line 26","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"9c7f614a7e038fbdc912fbbba3a7080acd4f6624","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    # import the key only if needed"},{"line_number":42,"context_line":"    gpg --list-keys \"${SIGNING_KEY}\""},{"line_number":43,"context_line":"    if [[ $? !\u003d 0 ]]; then"},{"line_number":44,"context_line":"        gpg --recv-keys \"${SIGNING_KEY}\""},{"line_number":45,"context_line":"    fi"},{"line_number":46,"context_line":"    # check the sig file"},{"line_number":47,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""}],"source_content_type":"application/x-shellscript","patch_set":2,"id":"fa69d971_00db5aed","line":44,"in_reply_to":"fa69d971_40eab2ad","updated":"2016-01-04 22:43:10.000000000","message":"if we are fine with updating the key as we extend the life or replace the signing key then ok","commit_id":"2f120ad837031df1623ae0e8728c1605c0eaae15"}],"elements/gentoo/README.rst":[{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"9aada399c06954c55396558b62cca54af43d400a","unresolved":false,"context_lines":[{"line_number":24,"context_line":"* Other profiles can be used by exporting GENTOO_PROFILE with a valid profile."},{"line_number":25,"context_line":"  A list of valid profiles follows:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    default/linux/amd64/13.0"},{"line_number":28,"context_line":"    default/linux/amd64/13.0/no-multilib"},{"line_number":29,"context_line":"    hardened/linux/amd64"},{"line_number":30,"context_line":"    hardened/linux/amd64/no-multilib"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_9e50dbd5","line":27,"updated":"2016-01-05 22:17:37.000000000","message":"Do we need the version in this identifier?  It doesn\u0027t look like it\u0027s being used directly, and it\u0027s something that won\u0027t make sense when a hypothetical 14.0 version exists.","commit_id":"958e205c9b52ddd9b6c903d04f1936aac15a36df"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"ab02c206c5d26131ed06886353ecbd4e88e426e0","unresolved":false,"context_lines":[{"line_number":24,"context_line":"* Other profiles can be used by exporting GENTOO_PROFILE with a valid profile."},{"line_number":25,"context_line":"  A list of valid profiles follows:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    default/linux/amd64/13.0"},{"line_number":28,"context_line":"    default/linux/amd64/13.0/no-multilib"},{"line_number":29,"context_line":"    hardened/linux/amd64"},{"line_number":30,"context_line":"    hardened/linux/amd64/no-multilib"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_decdf385","line":27,"in_reply_to":"fa69d971_9e50dbd5","updated":"2016-01-05 22:20:04.000000000","message":"this is just a direct mapping to the profiles in gentoo, I\u0027d rather not change it.","commit_id":"958e205c9b52ddd9b6c903d04f1936aac15a36df"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"0b77cd0bbc7aac76f4d2f65e42d418730135fa02","unresolved":false,"context_lines":[{"line_number":24,"context_line":"* Other profiles can be used by exporting GENTOO_PROFILE with a valid profile."},{"line_number":25,"context_line":"  A list of valid profiles follows:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    default/linux/amd64/13.0"},{"line_number":28,"context_line":"    default/linux/amd64/13.0/no-multilib"},{"line_number":29,"context_line":"    hardened/linux/amd64"},{"line_number":30,"context_line":"    hardened/linux/amd64/no-multilib"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa69d971_5b1c5cc1","line":27,"in_reply_to":"fa69d971_decdf385","updated":"2016-01-07 15:27:15.000000000","message":"I would have to agree here. Anyone building gentoo images should see this and comprehend this immediately rather than having to figure out a different naming scheme","commit_id":"958e205c9b52ddd9b6c903d04f1936aac15a36df"}],"elements/gentoo/bin/install-packages":[{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"2f7465f565b4841f8738bde97087a55f6e4d6393","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/usr/bin/env bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"# Copyright 2015 Matthew