)]}'
{"doc/source/signature.rst":[{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"f9abe1f5572b9fda3e60220e1f0193e89bd0c9f4","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Glance can be given a signature to validate the image against to make"},{"line_number":21,"context_line":"sure the image has not changed since its last use."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Requirements"},{"line_number":24,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_f93b5ccf","line":21,"updated":"2016-06-23 10:04:16.000000000","message":"For this purpose checksums are usually used. Signatures are used for validating origin.","commit_id":"8490417f13947c9e4c96924d08ffde2a5dabadf5"},{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"f9abe1f5572b9fda3e60220e1f0193e89bd0c9f4","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"  $ image_signature\u003d$(cat myimage.signature.b64)"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Upload your cert::"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"  $ openstack secret store --name test --algorithm RSA --expiration 2016-06-29 --secret-type certificate --payload-content-type \"application/octet-stream\" --payload-content-encoding base64 --payload \"$(base64 new_cert.crt)\""},{"line_number":104,"context_line":"  +---------------+-----------------------------------------------------------------------+"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_599f10b4","line":101,"updated":"2016-06-23 10:04:16.000000000","message":"This step seems should be just after image generated.","commit_id":"8490417f13947c9e4c96924d08ffde2a5dabadf5"},{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"f9abe1f5572b9fda3e60220e1f0193e89bd0c9f4","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Create the image::"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  $ glance image-create --name mySignedImage --container-format bare --disk-format qcow2 --property img_signature\u003d\"$image_signature\" --property img_signature_certificate_uuid\u003d\"$cert_uuid\" --property img_signature_hash_method\u003d\u0027SHA-256\u0027 --property img_signature_key_type\u003d\u0027RSA-PSS\u0027 \u003c myimage"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Other Links"},{"line_number":116,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_99805848","line":113,"updated":"2016-06-23 10:04:16.000000000","message":"It would be nice to know how to image signature can be validated.","commit_id":"8490417f13947c9e4c96924d08ffde2a5dabadf5"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"c837becf3ffe6a7e4e03c8a000d6b7baf526bc99","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Create the image::"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  $ glance image-create --name mySignedImage --container-format bare --disk-format qcow2 --property img_signature\u003d\"$image_signature\" --property img_signature_certificate_uuid\u003d\"$cert_uuid\" --property img_signature_hash_method\u003d\u0027SHA-256\u0027 --property img_signature_key_type\u003d\u0027RSA-PSS\u0027 \u003c myimage"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Other Links"},{"line_number":116,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_ddcbe951","line":113,"in_reply_to":"3aaa91ec_99805848","updated":"2016-06-23 11:08:58.000000000","message":"What do you mean by this? The image signature that you generated against the image?","commit_id":"8490417f13947c9e4c96924d08ffde2a5dabadf5"},{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"f5666222f2cd7aa651c2387b94fafc5ba6d47e66","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Create the image::"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  $ glance image-create --name mySignedImage --container-format bare --disk-format qcow2 --property img_signature\u003d\"$image_signature\" --property img_signature_certificate_uuid\u003d\"$cert_uuid\" --property img_signature_hash_method\u003d\u0027SHA-256\u0027 --property img_signature_key_type\u003d\u0027RSA-PSS\u0027 \u003c myimage"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Other Links"},{"line_number":116,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_602ccc02","line":113,"in_reply_to":"3aaa91ec_ddcbe951","updated":"2016-06-23 11:27:40.000000000","message":"How do I know if signature is valid.","commit_id":"8490417f13947c9e4c96924d08ffde2a5dabadf5"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0e1cf949fe2f1e7f552bd90b2f6341f272a8a67c","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Current ones you can use are:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* RSA-PSS"},{"line_number":60,"context_line":"* DSA"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Property img_signature_certificate_uuid"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3aaa91ec_111b8674","line":59,"updated":"2016-06-29 13:56:41.000000000","message":"How about ECC CURVES?\nThey are supported AFAIU.","commit_id":"0a6de0d339aed6936bcf63843d7bf772f0337cf8"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0e1cf949fe2f1e7f552bd90b2f6341f272a8a67c","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Property img_signature_certificate_uuid"},{"line_number":63,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":64,"context_line":"Certificates that you use."