Thode"},{"line_number":4,"context_line":"#"},{"line_number":5,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":6,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa69d971_d07e371a","line":3,"updated":"2016-01-11 19:42:00.000000000","message":"I dont think its 2015 anymore ;)","commit_id":"c51f67600db7cfa9407ebec5d6e6b8c836ffa152"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"2f7465f565b4841f8738bde97087a55f6e4d6393","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    exit 0"},{"line_number":33,"context_line":"}"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"fix_shm () {"},{"line_number":36,"context_line":"    if [[ \"${RUN_ONCE_SHM}\" \u003d\u003d \u00271\u0027 ]]; then"},{"line_number":37,"context_line":"        mv /dev/shm /dev/shm.orig"},{"line_number":38,"context_line":"        mkdir /dev/shm"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa69d971_d0acf789","line":35,"updated":"2016-01-11 19:42:00.000000000","message":"bashate E020 say the function should be declared as:\n\n    fix_shm {","commit_id":"c51f67600db7cfa9407ebec5d6e6b8c836ffa152"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"2f7465f565b4841f8738bde97087a55f6e4d6393","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    fi"},{"line_number":43,"context_line":"}"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"unfix_shm () {"},{"line_number":46,"context_line":"    if [[ \"${RUN_ONCE_SHM}\" \u003d\u003d \u00270\u0027 ]]; then"},{"line_number":47,"context_line":"        umount /dev/shm"},{"line_number":48,"context_line":"        rmdir /dev/shm"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa69d971_90cbdf52","line":45,"updated":"2016-01-11 19:42:00.000000000","message":"bashate E020 violation","commit_id":"c51f67600db7cfa9407ebec5d6e6b8c836ffa152"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"2f7465f565b4841f8738bde97087a55f6e4d6393","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    fi"},{"line_number":51,"context_line":"}"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"install_gentoo_packages () {"},{"line_number":54,"context_line":"    RUN_ONCE_SHM\u003d\u00271\u0027"},{"line_number":55,"context_line":"    fix_shm"},{"line_number":56,"context_line":"    emerge \"$@\""}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa69d971_b0c86356","line":53,"updated":"2016-01-11 19:42:00.000000000","message":"bashate E020 violation","commit_id":"c51f67600db7cfa9407ebec5d6e6b8c836ffa152"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"2f7465f565b4841f8738bde97087a55f6e4d6393","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"PKGS\u003d$@"},{"line_number":101,"context_line":"if [[ -n \"${MAP_ELEMENT:-}\" ]]; then"},{"line_number":102,"context_line":"    if ! PKGS\u003d\"$(pkg-map --element ${MAP_ELEMENT} ${@})\"; then"},{"line_number":103,"context_line":"        echo \"bin/pkg-map error. ${PKGS}\""},{"line_number":104,"context_line":"        exit 1"},{"line_number":105,"context_line":"    fi"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"fa69d971_f036db4f","line":102,"updated":"2016-01-11 19:42:00.000000000","message":"this if could be combined above.\n\nadditionally without using the [[ ]] double brackets this is being parsed by `test` (aka `[ ]`) which is different I believe. Though i could be wrong on that point, for consistent coding style and predictable results this should probably be in a [[ ]]","commit_id":"c51f67600db7cfa9407ebec5d6e6b8c836ffa152"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"d5b8a8176b317a2cff971c73ba93c9865267a337","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    exit 0"},{"line_number":33,"context_line":"}"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"fix_shm {"},{"line_number":36,"context_line":"    if [[ \"${RUN_ONCE_SHM}\" \u003d\u003d \u00271\u0027 ]]; then"},{"line_number":37,"context_line":"        mv /dev/shm /dev/shm.orig"},{"line_number":38,"context_line":"        mkdir /dev/shm"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"fa69d971_c52bd480","line":35,"updated":"2016-01-11 20:17:12.000000000","message":"Apologies, I missed the missing function declaration\n\n    function fix_shm {","commit_id":"a7b4673163cf67ce419c7d63b9c8988f3d7e91a2"}],"elements/gentoo/root.d/10-gentoo-image":[{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"9aada399c06954c55396558b62cca54af43d400a","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    exit 1"},{"line_number":46,"context_line":"fi"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"# NOTE(toabctl): if something changes here on the buildservice side, please"},{"line_number":49,"context_line":"# first ask in #opensuse-cloud on freenode before you change the format here!"},{"line_number":50,"context_line":"DIB_CLOUD_SOURCE\u003d${DIB_CLOUD_SOURCE:-\"http://gentoo.osuosl.org/releases/amd64/autobuilds/latest-stage4-amd64-${SIGNED_SOURCE_SUFFIX}.txt\"}"},{"line_number":51,"context_line":"BASE_IMAGE_FILE\u003d${BASE_IMAGE_FILE:-\"http://gentoo.osuosl.org/releases/amd64/autobuilds/$(curl ${DIB_CLOUD_SOURCE} -s | tail -n 1 | cut -d\\  -f 1)\"}"}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"fa69d971_fef0f7fe","line":48,"updated":"2016-01-05 22:17:37.000000000","message":"You may want to remove this comment since it references a SuSE IRC channel.","commit_id":"958e205c9b52ddd9b6c903d04f1936aac15a36df"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"ab02c206c5d26131ed06886353ecbd4e88e426e0","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    exit 1"},{"line_number":46,"context_line":"fi"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"# NOTE(toabctl): if something changes here on the buildservice side, please"},{"line_number":49,"context_line":"# first ask in #opensuse-cloud on freenode before you change the format here!"},{"line_number":50,"context_line":"DIB_CLOUD_SOURCE\u003d${DIB_CLOUD_SOURCE:-\"http://gentoo.osuosl.org/releases/amd64/autobuilds/latest-stage4-amd64-${SIGNED_SOURCE_SUFFIX}.txt\"}"},{"line_number":51,"context_line":"BASE_IMAGE_FILE\u003d${BASE_IMAGE_FILE:-\"http://gentoo.osuosl.org/releases/amd64/autobuilds/$(curl ${DIB_CLOUD_SOURCE} -s | tail -n 1 | cut -d\\  -f 1)\"}"}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"fa69d971_3ea3efb3","line":48,"in_reply_to":"fa69d971_fef0f7fe","updated":"2016-01-05 22:20:04.000000000","message":"heh, good point","commit_id":"958e205c9b52ddd9b6c903d04f1936aac15a36df"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"0d4297ad428a7e8d488356fea92af7b7f8bb0c8a","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${SIGNATURE_FILE}\" \"${CACHED_SIGNATURE_FILE}\""},{"line_number":60,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${BASE_IMAGE_FILE}\" \"${CACHED_FILE}\""},{"line_number":61,"context_line":"    pushd \"${DIB_IMAGE_CACHE}\""},{"line_number":62,"context_line":"    # import the key"},{"line_number":63,"context_line":"    echo \u0027-----BEGIN PGP PUBLIC KEY BLOCK-----"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    mQINBEqUWzgBEACXftaG+HVuSQBEqdpBIg2SOVgWW/KbCihO5wPOsdbM93e+psmb"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_d22fa39f","line":62,"updated":"2016-01-12 19:32:14.000000000","message":"Thanks for sticking with us while we get this done. I think I\u0027d personally use a static file, as this method makes it very hard for me, a reviewer, to compare it to the one that one actually gets from the Gentoo signer. Also, can you maybe assert where this key can be obtained and how it can be verified to be the correct one if it does get revoked and updated by Gentoo? I assume they publish the fingerprint + ID somewhere on an HTTPS website, which would be enough to close the loop IMO.","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"f17cceb85881aed0b8690e4a0d3a6e5b0b862c96","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${SIGNATURE_FILE}\" \"${CACHED_SIGNATURE_FILE}\""},{"line_number":60,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${BASE_IMAGE_FILE}\" \"${CACHED_FILE}\""},{"line_number":61,"context_line":"    pushd \"${DIB_IMAGE_CACHE}\""},{"line_number":62,"context_line":"    # import the key"},{"line_number":63,"context_line":"    echo \u0027-----BEGIN PGP PUBLIC KEY BLOCK-----"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    mQINBEqUWzgBEACXftaG+HVuSQBEqdpBIg2SOVgWW/KbCihO5wPOsdbM93e+psmb"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_46b6918b","line":62,"in_reply_to":"da6ed579_2be56608","updated":"2016-01-12 