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Supported:"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3aaa91ec_7122caa4","line":64,"updated":"2016-06-29 13:56:41.000000000","message":"So it is not certificate but rather id of certificate.","commit_id":"0a6de0d339aed6936bcf63843d7bf772f0337cf8"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0e1cf949fe2f1e7f552bd90b2f6341f272a8a67c","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Supported:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* X_509"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Example Usage"},{"line_number":71,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3aaa91ec_b13f12b3","line":68,"updated":"2016-06-29 13:56:41.000000000","message":"The format of this property is UUID.","commit_id":"0a6de0d339aed6936bcf63843d7bf772f0337cf8"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"442291d68bc1a73b002955c0092b4cf15719595c","unresolved":false,"context_lines":[{"line_number":59,"context_line":"* RSA-PSS"},{"line_number":60,"context_line":"* DSA"},{"line_number":61,"context_line":"* ECC-CURVES"},{"line_number":62,"context_line":"  * SECT571K1"},{"line_number":63,"context_line":"  * SECT409K1"},{"line_number":64,"context_line":"  * SECT571R1"},{"line_number":65,"context_line":"  * SECT409R1"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3aaa91ec_77b757d8","line":62,"updated":"2016-06-29 15:12:39.000000000","message":"Looks like you need 2 spaces here.","commit_id":"c6566c55f5c60cca040743b2ff3926f8513870fd"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"e5775ac170a4e2db2c3ec485e28fb0576d23d2da","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Glance can be given a signature to validate the origin of the image and"},{"line_number":21,"context_line":"it is in fact the image that was created with a certain certificate."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Requirements"},{"line_number":24,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_4b01cc05","line":21,"updated":"2016-06-29 19:49:28.000000000","message":"I think this could be a bit more clear.  Maybe something like:\n\nGlance has the ability to perform advanced image validation using a digital signature and asymmetric cryptography.  To trigger this, you must define specific custom image properties (described below), and have stored a certificate signed with your private key in a local Barbican installation.\n\nWhen the image properties described below exist on an image, Glance will validate the uploaded image data against these properties before storing it.  If validation is not successful, the upload will fail.\n\nAdditionally, the image properties may be used by other services (for example, Nova) to perform data verification when the image is downloaded from Glance.","commit_id":"cf80d5b110287fc6871ffb64436691c2bc9fe85a"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"e5775ac170a4e2db2c3ec485e28fb0576d23d2da","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Property img_signature"},{"line_number":39,"context_line":"~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":40,"context_line":"This is the signature of your image."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Property img_signature_hash_method"},{"line_number":43,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_981828d5","line":40,"updated":"2016-06-29 19:49:28.000000000","message":"It would be good to mention the 255-char limit on signature length here.","commit_id":"cf80d5b110287fc6871ffb64436691c2bc9fe85a"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"e5775ac170a4e2db2c3ec485e28fb0576d23d2da","unresolved":false,"context_lines":[{"line_number":121,"context_line":"Get an image and create the signature::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"  $ echo This is a dodgy image \u003e myimage"},{"line_number":124,"context_line":"  This is a legit image"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  $ openssl dgst -sha256 -sign private_key.pem -sigopt rsa_padding_mode:pss -out myimage.signature myimage"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_757585f8","line":124,"range":{"start_line":124,"start_character":2,"end_line":124,"end_character":23},"updated":"2016-06-29 19:49:28.000000000","message":"This line wouldn\u0027t be output from the prior command; is it left over from an earlier edit?","commit_id":"cf80d5b110287fc6871ffb64436691c2bc9fe85a"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"e5775ac170a4e2db2c3ec485e28fb0576d23d2da","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Create the image::"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"  $ glance image-create --name mySignedImage --container-format bare --disk-format qcow2 --property img_signature\u003d\"$image_signature\" --property img_signature_certificate_uuid\u003d\"$cert_uuid\" --property img_signature_hash_method\u003d\u0027SHA-256\u0027 --property img_signature_key_type\u003d\u0027RSA-PSS\u0027 \u003c myimage"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Other Links"},{"line_number":137,"context_line":"-----------"},{"line_number":138,"context_line":"* https://etherpad.openstack.org/p/mitaka-glance-image-signing-instructions"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_8e058212","line":135,"updated":"2016-06-29 19:49:28.000000000","message":"You might want to mention that this call will fail if the validation doesn\u0027t succeed.","commit_id":"cf80d5b110287fc6871ffb64436691c2bc9fe85a"}]}