21:31:12.000000000","message":"btw, the only ones with write on that page are releng members and infra","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"be1d72e2c212ce7299c3c69e677b6d2b4c71e557","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${SIGNATURE_FILE}\" \"${CACHED_SIGNATURE_FILE}\""},{"line_number":60,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${BASE_IMAGE_FILE}\" \"${CACHED_FILE}\""},{"line_number":61,"context_line":"    pushd \"${DIB_IMAGE_CACHE}\""},{"line_number":62,"context_line":"    # import the key"},{"line_number":63,"context_line":"    echo \u0027-----BEGIN PGP PUBLIC KEY BLOCK-----"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    mQINBEqUWzgBEACXftaG+HVuSQBEqdpBIg2SOVgWW/KbCihO5wPOsdbM93e+psmb"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_2be56608","line":62,"in_reply_to":"da6ed579_d22fa39f","updated":"2016-01-12 20:38:47.000000000","message":"Ya, I\u0027ll add a note and switch to a file.  Not sure if we publish the keys themselves though.\n\nThe key is correct though... not sure if we have a non-wiki link.  verifying that gets into trust relationships, you could gpg mail to releng@gentoo.org and one of us could respond if you wanted.\n\nhttps://wiki.gentoo.org/wiki/Project:RelEng#Keys","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"0d4297ad428a7e8d488356fea92af7b7f8bb0c8a","unresolved":false,"context_lines":[{"line_number":143,"context_line":"    ////////////////////////////////////////////////////////////////"},{"line_number":144,"context_line":"    /////////////////////////////////////////////////////////w\u003d\u003d"},{"line_number":145,"context_line":"    \u003d1qLu"},{"line_number":146,"context_line":"    -----END PGP PUBLIC KEY BLOCK-----\u0027 | gpg --import"},{"line_number":147,"context_line":"    # check the sig file"},{"line_number":148,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""},{"line_number":149,"context_line":"    CACHED_SIGNING_KEY\u003d$(gpg --verify --keyid-format 0xLONG \"${CACHED_SIGNATURE_FILE}\" 2\u003e\u00261 | grep \u0027using RSA key\u0027 | awk \u0027{print $NF}\u0027)"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_f22c27ad","line":146,"updated":"2016-01-12 19:32:14.000000000","message":"This runs in the user\u0027s context, not inside any chroot, so you\u0027ve just imported it into the user\u0027s GPG keyring. That is a bit untidy. So I\u0027d suggest instead doing something like this:\n\n    GPGDIR\u003d$(mktemp -d -t)\n    gpg --no-default-keyring --keyring $GPGDIR/gentookeys.gpg --import \u003c sigfile\n    gpgv --keyring $GPGDIR/gentookeys.gpg \"${CACHED_SIGNATURE_FILE}\"\n    rm -rf $GPGDIR\n\nNote the use of gpgv, which provides a much simpler interface for jobs like this. We are relying on set -e to catch the failure above, but if you want to be more explicit, that\u0027s never a bad idea when verifying things for security purposes. :)","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"f17cceb85881aed0b8690e4a0d3a6e5b0b862c96","unresolved":false,"context_lines":[{"line_number":143,"context_line":"    ////////////////////////////////////////////////////////////////"},{"line_number":144,"context_line":"    /////////////////////////////////////////////////////////w\u003d\u003d"},{"line_number":145,"context_line":"    \u003d1qLu"},{"line_number":146,"context_line":"    -----END PGP PUBLIC KEY BLOCK-----\u0027 | gpg --import"},{"line_number":147,"context_line":"    # check the sig file"},{"line_number":148,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""},{"line_number":149,"context_line":"    CACHED_SIGNING_KEY\u003d$(gpg --verify --keyid-format 0xLONG \"${CACHED_SIGNATURE_FILE}\" 2\u003e\u00261 | grep \u0027using RSA key\u0027 | awk \u0027{print $NF}\u0027)"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_266b5d20","line":146,"in_reply_to":"da6ed579_10a453a4","updated":"2016-01-12 21:31:12.000000000","message":"I\u0027ve had to stick with --verify instead of gpgv though, but am still using a oneoff gpgdir","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"be1d72e2c212ce7299c3c69e677b6d2b4c71e557","unresolved":false,"context_lines":[{"line_number":143,"context_line":"    ////////////////////////////////////////////////////////////////"},{"line_number":144,"context_line":"    /////////////////////////////////////////////////////////w\u003d\u003d"},{"line_number":145,"context_line":"    \u003d1qLu"},{"line_number":146,"context_line":"    -----END PGP PUBLIC KEY BLOCK-----\u0027 | gpg --import"},{"line_number":147,"context_line":"    # check the sig file"},{"line_number":148,"context_line":"    gpg --verify \"${CACHED_SIGNATURE_FILE}\""},{"line_number":149,"context_line":"    CACHED_SIGNING_KEY\u003d$(gpg --verify --keyid-format 0xLONG \"${CACHED_SIGNATURE_FILE}\" 2\u003e\u00261 | grep \u0027using RSA key\u0027 | awk \u0027{print $NF}\u0027)"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_10a453a4","line":146,"in_reply_to":"da6ed579_f22c27ad","updated":"2016-01-12 20:38:47.000000000","message":"ya, was thinking about using a specific gpgdir for this.  Didn\u0027t know about gpgv, so I\u0027ll switch to that.","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"0d4297ad428a7e8d488356fea92af7b7f8bb0c8a","unresolved":false,"context_lines":[{"line_number":150,"context_line":"    if [[ \"${SIGNING_KEY}\" !\u003d \"${CACHED_SIGNING_KEY}\" ]]; then"},{"line_number":151,"context_line":"        echo \u0027invalid key\u0027"},{"line_number":152,"context_line":"        exit 1"},{"line_number":153,"context_line":"    fi"},{"line_number":154,"context_line":"    echo \u0027valid key used\u0027"},{"line_number":155,"context_line":"    CACHED_SHA512SUM\u003d$(grep -A1 -e \u0027SHA512\u0027 \"${CACHED_SIGNATURE_FILE}\" | grep -e \u0027tar.bz2$\u0027 | cut -d\\  -f 1)"},{"line_number":156,"context_line":"    ACTUAL_SHA512SUM\u003d$(sha512sum \"${CACHED_FILE}\" | cut -d\\  -f 1)"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_92184b86","line":153,"updated":"2016-01-12 19:32:14.000000000","message":"If you use the bastion keyring method I show above, you don\u0027t need to verify the key ID\u0027s match, since you know the only key ID is the one you just imported.","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"be1d72e2c212ce7299c3c69e677b6d2b4c71e557","unresolved":false,"context_lines":[{"line_number":150,"context_line":"    if [[ \"${SIGNING_KEY}\" !\u003d \"${CACHED_SIGNING_KEY}\" ]]; then"},{"line_number":151,"context_line":"        echo \u0027invalid key\u0027"},{"line_number":152,"context_line":"        exit 1"},{"line_number":153,"context_line":"    fi"},{"line_number":154,"context_line":"    echo \u0027valid key used\u0027"},{"line_number":155,"context_line":"    CACHED_SHA512SUM\u003d$(grep -A1 -e \u0027SHA512\u0027 \"${CACHED_SIGNATURE_FILE}\" | grep -e \u0027tar.bz2$\u0027 | cut -d\\  -f 1)"},{"line_number":156,"context_line":"    ACTUAL_SHA512SUM\u003d$(sha512sum \"${CACHED_FILE}\" | cut -d\\  -f 1)"}],"source_content_type":"application/x-shellscript","patch_set":10,"id":"da6ed579_90b603db","line":153,"in_reply_to":"da6ed579_92184b86","updated":"2016-01-12 20:38:47.000000000","message":"ack","commit_id":"c0edb4702a7a01bd330a4941f42bc3cbf9e50b9f"},{"author":{"_account_id":16133,"name":"Robin H. Johnson","email":"robbat2@gentoo.org","username":"robbat2"},"change_message_id":"0369480e4ef6d023f4733742c268bf9c5048c1ca","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    exit 1"},{"line_number":62,"context_line":"fi"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"DIB_CLOUD_SOURCE\u003d${DIB_CLOUD_SOURCE:-\"http://gentoo.osuosl.org/releases/amd64/autobuilds/latest-stage4-amd64-${SIGNED_SOURCE_SUFFIX}.txt\"}"},{"line_number":65,"context_line":"BASE_IMAGE_FILE\u003d${BASE_IMAGE_FILE:-\"http://gentoo.osuosl.org/releases/amd64/autobuilds/$(curl ${DIB_CLOUD_SOURCE} -s | tail -n 1 | cut -d\\  -f 1)\"}"},{"line_number":66,"context_line":"SIGNATURE_FILE\u003d\"${SIGNATURE_FILE:-${BASE_IMAGE_FILE}.DIGESTS.asc}\""},{"line_number":67,"context_line":"CACHED_FILE\u003d\"${DIB_IMAGE_CACHE}/${FILENAME_BASE}.tar.bz2\""}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da6ed579_fa01556b","line":64,"updated":"2016-01-12 23:31:51.000000000","message":"Please use the Gentoo Official distribution URLs, rather than relying on OSL:\ns,http://gentoo.osuosl.org/,http://distfiles.gentoo.org/,g","commit_id":"f408616642d632f6e6940d401e20ac25ea8938f7"},{"author":{"_account_id":16133,"name":"Robin H. Johnson","email":"robbat2@gentoo.org","username":"robbat2"},"change_message_id":"0369480e4ef6d023f4733742c268bf9c5048c1ca","unresolved":false,"context_lines":[{"line_number":75,"context_line":"    \"${TMP_HOOKS_PATH}\"/bin/cache-url \"${BASE_IMAGE_FILE}\" \"${CACHED_FILE}\""},{"line_number":76,"context_line":"    pushd \"${DIB_IMAGE_CACHE}\""},{"line_number":77,"context_line":"    # import the key"},{"line_number":78,"context_line":"    # this key can be verified at https://wiki.gentoo.org/wiki/Project:RelEng#Keys"},{"line_number":79,"context_line":"    GPGDIR\u003d$(mktemp -d -t)"},{"line_number":80,"context_line":"    gpg --no-default-keyring --keyring \"${GPGDIR}\"/gentookeys.gpg --import \"${ELEMENT_DIR}\"/gentoo-releng.gpg"},{"line_number":81,"context_line":"    # check the sig file"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"da6ed579_da357146","line":78,"updated":"2016-01-12 23:31:51.000000000","message":"The keyring can be downloaded from:\nhttps://dev.gentoo.org/~dolsen/releases/keyrings/gentoo-keys-*.tar.xz\nhttp://distfiles.gentoo.org/distfiles/gentoo-keys-*.tar.xz\nLook for .asc/.gpg signatures as well.","commit_id":"f408616642d632f6e6940d401e20ac25ea8938f7"},{"author":{"_account_id":6488,"name":"Clint Byrum","email":"clint@fewbar.com","username":"clint-fewbar"},"change_message_id":"31d2e301d009ec867325e1daebc2d15c8cc1a441","unresolved":false,"context_lines":[{"line_number":78,"context_line":"    # this key can be verified at one of the following places"},{"line_number":79,"context_line":"    # https://wiki.gentoo.org/wiki/Project:RelEng#Keys"},{"line_number":80,"context_line":"    # https://dev.gentoo.org/~dolsen/releases/keyrings/gentoo-keys-*.tar.xz"},{"line_number":81,"context_line":"    # http://distfiles.gentoo.org/distfiles/gentoo-keys-*.tar.xz"},{"line_number":82,"context_line":"    GPGDIR\u003d$(mktemp -d -t)"},{"line_number":83,"context_line":"    gpg --no-default-keyring --keyring \"${GPGDIR}\"/gentookeys.gpg --import \"${ELEMENT_DIR}\"/gentoo-releng.gpg"},{"line_number":84,"context_line":"    # check the sig file"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"da6ed579_9feefeb2","line":81,"updated":"2016-01-13 05:57:32.000000000","message":"FYI, a keyring behind https is basically as good as an embedded GPG key in terms of tamper-proofing, since it\u0027s most likely the way diskimage-builder is fetched by distro makers is https://git.openstack.org/, though they _can_ take the time to verify the signed git tags. So if this key ever needs updating, we might just change this code to fetch over https (with explicit assertion of cert verification using system maintained CA certs, of course).","commit_id":"176ae7bff61818079cb21ce9c999978ac7fcea26"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"6a0c31dbc9fea11499331747b7875f9501a66f36","unresolved":false,"context_lines":[{"line_number":78,"context_line":"    # this key can be verified at one of the following places"},{"line_number":79,"context_line":"    # https://wiki.gentoo.org/wiki/Project:RelEng#Keys"},{"line_number":80,"context_line":"    # https://dev.gentoo.org/~dolsen/releases/keyrings/gentoo-keys-*.tar.xz"},{"line_number":81,"context_line":"    # http://distfiles.gentoo.org/distfiles/gentoo-keys-*.tar.xz"},{"line_number":82,"context_line":"    GPGDIR\u003d$(mktemp -d -t)"},{"line_number":83,"context_line":"    gpg --no-default-keyring --keyring \"${GPGDIR}\"/gentookeys.gpg --import \"${ELEMENT_DIR}\"/gentoo-releng.gpg"},{"line_number":84,"context_line":"    # check the sig file"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"da6ed579_9f8fdecb","line":81,"in_reply_to":"da6ed579_9feefeb2","updated":"2016-01-13 06:04:50.000000000","message":"the most likely way to get those keys is via emerge, the manifests are from signed commits and signed pushes.  Since distfiles.gentoo.org rotates we can\u0027t have it be https:// all the time.","commit_id":"176ae7bff61818079cb21ce9c999978ac7fcea26"}]}